Fix undefined behaviour in e_aes_cbc_hmac_sha256.c and e_aes_cbc_hmac_sha1.c

[openssl.git] / INSTALL

diff --git a/INSTALL b/INSTALL
index 64055ac27c2c86bbad41d4596ba65c3c89c0c8c0..3deb7ff9fcc85622ae42e27c02c6081505c04ba3 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -116,6 +116,11 @@
 
     $ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
 
+ (Note: if you do add options to the configuration command, please make sure
+ you've read more than just this Quick Start, such as relevant NOTES.* files,
+ the options outline below, as configuration options may change the outcome
+ in otherwise unexpected ways)
+
 
  Configuration Options
  ---------------------
@@ -427,6 +432,16 @@
                    require additional system-dependent options! See "Note on
                    multi-threading" below.
 
+  enable-tls13downgrade
+                   TODO(TLS1.3): Make this enabled by default and remove the
+                   option when TLSv1.3 is out of draft
+                   TLSv1.3 offers a downgrade protection mechanism. This is
+                   implemented but disabled by default. It should not typically
+                   be enabled except for testing purposes. Otherwise this could
+                   cause problems if a pre-RFC version of OpenSSL talks to an
+                   RFC implementation (it will erroneously be detected as a
+                   downgrade).
+
   no-ts
                    Don't build Time Stamping Authority support.
 
@@ -469,8 +484,9 @@
   enable-tls1_3
                    TODO(TLS1.3): Make this enabled by default
                    Build support for TLS1.3. Note: This is a WIP feature and
-                   does not currently interoperate with other TLS1.3
-                   implementations! Use with caution!!
+                   only a single draft version is supported.  Implementations
+                   of different draft versions will negotiate TLS 1.2 instead
+                   of (draft) TLS 1.3.  Use with caution!!
 
   no-<prot>
                    Don't build support for negotiating the specified SSL/TLS
@@ -499,16 +515,21 @@
                    "ripemd" algorithm is deprecated and if used is synonymous
                    with rmd160.
 
-  -Dxxx, -lxxx, -Lxxx, -fxxx, -mXXX, -Kxxx
-                   These system specific options will be passed through to the
-                   compiler to allow you to define preprocessor symbols, specify
-                   additional libraries, library directories or other compiler
-                   options. It might be worth noting that some compilers
-                   generate code specifically for processor the compiler
-                   currently executes on. This is not necessarily what you might
-                   have in mind, since it might be unsuitable for execution on
-                   other, typically older, processor. Consult your compiler
-                   documentation.
+  -Dxxx, lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
+                   These system specific options will be recognised and
+                   passed through to the compiler to allow you to define
+                   preprocessor symbols, specify additional libraries, library
+                   directories or other compiler options. It might be worth
+                   noting that some compilers generate code specifically for
+                   processor the compiler currently executes on. This is not
+                   necessarily what you might have in mind, since it might be
+                   unsuitable for execution on other, typically older,
+                   processor. Consult your compiler documentation.
+
+  -xxx, +xxx
+                   Additional options that are not otherwise recognised are
+                   passed through as they are to the compiler as well.  Again,
+                   consult your compiler documentation.
 
 
  Installation in Detail
@@ -915,7 +936,14 @@
  -xxx           Removes 'xxx' from the current set of tests.  If this is the
                 first token in the list, the current set of tests is first
                 assigned the whole set of available tests, effectively making
-                this token equivalent to TESTS="alltests -xxx"
+                this token equivalent to TESTS="alltests -xxx".
+ nn             Adds the test group 'nn' (which is a number) to the current
+                set of tests.
+ -nn            Removes the test group 'nn' from the current set of tests.
+                If this is the first token in the list, the current set of
+                tests is first assigned the whole set of available tests,
+                effectively making this token equivalent to
+                TESTS="alltests -xxx".
 
  Also, all tokens except for "alltests" may have wildcards, such as *.
  (on Unix and Windows, BSD style wildcards are supported, while on VMS,
@@ -934,6 +962,18 @@
 
  $ make TESTS='test_ssl* -test_ssl_*' test
 
+ Example: Only test group 10:
+
+ $ make TESTS='10'
+
+ Example: All tests except the slow group (group 99):
+
+ $ make TESTS='-99'
+
+ Example: All tests in test groups 80 to 99 except for tests in group 90:
+
+ $ make TESTS='[89]? -90'
+
  Note on multi-threading
  -----------------------