Don't unnecessarily tag ssl_cipher_is_deprecated as OPENSSL_EXPORT

We can just limit those tests to the static library build. This gets one
more unnecessary symbols out of a libssl.so symbol table.

Change-Id: I14121cd16e40e78b3b0549358aa7d348015fafe4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100488
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: Lily Chen <chlily@google.com>

ssl/internal.h

diff --git a/ssl/internal.h b/ssl/internal.h
index a59ded0..5454962 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -366,7 +366,7 @@
                                    enum ssl_compliance_policy_t policy);
 
 // ssl_cipher_is_deprecated returns true if `cipher` is deprecated.
-OPENSSL_EXPORT bool ssl_cipher_is_deprecated(const SSL_CIPHER *cipher);
+bool ssl_cipher_is_deprecated(const SSL_CIPHER *cipher);
 
 
 // Transcript layer.

ssl/ssl_test.cc

diff --git a/ssl/ssl_test.cc b/ssl/ssl_test.cc
index d0e633c..fc185ec 100644
--- a/ssl/ssl_test.cc
+++ b/ssl/ssl_test.cc
@@ -490,19 +490,6 @@
     "SHA1", "RSA",     "SSLv3", "TLSv1", "TLSv1.2",
 };
 
-static const struct {
-  const char *rule;
-  int expected_included_deprecated_count;
-} kDeprecatedCBCSHA256Rules[] = {
-    {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
-    {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
-    {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:TLS_ECDHE_RSA_WITH_AES_128_"
-     "CBC_SHA256",
-     2},
-};
-
 static const CurveTest kCurveTests[] = {
     {
         "P-256",
@@ -636,12 +623,27 @@
     ASSERT_TRUE(SSL_CTX_set_strict_cipher_list(ctx.get(), rule));
     for (const SSL_CIPHER *cipher : SSL_CTX_get_ciphers(ctx.get())) {
       EXPECT_NE(NID_undef, SSL_CIPHER_get_cipher_nid(cipher));
+#if !defined(BORINGSSL_SHARED_LIBRARY)
       EXPECT_FALSE(ssl_cipher_is_deprecated(cipher));
+#endif
     }
   }
 }
 
+#if !defined(BORINGSSL_SHARED_LIBRARY)
 TEST(SSLTest, CipherRulesDeprecated) {
+  static const struct {
+    const char *rule;
+    int expected_included_deprecated_count;
+  } kDeprecatedCBCSHA256Rules[] = {
+      {"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
+      {"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 1},
+      {"ALL:TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:"
+       "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+       2},
+  };
   for (const auto &test : kDeprecatedCBCSHA256Rules) {
     SCOPED_TRACE(test.rule);
     bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
@@ -657,6 +659,7 @@
     EXPECT_EQ(found, test.expected_included_deprecated_count);
   }
 }
+#endif  // BORINGSSL_SHARED_LIBRARY
 
 TEST(SSLTest, CurveRules) {
   for (const CurveTest &t : kCurveTests) {