diff -up openssl-1.0.1e/apps/s_client.c.krb5keytab openssl-1.0.1e/apps/s_client.c
--- openssl-1.0.1e/apps/s_client.c.krb5keytab 2015-03-03 14:41:41.248686764 +0100
+++ openssl-1.0.1e/apps/s_client.c 2015-03-03 15:43:38.285048063 +0100
@@ -169,6 +169,10 @@ typedef unsigned int u_int;
#include "s_apps.h"
#include "timeouts.h"
+#ifndef OPENSSL_NO_KRB5
+static char *krb5svc=NULL;
+#endif
+
#if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
/* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
#undef FIONBIO
@@ -348,6 +352,9 @@ static void sc_usage(void)
BIO_printf(bio_err," 'prot' defines which one to assume. Currently,\n");
BIO_printf(bio_err," only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
BIO_printf(bio_err," are supported.\n");
+#ifndef OPENSSL_NO_KRB5
+ BIO_printf(bio_err," -krb5svc arg - Kerberos service name\n");
+#endif
#ifndef OPENSSL_NO_ENGINE
BIO_printf(bio_err," -engine id - Initialise and use the specified engine\n");
#endif
@@ -906,6 +913,13 @@ int MAIN(int argc, char **argv)
else if (strcmp(*argv,"-nbio") == 0)
{ c_nbio=1; }
#endif
+#ifndef OPENSSL_NO_KRB5
+ else if (strcmp(*argv,"-krb5svc") == 0)
+ {
+ if (--argc < 1) goto bad;
+ krb5svc= *(++argv);
+ }
+#endif
else if (strcmp(*argv,"-starttls") == 0)
{
if (--argc < 1) goto bad;
@@ -1266,6 +1280,8 @@ bad:
{
SSL_set0_kssl_ctx(con, kctx);
kssl_ctx_setstring(kctx, KSSL_SERVER, host);
+ if (krb5svc != NULL)
+ kssl_ctx_setstring(kctx, KSSL_SERVICE, krb5svc);
}
#endif /* OPENSSL_NO_KRB5 */
/* SSL_set_cipher_list(con,"RC4-MD5"); */
diff -up openssl-1.0.1e/apps/s_server.c.krb5keytab openssl-1.0.1e/apps/s_server.c
--- openssl-1.0.1e/apps/s_server.c.krb5keytab 2015-03-03 14:41:41.198686492 +0100
+++ openssl-1.0.1e/apps/s_server.c 2015-03-03 16:14:14.827107550 +0100
@@ -201,6 +201,11 @@ typedef unsigned int u_int;
#include <fcntl.h>
#endif
+#ifndef OPENSSL_NO_KRB5
+static char *krb5svc=NULL;
+static char *keytab=NULL;
+#endif
+
#ifndef OPENSSL_NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength);
#endif
@@ -507,6 +512,10 @@ static void sv_usage(void)
BIO_printf(bio_err," -serverpref - Use server's cipher preferences\n");
BIO_printf(bio_err," -quiet - No server output\n");
BIO_printf(bio_err," -no_tmp_rsa - Do not generate a tmp RSA key\n");
+#ifndef OPENSSL_NO_KRB5
+ BIO_printf(bio_err," -krb5svc arg - Kerberos service name\n");
+ BIO_printf(bio_err," -keytab arg - Kerberos keytab filename\n");
+#endif
#ifndef OPENSSL_NO_PSK
BIO_printf(bio_err," -psk_hint arg - PSK identity hint to use\n");
BIO_printf(bio_err," -psk arg - PSK in hex (without 0x)\n");
@@ -1121,6 +1130,18 @@ int MAIN(int argc, char *argv[])
if (--argc < 1) goto bad;
cipher= *(++argv);
}
+#ifndef OPENSSL_NO_KRB5
+ else if (strcmp(*argv,"-krb5svc") == 0)
+ {
+ if (--argc < 1) goto bad;
+ krb5svc= *(++argv);
+ }
+ else if (strcmp(*argv,"-keytab") == 0)
+ {
+ if (--argc < 1) goto bad;
+ keytab= *(++argv);
+ }
+#endif
else if (strcmp(*argv,"-CAfile") == 0)
{
if (--argc < 1) goto bad;
@@ -2019,8 +2040,10 @@ static int sv_body(char *hostname, int s
if ((kctx = kssl_ctx_new()) != NULL)
{
SSL_set0_kssl_ctx(con, kctx);
- kssl_ctx_setstring(kctx, KSSL_SERVICE, KRB5SVC);
- kssl_ctx_setstring(kctx, KSSL_KEYTAB, KRB5KEYTAB);
+ kssl_ctx_setstring(kctx, KSSL_SERVICE,
+ krb5svc == NULL ? KRB5SVC : krb5svc);
+ if (keytab != NULL)
+ kssl_ctx_setstring(kctx, KSSL_KEYTAB, keytab);
}
#endif /* OPENSSL_NO_KRB5 */
if(context)
@@ -2613,8 +2636,11 @@ static int www_body(char *hostname, int
#ifndef OPENSSL_NO_KRB5
if ((kctx = kssl_ctx_new()) != NULL)
{
- kssl_ctx_setstring(kctx, KSSL_SERVICE, KRB5SVC);
- kssl_ctx_setstring(kctx, KSSL_KEYTAB, KRB5KEYTAB);
+ SSL_set0_kssl_ctx(con, kctx);
+ kssl_ctx_setstring(kctx, KSSL_SERVICE,
+ krb5svc == NULL ? KRB5SVC : krb5svc);
+ if (keytab != NULL)
+ kssl_ctx_setstring(kctx, KSSL_KEYTAB, keytab);
}
#endif /* OPENSSL_NO_KRB5 */
if(context) SSL_set_session_id_context(con, context,
diff -up openssl-1.0.1e/doc/apps/s_client.pod.krb5keytab openssl-1.0.1e/doc/apps/s_client.pod
--- openssl-1.0.1e/doc/apps/s_client.pod.krb5keytab 2015-03-03 14:41:41.249686770 +0100
+++ openssl-1.0.1e/doc/apps/s_client.pod 2015-03-03 16:28:08.374701114 +0100
@@ -18,6 +18,8 @@ B<openssl> B<s_client>
[B<-CApath directory>]
[B<-CAfile filename>]
[B<-trusted_first>]
+[B<-krb5svc service>]
+[B<-keytab filename>]
[B<-reconnect>]
[B<-pause>]
[B<-showcerts>]
@@ -115,6 +117,17 @@ and to use when attempting to build the
Set various certificate chain valiadition option. See the
L<B<verify>|verify(1)> manual page for details.
+=item B<-krb5svc service>
+
+the Kerberos service name to use (default "host"). This means s_server
+will expect a ticket for the principal I<service>/hostname@REALM, and will
+need keys for that principal in its keytab.
+
+=item B<-keytab filename>
+
+the Kerberos "keytab" (key table) file, containing keys for the s_server
+service principal (Kerberos identity; see -krb5svc).
+
=item B<-reconnect>
reconnects to the same server 5 times using the same session ID, this can
diff -up openssl-1.0.1e/doc/apps/s_server.pod.krb5keytab openssl-1.0.1e/doc/apps/s_server.pod
--- openssl-1.0.1e/doc/apps/s_server.pod.krb5keytab 2015-03-03 14:41:41.200686503 +0100
+++ openssl-1.0.1e/doc/apps/s_server.pod 2015-03-03 16:29:35.631184313 +0100
@@ -34,6 +34,8 @@ B<openssl> B<s_server>
[B<-CApath directory>]
[B<-CAfile filename>]
[B<-trusted_first>]
+[B<-krb5svc service>]
+[B<-keytab filename>]
[B<-nocert>]
[B<-cipher cipherlist>]
[B<-quiet>]
@@ -181,6 +183,17 @@ Use certificates in CA file or CA direct
when building the trust chain to verify client certificates.
This is mainly useful in environments with Bridge CA or Cross-Certified CAs.
+=item B<-krb5svc service>
+
+the Kerberos service name to use (default "host"). This means s_server
+will expect a ticket for the principal I<service>/hostname@REALM, and will
+need keys for that principal in its keytab.
+
+=item B<-keytab filename>
+
+the Kerberos "keytab" (key table) file, containing keys for the s_server
+service principal (Kerberos identity; see -krb5svc).
+
=item B<-state>
prints out the SSL session states.