prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Do not support sslv3 (poodle)
  In Docker 1.3.1 (coming very soon), only TLS1.0+ will be supported.
  Ping @shin- 
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `docker/tls.py`
  Content:
  ```
  1 import os
  2 
  3 from . import errors
  4 from .ssladapter import ssladapter
  5 
  6 
  7 class TLSConfig(object):
  8     cert = None
  9     verify = None
  10     ssl_version = None
  11 
  12     def __init__(self, client_cert=None, ca_cert=None, verify=None,
  13                  ssl_version=None, assert_hostname=None):
  14         # Argument compatibility/mapping with
  15         # http://docs.docker.com/examples/https/
  16         # This diverges from the Docker CLI in that users can specify 'tls'
  17         # here, but also disable any public/default CA pool verification by
  18         # leaving tls_verify=False
  19 
  20         # urllib3 sets a default ssl_version if ssl_version is None
  21         # http://tinyurl.com/kxga8hb
  22         self.ssl_version = ssl_version
  23         self.assert_hostname = assert_hostname
  24 
  25         # "tls" and "tls_verify" must have both or neither cert/key files
  26         # In either case, Alert the user when both are expected, but any are
  27         # missing.
  28 
  29         if client_cert:
  30             try:
  31                 tls_cert, tls_key = client_cert
  32             except ValueError:
  33                 raise errors.TLSParameterError(
  34                     'client_config must be a tuple of'
  35                     ' (client certificate, key file)'
  36                 )
  37 
  38             if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or
  39                not os.path.isfile(tls_key)):
  40                 raise errors.TLSParameterError(
  41                     'Path to a certificate and key files must be provided'
  42                     ' through the client_config param'
  43                 )
  44             self.cert = (tls_cert, tls_key)
  45 
  46         # Either set verify to True (public/default CA checks) or to the
  47         # path of a CA Cert file.
  48         if verify is not None:
  49             if not ca_cert:
  50                 self.verify = verify
  51             elif os.path.isfile(ca_cert):
  52                 if not verify:
  53                     raise errors.TLSParameterError(
  54                         'verify can not be False when a CA cert is'
  55                         ' provided.'
  56                     )
  57                 self.verify = ca_cert
  58             else:
  59                 raise errors.TLSParameterError(
  60                     'Invalid CA certificate provided for `tls_ca_cert`.'
  61                 )
  62 
  63     def configure_client(self, client):
  64         client.ssl_version = self.ssl_version
  65         if self.verify is not None:
  66             client.verify = self.verify
  67         if self.cert:
  68             client.cert = self.cert
  69         client.mount('https://', ssladapter.SSLAdapter(
  70             ssl_version=self.ssl_version,
  71             assert_hostname=self.assert_hostname,
  72         ))
  73
  ```
  
  Path: `docker/ssladapter/ssladapter.py`
  Content:
  ```
  1 """ Resolves OpenSSL issues in some servers:
  2       https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/
  3       https://github.com/kennethreitz/requests/pull/799
  4 """
  5 from distutils.version import StrictVersion
  6 from requests.adapters import HTTPAdapter
  7 try:
  8     import requests.packages.urllib3 as urllib3
  9 except ImportError:
  10     import urllib3
  11 
  12 
  13 PoolManager = urllib3.poolmanager.PoolManager
  14 
  15 
  16 class SSLAdapter(HTTPAdapter):
  17     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''
  18     def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):
  19         self.ssl_version = ssl_version
  20         self.assert_hostname = assert_hostname
  21         super(SSLAdapter, self).__init__(**kwargs)
  22 
  23     def init_poolmanager(self, connections, maxsize, block=False):
  24         kwargs = {
  25             'num_pools': connections,
  26             'maxsize': maxsize,
  27             'block': block,
  28             'assert_hostname': self.assert_hostname,
  29         }
  30         if self.can_override_ssl_version():
  31             kwargs['ssl_version'] = self.ssl_version
  32 
  33         self.poolmanager = PoolManager(**kwargs)
  34 
  35     def can_override_ssl_version(self):
  36         urllib_ver = urllib3.__version__.split('-')[0]
  37         if urllib_ver is None:
  38             return False
  39         if urllib_ver == 'dev':
  40             return True
  41         return StrictVersion(urllib_ver) > StrictVersion('1.5')
  42
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/docker/ssladapter/ssladapter.py b/docker/ssladapter/ssladapter.py
  --- a/docker/ssladapter/ssladapter.py
  +++ b/docker/ssladapter/ssladapter.py
  @@ -4,6 +4,7 @@
   """
   from distutils.version import StrictVersion
   from requests.adapters import HTTPAdapter
  +import ssl
   try:
       import requests.packages.urllib3 as urllib3
   except ImportError:
  @@ -13,9 +14,19 @@
   PoolManager = urllib3.poolmanager.PoolManager
   
   
  +def get_max_tls_protocol():
  +    protocols = ('PROTOCOL_TLSv1_2',
  +                 'PROTOCOL_TLSv1_1',
  +                 'PROTOCOL_TLSv1')
  +    for proto in protocols:
  +        if hasattr(ssl, proto):
  +            return proto
  +
  +
   class SSLAdapter(HTTPAdapter):
       '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''
       def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):
  +        ssl_version = ssl_version or get_max_tls_protocol()
           self.ssl_version = ssl_version
           self.assert_hostname = assert_hostname
           super(SSLAdapter, self).__init__(**kwargs)
  diff --git a/docker/tls.py b/docker/tls.py
  --- a/docker/tls.py
  +++ b/docker/tls.py
  @@ -17,8 +17,11 @@
           # here, but also disable any public/default CA pool verification by
           # leaving tls_verify=False
   
  -        # urllib3 sets a default ssl_version if ssl_version is None
  -        # http://tinyurl.com/kxga8hb
  +        # urllib3 sets a default ssl_version if ssl_version is None,
  +        # but that default is the vulnerable PROTOCOL_SSLv23 selection,
  +        # so we override the default with the maximum supported in the running
  +        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)
  +        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()
           self.ssl_version = ssl_version
           self.assert_hostname = assert_hostname
  
verification_info: {"golden_diff": "diff --git a/docker/ssladapter/ssladapter.py b/docker/ssladapter/ssladapter.py\n--- a/docker/ssladapter/ssladapter.py\n+++ b/docker/ssladapter/ssladapter.py\n@@ -4,6 +4,7 @@\n \"\"\"\n from distutils.version import StrictVersion\n from requests.adapters import HTTPAdapter\n+import ssl\n try:\n     import requests.packages.urllib3 as urllib3\n except ImportError:\n@@ -13,9 +14,19 @@\n PoolManager = urllib3.poolmanager.PoolManager\n \n \n+def get_max_tls_protocol():\n+    protocols = ('PROTOCOL_TLSv1_2',\n+                 'PROTOCOL_TLSv1_1',\n+                 'PROTOCOL_TLSv1')\n+    for proto in protocols:\n+        if hasattr(ssl, proto):\n+            return proto\n+\n+\n class SSLAdapter(HTTPAdapter):\n     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n     def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n+        ssl_version = ssl_version or get_max_tls_protocol()\n         self.ssl_version = ssl_version\n         self.assert_hostname = assert_hostname\n         super(SSLAdapter, self).__init__(**kwargs)\ndiff --git a/docker/tls.py b/docker/tls.py\n--- a/docker/tls.py\n+++ b/docker/tls.py\n@@ -17,8 +17,11 @@\n         # here, but also disable any public/default CA pool verification by\n         # leaving tls_verify=False\n \n-        # urllib3 sets a default ssl_version if ssl_version is None\n-        # http://tinyurl.com/kxga8hb\n+        # urllib3 sets a default ssl_version if ssl_version is None,\n+        # but that default is the vulnerable PROTOCOL_SSLv23 selection,\n+        # so we override the default with the maximum supported in the running\n+        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)\n+        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()\n         self.ssl_version = ssl_version\n         self.assert_hostname = assert_hostname\n", "issue": "Do not support sslv3 (poodle)\nIn Docker 1.3.1 (coming very soon), only TLS1.0+ will be supported.\nPing @shin- \n\n", "before_files": [{"content": "import os\n\nfrom . import errors\nfrom .ssladapter import ssladapter\n\n\nclass TLSConfig(object):\n    cert = None\n    verify = None\n    ssl_version = None\n\n    def __init__(self, client_cert=None, ca_cert=None, verify=None,\n                 ssl_version=None, assert_hostname=None):\n        # Argument compatibility/mapping with\n        # http://docs.docker.com/examples/https/\n        # This diverges from the Docker CLI in that users can specify 'tls'\n        # here, but also disable any public/default CA pool verification by\n        # leaving tls_verify=False\n\n        # urllib3 sets a default ssl_version if ssl_version is None\n        # http://tinyurl.com/kxga8hb\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n\n        # \"tls\" and \"tls_verify\" must have both or neither cert/key files\n        # In either case, Alert the user when both are expected, but any are\n        # missing.\n\n        if client_cert:\n            try:\n                tls_cert, tls_key = client_cert\n            except ValueError:\n                raise errors.TLSParameterError(\n                    'client_config must be a tuple of'\n                    ' (client certificate, key file)'\n                )\n\n            if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or\n               not os.path.isfile(tls_key)):\n                raise errors.TLSParameterError(\n                    'Path to a certificate and key files must be provided'\n                    ' through the client_config param'\n                )\n            self.cert = (tls_cert, tls_key)\n\n        # Either set verify to True (public/default CA checks) or to the\n        # path of a CA Cert file.\n        if verify is not None:\n            if not ca_cert:\n                self.verify = verify\n            elif os.path.isfile(ca_cert):\n                if not verify:\n                    raise errors.TLSParameterError(\n                        'verify can not be False when a CA cert is'\n                        ' provided.'\n                    )\n                self.verify = ca_cert\n            else:\n                raise errors.TLSParameterError(\n                    'Invalid CA certificate provided for `tls_ca_cert`.'\n                )\n\n    def configure_client(self, client):\n        client.ssl_version = self.ssl_version\n        if self.verify is not None:\n            client.verify = self.verify\n        if self.cert:\n            client.cert = self.cert\n        client.mount('https://', ssladapter.SSLAdapter(\n            ssl_version=self.ssl_version,\n            assert_hostname=self.assert_hostname,\n        ))\n", "path": "docker/tls.py"}, {"content": "\"\"\" Resolves OpenSSL issues in some servers:\n      https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/\n      https://github.com/kennethreitz/requests/pull/799\n\"\"\"\nfrom distutils.version import StrictVersion\nfrom requests.adapters import HTTPAdapter\ntry:\n    import requests.packages.urllib3 as urllib3\nexcept ImportError:\n    import urllib3\n\n\nPoolManager = urllib3.poolmanager.PoolManager\n\n\nclass SSLAdapter(HTTPAdapter):\n    '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n    def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n        super(SSLAdapter, self).__init__(**kwargs)\n\n    def init_poolmanager(self, connections, maxsize, block=False):\n        kwargs = {\n            'num_pools': connections,\n            'maxsize': maxsize,\n            'block': block,\n            'assert_hostname': self.assert_hostname,\n        }\n        if self.can_override_ssl_version():\n            kwargs['ssl_version'] = self.ssl_version\n\n        self.poolmanager = PoolManager(**kwargs)\n\n    def can_override_ssl_version(self):\n        urllib_ver = urllib3.__version__.split('-')[0]\n        if urllib_ver is None:\n            return False\n        if urllib_ver == 'dev':\n            return True\n        return StrictVersion(urllib_ver) > StrictVersion('1.5')\n", "path": "docker/ssladapter/ssladapter.py"}], "after_files": [{"content": "import os\n\nfrom . import errors\nfrom .ssladapter import ssladapter\n\n\nclass TLSConfig(object):\n    cert = None\n    verify = None\n    ssl_version = None\n\n    def __init__(self, client_cert=None, ca_cert=None, verify=None,\n                 ssl_version=None, assert_hostname=None):\n        # Argument compatibility/mapping with\n        # http://docs.docker.com/examples/https/\n        # This diverges from the Docker CLI in that users can specify 'tls'\n        # here, but also disable any public/default CA pool verification by\n        # leaving tls_verify=False\n\n        # urllib3 sets a default ssl_version if ssl_version is None,\n        # but that default is the vulnerable PROTOCOL_SSLv23 selection,\n        # so we override the default with the maximum supported in the running\n        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)\n        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n\n        # \"tls\" and \"tls_verify\" must have both or neither cert/key files\n        # In either case, Alert the user when both are expected, but any are\n        # missing.\n\n        if client_cert:\n            try:\n                tls_cert, tls_key = client_cert\n            except ValueError:\n                raise errors.TLSParameterError(\n                    'client_config must be a tuple of'\n                    ' (client certificate, key file)'\n                )\n\n            if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or\n               not os.path.isfile(tls_key)):\n                raise errors.TLSParameterError(\n                    'Path to a certificate and key files must be provided'\n                    ' through the client_config param'\n                )\n            self.cert = (tls_cert, tls_key)\n\n        # Either set verify to True (public/default CA checks) or to the\n        # path of a CA Cert file.\n        if verify is not None:\n            if not ca_cert:\n                self.verify = verify\n            elif os.path.isfile(ca_cert):\n                if not verify:\n                    raise errors.TLSParameterError(\n                        'verify can not be False when a CA cert is'\n                        ' provided.'\n                    )\n                self.verify = ca_cert\n            else:\n                raise errors.TLSParameterError(\n                    'Invalid CA certificate provided for `tls_ca_cert`.'\n                )\n\n    def configure_client(self, client):\n        client.ssl_version = self.ssl_version\n        if self.verify is not None:\n            client.verify = self.verify\n        if self.cert:\n            client.cert = self.cert\n        client.mount('https://', ssladapter.SSLAdapter(\n            ssl_version=self.ssl_version,\n            assert_hostname=self.assert_hostname,\n        ))\n", "path": "docker/tls.py"}, {"content": "\"\"\" Resolves OpenSSL issues in some servers:\n      https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/\n      https://github.com/kennethreitz/requests/pull/799\n\"\"\"\nfrom distutils.version import StrictVersion\nfrom requests.adapters import HTTPAdapter\nimport ssl\ntry:\n    import requests.packages.urllib3 as urllib3\nexcept ImportError:\n    import urllib3\n\n\nPoolManager = urllib3.poolmanager.PoolManager\n\n\ndef get_max_tls_protocol():\n    protocols = ('PROTOCOL_TLSv1_2',\n                 'PROTOCOL_TLSv1_1',\n                 'PROTOCOL_TLSv1')\n    for proto in protocols:\n        if hasattr(ssl, proto):\n            return proto\n\n\nclass SSLAdapter(HTTPAdapter):\n    '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n    def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n        ssl_version = ssl_version or get_max_tls_protocol()\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n        super(SSLAdapter, self).__init__(**kwargs)\n\n    def init_poolmanager(self, connections, maxsize, block=False):\n        kwargs = {\n            'num_pools': connections,\n            'maxsize': maxsize,\n            'block': block,\n            'assert_hostname': self.assert_hostname,\n        }\n        if self.can_override_ssl_version():\n            kwargs['ssl_version'] = self.ssl_version\n\n        self.poolmanager = PoolManager(**kwargs)\n\n    def can_override_ssl_version(self):\n        urllib_ver = urllib3.__version__.split('-')[0]\n        if urllib_ver is None:\n            return False\n        if urllib_ver == 'dev':\n            return True\n        return StrictVersion(urllib_ver) > StrictVersion('1.5')\n", "path": "docker/ssladapter/ssladapter.py"}]}