[thirdparty/openssl.git] / CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 0.9.6 and 0.9.7  [xx XXX 2000]

  *) New function BN_swap.
     [Bodo Moeller]

  *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
     the exponentiation functions are more likely to produce reasonable
     results on negative inputs.
     [Bodo Moeller]

  *) Change BN_mod_mul so that the result is always non-negative.
     Previously, it could be negative if one of the factors was negative;
     I don't think anyone really wanted that behaviour.
     [Bodo Moeller]

  *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
     (except for exponentation, which stays in crypto/bn/bn_exp.c,
     and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
     and add new functions:

          BN_nnmod
          BN_mod_sqr
          BN_mod_add
          BN_mod_add_quick
          BN_mod_sub
          BN_mod_sub_quick
          BN_mod_lshift1
          BN_mod_lshift1_quick
          BN_mod_lshift
          BN_mod_lshift_quick

     These functions always generate non-negative results.

     BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
     such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).

     BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
     BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
     be reduced modulo  m.
     [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]

  *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
     was actually never needed) and in BN_mul().  The removal in BN_mul()
     required a small change in bn_mul_part_recursive() and the addition
     of the static functions bn_cmp_part_words(), bn_sub_part_words()
     and bn_add_part_words() which do the same thing as bn_cmp_words(),
     bn_sub_words() and bn_add_words() except they take arrays with
     differing sizes.
     [Richard Levitte]

  *) In 'openssl passwd', verify passwords read from the terminal
     unless the '-salt' option is used (which usually means that
     verification would just waste user's time since the resulting
     hash is going to be compared with some given password hash)
     or the new '-noverify' option is used.

     This is an incompatible change, but it does not affect
     non-interactive use of 'openssl passwd' (passwords on the command
     line, '-stdin' option, '-in ...' option) and thus should not
     cause any problems.
     [Bodo Moeller]

  *) Remove all references to RSAref, since there's no more need for it.
     [Richard Levitte]

  *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
     The previous value, 12, was not always sufficient for BN_mod_exp().
     [Bodo Moeller]

  *) Make DSO load along a path given through an environment variable
     (SHLIB_PATH) with shl_load().
     [Richard Levitte]

  *) Constify the ENGINE code as a result of BIGNUM constification.
     Also constify the RSA code and most things related to it.  In a
     few places, most notable in the depth of the ASN.1 code, ugly
     casts back to non-const were required (to be solved at a later
     time)
     [Richard Levitte]

  *) Make it so the openssl application has all engines loaded by default.
     [Richard Levitte]

  *) Constify the BIGNUM routines a little more.
     [Richard Levitte]

  *) Make sure that shared libraries get the internal name engine with
     the full version number and not just 0.  This should mark the
     shared libraries as not backward compatible.  Of course, this should
     be changed again when we can guarantee backward binary compatibility.
     [Richard Levitte]

  *) Add the following functions:

	ENGINE_load_cswift()
	ENGINE_load_chil()
	ENGINE_load_atalla()
	ENGINE_load_nuron()
	ENGINE_load_builtin_engines()

     That way, an application can itself choose if external engines that
     are built-in in OpenSSL shall ever be used or not.  The benefit is
     that applications won't have to be linked with libdl or other dso
     libraries unless it's really needed.

     Changed 'openssl engine' to load all engines on demand.
     Changed the engine header files to avoid the duplication of some
     declarations (they differed!).
     [Richard Levitte]

  *) 'openssl engine' can now list capabilities.
     [Richard Levitte]

  *) Better error reporting in 'openssl engine'.
     [Richard Levitte]

  *) Never call load_dh_param(NULL) in s_server.
     [Bodo Moeller]

  *) Add engine application.  It can currently list engines by name and
     identity, and test if they are actually available.
     [Richard Levitte]

  *) Add support for shared libraries under Irix.
     [Albert Chin-A-Young <china@thewrittenword.com>]

  *) Improve RPM specification file by forcing symbolic linking and making
     sure the installed documentation is also owned by root.root.
     [Damien Miller <djm@mindrot.org>]

  *) Add configuration option to build on Linux on both big-endian and
     little-endian MIPS.
     [Ralf Baechle <ralf@uni-koblenz.de>]

  *) Give the OpenSSL applications more possibilities to make use of
     keys (public as well as private) handled by engines.
     [Richard Levitte]

  *) Add OCSP code that comes from CertCo.
     [Richard Levitte]

  *) Add VMS support for the Rijndael code.
     [Richard Levitte]

  *) Added untested support for Nuron crypto accelerator.
     [Ben Laurie]

  *) Add support for external cryptographic devices.  This code was
     previously distributed separately as the "engine" branch.
     [Geoff Thorpe, Richard Levitte]

  *) Rework the filename-translation in the DSO code. It is now possible to
     have far greater control over how a "name" is turned into a filename
     depending on the operating environment and any oddities about the
     different shared library filenames on each system.
     [Geoff Thorpe]

  *) Support threads on FreeBSD-elf in Configure.
     [Richard Levitte]

  *) Add the possibility to create shared libraries on HP-UX
     [Richard Levitte]

  *) Fix for SHA1 assembly problem with MASM: it produces
     warnings about corrupt line number information when assembling
     with debugging information. This is caused by the overlapping
     of two sections.
     [Bernd Matthes <mainbug@celocom.de>, Steve Henson]

  *) NCONF changes.
     NCONF_get_number() has no error checking at all.  As a replacement,
     NCONF_get_number_e() is defined (_e for "error checking") and is
     promoted strongly.  The old NCONF_get_number is kept around for
     binary backward compatibility.
     Make it possible for methods to load from something other than a BIO,
     by providing a function pointer that is given a name instead of a BIO.
     For example, this could be used to load configuration data from an
     LDAP server.
     [Richard Levitte]

  *) Fix typo in get_cert_by_subject() in by_dir.c
     [Jean-Marc Desperrier <jean-marc.desperrier@certplus.com>]

  *) Rework the system to generate shared libraries:

     - Make note of the expected extension for the shared libraries and
       if there is a need for symbolic links from for example libcrypto.so.0
       to libcrypto.so.0.9.7.  There is extended info in Configure for
       that.

     - Make as few rebuilds of the shared libraries as possible.

     - Still avoid linking the OpenSSL programs with the shared libraries.

     - When installing, install the shared libraries separately from the
       static ones.
     [Richard Levitte]

  *) Fix for non blocking accept BIOs. Added new I/O special reason
     BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
     with non blocking I/O was not possible because no retry code was
     implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
     this case.
     [Steve Henson]

  *) Added the beginnings of Rijndael support.
     [Ben Laurie]

  *) Fix for bug in DirectoryString mask setting. Add support for
     X509_NAME_print_ex() in 'req' and X509_print_ex() function
     to allow certificate printing to more controllable, additional
     'certopt' option to 'x509' to allow new printing options to be
     set.
     [Steve Henson]

  *) Clean old EAY MD5 hack from e_os.h.
     [Richard Levitte]

  *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.

     Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
     and not in SSL_clear because the latter is also used by the
     accept/connect functions; previously, the settings made by
     SSL_set_read_ahead would be lost during the handshake.
     [Bodo Moeller; problems reported by Anders Gertz <gertz@epact.se>]     

  *) Correct util/mkdef.pl to be selective about disabled algorithms.
     Previously, it would create entries for disableed algorithms no
     matter what.
     [Richard Levitte]

 Changes between 0.9.5a and 0.9.6  [24 Sep 2000]

  *) In ssl23_get_client_hello, generate an error message when faced
     with an initial SSL 3.0/TLS record that is too small to contain the
     first two bytes of the ClientHello message, i.e. client_version.
     (Note that this is a pathologic case that probably has never happened
     in real life.)  The previous approach was to use the version number
     from the record header as a substitute; but our protocol choice
     should not depend on that one because it is not authenticated
     by the Finished messages.
     [Bodo Moeller]

  *) More robust randomness gathering functions for Windows.
     [Jeffrey Altman <jaltman@columbia.edu>]

  *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
     not set then we don't setup the error code for issuer check errors
     to avoid possibly overwriting other errors which the callback does
     handle. If an application does set the flag then we assume it knows
     what it is doing and can handle the new informational codes
     appropriately.
     [Steve Henson]

  *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
     a general "ANY" type, as such it should be able to decode anything
     including tagged types. However it didn't check the class so it would
     wrongly interpret tagged types in the same way as their universal
     counterpart and unknown types were just rejected. Changed so that the
     tagged and unknown types are handled in the same way as a SEQUENCE:
     that is the encoding is stored intact. There is also a new type
     "V_ASN1_OTHER" which is used when the class is not universal, in this
     case we have no idea what the actual type is so we just lump them all
     together.
     [Steve Henson]

  *) On VMS, stdout may very well lead to a file that is written to
     in a record-oriented fashion.  That means that every write() will
     write a separate record, which will be read separately by the
     programs trying to read from it.  This can be very confusing.

     The solution is to put a BIO filter in the way that will buffer
     text until a linefeed is reached, and then write everything a
     line at a time, so every record written will be an actual line,
     not chunks of lines and not (usually doesn't happen, but I've
     seen it once) several lines in one record.  BIO_f_linebuffer() is
     the answer.

     Currently, it's a VMS-only method, because that's where it has
     been tested well enough.
     [Richard Levitte]

  *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
     it can return incorrect results.
     (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
     but it was in 0.9.6-beta[12].)
     [Bodo Moeller]

  *) Disable the check for content being present when verifying detached
     signatures in pk7_smime.c. Some versions of Netscape (wrongly)
     include zero length content when signing messages.
     [Steve Henson]

  *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
     BIO_ctrl (for BIO pairs).
Commit	Line	Data
f1c236f8	1	OpenSSL CHANGES
651d0aff RE	2	_______________
651d0aff RE	3
c5e8580e RL	4	Changes between 0.9.6 and 0.9.7 [xx XXX 2000]
c5e8580e RL	5
78a0c1f1 BM	6	*) New function BN_swap.
	7	[Bodo Moeller]
	8
	9	*) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
	10	the exponentiation functions are more likely to produce reasonable
	11	results on negative inputs.
	12	[Bodo Moeller]
	13
	14	*) Change BN_mod_mul so that the result is always non-negative.
	15	Previously, it could be negative if one of the factors was negative;
	16	I don't think anyone really wanted that behaviour.
	17	[Bodo Moeller]
	18
	19	*) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
	20	(except for exponentation, which stays in crypto/bn/bn_exp.c,
	21	and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
	22	and add new functions:
5acaa495	23
78a0c1f1 BM	24	BN_nnmod
	25	BN_mod_sqr
	26	BN_mod_add
5acaa495	27	BN_mod_add_quick
78a0c1f1	28	BN_mod_sub
5acaa495 BM	29	BN_mod_sub_quick
	30	BN_mod_lshift1
	31	BN_mod_lshift1_quick
	32	BN_mod_lshift
	33	BN_mod_lshift_quick
	34
78a0c1f1	35	These functions always generate non-negative results.
5acaa495	36
78a0c1f1 BM	37	BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder r
78a0c1f1 BM	38	such that \|m\| < r < 0, BN_nnmod will output rem + \|m\| instead).
5acaa495 BM	39
	40	BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
	41	BN_mod_XXX(r, a, [b,] m, ctx), but requires that a [and b]
	42	be reduced modulo m.
78a0c1f1 BM	43	[Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
78a0c1f1 BM	44
baa257f1 RL	45	*) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
	46	was actually never needed) and in BN_mul(). The removal in BN_mul()
	47	required a small change in bn_mul_part_recursive() and the addition
	48	of the static functions bn_cmp_part_words(), bn_sub_part_words()
	49	and bn_add_part_words() which do the same thing as bn_cmp_words(),
	50	bn_sub_words() and bn_add_words() except they take arrays with
	51	differing sizes.
	52	[Richard Levitte]
	53
db70a3fd BM	54	*) In 'openssl passwd', verify passwords read from the terminal
	55	unless the '-salt' option is used (which usually means that
	56	verification would just waste user's time since the resulting
	57	hash is going to be compared with some given password hash)
	58	or the new '-noverify' option is used.
	59
	60	This is an incompatible change, but it does not affect
	61	non-interactive use of 'openssl passwd' (passwords on the command
	62	line, '-stdin' option, '-in ...' option) and thus should not
	63	cause any problems.
	64	[Bodo Moeller]
	65
ccb9643f RL	66	*) Remove all references to RSAref, since there's no more need for it.
	67	[Richard Levitte]
	68
7f7b8d68 BM	69	*) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
	70	The previous value, 12, was not always sufficient for BN_mod_exp().
	71	[Bodo Moeller]
	72
e06433d9 RL	73	*) Make DSO load along a path given through an environment variable
	74	(SHLIB_PATH) with shl_load().
	75	[Richard Levitte]
	76
10e473e9	77	*) Constify the ENGINE code as a result of BIGNUM constification.
55b3c877 RL	78	Also constify the RSA code and most things related to it. In a
	79	few places, most notable in the depth of the ASN.1 code, ugly
	80	casts back to non-const were required (to be solved at a later
	81	time)
10e473e9 RL	82	[Richard Levitte]
10e473e9 RL	83
e7ef1a56 RL	84	*) Make it so the openssl application has all engines loaded by default.
	85	[Richard Levitte]
	86
020fc820 RL	87	*) Constify the BIGNUM routines a little more.
	88	[Richard Levitte]
	89
6b77e6d7 RL	90	*) Make sure that shared libraries get the internal name engine with
	91	the full version number and not just 0. This should mark the
	92	shared libraries as not backward compatible. Of course, this should
	93	be changed again when we can guarantee backward binary compatibility.
	94	[Richard Levitte]
	95
11c0f120 RL	96	*) Add the following functions:
	97
	98	ENGINE_load_cswift()
	99	ENGINE_load_chil()
	100	ENGINE_load_atalla()
	101	ENGINE_load_nuron()
	102	ENGINE_load_builtin_engines()
	103
	104	That way, an application can itself choose if external engines that
	105	are built-in in OpenSSL shall ever be used or not. The benefit is
	106	that applications won't have to be linked with libdl or other dso
	107	libraries unless it's really needed.
	108
	109	Changed 'openssl engine' to load all engines on demand.
	110	Changed the engine header files to avoid the duplication of some
	111	declarations (they differed!).
	112	[Richard Levitte]
	113
69e7805f RL	114	*) 'openssl engine' can now list capabilities.
	115	[Richard Levitte]
	116
e264cfe1 RL	117	*) Better error reporting in 'openssl engine'.
	118	[Richard Levitte]
	119
15d52ddb BM	120	*) Never call load_dh_param(NULL) in s_server.
	121	[Bodo Moeller]
	122
14c6d27d RL	123	*) Add engine application. It can currently list engines by name and
	124	identity, and test if they are actually available.
	125	[Richard Levitte]
	126
dcea8e12 RL	127	*) Add support for shared libraries under Irix.
	128	[Albert Chin-A-Young <china@thewrittenword.com>]
	129
501ebf16 RL	130	*) Improve RPM specification file by forcing symbolic linking and making
	131	sure the installed documentation is also owned by root.root.
	132	[Damien Miller <djm@mindrot.org>]
	133
815c83f7 RL	134	*) Add configuration option to build on Linux on both big-endian and
	135	little-endian MIPS.
	136	[Ralf Baechle <ralf@uni-koblenz.de>]
	137
3aba98e7 RL	138	*) Give the OpenSSL applications more possibilities to make use of
	139	keys (public as well as private) handled by engines.
	140	[Richard Levitte]
	141
7c155330 RL	142	*) Add OCSP code that comes from CertCo.
	143	[Richard Levitte]
	144
34a14882	145	*) Add VMS support for the Rijndael code.
5270e702 RL	146	[Richard Levitte]
	147
	148	*) Added untested support for Nuron crypto accelerator.
	149	[Ben Laurie]
	150
	151	*) Add support for external cryptographic devices. This code was
	152	previously distributed separately as the "engine" branch.
	153	[Geoff Thorpe, Richard Levitte]
	154
1df586be GT	155	*) Rework the filename-translation in the DSO code. It is now possible to
	156	have far greater control over how a "name" is turned into a filename
	157	depending on the operating environment and any oddities about the
	158	different shared library filenames on each system.
	159	[Geoff Thorpe]
	160
53400da7 RL	161	*) Support threads on FreeBSD-elf in Configure.
	162	[Richard Levitte]
	163
0fd44e2d RL	164	*) Add the possibility to create shared libraries on HP-UX
	165	[Richard Levitte]
	166
627ec355 DSH	167	*) Fix for SHA1 assembly problem with MASM: it produces
	168	warnings about corrupt line number information when assembling
	169	with debugging information. This is caused by the overlapping
	170	of two sections.
	171	[Bernd Matthes <mainbug@celocom.de>, Steve Henson]
	172
567f17cf RL	173	*) NCONF changes.
	174	NCONF_get_number() has no error checking at all. As a replacement,
	175	NCONF_get_number_e() is defined (_e for "error checking") and is
	176	promoted strongly. The old NCONF_get_number is kept around for
	177	binary backward compatibility.
	178	Make it possible for methods to load from something other than a BIO,
	179	by providing a function pointer that is given a name instead of a BIO.
	180	For example, this could be used to load configuration data from an
	181	LDAP server.
	182	[Richard Levitte]
	183
71d525c9 DSH	184	*) Fix typo in get_cert_by_subject() in by_dir.c
	185	[Jean-Marc Desperrier <jean-marc.desperrier@certplus.com>]
	186
a22fb399 RL	187	*) Rework the system to generate shared libraries:
	188
	189	- Make note of the expected extension for the shared libraries and
	190	if there is a need for symbolic links from for example libcrypto.so.0
	191	to libcrypto.so.0.9.7. There is extended info in Configure for
	192	that.
	193
	194	- Make as few rebuilds of the shared libraries as possible.
	195
	196	- Still avoid linking the OpenSSL programs with the shared libraries.
	197
	198	- When installing, install the shared libraries separately from the
	199	static ones.
	200	[Richard Levitte]
	201
924046ce DSH	202	*) Fix for non blocking accept BIOs. Added new I/O special reason
	203	BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
	204	with non blocking I/O was not possible because no retry code was
	205	implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
	206	this case.
	207	[Steve Henson]
	208
3ab56511 RL	209	*) Added the beginnings of Rijndael support.
	210	[Ben Laurie]
	211
d0c98589	212	*) Fix for bug in DirectoryString mask setting. Add support for
8ca533e3 DSH	213	X509_NAME_print_ex() in 'req' and X509_print_ex() function
	214	to allow certificate printing to more controllable, additional
	215	'certopt' option to 'x509' to allow new printing options to be
	216	set.
d0c98589 DSH	217	[Steve Henson]
d0c98589 DSH	218
ef71cb6d RL	219	*) Clean old EAY MD5 hack from e_os.h.
	220	[Richard Levitte]
	221
3a0afe1e BM	222	*) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
	223
	224	Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
	225	and not in SSL_clear because the latter is also used by the
	226	accept/connect functions; previously, the settings made by
	227	SSL_set_read_ahead would be lost during the handshake.
	228	[Bodo Moeller; problems reported by Anders Gertz <gertz@epact.se>]
	229
88aeb646 RL	230	*) Correct util/mkdef.pl to be selective about disabled algorithms.
	231	Previously, it would create entries for disableed algorithms no
	232	matter what.
	233	[Richard Levitte]
c5e8580e	234
0e8f2fdf	235	Changes between 0.9.5a and 0.9.6 [24 Sep 2000]
bbb72003	236
f1192b7f BM	237	*) In ssl23_get_client_hello, generate an error message when faced
	238	with an initial SSL 3.0/TLS record that is too small to contain the
	239	first two bytes of the ClientHello message, i.e. client_version.
	240	(Note that this is a pathologic case that probably has never happened
	241	in real life.) The previous approach was to use the version number
5a5accdd	242	from the record header as a substitute; but our protocol choice
f1192b7f BM	243	should not depend on that one because it is not authenticated
	244	by the Finished messages.
	245	[Bodo Moeller]
	246
d49da3aa UM	247	*) More robust randomness gathering functions for Windows.
	248	[Jeffrey Altman <jaltman@columbia.edu>]
	249
dbba890c DSH	250	*) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
	251	not set then we don't setup the error code for issuer check errors
	252	to avoid possibly overwriting other errors which the callback does
	253	handle. If an application does set the flag then we assume it knows
	254	what it is doing and can handle the new informational codes
	255	appropriately.
	256	[Steve Henson]
	257
6cffb201 DSH	258	*) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
	259	a general "ANY" type, as such it should be able to decode anything
	260	including tagged types. However it didn't check the class so it would
	261	wrongly interpret tagged types in the same way as their universal
	262	counterpart and unknown types were just rejected. Changed so that the
	263	tagged and unknown types are handled in the same way as a SEQUENCE:
	264	that is the encoding is stored intact. There is also a new type
	265	"V_ASN1_OTHER" which is used when the class is not universal, in this
	266	case we have no idea what the actual type is so we just lump them all
	267	together.
	268	[Steve Henson]
	269
645749ef RL	270	*) On VMS, stdout may very well lead to a file that is written to
	271	in a record-oriented fashion. That means that every write() will
	272	write a separate record, which will be read separately by the
	273	programs trying to read from it. This can be very confusing.
	274
	275	The solution is to put a BIO filter in the way that will buffer
	276	text until a linefeed is reached, and then write everything a
	277	line at a time, so every record written will be an actual line,
	278	not chunks of lines and not (usually doesn't happen, but I've
	279	seen it once) several lines in one record. BIO_f_linebuffer() is
	280	the answer.
	281
	282	Currently, it's a VMS-only method, because that's where it has
	283	been tested well enough.
	284	[Richard Levitte]
	285
fe035197	286	*) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
a45bd295	287	it can return incorrect results.
cb1fbf8e BM	288	(Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
cb1fbf8e BM	289	but it was in 0.9.6-beta[12].)
a45bd295 BM	290	[Bodo Moeller]
a45bd295 BM	291
730e37ed DSH	292	*) Disable the check for content being present when verifying detached
	293	signatures in pk7_smime.c. Some versions of Netscape (wrongly)
	294	include zero length content when signing messages.
	295	[Steve Henson]
	296
07fcf422 BM	297	*) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
07fcf422 BM	298	BIO_ctrl (for BIO pairs).
d49da3aa	299