Repository: randombit/botan
Pull request #3235 (2023-01-30 22:55:40)

Make TLS::Connection_Side an enum class
GH #3146


Patch:
diff --git a/src/examples/tls_stream_client.cpp b/src/examples/tls_stream_client.cpp
index 3b0d750e4..c3bbc2fd9 100644
--- a/src/examples/tls_stream_client.cpp
+++ b/src/examples/tls_stream_client.cpp
@@ -43,7 +43,7 @@ public:
       std::cout << "Connect failed: " << error.message() << "\n";
       return;
     }
-    m_stream.async_handshake(Botan::TLS::Connection_Side::CLIENT,
+    m_stream.async_handshake(Botan::TLS::Connection_Side::Client,
                              boost::bind(&client::handle_handshake, this, _::error));
   }
 
diff --git a/src/fuzzer/tls_13_handshake_layer.cpp b/src/fuzzer/tls_13_handshake_layer.cpp
index 32aa96796..90506b3ef 100644
--- a/src/fuzzer/tls_13_handshake_layer.cpp
+++ b/src/fuzzer/tls_13_handshake_layer.cpp
@@ -15,7 +15,7 @@ namespace {
 
 Botan::TLS::Handshake_Layer prepare(const Botan::secure_vector<uint8_t>& data)
    {
-   Botan::TLS::Handshake_Layer hl(Botan::TLS::Connection_Side::CLIENT);
+   Botan::TLS::Handshake_Layer hl(Botan::TLS::Connection_Side::Client);
    hl.copy_data(data);
    return hl;
    }
diff --git a/src/lib/tls/asio/asio_stream.h b/src/lib/tls/asio/asio_stream.h
index 4a5589999..48c5fbde2 100644
--- a/src/lib/tls/asio/asio_stream.h
+++ b/src/lib/tls/asio/asio_stream.h
@@ -231,7 +231,7 @@ class Stream
          {
          setup_native_handle(side, ec);
 
-         if(side == CLIENT)
+         if(side == Connection_Side::Client)
             {
             // send client hello, which was written to the send buffer on client instantiation
             send_pending_encrypted_data(ec);
@@ -714,7 +714,7 @@ class Stream
             {
             try_with_error_code([&]
                {
-               if(side == CLIENT)
+               if(side == Connection_Side::Client)
                   {
                   m_native_handle = std::unique_ptr<Client>(
                      new Client(m_core,
diff --git a/src/lib/tls/msg_cert_req.cpp b/src/lib/tls/msg_cert_req.cpp
index 4d1b5b846..9ca07f871 100644
--- a/src/lib/tls/msg_cert_req.cpp
+++ b/src/lib/tls/msg_cert_req.cpp
@@ -141,7 +141,7 @@ std::vector<uint8_t> Certificate_Request_12::serialize() const
    append_tls_length_value(buf, cert_types, 1);
 
    if(!m_schemes.empty())
-      buf += Signature_Algorithms(m_schemes).serialize(Connection_Side::SERVER);
+      buf += Signature_Algorithms(m_schemes).serialize(Connection_Side::Server);
 
    std::vector<uint8_t> encoded_names;
 
diff --git a/src/lib/tls/msg_cert_verify.cpp b/src/lib/tls/msg_cert_verify.cpp
index a690b602a..f2245d75a 100644
--- a/src/lib/tls/msg_cert_verify.cpp
+++ b/src/lib/tls/msg_cert_verify.cpp
@@ -116,7 +116,7 @@ std::vector<uint8_t> message(Connection_Side side, const Transcript_Hash& hash)
    std::vector<uint8_t> msg(64, 0x20);
    msg.reserve(64 + 33 + 1 + hash.size());
 
-   const std::string context_string = (side == TLS::Connection_Side::SERVER)
+   const std::string context_string = (side == TLS::Connection_Side::Server)
                                       ? "TLS 1.3, server CertificateVerify"
                                       : "TLS 1.3, client CertificateVerify";
 
@@ -166,7 +166,7 @@ Certificate_Verify_13::Certificate_Verify_13(
 
    const auto* private_key = creds_mgr.private_key_for(
                                        certificate_msg.leaf(),
-                                       m_side == Connection_Side::CLIENT ? "tls-client" : "tls-server",
+                                       m_side == Connection_Side::Client ? "tls-client" : "tls-server",
                                        hostname);
    if(!private_key)
       { throw TLS_Exception(Alert::INTERNAL_ERROR, "Application did not provide a private key for its certificate"); }
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 8cb5b06a6..2ad802518 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -105,7 +105,7 @@ class Client_Hello_Internal
          suites = reader.get_range_vector<uint16_t>(2, 1, 32767);
          comp_methods = reader.get_range_vector<uint8_t>(1, 1, 255);
 
-         extensions.deserialize(reader, Connection_Side::CLIENT, Handshake_Type::CLIENT_HELLO);
+         extensions.deserialize(reader, Connection_Side::Client, Handshake_Type::CLIENT_HELLO);
          }
 
       /**
@@ -252,7 +252,7 @@ std::vector<uint8_t> Client_Hello::serialize() const
    * renegotiating with a modern server)
    */
 
-   buf += m_data->extensions.serialize(Connection_Side::CLIENT);
+   buf += m_data->extensions.serialize(Connection_Side::Client);
 
    return buf;
    }
@@ -510,7 +510,7 @@ Client_Hello_12::Client_Hello_12(Handshake_IO& io,
    if(m_data->legacy_version.is_datagram_protocol())
       { m_data->extensions.add(new SRTP_Protection_Profiles(policy.srtp_profiles())); }
 
-   cb.tls_modify_extensions(m_data->extensions, CLIENT, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Client, type());
 
    hash.update(io.send(*this));
    }
@@ -581,7 +581,7 @@ Client_Hello_12::Client_Hello_12(Handshake_IO& io,
    if(reneg_info.empty() && !next_protocols.empty())
       { m_data->extensions.add(new Application_Layer_Protocol_Notification(next_protocols)); }
 
-   cb.tls_modify_extensions(m_data->extensions, CLIENT, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Client, type());
 
    hash.update(io.send(*this));
    }
@@ -806,7 +806,7 @@ Client_Hello_13::Client_Hello_13(const Policy& policy,
    // TODO: Some extensions require a certain order or pose other assumptions.
    //       We should check those after the user was allowed to make changes to
    //       the extensions.
-   cb.tls_modify_extensions(m_data->extensions, CLIENT, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Client, type());
 
    // RFC 8446 4.2.11
    //    The "pre_shared_key" extension MUST be the last extension in the
@@ -866,7 +866,7 @@ void Client_Hello_13::retry(const Hello_Retry_Request& hrr,
    //       invocations to this callback due to the first Client_Hello or the
    //       retried Client_Hello after receiving a Hello_Retry_Request. We assume
    //       that the user keeps and detects this state themselves.
-   cb.tls_modify_extensions(m_data->extensions, CLIENT, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Client, type());
 
    auto psk = m_data->extensions.get<PSK>();
    if(psk)
diff --git a/src/lib/tls/msg_finished.cpp b/src/lib/tls/msg_finished.cpp
index 4a1b6d63e..8315fec87 100644
--- a/src/lib/tls/msg_finished.cpp
+++ b/src/lib/tls/msg_finished.cpp
@@ -42,7 +42,7 @@ std::vector<uint8_t> finished_compute_verify_12(const Handshake_State& state,
 
    std::vector<uint8_t> input;
    std::vector<uint8_t> label;
-   label += (side == CLIENT)
+   label += (side == Connection_Side::Client)
             ? std::make_pair(TLS_CLIENT_LABEL, sizeof(TLS_CLIENT_LABEL))
             : std::make_pair(TLS_SERVER_LABEL, sizeof(TLS_SERVER_LABEL));
 
diff --git a/src/lib/tls/msg_server_hello.cpp b/src/lib/tls/msg_server_hello.cpp
index f785d0fae..a23681561 100644
--- a/src/lib/tls/msg_server_hello.cpp
+++ b/src/lib/tls/msg_server_hello.cpp
@@ -114,7 +114,7 @@ class Server_Hello_Internal
          // Extension parsing will however not be affected by the associated flag.
          // Only after parsing the extensions will the upstream code be able to decide
          // whether we're dealing with TLS 1.3 or older.
-         extensions.deserialize(reader, Connection_Side::SERVER,
+         extensions.deserialize(reader, Connection_Side::Server,
                                 is_hello_retry_request
                                 ? Handshake_Type::HELLO_RETRY_REQUEST
                                 : Handshake_Type::SERVER_HELLO);
@@ -187,7 +187,7 @@ std::vector<uint8_t> Server_Hello::serialize() const
 
    buf.push_back(m_data->comp_method);
 
-   buf += m_data->extensions.serialize(Connection_Side::SERVER);
+   buf += m_data->extensions.serialize(Connection_Side::Server);
 
    return buf;
    }
@@ -311,7 +311,7 @@ Server_Hello_12::Server_Hello_12(Handshake_IO& io,
          }
       }
 
-   cb.tls_modify_extensions(m_data->extensions, SERVER, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Server, type());
 
    hash.update(io.send(*this));
    }
@@ -368,7 +368,7 @@ Server_Hello_12::Server_Hello_12(Handshake_IO& io,
       m_data->extensions.add(new Session_Ticket());
       }
 
-   cb.tls_modify_extensions(m_data->extensions, SERVER, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Server, type());
 
    hash.update(io.send(*this));
    }
@@ -750,7 +750,7 @@ Server_Hello_13::Server_Hello_13(const Client_Hello_13& ch,
    if(key_exchange_group.has_value())
       { m_data->extensions.add(new Key_Share(key_exchange_group.value(), cb, rng)); }
 
-   cb.tls_modify_extensions(m_data->extensions, SERVER, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Server, type());
    }
 
 std::optional<Protocol_Version> Server_Hello_13::random_signals_downgrade() const
@@ -811,7 +811,7 @@ Hello_Retry_Request::Hello_Retry_Request(const Client_Hello_13& ch, Named_Group
 
    m_data->extensions.add(new Key_Share(selected_group));
 
-   cb.tls_modify_extensions(m_data->extensions, SERVER, type());
+   cb.tls_modify_extensions(m_data->extensions, Connection_Side::Server, type());
    }
 
 #endif // BOTAN_HAS_TLS_13
diff --git a/src/lib/tls/tls12/tls_channel_impl_12.cpp b/src/lib/tls/tls12/tls_channel_impl_12.cpp
index 3a9a0b410..33c809fd5 100644
--- a/src/lib/tls/tls12/tls_channel_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_channel_impl_12.cpp
@@ -206,7 +206,7 @@ void Channel_Impl_12::change_cipher_spec_reader(Connection_Side side)
    // flip side as we are reading
    std::shared_ptr<Connection_Cipher_State> read_state(
       new Connection_Cipher_State(pending->version(),
-                                  (side == CLIENT) ? SERVER : CLIENT,
+                                  (side == Connection_Side::Client) ? Connection_Side::Server : Connection_Side::Client,
                                   false,
                                   pending->ciphersuite(),
                                   pending->session_keys(),
diff --git a/src/lib/tls/tls12/tls_client_impl_12.cpp b/src/lib/tls/tls12/tls_client_impl_12.cpp
index 44269b3a0..b8a7b0a54 100644
--- a/src/lib/tls/tls12/tls_client_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_client_impl_12.cpp
@@ -355,7 +355,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
                                 "Server replied with DTLS-SRTP alg we did not send");
          }
 
-      callbacks().tls_examine_extensions(state.server_hello()->extensions(), SERVER, Handshake_Type::SERVER_HELLO);
+      callbacks().tls_examine_extensions(state.server_hello()->extensions(), Connection_Side::Server, Handshake_Type::SERVER_HELLO);
 
       state.set_version(state.server_hello()->legacy_version());
       m_application_protocol = state.server_hello()->next_protocol();
@@ -563,7 +563,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
       }
    else if(type == CERTIFICATE_STATUS)
       {
-      state.server_cert_status(new Certificate_Status(contents, Connection_Side::SERVER));
+      state.server_cert_status(new Certificate_Status(contents, Connection_Side::Server));
 
       if(state.ciphersuite().kex_method() != Kex_Algo::STATIC_RSA)
          {
@@ -690,9 +690,9 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
 
       state.handshake_io().send(Change_Cipher_Spec());
 
-      change_cipher_spec_writer(CLIENT);
+      change_cipher_spec_writer(Connection_Side::Client);
 
-      state.client_finished(new Finished_12(state.handshake_io(), state, CLIENT));
+      state.client_finished(new Finished_12(state.handshake_io(), state, Connection_Side::Client));
 
       if(state.server_hello()->supports_session_ticket())
          state.set_expected_next(NEW_SESSION_TICKET);
@@ -709,7 +709,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
       {
       state.set_expected_next(FINISHED);
 
-      change_cipher_spec_reader(CLIENT);
+      change_cipher_spec_reader(Connection_Side::Client);
       }
    else if(type == FINISHED)
       {
@@ -719,7 +719,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
 
       state.server_finished(new Finished_12(contents));
 
-      if(!state.server_finished()->verify(state, SERVER))
+      if(!state.server_finished()->verify(state, Connection_Side::Server))
          throw TLS_Exception(Alert::DECRYPT_ERROR,
                              "Finished message didn't verify");
 
@@ -729,8 +729,8 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
          {
          // session resume case
          state.handshake_io().send(Change_Cipher_Spec());
-         change_cipher_spec_writer(CLIENT);
-         state.client_finished(new Finished_12(state.handshake_io(), state, CLIENT));
+         change_cipher_spec_writer(Connection_Side::Client);
+         state.client_finished(new Finished_12(state.handshake_io(), state, Connection_Side::Client));
          }
 
       std::vector<uint8_t> session_id = state.server_hello()->session_id();
@@ -745,7 +745,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
          state.session_keys().master_secret(),
          state.server_hello()->legacy_version(),
          state.server_hello()->ciphersuite(),
-         CLIENT,
+         Connection_Side::Client,
          state.server_hello()->supports_extended_master_secret(),
          state.server_hello()->supports_encrypt_then_mac(),
          get_peer_cert_chain(state),
diff --git a/src/lib/tls/tls12/tls_server_impl_12.cpp b/src/lib/tls/tls12/tls_server_impl_12.cpp
index e7ac38d2f..5ae5831a3 100644
--- a/src/lib/tls/tls12/tls_server_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_server_impl_12.cpp
@@ -385,7 +385,7 @@ Protocol_Version select_version(const TLS::Policy& policy,
 }
 
 /*
-* Process a CLIENT HELLO Message
+* Process a Client Hello Message
 */
 void Server_Impl_12::process_client_hello_msg(const Handshake_State* active_state,
       Server_Handshake_State& pending_state,
@@ -495,7 +495,7 @@ void Server_Impl_12::process_client_hello_msg(const Handshake_State* active_stat
 
    secure_renegotiation_check(pending_state.client_hello());
 
-   callbacks().tls_examine_extensions(pending_state.client_hello()->extensions(), CLIENT, Handshake_Type::CLIENT_HELLO);
+   callbacks().tls_examine_extensions(pending_state.client_hello()->extensions(), Connection_Side::Client, Handshake_Type::CLIENT_HELLO);
 
    Session session_info;
    const bool resuming =
@@ -562,7 +562,7 @@ void Server_Impl_12::process_client_key_exchange_msg(Server_Handshake_State& pen
 void Server_Impl_12::process_change_cipher_spec_msg(Server_Handshake_State& pending_state)
    {
    pending_state.set_expected_next(FINISHED);
-   change_cipher_spec_reader(SERVER);
+   change_cipher_spec_reader(Connection_Side::Server);
    }
 
 void Server_Impl_12::process_certificate_verify_msg(Server_Handshake_State& pending_state,
@@ -625,7 +625,7 @@ void Server_Impl_12::process_finished_msg(Server_Handshake_State& pending_state,
 
    pending_state.client_finished(new Finished_12(contents));
 
-   if(!pending_state.client_finished()->verify(pending_state, CLIENT))
+   if(!pending_state.client_finished()->verify(pending_state, Connection_Side::Client))
       throw TLS_Exception(Alert::DECRYPT_ERROR,
                           "Finished message didn't verify");
 
@@ -640,7 +640,7 @@ void Server_Impl_12::process_finished_msg(Server_Handshake_State& pending_state,
          pending_state.session_keys().master_secret(),
          pending_state.server_hello()->legacy_version(),
          pending_state.server_hello()->ciphersuite(),
-         SERVER,
+         Connection_Side::Server,
          pending_state.server_hello()->supports_extended_master_secret(),
          pending_state.server_hello()->supports_encrypt_then_mac(),
          get_peer_cert_chain(pending_state),
@@ -678,9 +678,9 @@ void Server_Impl_12::process_finished_msg(Server_Handshake_State& pending_state,
 
       pending_state.handshake_io().send(Change_Cipher_Spec());
 
-      change_cipher_spec_writer(SERVER);
+      change_cipher_spec_writer(Connection_Side::Server);
 
-      pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, SERVER));
+      pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));
       }
 
    activate_session();
@@ -800,9 +800,9 @@ void Server_Impl_12::session_resume(Server_Handshake_State& pending_state,
 
    pending_state.handshake_io().send(Change_Cipher_Spec());
 
-   change_cipher_spec_writer(SERVER);
+   change_cipher_spec_writer(Connection_Side::Server);
 
-   pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, SERVER));
+   pending_state.server_finished(new Finished_12(pending_state.handshake_io(), pending_state, Connection_Side::Server));
    pending_state.set_expected_next(HANDSHAKE_CCS);
    }
 
diff --git a/src/lib/tls/tls12/tls_session_key.h b/src/lib/tls/tls12/tls_session_key.h
index 0ea6d81cd..289e9919e 100644
--- a/src/lib/tls/tls12/tls_session_key.h
+++ b/src/lib/tls/tls12/tls_session_key.h
@@ -50,12 +50,12 @@ class Session_Keys final
 
       const secure_vector<uint8_t>& aead_key(Connection_Side side) const
          {
-         return (side == Connection_Side::CLIENT) ? client_aead_key() : server_aead_key();
+         return (side == Connection_Side::Client) ? client_aead_key() : server_aead_key();
          }
 
       const std::vector<uint8_t>& nonce(Connection_Side side) const
          {
-         return (side == Connection_Side::CLIENT) ? client_nonce() : server_nonce();
+         return (side == Connection_Side::Client) ? client_nonce() : server_nonce();
          }
 
       Session_Keys() = default;
diff --git a/src/lib/tls/tls13/msg_certificate_13.cpp b/src/lib/tls/tls13/msg_certificate_13.cpp
index 1571e2628..15beba7a9 100644
--- a/src/lib/tls/tls13/msg_certificate_13.cpp
+++ b/src/lib/tls/tls13/msg_certificate_13.cpp
@@ -125,10 +125,10 @@ void Certificate_13::verify(Callbacks& callbacks,
       }
 
    const auto trusted_CAs = creds.trusted_certificate_authorities(
-                                     m_side == Connection_Side::CLIENT ? "tls-client" : "tls-server",
+                                     m_side == Connection_Side::Client ? "tls-client" : "tls-server",
                                      hostname);
 
-   const auto usage = (m_side == CLIENT) ? Usage_Type::TLS_CLIENT_AUTH : Usage_Type::TLS_SERVER_AUTH;
+   const auto usage = (m_side == Connection_Side::Client) ? Usage_Type::TLS_CLIENT_AUTH : Usage_Type::TLS_SERVER_AUTH;
    callbacks.tls_verify_cert_chain(certs, ocsp_responses, trusted_CAs, usage, hostname, policy);
    }
 
@@ -178,7 +178,7 @@ Certificate_13::Certificate_13(const Certificate_Request_13& cert_request,
                                Credentials_Manager& credentials_manager,
                                Callbacks& callbacks) :
    m_request_context(cert_request.context()),
-   m_side(Connection_Side::CLIENT)
+   m_side(Connection_Side::Client)
    {
    setup_entries(credentials_manager.find_cert_chain(
                     filter_signature_schemes(cert_request.signature_schemes()),
@@ -200,7 +200,7 @@ Certificate_13::Certificate_13(const Client_Hello_13& client_hello,
    //    [In the case of server authentication], this field
    //    SHALL be zero length
    m_request_context(),
-   m_side(Connection_Side::SERVER)
+   m_side(Connection_Side::Server)
    {
    BOTAN_ASSERT_NOMSG(client_hello.extensions().has<Signature_Algorithms>());
 
@@ -226,7 +226,7 @@ Certificate_13::Certificate_13(const std::vector<uint8_t>& buf,
 
    // RFC 8446 4.4.2
    //    [...] in the case of server authentication, this field SHALL be zero length.
-   if(m_side == Connection_Side::SERVER && !m_request_context.empty())
+   if(m_side == Connection_Side::Server && !m_request_context.empty())
       {
       throw TLS_Exception(Alert::ILLEGAL_PARAMETER,
                           "Server Certificate message must not contain a request context");
@@ -301,7 +301,7 @@ Certificate_13::Certificate_13(const std::vector<uint8_t>& buf,
       // RFC 8446 4.4.2.4
       //    If the server supplies an empty Certificate message, the client MUST
       //    abort the handshake with a "decode_error" alert.
-      if(m_side == SERVER)
+      if(m_side == Connection_Side::Server)
          {
          throw TLS_Exception(Alert::DECODE_ERROR, "No certificates sent by server");
          }
diff --git a/src/lib/tls/tls13/msg_certificate_req_13.cpp b/src/lib/tls/tls13/msg_certificate_req_13.cpp
index fa08489e2..8010e8fbd 100644
--- a/src/lib/tls/tls13/msg_certificate_req_13.cpp
+++ b/src/lib/tls/tls13/msg_certificate_req_13.cpp
@@ -26,7 +26,7 @@ Certificate_Request_13::Certificate_Request_13(const std::vector<uint8_t>& buf,
    // RFC 8446 4.3.2
    //    A server which is authenticating with a certificate MAY optionally
    //    request a certificate from the client.
-   if(side != Connection_Side::SERVER)
+   if(side != Connection_Side::Server)
       {
       throw TLS_Exception(Alert::UNEXPECTED_MESSAGE, "Received a Certificate_Request message from a client");
       }
@@ -109,7 +109,7 @@ Certificate_Request_13::Certificate_Request_13(std::vector<X509_DN> acceptable_C
 
    // TODO: give the application a chance to modifying extensions
    //       (after GH #2988 is merged)
-   // callbacks.tls_modify_extensions(m_extensions, Connection_Side::SERVER);
+   // callbacks.tls_modify_extensions(m_extensions, Connection_Side::Server);
    }
 
 std::optional<Certificate_Request_13>
@@ -169,7 +169,7 @@ std::vector<uint8_t> Certificate_Request_13::serialize() const
    {
    std::vector<uint8_t> buf;
    append_tls_length_value(buf, m_context, 1);
-   buf += m_extensions.serialize(Connection_Side::SERVER);
+   buf += m_extensions.serialize(Connection_Side::Server);
    return buf;
    }
 
diff --git a/src/lib/tls/tls13/msg_encrypted_extensions.cpp b/src/lib/tls/tls13/msg_encrypted_extensions.cpp
index 406ca0d02..0e60dce60 100644
--- a/src/lib/tls/tls13/msg_encrypted_extensions.cpp
+++ b/src/lib/tls/tls13/msg_encrypted_extensions.cpp
@@ -70,7 +70,7 @@ Encrypted_Extensions::Encrypted_Extensions(const Client_Hello_13& client_hello,
    // TODO: Implement handling for (at least)
    //       * SRTP
 
-   cb.tls_modify_extensions(m_extensions, SERVER, type());
+   cb.tls_modify_extensions(m_extensions, Connection_Side::Server, type());
    }
 
 Encrypted_Extensions::Encrypted_Extensions(const std::vector<uint8_t>& buf)
@@ -86,7 +86,7 @@ Encrypted_Extensions::Encrypted_Extensions(const std::vector<uint8_t>& buf)
                           "Server sent an empty Encrypted Extensions message");
       }
 
-   m_extensions.deserialize(reader, Connection_Side::SERVER, type());
+   m_extensions.deserialize(reader, Connection_Side::Server, type());
 
    // RFC 8446 4.2
    //    If an implementation receives an extension which it recognizes and
@@ -121,7 +121,7 @@ Encrypted_Extensions::Encrypted_Extensions(const std::vector<uint8_t>& buf)
 
 std::vector<uint8_t> Encrypted_Extensions::serialize() const
    {
-   return m_extensions.serialize(Connection_Side::SERVER);
+   return m_extensions.serialize(Connection_Side::Server);
    }
 
 }
diff --git a/src/lib/tls/tls13/tls_channel_impl_13.cpp b/src/lib/tls/tls13/tls_channel_impl_13.cpp
index 8ede28fb2..fd886200b 100644
--- a/src/lib/tls/tls13/tls_channel_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_channel_impl_13.cpp
@@ -44,7 +44,7 @@ Channel_Impl_13::Channel_Impl_13(Callbacks& callbacks,
                                  RandomNumberGenerator& rng,
                                  const Policy& policy,
                                  bool is_server) :
-   m_side(is_server ? Connection_Side::SERVER : Connection_Side::CLIENT),
+   m_side(is_server ? Connection_Side::Server : Connection_Side::Client),
    m_callbacks(callbacks),
    m_session_manager(session_manager),
    m_credentials_manager(credentials_manager),
diff --git a/src/lib/tls/tls13/tls_cipher_state.cpp b/src/lib/tls/tls13/tls_cipher_state.cpp
index 733c773ed..f63d27e13 100644
--- a/src/lib/tls/tls13/tls_cipher_state.cpp
+++ b/src/lib/tls/tls13/tls_cipher_state.cpp
@@ -171,7 +171,7 @@ void Cipher_State::advance_with_server_finished(const Transcript_Hash& transcrip
    // Note: the secrets for processing client's application data
    //       are not derived before the client's Finished message
    //       was seen and the handshake can be considered finished.
-   if(m_connection_side == Connection_Side::SERVER)
+   if(m_connection_side == Connection_Side::Server)
       {
       derive_write_traffic_key(server_application_traffic_secret);
       m_read_application_traffic_secret = std::move(client_application_traffic_secret);
@@ -198,7 +198,7 @@ void Cipher_State::advance_with_client_finished(const Transcript_Hash& transcrip
 
    // With the client's Finished message, the handshake is complete and
    // we can process client application data.
-   if(m_connection_side == Connection_Side::SERVER)
+   if(m_connection_side == Connection_Side::Server)
       {
       derive_read_traffic_key(m_read_application_traffic_secret);
       }
@@ -285,7 +285,7 @@ bool Cipher_State::must_expect_unprotected_alert_traffic() const
    //   After successfully receiving a Server Hello we expect servers to send
    //   alerts as protected records only, just like they start protecting their
    //   handshake data at this point.
-   if(m_connection_side == CLIENT && m_state == State::EarlyTraffic)
+   if(m_connection_side == Connection_Side::Client && m_state == State::EarlyTraffic)
       { return true; }
 
    // Server side:
@@ -296,7 +296,7 @@ bool Cipher_State::must_expect_unprotected_alert_traffic() const
    //
    // TODO: when implementing PSK and/or early data for the server, we might
    //       need to reconsider this decision.
-   if(m_connection_side == SERVER &&
+   if(m_connection_side == Connection_Side::Server &&
          (m_state == State::HandshakeTraffic ||
           m_state == State::ServerApplicationTraffic))
       { return true; }
@@ -309,10 +309,10 @@ bool Cipher_State::can_encrypt_application_traffic() const
    // TODO: when implementing early traffic (0-RTT) this will likely need
    //       to allow `State::EarlyTraffic`.
 
-   if(m_connection_side == Connection_Side::CLIENT && m_state != State::Completed)
+   if(m_connection_side == Connection_Side::Client && m_state != State::Completed)
       { return false; }
 
-   if (m_connection_side == Connection_Side::SERVER && m_state != State::ServerApplicationTraffic && m_state != State::Completed)
+   if (m_connection_side == Connection_Side::Server && m_state != State::ServerApplicationTraffic && m_state != State::Completed)
       { return false; }
 
    return !m_write_key.empty() && !m_write_iv.empty();
@@ -323,10 +323,10 @@ bool Cipher_State::can_decrypt_application_traffic() const
    // TODO: when implementing early traffic (0-RTT) this will likely need
    //       to allow `State::EarlyTraffic`.
 
-   if(m_connection_side == Connection_Side::CLIENT && m_state != State::ServerApplicationTraffic && m_state != State::Completed)
+   if(m_connection_side == Connection_Side::Client && m_state != State::ServerApplicationTraffic && m_state != State::Completed)
       { return false; }
 
-   if(m_connection_side == Connection_Side::SERVER && m_state != State::Completed)
+   if(m_connection_side == Connection_Side::Server && m_state != State::Completed)
       { return false; }
 
    return !m_read_key.empty() && !m_read_iv.empty();
@@ -364,8 +364,8 @@ std::vector<uint8_t> Cipher_State::psk_binder_mac(const Transcript_Hash& transcr
 
 std::vector<uint8_t> Cipher_State::finished_mac(const Transcript_Hash& transcript_hash) const
    {
-   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::SERVER || m_state == State::HandshakeTraffic);
-   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::CLIENT || m_state == State::ServerApplicationTraffic);
+   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::Server || m_state == State::HandshakeTraffic);
+   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::Client || m_state == State::ServerApplicationTraffic);
    BOTAN_ASSERT_NOMSG(!m_finished_key.empty());
 
    auto hmac = HMAC(m_hash->new_object());
@@ -377,8 +377,8 @@ std::vector<uint8_t> Cipher_State::finished_mac(const Transcript_Hash& transcrip
 bool Cipher_State::verify_peer_finished_mac(const Transcript_Hash& transcript_hash,
       const std::vector<uint8_t>& peer_mac) const
    {
-   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::SERVER || m_state == State::ServerApplicationTraffic);
-   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::CLIENT || m_state == State::HandshakeTraffic);
+   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::Server || m_state == State::ServerApplicationTraffic);
+   BOTAN_ASSERT_NOMSG(m_connection_side != Connection_Side::Client || m_state == State::HandshakeTraffic);
    BOTAN_ASSERT_NOMSG(!m_peer_finished_key.empty());
 
    auto hmac = HMAC(m_hash->new_object());
@@ -482,7 +482,7 @@ void Cipher_State::advance_with_server_hello(const Ciphersuite& cipher,
    const auto client_handshake_traffic_secret = derive_secret(handshake_secret, "c hs traffic", transcript_hash);
    const auto server_handshake_traffic_secret = derive_secret(handshake_secret, "s hs traffic", transcript_hash);
 
-   if(m_connection_side == Connection_Side::SERVER)
+   if(m_connection_side == Connection_Side::Server)
       {
       derive_read_traffic_key(client_handshake_traffic_secret, true);
       derive_write_traffic_key(server_handshake_traffic_secret, true);
diff --git a/src/lib/tls/tls13/tls_cipher_state.h b/src/lib/tls/tls13/tls_cipher_state.h
index 1b84e48a8..2e48de09a 100644
--- a/src/lib/tls/tls13/tls_cipher_state.h
+++ b/src/lib/tls/tls13/tls_cipher_state.h
@@ -253,8 +253,8 @@ class BOTAN_TEST_API Cipher_State
 
    private:
       /**
+       * @param whoami         whether we play the Server or Client
        * @param hash_function  the negotiated hash function to be used
-       * @param whoami         whether we play the SERVER or CLIENT
        */
       Cipher_State(Connection_Side whoami, const std::string& hash_function);
 
diff --git a/src/lib/tls/tls13/tls_client_impl_13.cpp b/src/lib/tls/tls13/tls_client_impl_13.cpp
index b50f13366..b99604c1b 100644
--- a/src/lib/tls/tls13/tls_client_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_client_impl_13.cpp
@@ -340,7 +340,7 @@ void Client_Impl_13::handle(const Server_Hello_13& sh)
                                                             m_transcript_hash.current());
       }
 
-   callbacks().tls_examine_extensions(sh.extensions(), SERVER, Handshake_Type::SERVER_HELLO);
+   callbacks().tls_examine_extensions(sh.extensions(), Connection_Side::Server, Handshake_Type::SERVER_HELLO);
 
    m_transitions.set_expected_next(ENCRYPTED_EXTENSIONS);
    }
@@ -374,7 +374,7 @@ void Client_Impl_13::handle(const Hello_Retry_Request& hrr)
 
    ch.retry(hrr, m_transcript_hash, callbacks(), rng());
 
-   callbacks().tls_examine_extensions(hrr.extensions(), SERVER, Handshake_Type::HELLO_RETRY_REQUEST);
+   callbacks().tls_examine_extensions(hrr.extensions(), Connection_Side::Server, Handshake_Type::HELLO_RETRY_REQUEST);
 
    send_handshake_message(std::reference_wrapper(ch));
 
@@ -416,7 +416,7 @@ void Client_Impl_13::handle(const Encrypted_Extensions& encrypted_extensions_msg
       set_record_size_limits(outgoing_limit->limit(), incoming_limit->limit());
       }
 
-   callbacks().tls_examine_extensions(exts, SERVER, Handshake_Type::ENCRYPTED_EXTENSIONS);
+   callbacks().tls_examine_extensions(exts, Connection_Side::Server, Handshake_Type::ENCRYPTED_EXTENSIONS);
 
    if(m_handshake_state.server_hello().extensions().has<PSK>())
       {
@@ -441,7 +441,7 @@ void Client_Impl_13::handle(const Certificate_Request_13& certificate_request_ms
       throw TLS_Exception(Alert::DECODE_ERROR, "Certificate_Request context must be empty in the main handshake");
       }
 
-   callbacks().tls_examine_extensions(certificate_request_msg.extensions(), SERVER, Handshake_Type::CERTIFICATE_REQUEST);
+   callbacks().tls_examine_extensions(certificate_request_msg.extensions(), Connection_Side::Server, Handshake_Type::CERTIFICATE_REQUEST);
    m_transitions.set_expected_next(CERTIFICATE);
    }
 
@@ -528,7 +528,7 @@ void Client_Impl_13::send_client_authentication(Channel_Impl_13::AggregatedMessa
          cert_request.signature_schemes(),
          m_info.hostname(),
          m_transcript_hash.current(),
-         Connection_Side::CLIENT,
+         Connection_Side::Client,
          credentials_manager(),
          policy(),
          callbacks(),
@@ -587,12 +587,12 @@ void TLS::Client_Impl_13::handle(const New_Session_Ticket_13& new_session_ticket
                    new_session_ticket.lifetime_hint(),
                    m_handshake_state.server_hello().selected_version(),
                    m_handshake_state.server_hello().ciphersuite(),
-                   Connection_Side::CLIENT,
+                   Connection_Side::Client,
                    peer_cert_chain(),
                    m_info,
                    callbacks().tls_current_timestamp());
 
-   callbacks().tls_examine_extensions(new_session_ticket.extensions(), SERVER, Handshake_Type::NEW_SESSION_TICKET);
+   callbacks().tls_examine_extensions(new_session_ticket.extensions(), Connection_Side::Server, Handshake_Type::NEW_SESSION_TICKET);
    if(callbacks().tls_session_ticket_received(session))
       {
       session_manager().save(session);
diff --git a/src/lib/tls/tls13/tls_extensions_key_share.cpp b/src/lib/tls/tls13/tls_extensions_key_share.cpp
index d19deaef0..4ceb73064 100644
--- a/src/lib/tls/tls13/tls_extensions_key_share.cpp
+++ b/src/lib/tls/tls13/tls_extensions_key_share.cpp
@@ -526,11 +526,11 @@ Key_Share::Key_Share(TLS_Data_Reader& reader,
       {
       m_impl = std::make_unique<Key_Share_Impl>(Key_Share_ClientHello(reader, extension_size));
       }
-   else if(message_type == HELLO_RETRY_REQUEST)  // Connection_Side::SERVER
+   else if(message_type == HELLO_RETRY_REQUEST)  // Connection_Side::Server
       {
       m_impl = std::make_unique<Key_Share_Impl>(Key_Share_HelloRetryRequest(reader, extension_size));
       }
-   else if(message_type == SERVER_HELLO)  // Connection_Side::SERVER
+   else if(message_type == SERVER_HELLO)  // Connection_Side::Server
       {
       m_impl = std::make_unique<Key_Share_Impl>(Key_Share_ServerHello(reader, extension_size));
       }
diff --git a/src/lib/tls/tls13/tls_extensions_psk.cpp b/src/lib/tls/tls13/tls_extensions_psk.cpp
index 1727a7130..83482b736 100644
--- a/src/lib/tls/tls13/tls_extensions_psk.cpp
+++ b/src/lib/tls/tls13/tls_extensions_psk.cpp
@@ -135,7 +135,7 @@ PSK::PSK(const Session& session_to_resume, Callbacks& callbacks)
 
    auto psk = session_to_resume.master_secret();
    cpsk.hash_algorithm = session_to_resume.ciphersuite().prf_algo();
-   cpsk.cipher_state = Cipher_State::init_with_psk(CLIENT,
+   cpsk.cipher_state = Cipher_State::init_with_psk(Connection_Side::Client,
                                                   Cipher_State::PSK_Type::RESUMPTION,
                                                   std::move(psk),
                                                   session_to_resume.ciphersuite());
@@ -230,14 +230,14 @@ std::vector<uint8_t> PSK::serialize(Connection_Side side) const
       {
       [&](const Server_PSK& psk)
          {
-         BOTAN_STATE_CHECK(side == SERVER);
+         BOTAN_STATE_CHECK(side == Connection_Side::Server);
          result.reserve(2);
          result.push_back(get_byte<0>(psk.selected_identity));
          result.push_back(get_byte<1>(psk.selected_identity));
          },
       [&](const std::vector<Client_PSK>& psks)
          {
-         BOTAN_STATE_CHECK(side == CLIENT);
+         BOTAN_STATE_CHECK(side == Connection_Side::Client);
 
          std::vector<uint8_t> identities;
          std::vector<uint8_t> binders;
diff --git a/src/lib/tls/tls13/tls_handshake_layer_13.h b/src/lib/tls/tls13/tls_handshake_layer_13.h
index e573767ae..f481b70b4 100644
--- a/src/lib/tls/tls13/tls_handshake_layer_13.h
+++ b/src/lib/tls/tls13/tls_handshake_layer_13.h
@@ -28,7 +28,7 @@ class Transcript_Hash_State;
 class BOTAN_TEST_API Handshake_Layer
    {
    public:
-      Handshake_Layer(Connection_Side whoami) : m_peer(whoami == SERVER ? CLIENT : SERVER) {}
+      Handshake_Layer(Connection_Side whoami) : m_peer(whoami == Connection_Side::Server ? Connection_Side::Client : Connection_Side::Server) {}
 
       /**
        * Reads data that was received in handshake records and stores it internally for further
diff --git a/src/lib/tls/tls13/tls_handshake_state_13.cpp b/src/lib/tls/tls13/tls_handshake_state_13.cpp
index 37fea16ad..ab7f92733 100644
--- a/src/lib/tls/tls13/tls_handshake_state_13.cpp
+++ b/src/lib/tls/tls13/tls_handshake_state_13.cpp
@@ -62,7 +62,7 @@ Certificate_Request_13& Handshake_State_13_Base::store(Certificate_Request_13 ce
 
 Certificate_13& Handshake_State_13_Base::store(Certificate_13 certificate, const bool from_peer)
    {
-   auto& target = ((m_side == CLIENT) == from_peer)
+   auto& target = ((m_side == Connection_Side::Client) == from_peer)
                   ? m_server_certificate
                   : m_client_certificate;
    target = std::move(certificate);
@@ -71,7 +71,7 @@ Certificate_13& Handshake_State_13_Base::store(Certificate_13 certificate, const
 
 Certificate_Verify_13& Handshake_State_13_Base::store(Certificate_Verify_13 certificate_verify, const bool from_peer)
    {
-   auto& target = ((m_side == CLIENT) == from_peer)
+   auto& target = ((m_side == Connection_Side::Client) == from_peer)
                   ? m_server_certificate_verify
                   : m_client_certificate_verify;
    target = std::move(certificate_verify);
@@ -80,7 +80,7 @@ Certificate_Verify_13& Handshake_State_13_Base::store(Certificate_Verify_13 cert
 
 Finished_13& Handshake_State_13_Base::store(Finished_13 finished, const bool from_peer)
    {
-   auto& target = ((m_side == CLIENT) == from_peer)
+   auto& target = ((m_side == Connection_Side::Client) == from_peer)
                   ? m_server_finished
                   : m_client_finished;
    target = std::move(finished);
diff --git a/src/lib/tls/tls13/tls_handshake_state_13.h b/src/lib/tls/tls13/tls_handshake_state_13.h
index c2bf7c550..122c448c8 100644
--- a/src/lib/tls/tls13/tls_handshake_state_13.h
+++ b/src/lib/tls/tls13/tls_handshake_state_13.h
@@ -165,12 +165,12 @@ class BOTAN_TEST_API Handshake_State_13 : public Internal::Handshake_State_13_Ba
          }
    };
 
-using Client_Handshake_State_13 = Handshake_State_13<Connection_Side::CLIENT,
+using Client_Handshake_State_13 = Handshake_State_13<Connection_Side::Client,
       Client_Handshake_13_Message,
       Server_Handshake_13_Message,
       Server_Post_Handshake_13_Message>;
 
-using Server_Handshake_State_13 = Handshake_State_13<Connection_Side::SERVER,
+using Server_Handshake_State_13 = Handshake_State_13<Connection_Side::Server,
       Server_Handshake_13_Message,
       Client_Handshake_13_Message,
       Client_Post_Handshake_13_Message>;
diff --git a/src/lib/tls/tls13/tls_record_layer_13.cpp b/src/lib/tls/tls13/tls_record_layer_13.cpp
index 3eafcd95f..70c8b762d 100644
--- a/src/lib/tls/tls13/tls_record_layer_13.cpp
+++ b/src/lib/tls/tls13/tls_record_layer_13.cpp
@@ -155,7 +155,7 @@ Record_Layer::Record_Layer(Connection_Side side)
    // Once TLS 1.3 is negotiateed, the implementations will disable these
    // compatibility modes accordingly or a protocol downgrade will transfer
    // the marshalling responsibility to our TLS 1.2 implementation.
-   , m_sending_compat_mode(m_side == Connection_Side::CLIENT)
+   , m_sending_compat_mode(m_side == Connection_Side::Client)
    , m_receiving_compat_mode(true) {}
 
 
diff --git a/src/lib/tls/tls13/tls_server_impl_13.cpp b/src/lib/tls/tls13/tls_server_impl_13.cpp
index 5d34dd91b..d57afbcc4 100644
--- a/src/lib/tls/tls13/tls_server_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_server_impl_13.cpp
@@ -168,7 +168,7 @@ void Server_Impl_13::handle_reply_to_client_hello(const Server_Hello_13& server_
                                         client_hello.signature_schemes(),
                                         client_hello.sni_hostname(),
                                         m_transcript_hash.current(),
-                                        Connection_Side::SERVER,
+                                        Connection_Side::Server,
                                         credentials_manager(),
                                         policy(),
                                         callbacks(),
@@ -290,7 +290,7 @@ void Server_Impl_13::handle(const Client_Hello_13& client_hello)
          }
       }
 
-   callbacks().tls_examine_extensions(exts, CLIENT, client_hello.type());
+   callbacks().tls_examine_extensions(exts, Connection_Side::Client, client_hello.type());
    const auto sh_or_hrr = m_handshake_state.sending(Server_Hello_13::create(
       client_hello, is_initial_client_hello, rng(), policy(), callbacks()));
    send_handshake_message(sh_or_hrr);
diff --git a/src/lib/tls/tls_callbacks.h b/src/lib/tls/tls_callbacks.h
index 709d9fc54..050bc5517 100644
--- a/src/lib/tls/tls_callbacks.h
+++ b/src/lib/tls/tls_callbacks.h
@@ -361,7 +361,7 @@ class BOTAN_PUBLIC_API(2,0) Callbacks
        * Default implementation does nothing.
        *
        * @param extn the extensions
-       * @param which_side will be CLIENT or SERVER which is the current
+       * @param which_side will be Connection_Side::Client or Connection_Side::Server which is the current
        *                   applications role in the exchange.
        * @param which_message will state the handshake message type containing the extensions
        */
@@ -379,8 +379,8 @@ class BOTAN_PUBLIC_API(2,0) Callbacks
        * Default implementation does nothing.
        *
        * @param extn the extensions
-       * @param which_side will be CLIENT if these are are the clients extensions (ie we are
-       *        the server) or SERVER if these are the server extensions (we are the client).
+       * @param which_side will be Connection_Side::Client if these are are the clients extensions (ie we are
+       *        the server) or Connection_Side::Server if these are the server extensions (we are the client).
        * @param which_message will state the handshake message type containing the extensions
        */
        virtual void tls_examine_extensions(const Extensions& extn, Connection_Side which_side, Handshake_Type which_message);
diff --git a/src/lib/tls/tls_extensions.cpp b/src/lib/tls/tls_extensions.cpp
index ee5b57971..a90304e25 100644
--- a/src/lib/tls/tls_extensions.cpp
+++ b/src/lib/tls/tls_extensions.cpp
@@ -285,7 +285,7 @@ std::vector<uint8_t> Server_Name_Indicator::serialize(Connection_Side whoami) co
    //    [...] the server SHALL include an extension of type "server_name" in
    //    the (extended) server hello. The "extension_data" field of this
    //    extension SHALL be empty.
-   if(whoami == Connection_Side::SERVER)
+   if(whoami == Connection_Side::Server)
       {
       return {};
       }
@@ -355,7 +355,7 @@ Application_Layer_Protocol_Notification::Application_Layer_Protocol_Notification
    //    The "extension_data" field of the [...] extension is structured the
    //    same as described above for the client "extension_data", except that
    //    the "ProtocolNameList" MUST contain exactly one "ProtocolName".
-   if(from == Connection_Side::SERVER && m_protocols.size() != 1)
+   if(from == Connection_Side::Server && m_protocols.size() != 1)
       {
       throw TLS_Exception(Alert::DECODE_ERROR,
                           "Server sent " + std::to_string(m_protocols.size()) +
@@ -634,7 +634,7 @@ std::vector<uint8_t> Supported_Versions::serialize(Connection_Side whoami) const
    {
    std::vector<uint8_t> buf;
 
-   if(whoami == Connection_Side::SERVER)
+   if(whoami == Connection_Side::Server)
       {
       BOTAN_ASSERT_NOMSG(m_versions.size() == 1);
       buf.push_back(m_versions[0].major_version());
@@ -684,7 +684,7 @@ Supported_Versions::Supported_Versions(TLS_Data_Reader& reader,
                                        uint16_t extension_size,
                                        Connection_Side from)
    {
-   if(from == Connection_Side::SERVER)
+   if(from == Connection_Side::Server)
       {
       if(extension_size != 2)
          throw Decoding_Error("Server sent invalid supported_versions extension");
@@ -744,7 +744,7 @@ Record_Size_Limit::Record_Size_Limit(TLS_Data_Reader& reader,
    // Note: We are currently supporting this extension in TLS 1.3 only, hence
    //       we check for the TLS 1.3 limit. The TLS 1.2 limit would not include
    //       the "content type byte" and hence be one byte less!
-   if(m_limit > MAX_PLAINTEXT_SIZE + 1 /* encrypted content type byte */ && from == SERVER)
+   if(m_limit > MAX_PLAINTEXT_SIZE + 1 /* encrypted content type byte */ && from == Connection_Side::Server)
       {
       throw TLS_Exception(Alert::ILLEGAL_PARAMETER,
                           "Server requested a record size limit larger than the protocol's maximum");
diff --git a/src/lib/tls/tls_magic.h b/src/lib/tls/tls_magic.h
index fbbd1f0ad..73276bb23 100644
--- a/src/lib/tls/tls_magic.h
+++ b/src/lib/tls/tls_magic.h
@@ -42,8 +42,13 @@ enum Size_Limits : size_t {
    MAX_CIPHERTEXT_SIZE_TLS13 = MAX_PLAINTEXT_SIZE + MAX_AEAD_EXPANSION_SIZE_TLS13 + 1
 };
 
-// This will become an enum class in a future major release
-enum Connection_Side { CLIENT = 1, SERVER = 2 };
+enum class Connection_Side {
+   Client = 1,
+   Server = 2,
+
+   CLIENT BOTAN_DEPRECATED("Use Connection_Side::Client") = Client,
+   SERVER BOTAN_DEPRECATED("Use Connection_Side::Server") = Server,
+};
 
 // This will become an enum class in a future major release
 enum Record_Type {
diff --git a/src/lib/tls/tls_messages.h b/src/lib/tls/tls_messages.h
index 8a9dc9ab5..c3ff84195 100644
--- a/src/lib/tls/tls_messages.h
+++ b/src/lib/tls/tls_messages.h
@@ -566,7 +566,7 @@ class BOTAN_UNSTABLE_API Certificate_13 final : public Handshake_Message
       * Deserialize a Certificate message
       * @param buf the serialized message
       * @param policy the TLS policy
-      * @param side is this a SERVER or CLIENT certificate message
+      * @param side is this a Connection_Side::Server or Connection_Side::Client certificate message
       */
       Certificate_13(const std::vector<uint8_t>& buf,
                      const Policy& policy,
@@ -758,7 +758,7 @@ class BOTAN_UNSTABLE_API Certificate_Verify_13 final : public Certificate_Verify
       /**
       * Deserialize a Certificate message
       * @param buf the serialized message
-      * @param side is this a SERVER or CLIENT certificate message
+      * @param side is this a Connection_Side::Server or Connection_Side::Client certificate message
       */
       Certificate_Verify_13(const std::vector<uint8_t>& buf,
                             const Connection_Side side);
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 3896498c6..6a1703739 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -128,7 +128,7 @@ Session::Session(secure_vector<uint8_t>&& session_psk,
    m_master_secret(std::move(session_psk)),
    m_version(server_hello.selected_version()),
    m_ciphersuite(server_hello.ciphersuite()),
-   m_connection_side(Connection_Side::SERVER),
+   m_connection_side(Connection_Side::Server),
    m_extended_master_secret(true),
    m_encrypt_then_mac(true),
    m_peer_certs(peer_certs),
diff --git a/src/lib/tls/tls_session_manager_memory.cpp b/src/lib/tls/tls_session_manager_memory.cpp
index 39dcead4b..0afdce80f 100644
--- a/src/lib/tls/tls_session_manager_memory.cpp
+++ b/src/lib/tls/tls_session_manager_memory.cpp
@@ -121,7 +121,7 @@ void Session_Manager_In_Memory::save(const Session& session)
 
    m_sessions[session_id_str] = session.encrypt(m_session_key, m_rng);
 
-   if(session.side() == CLIENT && !session.server_info().empty())
+   if(session.side() == Connection_Side::Client && !session.server_info().empty())
       m_info_sessions[session.server_info()] = session_id_str;
    }
 


Test patch:
diff --git a/src/tests/test_tls.cpp b/src/tests/test_tls.cpp
index b77b8794a..535e9c01c 100644
--- a/src/tests/test_tls.cpp
+++ b/src/tests/test_tls.cpp
@@ -46,7 +46,7 @@ class TLS_Session_Tests final : public Test
                                      Botan::secure_vector<uint8_t>{0xCC, 0xDD},
                                      Botan::TLS::Protocol_Version::TLS_V12,
                                      0xC02F,
-                                     Botan::TLS::CLIENT,
+                                     Botan::TLS::Connection_Side::Client,
                                      true,
                                      false,
                                      std::vector<Botan::X509_Certificate>(),
@@ -91,7 +91,7 @@ class TLS_Session_Tests final : public Test
                                      Botan::secure_vector<uint8_t>{0xCC, 0xEE},
                                      Botan::TLS::Protocol_Version::TLS_V12,
                                      0xBAAD, // cipher suite does not exist
-                                     Botan::TLS::CLIENT,
+                                     Botan::TLS::Connection_Side::Client,
                                      true,
                                      false,
                                      std::vector<Botan::X509_Certificate>(),
diff --git a/src/tests/test_tls_cipher_state.cpp b/src/tests/test_tls_cipher_state.cpp
index d45e564ac..ad950f7ee 100644
--- a/src/tests/test_tls_cipher_state.cpp
+++ b/src/tests/test_tls_cipher_state.cpp
@@ -40,8 +40,8 @@ decltype(auto) make_CHECK_both(Cipher_State* cs_client, Cipher_State* cs_server)
       {
       return
          {
-         Botan_Tests::CHECK(std::string(name + " (client)").c_str(), std::bind(lambda, cs_client, Connection_Side::CLIENT, _1)),
-         Botan_Tests::CHECK(std::string(name + " (server)").c_str(), std::bind(lambda, cs_server, Connection_Side::SERVER, _1))
+         Botan_Tests::CHECK(std::string(name + " (client)").c_str(), std::bind(lambda, cs_client, Connection_Side::Client, _1)),
+         Botan_Tests::CHECK(std::string(name + " (server)").c_str(), std::bind(lambda, cs_server, Connection_Side::Server, _1))
          };
       };
    }
@@ -143,7 +143,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    const auto encrypted_extensions = RFC8448_TestData
       (
       "encrypted_extensions",
-      Connection_Side::SERVER,
+      Connection_Side::Server,
       Botan::hex_decode("17 03 03 02 a2"),
       Botan::hex_decode_locked("d1 ff 33 4a 56 f5 bf"
                                "f6 59 4a 07 cc 87 b5 80 23 3f 50 0f 45 e4 89 e7 f3 3a f3 5e df"
@@ -218,7 +218,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    const auto encrypted_client_finished_message = RFC8448_TestData
       (
       "encrypted_client_finished_message",
-      Connection_Side::CLIENT,
+      Connection_Side::Client,
       Botan::hex_decode("17 03 03 00 35"),
       Botan::hex_decode_locked("75 ec 4d c2 38 cc e6"
          "0b 29 80 44 a7 1e 21 9c 56 cc 77 b0 51 7f e9 b9 3c 7a 4b fc 44"
@@ -233,7 +233,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    const auto encrypted_new_session_ticket = RFC8448_TestData
       (
       "encrypted_new_session_ticket",
-      Connection_Side::SERVER,
+      Connection_Side::Server,
       Botan::hex_decode("17 03 03 00 de"),
       Botan::hex_decode_locked(
          "3a 6b 8f 90 41 4a 97"
@@ -267,7 +267,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    const auto encrypted_application_data_client = RFC8448_TestData
       (
       "encrypted_application_data_client",
-      Connection_Side::CLIENT,
+      Connection_Side::Client,
       Botan::hex_decode("17 03 03 00 43"),
       Botan::hex_decode_locked("a2 3f 70 54 b6 2c 94"
                                "d0 af fa fe 82 28 ba 55 cb ef ac ea 42 f9 14 aa 66 bc ab 3f 2b"
@@ -284,7 +284,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    const auto encrypted_application_data_server = RFC8448_TestData
       (
       "encrypted_application_data_server",
-      Connection_Side::SERVER,
+      Connection_Side::Server,
       Botan::hex_decode("17 03 03 00 43"),
       Botan::hex_decode_locked("2e 93 7e 11 ef 4a c7"
          "40 e5 38 ad 36 00 5f c4 a4 69 32 fc 32 25 d0 5f 82 aa 1b 36 e3"
@@ -300,9 +300,9 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
    auto cipher = Ciphersuite::from_name("AES_128_GCM_SHA256").value();
 
    // initialize Cipher_State with client_hello...server_hello
-   auto cs_client = Cipher_State::init_with_server_hello(Connection_Side::CLIENT, secure_vector<uint8_t>(shared_secret), cipher,
+   auto cs_client = Cipher_State::init_with_server_hello(Connection_Side::Client, secure_vector<uint8_t>(shared_secret), cipher,
          th_server_hello);
-   auto cs_server = Cipher_State::init_with_server_hello(Connection_Side::SERVER, secure_vector<uint8_t>(shared_secret), cipher,
+   auto cs_server = Cipher_State::init_with_server_hello(Connection_Side::Server, secure_vector<uint8_t>(shared_secret), cipher,
          th_server_hello);
 
    auto CHECK_both = make_CHECK_both(cs_client.get(), cs_server.get());
@@ -316,7 +316,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
                         !cs->is_compatible_with(Ciphersuite::from_name("CHACHA20_POLY1305_SHA256").value()) &&
                         !cs->is_compatible_with(Ciphersuite::from_name("AES_128_CCM_SHA256").value()) &&
                         !cs->is_compatible_with(Ciphersuite::from_name("PSK_WITH_AES_128_GCM_SHA256").value()));
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("Clients don't expect unprotected alerts after server hello",
                            !cs->must_expect_unprotected_alert_traffic());
@@ -339,7 +339,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
          // validate the MAC we receive in server Finished message
          const auto expected_server_mac = Botan::hex_decode("9b 9b 14 1d 90 63 37 fb d2 cb dc e7 1d f4"
                                                             "de da 4a b4 2c 30 95 72 cb 7f ff ee 54 54 b7 8f 07 18");
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("expecting the correct MAC for server finished", cs->verify_peer_finished_mac(th_pre_server_finished,
                            expected_server_mac));
@@ -356,7 +356,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
                cs->advance_with_server_finished(th_server_finished);
                });
 
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("can read application data", cs->can_decrypt_application_traffic());
             result.confirm("can not yet write application data", !cs->can_encrypt_application_traffic());
@@ -374,7 +374,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1()
          // generate the MAC for the client Finished message
          const auto expected_client_mac = Botan::hex_decode("a8 ec 43 6d 67 76 34 ae 52 5a c1 fc eb e1 1a 03"
                                                             "9e c1 76 94 fa c6 e9 85 27 b6 42 f2 ed d5 ce 61");
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.test_eq("generating the correct MAC for client finished", cs->finished_mac(th_server_finished), expected_client_mac);
             }
@@ -509,7 +509,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
    const auto encrypted_extensions = RFC8448_TestData
       (
       "encrypted_extensions",
-      Connection_Side::SERVER,
+      Connection_Side::Server,
       Botan::hex_decode("17 03 03 00 61"),
       Botan::hex_decode_locked(
          "dc 48 23 7b 4b 87 9f"
@@ -531,7 +531,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
    const auto encrypted_client_finished_message = RFC8448_TestData
       (
       "encrypted_client_finished_message",
-      Connection_Side::CLIENT,
+      Connection_Side::Client,
       Botan::hex_decode("17 03 03 00 35"),
       Botan::hex_decode_locked("00 f8 b4 67 d1 4c f2"
          "2a 4b 3f 0b 6a e0 d8 e6 cc 8d 08 e0 db 35 15 ef 5c 2b df 19 22"
@@ -546,7 +546,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
    const auto encrypted_application_data_client = RFC8448_TestData
       (
       "encrypted_application_data_client",
-      Connection_Side::CLIENT,
+      Connection_Side::Client,
       Botan::hex_decode("17 03 03 00 43"),
       Botan::hex_decode_locked("b1 ce bc e2 42 aa 20"
          "1b e9 ae 5e 1c b2 a9 aa 4b 33 d4 e8 66 af 1e db 06 89 19 23 77"
@@ -563,7 +563,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
    const auto encrypted_application_data_server = RFC8448_TestData
       (
       "encrypted_application_data_server",
-      Connection_Side::SERVER,
+      Connection_Side::Server,
       Botan::hex_decode("17 03 03 00 43"),
       Botan::hex_decode_locked("27 5e 9f 20 ac ff 57"
          "bc 00 06 57 d3 86 7d f0 39 cc cf 79 04 78 84 cf 75 77 17 46 f7"
@@ -578,11 +578,11 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
 
    auto cipher = Ciphersuite::from_name("AES_128_GCM_SHA256").value();
 
-   auto cs_client = Cipher_State::init_with_psk(Connection_Side::CLIENT,
+   auto cs_client = Cipher_State::init_with_psk(Connection_Side::Client,
                                          Cipher_State::PSK_Type::RESUMPTION,
                                          secure_vector<uint8_t>(psk.begin(), psk.end()),
                                          cipher);
-   auto cs_server = Cipher_State::init_with_psk(Connection_Side::SERVER,
+   auto cs_server = Cipher_State::init_with_psk(Connection_Side::Server,
                                          Cipher_State::PSK_Type::RESUMPTION,
                                          secure_vector<uint8_t>(psk.begin(), psk.end()),
                                          cipher);
@@ -616,7 +616,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
          result.require("early key export is possible", cs->can_export_keys());
          result.test_eq("early key export produces expected result", cs->export_key(early_export_label, early_export_context, 16), early_expected_key_export);
 
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("Clients must expect servers to respond with an unprotected alert",
                            cs->must_expect_unprotected_alert_traffic());
@@ -645,7 +645,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
          // validate the MAC we receive in server Finished message
          const auto expected_server_mac = Botan::hex_decode("48 d3 e0 e1 b3 d9 07 c6 ac ff 14 5e 16 09 03 88"
                                                             "c7 7b 05 c0 50 b6 34 ab 1a 88 bb d0 dd 1a 34 b2");
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("expecting the correct MAC for server finished", cs->verify_peer_finished_mac(th_pre_server_finished,
                            expected_server_mac));
@@ -670,7 +670,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
                cs->advance_with_server_finished(th_server_finished);
                });
 
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.confirm("can read application data", cs->can_decrypt_application_traffic());
             result.confirm("cannot write application data", !cs->can_encrypt_application_traffic());
@@ -688,7 +688,7 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt0()
          // generate the MAC for the client Finished message
          const auto expected_client_mac = Botan::hex_decode("72 30 a9 c9 52 c2 5c d6 13 8f c5 e6 62 83 08 c4"
                                                             "1c 53 35 dd 81 b9 f9 6b ce a5 0f d3 2b da 41 6d");
-         if(side == Connection_Side::CLIENT)
+         if(side == Connection_Side::Client)
             {
             result.test_eq("generating the correct MAC for client finished", cs->finished_mac(th_end_of_early_data), expected_client_mac);
             }
diff --git a/src/tests/test_tls_handshake_layer_13.cpp b/src/tests/test_tls_handshake_layer_13.cpp
index 54fbf6720..5b9a0de3e 100644
--- a/src/tests/test_tls_handshake_layer_13.cpp
+++ b/src/tests/test_tls_handshake_layer_13.cpp
@@ -163,7 +163,7 @@ std::vector<Test::Result> read_handshake_messages()
       {
       Botan_Tests::CHECK("empty read", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          result.confirm("needs header bytes", !hl.next_message(Policy(), th));
          check_transcript_hash_empty(result, th);
@@ -171,7 +171,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read incomplete header", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data({0x00, 0x01, 0x02});
          result.confirm("needs more bytes", !hl.next_message(Policy(), th));
@@ -180,7 +180,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read client hello", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data(client_hello_message);
          result.confirm("is a client hello", has_message<Client_Hello_13>(result, hl.next_message(Policy(), th)));
@@ -189,7 +189,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read server hello", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data(server_hello_message);
          result.confirm("is a server hello", has_message<Server_Hello_13>(result, hl.next_message(Policy(), th)));
@@ -198,7 +198,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read legacy server hello", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data(server_hello_12_message);
          result.confirm("is a legacy server hello", has_message<Server_Hello_12>(result, hl.next_message(Policy(), th)));
@@ -207,7 +207,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read client hello in two steps", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
 
          const Botan::secure_vector<uint8_t> partial_client_hello_message(
@@ -226,7 +226,7 @@ std::vector<Test::Result> read_handshake_messages()
 
       Botan_Tests::CHECK("read multiple messages", [&](auto& result)
          {
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data(Botan::concat(server_hello_message, encrypted_extensions));
          result.confirm("is a server hello", has_message<Server_Hello_13>(result, hl.next_message(Policy(), th)));
@@ -238,7 +238,7 @@ std::vector<Test::Result> read_handshake_messages()
          {
          for(const auto& msg : tls_12_only_messages)
             {
-            Handshake_Layer hl(Connection_Side::CLIENT);
+            Handshake_Layer hl(Connection_Side::Client);
             Transcript_Hash_State th("SHA-256");
 
             hl.copy_data(msg);
@@ -259,7 +259,7 @@ std::vector<Test::Result> read_handshake_messages()
          const auto data = Botan::hex_decode_locked("D4B028717D0FA310FF8664127B9448D7952E06A4F9EA23");
          // data from the bogo test --          ~~~~~~ <- length
          //                                   ~~ <- bogus message type
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          hl.copy_data(data);
             result.template test_throws<TLS_Exception>("message is rejected", "Unknown handshake message received",
@@ -275,7 +275,7 @@ std::vector<Test::Result> prepare_message()
       Botan_Tests::CHECK("prepare client hello", [&](auto& result)
          {
          auto hello = std::get<Client_Hello_13>(Client_Hello_13::parse({client_hello_message.cbegin()+4, client_hello_message.cend()}));
-         Handshake_Layer hl(Connection_Side::CLIENT);
+         Handshake_Layer hl(Connection_Side::Client);
          Transcript_Hash_State th("SHA-256");
          result.test_eq("produces the same message", hl.prepare_message(hello, th), client_hello_message);
          check_transcript_hash_filled(result, th);
@@ -284,7 +284,7 @@ std::vector<Test::Result> prepare_message()
       Botan_Tests::CHECK("prepare server hello", [&](auto& result)
          {
          auto hello = std::get<Server_Hello_13>(Server_Hello_13::parse({server_hello_message.cbegin()+4, server_hello_message.cend()}));
-         Handshake_Layer hl(Connection_Side::SERVER);
+         Handshake_Layer hl(Connection_Side::Server);
          Transcript_Hash_State th("SHA-256");
          result.test_eq("produces the same message", hl.prepare_message(hello, th), server_hello_message);
          check_transcript_hash_filled(result, th);
@@ -294,7 +294,7 @@ std::vector<Test::Result> prepare_message()
 
 std::vector<Test::Result> full_client_handshake()
    {
-   Handshake_Layer hl(Connection_Side::CLIENT);
+   Handshake_Layer hl(Connection_Side::Client);
    Transcript_Hash_State th;
 
    Text_Policy policy("minimum_rsa_bits = 1024");
@@ -365,7 +365,7 @@ std::vector<Test::Result> full_client_handshake()
 
 std::vector<Test::Result> hello_retry_request_handshake()
    {
-   Handshake_Layer hl(Connection_Side::CLIENT);
+   Handshake_Layer hl(Connection_Side::Client);
    Transcript_Hash_State th;
 
    Text_Policy policy("minimum_rsa_bits = 1024");
diff --git a/src/tests/test_tls_messages.cpp b/src/tests/test_tls_messages.cpp
index 4666bb718..7a47d877f 100644
--- a/src/tests/test_tls_messages.cpp
+++ b/src/tests/test_tls_messages.cpp
@@ -148,7 +148,7 @@ class TLS_Message_Parsing_Test final : public Text_Based_Test
                   }
                else if(algo == "cert_status")
                   {
-                  Botan::TLS::Certificate_Status message(buffer, Botan::TLS::Connection_Side::SERVER);
+                  Botan::TLS::Certificate_Status message(buffer, Botan::TLS::Connection_Side::Server);
 
                   Botan::OCSP::Response resp(message.response());
 
@@ -205,7 +205,7 @@ class TLS_Message_Parsing_Test final : public Text_Based_Test
                {
                result.test_throws("invalid cert_status input", exception, [&buffer]()
                   {
-                  Botan::TLS::Certificate_Status message(buffer, Botan::TLS::Connection_Side::SERVER);
+                  Botan::TLS::Certificate_Status message(buffer, Botan::TLS::Connection_Side::Server);
                   });
                }
             else if(algo == "new_session_ticket")
@@ -274,7 +274,7 @@ class TLS_Key_Share_CH_Generation_Test final : public Text_Based_Test
             rng.add_entropy(rng_data.data(), rng_data.size());
 
             Botan::TLS::Key_Share share(policy, cb, rng);
-            const auto serialized_buffer = share.serialize(Botan::TLS::Connection_Side::CLIENT);
+            const auto serialized_buffer = share.serialize(Botan::TLS::Connection_Side::Client);
 
             result.test_eq("key_share_CH_offers test", serialized_buffer, expected_key_share);
 
@@ -309,8 +309,8 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                      const std::string expected_buffer = Botan::hex_encode(buffer);
                      Botan::TLS::TLS_Data_Reader tls_data_reader("ClientHello", buffer);
                       Botan::TLS::Supported_Versions supported_versions(tls_data_reader, static_cast<uint16_t>(buffer.size()),
-                        Botan::TLS::Connection_Side::CLIENT);
-                     const auto serialized_buffer = supported_versions.serialize(Botan::TLS::Connection_Side::CLIENT);
+                        Botan::TLS::Connection_Side::Client);
+                     const auto serialized_buffer = supported_versions.serialize(Botan::TLS::Connection_Side::Client);
 
                      const std::vector<std::vector<uint8_t>> expected_versions = vars.get_req_bin_list("Expected_Content");
                      for (const auto& expected_version : expected_versions)
@@ -326,7 +326,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                      Botan::TLS::TLS_Data_Reader tls_data_reader("ClientHello", buffer);
                      Botan::TLS::Supported_Groups supp_groups_ext (tls_data_reader, static_cast<uint16_t>(buffer.size()));
 
-                     const auto serialized_buffer = supp_groups_ext.serialize(Botan::TLS::Connection_Side::CLIENT);
+                     const auto serialized_buffer = supp_groups_ext.serialize(Botan::TLS::Connection_Side::Client);
                      const auto expected_content = vars.get_req_bin("Expected_Content");
 
                      const auto dh_groups = supp_groups_ext.dh_groups();
@@ -354,7 +354,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                      Botan::TLS::TLS_Data_Reader tls_data_reader("ClientHello", buffer);
                      Botan::TLS::Signature_Algorithms_Cert sig_algo_cert (tls_data_reader, static_cast<uint16_t>(buffer.size()));
 
-                     const auto serialized_buffer = sig_algo_cert.serialize(Botan::TLS::Connection_Side::CLIENT);
+                     const auto serialized_buffer = sig_algo_cert.serialize(Botan::TLS::Connection_Side::Client);
                      const auto expected_content = vars.get_req_bin("Expected_Content");
 
                      result.confirm("signature_algorithms_cert extension - size check",
@@ -378,7 +378,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                   Botan::TLS::TLS_Data_Reader tls_data_reader("HelloRetryRequest", buffer);
                   Botan::TLS::Cookie cookie(tls_data_reader, static_cast<uint16_t>(buffer.size()));
 
-                  const auto serialized_buffer = cookie.serialize(Botan::TLS::Connection_Side::SERVER);
+                  const auto serialized_buffer = cookie.serialize(Botan::TLS::Connection_Side::Server);
                   const auto expected_cookie = vars.get_req_bin("Expected_Content");
 
                   result.test_eq("Cookie extension test", Botan::hex_encode(expected_cookie), Botan::hex_encode(cookie.get_cookie()));
@@ -388,7 +388,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                   Botan::TLS::TLS_Data_Reader tls_data_reader("HelloRetryRequest", buffer);
                   Botan::TLS::Key_Share key_share(tls_data_reader, static_cast<uint16_t>(buffer.size()), Botan::TLS::Handshake_Type::HELLO_RETRY_REQUEST);
 
-                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::CLIENT);
+                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::Client);
                   const auto expected_key_share = vars.get_req_bin("Expected_Content");
 
                   result.test_eq("key_share_HRR test", Botan::hex_encode(serialized_buffer), Botan::hex_encode(expected_key_share));
@@ -398,7 +398,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                   Botan::TLS::TLS_Data_Reader tls_data_reader("ServerHello", buffer);
                   Botan::TLS::Key_Share key_share(tls_data_reader, static_cast<uint16_t>(buffer.size()), Botan::TLS::Handshake_Type::SERVER_HELLO);
 
-                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::CLIENT);
+                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::Client);
                   const auto expected_key_share = vars.get_req_bin("Expected_Content");
 
                   result.test_eq("key_share_SH test", Botan::hex_encode(serialized_buffer), Botan::hex_encode(expected_key_share));
@@ -408,7 +408,7 @@ class TLS_Extension_Parsing_Test final : public Text_Based_Test
                   Botan::TLS::TLS_Data_Reader tls_data_reader("ClientHello", buffer);
                   Botan::TLS::Key_Share key_share(tls_data_reader, static_cast<uint16_t>(buffer.size()), Botan::TLS::Handshake_Type::CLIENT_HELLO);
 
-                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::SERVER);
+                  const auto serialized_buffer = key_share.serialize(Botan::TLS::Connection_Side::Server);
                   const auto expected_key_share = vars.get_req_bin("Expected_Content");
 
                   result.test_eq("key_share_CH test", Botan::hex_encode(serialized_buffer), Botan::hex_encode(expected_key_share));
diff --git a/src/tests/test_tls_record_layer_13.cpp b/src/tests/test_tls_record_layer_13.cpp
index 81c4ac227..987fc93da 100644
--- a/src/tests/test_tls_record_layer_13.cpp
+++ b/src/tests/test_tls_record_layer_13.cpp
@@ -28,7 +28,7 @@ using Records = std::vector<TLS::Record>;
 
 TLS::Record_Layer record_layer_client(const bool skip_client_hello=false)
    {
-   auto rl = TLS::Record_Layer(TLS::Connection_Side::CLIENT);
+   auto rl = TLS::Record_Layer(TLS::Connection_Side::Client);
 
    // this is relevant for tests that rely on the legacy version in the record
    if(skip_client_hello)
@@ -39,7 +39,7 @@ TLS::Record_Layer record_layer_client(const bool skip_client_hello=false)
 
 TLS::Record_Layer record_layer_server(const bool skip_client_hello=false)
    {
-   auto rl = TLS::Record_Layer(TLS::Connection_Side::SERVER);
+   auto rl = TLS::Record_Layer(TLS::Connection_Side::Server);
 
    // this is relevant for tests that rely on the legacy version in the record
    if(skip_client_hello)
@@ -48,7 +48,7 @@ TLS::Record_Layer record_layer_server(const bool skip_client_hello=false)
    return rl;
    }
 
-std::unique_ptr<TLS::Cipher_State> rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side side = Botan::TLS::Connection_Side::CLIENT)
+std::unique_ptr<TLS::Cipher_State> rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side side = Botan::TLS::Connection_Side::Client)
    {
    const auto transcript_hash = Botan::hex_decode(
                                    "86 0c 06 ed c0 78 58 ee 8e 78 f0 e7 42 8c 58 ed"
@@ -167,7 +167,7 @@ std::vector<Test::Result> basic_sanitization_parse_records(TLS::Connection_Side
    {
    auto parse_records = [side](const std::vector<uint8_t>& data, TLS::Cipher_State* cs=nullptr)
       {
-      auto rl = ((side == TLS::Connection_Side::CLIENT) ? record_layer_client(true) : record_layer_server());
+      auto rl = ((side == TLS::Connection_Side::Client) ? record_layer_client(true) : record_layer_server());
       rl.copy_data(data);
       return rl.next_record(cs);
       };
@@ -312,12 +312,12 @@ std::vector<Test::Result> basic_sanitization_parse_records(TLS::Connection_Side
 
 std::vector<Test::Result> basic_sanitization_parse_records_client()
    {
-   return basic_sanitization_parse_records(TLS::Connection_Side::CLIENT);
+   return basic_sanitization_parse_records(TLS::Connection_Side::Client);
    }
 
 std::vector<Test::Result> basic_sanitization_parse_records_server()
    {
-   return basic_sanitization_parse_records(TLS::Connection_Side::SERVER);
+   return basic_sanitization_parse_records(TLS::Connection_Side::Server);
    }
 
 std::vector<Test::Result> read_fragmented_records()
@@ -619,7 +619,7 @@ read_encrypted_records()
 
          result.test_no_throw("Server allows unprotected alerts after its first flight", [&]
             {
-            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::SERVER);
+            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::Server);
             auto rl = parse_records(alert);
             rl.next_record(cs.get());
             });
@@ -627,7 +627,7 @@ read_encrypted_records()
          result.test_throws<Botan::TLS::TLS_Exception>("Unprotected handshake messages are not allowed for servers",
                "unprotected record received where protected traffic was expected", [&]
             {
-            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::SERVER);
+            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::Server);
             auto rl = parse_records(hsmsg);
             rl.next_record(cs.get());
             });
@@ -635,7 +635,7 @@ read_encrypted_records()
          result.test_throws<Botan::TLS::TLS_Exception>("Clients don't allow unprotected alerts after Server Hello",
                "unprotected record received where protected traffic was expected", [&]
             {
-            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::CLIENT);
+            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::Client);
             auto rl = parse_records(alert);
             rl.next_record(cs.get());
             });
@@ -643,7 +643,7 @@ read_encrypted_records()
          result.test_throws<Botan::TLS::TLS_Exception>("Unprotected handshake messages are not allowed for clients",
                "unprotected record received where protected traffic was expected", [&]
             {
-            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::CLIENT);
+            auto cs = rfc8448_rtt1_handshake_traffic(TLS::Connection_Side::Client);
             auto rl = parse_records(hsmsg);
             rl.next_record(cs.get());
             });
@@ -938,7 +938,7 @@ std::vector<Test::Result> record_size_limits()
       {
       Botan_Tests::CHECK("no specified limits means protocol defaults", [&](Test::Result& result)
          {
-         auto csc = rfc8448_rtt1_handshake_traffic(Botan::TLS::CLIENT);
+         auto csc = rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side::Client);
          auto rlc = record_layer_client(true);
 
          const auto r1 = rlc.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE), csc.get());
@@ -947,7 +947,7 @@ std::vector<Test::Result> record_size_limits()
          const auto r2 = rlc.prepare_records(TLS::Record_Type::APPLICATION_DATA, std::vector<uint8_t>(Botan::TLS::MAX_PLAINTEXT_SIZE + 1), csc.get());
          result.test_eq("two records generated", count_records(r2), 2);
 
-         auto css = rfc8448_rtt1_handshake_traffic(Botan::TLS::SERVER);
+         auto css = rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side::Server);
          auto rls = record_layer_server(true);
          rls.copy_data(r1);
 
@@ -1013,7 +1013,7 @@ std::vector<Test::Result> record_size_limits()
 
       Botan_Tests::CHECK("incoming limit is checked on protected records", [&](Test::Result& result)
          {
-         auto css = rfc8448_rtt1_handshake_traffic(Botan::TLS::SERVER);
+         auto css = rfc8448_rtt1_handshake_traffic(Botan::TLS::Connection_Side::Server);
          auto rls = record_layer_server(true);
 
          rls.set_record_size_limits(Botan::TLS::MAX_PLAINTEXT_SIZE + 1, 127 + 1);
diff --git a/src/tests/test_tls_rfc8448.cpp b/src/tests/test_tls_rfc8448.cpp
index d61a0319b..5303beac5 100644
--- a/src/tests/test_tls_rfc8448.cpp
+++ b/src/tests/test_tls_rfc8448.cpp
@@ -787,7 +787,7 @@ class Server_Context : public TLS_Context
  */
 void sort_client_extensions(Botan::TLS::Extensions& exts, Botan::TLS::Connection_Side side)
    {
-   if(side == Botan::TLS::Connection_Side::CLIENT)
+   if(side == Botan::TLS::Connection_Side::Client)
       {
       const std::vector<Botan::TLS::Extension_Code> expected_order =
          {
@@ -822,7 +822,7 @@ void sort_client_extensions(Botan::TLS::Extensions& exts, Botan::TLS::Connection
  */
 void sort_server_extensions(Botan::TLS::Extensions& exts, Botan::TLS::Connection_Side side, Botan::TLS::Handshake_Type /*type*/)
    {
-   if(side == Botan::TLS::Connection_Side::SERVER)
+   if(side == Botan::TLS::Connection_Side::Server)
       {
       const std::vector<Botan::TLS::Extension_Code> expected_order =
          {
diff --git a/src/tests/test_tls_stream_integration.cpp b/src/tests/test_tls_stream_integration.cpp
index 5ace2ed32..db44b6053 100644
--- a/src/tests/test_tls_stream_integration.cpp
+++ b/src/tests/test_tls_stream_integration.cpp
@@ -268,7 +268,7 @@ class Server : public Peer, public std::enable_shared_from_this<Server>
             }
 
          reset_timeout("handshake");
-         m_stream->async_handshake(Botan::TLS::Connection_Side::SERVER,
+         m_stream->async_handshake(Botan::TLS::Connection_Side::Server,
                                    std::bind(&Server::handle_handshake, shared_from_this(), _1));
          }
 
@@ -499,7 +499,7 @@ class Test_Conversation : public TestBase, public net::coroutine, public std::en
             m_result.expect_success("connect", ec);
 
             m_client->reset_timeout("handshake");
-            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::CLIENT,
+            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::Client,
                   std::bind(test_case, shared_from_this(), _1));
             m_result.expect_success("handshake", ec);
 
@@ -547,7 +547,7 @@ class Test_Conversation_Sync : public Synchronous_Test
          net::connect(m_client->stream().lowest_layer(), k_endpoints, ec);
          m_result.expect_success("connect", ec);
 
-         m_client->stream().handshake(Botan::TLS::Connection_Side::CLIENT, ec);
+         m_client->stream().handshake(Botan::TLS::Connection_Side::Client, ec);
          m_result.expect_success("handshake", ec);
 
          net::write(m_client->stream(),
@@ -595,7 +595,7 @@ class Test_Eager_Close : public TestBase, public net::coroutine, public std::ena
             m_result.expect_success("connect", ec);
 
             m_client->reset_timeout("handshake");
-            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::CLIENT,
+            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::Client,
                   std::bind(test_case, shared_from_this(), _1));
             m_result.expect_success("handshake", ec);
 
@@ -625,7 +625,7 @@ class Test_Eager_Close_Sync : public Synchronous_Test
          net::connect(m_client->stream().lowest_layer(), k_endpoints, ec);
          m_result.expect_success("connect", ec);
 
-         m_client->stream().handshake(Botan::TLS::Connection_Side::CLIENT, ec);
+         m_client->stream().handshake(Botan::TLS::Connection_Side::Client, ec);
          m_result.expect_success("handshake", ec);
 
          m_client->stream().shutdown(ec);
@@ -662,7 +662,7 @@ class Test_Close_Without_Shutdown
             m_result.expect_success("connect", ec);
 
             m_client->reset_timeout("handshake");
-            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::CLIENT,
+            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::Client,
                   std::bind(test_case, shared_from_this(), _1));
             m_result.expect_success("handshake", ec);
 
@@ -703,7 +703,7 @@ class Test_Close_Without_Shutdown_Sync : public Synchronous_Test
          net::connect(m_client->stream().lowest_layer(), k_endpoints, ec);
          m_result.expect_success("connect", ec);
 
-         m_client->stream().handshake(Botan::TLS::Connection_Side::CLIENT, ec);
+         m_client->stream().handshake(Botan::TLS::Connection_Side::Client, ec);
          m_result.expect_success("handshake", ec);
 
          m_server->expect_short_read();
@@ -738,7 +738,7 @@ class Test_No_Shutdown_Response : public TestBase, public net::coroutine,
             m_result.expect_success("connect", ec);
 
             m_client->reset_timeout("handshake");
-            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::CLIENT,
+            yield m_client->stream().async_handshake(Botan::TLS::Connection_Side::Client,
                   std::bind(test_case, shared_from_this(), _1));
             m_result.expect_success("handshake", ec);
 
@@ -778,7 +778,7 @@ class Test_No_Shutdown_Response_Sync : public Synchronous_Test
          net::connect(m_client->stream().lowest_layer(), k_endpoints, ec);
          m_result.expect_success("connect", ec);
 
-         m_client->stream().handshake(Botan::TLS::Connection_Side::CLIENT, ec);
+         m_client->stream().handshake(Botan::TLS::Connection_Side::Client, ec);
          m_result.expect_success("handshake", ec);
 
          net::write(m_client->stream(),
diff --git a/src/tests/unit_asio_stream.cpp b/src/tests/unit_asio_stream.cpp
index 67f35bff7..8a50babb5 100644
--- a/src/tests/unit_asio_stream.cpp
+++ b/src/tests/unit_asio_stream.cpp
@@ -166,7 +166,7 @@ class Asio_Stream_Tests final : public Test
          auto ctx = get_context();
          AsioStream ssl(ctx, ioc, test_data());
 
-         ssl.handshake(Botan::TLS::CLIENT);
+         ssl.handshake(Botan::TLS::Connection_Side::Client);
 
          Test::Result result("sync TLS handshake");
          result.test_eq("feeds data into channel until active", ssl.native_handle()->is_active(), true);
@@ -188,7 +188,7 @@ class Asio_Stream_Tests final : public Test
          ssl.native_handle()->send(TEST_DATA, TEST_DATA_SIZE);
 
          error_code ec;
-         ssl.handshake(Botan::TLS::CLIENT, ec);
+         ssl.handshake(Botan::TLS::Connection_Side::Client, ec);
 
          Test::Result result("sync TLS handshake error");
          result.test_eq("does not activate channel", ssl.native_handle()->is_active(), false);
@@ -206,7 +206,7 @@ class Asio_Stream_Tests final : public Test
          ssl.next_layer().connect(remote);
 
          error_code ec;
-         ssl.handshake(Botan::TLS::CLIENT, ec);
+         ssl.handshake(Botan::TLS::Connection_Side::Client, ec);
 
          Test::Result result("sync TLS handshake error");
          result.test_eq("does not activate channel", ssl.native_handle()->is_active(), false);
@@ -235,7 +235,7 @@ class Asio_Stream_Tests final : public Test
             result.test_eq("feeds data into channel until active", ssl.native_handle()->is_active(), true);
             };
 
-         ssl.async_handshake(Botan::TLS::CLIENT, handler);
+         ssl.async_handshake(Botan::TLS::Connection_Side::Client, handler);
 
          ssl.next_layer().close_remote();
          ioc.run();
@@ -264,7 +264,7 @@ class Asio_Stream_Tests final : public Test
             result.confirm("propagates error code", ec == net::error::no_recovery);
             };
 
-         ssl.async_handshake(Botan::TLS::CLIENT, handler);
+         ssl.async_handshake(Botan::TLS::Connection_Side::Client, handler);
 
          ioc.run();
          results.push_back(result);
@@ -287,7 +287,7 @@ class Asio_Stream_Tests final : public Test
             result.confirm("propagates error code", ec == ThrowingMockChannel::expected_ec());
             };
 
-         ssl.async_handshake(Botan::TLS::CLIENT, handler);
+         ssl.async_handshake(Botan::TLS::Connection_Side::Client, handler);
 
          ioc.run();
          results.push_back(result);
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index 401a3fd4b..4e0a7f356 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -299,7 +299,7 @@ class TLS_Handshake_Test final
                const uint8_t server_extn[6] = { 's', 'e', 'r', 'v', 'e', 'r' };
 
                Botan::TLS::append_tls_length_value(m_buf,
-                                                   (side == Botan::TLS::CLIENT) ? client_extn : server_extn,
+                                                   (side == Botan::TLS::Connection_Side::Client) ? client_extn : server_extn,
                                                    6, 1);
                }
          private:
@@ -368,7 +368,7 @@ class TLS_Handshake_Test final
 
                      if(m_results.test_eq("Expected size for test extn", val.size(), 7))
                         {
-                        if(which_side == Botan::TLS::CLIENT)
+                        if(which_side == Botan::TLS::Connection_Side::Client)
                            m_results.test_eq("Expected extension value", val, "06636C69656E74");
                         else
                            m_results.test_eq("Expected extension value", val, "06736572766572");