#ifdef _WIN32

return (unsigned long) GetCurrentThreadId();

#else /* !_WIN32 */

return (unsigned long) pthread_self();

#endif /* !_WIN32 */

int i, n;

n = CRYPTO_num_locks();

locks = new uv_rwlock_t[n];

for (i = 0; i < n; i++)

if (uv_rwlock_init(locks + i))

abort();

assert((mode & CRYPTO_LOCK) || (mode & CRYPTO_UNLOCK));

assert((mode & CRYPTO_READ) || (mode & CRYPTO_WRITE));

if (mode & CRYPTO_LOCK) {

if (mode & CRYPTO_READ)

uv_rwlock_rdlock(locks + n);

else

uv_rwlock_wrlock(locks + n);

} else {

if (mode & CRYPTO_READ)

uv_rwlock_rdunlock(locks + n);

else

uv_rwlock_wrunlock(locks + n);

}

HandleScope scope;

Local<FunctionTemplate> t = FunctionTemplate::New(SecureContext::New);

secure_context_constructor = Persistent<FunctionTemplate>::New(t);

t->InstanceTemplate()->SetInternalFieldCount(1);

t->SetClassName(String::NewSymbol("SecureContext"));

NODE_SET_PROTOTYPE_METHOD(t, "init", SecureContext::Init);

NODE_SET_PROTOTYPE_METHOD(t, "setKey", SecureContext::SetKey);

NODE_SET_PROTOTYPE_METHOD(t, "setCert", SecureContext::SetCert);

NODE_SET_PROTOTYPE_METHOD(t, "addCACert", SecureContext::AddCACert);

NODE_SET_PROTOTYPE_METHOD(t, "addCRL", SecureContext::AddCRL);

NODE_SET_PROTOTYPE_METHOD(t, "addRootCerts", SecureContext::AddRootCerts);

NODE_SET_PROTOTYPE_METHOD(t, "setCiphers", SecureContext::SetCiphers);

NODE_SET_PROTOTYPE_METHOD(t, "setOptions", SecureContext::SetOptions);

NODE_SET_PROTOTYPE_METHOD(t, "setSessionIdContext",

SecureContext::SetSessionIdContext);

NODE_SET_PROTOTYPE_METHOD(t, "close", SecureContext::Close);

NODE_SET_PROTOTYPE_METHOD(t, "loadPKCS12", SecureContext::LoadPKCS12);

target->Set(String::NewSymbol("SecureContext"), t->GetFunction());

HandleScope scope;

SecureContext *p = new SecureContext();

p->Wrap(args.Holder());

return args.This();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

OPENSSL_CONST SSL_METHOD *method = SSLv23_method();

if (args.Length() == 1 && args[0]->IsString()) {

String::Utf8Value sslmethod(args[0]);

if (strcmp(*sslmethod, "SSLv2_method") == 0) {

#ifndef OPENSSL_NO_SSL2

method = SSLv2_method();

#else

return ThrowException(Exception::Error(String::New("SSLv2 methods disabled")));

#endif

} else if (strcmp(*sslmethod, "SSLv2_server_method") == 0) {

#ifndef OPENSSL_NO_SSL2

method = SSLv2_server_method();

#else

return ThrowException(Exception::Error(String::New("SSLv2 methods disabled")));

#endif

} else if (strcmp(*sslmethod, "SSLv2_client_method") == 0) {

#ifndef OPENSSL_NO_SSL2

method = SSLv2_client_method();

#else

return ThrowException(Exception::Error(String::New("SSLv2 methods disabled")));

#endif

} else if (strcmp(*sslmethod, "SSLv3_method") == 0) {

method = SSLv3_method();

} else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {

method = SSLv3_server_method();

} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {

method = SSLv3_client_method();

} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {

method = SSLv23_method();

} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {

method = SSLv23_server_method();

} else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {

method = SSLv23_client_method();

} else if (strcmp(*sslmethod, "TLSv1_method") == 0) {

method = TLSv1_method();

} else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {

method = TLSv1_server_method();

} else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {

method = TLSv1_client_method();

} else {

return ThrowException(Exception::Error(String::New("Unknown method")));

}

}

sc->ctx_ = SSL_CTX_new(method);

// Enable session caching?

SSL_CTX_set_session_cache_mode(sc->ctx_, SSL_SESS_CACHE_SERVER);

// SSL_CTX_set_session_cache_mode(sc->ctx_,SSL_SESS_CACHE_OFF);

sc->ca_store_ = NULL;

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

unsigned int len = args.Length();

if (len != 1 && len != 2) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

if (len == 2 && !args[1]->IsString()) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

BIO *bio = LoadBIO(args[0]);

if (!bio) return False();

String::Utf8Value passphrase(args[1]);

EVP_PKEY* key = PEM_read_bio_PrivateKey(bio, NULL, NULL,

len == 1 ? NULL : *passphrase);

if (!key) {

BIO_free(bio);

unsigned long err = ERR_get_error();

if (!err) {

return ThrowException(Exception::Error(

String::New("PEM_read_bio_PrivateKey")));

}

char string[120];

ERR_error_string_n(err, string, sizeof string);

return ThrowException(Exception::Error(String::New(string)));

}

SSL_CTX_use_PrivateKey(sc->ctx_, key);

EVP_PKEY_free(key);

BIO_free(bio);

return True();

int ret = 0;

X509 *x = NULL;

x = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);

if (x == NULL) {

SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);

goto end;

}

ret = SSL_CTX_use_certificate(ctx, x);

if (ERR_peek_error() != 0) {

// Key/certificate mismatch doesn't imply ret==0 ...

ret = 0;

}

if (ret) {

// If we could set up our certificate, now proceed to

// the CA certificates.

X509 *ca;

int r;

unsigned long err;

if (ctx->extra_certs != NULL) {

sk_X509_pop_free(ctx->extra_certs, X509_free);

ctx->extra_certs = NULL;

}

while ((ca = PEM_read_bio_X509(in, NULL, NULL, NULL))) {

r = SSL_CTX_add_extra_chain_cert(ctx, ca);

if (!r) {

X509_free(ca);

ret = 0;

goto end;

}

// Note that we must not free r if it was successfully

// added to the chain (while we must free the main

// certificate, since its reference count is increased

// by SSL_CTX_use_certificate).

}

// When the while loop ends, it's usually just EOF.

err = ERR_peek_last_error();

if (ERR_GET_LIB(err) == ERR_LIB_PEM &&

ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {

ERR_clear_error();

} else {

// some real error

ret = 0;

}

}

end:

if (x != NULL) X509_free(x);

return ret;

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(

String::New("Bad parameter")));

}

BIO* bio = LoadBIO(args[0]);

if (!bio) return False();

int rv = SSL_CTX_use_certificate_chain(sc->ctx_, bio);

BIO_free(bio);

if (!rv) {

unsigned long err = ERR_get_error();

if (!err) {

return ThrowException(Exception::Error(

String::New("SSL_CTX_use_certificate_chain")));

}

char string[120];

ERR_error_string_n(err, string, sizeof string);

return ThrowException(Exception::Error(String::New(string)));

}

return True();

bool newCAStore = false;

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

if (!sc->ca_store_) {

sc->ca_store_ = X509_STORE_new();

newCAStore = true;

}

X509* x509 = LoadX509(args[0]);

if (!x509) return False();

X509_STORE_add_cert(sc->ca_store_, x509);

SSL_CTX_add_client_CA(sc->ctx_, x509);

X509_free(x509);

if (newCAStore) {

SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_);

}

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

BIO *bio = LoadBIO(args[0]);

if (!bio) return False();

X509_CRL *x509 = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL);

if (x509 == NULL) {

BIO_free(bio);

return False();

}

X509_STORE_add_crl(sc->ca_store_, x509);

X509_STORE_set_flags(sc->ca_store_, X509_V_FLAG_CRL_CHECK |

X509_V_FLAG_CRL_CHECK_ALL);

BIO_free(bio);

X509_CRL_free(x509);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

assert(sc->ca_store_ == NULL);

if (!root_cert_store) {

root_cert_store = X509_STORE_new();

for (int i = 0; root_certs[i]; i++) {

BIO *bp = BIO_new(BIO_s_mem());

if (!BIO_write(bp, root_certs[i], strlen(root_certs[i]))) {

BIO_free(bp);

return False();

}

X509 *x509 = PEM_read_bio_X509(bp, NULL, NULL, NULL);

if (x509 == NULL) {

BIO_free(bp);

return False();

}

X509_STORE_add_cert(root_cert_store, x509);

BIO_free(bp);

X509_free(x509);

}

}

sc->ca_store_ = root_cert_store;

SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1 || !args[0]->IsString()) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

String::Utf8Value ciphers(args[0]);

SSL_CTX_set_cipher_list(sc->ctx_, *ciphers);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1 || !args[0]->IsUint32()) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

unsigned int opts = args[0]->Uint32Value();

SSL_CTX_set_options(sc->ctx_, opts);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1 || !args[0]->IsString()) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

String::Utf8Value sessionIdContext(args[0]);

const unsigned char* sid_ctx = (const unsigned char*) *sessionIdContext;

unsigned int sid_ctx_len = sessionIdContext.length();

int r = SSL_CTX_set_session_id_context(sc->ctx_, sid_ctx, sid_ctx_len);

if (r != 1) {

Local<String> message;

BIO* bio;

BUF_MEM* mem;

if ((bio = BIO_new(BIO_s_mem()))) {

ERR_print_errors(bio);

BIO_get_mem_ptr(bio, &mem);

message = String::New(mem->data, mem->length);

BIO_free(bio);

} else {

message = String::New("SSL_CTX_set_session_id_context error");

}

return ThrowException(Exception::TypeError(message));

}

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

sc->FreeCTXMem();

return False();

HandleScope scope;

BIO* in = NULL;

PKCS12* p12 = NULL;

EVP_PKEY* pkey = NULL;

X509* cert = NULL;

STACK_OF(X509)* extraCerts = NULL;

char* pass = NULL;

bool ret = false;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() < 1) {

return ThrowException(Exception::TypeError(

String::New("Bad parameter")));

}

in = LoadBIO(args[0]);

if (in == NULL) {

return ThrowException(Exception::Error(

String::New("Unable to load BIO")));

}

if (args.Length() >= 2) {

ASSERT_IS_STRING_OR_BUFFER(args[1]);

int passlen = DecodeBytes(args[1], BINARY);

if (passlen < 0) {

BIO_free(in);

return ThrowException(Exception::TypeError(

String::New("Bad password")));

}

pass = new char[passlen + 1];

int pass_written = DecodeWrite(pass, passlen, args[1], BINARY);

assert(pass_written == passlen);

pass[passlen] = '\0';

}

if (d2i_PKCS12_bio(in, &p12) &&

PKCS12_parse(p12, pass, &pkey, &cert, &extraCerts) &&

SSL_CTX_use_certificate(sc->ctx_, cert) &&

SSL_CTX_use_PrivateKey(sc->ctx_, pkey))

{

// set extra certs

while (X509* x509 = sk_X509_pop(extraCerts)) {

if (!sc->ca_store_) {

sc->ca_store_ = X509_STORE_new();

SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_);

}

X509_STORE_add_cert(sc->ca_store_, x509);

SSL_CTX_add_client_CA(sc->ctx_, x509);

}

EVP_PKEY_free(pkey);

X509_free(cert);

sk_X509_free(extraCerts);

ret = true;

}

PKCS12_free(p12);

BIO_free(in);

delete[] pass;

if (!ret) {

unsigned long err = ERR_get_error();

const char *str = ERR_reason_error_string(err);

return ThrowException(Exception::Error(String::New(str)));

}

return True();

if (rv >= 0) return rv;

int retry = BIO_should_retry(bio);

(void) retry; // unused if !defined(SSL_PRINT_DEBUG)

if (BIO_should_write(bio)) {

DEBUG_PRINT("[%p] BIO: %s want write. should retry %d\n", ssl_, func, retry);

return 0;

} else if (BIO_should_read(bio)) {

DEBUG_PRINT("[%p] BIO: %s want read. should retry %d\n", ssl_, func, retry);

return 0;

} else {

static char ssl_error_buf[512];

ERR_error_string_n(rv, ssl_error_buf, sizeof(ssl_error_buf));

HandleScope scope;

Local<Value> e = Exception::Error(String::New(ssl_error_buf));

handle_->Set(String::New("error"), e);

DEBUG_PRINT("[%p] BIO: %s failed: (%d) %s\n", ssl_, func, rv, ssl_error_buf);

return rv;

}

return 0;

if (rv >= 0) return rv;

int err = SSL_get_error(ssl_, rv);

if (err == SSL_ERROR_NONE) {

return 0;

} else if (err == SSL_ERROR_WANT_WRITE) {

DEBUG_PRINT("[%p] SSL: %s want write\n", ssl_, func);

return 0;

} else if (err == SSL_ERROR_WANT_READ) {

DEBUG_PRINT("[%p] SSL: %s want read\n", ssl_, func);

return 0;

} else {

HandleScope scope;

BUF_MEM* mem;

BIO *bio;

assert(err == SSL_ERROR_SSL || err == SSL_ERROR_SYSCALL);

// XXX We need to drain the error queue for this thread or else OpenSSL

// has the possibility of blocking connections? This problem is not well

// understood. And we should be somehow propagating these errors up

// into JavaScript. There is no test which demonstrates this problem.

// https://github.com/joyent/node/issues/1719

if ((bio = BIO_new(BIO_s_mem()))) {

ERR_print_errors(bio);

BIO_get_mem_ptr(bio, &mem);

Local<Value> e = Exception::Error(String::New(mem->data, mem->length));

handle_->Set(String::New("error"), e);

BIO_free(bio);

}

return rv;

}

return 0;

#ifndef NDEBUG

HandleScope scope;

// We should clear the error in JS-land

assert(handle_->Get(String::New("error"))->BooleanValue() == false);

#endif // NDEBUG

HandleScope scope;

int flags = SSL_get_shutdown(ssl_);

if (flags & SSL_SENT_SHUTDOWN) {

handle_->Set(String::New("sentShutdown"), True());

}

if (flags & SSL_RECEIVED_SHUTDOWN) {

handle_->Set(String::New("receivedShutdown"), True());

}

HandleScope scope;

Local<FunctionTemplate> t = FunctionTemplate::New(Connection::New);

t->InstanceTemplate()->SetInternalFieldCount(1);

t->SetClassName(String::NewSymbol("Connection"));

NODE_SET_PROTOTYPE_METHOD(t, "encIn", Connection::EncIn);

NODE_SET_PROTOTYPE_METHOD(t, "clearOut", Connection::ClearOut);

NODE_SET_PROTOTYPE_METHOD(t, "clearIn", Connection::ClearIn);

NODE_SET_PROTOTYPE_METHOD(t, "encOut", Connection::EncOut);

NODE_SET_PROTOTYPE_METHOD(t, "clearPending", Connection::ClearPending);

NODE_SET_PROTOTYPE_METHOD(t, "encPending", Connection::EncPending);

NODE_SET_PROTOTYPE_METHOD(t, "getPeerCertificate", Connection::GetPeerCertificate);

NODE_SET_PROTOTYPE_METHOD(t, "getSession", Connection::GetSession);

NODE_SET_PROTOTYPE_METHOD(t, "setSession", Connection::SetSession);

NODE_SET_PROTOTYPE_METHOD(t, "isSessionReused", Connection::IsSessionReused);

NODE_SET_PROTOTYPE_METHOD(t, "isInitFinished", Connection::IsInitFinished);

NODE_SET_PROTOTYPE_METHOD(t, "verifyError", Connection::VerifyError);

NODE_SET_PROTOTYPE_METHOD(t, "getCurrentCipher", Connection::GetCurrentCipher);

NODE_SET_PROTOTYPE_METHOD(t, "start", Connection::Start);

NODE_SET_PROTOTYPE_METHOD(t, "shutdown", Connection::Shutdown);

NODE_SET_PROTOTYPE_METHOD(t, "receivedShutdown", Connection::ReceivedShutdown);

NODE_SET_PROTOTYPE_METHOD(t, "close", Connection::Close);

#ifdef OPENSSL_NPN_NEGOTIATED

NODE_SET_PROTOTYPE_METHOD(t, "getNegotiatedProtocol", Connection::GetNegotiatedProto);

NODE_SET_PROTOTYPE_METHOD(t, "setNPNProtocols", Connection::SetNPNProtocols);

#endif

#ifdef SSL_CTRL_SET_TLSEXT_SERVERNAME_CB

NODE_SET_PROTOTYPE_METHOD(t, "getServername", Connection::GetServername);

NODE_SET_PROTOTYPE_METHOD(t, "setSNICallback", Connection::SetSNICallback);

#endif

target->Set(String::NewSymbol("Connection"), t->GetFunction());

// Quoting SSL_set_verify(3ssl):

//

// The VerifyCallback function is used to control the behaviour when

// the SSL_VERIFY_PEER flag is set. It must be supplied by the

// application and receives two arguments: preverify_ok indicates,

// whether the verification of the certificate in question was passed

// (preverify_ok=1) or not (preverify_ok=0). x509_ctx is a pointer to

// the complete context used for the certificate chain verification.

//

// The certificate chain is checked starting with the deepest nesting

// level (the root CA certificate) and worked upward to the peer's

// certificate. At each level signatures and issuer attributes are

// checked. Whenever a verification error is found, the error number is

// stored in x509_ctx and VerifyCallback is called with preverify_ok=0.

// By applying X509_CTX_store_* functions VerifyCallback can locate the

// certificate in question and perform additional steps (see EXAMPLES).

// If no error is found for a certificate, VerifyCallback is called

// with preverify_ok=1 before advancing to the next level.

//

// The return value of VerifyCallback controls the strategy of the

// further verification process. If VerifyCallback returns 0, the

// verification process is immediately stopped with "verification

// failed" state. If SSL_VERIFY_PEER is set, a verification failure

// alert is sent to the peer and the TLS/SSL handshake is terminated. If

// VerifyCallback returns 1, the verification process is continued. If

// VerifyCallback always returns 1, the TLS/SSL handshake will not be

// terminated with respect to verification failures and the connection

// will be established. The calling process can however retrieve the

// error code of the last verification error using

// SSL_get_verify_result(3) or by maintaining its own error storage

// managed by VerifyCallback.

//

// If no VerifyCallback is specified, the default callback will be

// used. Its return value is identical to preverify_ok, so that any

// verification failure will lead to a termination of the TLS/SSL

// handshake with an alert message, if SSL_VERIFY_PEER is set.

//

// Since we cannot perform I/O quickly enough in this callback, we ignore

// all preverify_ok errors and let the handshake continue. It is

// imparative that the user use Connection::VerifyError after the

// 'secure' callback has been made.

return 1;

const unsigned char **data,

unsigned int *len,

void *arg) {

Connection *p = static_cast<Connection*>(SSL_get_app_data(s));

if (p->npnProtos_.IsEmpty()) {

// No initialization - no NPN protocols

*data = reinterpret_cast<const unsigned char*>("");

*len = 0;

} else {

*data = reinterpret_cast<const unsigned char*>(Buffer::Data(p->npnProtos_));

*len = Buffer::Length(p->npnProtos_);

}

return SSL_TLSEXT_ERR_OK;

unsigned char **out, unsigned char *outlen,

const unsigned char* in,

unsigned int inlen, void *arg) {

Connection *p = static_cast<Connection*> SSL_get_app_data(s);

// Release old protocol handler if present

if (!p->selectedNPNProto_.IsEmpty()) {

p->selectedNPNProto_.Dispose();

}

if (p->npnProtos_.IsEmpty()) {

// We should at least select one protocol

// If server is using NPN

*out = reinterpret_cast<unsigned char*>(const_cast<char*>("http/1.1"));

*outlen = 8;

// set status unsupported

p->selectedNPNProto_ = Persistent<Value>::New(False());

return SSL_TLSEXT_ERR_OK;

}

const unsigned char* npnProtos =

reinterpret_cast<const unsigned char*>(Buffer::Data(p->npnProtos_));

int status = SSL_select_next_proto(out, outlen, in, inlen, npnProtos,

Buffer::Length(p->npnProtos_));

switch (status) {

case OPENSSL_NPN_UNSUPPORTED:

p->selectedNPNProto_ = Persistent<Value>::New(Null());

break;

case OPENSSL_NPN_NEGOTIATED:

p->selectedNPNProto_ = Persistent<Value>::New(String::New(

reinterpret_cast<const char*>(*out), *outlen

));

break;

case OPENSSL_NPN_NO_OVERLAP:

p->selectedNPNProto_ = Persistent<Value>::New(False());

break;

default:

break;

}

return SSL_TLSEXT_ERR_OK;

HandleScope scope;

Connection *p = static_cast<Connection*> SSL_get_app_data(s);

const char* servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);

if (servername) {

if (!p->servername_.IsEmpty()) {

p->servername_.Dispose();

}

p->servername_ = Persistent<String>::New(String::New(servername));

// Call sniCallback_ and use it's return value as context

if (!p->sniCallback_.IsEmpty()) {

if (!p->sniContext_.IsEmpty()) {

p->sniContext_.Dispose();

}

// Get callback init args

Local<Value> argv[1] = {*p->servername_};

Local<Function> callback = *p->sniCallback_;

// Call it

//

// XXX There should be an object connected to this that

// we can attach a domain onto.

Local<Value> ret;

ret = Local<Value>::New(MakeCallback(Context::GetCurrent()->Global(),

callback, ARRAY_SIZE(argv), argv));

// If ret is SecureContext

if (secure_context_constructor->HasInstance(ret)) {

p->sniContext_ = Persistent<Value>::New(ret);

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(

Local<Object>::Cast(ret));

SSL_set_SSL_CTX(s, sc->ctx_);

} else {

return SSL_TLSEXT_ERR_NOACK;

}

}

}

return SSL_TLSEXT_ERR_OK;

HandleScope scope;

Connection *p = new Connection();

p->Wrap(args.Holder());

if (args.Length() < 1 || !args[0]->IsObject()) {

return ThrowException(Exception::Error(String::New(

"First argument must be a crypto module Credentials")));

}

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args[0]->ToObject());

bool is_server = args[1]->BooleanValue();

p->ssl_ = SSL_new(sc->ctx_);

p->bio_read_ = BIO_new(BIO_s_mem());

p->bio_write_ = BIO_new(BIO_s_mem());

SSL_set_app_data(p->ssl_, p);

if (is_server) SSL_set_info_callback(p->ssl_, SSLInfoCallback);

#ifdef OPENSSL_NPN_NEGOTIATED

if (is_server) {

// Server should advertise NPN protocols