--- Python-2.7.5.orig/Lib/ssl.py	2013-05-12 05:32:44.000000000 +0200
+++ Python-2.7.5/Lib/ssl.py	2013-07-03 13:09:56.446860618 +0200
@@ -106,6 +106,7 @@ class SSLSocket(socket):
     def __init__(self, sock, keyfile=None, certfile=None,
                  server_side=False, cert_reqs=CERT_NONE,
                  ssl_version=PROTOCOL_SSLv23, ca_certs=None,
+                 server_hostname=None,
                  do_handshake_on_connect=True,
                  suppress_ragged_eofs=True, ciphers=None):
         socket.__init__(self, _sock=sock._sock)
@@ -138,6 +139,7 @@ class SSLSocket(socket):
             self._sslobj = _ssl.sslwrap(self._sock, server_side,
                                         keyfile, certfile,
                                         cert_reqs, ssl_version, ca_certs,
+					server_hostname,
                                         ciphers)
             if do_handshake_on_connect:
                 self.do_handshake()
@@ -146,6 +148,7 @@ class SSLSocket(socket):
         self.cert_reqs = cert_reqs
         self.ssl_version = ssl_version
         self.ca_certs = ca_certs
+        self.server_hostname = server_hostname
         self.ciphers = ciphers
         self.do_handshake_on_connect = do_handshake_on_connect
         self.suppress_ragged_eofs = suppress_ragged_eofs
@@ -311,7 +314,7 @@ class SSLSocket(socket):
             raise ValueError("attempt to connect already-connected SSLSocket!")
         self._sslobj = _ssl.sslwrap(self._sock, False, self.keyfile, self.certfile,
                                     self.cert_reqs, self.ssl_version,
-                                    self.ca_certs, self.ciphers)
+                                    self.ca_certs, self.server_hostname, self.ciphers)
         try:
             if return_errno:
                 rc = socket.connect_ex(self, addr)
@@ -352,6 +355,7 @@ class SSLSocket(socket):
                               cert_reqs=self.cert_reqs,
                               ssl_version=self.ssl_version,
                               ca_certs=self.ca_certs,
+                              server_hostname=None,
                               ciphers=self.ciphers,
                               do_handshake_on_connect=self.do_handshake_on_connect,
                               suppress_ragged_eofs=self.suppress_ragged_eofs),
@@ -466,7 +470,7 @@ def sslwrap_simple(sock, keyfile=None, c
         sock = sock._sock
 
     ssl_sock = _ssl.sslwrap(sock, 0, keyfile, certfile, CERT_NONE,
-                            PROTOCOL_SSLv23, None)
+                            PROTOCOL_SSLv23, None, None, None)
     try:
         sock.getpeername()
     except socket_error:
--- Python-2.7.5.orig/Modules/_ssl.c	2013-05-12 05:32:50.000000000 +0200
+++ Python-2.7.5/Modules/_ssl.c	2013-07-03 13:18:12.556858616 +0200
@@ -265,7 +265,7 @@ newPySSLObject(PySocketSockObject *Sock,
                enum py_ssl_server_or_client socket_type,
                enum py_ssl_cert_requirements certreq,
                enum py_ssl_version proto_version,
-               char *cacerts_file, char *ciphers)
+               char *cacerts_file, char *server_hostname, char *ciphers)
 {
     PySSLObject *self;
     char *errstr = NULL;
@@ -310,6 +310,15 @@ newPySSLObject(PySocketSockObject *Sock,
 #endif
     else if (proto_version == PY_SSL_VERSION_SSL23)
         self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
+#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
+    /* If SNI isn't supported, we just don't call it and fail silently,
+     * as there's not much else we can do.
+     */
+    if ((socket_type == PY_SSL_CLIENT) &&
+        (proto_version == PY_SSL_VERSION_TLS1) &&
+        server_hostname)
+         SSL_set_tlsext_host_name(self->ssl, server_hostname);
+#endif
     PySSL_END_ALLOW_THREADS
 
     if (self->ctx == NULL) {
@@ -425,15 +434,16 @@ PySSL_sslwrap(PyObject *self, PyObject *
     char *key_file = NULL;
     char *cert_file = NULL;
     char *cacerts_file = NULL;
+    char *server_hostname = NULL;
     char *ciphers = NULL;
 
-    if (!PyArg_ParseTuple(args, "O!i|zziizz:sslwrap",
+    if (!PyArg_ParseTuple(args, "O!i|zziizzz:sslwrap",
                           PySocketModule.Sock_Type,
                           &Sock,
                           &server_side,
                           &key_file, &cert_file,
                           &verification_mode, &protocol,
-                          &cacerts_file, &ciphers))
+                          &cacerts_file, &server_hostname, &ciphers))
         return NULL;
 
     /*
@@ -446,13 +456,13 @@ PySSL_sslwrap(PyObject *self, PyObject *
 
     return (PyObject *) newPySSLObject(Sock, key_file, cert_file,
                                        server_side, verification_mode,
-                                       protocol, cacerts_file,
+                                       protocol, cacerts_file, server_hostname,
                                        ciphers);
 }
 
 PyDoc_STRVAR(ssl_doc,
 "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n"
-"                              cacertsfile, ciphers]) -> sslobject");
+"                              cacertsfile, ciphers, server_hostname]) -> sslobject");
 
 /* SSL object methods */