Add stunnel v5.71 port

[embhorn]

No description provided.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds a stunnel 5.71 port patch with optional wolfSSL support and documents how to build/test it on Unix.

Changes:

• Add --enable-wolfssl / --enable-wolfssldebug configure + build-system switches and conditional compilation for wolfSSL compatibility.
• Implement wolfSSL-specific behavior in TLS/OCSP/DH/ECDH/session/verification paths and add a MinGW wolfSSL makefile.
• Update Python test harness to recognize wolfSSL output and allow running a single test plugin; adjust several plugin expectations/skips.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
stunnel/5.71/stunnel-5.71.patch	Main patch adding wolfSSL build/config logic, code ifdefs, and test harness changes for 5.71.
stunnel/5.71/README_UNIX.md	Unix build + test instructions for wolfSSL/OpenSSL builds and documented behavioral differences.

Suppressed comments (7)

stunnel/5.71/stunnel-5.71.patch:1

• The success check/comment is inverted (it treats == SSL_SUCCESS as failure) and SSL_FILETYPE_ASN1 is very likely wrong for typical PEM cert/key files. This can silently skip DH configuration (or fall through into the OpenSSL-path code that uses dh_params) on actual failures. Fix by using the correct filetype (likely SSL_FILETYPE_PEM) and returning failure when wolfSSL_CTX_SetTmpDH_file() does not succeed (or implement a safe fallback explicitly).

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• Session ticket key_name is expected to be a fixed-size identifier (commonly 16 bytes) and should not be partially filled with a constant string (includes a NUL and leaves remaining bytes uninitialized). This can reduce security/robustness of ticket key rotation and can cause interop issues. Set all bytes deterministically (e.g., derive from the active ticket key material or at least fully initialize the buffer to a stable 16-byte value).

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• wolfSSL_Debugging_ON() typically depends on wolfSSL being built with debugging enabled; calling it unconditionally for all wolfSSL builds can cause build/link failures or unexpected runtime overhead/log noise. Gate these calls behind the configure-controlled macro (e.g., WOLFSSL_DEBUG_ON) or the --enable-wolfssldebug path so that non-debug wolfSSL builds remain clean.

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• This code runs in an async method, but uses time.sleep(), which blocks the event loop. Remove the sleep entirely (filtering doesn’t need it), or replace it with a non-blocking sleep (e.g., await asyncio.sleep(...)) if a delay is truly required.

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• If c1Data is allocated successfully and wolfSSL_X509_get_pubkey_buffer(c2, NULL, &c2Sz) fails, the function returns without freeing c1Data (leak on error path). Free any previously allocated buffers before returning on downstream failures, and consider validating c1Sz/c2Sz > 0 before allocating.

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• Config.plugin is declared as str but argparse defaults it to None, so the effective type is Optional[str]. Update the NamedTuple annotation to Optional[str] (or str | None on newer Python) to match runtime behavior and avoid type inconsistencies.

diff --git a/configure.ac b/configure.ac

stunnel/5.71/stunnel-5.71.patch:1

• Binding to a fixed port (12345) can spuriously fail if the port is in use (e.g., parallel test runs/CI), causing unnecessary skips. Prefer binding to port 0 (ephemeral) for the capability check to avoid collisions.

diff --git a/configure.ac b/configure.ac

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.