From 3875a3c39a50b16945a0c05f0c4c8ae67e499921 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Thu, 8 Sep 2016 20:11:03 +0200
Subject: [PATCH] convert ssl constants to enums

---
 Doc/library/ssl.rst | 34 ++++++++++++++++++++++++++++++++++
 Lib/ssl.py          | 52 +++++++++++++++++++++++++++++++++-------------------
 2 files changed, 67 insertions(+), 19 deletions(-)

diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 3706a6e8966975b9d8f310d3a0113ecadc46929a..9e86b2f5afefff14c4f2542f36af2e597e321745 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -515,6 +515,10 @@ Certificate handling
 Constants
 ^^^^^^^^^
 
+   All constants are now :class:`enum.IntEnum` or :class:`enum.IntFlag` collections.
+
+   .. versionadded:: 3.6
+
 .. data:: CERT_NONE
 
    Possible value for :attr:`SSLContext.verify_mode`, or the ``cert_reqs``
@@ -548,6 +552,12 @@ Constants
    be passed, either to :meth:`SSLContext.load_verify_locations` or as a
    value of the ``ca_certs`` parameter to :func:`wrap_socket`.
 
+.. class:: VerifyMode
+
+   :class:`enum.IntEnum` collection of CERT_* constants.
+
+   .. versionadded:: 3.6
+
 .. data:: VERIFY_DEFAULT
 
    Possible value for :attr:`SSLContext.verify_flags`. In this mode, certificate
@@ -588,6 +598,12 @@ Constants
 
    .. versionadded:: 3.4.4
 
+.. class:: VerifyFlags
+
+   :class:`enum.IntFlag` collection of VERIFY_* constants.
+
+   .. versionadded:: 3.6
+
 .. data:: PROTOCOL_TLS
 
    Selects the highest protocol version that both the client and server support.
@@ -757,6 +773,12 @@ Constants
 
    .. versionadded:: 3.3
 
+.. class:: Options
+
+   :class:`enum.IntFlag` collection of OP_* constants.
+
+   .. versionadded:: 3.6
+
 .. data:: HAS_ALPN
 
    Whether the OpenSSL library has built-in support for the *Application-Layer
@@ -839,6 +861,12 @@ Constants
 
    .. versionadded:: 3.4
 
+.. class:: AlertDescription
+
+   :class:`enum.IntEnum` collection of ALERT_DESCRIPTION_* constants.
+
+   .. versionadded:: 3.6
+
 .. data:: Purpose.SERVER_AUTH
 
    Option for :func:`create_default_context` and
@@ -857,6 +885,12 @@ Constants
 
    .. versionadded:: 3.4
 
+.. class:: SSLErrorNumber
+
+   :class:`enum.IntEnum` collection of SSL_ERROR_* constants.
+
+   .. versionadded:: 3.6
+
 
 SSL Sockets
 -----------
diff --git a/Lib/ssl.py b/Lib/ssl.py
index 42ca1686d93eacc142c2e6db778d21b2f8310e89..c495fe5108e0bc9e6d728a368a2efb81ac1b0159 100644
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -94,7 +94,7 @@ import re
 import sys
 import os
 from collections import namedtuple
-from enum import Enum as _Enum, IntEnum as _IntEnum
+from enum import Enum as _Enum, IntEnum as _IntEnum, IntFlag as _IntFlag
 
 import _ssl             # if we can't import it, let the error propagate
 
@@ -104,7 +104,6 @@ from _ssl import (
     SSLError, SSLZeroReturnError, SSLWantReadError, SSLWantWriteError,
     SSLSyscallError, SSLEOFError,
     )
-from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
 from _ssl import txt2obj as _txt2obj, nid2obj as _nid2obj
 from _ssl import RAND_status, RAND_add, RAND_bytes, RAND_pseudo_bytes
 try:
@@ -113,32 +112,47 @@ except ImportError:
     # LibreSSL does not provide RAND_egd
     pass
 
-def _import_symbols(prefix):
-    for n in dir(_ssl):
-        if n.startswith(prefix):
-            globals()[n] = getattr(_ssl, n)
-
-_import_symbols('OP_')
-_import_symbols('ALERT_DESCRIPTION_')
-_import_symbols('SSL_ERROR_')
-_import_symbols('VERIFY_')
 
 from _ssl import HAS_SNI, HAS_ECDH, HAS_NPN, HAS_ALPN
-
 from _ssl import _OPENSSL_API_VERSION
 
+
 _IntEnum._convert(
-        '_SSLMethod', __name__,
-        lambda name: name.startswith('PROTOCOL_') and name != 'PROTOCOL_SSLv23',
-        source=_ssl)
+    '_SSLMethod', __name__,
+    lambda name: name.startswith('PROTOCOL_') and name != 'PROTOCOL_SSLv23',
+    source=_ssl)
+
+_IntFlag._convert(
+    'Options', __name__,
+    lambda name: name.startswith('OP_'),
+    source=_ssl)
+
+_IntEnum._convert(
+    'AlertDescription', __name__,
+    lambda name: name.startswith('ALERT_DESCRIPTION_'),
+    source=_ssl)
+
+_IntEnum._convert(
+    'SSLErrorNumber', __name__,
+    lambda name: name.startswith('SSL_ERROR_'),
+    source=_ssl)
+
+_IntFlag._convert(
+    'VerifyFlags', __name__,
+    lambda name: name.startswith('VERIFY_'),
+    source=_ssl)
+
+_IntEnum._convert(
+    'VerifyMode', __name__,
+    lambda name: name.startswith('CERT_'),
+    source=_ssl)
+
 
 PROTOCOL_SSLv23 = _SSLMethod.PROTOCOL_SSLv23 = _SSLMethod.PROTOCOL_TLS
 _PROTOCOL_NAMES = {value: name for name, value in _SSLMethod.__members__.items()}
 
-try:
-    _SSLv2_IF_EXISTS = PROTOCOL_SSLv2
-except NameError:
-    _SSLv2_IF_EXISTS = None
+_SSLv2_IF_EXISTS = getattr(_SSLMethod, 'PROTOCOL_SSLv2', None)
+
 
 if sys.platform == "win32":
     from _ssl import enum_certificates, enum_crls
-- 
2.7.4