rearrange checks and make the error messages more descriptive

diff --git a/src/main/tls.c b/src/main/tls.c
index 83d98e89d980e0bb102fb5468876fb65996e9d41..bce499100865c1bec9060cdac2bbee2b0db2e61a 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2874,50 +2874,75 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
        }
 
 #ifdef PSK_MAX_IDENTITY_LEN
-       if (!client) {
-               /*
-                *      No dynamic query exists.  There MUST be a
-                *      statically configured identity and password.
-                */
-               if (conf->psk_query && !*conf->psk_query) {
+       if (conf->psk_identity || conf->psk_password || conf->psk_query) {
+               if (conf->certificate_file ||
+                   conf->private_key_password || conf->private_key_file ||
+                   conf->ca_file || conf->ca_path) {
+                       ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
+                       return NULL;
+               }
+       }
+
+       /*
+        *      A dynamic query exists.  There MUST NOT be a
+        *      statically configured identity and password.
+        */
+       if (conf->psk_query) {
+               if (!*conf->psk_query) {
                        ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be empty");
                        return NULL;
                }
 
+               if (conf->psk_identity || *conf->psk_identity) {
+                       ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity and psk_query cannot be used at the same time.");
+                       return NULL;
+               }
+
+               if (conf->psk_password || *conf->psk_password) {
+                       ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_password and psk_query cannot be used at the same time.");
+                       return NULL;
+               }
+
+               if (client) {
+                       ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be used for outgoing connections");
+                       return NULL;
+               }
+
                /*
-                *      Set the callback only if we can check things.
+                *      Now check that if PSK is being used, that the config is valid.
                 */
-               if (conf->psk_identity || conf->psk_query) {
-                       SSL_CTX_set_psk_server_callback(ctx, psk_server_callback);
+       } else if (conf->psk_identity) {
+               if (!*conf->psk_identity) {
+                       ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity is empty");
+                       return NULL;
                }
 
-       } else if (conf->psk_query) {
-               ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be used for outgoing connections");
+
+               if (!conf->psk_password || !*conf->psk_password) {
+                       ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity is set, but there is no psk_password");
+                       return NULL;
+               }
+
+       } else if (conf->psk_password) {
+               ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_password is set, but there is no psk_identity");
                return NULL;
        }
 
        /*
-        *      Now check that if PSK is being used, the config is valid.
+        *      Set the server PSK callback if necessary.
         */
-       if ((conf->psk_identity && !conf->psk_password) ||
-           (!conf->psk_identity && conf->psk_password) ||
-           (conf->psk_identity && !*conf->psk_identity) ||
-           (conf->psk_password && !*conf->psk_password)) {
-               ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity or psk_password are empty");
-               return NULL;
+       if (!client && (conf->psk_identity || conf->psk_query)) {
+               SSL_CTX_set_psk_server_callback(ctx, psk_server_callback);
        }
 
+       /*
+        *      Do more sanity checking if we have a PSK identity.  We
+        *      check the password, and convert it to it's final form.
+        */
        if (conf->psk_identity) {
                size_t psk_len, hex_len;
                uint8_t buffer[PSK_MAX_PSK_LEN];
 
-               if (conf->certificate_file ||
-                   conf->private_key_password || conf->private_key_file ||
-                   conf->ca_file || conf->ca_path) {
-                       ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
-                       return NULL;
-               }
-
                if (client) {
                        SSL_CTX_set_psk_client_callback(ctx,
                                                        psk_client_callback);