allow certs && PSK.

Also document this in the default config

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 5fc5f5b8232d6b57cf74986b4f5cc4a08a46554f..45083db99a45a2863899e9c46d2c585abcb1630b 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -203,28 +203,30 @@ eap {
        #       auto_chain = yes
 
                #
-               #  If OpenSSL supports TLS-PSK, then we can use
-               #  a PSK identity and (hex) password.  When the
-               #  following two configuration items are specified,
-               #  then certificate-based configuration items are
-               #  not allowed.  e.g.:
-               #
-               #       private_key_password
-               #       private_key_file
-               #       certificate_file
-               #       ca_file
-               #       ca_path
-               #
-               #  For now, the identity is fixed, and must be the
-               #  same on the client.  The passphrase must be a hex
-               #  value, and can be up to 256 hex digits.
-               #
-               #  Future versions of the server may be able to
-               #  look up the shared key (hexphrase) based on the
-               #  identity.
-               #
-       #       psk_identity = "test"
-       #       psk_hexphrase = "036363823"
+               #  If OpenSSL supports TLS-PSK, then we can use a
+               #  fixed PSK identity and (hex) password.  As of
+               #  3.0.18, these can be used at the same time as the
+               #  certificate configuration.
+               #
+#              psk_identity = "test"
+#              psk_hexphrase = "036363823"
+
+
+               #
+               #  Dynamic queries for the PSK.  If TLS-PSK is used,
+               #  and psk_query is set, then you MUST NOT use
+               #  psk_identity or psk_hexphrase.
+               #
+               #  Instead, use a dynamic expansion similar to the one
+               #  below.  It keys off of TLS-PSK-Identity.  It should
+               #  return a of string no more than 512 hex characters.
+               #  That string will be converted to binary, and will
+               #  be used as the dynamic PSK hexphrase.
+               #
+               #  Note that this query is just an example.  You will
+               #  need to customize it for your installation.
+               #
+#              psk_query = "%{sql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"
 
                #
                #  For DH cipher suites to work, you have to

diff --git a/src/main/tls.c b/src/main/tls.c
index fe848d765978c42c3e83cb3bcb61c7e34b0da197..5c4691376666d951e31702b795354f295685aa50 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2874,15 +2874,6 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
        }
 
 #ifdef PSK_MAX_IDENTITY_LEN
-       if (conf->psk_identity || conf->psk_password || conf->psk_query) {
-               if (conf->certificate_file ||
-                   conf->private_key_password || conf->private_key_file ||
-                   conf->ca_file || conf->ca_path) {
-                       ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
-                       return NULL;
-               }
-       }
-
        /*
         *      A dynamic query exists.  There MUST NOT be a
         *      statically configured identity and password.