Skip to content

Add ability to TLS 1.3 cipher suites on SSL Context#1432

Merged
alex merged 1 commit into
pyca:mainfrom
schwabe:set_tls13_ciphersuites
Jul 29, 2025
Merged

Add ability to TLS 1.3 cipher suites on SSL Context#1432
alex merged 1 commit into
pyca:mainfrom
schwabe:set_tls13_ciphersuites

Conversation

@schwabe

@schwabe schwabe commented Jul 15, 2025

Copy link
Copy Markdown
Contributor

No description provided.

@schwabe

schwabe commented Jul 15, 2025

Copy link
Copy Markdown
Contributor Author

Needs test + changelog entry.

@schwabe schwabe force-pushed the set_tls13_ciphersuites branch from 0f13c17 to 406e319 Compare July 16, 2025 08:35
@alex

alex commented Jul 17, 2025

Copy link
Copy Markdown
Member

should be possible to rebase on main to resolve the CI issues

@schwabe schwabe force-pushed the set_tls13_ciphersuites branch 2 times, most recently from 182450c to c6fe5df Compare July 17, 2025 11:20
Comment thread src/OpenSSL/SSL.py Outdated

.. versionadded:: 25.2.0
"""
ciphersuites = _text_to_bytes_and_warn("ciphersuites", ciphersuites)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No warning for new APIs, we should strictly enforce types.

Comment thread tests/test_ssl.py Outdated
[b"TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256"],
)
def test_set_cipher_list(
def test_set_ciphersuites(

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need tests for both, you can't get rid of the old test.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my mistake I copied the old and then messed up the existing one.

@schwabe schwabe force-pushed the set_tls13_ciphersuites branch 3 times, most recently from 07815b9 to 09a3e1f Compare July 17, 2025 15:42
Comment thread src/OpenSSL/SSL.py Outdated
)

@_require_not_used
def set_ciphersuites(self, ciphersuites: bytes) -> None:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@reaperhulk should this be set_tls13_ciphersuites, or just match the OpenSSL name?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think we should put tls13 in there even though it's inconsistent with OpenSSL itself. Marginally less confusing to consumers or people reading code who haven't memorized the docstrings for every function.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed the PR to add the tls13 in there. I hope we don't have to rename it again when TLS 1.4/2.0 comes out

@schwabe schwabe force-pushed the set_tls13_ciphersuites branch from 09a3e1f to 39218cf Compare July 29, 2025 06:55
@alex alex merged commit a157163 into pyca:main Jul 29, 2025
39 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants