From d73122f17a14511f522261fa7fee6eae54811ca5 Mon Sep 17 00:00:00 2001
From: Mariusz Dalewski <mariusz.dalewski@mddv.pl>
Date: Fri, 16 Oct 2026 19:56:07 +0200
Subject: openvpn: T9469: add TLS key to generated client config

The client configuration generated by "generate openvpn client-config"
never included the TLS shared secret, so a client could not connect to
a server using "tls crypt-key" or "tls auth-key" without editing the
file by hand.

The key is now embedded inline as <tls-crypt>, or as <tls-auth> with
"key-direction 1" to match the server side. Configs for servers without
a TLS key are unchanged.
---
 src/op_mode/generate_ovpn_client_file.py | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/op_mode/generate_ovpn_client_file.py b/src/op_mode/generate_ovpn_client_file.py
index 21c933932..1b81ff184 100755
--- a/src/op_mode/generate_ovpn_client_file.py
+++ b/src/op_mode/generate_ovpn_client_file.py
@@ -21,6 +21,7 @@ from textwrap import fill
 
 from vyos.config import Config
 from vyos.ifconfig import Section
+from vyos.utils.dict import dict_search_args
 
 client_config = """
 
@@ -88,7 +89,22 @@ auth {{ hash }}
 -----END PRIVATE KEY-----
 
 </key>
-
+{% if tls is defined and tls.crypt_key is defined %}
+
+<tls-crypt>
+-----BEGIN OpenVPN Static key V1-----
+{{ tls_key }}
+-----END OpenVPN Static key V1-----
+</tls-crypt>
+{% elif tls is defined and tls.auth_key is defined %}
+
+key-direction 1
+<tls-auth>
+-----BEGIN OpenVPN Static key V1-----
+{{ tls_key }}
+-----END OpenVPN Static key V1-----
+</tls-auth>
+{% endif %}
 """
 
 config = Config()
@@ -158,5 +174,15 @@ if __name__ == '__main__':
     config['key'] = key
     config['port'] = '1194' if 'local_port' not in config else config['local_port']
 
+    tls = config.get('tls', {})
+    tls_key = tls.get('crypt_key') or tls.get('auth_key')
+    if tls_key:
+        tls_key_data = dict_search_args(
+            config, 'pki', 'openvpn', 'shared_secret', tls_key, 'key'
+        )
+        if not tls_key_data:
+            exit(f'OpenVPN shared secret key "{tls_key}" does not exist!')
+        config['tls_key'] = fill(tls_key_data, width=32)
+
     client = Template(client_config, trim_blocks=True).render(config)
     print(client)
-- 
cgit v1.2.3