Page MenuHomeVyOS Platform

openvpn: generated client config lacks tls-crypt/tls-auth static key
Open, NormalPublicBUG

Description

"generate openvpn client-config" does not include the TLS static key in the generated .ovpn file when the server interface uses "tls crypt-key" or "tls auth-key". The resulting client configuration cannot be used as-is to connect to such a server; the key has to be added to the file manually.

Steps to reproduce:

run generate pki ca install ca-ovpn
run generate pki certificate sign ca-ovpn install srv-ovpn
run generate pki certificate sign ca-ovpn install cli-ovpn
run generate pki openvpn shared-secret install ovpn-tls

set interfaces openvpn vtun0 mode server
set interfaces openvpn vtun0 server subnet 10.255.0.0/24
set interfaces openvpn vtun0 server topology subnet
set interfaces openvpn vtun0 tls ca-certificate ca-ovpn
set interfaces openvpn vtun0 tls certificate srv-ovpn
set interfaces openvpn vtun0 tls crypt-key ovpn-tls
commit

run generate openvpn client-config interface vtun0 ca ca-ovpn certificate cli-ovpn

The same applies with "tls auth-key ovpn-tls" instead of "tls crypt-key".

Expected behavior:

The generated client configuration contains the static key referenced by the server interface, inline as:

  • <tls-crypt>...</tls-crypt> for "tls crypt-key"
  • "key-direction 1" plus <tls-auth>...</tls-auth> for "tls auth-key"

Details

Version
rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)