From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 14 Jan 2019 21:19:44 +0000 (-0500)
Subject: allow certs && PSK.
X-Git-Tag: release_3_0_18~86
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0055228d1b546bb2ed28ddfecaf5d0ed1e537f4e;p=thirdparty%2Ffreeradius-server.git

allow certs && PSK.

Also document this in the default config
---

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 5fc5f5b8232..45083db99a4 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -203,28 +203,30 @@ eap {
 	#	auto_chain = yes
 
 		#
-		#  If OpenSSL supports TLS-PSK, then we can use
-		#  a PSK identity and (hex) password.  When the
-		#  following two configuration items are specified,
-		#  then certificate-based configuration items are
-		#  not allowed.  e.g.:
-		#
-		#	private_key_password
-		#	private_key_file
-		#	certificate_file
-		#	ca_file
-		#	ca_path
-		#
-		#  For now, the identity is fixed, and must be the
-		#  same on the client.  The passphrase must be a hex
-		#  value, and can be up to 256 hex digits.
-		#
-		#  Future versions of the server may be able to
-		#  look up the shared key (hexphrase) based on the
-		#  identity.
-		#
-	#	psk_identity = "test"
-	#	psk_hexphrase = "036363823"
+		#  If OpenSSL supports TLS-PSK, then we can use a
+		#  fixed PSK identity and (hex) password.  As of
+		#  3.0.18, these can be used at the same time as the
+		#  certificate configuration.
+		#
+#		psk_identity = "test"
+#		psk_hexphrase = "036363823"
+
+
+		#
+		#  Dynamic queries for the PSK.  If TLS-PSK is used,
+		#  and psk_query is set, then you MUST NOT use
+		#  psk_identity or psk_hexphrase.
+		#
+		#  Instead, use a dynamic expansion similar to the one
+		#  below.  It keys off of TLS-PSK-Identity.  It should
+		#  return a of string no more than 512 hex characters.
+		#  That string will be converted to binary, and will
+		#  be used as the dynamic PSK hexphrase.
+		#
+		#  Note that this query is just an example.  You will
+		#  need to customize it for your installation.
+		#
+#		psk_query = "%{sql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"
 
 		#
 		#  For DH cipher suites to work, you have to
diff --git a/src/main/tls.c b/src/main/tls.c
index fe848d76597..5c469137666 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2874,15 +2874,6 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
 	}
 
 #ifdef PSK_MAX_IDENTITY_LEN
-	if (conf->psk_identity || conf->psk_password || conf->psk_query) {
-		if (conf->certificate_file ||
-		    conf->private_key_password || conf->private_key_file ||
-		    conf->ca_file || conf->ca_path) {
-			ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
-			return NULL;
-		}
-	}
-
 	/*
 	 *	A dynamic query exists.  There MUST NOT be a
 	 *	statically configured identity and password.