HandleScope scope;

Local<FunctionTemplate> t = FunctionTemplate::New(SecureContext::New);

t->InstanceTemplate()->SetInternalFieldCount(1);

t->SetClassName(String::NewSymbol("SecureContext"));

NODE_SET_PROTOTYPE_METHOD(t, "init", SecureContext::Init);

NODE_SET_PROTOTYPE_METHOD(t, "setKey", SecureContext::SetKey);

NODE_SET_PROTOTYPE_METHOD(t, "setCert", SecureContext::SetCert);

NODE_SET_PROTOTYPE_METHOD(t, "addCACert", SecureContext::AddCACert);

NODE_SET_PROTOTYPE_METHOD(t, "addCRL", SecureContext::AddCRL);

NODE_SET_PROTOTYPE_METHOD(t, "addRootCerts", SecureContext::AddRootCerts);

NODE_SET_PROTOTYPE_METHOD(t, "setCiphers", SecureContext::SetCiphers);

NODE_SET_PROTOTYPE_METHOD(t, "close", SecureContext::Close);

target->Set(String::NewSymbol("SecureContext"), t->GetFunction());

HandleScope scope;

SecureContext *p = new SecureContext();

p->Wrap(args.Holder());

return args.This();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

OPENSSL_CONST SSL_METHOD *method = SSLv23_method();

if (args.Length() == 1 && args[0]->IsString()) {

String::Utf8Value sslmethod(args[0]->ToString());

if (strcmp(*sslmethod, "SSLv2_method") == 0) {

method = SSLv2_method();

} else if (strcmp(*sslmethod, "SSLv2_server_method") == 0) {

method = SSLv2_server_method();

} else if (strcmp(*sslmethod, "SSLv2_client_method") == 0) {

method = SSLv2_client_method();

} else if (strcmp(*sslmethod, "SSLv3_method") == 0) {

method = SSLv3_method();

} else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {

method = SSLv3_server_method();

} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {

method = SSLv3_client_method();

} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {

method = SSLv23_method();

} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {

method = SSLv23_server_method();

} else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {

method = SSLv23_client_method();

} else if (strcmp(*sslmethod, "TLSv1_method") == 0) {

method = TLSv1_method();

} else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {

method = TLSv1_server_method();

} else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {

method = TLSv1_client_method();

} else {

return ThrowException(Exception::Error(String::New("Unknown method")));

}

}

sc->ctx_ = SSL_CTX_new(method);

// Enable session caching?

SSL_CTX_set_session_cache_mode(sc->ctx_, SSL_SESS_CACHE_SERVER);

// SSL_CTX_set_session_cache_mode(sc->ctx_,SSL_SESS_CACHE_OFF);

sc->ca_store_ = X509_STORE_new();

SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

BIO *bio = LoadBIO(args[0]);

if (!bio) return False();

EVP_PKEY* key = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);

if (!key) {

BIO_free(bio);

return False();

}

SSL_CTX_use_PrivateKey(sc->ctx_, key);

EVP_PKEY_free(key);

BIO_free(bio);

return True();

int ret = 0;

X509 *x = NULL;

x = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);

if (x == NULL) {

SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);

goto end;

}

ret = SSL_CTX_use_certificate(ctx, x);

if (ERR_peek_error() != 0) {

// Key/certificate mismatch doesn't imply ret==0 ...

ret = 0;

}

if (ret) {

// If we could set up our certificate, now proceed to

// the CA certificates.

X509 *ca;

int r;

unsigned long err;

if (ctx->extra_certs != NULL) {

sk_X509_pop_free(ctx->extra_certs, X509_free);

ctx->extra_certs = NULL;

}

while ((ca = PEM_read_bio_X509(in, NULL, NULL, NULL))) {

r = SSL_CTX_add_extra_chain_cert(ctx, ca);

if (!r) {

X509_free(ca);

ret = 0;

goto end;

}

// Note that we must not free r if it was successfully

// added to the chain (while we must free the main

// certificate, since its reference count is increased

// by SSL_CTX_use_certificate).

}

// When the while loop ends, it's usually just EOF.

err = ERR_peek_last_error();

if (ERR_GET_LIB(err) == ERR_LIB_PEM &&

ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {

ERR_clear_error();

} else {

// some real error

ret = 0;

}

}

end:

if (x != NULL) X509_free(x);

return ret;

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(

String::New("Bad parameter")));

}

BIO* bio = LoadBIO(args[0]);

if (!bio) return False();

int rv = SSL_CTX_use_certificate_chain(sc->ctx_, bio);

BIO_free(bio);

if (!rv) {

unsigned long err = ERR_get_error();

if (!err) {

return ThrowException(Exception::Error(

String::New("SSL_CTX_use_certificate_chain")));

}

char string[120];

ERR_error_string(err, string);

return ThrowException(Exception::Error(String::New(string)));

}

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

X509* x509 = LoadX509(args[0]);

if (!x509) return False();

X509_STORE_add_cert(sc->ca_store_, x509);

X509_free(x509);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

BIO *bio = LoadBIO(args[0]);

if (!bio) return False();

X509_CRL *x509 = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL);

if (x509 == NULL) {

BIO_free(bio);

return False();

}

X509_STORE_add_crl(sc->ca_store_, x509);

X509_STORE_set_flags(sc->ca_store_, X509_V_FLAG_CRL_CHECK |

X509_V_FLAG_CRL_CHECK_ALL);

BIO_free(bio);

X509_CRL_free(x509);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

for (int i = 0; root_certs[i]; i++) {

// TODO: reuse bp ?

BIO *bp = BIO_new(BIO_s_mem());

if (!BIO_write(bp, root_certs[i], strlen(root_certs[i]))) {

BIO_free(bp);

return False();

}

X509 *x509 = PEM_read_bio_X509(bp, NULL, NULL, NULL);

if (x509 == NULL) {

BIO_free(bp);

return False();

}

X509_STORE_add_cert(sc->ca_store_, x509);

BIO_free(bp);

X509_free(x509);

}

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (args.Length() != 1 || !args[0]->IsString()) {

return ThrowException(Exception::TypeError(String::New("Bad parameter")));

}

String::Utf8Value ciphers(args[0]->ToString());

SSL_CTX_set_cipher_list(sc->ctx_, *ciphers);

return True();

HandleScope scope;

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args.Holder());

if (sc->ctx_ != NULL) {

SSL_CTX_free(sc->ctx_);

sc->ctx_ = NULL;

sc->ca_store_ = NULL;

return True();

}

return False();

if (rv >= 0) return rv;

int retry = BIO_should_retry(bio);

if (BIO_should_write(bio)) {

DEBUG_PRINT("[%p] BIO: %s want write. should retry %d\n", ssl_, func, retry);

return 0;

} else if (BIO_should_read(bio)) {

DEBUG_PRINT("[%p] BIO: %s want read. should retry %d\n", ssl_, func, retry);

return 0;

} else {

static char ssl_error_buf[512];

ERR_error_string_n(rv, ssl_error_buf, sizeof(ssl_error_buf));

HandleScope scope;

Local<Value> e = Exception::Error(String::New(ssl_error_buf));

handle_->Set(String::New("error"), e);

DEBUG_PRINT("[%p] BIO: %s failed: (%d) %s\n", ssl_, func, rv, ssl_error_buf);

return rv;

}

return 0;

if (rv >= 0) return rv;

int err = SSL_get_error(ssl_, rv);

if (err == SSL_ERROR_WANT_WRITE) {

DEBUG_PRINT("[%p] SSL: %s want write\n", ssl_, func);

return 0;

} else if (err == SSL_ERROR_WANT_READ) {

DEBUG_PRINT("[%p] SSL: %s want read\n", ssl_, func);

return 0;

} else {

static char ssl_error_buf[512];

ERR_error_string_n(err, ssl_error_buf, sizeof(ssl_error_buf));

HandleScope scope;

Local<Value> e = Exception::Error(String::New(ssl_error_buf));

handle_->Set(String::New("error"), e);

DEBUG_PRINT("[%p] SSL: %s failed: (%d:%d) %s\n", ssl_, func, err, rv, ssl_error_buf);

return rv;

}

return 0;

#ifndef NDEBUG

HandleScope scope;

// We should clear the error in JS-land

assert(handle_->Get(String::New("error"))->BooleanValue() == false);

#endif // NDEBUG

HandleScope scope;

int flags = SSL_get_shutdown(ssl_);

if (flags & SSL_SENT_SHUTDOWN) {

handle_->Set(String::New("sentShutdown"), True());

}

if (flags & SSL_RECEIVED_SHUTDOWN) {

handle_->Set(String::New("receivedShutdown"), True());

}

HandleScope scope;

Local<FunctionTemplate> t = FunctionTemplate::New(Connection::New);

t->InstanceTemplate()->SetInternalFieldCount(1);

t->SetClassName(String::NewSymbol("Connection"));

NODE_SET_PROTOTYPE_METHOD(t, "encIn", Connection::EncIn);

NODE_SET_PROTOTYPE_METHOD(t, "clearOut", Connection::ClearOut);

NODE_SET_PROTOTYPE_METHOD(t, "clearIn", Connection::ClearIn);

NODE_SET_PROTOTYPE_METHOD(t, "encOut", Connection::EncOut);

NODE_SET_PROTOTYPE_METHOD(t, "clearPending", Connection::ClearPending);

NODE_SET_PROTOTYPE_METHOD(t, "encPending", Connection::EncPending);

NODE_SET_PROTOTYPE_METHOD(t, "getPeerCertificate", Connection::GetPeerCertificate);

NODE_SET_PROTOTYPE_METHOD(t, "isInitFinished", Connection::IsInitFinished);

NODE_SET_PROTOTYPE_METHOD(t, "verifyError", Connection::VerifyError);

NODE_SET_PROTOTYPE_METHOD(t, "getCurrentCipher", Connection::GetCurrentCipher);

NODE_SET_PROTOTYPE_METHOD(t, "start", Connection::Start);

NODE_SET_PROTOTYPE_METHOD(t, "shutdown", Connection::Shutdown);

NODE_SET_PROTOTYPE_METHOD(t, "receivedShutdown", Connection::ReceivedShutdown);

NODE_SET_PROTOTYPE_METHOD(t, "close", Connection::Close);

target->Set(String::NewSymbol("Connection"), t->GetFunction());

// Quoting SSL_set_verify(3ssl):

//

// The VerifyCallback function is used to control the behaviour when

// the SSL_VERIFY_PEER flag is set. It must be supplied by the

// application and receives two arguments: preverify_ok indicates,

// whether the verification of the certificate in question was passed

// (preverify_ok=1) or not (preverify_ok=0). x509_ctx is a pointer to

// the complete context used for the certificate chain verification.

//

// The certificate chain is checked starting with the deepest nesting

// level (the root CA certificate) and worked upward to the peer's

// certificate. At each level signatures and issuer attributes are

// checked. Whenever a verification error is found, the error number is

// stored in x509_ctx and VerifyCallback is called with preverify_ok=0.

// By applying X509_CTX_store_* functions VerifyCallback can locate the

// certificate in question and perform additional steps (see EXAMPLES).

// If no error is found for a certificate, VerifyCallback is called

// with preverify_ok=1 before advancing to the next level.

//

// The return value of VerifyCallback controls the strategy of the

// further verification process. If VerifyCallback returns 0, the

// verification process is immediately stopped with "verification

// failed" state. If SSL_VERIFY_PEER is set, a verification failure

// alert is sent to the peer and the TLS/SSL handshake is terminated. If

// VerifyCallback returns 1, the verification process is continued. If

// VerifyCallback always returns 1, the TLS/SSL handshake will not be

// terminated with respect to verification failures and the connection

// will be established. The calling process can however retrieve the

// error code of the last verification error using

// SSL_get_verify_result(3) or by maintaining its own error storage

// managed by VerifyCallback.

//

// If no VerifyCallback is specified, the default callback will be

// used. Its return value is identical to preverify_ok, so that any

// verification failure will lead to a termination of the TLS/SSL

// handshake with an alert message, if SSL_VERIFY_PEER is set.

//

// Since we cannot perform I/O quickly enough in this callback, we ignore

// all preverify_ok errors and let the handshake continue. It is

// imparative that the user use Connection::VerifyError after the

// 'secure' callback has been made.

return 1;

HandleScope scope;

Connection *p = new Connection();

p->Wrap(args.Holder());

if (args.Length() < 1 || !args[0]->IsObject()) {

return ThrowException(Exception::Error(String::New(

"First argument must be a crypto module Credentials")));

}

SecureContext *sc = ObjectWrap::Unwrap<SecureContext>(args[0]->ToObject());

bool is_server = args[1]->BooleanValue();

p->ssl_ = SSL_new(sc->ctx_);

p->bio_read_ = BIO_new(BIO_s_mem());

p->bio_write_ = BIO_new(BIO_s_mem());

SSL_set_bio(p->ssl_, p->bio_read_, p->bio_write_);

#ifdef SSL_MODE_RELEASE_BUFFERS

long mode = SSL_get_mode(p->ssl_);

SSL_set_mode(p->ssl_, mode | SSL_MODE_RELEASE_BUFFERS);

#endif

int verify_mode;

if (is_server) {

bool request_cert = args[2]->BooleanValue();

if (!request_cert) {

// Note reject_unauthorized ignored.

verify_mode = SSL_VERIFY_NONE;

} else {

bool reject_unauthorized = args[3]->BooleanValue();

verify_mode = SSL_VERIFY_PEER;

if (reject_unauthorized) verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;

}

} else {

// Note request_cert and reject_unauthorized are ignored for clients.

verify_mode = SSL_VERIFY_NONE;

}

// Always allow a connection. We'll reject in javascript.

SSL_set_verify(p->ssl_, verify_mode, VerifyCallback);

if ((p->is_server_ = is_server)) {

SSL_set_accept_state(p->ssl_);

} else {

SSL_set_connect_state(p->ssl_);

}

return args.This();

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (args.Length() < 3) {

return ThrowException(Exception::TypeError(

String::New("Takes 3 parameters")));

}

if (!Buffer::HasInstance(args[0])) {

return ThrowException(Exception::TypeError(

String::New("Second argument should be a buffer")));

}

Local<Object> buffer_obj = args[0]->ToObject();

char *buffer_data = Buffer::Data(buffer_obj);

size_t buffer_length = Buffer::Length(buffer_obj);

size_t off = args[1]->Int32Value();

if (off >= buffer_length) {

return ThrowException(Exception::Error(

String::New("Offset is out of bounds")));

}

size_t len = args[2]->Int32Value();

if (off + len > buffer_length) {

return ThrowException(Exception::Error(

String::New("Length is extends beyond buffer")));

}

int bytes_written = BIO_write(ss->bio_read_, buffer_data + off, len);

ss->HandleBIOError(ss->bio_read_, "BIO_write", bytes_written);

ss->SetShutdownFlags();

return scope.Close(Integer::New(bytes_written));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (args.Length() < 3) {

return ThrowException(Exception::TypeError(

String::New("Takes 3 parameters")));

}

if (!Buffer::HasInstance(args[0])) {

return ThrowException(Exception::TypeError(

String::New("Second argument should be a buffer")));

}

Local<Object> buffer_obj = args[0]->ToObject();

char *buffer_data = Buffer::Data(buffer_obj);

size_t buffer_length = Buffer::Length(buffer_obj);

size_t off = args[1]->Int32Value();

if (off >= buffer_length) {

return ThrowException(Exception::Error(

String::New("Offset is out of bounds")));

}

size_t len = args[2]->Int32Value();

if (off + len > buffer_length) {

return ThrowException(Exception::Error(

String::New("Length is extends beyond buffer")));

}

if (!SSL_is_init_finished(ss->ssl_)) {

int rv;

if (ss->is_server_) {

rv = SSL_accept(ss->ssl_);

ss->HandleSSLError("SSL_accept:ClearOut", rv);

} else {

rv = SSL_connect(ss->ssl_);

ss->HandleSSLError("SSL_connect:ClearOut", rv);

}

if (rv < 0) return scope.Close(Integer::New(rv));

}

int bytes_read = SSL_read(ss->ssl_, buffer_data + off, len);

ss->HandleSSLError("SSL_read:ClearOut", bytes_read);

ss->SetShutdownFlags();

return scope.Close(Integer::New(bytes_read));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

int bytes_pending = BIO_pending(ss->bio_read_);

return scope.Close(Integer::New(bytes_pending));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

int bytes_pending = BIO_pending(ss->bio_write_);

return scope.Close(Integer::New(bytes_pending));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (args.Length() < 3) {

return ThrowException(Exception::TypeError(

String::New("Takes 3 parameters")));

}

if (!Buffer::HasInstance(args[0])) {

return ThrowException(Exception::TypeError(

String::New("Second argument should be a buffer")));

}

Local<Object> buffer_obj = args[0]->ToObject();

char *buffer_data = Buffer::Data(buffer_obj);

size_t buffer_length = Buffer::Length(buffer_obj);

size_t off = args[1]->Int32Value();

if (off >= buffer_length) {

return ThrowException(Exception::Error(

String::New("Offset is out of bounds")));

}

size_t len = args[2]->Int32Value();

if (off + len > buffer_length) {

return ThrowException(Exception::Error(

String::New("Length is extends beyond buffer")));

}

int bytes_read = BIO_read(ss->bio_write_, buffer_data + off, len);

ss->HandleBIOError(ss->bio_write_, "BIO_read:EncOut", bytes_read);

ss->SetShutdownFlags();

return scope.Close(Integer::New(bytes_read));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (args.Length() < 3) {

return ThrowException(Exception::TypeError(

String::New("Takes 3 parameters")));

}

if (!Buffer::HasInstance(args[0])) {

return ThrowException(Exception::TypeError(

String::New("Second argument should be a buffer")));

}

Local<Object> buffer_obj = args[0]->ToObject();

char *buffer_data = Buffer::Data(buffer_obj);

size_t buffer_length = Buffer::Length(buffer_obj);

size_t off = args[1]->Int32Value();

if (off > buffer_length) {

return ThrowException(Exception::Error(

String::New("Offset is out of bounds")));

}

size_t len = args[2]->Int32Value();

if (off + len > buffer_length) {

return ThrowException(Exception::Error(

String::New("Length is extends beyond buffer")));

}

if (!SSL_is_init_finished(ss->ssl_)) {

int rv;

if (ss->is_server_) {

rv = SSL_accept(ss->ssl_);

ss->HandleSSLError("SSL_accept:ClearIn", rv);

} else {

rv = SSL_connect(ss->ssl_);

ss->HandleSSLError("SSL_connect:ClearIn", rv);

}

if (rv < 0) return scope.Close(Integer::New(rv));

}

int bytes_written = SSL_write(ss->ssl_, buffer_data + off, len);

ss->HandleSSLError("SSL_write:ClearIn", bytes_written);

ss->SetShutdownFlags();

return scope.Close(Integer::New(bytes_written));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (ss->ssl_ == NULL) return Undefined();

Local<Object> info = Object::New();

X509* peer_cert = SSL_get_peer_certificate(ss->ssl_);

if (peer_cert != NULL) {

char* subject = X509_NAME_oneline(X509_get_subject_name(peer_cert), 0, 0);

if (subject != NULL) {

info->Set(subject_symbol, String::New(subject));

OPENSSL_free(subject);

}

char* issuer = X509_NAME_oneline(X509_get_issuer_name(peer_cert), 0, 0);

if (subject != NULL) {

info->Set(issuer_symbol, String::New(issuer));

OPENSSL_free(issuer);

}

char buf[256];

BIO* bio = BIO_new(BIO_s_mem());

ASN1_TIME_print(bio, X509_get_notBefore(peer_cert));

memset(buf, 0, sizeof(buf));

BIO_read(bio, buf, sizeof(buf) - 1);

info->Set(valid_from_symbol, String::New(buf));

ASN1_TIME_print(bio, X509_get_notAfter(peer_cert));

memset(buf, 0, sizeof(buf));

BIO_read(bio, buf, sizeof(buf) - 1);

BIO_free(bio);

info->Set(valid_to_symbol, String::New(buf));

unsigned int md_size, i;

unsigned char md[EVP_MAX_MD_SIZE];

if (X509_digest(peer_cert, EVP_sha1(), md, &md_size)) {

const char hex[] = "0123456789ABCDEF";

char fingerprint[EVP_MAX_MD_SIZE * 3];

for (i=0; i<md_size; i++) {

fingerprint[3*i] = hex[(md[i] & 0xf0) >> 4];

fingerprint[(3*i)+1] = hex[(md[i] & 0x0f)];

fingerprint[(3*i)+2] = ':';

}

if (md_size > 0) {

fingerprint[(3*(md_size-1))+2] = '\0';

}

else {

fingerprint[0] = '\0';

}

info->Set(fingerprint_symbol, String::New(fingerprint));

}

STACK_OF(ASN1_OBJECT) *eku = (STACK_OF(ASN1_OBJECT) *)X509_get_ext_d2i(

peer_cert, NID_ext_key_usage, NULL, NULL);

if (eku != NULL) {

Local<Array> ext_key_usage = Array::New();

for (int i = 0; i < sk_ASN1_OBJECT_num(eku); i++) {

memset(buf, 0, sizeof(buf));

OBJ_obj2txt(buf, sizeof(buf) - 1, sk_ASN1_OBJECT_value(eku, i), 1);

ext_key_usage->Set(Integer::New(i), String::New(buf));

}

sk_ASN1_OBJECT_pop_free(eku, ASN1_OBJECT_free);

info->Set(ext_key_usage_symbol, ext_key_usage);

}

X509_free(peer_cert);

}

return scope.Close(info);

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (!SSL_is_init_finished(ss->ssl_)) {

int rv;

if (ss->is_server_) {

rv = SSL_accept(ss->ssl_);

ss->HandleSSLError("SSL_accept:Start", rv);

} else {

rv = SSL_connect(ss->ssl_);

ss->HandleSSLError("SSL_connect:Start", rv);

}

return scope.Close(Integer::New(rv));

}

return scope.Close(Integer::New(0));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (ss->ssl_ == NULL) return False();

int rv = SSL_shutdown(ss->ssl_);

ss->HandleSSLError("SSL_shutdown", rv);

ss->SetShutdownFlags();

return scope.Close(Integer::New(rv));

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (ss->ssl_ == NULL) return False();

int r = SSL_get_shutdown(ss->ssl_);

if (r | SSL_RECEIVED_SHUTDOWN) return True();

return False();

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (ss->ssl_ == NULL) return False();

return SSL_is_init_finished(ss->ssl_) ? True() : False();

HandleScope scope;

Connection *ss = Connection::Unwrap(args);

if (ss->ssl_ == NULL) return Null();

// XXX Do this check in JS land?

X509* peer_cert = SSL_get_peer_certificate(ss->ssl_);

if (peer_cert == NULL) {

// We requested a certificate and they did not send us one.

// Definitely an error.

// XXX is this the right error message?

return scope.Close(String::New("UNABLE_TO_GET_ISSUER_CERT"));

}

X509_free(peer_cert);

long x509_verify_error = SSL_get_verify_result(ss->ssl_);

Local<String> s;

switch (x509_verify_error) {

case X509_V_OK:

return Null();

case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:

s = String::New("UNABLE_TO_GET_ISSUER_CERT");

break;

case X509_V_ERR_UNABLE_TO_GET_CRL:

s = String::New("UNABLE_TO_GET_CRL");

break;

case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:

s = String::New("UNABLE_TO_DECRYPT_CERT_SIGNATURE");

break;

case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:

s = String::New("UNABLE_TO_DECRYPT_CRL_SIGNATURE");

break;