diff --git a/Modules/_ssl.c b/Modules/_ssl.c index d00f407b569fb69..04a8b7344aa5f28 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -3288,6 +3288,26 @@ _ssl__SSLContext_set_ciphers_impl(PySSLContext *self, const char *cipherlist) Py_RETURN_NONE; } + +static PyObject * +_ssl_SSLContext_set_ciphers_tls3_impl(PySSLContext *self, const char* cipherlist) +{ + int ret = SSL_CTX_set_ciphersuites(self->ctx, cipherlist); + if (ret == 0) + { + /* Similar to TLS 1.2 cipher suites, and OpenSSL versions, otherwise the error can be + * reported again. + */ + ERR_clear_error(); + PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "No TLSv1.3 cipher could be selected"); + return NULL; + } + + Py_RETURN_NONE; +} + + + /*[clinic input] _ssl._SSLContext.get_ciphers [clinic start generated code]*/ @@ -5001,6 +5021,7 @@ static struct PyMethodDef context_methods[] = { _SSL__SSLCONTEXT__WRAP_SOCKET_METHODDEF _SSL__SSLCONTEXT__WRAP_BIO_METHODDEF _SSL__SSLCONTEXT_SET_CIPHERS_METHODDEF + _SSL__SSLCONTEXT_SET_CIPHERSUITES_TLSV13_METHODDEF _SSL__SSLCONTEXT__SET_ALPN_PROTOCOLS_METHODDEF _SSL__SSLCONTEXT_LOAD_CERT_CHAIN_METHODDEF _SSL__SSLCONTEXT_LOAD_DH_PARAMS_METHODDEF diff --git a/Modules/clinic/_ssl.c.h b/Modules/clinic/_ssl.c.h index 2940f16a2cb7f6a..e1e1d7a707cd275 100644 --- a/Modules/clinic/_ssl.c.h +++ b/Modules/clinic/_ssl.c.h @@ -488,6 +488,46 @@ _ssl__SSLContext_set_ciphers(PySSLContext *self, PyObject *arg) return return_value; } +#define _SSL__SSLCONTEXT_SET_CIPHERSUITES_TLSV13_METHODDEF \ + {"set_cipher_suites", _ssl__SSLContext_set_ciphers_suites_tlsv13, METH_O, "Set cipher suites and use it for TLS v1.3 cipher suites"}, + + +static PyObject * +_ssl_SSLContext_set_ciphers_tls3_impl(PySSLContext *self, const char* cipherlist); + + +static PyObject* _ssl__SSLContext_set_ciphers_suites_tlsv13(PySSLContext* self, PyObject* arg) +{ + PyObject *return_val = NULL; + const char* cipherlist; + + // Check whether we got a unicode string input + + if (!PyUnicode_Check(arg)) + { + _PyArg_BadArgument("set_ciphers_suites", "argument", "str", arg); + return return_val; + } + + Py_ssize_t cipherlist_length; + + cipherlist = PyUnicode_AsUTF8AndSize(arg, &cipherlist_length); + + if (cipherlist == NULL) + return NULL; + + if (strlen(cipherlist) != (size_t)cipherlist_length) + { + PyErr_SetString(PyExc_ValueError, "We have an embedded null character"); + return return_val; + } + + return_val = _ssl_SSLContext_set_ciphers_tls3_impl(self, cipherlist); + + return return_val; + +} + PyDoc_STRVAR(_ssl__SSLContext_get_ciphers__doc__, "get_ciphers($self, /)\n" "--\n"