From 3fc7a38b25db1e70e00e14532b804302cf9a81a5 Mon Sep 17 00:00:00 2001
From: Wojciech Nowak <wojciech.nowak@nokia.com>
Date: Sun, 4 Feb 2024 00:01:02 +0100
Subject: [PATCH] SSL_CTX_set_ciphersuites for tlsv3 context

---
 src/OpenSSL/SSL.py | 20 ++++++++++++++++++++
 tests/test_ssl.py  | 26 ++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py
index 5e42289a..e36cfe0e 100644
--- a/src/OpenSSL/SSL.py
+++ b/src/OpenSSL/SSL.py
@@ -1343,6 +1343,26 @@ def set_tmp_ecdh(self, curve: _EllipticCurve) -> None:
         """
         _lib.SSL_CTX_set_tmp_ecdh(self._context, curve._to_EC_KEY())
 
+    def set_ciphersuites(self, cipher_list: bytes) -> None:
+        """
+        Set the list of ciphers to be used to configure the available TLSv1.3
+        ciphersuites for this context.
+
+        See the OpenSSL manual for more information (e.g.
+        :manpage:`ciphers(1)`).
+
+        :param bytes cipher_list: An OpenSSL cipher string.
+        :return: None
+        """
+        cipher_list = _text_to_bytes_and_warn("cipher_list", cipher_list)
+
+        if not isinstance(cipher_list, bytes):
+            raise TypeError("cipher_list must be a byte string.")
+
+        _openssl_assert(
+            _lib.SSL_CTX_set_ciphersuites(self._context, cipher_list) == 1
+        )
+
     def set_cipher_list(self, cipher_list: bytes) -> None:
         """
         Set the list of ciphers to be used in this context.
diff --git a/tests/test_ssl.py b/tests/test_ssl.py
index 3a0cddfb..df85d04b 100644
--- a/tests/test_ssl.py
+++ b/tests/test_ssl.py
@@ -486,6 +486,24 @@ class TestContext:
     Unit tests for `OpenSSL.SSL.Context`.
     """
 
+    @pytest.mark.parametrize(
+        "cipher_string",
+        [
+            b"hello world:TLS_AES_128_GCM_SHA256",
+            "hello world:TLS_AES_128_GCM_SHA256",
+        ],
+    )
+    def test_set_ciphersuites(self, context, cipher_string):
+        """
+        `Context.set_ciphersuites` accepts both byte and unicode strings
+        for naming the ciphers which connections created with the context
+        object will be able to choose from.
+        """
+        context.set_ciphersuites(cipher_string)
+        conn = Connection(context, None)
+
+        assert "TLS_AES_128_GCM_SHA256" in conn.get_cipher_list()
+
     @pytest.mark.parametrize(
         "cipher_string",
         [b"hello world:AES128-SHA", "hello world:AES128-SHA"],
@@ -509,6 +527,14 @@ def test_set_cipher_list_wrong_type(self, context):
         with pytest.raises(TypeError):
             context.set_cipher_list(object())
 
+    def test_set_ciphersuites_wrong_type(self, context):
+        """
+        `Context.set_ciphersuites` raises `TypeError` when passed a non-string
+        argument.
+        """
+        with pytest.raises(TypeError):
+            context.set_ciphersuites(object())
+
     @pytest.mark.flaky(reruns=2)
     def test_set_cipher_list_no_cipher_match(self, context):
         """