From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 14 Jan 2019 16:36:11 +0000 (-0500)
Subject: rearrange checks and make the error messages more descriptive
X-Git-Tag: release_3_0_18~88
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b16a380e4f6344f1b31fecd067f7aa2d6009b2df;p=thirdparty%2Ffreeradius-server.git

rearrange checks and make the error messages more descriptive
---

diff --git a/src/main/tls.c b/src/main/tls.c
index 83d98e89d98..bce49910086 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2874,50 +2874,75 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
 	}
 
 #ifdef PSK_MAX_IDENTITY_LEN
-	if (!client) {
-		/*
-		 *	No dynamic query exists.  There MUST be a
-		 *	statically configured identity and password.
-		 */
-		if (conf->psk_query && !*conf->psk_query) {
+	if (conf->psk_identity || conf->psk_password || conf->psk_query) {
+		if (conf->certificate_file ||
+		    conf->private_key_password || conf->private_key_file ||
+		    conf->ca_file || conf->ca_path) {
+			ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
+			return NULL;
+		}
+	}
+
+	/*
+	 *	A dynamic query exists.  There MUST NOT be a
+	 *	statically configured identity and password.
+	 */
+	if (conf->psk_query) {
+		if (!*conf->psk_query) {
 			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be empty");
 			return NULL;
 		}
 
+		if (conf->psk_identity || *conf->psk_identity) {
+			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity and psk_query cannot be used at the same time.");
+			return NULL;
+		}
+
+		if (conf->psk_password || *conf->psk_password) {
+			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_password and psk_query cannot be used at the same time.");
+			return NULL;
+		}
+
+		if (client) {
+			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be used for outgoing connections");
+			return NULL;
+		}
+
 		/*
-		 *	Set the callback only if we can check things.
+		 *	Now check that if PSK is being used, that the config is valid.
 		 */
-		if (conf->psk_identity || conf->psk_query) {
-			SSL_CTX_set_psk_server_callback(ctx, psk_server_callback);
+	} else if (conf->psk_identity) {
+		if (!*conf->psk_identity) {
+			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity is empty");
+			return NULL;
 		}
 
-	} else if (conf->psk_query) {
-		ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_query cannot be used for outgoing connections");
+
+		if (!conf->psk_password || !*conf->psk_password) {
+			ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity is set, but there is no psk_password");
+			return NULL;
+		}
+
+	} else if (conf->psk_password) {
+		ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_password is set, but there is no psk_identity");
 		return NULL;
 	}
 
 	/*
-	 *	Now check that if PSK is being used, the config is valid.
+	 *	Set the server PSK callback if necessary.
 	 */
-	if ((conf->psk_identity && !conf->psk_password) ||
-	    (!conf->psk_identity && conf->psk_password) ||
-	    (conf->psk_identity && !*conf->psk_identity) ||
-	    (conf->psk_password && !*conf->psk_password)) {
-		ERROR(LOG_PREFIX ": Invalid PSK Configuration: psk_identity or psk_password are empty");
-		return NULL;
+	if (!client && (conf->psk_identity || conf->psk_query)) {
+		SSL_CTX_set_psk_server_callback(ctx, psk_server_callback);
 	}
 
+	/*
+	 *	Do more sanity checking if we have a PSK identity.  We
+	 *	check the password, and convert it to it's final form.
+	 */
 	if (conf->psk_identity) {
 		size_t psk_len, hex_len;
 		uint8_t buffer[PSK_MAX_PSK_LEN];
 
-		if (conf->certificate_file ||
-		    conf->private_key_password || conf->private_key_file ||
-		    conf->ca_file || conf->ca_path) {
-			ERROR(LOG_PREFIX ": When PSKs are used, No certificate configuration is permitted");
-			return NULL;
-		}
-
 		if (client) {
 			SSL_CTX_set_psk_client_callback(ctx,
 							psk_client_callback);