fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.

2026-10-27 08:46:36 +01:00
1 parent 1697e1aa38
commit dd2dfaaf2b
@@ -1,3 +1,14 @@
+vpn-router (0.33.2-1) unstable; urgency=medium
+
+  fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
+
+  * The README, the package description, the installer's questions, the
+    status page, the messages of the web service and the examples say
+    IKEv2 access and IKEv2 clients; the strongSwan connection keeps its
+    name, road-warrior.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 27 Oct 2026 23:00:00 +0100
+
 vpn-router (0.33.1-1) unstable; urgency=medium

  fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.
@@ -46,10 +46,10 @@ Suggests: caddy,
          pdns-server,
          pdns-backend-pgsql,
          proxmox-backup-client-static
-Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
+Description: Linux VPN router with IPSec, IKEv2, OpenVPN and WireGuard support
 Configures a Linux host or virtual machine as a VPN router: site-to-site
 IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
- optional road-warrior access using EAP-TLS, optional OpenVPN with a
+ optional IKEv2 access using EAP-TLS, optional OpenVPN with a
 certificate and a password per user, kept in a local LDAP directory, optional
 WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
 needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
@@ -4,7 +4,7 @@ Choices: none, generic, azure, gcp
 Default: none
 Description: Platform:
 Which platform this router runs on. The choice loads platform-specific
- additions, such as the provider DNS resolver for road-warrior clients.
+ additions, such as the provider DNS resolver for IKEv2 clients.
 .
 none defers configuration entirely: the package installs its files and
 changes nothing on the machine. Choose it when the router will be configured
@@ -58,7 +58,7 @@ Type: string
 Default:
 Description: Local router FQDN:
 Fully-qualified domain name of this router (for example
- router.example.com). Used as the road-warrior server identity and
+ router.example.com). Used as the IKEv2 server identity and
 certificate common name.

 Template: vpn-router/local_id_mode
@@ -122,15 +122,15 @@ Description: Pre-shared key (PSK):
 Template: vpn-router/p2s_enabled
 Type: boolean
 Default: false
-Description: Enable road-warrior (P2S) access?
+Description: Enable IKEv2 access?
 If enabled, this router accepts IKEv2 EAP-TLS connections from individual
 clients, with certificates of the router's P2S issuing CA.

 Template: vpn-router/p2s_address_pool
 Type: string
 Default:
-Description: Road-warrior address pool:
- CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
+Description: IKEv2 address pool:
+ CIDR block assigned to IKEv2 clients (for example 172.16.0.0/24).

 Template: vpn-router/pki_root_name
 Type: string
@@ -7,7 +7,7 @@ disables the unit.
 Every SAMPLE_SECONDS, on the minute, a sample is taken with psutil: the CPU utilization since the
 previous sample, the memory used and in total, the free and the total space of /, the bytes
 received and sent per second on the external and the internal interface, and the load averages;
-and the VPN clients of each enabled VPN system (vpnrouter_status): road-warrior (p2s) and
+and the VPN clients of each enabled VPN system (vpnrouter_status): IKEv2 (p2s) and
 OpenVPN clients and WireGuard peers with a recent handshake; and of each site-to-site connection
 that is set up, whether it is up, the bytes and packets per second through its child SAs since
 the previous sample, and how long its IKE SA has been up. The interfaces, the enabled systems and
@@ -1063,7 +1063,7 @@ def routing_ready(ctx):


 def p2s_ready(ctx):
-    """Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
+    """IKEv2 access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
    return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])


@@ -10,7 +10,7 @@ adding one file here. Nothing in the core has to be edited.

 A module may define any of:

-    EXTRA_P2S_DNS   str, added to the road-warrior pool 'dns' list
+    EXTRA_P2S_DNS   str, added to the 'dns' list of the IKEv2 address pool
    EXTRA_LOCAL_TS  str, added to 'local_ts' on both connections
    apply(ctx)      called once the system has been configured, to apply
                    platform-specific state. Must be idempotent. ctx is the
@@ -3,7 +3,7 @@
 No platform-specific configuration is currently required.

 The Azure platform resolver 168.63.129.16 is deliberately *not* advertised to
-road-warrior clients and *not* added to the traffic selectors. Clients are
+IKEv2 clients and *not* added to the traffic selectors. Clients are
 given the router's addresses of p2s.dns_listen as their DNS servers, where dnsmasq
 forwards to the router's own systemd-resolved. That resolves
 Azure-internal names without routing the wireserver address through the tunnel
@@ -2,7 +2,7 @@

 No platform-specific configuration is currently required.

-As on Azure, road-warrior clients are given the router itself as their DNS
+As on Azure, IKEv2 clients are given the router itself as their DNS
 server and the router forwards through its own systemd-resolved, so the
 metadata resolver does not belong in the pool or in the traffic selectors.
 """
@@ -814,7 +814,7 @@ def profile(connection, name):


 def apple_profile(connection, name, password):
-    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 road-warrior access: the root CA and
+    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 access: the root CA and
    the P2S CA, the user's certificate and key as a PKCS#12 encrypted with the password, and the VPN.

    The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
@@ -828,7 +828,7 @@ def apple_profile(connection, name, password):
    cfg = vpnrouter.load_config()
    fqdn = cfg['wan']['local_fqdn'].strip()
    if not cfg['p2s']['enabled'] or not fqdn:
-        raise Failure('IKEv2 road-warrior access is not enabled', 2)
+        raise Failure('IKEv2 access is not enabled', 2)
    credentials = vpnrouter_pki.user_credentials(name)
    if credentials is None:
        raise Failure(f'user {name} has no certificate')
@@ -29,7 +29,7 @@ Pages:
  /backup  the backup settings, the last run and the local archives: show, change and run
           now (see backup())
  /remote-access
-           the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each
+           the settings of IKEv2, OpenVPN and WireGuard access and whether each
           runs: show and change, applied by vpn-router-setup (see remote_access())
  /ca      the PKI: its settings, the root and issuing CAs, the certificates issued; change the
           settings, issue and revoke certificates, and take the certificate of an issuing CA
@@ -79,7 +79,7 @@ default, the overall status, the time and the client's address (its address as f
 below); standard also the package version, the installed version of vpn-router-manager
 (manager_version, null when it is not installed) and the number of active and other services; full
 whether each service runs, whether Docker is installed, how many of the site-to-site connections are established
-(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN
+(site_to_site: connections and established, null when swanctl cannot be asked), and IKEv2, OpenVPN
 and WireGuard. No configuration data, key or connection name is shown, and no address but the client's.

 The service first initializes, without listening: it makes the signing key, the OpenID Provider's key
@@ -184,7 +184,7 @@ BODY_LIMIT = 65536
 #: The settings of a site_to_site connection that /site-to-site adds and changes.
 CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')

-#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard.
+#: The sections of the remote access systems /remote-access changes: IKEv2, OpenVPN and WireGuard.
 REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard')

 #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
@@ -490,7 +490,7 @@ def text_of(status):
        lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established')
    if 'p2s' in status:
        clients = status['p2s']['clients']
-        lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
+        lines.append(f'IKEv2: {"unknown" if clients is None else f"{clients} connected"}')
    if 'openvpn' in status:
        clients = status['openvpn']['clients']
        lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}')
@@ -566,7 +566,7 @@ def users(state, method, path, body):
      DELETE /users/<name>            remove the user and revoke the certificate
      GET    /users/<name>/profile    the OpenVPN client profile
      POST   /users/<name>/apple-profile
-                                      the Apple configuration profile of IKEv2 road-warrior access: {"password"}, which
+                                      the Apple configuration profile of IKEv2 access: {"password"}, which
                                      encrypts the user's key in it; {"name", "profile"}
      POST   /users/<name>/otp       a new TOTP secret and its otpauth URI; nothing is stored
      PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
@@ -1051,7 +1051,7 @@ def account(name, method, path, body):
      POST   /account/profile  the user's OpenVPN client profile: {"current_password", "current_code"?}; {"name",
                               "profile"}
      POST   /account/apple-profile
-                               the user's Apple configuration profile of IKEv2 road-warrior access:
+                               the user's Apple configuration profile of IKEv2 access:
                               {"current_password", "current_code"?, "password"}, password encrypting the user's key in
                               it; {"name", "profile"}