lib/59071: libsaslc leaks private symbols

["Greg A. Woods" <woods%planix.ca@localhost>]

>Number:         59071
>Category:       lib
>Synopsis:       libsaslc leaks private symbols
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 12 03:55:00 +0000 2025
>Originator:     Greg A. Woods
>Release:        NetBSD current et all
>Organization:
Planix, Inc.; Kelowna, BC; Canada
>Environment:
>Description:
	libsaslc leaks private symbols
>How-To-Repeat:
	build with MKKERBEROS=no, observe saslc__mech_gssapi is missing
	from the expected symbols
>Fix:
	use -fvisibility=hidden, declare public symbols, update expected
	symbols list, (bump major?)

diff --git a/crypto/external/bsd/libsaslc/dist/include/saslc.h b/crypto/external/bsd/libsaslc/dist/include/saslc.h
index dea4de9cec19..f0992e5d9d39 100644
--- a/crypto/external/bsd/libsaslc/dist/include/saslc.h
+++ b/crypto/external/bsd/libsaslc/dist/include/saslc.h
@@ -64,27 +64,40 @@ typedef struct saslc_t saslc_t;
 typedef struct saslc_sess_t saslc_sess_t;
 
 /* begin and end */
+__attribute__((visibility("default")))
 saslc_t *saslc_alloc(void);
+__attribute__((visibility("default")))
 int saslc_init(saslc_t *, const char *, const char *);
+__attribute__((visibility("default")))
 int saslc_end(saslc_t *);
 
 /* error */
+__attribute__((visibility("default")))
 const char *saslc_strerror(saslc_t *);
+__attribute__((visibility("default")))
 const char *saslc_sess_strerror(saslc_sess_t *);
 
 /* session begin and end */
+__attribute__((visibility("default")))
 saslc_sess_t *saslc_sess_init(saslc_t *, const char *, const char *);
+__attribute__((visibility("default")))
 void saslc_sess_end(saslc_sess_t *);
 
 /* session properties */
+__attribute__((visibility("default")))
 int saslc_sess_setprop(saslc_sess_t *, const char *, const char *);
+__attribute__((visibility("default")))
 const char *saslc_sess_getprop(saslc_sess_t *, const char *);
+__attribute__((visibility("default")))
 const char *saslc_sess_getmech(saslc_sess_t *);
 
 /* session management */
+__attribute__((visibility("default")))
 int saslc_sess_cont(saslc_sess_t *, const void *, size_t, void **, size_t *);
+__attribute__((visibility("default")))
 ssize_t saslc_sess_encode(saslc_sess_t *, const void *, size_t, void **,
     size_t *);
+__attribute__((visibility("default")))
 ssize_t saslc_sess_decode(saslc_sess_t *, const void *, size_t, void **,
     size_t *);
 
diff --git a/crypto/external/bsd/libsaslc/lib/Makefile b/crypto/external/bsd/libsaslc/lib/Makefile
index 2b6233e9984e..af0dfab4e84a 100644
--- a/crypto/external/bsd/libsaslc/lib/Makefile
+++ b/crypto/external/bsd/libsaslc/lib/Makefile
@@ -28,6 +28,8 @@ SRCS+= xsess.c
 
 COPTS.msg.c = -Wno-format-nonliteral
 
+COPTS+= -fvisibility=hidden
+
 CPPFLAGS+=-I${EXTDIST}/include
 WARNS?=4
 
diff --git a/crypto/external/bsd/libsaslc/lib/saslc.expsym b/crypto/external/bsd/libsaslc/lib/saslc.expsym
index c953f30f0984..b110ca65c255 100644
--- a/crypto/external/bsd/libsaslc/lib/saslc.expsym
+++ b/crypto/external/bsd/libsaslc/lib/saslc.expsym
@@ -1,48 +1,4 @@
-saslc__buffer32_create
-saslc__buffer32_destroy
-saslc__buffer32_fetch
-saslc__buffer_create
-saslc__buffer_destroy
-saslc__buffer_fetch
-saslc__crypto_decode_base64
-saslc__crypto_encode_base64
-saslc__crypto_hash_to_hex
-saslc__crypto_hmac_md5_hash
-saslc__crypto_hmac_md5_hex
-saslc__crypto_md5_hash
-saslc__crypto_md5_hex
-saslc__crypto_nonce
-saslc__dict_create
-saslc__dict_destroy
-saslc__dict_get
-saslc__dict_get_len
-saslc__dict_insert
-saslc__dict_remove
-saslc__error_get_strerror
-saslc__list_append
-saslc__list_flags
-saslc__list_free
-saslc__list_log
-saslc__list_parse
-saslc__mech_anonymous
-saslc__mech_crammd5
-saslc__mech_digestmd5
-saslc__mech_external
-saslc__mech_generic_create
-saslc__mech_generic_destroy
-saslc__mech_gssapi
-saslc__mech_list_create
-saslc__mech_list_destroy
-saslc__mech_list_get
-saslc__mech_login
-saslc__mech_plain
-saslc__mech_qop_tbl
-saslc__mech_strdup
-saslc__msg_syslog
-saslc__parser_config
-saslc__parser_is_true
 saslc_alloc
-saslc_debug
 saslc_end
 saslc_init
 saslc_sess_cont