1 files changed, 97 insertions, 9 deletions
diff --git a/src/openssl.c b/src/openssl.c
index 4a290a9..03f3f8d 100644
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -465,6 +465,48 @@ static void lib_setintegers(lua_State *L, const integer_Reg *l) {
 } /* lib_setintegers() */
 
 
+
+#if !HAVE_EVP_PKEY_base_id
+#define EVP_PKEY_base_id(key) compat_EVP_PKEY_base_id((key))
+
+static int compat_EVP_PKEY_base_id(EVP_PKEY *key) {
+	return EVP_PKEY_type(key->type);
+} /* compat_EVP_PKEY_base_id() */
+#endif
+
+
+#if !HAVE_EVP_PKEY_get0
+#define EVP_PKEY_get0(key) compat_EVP_PKEY_get0((key))
+
+static void *compat_EVP_PKEY_get0(EVP_PKEY *key) {
+	void *ptr = NULL;
+
+	switch (EVP_PKEY_base_id(key)) {
+	case EVP_PKEY_RSA:
+		if ((ptr = EVP_PKEY_get1_RSA(key)))
+			RSA_free(ptr);
+		break;
+	case EVP_PKEY_DSA:
+		if ((ptr = EVP_PKEY_get1_DSA(key)))
+			DSA_free(ptr);
+		break;
+	case EVP_PKEY_DH:
+		if ((ptr = EVP_PKEY_get1_DH(key)))
+			DH_free(ptr);
+		break;
+	case EVP_PKEY_EC:
+		if ((ptr = EVP_PKEY_get1_EC_KEY(key)))
+			EC_KEY_free(ptr);
+		break;
+	default:
+		break;
+	}
+
+	return ptr;
+} /* compat_EVP_PKEY_get0() */
+#endif
+
+
 static void initall(lua_State *L);
 
 
@@ -4134,6 +4176,51 @@ static int sx_setCipherList(lua_State *L) {
 } /* sx_setCipherList() */
 
 
+static int sx_setEphemeralKey(lua_State *L) {
+	SSL_CTX *ctx = checksimple(L, 1, SSL_CTX_CLASS);
+	EVP_PKEY *key = checksimple(L, 2, PKEY_CLASS);
+	void *tmp;
+
+	/*
+	 * NOTE: SSL_CTX_set_tmp duplicates the keys, so we don't need to
+	 * worry about lifetimes. EVP_PKEY_get0 doesn't increment the
+	 * reference count.
+	 */
+	switch (EVP_PKEY_base_id(key)) {
+	case EVP_PKEY_RSA:
+		if (!(tmp = EVP_PKEY_get0(key)))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		if (!SSL_CTX_set_tmp_rsa(ctx, tmp))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		break;
+	case EVP_PKEY_DH:
+		if (!(tmp = EVP_PKEY_get0(key)))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		if (!SSL_CTX_set_tmp_dh(ctx, tmp))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		break;
+	case EVP_PKEY_EC:
+		if (!(tmp = EVP_PKEY_get0(key)))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		if (!SSL_CTX_set_tmp_ecdh(ctx, tmp))
+			return throwssl(L, "ssl.context:setEphemeralKey");
+
+		break;
+	default:
+		return luaL_error(L, "%d: unsupported EVP base type", EVP_PKEY_base_id(key));
+	} /* switch() */
+
+	lua_pushboolean(L, 1);
+
+	return 1;
+} /* sx_setEphemeralKey() */
+
+
 static int sx__gc(lua_State *L) {
 	SSL_CTX **ud = luaL_checkudata(L, 1, SSL_CTX_CLASS);
 
@@ -4145,15 +4232,16 @@ static int sx__gc(lua_State *L) {
 
 
 static const luaL_Reg sx_methods[] = {
-	{ "setOptions",     &sx_setOptions },
-	{ "getOptions",     &sx_getOptions },
-	{ "clearOptions",   &sx_clearOptions },
-	{ "setStore",       &sx_setStore },
-	{ "setVerify",      &sx_setVerify },
-	{ "getVerify",      &sx_getVerify },
-	{ "setCertificate", &sx_setCertificate },
-	{ "setPrivateKey",  &sx_setPrivateKey },
-	{ "setCipherList",  &sx_setCipherList },
+	{ "setOptions",       &sx_setOptions },
+	{ "getOptions",       &sx_getOptions },
+	{ "clearOptions",     &sx_clearOptions },
+	{ "setStore",         &sx_setStore },
+	{ "setVerify",        &sx_setVerify },
+	{ "getVerify",        &sx_getVerify },
+	{ "setCertificate",   &sx_setCertificate },
+	{ "setPrivateKey",    &sx_setPrivateKey },
+	{ "setCipherList",    &sx_setCipherList },
+	{ "setEphemeralKey",  &sx_setEphemeralKey },
 	{ NULL, NULL },
 };