The patch removes ssl._import_symbols and adds more enums to the ssl module. Please review the patch. I'll update documentation in the next step.

With IntFlags it is much easier to understand flags like SSLContext.options

>>> import ssl
>>> ctx = ssl.create_default_context()
>>> ssl.Options(ctx.options)
<Options.OP_ALL|OP_NO_SSLv3|OP_NO_SSLv2|OP_NO_COMPRESSION: 2197947391>

Thanks Ethan! I have updated the patch with documentation and your fix.

Do you have an easy recipe to wrap properties like SSLContext.options to return an enum? It's not easy because super() does not support attribute proxy assignment. super().verify_mode = value raises an AttributeError.

Can you give me a code sample?

Also, wouldn't

<Options.ALL|NO_SSLv3|NO_SSLv2|NO_COMPRESSION: 2197947391>

be more readable? And keep the "OP_" names as aliases.

I tried:

class SSLContext(_SSLContext):
    ...

    @property
    def options(self):
        return Options(super().options)

    @options.setter
    def options(self, value)
        super().options = value
    #          ^^^^^
    #          This fails with an AttributeError

    # it would be cool to have something like this:
    options = MagicEnumWrapper(Options)

About the shorter names, I'm worried that it might confuse people. The long names have been module constants for a long time.

Huh. Well, for property this works:

    @property
    def options(self):
        return Options(_SSLContext.options.__get__(self))

    @options.setter
    def options(self, value):
        _SSLContext.options.__set__(self, Options.OP_ALL)

Sure is ugly, though.

I think there's a PEP about making super() work with descriptors... Ah, PEP-447 (not sure it's the same issue, though.)

A little more research shows this is a problem with inheriting descriptors.

See bpo-14965.

Evidently the correct form is:

super(SSLContext, SSLContext).options.__set__(self, value)

Not sure that's any better. :(

Too bad, but the ugly variant will suffice.

>>> import ssl
>>> ctx = ssl.create_default_context()
>>> ctx.options
<Options.OP_ALL|OP_NO_SSLv3|OP_NO_SSLv2|OP_NO_COMPRESSION: 2197947391>
>>> ctx.verify_flags
<VerifyFlags.VERIFY_X509_TRUSTED_FIRST: 32768>
>>> ctx.verify_mode
<VerifyMode.CERT_REQUIRED: 2>

Latest patch: https://github.com/tiran/cpython/commits/feature/ssl_enum

New changeset c32e9f9b00f7 by Christian Heimes in branch 'default':
Issue bpo-28025: Convert all ssl module constants to IntEnum and IntFlags.
https://hg.python.org/cpython/rev/c32e9f9b00f7