vpnc: update version and add nossl variant

[jschwartzenberg]

Maintainer: @danielg4
Compile tested: (mipsel_24kc_musl, TP-Link Archer C50v6, f10ee1e20966bdb86cb61a87338f953de1d86cc6)
Compile tested: (arm_arm1176jzf-s_vfp, Raspberry Pi Model B Rev 2, 24.10.0-rc7)
Run tested: (arm_arm1176jzf-s_vfp, Raspberry Pi Model B Rev 2, 24.10.0-rc7)

Description:
Updated vpnc to the latest version. I submitted a patch that allows compilation without an SSL library. When using a pre-shared group key, vpnc doesn't use its SSL library, so for many cases this is not needed while it allows vpnc to be used on devices with little space where an SSL library does not fit. See also: streambinder/vpnc#55

Note that I still need to test the newer version and will report back. Many thanks in advance for any feedback you might have!

[BKPepe]

I noticed you've added a non-SSL version. We want to ensure we fully understand all potential use-case scenarios. Could you please share more information about the situations where this version would be used? This will help us ensure we're providing the best possible solution for all our users. May I know what is the size diference between SSL and nonSSL variant? We recommend using SSL/TLS, because of the security, which is top priority for us.

[jschwartzenberg]

Could you please share more information about the situations where this version would be used?

vpnc supports VPN connections either with SSL certificates or using a private pre-shared group key. In case the nonSSL variant is used to connect to an endpoint that relies on certificates, it will bail out, no connection will be established. In the second case with the pre-shared key, the whole SSL library is not involved with the connection setup, so it doesn't matter whether you use an SSL or nonSSL build.

So the nossl version can only be used for scenarios which work with the pre-shared group key. I use it to connect to a Fritzbox.

May I know what is the size diference between SSL and nonSSL variant?

The SSL variant pulls in GNUTLS, which takes up more space than I have free on my TP-Link Archer C50. On my Turris Omnia I have more than enough space, but on the Archer C50 there's about a 3.5" floppy worth of space left after installing plain OpenWRT and by avoiding the SSL dependency I can still establish a VPN connection with vpnc :)

We recommend using SSL/TLS, because of the security, which is top priority for us.

In this case there's no security impact as these are independent connection mechanisms. If the endpoint requires SSL/TLS, you must use the SSL/TLS version. If the endpoint uses a pre-shared group key, you can use either version, but the SSL/TLS part will never be used.

Please let me know if I should provide more info! Many thanks for the quick response!

[jschwartzenberg]

@BKPepe I added more information to the description. I hope it is more clear now. Let me know if I should alter it in any way.

I also solved another issue and tested that it works on my Raspberry Pi.

[openwrt-ai]

Reviewed 1 new commit. One inline issue (conffiles template misnamed) and one nit. Commit message accurately reflects the diff.

---

Generated by Claude Code

[openwrt-ai]

The conffiles template is renamed to Package/vpnc-default/conffiles, but no package by that name is built. OpenWrt looks up conffiles as Package/<pkgname>/conffiles, so it needs Package/vpnc/conffiles and Package/vpnc-nossl/conffiles. As written, neither package registers /etc/vpnc/default.conf as a conffile anymore — a regression from the previous Package/vpnc/conffiles, meaning the file is no longer preserved via the conffiles mechanism on upgrade/removal.

Mirroring the Package/vpnc-nossl/install assignment you already use:

Suggested change

	define Package/vpnc-default/conffiles
	/etc/vpnc/default.conf
	endef
	define Package/vpnc/conffiles
	/etc/vpnc/default.conf
	endef
	Package/vpnc-nossl/conffiles = $(Package/vpnc/conffiles)

---

Generated by Claude Code

[openwrt-ai]

nit: this continuation line is indented with spaces while the surrounding recipe uses tabs. For consistency with the rest of the block:

Suggested change

	$(CRYPTO_NONE_MAKEFLAG) \
	$(CRYPTO_NONE_MAKEFLAG) \

---

Generated by Claude Code

[jschwartzenberg]

Should I do anything about the indentation messages? There are tabs there already and I did not touch most of those lines.

Edit: I saw other Makefiles use spaces instead, so I guess this is something that is converging to a standard practice that wasn't enforced before. I updated the commit to conform.

[openwrt-ai]

Reviewed 1 new commit; no new issues found. The changes since the last review resolve both previously flagged items (the misnamed conffiles template is now Package/vpnc/conffiles with a vpnc-nossl mapping, and the makeflag indentation is fixed). Commit message still accurately reflects the diff.

---

Generated by Claude Code

[BKPepe]

I don't think it's possible to install vpnc-ssl and vpnc-nonssl at the same time, right? So CONFLICTS should be defined there.

[jschwartzenberg]

I don't think it's possible to install vpnc-ssl and vpnc-nonssl at the same time, right? So CONFLICTS should be defined there.

Indeed! Added this now, I hope I did it correctly.

[jschwartzenberg]

I updated the hash too now. I was thinking of looking at moving to a newer commit ID, as it seems there were quite some commits in the vpnc repository since I created this PR, but they all seem to be related to their CI.
https://github.com/streambinder/vpnc/commits/master/

[openwrt-ai]

Reviewed 1 new commit; no new issues found. The changes since the last review (mutual CONFLICTS between vpnc and vpnc-nossl, the PKG_MIRROR_HASH update, and the description indentation normalization) are all correct and address the prior conversation. Commit message still accurately reflects the diff.

---

Generated by Claude Code

[jschwartzenberg]

I updated the patch with the new line numbers as it was considered dirty. But now it seems to expect it can be attributed as well. It seems it was introduced by Rosen Penev in 2019. I guess I'll attribute it to them :)