Repository: randombit/botan
Pull request #3237 (2023-01-31 12:46:18)

Make TLS::Record_Type an enum class
This also merges `NO_RECORD` with the TLS 1.3 `Invalid` enum value, since my read of TLS 1.3 is that this is reservation is done explicitly so that implementations can use 0 as the invalid/`None` record type instead of having to use an out of range value (as `NO_RECORD` was) or optional type.

#3146 


Patch:
diff --git a/src/lib/pubkey/mce/code_based_key_gen.cpp b/src/lib/pubkey/mce/code_based_key_gen.cpp
index a63885263..c86169566 100644
--- a/src/lib/pubkey/mce/code_based_key_gen.cpp
+++ b/src/lib/pubkey/mce/code_based_key_gen.cpp
@@ -50,7 +50,7 @@ class binary_matrix final
 
       size_t columns() const { return m_coln; }
 
-      const std::vector<uint32_t>& elem() const { return m_elem; }
+      std::vector<uint32_t> elem() const { return m_elem; }
 
    private:
       size_t m_rown;  // number of rows.
diff --git a/src/lib/tls/tls12/tls_channel_impl_12.cpp b/src/lib/tls/tls12/tls_channel_impl_12.cpp
index 33c809fd5..4f9ff24b9 100644
--- a/src/lib/tls/tls12/tls_channel_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_channel_impl_12.cpp
@@ -315,7 +315,7 @@ size_t Channel_Impl_12::received_data(const uint8_t input[], size_t input_size)
             return needed; // need more data to complete record
 
          // Ignore invalid records in DTLS
-         if(m_is_datagram && record.type() == NO_RECORD)
+         if(m_is_datagram && record.type() == Record_Type::Invalid)
             {
             return 0;
             }
@@ -330,7 +330,7 @@ size_t Channel_Impl_12::received_data(const uint8_t input[], size_t input_size)
 
          const bool initial_record = epoch0_restart || (!pending_state() && !active_state());
 
-         if(record.type() != ALERT)
+         if(record.type() != Record_Type::Alert)
             {
             if(initial_record)
                {
@@ -360,13 +360,13 @@ size_t Channel_Impl_12::received_data(const uint8_t input[], size_t input_size)
                }
             }
 
-         if(record.type() == HANDSHAKE || record.type() == CHANGE_CIPHER_SPEC)
+         if(record.type() == Record_Type::Handshake || record.type() == Record_Type::ChangeCipherSpec)
             {
             if(m_has_been_closed)
                throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received handshake data after connection closure");
             process_handshake_ccs(m_record_buf, record.sequence(), record.type(), record.version(), epoch0_restart);
             }
-         else if(record.type() == APPLICATION_DATA)
+         else if(record.type() == Record_Type::ApplicationData)
             {
             if(m_has_been_closed)
                throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received application data after connection closure");
@@ -374,13 +374,13 @@ size_t Channel_Impl_12::received_data(const uint8_t input[], size_t input_size)
                throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Can't interleave application and handshake data");
             process_application_data(record.sequence(), m_record_buf);
             }
-         else if(record.type() == ALERT)
+         else if(record.type() == Record_Type::Alert)
             {
             process_alert(m_record_buf);
             }
-         else if(record.type() != NO_RECORD)
+         else if(record.type() != Record_Type::Invalid)
             throw Unexpected_Message("Unexpected record type " +
-                                     std::to_string(record.type()) +
+                                     std::to_string(static_cast<size_t>(record.type())) +
                                      " from counterparty");
          }
 
@@ -515,7 +515,7 @@ void Channel_Impl_12::process_alert(const secure_vector<uint8_t>& record)
     }
 
 void Channel_Impl_12::write_record(Connection_Cipher_State* cipher_state, uint16_t epoch,
-                                   uint8_t record_type, const uint8_t input[], size_t length)
+                                   Record_Type record_type, const uint8_t input[], size_t length)
    {
    BOTAN_ASSERT(m_pending_state || m_active_state, "Some connection state exists");
 
@@ -526,19 +526,24 @@ void Channel_Impl_12::write_record(Connection_Cipher_State* cipher_state, uint16
 
    if(cipher_state == nullptr)
       {
-      TLS::write_unencrypted_record(m_writebuf, record_type, record_version, next_seq,
+      TLS::write_unencrypted_record(m_writebuf,
+                                    record_type,
+                                    record_version, next_seq,
                                     input, length);
       }
    else
       {
-      TLS::write_record(m_writebuf, record_type, record_version, next_seq,
+      TLS::write_record(m_writebuf,
+                        record_type,
+                        record_version, next_seq,
                         input, length, *cipher_state, m_rng);
       }
 
    callbacks().tls_emit_data(m_writebuf.data(), m_writebuf.size());
    }
 
-void Channel_Impl_12::send_record_array(uint16_t epoch, uint8_t type, const uint8_t input[], size_t length)
+void Channel_Impl_12::send_record_array(uint16_t epoch, Record_Type type,
+                                        const uint8_t input[], size_t length)
    {
    if(length == 0)
       return;
@@ -555,13 +560,13 @@ void Channel_Impl_12::send_record_array(uint16_t epoch, uint8_t type, const uint
       }
    }
 
-void Channel_Impl_12::send_record(uint8_t record_type, const std::vector<uint8_t>& record)
+void Channel_Impl_12::send_record(Record_Type record_type, const std::vector<uint8_t>& record)
    {
    send_record_array(sequence_numbers().current_write_epoch(),
                      record_type, record.data(), record.size());
    }
 
-void Channel_Impl_12::send_record_under_epoch(uint16_t epoch, uint8_t record_type,
+void Channel_Impl_12::send_record_under_epoch(uint16_t epoch, Record_Type record_type,
       const std::vector<uint8_t>& record)
    {
    send_record_array(epoch, record_type, record.data(), record.size());
@@ -573,7 +578,7 @@ void Channel_Impl_12::send(const uint8_t buf[], size_t buf_size)
       throw Invalid_State("Data cannot be sent on inactive TLS connection");
 
    send_record_array(sequence_numbers().current_write_epoch(),
-                     APPLICATION_DATA, buf, buf_size);
+                     Record_Type::ApplicationData, buf, buf_size);
    }
 
 void Channel_Impl_12::send_alert(const Alert& alert)
@@ -583,7 +588,7 @@ void Channel_Impl_12::send_alert(const Alert& alert)
       {
       try
          {
-         send_record(ALERT, alert.serialize());
+         send_record(Record_Type::Alert, alert.serialize());
          }
       catch(...) { /* swallow it */ }
       }
diff --git a/src/lib/tls/tls12/tls_channel_impl_12.h b/src/lib/tls/tls12/tls_channel_impl_12.h
index 4e1f01fd8..7f2a4c488 100644
--- a/src/lib/tls/tls12/tls_channel_impl_12.h
+++ b/src/lib/tls/tls12/tls_channel_impl_12.h
@@ -190,16 +190,17 @@ class Channel_Impl_12 : public Channel_Impl
       virtual std::vector<X509_Certificate> get_peer_cert_chain(const Handshake_State& state) const = 0;
 
    private:
-      void send_record(uint8_t record_type, const std::vector<uint8_t>& record);
+      void send_record(Record_Type record_type, const std::vector<uint8_t>& record);
 
-      void send_record_under_epoch(uint16_t epoch, uint8_t record_type,
+      void send_record_under_epoch(uint16_t epoch, Record_Type record_type,
                                    const std::vector<uint8_t>& record);
 
-      void send_record_array(uint16_t epoch, uint8_t record_type,
+      void send_record_array(uint16_t epoch, Record_Type record_type,
                              const uint8_t input[], size_t length);
 
       void write_record(Connection_Cipher_State* cipher_state,
-                        uint16_t epoch, uint8_t type, const uint8_t input[], size_t length);
+                        uint16_t epoch, Record_Type type,
+                        const uint8_t input[], size_t length);
 
       void reset_state();
 
diff --git a/src/lib/tls/tls12/tls_handshake_io.cpp b/src/lib/tls/tls12/tls_handshake_io.cpp
index d9b437f5b..a793af796 100644
--- a/src/lib/tls/tls12/tls_handshake_io.cpp
+++ b/src/lib/tls/tls12/tls_handshake_io.cpp
@@ -49,11 +49,11 @@ void Stream_Handshake_IO::add_record(const uint8_t record[],
                                      size_t record_len,
                                      Record_Type record_type, uint64_t /*sequence_number*/)
    {
-   if(record_type == HANDSHAKE)
+   if(record_type == Record_Type::Handshake)
       {
       m_queue.insert(m_queue.end(), record, record + record_len);
       }
-   else if(record_type == CHANGE_CIPHER_SPEC)
+   else if(record_type == Record_Type::ChangeCipherSpec)
       {
       if(record_len != 1 || record[0] != 1)
          throw Decoding_Error("Invalid ChangeCipherSpec");
@@ -63,7 +63,9 @@ void Stream_Handshake_IO::add_record(const uint8_t record[],
       m_queue.insert(m_queue.end(), ccs_hs, ccs_hs + sizeof(ccs_hs));
       }
    else
-      throw Decoding_Error("Unknown message type " + std::to_string(record_type) + " in handshake processing");
+      throw Decoding_Error("Unknown message type " +
+                           std::to_string(static_cast<size_t>(record_type)) +
+                           " in handshake processing");
    }
 
 std::pair<Handshake_Type, std::vector<uint8_t>>
@@ -123,12 +125,12 @@ std::vector<uint8_t> Stream_Handshake_IO::send(const Handshake_Message& msg)
 
    if(msg.type() == HANDSHAKE_CCS)
       {
-      m_send_hs(CHANGE_CIPHER_SPEC, msg_bits);
+      m_send_hs(Record_Type::ChangeCipherSpec, msg_bits);
       return std::vector<uint8_t>(); // not included in handshake hashes
       }
 
    auto buf = format(msg_bits, msg.wire_type());
-   m_send_hs(HANDSHAKE, buf);
+   m_send_hs(Record_Type::Handshake, buf);
    return buf;
    }
 
@@ -159,7 +161,7 @@ void Datagram_Handshake_IO::retransmit_flight(size_t flight_idx)
          {
          // Epoch gap: insert the CCS
          std::vector<uint8_t> ccs(1, 1);
-         m_send_hs(epoch, CHANGE_CIPHER_SPEC, ccs);
+         m_send_hs(epoch, Record_Type::ChangeCipherSpec, ccs);
          }
 
       send_message(msg_seq, msg.epoch, msg.msg_type, msg.msg_bits);
@@ -201,7 +203,7 @@ void Datagram_Handshake_IO::add_record(const uint8_t record[],
    {
    const uint16_t epoch = static_cast<uint16_t>(record_sequence >> 48);
 
-   if(record_type == CHANGE_CIPHER_SPEC)
+   if(record_type == Record_Type::ChangeCipherSpec)
       {
       if(record_len != 1 || record[0] != 1)
          throw Decoding_Error("Invalid ChangeCipherSpec");
@@ -403,7 +405,7 @@ Datagram_Handshake_IO::send_under_epoch(const Handshake_Message& msg, uint16_t e
 
    if(msg_type == HANDSHAKE_CCS)
       {
-      m_send_hs(epoch, CHANGE_CIPHER_SPEC, msg_bits);
+      m_send_hs(epoch, Record_Type::ChangeCipherSpec, msg_bits);
       return std::vector<uint8_t>(); // not included in handshake hashes
       }
    else if(msg_type == HELLO_VERIFY_REQUEST)
@@ -436,7 +438,7 @@ std::vector<uint8_t> Datagram_Handshake_IO::send_message(uint16_t msg_seq,
 
    if(no_fragment.size() + DTLS_HEADER_SIZE <= m_mtu)
       {
-      m_send_hs(epoch, HANDSHAKE, no_fragment);
+      m_send_hs(epoch, Record_Type::Handshake, no_fragment);
       }
    else
       {
@@ -469,7 +471,7 @@ std::vector<uint8_t> Datagram_Handshake_IO::send_message(uint16_t msg_seq,
                             msg_type,
                             msg_seq);
 
-         m_send_hs(epoch, HANDSHAKE, frag);
+         m_send_hs(epoch, Record_Type::Handshake, frag);
 
          frag_offset += frag_len;
          }
diff --git a/src/lib/tls/tls12/tls_handshake_io.h b/src/lib/tls/tls12/tls_handshake_io.h
index 448368f6b..a21a53d2d 100644
--- a/src/lib/tls/tls12/tls_handshake_io.h
+++ b/src/lib/tls/tls12/tls_handshake_io.h
@@ -85,7 +85,7 @@ class Handshake_IO
 class Stream_Handshake_IO final : public Handshake_IO
    {
    public:
-      typedef std::function<void (uint8_t, const std::vector<uint8_t>&)> writer_fn;
+      typedef std::function<void (Record_Type, const std::vector<uint8_t>&)> writer_fn;
 
       explicit Stream_Handshake_IO(writer_fn writer) : m_send_hs(writer) {}
 
@@ -121,7 +121,7 @@ class Stream_Handshake_IO final : public Handshake_IO
 class Datagram_Handshake_IO final : public Handshake_IO
    {
    public:
-      typedef std::function<void (uint16_t, uint8_t, const std::vector<uint8_t>&)> writer_fn;
+      typedef std::function<void (uint16_t, Record_Type, const std::vector<uint8_t>&)> writer_fn;
 
       Datagram_Handshake_IO(writer_fn writer,
                             class Connection_Sequence_Numbers& seq,
diff --git a/src/lib/tls/tls12/tls_record.cpp b/src/lib/tls/tls12/tls_record.cpp
index 06ebd31ec..88ae1b930 100644
--- a/src/lib/tls/tls12/tls_record.cpp
+++ b/src/lib/tls/tls12/tls_record.cpp
@@ -159,14 +159,14 @@ Connection_Cipher_State::aead_nonce(const uint8_t record[], size_t record_len, u
 
 std::vector<uint8_t>
 Connection_Cipher_State::format_ad(uint64_t msg_sequence,
-                                   uint8_t msg_type,
+                                   Record_Type msg_type,
                                    Protocol_Version version,
                                    uint16_t msg_length)
    {
    std::vector<uint8_t> ad(13);
 
    store_be(msg_sequence, &ad[0]);
-   ad[8] = msg_type;
+   ad[8] = static_cast<uint8_t>(msg_type);
    ad[9] = version.major_version();
    ad[10] = version.minor_version();
    ad[11] = get_byte<0>(msg_length);
@@ -186,13 +186,13 @@ inline void append_u16_len(secure_vector<uint8_t>& output, size_t len_field)
    }
 
 void write_record_header(secure_vector<uint8_t>& output,
-                         uint8_t record_type,
+                         Record_Type record_type,
                          Protocol_Version version,
                          uint64_t record_sequence)
    {
    output.clear();
 
-   output.push_back(record_type);
+   output.push_back(static_cast<uint8_t>(record_type));
    output.push_back(version.major_version());
    output.push_back(version.minor_version());
 
@@ -206,13 +206,13 @@ void write_record_header(secure_vector<uint8_t>& output,
 }
 
 void write_unencrypted_record(secure_vector<uint8_t>& output,
-                              uint8_t record_type,
+                              Record_Type record_type,
                               Protocol_Version version,
                               uint64_t record_sequence,
                               const uint8_t* message,
                               size_t message_len)
    {
-   if(record_type == APPLICATION_DATA)
+   if(record_type == Record_Type::ApplicationData)
       throw Internal_Error("Writing an unencrypted TLS application data record");
    write_record_header(output, record_type, version, record_sequence);
    append_u16_len(output, message_len);
@@ -220,7 +220,7 @@ void write_unencrypted_record(secure_vector<uint8_t>& output,
    }
 
 void write_record(secure_vector<uint8_t>& output,
-                  uint8_t record_type,
+                  Record_Type record_type,
                   Protocol_Version version,
                   uint64_t record_sequence,
                   const uint8_t* message,
@@ -309,7 +309,7 @@ void decrypt_record(secure_vector<uint8_t>& output,
 
    aead.set_associated_data_vec(
       cs.format_ad(record_sequence,
-                   static_cast<uint8_t>(record_type),
+                   record_type,
                    record_version,
                    static_cast<uint16_t>(ptext_size))
       );
diff --git a/src/lib/tls/tls12/tls_record.h b/src/lib/tls/tls12/tls_record.h
index 4ba672bcd..befe815e5 100644
--- a/src/lib/tls/tls12/tls_record.h
+++ b/src/lib/tls/tls12/tls_record.h
@@ -53,9 +53,10 @@ class Connection_Cipher_State final
 
       std::vector<uint8_t> aead_nonce(const uint8_t record[], size_t record_len, uint64_t seq);
 
-      std::vector<uint8_t> format_ad(uint64_t seq, uint8_t type,
-                                  Protocol_Version version,
-                                  uint16_t ptext_length);
+      std::vector<uint8_t> format_ad(uint64_t seq,
+                                     Record_Type type,
+                                     Protocol_Version version,
+                                     uint16_t ptext_length);
 
       size_t nonce_bytes_from_handshake() const { return m_nonce_bytes_from_handshake; }
       size_t nonce_bytes_from_record() const { return m_nonce_bytes_from_record; }
@@ -88,7 +89,7 @@ class Record_Header final
          m_needed(needed),
          m_sequence(0),
          m_version(Protocol_Version()),
-         m_type(NO_RECORD)
+         m_type(Record_Type::Invalid)
          {}
 
       size_t needed() const { return m_needed; }
@@ -133,7 +134,7 @@ class Record_Header final
 * @param message_len is size of message
 */
 void write_unencrypted_record(secure_vector<uint8_t>& write_buffer,
-                              uint8_t record_type,
+                              Record_Type record_type,
                               Protocol_Version record_version,
                               uint64_t record_sequence,
                               const uint8_t* message,
@@ -151,7 +152,7 @@ void write_unencrypted_record(secure_vector<uint8_t>& write_buffer,
 * @param rng is a random number generator
 */
 void write_record(secure_vector<uint8_t>& write_buffer,
-                  uint8_t record_type,
+                  Record_Type record_type,
                   Protocol_Version record_version,
                   uint64_t record_sequence,
                   const uint8_t* message,
diff --git a/src/lib/tls/tls13/tls_channel_impl_13.cpp b/src/lib/tls/tls13/tls_channel_impl_13.cpp
index fd886200b..2327022fa 100644
--- a/src/lib/tls/tls13/tls_channel_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_channel_impl_13.cpp
@@ -96,10 +96,10 @@ size_t Channel_Impl_13::received_data(const uint8_t input[], size_t input_size)
 
          // RFC 8446 5.1
          //   Handshake messages MUST NOT be interleaved with other record types.
-         if(record.type != HANDSHAKE && m_handshake_layer.has_pending_data())
+         if(record.type != Record_Type::Handshake && m_handshake_layer.has_pending_data())
             { throw Unexpected_Message("Expected remainder of a handshake message"); }
 
-         if(record.type == HANDSHAKE)
+         if(record.type == Record_Type::Handshake)
             {
             m_handshake_layer.copy_data(record.fragment);
 
@@ -163,21 +163,24 @@ size_t Channel_Impl_13::received_data(const uint8_t input[], size_t input_size)
                   }
                }
             }
-         else if(record.type == CHANGE_CIPHER_SPEC)
+         else if(record.type == Record_Type::ChangeCipherSpec)
             {
             process_dummy_change_cipher_spec();
             }
-         else if(record.type == APPLICATION_DATA)
+         else if(record.type == Record_Type::ApplicationData)
             {
             BOTAN_ASSERT(record.seq_no.has_value(), "decrypted application traffic had a sequence number");
             callbacks().tls_record_received(record.seq_no.value(), record.fragment.data(), record.fragment.size());
             }
-         else if(record.type == ALERT)
+         else if(record.type == Record_Type::Alert)
             {
             process_alert(record.fragment);
             }
          else
-            { throw Unexpected_Message("Unexpected record type " + std::to_string(record.type) + " from counterparty"); }
+            {
+            throw Unexpected_Message("Unexpected record type " +
+                                     std::to_string(static_cast<size_t>(record.type)) +
+                                     " from counterparty"); }
          }
       }
    catch(TLS_Exception& e)
@@ -251,13 +254,13 @@ Channel_Impl_13::AggregatedMessages::add(const Handshake_Message_13_Ref message)
 std::vector<uint8_t> Channel_Impl_13::AggregatedMessages::send()
    {
    BOTAN_STATE_CHECK(!m_message_buffer.empty());
-   m_channel.send_record(Record_Type::HANDSHAKE, m_message_buffer);
+   m_channel.send_record(Record_Type::Handshake, m_message_buffer);
    return std::exchange(m_message_buffer, {});
    }
 
 void Channel_Impl_13::send_post_handshake_message(const Post_Handshake_Message_13 message)
    {
-   send_record(Record_Type::HANDSHAKE, m_handshake_layer.prepare_post_handshake_message(message));
+   send_record(Record_Type::Handshake, m_handshake_layer.prepare_post_handshake_message(message));
    }
 
 void Channel_Impl_13::send_dummy_change_cipher_spec()
@@ -268,7 +271,7 @@ void Channel_Impl_13::send_dummy_change_cipher_spec()
    //
    // The only allowed CCS message content is 0x01, all other CCS records MUST
    // be rejected by TLS 1.3 implementations.
-   send_record(Record_Type::CHANGE_CIPHER_SPEC, {0x01});
+   send_record(Record_Type::ChangeCipherSpec, {0x01});
    }
 
 void Channel_Impl_13::send(const uint8_t buf[], size_t buf_size)
@@ -290,7 +293,7 @@ void Channel_Impl_13::send(const uint8_t buf[], size_t buf_size)
       m_opportunistic_key_update = false;
       }
 
-   send_record(Record_Type::APPLICATION_DATA, {buf, buf+buf_size});
+   send_record(Record_Type::ApplicationData, {buf, buf+buf_size});
    }
 
 void Channel_Impl_13::send_alert(const Alert& alert)
@@ -299,7 +302,7 @@ void Channel_Impl_13::send_alert(const Alert& alert)
       {
       try
          {
-         send_record(Record_Type::ALERT, alert.serialize());
+         send_record(Record_Type::Alert, alert.serialize());
          }
       catch(...) { /* swallow it */ }
       }
@@ -345,7 +348,7 @@ void Channel_Impl_13::update_traffic_keys(bool request_peer_update)
    m_cipher_state->update_write_keys();
    }
 
-void Channel_Impl_13::send_record(uint8_t record_type, const std::vector<uint8_t>& record)
+void Channel_Impl_13::send_record(Record_Type record_type, const std::vector<uint8_t>& record)
    {
    BOTAN_STATE_CHECK(!is_downgrading());
    BOTAN_STATE_CHECK(m_can_write);
@@ -357,7 +360,7 @@ void Channel_Impl_13::send_record(uint8_t record_type, const std::vector<uint8_t
    // adhere to a more strict record specification. Note that for the
    // server case this is a NOOP.
    // See (RFC 8446 5.1. regarding "legacy_record_version")
-   if(!m_first_message_sent && type == Record_Type::HANDSHAKE)
+   if(!m_first_message_sent && type == Record_Type::Handshake)
       {
       m_record_layer.disable_sending_compat_mode();
       m_first_message_sent = true;
@@ -365,9 +368,9 @@ void Channel_Impl_13::send_record(uint8_t record_type, const std::vector<uint8_t
 
    // The dummy CCS must not be prepended if the following record is
    // an unprotected Alert record.
-   if(prepend_ccs() && (m_cipher_state || record_type != Record_Type::ALERT))
+   if(prepend_ccs() && (m_cipher_state || record_type != Record_Type::Alert))
       {
-      const auto ccs = m_record_layer.prepare_records(Record_Type::CHANGE_CIPHER_SPEC, {0x01}, m_cipher_state.get());
+      const auto ccs = m_record_layer.prepare_records(Record_Type::ChangeCipherSpec, {0x01}, m_cipher_state.get());
       to_write = concat(ccs, to_write);
       }
 
diff --git a/src/lib/tls/tls13/tls_channel_impl_13.h b/src/lib/tls/tls13/tls_channel_impl_13.h
index d1033b5f4..c6141824f 100644
--- a/src/lib/tls/tls13/tls_channel_impl_13.h
+++ b/src/lib/tls/tls13/tls_channel_impl_13.h
@@ -224,7 +224,7 @@ class Channel_Impl_13 : public Channel_Impl
       const Policy& policy() const { return m_policy; }
 
    private:
-      void send_record(uint8_t record_type, const std::vector<uint8_t>& record);
+      void send_record(Record_Type record_type, const std::vector<uint8_t>& record);
 
       void process_alert(const secure_vector<uint8_t>& record);
 
diff --git a/src/lib/tls/tls13/tls_record_layer_13.cpp b/src/lib/tls/tls13/tls_record_layer_13.cpp
index 70c8b762d..1c4b67cf7 100644
--- a/src/lib/tls/tls13/tls_record_layer_13.cpp
+++ b/src/lib/tls/tls13/tls_record_layer_13.cpp
@@ -37,10 +37,10 @@ Record_Type read_record_type(const uint8_t type_byte)
    // RFC 8446 5.
    //    If a TLS implementation receives an unexpected record type,
    //    it MUST terminate the connection with an "unexpected_message" alert.
-   if(type_byte != Record_Type::APPLICATION_DATA
-         && type_byte != Record_Type::HANDSHAKE
-         && type_byte != Record_Type::ALERT
-         && type_byte != Record_Type::CHANGE_CIPHER_SPEC)
+   if(type_byte != static_cast<uint8_t>(Record_Type::ApplicationData) &&
+      type_byte != static_cast<uint8_t>(Record_Type::Handshake) &&
+      type_byte != static_cast<uint8_t>(Record_Type::Alert) &&
+      type_byte != static_cast<uint8_t>(Record_Type::ChangeCipherSpec))
       {
       throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "TLS record type had unexpected value");
       }
@@ -77,10 +77,10 @@ struct TLSPlaintext_Header
       //
       //    Zero-length fragments of Application Data MAY be sent, as they are
       //    potentially useful as a traffic analysis countermeasure.
-      if(fragment_length == 0 && type != Record_Type::APPLICATION_DATA)
+      if(fragment_length == 0 && type != Record_Type::ApplicationData)
          { throw TLS_Exception(Alert::DECODE_ERROR, "empty record received"); }
 
-      if(type == Record_Type::APPLICATION_DATA)
+      if(type == Record_Type::ApplicationData)
          {
          // RFC 8446 5.2
          //    The length [...] is the sum of the lengths of the content and the
@@ -183,20 +183,20 @@ std::vector<uint8_t> Record_Layer::prepare_records(const Record_Type type,
    //
    // ... hence, CHANGE_CIPHER_SPEC is never protected, even if a usable cipher
    // state was passed to this method.
-   const bool protect = cipher_state != nullptr && type != Record_Type::CHANGE_CIPHER_SPEC;
+   const bool protect = cipher_state != nullptr && type != Record_Type::ChangeCipherSpec;
 
    // RFC 8446 5.1
-   BOTAN_ASSERT(protect || type != Record_Type::APPLICATION_DATA,
+   BOTAN_ASSERT(protect || type != Record_Type::ApplicationData,
                 "Application Data records MUST NOT be written to the wire unprotected");
 
    // RFC 8446 5.1
    //   "MUST NOT sent zero-length fragments of Handshake types"
    //   "a record with an Alert type MUST contain exactly one message" [of non-zero length]
    //   "Zero-length fragments of Application Data MAY be sent"
-   BOTAN_ASSERT(!data.empty() || type == Record_Type::APPLICATION_DATA,
+   BOTAN_ASSERT(!data.empty() || type == Record_Type::ApplicationData,
                 "zero-length fragments of types other than application data are not allowed");
 
-   if(type == Record_Type::CHANGE_CIPHER_SPEC &&
+   if(type == Record_Type::ChangeCipherSpec &&
          !verify_change_cipher_spec(data.cbegin(), data.size()))
       {
       throw Invalid_Argument("TLS 1.3 deprecated CHANGE_CIPHER_SPEC");
@@ -245,7 +245,7 @@ std::vector<uint8_t> Record_Layer::prepare_records(const Record_Type type,
       {
       const size_t pt_size = std::min<size_t>(to_process, max_plaintext_size);
       const size_t ct_size = (!protect) ? pt_size : cipher_state->encrypt_output_length(pt_size + content_type_tag_length);
-      const auto   pt_type = (!protect) ? type : Record_Type::APPLICATION_DATA;
+      const auto   pt_type = (!protect) ? type : Record_Type::ApplicationData;
 
       // RFC 8446 5.1
       //    MUST be set to 0x0303 for all records generated by a TLS 1.3
@@ -310,9 +310,9 @@ Record_Layer::ReadResult<Record> Record_Layer::next_record(Cipher_State* cipher_
    // RFC 8446 5.
    //    An implementation may receive an unencrypted [CCS] at any time
    if(cipher_state != nullptr
-         && plaintext_header.type != APPLICATION_DATA
-         && plaintext_header.type != CHANGE_CIPHER_SPEC
-         && (!cipher_state->must_expect_unprotected_alert_traffic() || plaintext_header.type != ALERT))
+      && plaintext_header.type != Record_Type::ApplicationData
+      && plaintext_header.type != Record_Type::ChangeCipherSpec
+      && (!cipher_state->must_expect_unprotected_alert_traffic() || plaintext_header.type != Record_Type::Alert))
       {
       throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
             "unprotected record received where protected traffic was expected");
@@ -326,7 +326,7 @@ Record_Layer::ReadResult<Record> Record_Layer::next_record(Cipher_State* cipher_
    const auto fragment_begin = header_end;
    const auto fragment_end   = fragment_begin + plaintext_header.fragment_length;
 
-   if(plaintext_header.type == Record_Type::CHANGE_CIPHER_SPEC &&
+   if(plaintext_header.type == Record_Type::ChangeCipherSpec &&
          !verify_change_cipher_spec(fragment_begin, plaintext_header.fragment_length))
       {
       throw TLS_Exception(Alert::UNEXPECTED_MESSAGE,
@@ -336,7 +336,7 @@ Record_Layer::ReadResult<Record> Record_Layer::next_record(Cipher_State* cipher_
    Record record(plaintext_header.type, secure_vector<uint8_t>(fragment_begin, fragment_end));
    m_read_buffer.erase(header_begin, fragment_end);
 
-   if(record.type == Record_Type::APPLICATION_DATA)
+   if(record.type == Record_Type::ApplicationData)
       {
       if(cipher_state == nullptr)
          {
@@ -365,7 +365,7 @@ Record_Layer::ReadResult<Record> Record_Layer::next_record(Cipher_State* cipher_
       // hydrate the actual content type from TLSInnerPlaintext
       record.type = read_record_type(*end_of_content);
 
-      if(record.type == Record_Type::CHANGE_CIPHER_SPEC)
+      if(record.type == Record_Type::ChangeCipherSpec)
          {
          // RFC 8446 5
          //  An implementation [...] which receives a protected change_cipher_spec record MUST
diff --git a/src/lib/tls/tls_magic.h b/src/lib/tls/tls_magic.h
index 73276bb23..53d5cd244 100644
--- a/src/lib/tls/tls_magic.h
+++ b/src/lib/tls/tls_magic.h
@@ -50,18 +50,15 @@ enum class Connection_Side {
    SERVER BOTAN_DEPRECATED("Use Connection_Side::Server") = Server,
 };
 
-// This will become an enum class in a future major release
-enum Record_Type {
-   INVALID            = 0,  // RFC 8446 (TLS 1.3)
-
-   CHANGE_CIPHER_SPEC = 20,
-   ALERT              = 21,
-   HANDSHAKE          = 22,
-   APPLICATION_DATA   = 23,
+enum class Record_Type: uint8_t {
+   Invalid            = 0,  // RFC 8446 (TLS 1.3)
 
-   HEARTBEAT          = 24, // RFC 6520 (TLS 1.3)
+   ChangeCipherSpec   = 20,
+   Alert              = 21,
+   Handshake          = 22,
+   ApplicationData    = 23,
 
-   NO_RECORD          = 256
+   Heartbeat          = 24, // RFC 6520 (TLS 1.3)
 };
 
 // This will become an enum class in a future major release


Test patch:
diff --git a/src/tests/test_tls_record_layer_13.cpp b/src/tests/test_tls_record_layer_13.cpp
index 987fc93da..2f7795ce6 100644
--- a/src/tests/test_tls_record_layer_13.cpp
+++ b/src/tests/test_tls_record_layer_13.cpp
@@ -87,7 +87,7 @@ std::vector<Test::Result> read_full_records()
          result.require("received something", std::holds_alternative<TLS::Record>(read));
 
          auto record = std::get<TLS::Record>(read);
-         result.confirm("received CCS", record.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS", record.type == TLS::Record_Type::ChangeCipherSpec);
          result.test_eq("CCS byte is 0x01", record.fragment, Botan::hex_decode("01"));
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
@@ -105,14 +105,14 @@ std::vector<Test::Result> read_full_records()
          result.require("received something", std::holds_alternative<TLS::Record>(read));
          auto record = std::get<TLS::Record>(read);
 
-         result.confirm("received CCS 1", record.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS 1", record.type == TLS::Record_Type::ChangeCipherSpec);
          result.test_eq("CCS byte is 0x01", record.fragment, Botan::hex_decode("01"));
 
          read = rl.next_record();
          result.require("received something", std::holds_alternative<TLS::Record>(read));
          record = std::get<TLS::Record>(read);
 
-         result.confirm("received CCS 2", record.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS 2", record.type == TLS::Record_Type::ChangeCipherSpec);
          result.test_eq("CCS byte is 0x01", record.fragment, Botan::hex_decode("01"));
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
@@ -127,7 +127,7 @@ std::vector<Test::Result> read_full_records()
          result.confirm("received something", std::holds_alternative<TLS::Record>(read));
 
          auto rec = std::get<TLS::Record>(read);
-         result.confirm("received handshake record", rec.type == TLS::Record_Type::HANDSHAKE);
+         result.confirm("received handshake record", rec.type == TLS::Record_Type::Handshake);
          result.test_eq("contains the full handshake message",
                         Botan::secure_vector<uint8_t>(client_hello_record.begin()+TLS::TLS_HEADER_SIZE,
                               client_hello_record.end()), rec.fragment);
@@ -146,7 +146,7 @@ std::vector<Test::Result> read_full_records()
          result.require("received something", std::holds_alternative<TLS::Record>(read));
 
          auto rec = std::get<TLS::Record>(read);
-         result.confirm("received handshake record", rec.type == TLS::Record_Type::HANDSHAKE);
+         result.confirm("received handshake record", rec.type == TLS::Record_Type::Handshake);
          result.test_eq("contains the full handshake message",
                         Botan::secure_vector<uint8_t>(client_hello_record.begin()+TLS::TLS_HEADER_SIZE,
                               client_hello_record.end()), rec.fragment);
@@ -155,7 +155,7 @@ std::vector<Test::Result> read_full_records()
          result.require("received something", std::holds_alternative<TLS::Record>(read));
 
          rec = std::get<TLS::Record>(read);
-         result.confirm("received CCS record", rec.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS record", rec.type == TLS::Record_Type::ChangeCipherSpec);
          result.test_eq("CCS byte is 0x01", rec.fragment, Botan::hex_decode("01"));
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
@@ -352,7 +352,7 @@ std::vector<Test::Result> read_fragmented_records()
          result.require("received something 1", std::holds_alternative<TLS::Record>(res1));
 
          auto rec1 = std::get<TLS::Record>(res1);
-         result.confirm("received CCS", rec1.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS", rec1.type == TLS::Record_Type::ChangeCipherSpec);
          result.test_eq("CCS byte is 0x01", rec1.fragment, Botan::hex_decode("01"));
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
@@ -368,7 +368,7 @@ std::vector<Test::Result> read_fragmented_records()
          result.require("received something 2", std::holds_alternative<TLS::Record>(res2));
 
          auto rec2 = std::get<TLS::Record>(res2);
-         result.confirm("received CCS", rec2.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS", rec2.type == TLS::Record_Type::ChangeCipherSpec);
          result.confirm("demands more bytes", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
 
          wait_for_more_bytes(2, rl, {'\x03'}, result);
@@ -378,7 +378,7 @@ std::vector<Test::Result> read_fragmented_records()
          result.require("received something 3", std::holds_alternative<TLS::Record>(res3));
 
          auto rec3 = std::get<TLS::Record>(res3);
-         result.confirm("received CCS", rec3.type == TLS::Record_Type::CHANGE_CIPHER_SPEC);
+         result.confirm("received CCS", rec3.type == TLS::Record_Type::ChangeCipherSpec);
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
          })
@@ -392,7 +392,7 @@ std::vector<Test::Result> write_records()
       {
       Botan_Tests::CHECK("prepare an zero-length application data fragment", [&](auto& result)
          {
-         auto record = record_layer_client().prepare_records(Botan::TLS::APPLICATION_DATA, {}, cs.get());
+         auto record = record_layer_client().prepare_records(Botan::TLS::Record_Type::ApplicationData, {}, cs.get());
 
          result.require("record header was added", record.size() > Botan::TLS::TLS_HEADER_SIZE + 1 /* encrypted content type */);
          }),
@@ -409,7 +409,7 @@ std::vector<Test::Result> write_records()
                                           "54 13 69 1e 52 9a af 2c 00 2b 00 03 02 03 04 00 0d 00 20 00 1e"
                                           "04 03 05 03 06 03 02 03 08 04 08 05 08 06 04 01 05 01 06 01 02"
                                           "01 04 02 05 02 06 02 02 02 00 2d 00 02 01 01 00 1c 00 02 40 01");
-         auto record = record_layer_client().prepare_records(Botan::TLS::HANDSHAKE, client_hello_msg);
+         auto record = record_layer_client().prepare_records(Botan::TLS::Record_Type::Handshake, client_hello_msg);
 
          result.require("record header was added", record.size() == client_hello_msg.size() + Botan::TLS::TLS_HEADER_SIZE);
 
@@ -418,7 +418,7 @@ std::vector<Test::Result> write_records()
          }),
       Botan_Tests::CHECK("prepare a dummy CCS", [&](auto& result)
          {
-         auto record = record_layer_client(true).prepare_records(Botan::TLS::Record_Type::CHANGE_CIPHER_SPEC, {0x01});
+         auto record = record_layer_client(true).prepare_records(Botan::TLS::Record_Type::ChangeCipherSpec, {0x01});
          result.require("record was created", record.size() == Botan::TLS::TLS_HEADER_SIZE + 1);
 
          result.test_eq("CCS record is well-formed", record, Botan::hex_decode("140303000101"));
@@ -428,13 +428,13 @@ std::vector<Test::Result> write_records()
          result.test_throws("cannot create non-dummy CCS", "TLS 1.3 deprecated CHANGE_CIPHER_SPEC", []
             {
             const auto ccs_content = Botan::hex_decode("de ad be ef");
-            record_layer_client().prepare_records(Botan::TLS::Record_Type::CHANGE_CIPHER_SPEC, ccs_content);
+            record_layer_client().prepare_records(Botan::TLS::Record_Type::ChangeCipherSpec, ccs_content);
             });
          }),
       Botan_Tests::CHECK("large messages are sharded", [&](auto& result)
          {
          const std::vector<uint8_t> large_client_hello(Botan::TLS::MAX_PLAINTEXT_SIZE + 4096);
-         auto record = record_layer_client().prepare_records(Botan::TLS::HANDSHAKE, large_client_hello);
+         auto record = record_layer_client().prepare_records(Botan::TLS::Record_Type::Handshake, large_client_hello);
 
          result.test_gte("produces at least two record headers", record.size(),
                          large_client_hello.size() + 2 * Botan::TLS::TLS_HEADER_SIZE);
@@ -541,7 +541,7 @@ read_encrypted_records()
          result.require("some records decrypted", !std::holds_alternative<Botan::TLS::BytesNeeded>(res));
          auto record = std::get<TLS::Record>(res);
 
-         result.test_is_eq("inner type was 'HANDSHAKE'", record.type, Botan::TLS::Record_Type::HANDSHAKE);
+         result.test_is_eq("inner type was 'HANDSHAKE'", record.type, Botan::TLS::Record_Type::Handshake);
          result.test_eq("decrypted payload length", record.fragment.size(), 657 /* taken from RFC 8448 */);
 
          result.confirm("no more records", std::holds_alternative<TLS::BytesNeeded>(rl.next_record()));
@@ -711,12 +711,12 @@ read_encrypted_records()
 
          const auto srv_hello = client.next_record(nullptr);
          result.confirm("read a record", std::holds_alternative<TLS::Record>(srv_hello));
-         result.confirm("is handshake record", std::get<TLS::Record>(srv_hello).type == TLS::HANDSHAKE);
+         result.confirm("is handshake record", std::get<TLS::Record>(srv_hello).type == TLS::Record_Type::Handshake);
 
          auto cs = rfc8448_rtt1_handshake_traffic();
          const auto enc_exts = client.next_record(cs.get());
          result.confirm("read a record", std::holds_alternative<TLS::Record>(enc_exts));
-         result.confirm("is handshake record", std::get<TLS::Record>(enc_exts).type == TLS::HANDSHAKE);
+         result.confirm("is handshake record", std::get<TLS::Record>(enc_exts).type == TLS::Record_Type::Handshake);
          }),
 
       Botan_Tests::CHECK("read a padded record", [&](Test::Result& result)
@@ -752,7 +752,7 @@ std::vector<Test::Result> write_encrypted_records()
       {
       Botan_Tests::CHECK("write encrypted client handshake finished", [&](Test::Result& result)
          {
-         auto ct = record_layer_client(true).prepare_records(TLS::Record_Type::HANDSHAKE,
+         auto ct = record_layer_client(true).prepare_records(TLS::Record_Type::Handshake,
                plaintext_msg, cs.get());
          auto expected_ct =
          Botan::hex_decode("17 03 03 00 35 75 ec 4d c2 38 cc e6"
@@ -763,7 +763,7 @@ std::vector<Test::Result> write_encrypted_records()
 
       Botan_Tests::CHECK("write a dummy CCS (that must not be encrypted)", [&](auto& result)
          {
-         auto record = record_layer_client(true).prepare_records(Botan::TLS::Record_Type::CHANGE_CIPHER_SPEC, {0x01}, cs.get());
+         auto record = record_layer_client(true).prepare_records(Botan::TLS::Record_Type::ChangeCipherSpec, {0x01}, cs.get());
          result.require("record was created and not encrypted", record.size() == Botan::TLS::TLS_HEADER_SIZE + 1);
 
          result.test_eq("CCS record is well-formed", record, Botan::hex_decode("140303000101"));
@@ -772,14 +772,14 @@ std::vector<Test::Result> write_encrypted_records()
       Botan_Tests::CHECK("write a lot of data producing two protected records", [&](Test::Result& result)
          {
          std::vector<uint8_t> big_data(TLS::MAX_PLAINTEXT_SIZE + TLS::MAX_PLAINTEXT_SIZE / 2);
-         auto ct = record_layer_client(true).prepare_records(TLS::Record_Type::APPLICATION_DATA,
+         auto ct = record_layer_client(true).prepare_records(TLS::Record_Type::ApplicationData,
                    big_data, cs.get());
          result.require("encryption added some MAC and record headers",
                         ct.size() > big_data.size() + Botan::TLS::TLS_HEADER_SIZE * 2);
 
          auto read_record_header = [&](auto &reader)
             {
-            result.test_is_eq("APPLICATION_DATA", reader.get_byte(), static_cast<uint8_t>(TLS::Record_Type::APPLICATION_DATA));
+            result.test_is_eq("APPLICATION_DATA", reader.get_byte(), static_cast<uint8_t>(TLS::Record_Type::ApplicationData));
             result.test_is_eq("TLS legacy version", reader.get_uint16_t(), uint16_t(0x0303));
 
             const auto fragment_length = reader.get_uint16_t();
@@ -836,31 +836,31 @@ std::vector<Test::Result> legacy_version_handling()
       Botan_Tests::CHECK("client side starts with version 0x0301", [&](Test::Result& result)
          {
          auto rl = record_layer_client();
-         auto rec = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(5));
+         auto rec = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(5));
          result.confirm("first record has version 0x0301", has_version(rec, 0x0301));
 
          rl.disable_sending_compat_mode();
 
-         rec = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(5));
+         rec = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(5));
          result.confirm("next record has version 0x0303", has_version(rec, 0x0303));
          }),
 
       Botan_Tests::CHECK("client side starts with version 0x0301 (even if multiple reconds are required)", [&](Test::Result& result)
          {
          auto rl = record_layer_client();
-         auto rec = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(5 * Botan::TLS::MAX_PLAINTEXT_SIZE));
+         auto rec = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(5 * Botan::TLS::MAX_PLAINTEXT_SIZE));
          result.confirm("first record has version 0x0301", has_version(rec, 0x0301));
 
          rl.disable_sending_compat_mode();
 
-         rec = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(5 * Botan::TLS::MAX_PLAINTEXT_SIZE));
+         rec = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(5 * Botan::TLS::MAX_PLAINTEXT_SIZE));
          result.confirm("next record has version 0x0303", has_version(rec, 0x0303));
          }),
 
       Botan_Tests::CHECK("server side starts with version 0x0303", [&](Test::Result& result)
          {
          auto rl = record_layer_server(true);
-         auto rec = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(5));
+         auto rec = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(5));
          result.confirm("first record has version 0x0303", has_version(rec, 0x0303));
          }),
 
@@ -941,10 +941,10 @@ std::vector<Test::Result> record_size_limits()
          auto csc = rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side::Client);
          auto rlc = record_layer_client(true);
 
-         const auto r1 = rlc.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE), csc.get());
+         const auto r1 = rlc.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE), csc.get());
          result.test_eq("one record generated", count_records(r1), 1);
 
-         const auto r2 = rlc.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1), csc.get());
+         const auto r2 = rlc.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1), csc.get());
          result.test_eq("two records generated", count_records(r2), 2);
 
          auto css = rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side::Server);
@@ -961,10 +961,10 @@ std::vector<Test::Result> record_size_limits()
 
          rl.set_record_size_limits(127 + 1 /* content type byte */, Botan::TLS::MAX_PLAINTEXT_SIZE + 1);
 
-         const auto r1 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(127), cs.get());
+         const auto r1 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(127), cs.get());
          result.test_eq("one record generated", count_records(r1), 1);
 
-         const auto r2 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(128), cs.get());
+         const auto r2 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(128), cs.get());
          result.test_eq("two records generated", count_records(r2), 2);
          }),
 
@@ -973,18 +973,18 @@ std::vector<Test::Result> record_size_limits()
          auto cs = rfc8448_rtt1_handshake_traffic();
          auto rl = record_layer_client(true);
 
-         const auto r1 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE), cs.get());
+         const auto r1 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE), cs.get());
          result.test_eq("one record generated", count_records(r1), 1);
 
-         const auto r2 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1), cs.get());
+         const auto r2 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1), cs.get());
          result.test_eq("two records generated", count_records(r2), 2);
 
          rl.set_record_size_limits(127 + 1 /* content type byte */, Botan::TLS::MAX_PLAINTEXT_SIZE + 1);
 
-         const auto r3 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(127), cs.get());
+         const auto r3 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(127), cs.get());
          result.test_eq("one record generated", count_records(r3), 1);
 
-         const auto r4 = rl.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(128), cs.get());
+         const auto r4 = rl.prepare_records(TLS::Record_Type::ApplicationData, std::vector<uint8_t>(128), cs.get());
          result.test_eq("two records generated", count_records(r4), 2);
          }),
 
@@ -994,10 +994,10 @@ std::vector<Test::Result> record_size_limits()
 
          rl.set_record_size_limits(127 + 1 /* content type byte */, Botan::TLS::MAX_PLAINTEXT_SIZE + 1);
 
-         const auto r1 = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE));
+         const auto r1 = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE));
          result.test_eq("one record generated", count_records(r1), 1);
 
-         const auto r2 = rl.prepare_records(TLS::Record_Type::HANDSHAKE, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1));
+         const auto r2 = rl.prepare_records(TLS::Record_Type::Handshake, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1));
          result.test_eq("two records generated", count_records(r2), 2);
          }),