fix tncc_emulate.py with Python 3.7

Fingerprint-checking monkey-patch for SSLSocket needs to be refined to work with Python 3.7+

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

trojans/tncc-emulate.py

@@ -659,10 +659,14 @@ def do_handshake(self, *args, **kw):
     elif not asn1crypto:
         logging.warn("asn1crypto module not available, will not validate server certificate")
     else:
-        # we need to monkey-patch this, because SSLContext.sslsocket_class isn't
-        # available until Python 3.7
-        # https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket
-        ssl.SSLSocket = fingerprint_checking_SSLSocket(fingerprint)
+        # For Python <3.7, we monkey-patch ssl.SSLSocket directly, because ssl.SSLContext.sslsocket_class
+        # isn't available until Python 3.7. For Python 3.7+, we set ssl.SSLContext.sslsocket_class
+        # to our modified version (which is sort of monkey-patching too).
+        # (see https://gist.github.com/dlenski/fc42156c00a615f4aa18a6d19d67e208)
+        if sys.version_info >= (3, 7):
+            ssl.SSLContext.sslsocket_class = fingerprint_checking_SSLSocket(fingerprint)
+        else:
+            ssl.SSLSocket = fingerprint_checking_SSLSocket(fingerprint)
 
     certs = []
     if asn1crypto:

www/changelog.xml

@@ -15,7 +15,7 @@
 <ul>
    <li><b>OpenConnect HEAD</b>
      <ul>
-       <li><i>No changelog entries yet</i></li>
+       <li>Make <tt>tncc-emulate.py</tt> work with Python 3.7+. (<a href="https://gitlab.com/openconnect/openconnect/-/issues/152">!152</a>, <a href="https://gitlab.com/openconnect/openconnect/merge_requests/120">!120</a>)</li>
      </ul><br/>
   </li>
   <li><b><a href="ftp://ftp.infradead.org/pub/openconnect/openconnect-8.10.tar.gz">OpenConnect v8.10</a></b>