fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.

2026-10-27 08:46:36 +01:00
1 parent 1697e1aa38
commit dd2dfaaf2b
@@ -7,7 +7,7 @@ disables the unit.
 Every SAMPLE_SECONDS, on the minute, a sample is taken with psutil: the CPU utilization since the
 previous sample, the memory used and in total, the free and the total space of /, the bytes
 received and sent per second on the external and the internal interface, and the load averages;
-and the VPN clients of each enabled VPN system (vpnrouter_status): road-warrior (p2s) and
+and the VPN clients of each enabled VPN system (vpnrouter_status): IKEv2 (p2s) and
 OpenVPN clients and WireGuard peers with a recent handshake; and of each site-to-site connection
 that is set up, whether it is up, the bytes and packets per second through its child SAs since
 the previous sample, and how long its IKE SA has been up. The interfaces, the enabled systems and
@@ -1063,7 +1063,7 @@ def routing_ready(ctx):


 def p2s_ready(ctx):
-    """Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
+    """IKEv2 access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
    return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])


@@ -10,7 +10,7 @@ adding one file here. Nothing in the core has to be edited.

 A module may define any of:

-    EXTRA_P2S_DNS   str, added to the road-warrior pool 'dns' list
+    EXTRA_P2S_DNS   str, added to the 'dns' list of the IKEv2 address pool
    EXTRA_LOCAL_TS  str, added to 'local_ts' on both connections
    apply(ctx)      called once the system has been configured, to apply
                    platform-specific state. Must be idempotent. ctx is the
@@ -3,7 +3,7 @@
 No platform-specific configuration is currently required.

 The Azure platform resolver 168.63.129.16 is deliberately *not* advertised to
-road-warrior clients and *not* added to the traffic selectors. Clients are
+IKEv2 clients and *not* added to the traffic selectors. Clients are
 given the router's addresses of p2s.dns_listen as their DNS servers, where dnsmasq
 forwards to the router's own systemd-resolved. That resolves
 Azure-internal names without routing the wireserver address through the tunnel
@@ -2,7 +2,7 @@

 No platform-specific configuration is currently required.

-As on Azure, road-warrior clients are given the router itself as their DNS
+As on Azure, IKEv2 clients are given the router itself as their DNS
 server and the router forwards through its own systemd-resolved, so the
 metadata resolver does not belong in the pool or in the traffic selectors.
 """
@@ -814,7 +814,7 @@ def profile(connection, name):


 def apple_profile(connection, name, password):
-    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 road-warrior access: the root CA and
+    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 access: the root CA and
    the P2S CA, the user's certificate and key as a PKCS#12 encrypted with the password, and the VPN.

    The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
@@ -828,7 +828,7 @@ def apple_profile(connection, name, password):
    cfg = vpnrouter.load_config()
    fqdn = cfg['wan']['local_fqdn'].strip()
    if not cfg['p2s']['enabled'] or not fqdn:
-        raise Failure('IKEv2 road-warrior access is not enabled', 2)
+        raise Failure('IKEv2 access is not enabled', 2)
    credentials = vpnrouter_pki.user_credentials(name)
    if credentials is None:
        raise Failure(f'user {name} has no certificate')
@@ -29,7 +29,7 @@ Pages:
  /backup  the backup settings, the last run and the local archives: show, change and run
           now (see backup())
  /remote-access
-           the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each
+           the settings of IKEv2, OpenVPN and WireGuard access and whether each
           runs: show and change, applied by vpn-router-setup (see remote_access())
  /ca      the PKI: its settings, the root and issuing CAs, the certificates issued; change the
           settings, issue and revoke certificates, and take the certificate of an issuing CA
@@ -79,7 +79,7 @@ default, the overall status, the time and the client's address (its address as f
 below); standard also the package version, the installed version of vpn-router-manager
 (manager_version, null when it is not installed) and the number of active and other services; full
 whether each service runs, whether Docker is installed, how many of the site-to-site connections are established
-(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN
+(site_to_site: connections and established, null when swanctl cannot be asked), and IKEv2, OpenVPN
 and WireGuard. No configuration data, key or connection name is shown, and no address but the client's.

 The service first initializes, without listening: it makes the signing key, the OpenID Provider's key
@@ -184,7 +184,7 @@ BODY_LIMIT = 65536
 #: The settings of a site_to_site connection that /site-to-site adds and changes.
 CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')

-#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard.
+#: The sections of the remote access systems /remote-access changes: IKEv2, OpenVPN and WireGuard.
 REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard')

 #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
@@ -490,7 +490,7 @@ def text_of(status):
        lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established')
    if 'p2s' in status:
        clients = status['p2s']['clients']
-        lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
+        lines.append(f'IKEv2: {"unknown" if clients is None else f"{clients} connected"}')
    if 'openvpn' in status:
        clients = status['openvpn']['clients']
        lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}')
@@ -566,7 +566,7 @@ def users(state, method, path, body):
      DELETE /users/<name>            remove the user and revoke the certificate
      GET    /users/<name>/profile    the OpenVPN client profile
      POST   /users/<name>/apple-profile
-                                      the Apple configuration profile of IKEv2 road-warrior access: {"password"}, which
+                                      the Apple configuration profile of IKEv2 access: {"password"}, which
                                      encrypts the user's key in it; {"name", "profile"}
      POST   /users/<name>/otp       a new TOTP secret and its otpauth URI; nothing is stored
      PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
@@ -1051,7 +1051,7 @@ def account(name, method, path, body):
      POST   /account/profile  the user's OpenVPN client profile: {"current_password", "current_code"?}; {"name",
                               "profile"}
      POST   /account/apple-profile
-                               the user's Apple configuration profile of IKEv2 road-warrior access:
+                               the user's Apple configuration profile of IKEv2 access:
                               {"current_password", "current_code"?, "password"}, password encrypting the user's key in
                               it; {"name", "profile"}