For example:
[edit interfaces openvpn vtun0]
vyos@vyos# show
(...)
openvpn-option "tls-crypt /config/auth/tls-auth.key"
(...)
[edit interfaces openvpn vtun0]
vyos@vyos# delete openvpn-option [I pressed Tab here] vbash: ${/config/auth/tls-auth.key[@]}: bad substitution
Possible completions:
tls-crypt
/config/auth/tls-auth.key
[edit interfaces openvpn vtun0]
vyos@vyos# delete openvpn-optionThats the downside of those nodes which allow passing raw values down the config. I never liked them and they should be removed. The CLI should be extended to support the raw options instead.
Also passing wrong/invalid option will break OpenVPN.
Why not use the real CLI command to pass the TLS cert?
I personally don't mind the raw options, and there are other people using them too (T127, T1246, T1383, T1421, T1430).
There is no option for tls-crypt, just tls-auth. Also I'm experimenting with the various mtu options (tun-mtu, link-mtu, mssfix, fragment) and keepalive options (ping-restart, ping) that can't be set through the existing keepalive options (keepalive doesn't take 0 as a value if I want ping-restart 0 for example, and there's no way to not have keepalive be set with default vaules). So yeah, if all of these options were integrated, I personally wouldn't need the openvpn-options. But I think there are other places that use raw values with quotes that are affected by the autocompletion bug too, dhcp-server for example.
Yes there are definately other places like DHCP.
Would it make sense to add a „tls crypt-file“ CLI option?
The above commit fixes value help on tab (it displays correct quoted values, the script doesn't error any more) but the completion itself is still broken.