Using the following configuration:
set interfaces openvpn vtun0 encryption cipher 'aes256gcm' set interfaces openvpn vtun0 keep-alive failure-count '3' set interfaces openvpn vtun0 keep-alive interval '10' set interfaces openvpn vtun0 mode 'server' set interfaces openvpn vtun0 openvpn-option 'tls-auth /config/auth/openvpn/ta.key 0' set interfaces openvpn vtun0 server name-server '10.53.53.53' set interfaces openvpn vtun0 server name-server '10.53.53.54' set interfaces openvpn vtun0 server push-route '0.0.0.0/0' set interfaces openvpn vtun0 server subnet '10.7.178.0/24' set interfaces openvpn vtun0 tls ca-cert-file '/config/auth/ovpn_test_ca.pem' set interfaces openvpn vtun0 tls cert-file '/config/auth/ovpn_test_server.pem' set interfaces openvpn vtun0 tls dh-file '/config/auth/ovpn_test_dh.pem' set interfaces openvpn vtun0 tls key-file '/config/auth/ovpn_test_server.key' set interfaces openvpn vtun0 use-lzo-compression
will render:
{'auth_user_pass_file': '/run/openvpn/vtun0.pw',
'daemon_group': 'openvpn',
'daemon_user': 'openvpn',
'device_type': 'tun',
'encryption': {'cipher': 'aes256gcm'},
'ifname': 'vtun0',
'keep_alive': {'failure_count': '3', 'interval': '10'},
'mode': 'server',
'openvpn_option': ['tls-auth', '/config/auth/openvpn/ta.key', '0'],
'protocol': 'udp',
'server': {'name_server': ['10.53.53.53', '10.53.53.54'],
'push_route': ['0.0.0.0/0'],
'subnet': ['10.7.178.0/24'],
'topology': 'net30'},
'tls': {'ca_cert_file': '/config/auth/ovpn_test_ca.pem',
'cert_file': '/config/auth/ovpn_test_server.pem',
'dh_file': '/config/auth/ovpn_test_dh.pem',
'key_file': '/config/auth/ovpn_test_server.key'},
'use_lzo_compression': {}}The error can be seen in the openvpn_option key, the value from the CLI is split() into individual list elements. This is wrong. the proper result shoudl be: 'openvpn_option': ['tls-auth /config/auth/openvpn/ta.key 0']. My initial feeling is that this comes from the change that a multi node should always be represented as a list (https://github.com/vyos/vyos-1x/commit/b40c5268).
As defining a CLI node which is non-multi with a value containing whitespaces works: 'description': 'asdf ghje sadf' - interface descriptions are a good example here.