text: """
  SSL with SNI_-support for Python 2. Follow these instructions if you would
  like to verify SSL certificates in Python 2. Note, the default libraries do
  *not* do certificate checking; you need to do additional work to validate
  certificates yourself.
  
  This needs the following packages installed:
  
  * pyOpenSSL (tested with 16.0.0)
  * cryptography (minimum 1.3.4, from pyopenssl)
  * idna (minimum 2.0, from cryptography)
  
  However, pyopenssl depends on cryptography, which depends on idna, so while we
  use all three directly here we end up having relatively few packages required.
  
  You can install them with the following command:
  
      pip install pyopenssl cryptography idna
  
  To activate certificate checking, call
  :func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
  before you begin making HTTP requests. This can be done in a ``sitecustomize``
  module, or at any other time before your application begins using ``urllib3``,
  like this::
  
      try:
          import urllib3.contrib.pyopenssl
          urllib3.contrib.pyopenssl.inject_into_urllib3()
      except ImportError:
          pass
  
  Now you can use :mod:`urllib3` as you normally would, and it will support SNI
  when the required modules are installed.
  
  Activating this module also has the positive side effect of disabling SSL/TLS
  compression in Python 2 (see `CRIME attack`_).
  
  If you want to configure the default list of supported cipher suites, you can
  set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
  
  .. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
  .. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
  """
  from __future__ import absolute_import
  
  import OpenSSL.SSL
  from cryptography import x509
  from cryptography.hazmat.backends.openssl import backend as openssl_backend
  from cryptography.hazmat.backends.openssl.x509 import _Certificate
  
  try:
      from cryptography.x509 import UnsupportedExtension
  except ImportError:
      # UnsupportedExtension is gone in cryptography >= 2.1.0
      class UnsupportedExtension(Exception):
          pass
  
  
  from socket import timeout, error as SocketError
  from io import BytesIO
  
  try:  # Platform-specific: Python 2
      from socket import _fileobject
  except ImportError:  # Platform-specific: Python 3
      _fileobject = None
      from ..packages.backports.makefile import backport_makefile
  
  import logging
  import ssl
  from ..packages import six
  import sys
  
  from .. import util
  
  
  __all__ = ["inject_into_urllib3", "extract_from_urllib3"]
  
  # SNI always works.
  HAS_SNI = True
  
  # Map from urllib3 to PyOpenSSL compatible parameter-values.
  _openssl_versions = {
      util.PROTOCOL_TLS: OpenSSL.SSL.SSLv23_METHOD,
      ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
  }
  
  if hasattr(ssl, "PROTOCOL_SSLv3") and hasattr(OpenSSL.SSL, "SSLv3_METHOD"):
      _openssl_versions[ssl.PROTOCOL_SSLv3] = OpenSSL.SSL.SSLv3_METHOD
  
  if hasattr(ssl, "PROTOCOL_TLSv1_1") and hasattr(OpenSSL.SSL, "TLSv1_1_METHOD"):
      _openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD
  
  if hasattr(ssl, "PROTOCOL_TLSv1_2") and hasattr(OpenSSL.SSL, "TLSv1_2_METHOD"):
      _openssl_versions[ssl.PROTOCOL_TLSv1_2] = OpenSSL.SSL.TLSv1_2_METHOD
  
  
  _stdlib_to_openssl_verify = {
      ssl.CERT_NONE: OpenSSL.SSL.VERIFY_NONE,
      ssl.CERT_OPTIONAL: OpenSSL.SSL.VERIFY_PEER,
      ssl.CERT_REQUIRED: OpenSSL.SSL.VERIFY_PEER
      + OpenSSL.SSL.VERIFY_FAIL_IF_NO_PEER_CERT,
  }
  _openssl_to_stdlib_verify = dict((v, k) for k, v in _stdlib_to_openssl_verify.items())
  
  # OpenSSL will only write 16K at a time
  SSL_WRITE_BLOCKSIZE = 16384
  
  orig_util_HAS_SNI = util.HAS_SNI
  orig_util_SSLContext = util.ssl_.SSLContext
  
  
  log = logging.getLogger(__name__)
  
  
  def inject_into_urllib3():
      "Monkey-patch urllib3 with PyOpenSSL-backed SSL-support."
  
      _validate_dependencies_met()
  
      util.SSLContext = PyOpenSSLContext
      util.ssl_.SSLContext = PyOpenSSLContext
      util.HAS_SNI = HAS_SNI
      util.ssl_.HAS_SNI = HAS_SNI
      util.IS_PYOPENSSL = True
      util.ssl_.IS_PYOPENSSL = True
  
  
  def extract_from_urllib3():
      "Undo monkey-patching by :func:`inject_into_urllib3`."
  
      util.SSLContext = orig_util_SSLContext
      util.ssl_.SSLContext = orig_util_SSLContext
      util.HAS_SNI = orig_util_HAS_SNI
      util.ssl_.HAS_SNI = orig_util_HAS_SNI
      util.IS_PYOPENSSL = False
      util.ssl_.IS_PYOPENSSL = False
  
  
  def _validate_dependencies_met():
      """
      Verifies that PyOpenSSL's package-level dependencies have been met.
      Throws `ImportError` if they are not met.
      """
      # Method added in `cryptography==1.1`; not available in older versions
      from cryptography.x509.extensions import Extensions
  
      if getattr(Extensions, "get_extension_for_class", None) is None:
          raise ImportError(
              "'cryptography' module missing required functionality.  "
              "Try upgrading to v1.3.4 or newer."
          )
  
      # pyOpenSSL 0.14 and above use cryptography for OpenSSL bindings. The _x509
      # attribute is only present on those versions.
      from OpenSSL.crypto import X509
  
      x509 = X509()
      if getattr(x509, "_x509", None) is None:
          raise ImportError(
              "'pyOpenSSL' module missing required functionality. "
              "Try upgrading to v0.14 or newer."
          )
  
  
  def _dnsname_to_stdlib(name):
      """
      Converts a dNSName SubjectAlternativeName field to the form used by the
      standard library on the given Python version.
  
      Cryptography produces a dNSName as a unicode string that was idna-decoded
      from ASCII bytes. We need to idna-encode that string to get it back, and
      then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
      uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
  
      If the name cannot be idna-encoded then we return None signalling that
      the name given should be skipped.
      """
  
      def idna_encode(name):
          """
          Borrowed wholesale from the Python Cryptography Project. It turns out
          that we can't just safely call `idna.encode`: it can explode for
          wildcard names. This avoids that problem.
          """
          from stickybeak.vendored.pip._vendor import idna
  
          try:
              for prefix in [u"*.", u"."]:
                  if name.startswith(prefix):
                      name = name[len(prefix) :]
                      return prefix.encode("ascii") + idna.encode(name)
              return idna.encode(name)
          except idna.core.IDNAError:
              return None
  
      # Don't send IPv6 addresses through the IDNA encoder.
      if ":" in name:
          return name
  
      name = idna_encode(name)
      if name is None:
          return None
      elif sys.version_info >= (3, 0):
          name = name.decode("utf-8")
      return name
  
  
  def get_subj_alt_name(peer_cert):
      """
      Given an PyOpenSSL certificate, provides all the subject alternative names.
      """
      # Pass the cert to cryptography, which has much better APIs for this.
      if hasattr(peer_cert, "to_cryptography"):
          cert = peer_cert.to_cryptography()
      else:
          # This is technically using private APIs, but should work across all
          # relevant versions before PyOpenSSL got a proper API for this.
          cert = _Certificate(openssl_backend, peer_cert._x509)
  
      # We want to find the SAN extension. Ask Cryptography to locate it (it's
      # faster than looping in Python)
      try:
          ext = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
      except x509.ExtensionNotFound:
          # No such extension, return the empty list.
          return []
      except (
          x509.DuplicateExtension,
          UnsupportedExtension,
          x509.UnsupportedGeneralNameType,
          UnicodeError,
      ) as e:
          # A problem has been found with the quality of the certificate. Assume
          # no SAN field is present.
          log.warning(
              "A problem was encountered with the certificate that prevented "
              "urllib3 from finding the SubjectAlternativeName field. This can "
              "affect certificate validation. The error was %s",
              e,
          )
          return []
  
      # We want to return dNSName and iPAddress fields. We need to cast the IPs
      # back to strings because the match_hostname function wants them as
      # strings.
      # Sadly the DNS names need to be idna encoded and then, on Python 3, UTF-8
      # decoded. This is pretty frustrating, but that's what the standard library
      # does with certificates, and so we need to attempt to do the same.
      # We also want to skip over names which cannot be idna encoded.
      names = [
          ("DNS", name)
          for name in map(_dnsname_to_stdlib, ext.get_values_for_type(x509.DNSName))
          if name is not None
      ]
      names.extend(
          ("IP Address", str(name)) for name in ext.get_values_for_type(x509.IPAddress)
      )
  
      return names
  
  
  class WrappedSocket(object):
      """API-compatibility wrapper for Python OpenSSL's Connection-class.
  
      Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
      collector of pypy.
      """
  
      def __init__(self, connection, socket, suppress_ragged_eofs=True):
          self.connection = connection
          self.socket = socket
          self.suppress_ragged_eofs = suppress_ragged_eofs
          self._makefile_refs = 0
          self._closed = False
  
      def fileno(self):
          return self.socket.fileno()
  
      # Copy-pasted from Python 3.5 source code
      def _decref_socketios(self):
          if self._makefile_refs > 0:
              self._makefile_refs -= 1
          if self._closed:
              self.close()
  
      def recv(self, *args, **kwargs):
          try:
              data = self.connection.recv(*args, **kwargs)
          except OpenSSL.SSL.SysCallError as e:
              if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):
                  return b""
              else:
                  raise SocketError(str(e))
          except OpenSSL.SSL.ZeroReturnError:
              if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
                  return b""
              else:
                  raise
          except OpenSSL.SSL.WantReadError:
              if not util.wait_for_read(self.socket, self.socket.gettimeout()):
                  raise timeout("The read operation timed out")
              else:
                  return self.recv(*args, **kwargs)
  
          # TLS 1.3 post-handshake authentication
          except OpenSSL.SSL.Error as e:
              raise ssl.SSLError("read error: %r" % e)
          else:
              return data
  
      def recv_into(self, *args, **kwargs):
          try:
              return self.connection.recv_into(*args, **kwargs)
          except OpenSSL.SSL.SysCallError as e:
              if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):
                  return 0
              else:
                  raise SocketError(str(e))
          except OpenSSL.SSL.ZeroReturnError:
              if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
                  return 0
              else:
                  raise
          except OpenSSL.SSL.WantReadError:
              if not util.wait_for_read(self.socket, self.socket.gettimeout()):
                  raise timeout("The read operation timed out")
              else:
                  return self.recv_into(*args, **kwargs)
  
          # TLS 1.3 post-handshake authentication
          except OpenSSL.SSL.Error as e:
              raise ssl.SSLError("read error: %r" % e)
  
      def settimeout(self, timeout):
          return self.socket.settimeout(timeout)
  
      def _send_until_done(self, data):
          while True:
              try:
                  return self.connection.send(data)
              except OpenSSL.SSL.WantWriteError:
                  if not util.wait_for_write(self.socket, self.socket.gettimeout()):
                      raise timeout()
                  continue
              except OpenSSL.SSL.SysCallError as e:
                  raise SocketError(str(e))
  
      def sendall(self, data):
          total_sent = 0
          while total_sent < len(data):
              sent = self._send_until_done(
                  data[total_sent : total_sent + SSL_WRITE_BLOCKSIZE]
              )
              total_sent += sent
  
      def shutdown(self):
          # FIXME rethrow compatible exceptions should we ever use this
          self.connection.shutdown()
  
      def close(self):
          if self._makefile_refs < 1:
              try:
                  self._closed = True
                  return self.connection.close()
              except OpenSSL.SSL.Error:
                  return
          else:
              self._makefile_refs -= 1
  
      def getpeercert(self, binary_form=False):
          x509 = self.connection.get_peer_certificate()
  
          if not x509:
              return x509
  
          if binary_form:
              return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509)
  
          return {
              "subject": ((("commonName", x509.get_subject().CN),),),
              "subjectAltName": get_subj_alt_name(x509),
          }
  
      def version(self):
          return self.connection.get_protocol_version_name()
  
      def _reuse(self):
          self._makefile_refs += 1
  
      def _drop(self):
          if self._makefile_refs < 1:
              self.close()
          else:
              self._makefile_refs -= 1
  
  
  if _fileobject:  # Platform-specific: Python 2
  
      def makefile(self, mode, bufsize=-1):
          self._makefile_refs += 1
          return _fileobject(self, mode, bufsize, close=True)
  
  
  else:  # Platform-specific: Python 3
      makefile = backport_makefile
  
  WrappedSocket.makefile = makefile
  
  
  class PyOpenSSLContext(object):
      """
      I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
      for translating the interface of the standard library ``SSLContext`` object
      to calls into PyOpenSSL.
      """
  
      def __init__(self, protocol):
          self.protocol = _openssl_versions[protocol]
          self._ctx = OpenSSL.SSL.Context(self.protocol)
          self._options = 0
          self.check_hostname = False
  
      @property
      def options(self):
          return self._options
  
      @options.setter
      def options(self, value):
          self._options = value
          self._ctx.set_options(value)
  
      @property
      def verify_mode(self):
          return _openssl_to_stdlib_verify[self._ctx.get_verify_mode()]
  
      @verify_mode.setter
      def verify_mode(self, value):
          self._ctx.set_verify(_stdlib_to_openssl_verify[value], _verify_callback)
  
      def set_default_verify_paths(self):
          self._ctx.set_default_verify_paths()
  
      def set_ciphers(self, ciphers):
          if isinstance(ciphers, six.text_type):
              ciphers = ciphers.encode("utf-8")
          self._ctx.set_cipher_list(ciphers)
  
      def load_verify_locations(self, cafile=None, capath=None, cadata=None):
          if cafile is not None:
              cafile = cafile.encode("utf-8")
          if capath is not None:
              capath = capath.encode("utf-8")
          try:
              self._ctx.load_verify_locations(cafile, capath)
              if cadata is not None:
                  self._ctx.load_verify_locations(BytesIO(cadata))
          except OpenSSL.SSL.Error as e:
              raise ssl.SSLError("unable to load trusted certificates: %r" % e)
  
      def load_cert_chain(self, certfile, keyfile=None, password=None):
          self._ctx.use_certificate_chain_file(certfile)
          if password is not None:
              if not isinstance(password, six.binary_type):
                  password = password.encode("utf-8")
              self._ctx.set_passwd_cb(lambda *_: password)
          self._ctx.use_privatekey_file(keyfile or certfile)
  
      def wrap_socket(
          self,
          sock,
          server_side=False,
          do_handshake_on_connect=True,
          suppress_ragged_eofs=True,
          server_hostname=None,
      ):
          cnx = OpenSSL.SSL.Connection(self._ctx, sock)
  
          if isinstance(server_hostname, six.text_type):  # Platform-specific: Python 3
              server_hostname = server_hostname.encode("utf-8")
  
          if server_hostname is not None:
              cnx.set_tlsext_host_name(server_hostname)
  
          cnx.set_connect_state()
  
          while True:
              try:
                  cnx.do_handshake()
              except OpenSSL.SSL.WantReadError:
                  if not util.wait_for_read(sock, sock.gettimeout()):
                      raise timeout("select timed out")
                  continue
              except OpenSSL.SSL.Error as e:
                  raise ssl.SSLError("bad handshake: %r" % e)
              break
  
          return WrappedSocket(cnx, sock)
  
  
  def _verify_callback(cnx, x509, err_no, err_depth, return_code):
      return err_no == 0
  