We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Do not support sslv3 (poodle)
In Docker 1.3.1 (coming very soon), only TLS1.0+ will be supported.
Ping @shin- 


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `docker/tls.py`
Content:
```
1 import os
2 
3 from . import errors
4 from .ssladapter import ssladapter
5 
6 
7 class TLSConfig(object):
8     cert = None
9     verify = None
10     ssl_version = None
11 
12     def __init__(self, client_cert=None, ca_cert=None, verify=None,
13                  ssl_version=None, assert_hostname=None):
14         # Argument compatibility/mapping with
15         # http://docs.docker.com/examples/https/
16         # This diverges from the Docker CLI in that users can specify 'tls'
17         # here, but also disable any public/default CA pool verification by
18         # leaving tls_verify=False
19 
20         # urllib3 sets a default ssl_version if ssl_version is None
21         # http://tinyurl.com/kxga8hb
22         self.ssl_version = ssl_version
23         self.assert_hostname = assert_hostname
24 
25         # "tls" and "tls_verify" must have both or neither cert/key files
26         # In either case, Alert the user when both are expected, but any are
27         # missing.
28 
29         if client_cert:
30             try:
31                 tls_cert, tls_key = client_cert
32             except ValueError:
33                 raise errors.TLSParameterError(
34                     'client_config must be a tuple of'
35                     ' (client certificate, key file)'
36                 )
37 
38             if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or
39                not os.path.isfile(tls_key)):
40                 raise errors.TLSParameterError(
41                     'Path to a certificate and key files must be provided'
42                     ' through the client_config param'
43                 )
44             self.cert = (tls_cert, tls_key)
45 
46         # Either set verify to True (public/default CA checks) or to the
47         # path of a CA Cert file.
48         if verify is not None:
49             if not ca_cert:
50                 self.verify = verify
51             elif os.path.isfile(ca_cert):
52                 if not verify:
53                     raise errors.TLSParameterError(
54                         'verify can not be False when a CA cert is'
55                         ' provided.'
56                     )
57                 self.verify = ca_cert
58             else:
59                 raise errors.TLSParameterError(
60                     'Invalid CA certificate provided for `tls_ca_cert`.'
61                 )
62 
63     def configure_client(self, client):
64         client.ssl_version = self.ssl_version
65         if self.verify is not None:
66             client.verify = self.verify
67         if self.cert:
68             client.cert = self.cert
69         client.mount('https://', ssladapter.SSLAdapter(
70             ssl_version=self.ssl_version,
71             assert_hostname=self.assert_hostname,
72         ))
73
```

Path: `docker/ssladapter/ssladapter.py`
Content:
```
1 """ Resolves OpenSSL issues in some servers:
2       https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/
3       https://github.com/kennethreitz/requests/pull/799
4 """
5 from distutils.version import StrictVersion
6 from requests.adapters import HTTPAdapter
7 try:
8     import requests.packages.urllib3 as urllib3
9 except ImportError:
10     import urllib3
11 
12 
13 PoolManager = urllib3.poolmanager.PoolManager
14 
15 
16 class SSLAdapter(HTTPAdapter):
17     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''
18     def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):
19         self.ssl_version = ssl_version
20         self.assert_hostname = assert_hostname
21         super(SSLAdapter, self).__init__(**kwargs)
22 
23     def init_poolmanager(self, connections, maxsize, block=False):
24         kwargs = {
25             'num_pools': connections,
26             'maxsize': maxsize,
27             'block': block,
28             'assert_hostname': self.assert_hostname,
29         }
30         if self.can_override_ssl_version():
31             kwargs['ssl_version'] = self.ssl_version
32 
33         self.poolmanager = PoolManager(**kwargs)
34 
35     def can_override_ssl_version(self):
36         urllib_ver = urllib3.__version__.split('-')[0]
37         if urllib_ver is None:
38             return False
39         if urllib_ver == 'dev':
40             return True
41         return StrictVersion(urllib_ver) > StrictVersion('1.5')
42
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/docker/ssladapter/ssladapter.py b/docker/ssladapter/ssladapter.py
--- a/docker/ssladapter/ssladapter.py
+++ b/docker/ssladapter/ssladapter.py
@@ -4,6 +4,7 @@
 """
 from distutils.version import StrictVersion
 from requests.adapters import HTTPAdapter
+import ssl
 try:
     import requests.packages.urllib3 as urllib3
 except ImportError:
@@ -13,9 +14,19 @@
 PoolManager = urllib3.poolmanager.PoolManager
 
 
+def get_max_tls_protocol():
+    protocols = ('PROTOCOL_TLSv1_2',
+                 'PROTOCOL_TLSv1_1',
+                 'PROTOCOL_TLSv1')
+    for proto in protocols:
+        if hasattr(ssl, proto):
+            return proto
+
+
 class SSLAdapter(HTTPAdapter):
     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''
     def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):
+        ssl_version = ssl_version or get_max_tls_protocol()
         self.ssl_version = ssl_version
         self.assert_hostname = assert_hostname
         super(SSLAdapter, self).__init__(**kwargs)
diff --git a/docker/tls.py b/docker/tls.py
--- a/docker/tls.py
+++ b/docker/tls.py
@@ -17,8 +17,11 @@
         # here, but also disable any public/default CA pool verification by
         # leaving tls_verify=False
 
-        # urllib3 sets a default ssl_version if ssl_version is None
-        # http://tinyurl.com/kxga8hb
+        # urllib3 sets a default ssl_version if ssl_version is None,
+        # but that default is the vulnerable PROTOCOL_SSLv23 selection,
+        # so we override the default with the maximum supported in the running
+        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)
+        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()
         self.ssl_version = ssl_version
         self.assert_hostname = assert_hostname

{"golden_diff": "diff --git a/docker/ssladapter/ssladapter.py b/docker/ssladapter/ssladapter.py\n--- a/docker/ssladapter/ssladapter.py\n+++ b/docker/ssladapter/ssladapter.py\n@@ -4,6 +4,7 @@\n \"\"\"\n from distutils.version import StrictVersion\n from requests.adapters import HTTPAdapter\n+import ssl\n try:\n     import requests.packages.urllib3 as urllib3\n except ImportError:\n@@ -13,9 +14,19 @@\n PoolManager = urllib3.poolmanager.PoolManager\n \n \n+def get_max_tls_protocol():\n+    protocols = ('PROTOCOL_TLSv1_2',\n+                 'PROTOCOL_TLSv1_1',\n+                 'PROTOCOL_TLSv1')\n+    for proto in protocols:\n+        if hasattr(ssl, proto):\n+            return proto\n+\n+\n class SSLAdapter(HTTPAdapter):\n     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n     def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n+        ssl_version = ssl_version or get_max_tls_protocol()\n         self.ssl_version = ssl_version\n         self.assert_hostname = assert_hostname\n         super(SSLAdapter, self).__init__(**kwargs)\ndiff --git a/docker/tls.py b/docker/tls.py\n--- a/docker/tls.py\n+++ b/docker/tls.py\n@@ -17,8 +17,11 @@\n         # here, but also disable any public/default CA pool verification by\n         # leaving tls_verify=False\n \n-        # urllib3 sets a default ssl_version if ssl_version is None\n-        # http://tinyurl.com/kxga8hb\n+        # urllib3 sets a default ssl_version if ssl_version is None,\n+        # but that default is the vulnerable PROTOCOL_SSLv23 selection,\n+        # so we override the default with the maximum supported in the running\n+        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)\n+        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()\n         self.ssl_version = ssl_version\n         self.assert_hostname = assert_hostname\n", "issue": "Do not support sslv3 (poodle)\nIn Docker 1.3.1 (coming very soon), only TLS1.0+ will be supported.\nPing @shin- \n\n", "before_files": [{"content": "import os\n\nfrom . import errors\nfrom .ssladapter import ssladapter\n\n\nclass TLSConfig(object):\n    cert = None\n    verify = None\n    ssl_version = None\n\n    def __init__(self, client_cert=None, ca_cert=None, verify=None,\n                 ssl_version=None, assert_hostname=None):\n        # Argument compatibility/mapping with\n        # http://docs.docker.com/examples/https/\n        # This diverges from the Docker CLI in that users can specify 'tls'\n        # here, but also disable any public/default CA pool verification by\n        # leaving tls_verify=False\n\n        # urllib3 sets a default ssl_version if ssl_version is None\n        # http://tinyurl.com/kxga8hb\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n\n        # \"tls\" and \"tls_verify\" must have both or neither cert/key files\n        # In either case, Alert the user when both are expected, but any are\n        # missing.\n\n        if client_cert:\n            try:\n                tls_cert, tls_key = client_cert\n            except ValueError:\n                raise errors.TLSParameterError(\n                    'client_config must be a tuple of'\n                    ' (client certificate, key file)'\n                )\n\n            if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or\n               not os.path.isfile(tls_key)):\n                raise errors.TLSParameterError(\n                    'Path to a certificate and key files must be provided'\n                    ' through the client_config param'\n                )\n            self.cert = (tls_cert, tls_key)\n\n        # Either set verify to True (public/default CA checks) or to the\n        # path of a CA Cert file.\n        if verify is not None:\n            if not ca_cert:\n                self.verify = verify\n            elif os.path.isfile(ca_cert):\n                if not verify:\n                    raise errors.TLSParameterError(\n                        'verify can not be False when a CA cert is'\n                        ' provided.'\n                    )\n                self.verify = ca_cert\n            else:\n                raise errors.TLSParameterError(\n                    'Invalid CA certificate provided for `tls_ca_cert`.'\n                )\n\n    def configure_client(self, client):\n        client.ssl_version = self.ssl_version\n        if self.verify is not None:\n            client.verify = self.verify\n        if self.cert:\n            client.cert = self.cert\n        client.mount('https://', ssladapter.SSLAdapter(\n            ssl_version=self.ssl_version,\n            assert_hostname=self.assert_hostname,\n        ))\n", "path": "docker/tls.py"}, {"content": "\"\"\" Resolves OpenSSL issues in some servers:\n      https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/\n      https://github.com/kennethreitz/requests/pull/799\n\"\"\"\nfrom distutils.version import StrictVersion\nfrom requests.adapters import HTTPAdapter\ntry:\n    import requests.packages.urllib3 as urllib3\nexcept ImportError:\n    import urllib3\n\n\nPoolManager = urllib3.poolmanager.PoolManager\n\n\nclass SSLAdapter(HTTPAdapter):\n    '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n    def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n        super(SSLAdapter, self).__init__(**kwargs)\n\n    def init_poolmanager(self, connections, maxsize, block=False):\n        kwargs = {\n            'num_pools': connections,\n            'maxsize': maxsize,\n            'block': block,\n            'assert_hostname': self.assert_hostname,\n        }\n        if self.can_override_ssl_version():\n            kwargs['ssl_version'] = self.ssl_version\n\n        self.poolmanager = PoolManager(**kwargs)\n\n    def can_override_ssl_version(self):\n        urllib_ver = urllib3.__version__.split('-')[0]\n        if urllib_ver is None:\n            return False\n        if urllib_ver == 'dev':\n            return True\n        return StrictVersion(urllib_ver) > StrictVersion('1.5')\n", "path": "docker/ssladapter/ssladapter.py"}], "after_files": [{"content": "import os\n\nfrom . import errors\nfrom .ssladapter import ssladapter\n\n\nclass TLSConfig(object):\n    cert = None\n    verify = None\n    ssl_version = None\n\n    def __init__(self, client_cert=None, ca_cert=None, verify=None,\n                 ssl_version=None, assert_hostname=None):\n        # Argument compatibility/mapping with\n        # http://docs.docker.com/examples/https/\n        # This diverges from the Docker CLI in that users can specify 'tls'\n        # here, but also disable any public/default CA pool verification by\n        # leaving tls_verify=False\n\n        # urllib3 sets a default ssl_version if ssl_version is None,\n        # but that default is the vulnerable PROTOCOL_SSLv23 selection,\n        # so we override the default with the maximum supported in the running\n        # Python interpeter up to TLS 1.2. (see: http://tinyurl.com/kxga8hb)\n        ssl_version = ssl_version or ssladapter.get_max_tls_protocol()\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n\n        # \"tls\" and \"tls_verify\" must have both or neither cert/key files\n        # In either case, Alert the user when both are expected, but any are\n        # missing.\n\n        if client_cert:\n            try:\n                tls_cert, tls_key = client_cert\n            except ValueError:\n                raise errors.TLSParameterError(\n                    'client_config must be a tuple of'\n                    ' (client certificate, key file)'\n                )\n\n            if not (tls_cert and tls_key) or (not os.path.isfile(tls_cert) or\n               not os.path.isfile(tls_key)):\n                raise errors.TLSParameterError(\n                    'Path to a certificate and key files must be provided'\n                    ' through the client_config param'\n                )\n            self.cert = (tls_cert, tls_key)\n\n        # Either set verify to True (public/default CA checks) or to the\n        # path of a CA Cert file.\n        if verify is not None:\n            if not ca_cert:\n                self.verify = verify\n            elif os.path.isfile(ca_cert):\n                if not verify:\n                    raise errors.TLSParameterError(\n                        'verify can not be False when a CA cert is'\n                        ' provided.'\n                    )\n                self.verify = ca_cert\n            else:\n                raise errors.TLSParameterError(\n                    'Invalid CA certificate provided for `tls_ca_cert`.'\n                )\n\n    def configure_client(self, client):\n        client.ssl_version = self.ssl_version\n        if self.verify is not None:\n            client.verify = self.verify\n        if self.cert:\n            client.cert = self.cert\n        client.mount('https://', ssladapter.SSLAdapter(\n            ssl_version=self.ssl_version,\n            assert_hostname=self.assert_hostname,\n        ))\n", "path": "docker/tls.py"}, {"content": "\"\"\" Resolves OpenSSL issues in some servers:\n      https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/\n      https://github.com/kennethreitz/requests/pull/799\n\"\"\"\nfrom distutils.version import StrictVersion\nfrom requests.adapters import HTTPAdapter\nimport ssl\ntry:\n    import requests.packages.urllib3 as urllib3\nexcept ImportError:\n    import urllib3\n\n\nPoolManager = urllib3.poolmanager.PoolManager\n\n\ndef get_max_tls_protocol():\n    protocols = ('PROTOCOL_TLSv1_2',\n                 'PROTOCOL_TLSv1_1',\n                 'PROTOCOL_TLSv1')\n    for proto in protocols:\n        if hasattr(ssl, proto):\n            return proto\n\n\nclass SSLAdapter(HTTPAdapter):\n    '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''\n    def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):\n        ssl_version = ssl_version or get_max_tls_protocol()\n        self.ssl_version = ssl_version\n        self.assert_hostname = assert_hostname\n        super(SSLAdapter, self).__init__(**kwargs)\n\n    def init_poolmanager(self, connections, maxsize, block=False):\n        kwargs = {\n            'num_pools': connections,\n            'maxsize': maxsize,\n            'block': block,\n            'assert_hostname': self.assert_hostname,\n        }\n        if self.can_override_ssl_version():\n            kwargs['ssl_version'] = self.ssl_version\n\n        self.poolmanager = PoolManager(**kwargs)\n\n    def can_override_ssl_version(self):\n        urllib_ver = urllib3.__version__.split('-')[0]\n        if urllib_ver is None:\n            return False\n        if urllib_ver == 'dev':\n            return True\n        return StrictVersion(urllib_ver) > StrictVersion('1.5')\n", "path": "docker/ssladapter/ssladapter.py"}]}