7e7e3f
diff -up openssl-1.0.1k/apps/s_apps.h.ephemeral openssl-1.0.1k/apps/s_apps.h
7e7e3f
--- openssl-1.0.1k/apps/s_apps.h.ephemeral	2015-01-09 10:22:03.289896211 +0100
7e7e3f
+++ openssl-1.0.1k/apps/s_apps.h	2015-01-09 10:22:03.373898111 +0100
24632b
@@ -156,6 +156,7 @@ int MS_CALLBACK verify_callback(int ok,
24632b
 int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file);
24632b
 int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key);
24632b
 #endif
24632b
+int ssl_print_tmp_key(BIO *out, SSL *s);
24632b
 int init_client(int *sock, char *server, char *port, int type);
24632b
 int should_retry(int i);
24632b
 int extract_host_port(char *str,char **host_ptr,char **port_ptr);
7e7e3f
diff -up openssl-1.0.1k/apps/s_cb.c.ephemeral openssl-1.0.1k/apps/s_cb.c
7e7e3f
--- openssl-1.0.1k/apps/s_cb.c.ephemeral	2015-01-08 15:00:36.000000000 +0100
7e7e3f
+++ openssl-1.0.1k/apps/s_cb.c	2015-01-09 10:22:03.373898111 +0100
24632b
@@ -338,6 +338,38 @@ void MS_CALLBACK apps_ssl_info_callback(
24632b
 		}
24632b
 	}
24632b
 
24632b
+int ssl_print_tmp_key(BIO *out, SSL *s)
24632b
+	{
24632b
+	EVP_PKEY *key;
24632b
+	if (!SSL_get_server_tmp_key(s, &key))
24632b
+		return 1;
24632b
+	BIO_puts(out, "Server Temp Key: ");
24632b
+	switch (EVP_PKEY_id(key))
24632b
+		{
24632b
+	case EVP_PKEY_RSA:
24632b
+		BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_bits(key));
24632b
+		break;
24632b
+
24632b
+	case EVP_PKEY_DH:
24632b
+		BIO_printf(out, "DH, %d bits\n", EVP_PKEY_bits(key));
24632b
+		break;
24632b
+
24632b
+	case EVP_PKEY_EC:
24632b
+			{
24632b
+			EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key);
24632b
+			int nid;
24632b
+			const char *cname;
24632b
+			nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
24632b
+			EC_KEY_free(ec);
24632b
+			cname = OBJ_nid2sn(nid);
24632b
+			BIO_printf(out, "ECDH, %s, %d bits\n",
24632b
+						cname, EVP_PKEY_bits(key));
24632b
+			}
24632b
+		}
24632b
+	EVP_PKEY_free(key);
24632b
+	return 1;
24632b
+	}
24632b
+		
24632b
 
24632b
 void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg)
24632b
 	{
7e7e3f
diff -up openssl-1.0.1k/apps/s_client.c.ephemeral openssl-1.0.1k/apps/s_client.c
7e7e3f
--- openssl-1.0.1k/apps/s_client.c.ephemeral	2015-01-09 10:22:03.367897975 +0100
7e7e3f
+++ openssl-1.0.1k/apps/s_client.c	2015-01-09 10:22:03.373898111 +0100
7e7e3f
@@ -2058,6 +2058,8 @@ static void print_stuff(BIO *bio, SSL *s
24632b
 			BIO_write(bio,"\n",1);
24632b
 			}
24632b
 
24632b
+		ssl_print_tmp_key(bio, s);
24632b
+
24632b
 		BIO_printf(bio,"---\nSSL handshake has read %ld bytes and written %ld bytes\n",
24632b
 			BIO_number_read(SSL_get_rbio(s)),
24632b
 			BIO_number_written(SSL_get_wbio(s)));
7e7e3f
diff -up openssl-1.0.1k/ssl/ssl.h.ephemeral openssl-1.0.1k/ssl/ssl.h
7e7e3f
--- openssl-1.0.1k/ssl/ssl.h.ephemeral	2015-01-09 10:22:03.358897772 +0100
7e7e3f
+++ openssl-1.0.1k/ssl/ssl.h	2015-01-09 10:25:08.644088146 +0100
7e7e3f
@@ -1593,6 +1593,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
24632b
 #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS		82
24632b
 #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS	83
24632b
 
24632b
+#define SSL_CTRL_GET_SERVER_TMP_KEY		109
613f66
 #define SSL_CTRL_CHECK_PROTO_VERSION		119
7e7e3f
 #define DTLS_CTRL_SET_LINK_MTU			120
7e7e3f
 #define DTLS_CTRL_GET_LINK_MIN_MTU		121
7e7e3f
@@ -1638,6 +1639,9 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
24632b
 #define SSL_CTX_clear_extra_chain_certs(ctx) \
24632b
 	SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL)
24632b
 
24632b
+#define SSL_get_server_tmp_key(s, pk) \
24632b
+	SSL_ctrl(s,SSL_CTRL_GET_SERVER_TMP_KEY,0,pk)
24632b
+
24632b
 #ifndef OPENSSL_NO_BIO
24632b
 BIO_METHOD *BIO_f_ssl(void);
24632b
 BIO *BIO_new_ssl(SSL_CTX *ctx,int client);
7e7e3f
diff -up openssl-1.0.1k/ssl/s3_lib.c.ephemeral openssl-1.0.1k/ssl/s3_lib.c
7e7e3f
--- openssl-1.0.1k/ssl/s3_lib.c.ephemeral	2015-01-08 15:00:56.000000000 +0100
7e7e3f
+++ openssl-1.0.1k/ssl/s3_lib.c	2015-01-09 10:22:03.374898133 +0100
613f66
@@ -3356,6 +3356,45 @@ long ssl3_ctrl(SSL *s, int cmd, long lar
24632b
 
24632b
 #endif /* !OPENSSL_NO_TLSEXT */
613f66
 
24632b
+	case SSL_CTRL_GET_SERVER_TMP_KEY:
24632b
+		if (s->server || !s->session || !s->session->sess_cert)
24632b
+			return 0;
24632b
+		else
24632b
+			{
24632b
+			SESS_CERT *sc;
24632b
+			EVP_PKEY *ptmp;
24632b
+			int rv = 0;
24632b
+			sc = s->session->sess_cert;
24632b
+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
24632b
+			if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp
24632b
+							&& !sc->peer_ecdh_tmp)
24632b
+				return 0;
24632b
+#endif
24632b
+			ptmp = EVP_PKEY_new();
24632b
+			if (!ptmp)
24632b
+				return 0;
24632b
+			if (0);
24632b
+#ifndef OPENSSL_NO_RSA
24632b
+			else if (sc->peer_rsa_tmp)
24632b
+				rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
24632b
+#endif
24632b
+#ifndef OPENSSL_NO_DH
24632b
+			else if (sc->peer_dh_tmp)
24632b
+				rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
24632b
+#endif
24632b
+#ifndef OPENSSL_NO_ECDH
24632b
+			else if (sc->peer_ecdh_tmp)
24632b
+				rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
24632b
+#endif
24632b
+			if (rv)
24632b
+				{
24632b
+				*(EVP_PKEY **)parg = ptmp;
24632b
+				return 1;
24632b
+				}
24632b
+			EVP_PKEY_free(ptmp);
24632b
+			return 0;
24632b
+			}
613f66
+
613f66
 	case SSL_CTRL_CHECK_PROTO_VERSION:
613f66
 		/* For library-internal use; checks that the current protocol
613f66
 		 * is the highest enabled version (according to s->ctx->method,