Update Files

Kha/Tools/macos/std/hl/_std/sys/ssl/Certificate.hx

@@ -0,0 +1,182 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+import sys.ssl.Lib;
+
+@:noDoc
+typedef CertificatePtr = hl.Abstract<"hl_ssl_cert">;
+
+@:coreApi
+class Certificate {
+	var __h:Null<Certificate>;
+	var __x:CertificatePtr;
+
+	@:allow(sys.ssl.Socket)
+	function new(x:CertificatePtr, ?h:Certificate) {
+		__x = x;
+		__h = h;
+	}
+
+	public static function loadFile(file:String):Certificate {
+		return new Certificate(cert_load_file(@:privateAccess file.toUtf8()));
+	}
+
+	public static function loadPath(path:String):Certificate {
+		return new Certificate(cert_load_path(@:privateAccess path.toUtf8()));
+	}
+
+	public static function fromString(str:String):Certificate {
+		return new Certificate(cert_add_pem(null, @:privateAccess str.toUtf8()));
+	}
+
+	public static function loadDefaults():Certificate {
+		var x = cert_load_defaults();
+		if (x != null)
+			return new Certificate(x);
+
+		var defPaths = null;
+		switch (Sys.systemName()) {
+			case "Linux":
+				defPaths = [
+					"/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
+					"/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL
+					"/etc/ssl/ca-bundle.pem", // OpenSUSE
+					"/etc/pki/tls/cacert.pem", // OpenELEC
+					"/etc/ssl/certs", // SLES10/SLES11
+					"/system/etc/security/cacerts" // Android
+				];
+			case "BSD":
+				defPaths = [
+					"/usr/local/share/certs/ca-root-nss.crt", // FreeBSD/DragonFly
+					"/etc/ssl/cert.pem", // OpenBSD
+					"/etc/openssl/certs/ca-certificates.crt", // NetBSD
+				];
+			case "Android":
+				defPaths = ["/system/etc/security/cacerts"];
+			default:
+		}
+		if (defPaths != null) {
+			for (path in defPaths) {
+				if (sys.FileSystem.exists(path)) {
+					if (sys.FileSystem.isDirectory(path))
+						return loadPath(path);
+					else
+						return loadFile(path);
+				}
+			}
+		}
+		return null;
+	}
+
+	public var commonName(get, null):Null<String>;
+	public var altNames(get, null):Array<String>;
+	public var notBefore(get, null):Date;
+	public var notAfter(get, null):Date;
+
+	function get_commonName():Null<String> {
+		return subject("CN");
+	}
+
+	function get_altNames():Array<String> {
+		var a = cert_get_altnames(__x);
+		return [for (e in a) @:privateAccess String.fromUCS2(e)];
+	}
+
+	public function subject(field:String):Null<String> {
+		var s = cert_get_subject(__x, @:privateAccess field.toUtf8());
+		return s == null ? null : @:privateAccess String.fromUCS2(cast s);
+	}
+
+	public function issuer(field:String):Null<String> {
+		var s = cert_get_issuer(__x, @:privateAccess field.toUtf8());
+		return s == null ? null : @:privateAccess String.fromUCS2(cast s);
+	}
+
+	function get_notBefore():Date {
+		var a = cert_get_notbefore(__x);
+		return new Date(a[0], a[1] - 1, a[2], a[3], a[4], a[5]);
+	}
+
+	function get_notAfter():Date {
+		var a = cert_get_notafter(__x);
+		return new Date(a[0], a[1] - 1, a[2], a[3], a[4], a[5]);
+	}
+
+	public function next():Null<Certificate> {
+		var n = cert_get_next(__x);
+		return n == null ? null : new Certificate(n, __h == null ? this : __h);
+	}
+
+	public function add(pem:String):Void {
+		cert_add_pem(__x, @:privateAccess pem.toUtf8());
+	}
+
+	public function addDER(der:haxe.io.Bytes):Void {
+		cert_add_der(__x, @:privateAccess der.b, @:privateAccess der.length);
+	}
+
+	@:hlNative("ssl", "cert_load_defaults") static function cert_load_defaults():CertificatePtr {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_load_file") static function cert_load_file(file:hl.Bytes):CertificatePtr {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_load_path") static function cert_load_path(path:hl.Bytes):CertificatePtr {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_subject") static function cert_get_subject(cert:CertificatePtr, obj:hl.Bytes):hl.Bytes {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_issuer") static function cert_get_issuer(cert:CertificatePtr, obj:hl.Bytes):hl.Bytes {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_altnames") static function cert_get_altnames(cert:CertificatePtr):hl.NativeArray<hl.Bytes> {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_notbefore") static function cert_get_notbefore(cert:CertificatePtr):hl.NativeArray<Int> {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_notafter") static function cert_get_notafter(cert:CertificatePtr):hl.NativeArray<Int> {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_get_next") static function cert_get_next(cert:CertificatePtr):Null<CertificatePtr> {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_add_pem") static function cert_add_pem(cert:Null<CertificatePtr>, data:hl.Bytes):CertificatePtr {
+		return null;
+	}
+
+	@:hlNative("ssl", "cert_add_der") static function cert_add_der(cert:Null<CertificatePtr>, data:hl.Bytes, len:Int):CertificatePtr {
+		return null;
+	}
+}

Kha/Tools/macos/std/hl/_std/sys/ssl/Context.hx

@@ -0,0 +1,98 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+private typedef ConfigPtr = hl.Abstract<"mbedtls_ssl_config">;
+private typedef ContextPtr = hl.Abstract<"mbedtls_ssl_context">;
+
+@:keep class SNICbResult {
+	public var cert:Certificate.CertificatePtr;
+	public var key:Key.KeyPtr;
+
+	public function new(cert:Certificate, key:Key) {
+		this.cert = @:privateAccess cert.__x;
+		this.key = @:privateAccess key.__k;
+	}
+}
+
+@:hlNative("ssl", "ssl_")
+abstract Context(ContextPtr) {
+	public function new(config) {
+		this = ssl_new(config);
+	}
+
+	public function close():Void {}
+
+	public function handshake():Int {
+		return 0;
+	}
+
+	public function recvChar():Int {
+		return 0;
+	}
+
+	public function sendChar(c:Int):Int {
+		return 0;
+	}
+
+	public function getPeerCertificate():Certificate.CertificatePtr {
+		return null;
+	}
+
+	public function recv(bytes:hl.Bytes, pos:Int, len:Int):Int {
+		return 0;
+	}
+
+	public function send(bytes:hl.Bytes, pos:Int, len:Int):Int {
+		return 0;
+	}
+
+	public function setSocket(socket:sys.net.Socket.SocketHandle):Void {}
+
+	public function setHostname(name:hl.Bytes):Void {}
+
+	@:hlNative("ssl", "ssl_new") static function ssl_new(conf:Config):ContextPtr {
+		return null;
+	}
+}
+
+@:hlNative("ssl", "conf_")
+abstract Config(ConfigPtr) {
+	public function new(server:Bool) {
+		this = conf_new(server);
+	}
+
+	public function setCert(cert:Certificate.CertificatePtr, pkey:Key.KeyPtr):Void {}
+
+	public function setCa(ca:Certificate.CertificatePtr):Void {}
+
+	public function close():Void {}
+
+	public function setVerify(mode:Int):Void {}
+
+	public function setServernameCallback(cb:hl.Bytes->SNICbResult):Void {}
+
+	@:hlNative("ssl", "conf_new") static function conf_new(server:Bool):ConfigPtr {
+		return null;
+	}
+}

Kha/Tools/macos/std/hl/_std/sys/ssl/Digest.hx

@@ -0,0 +1,56 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+import sys.ssl.Lib;
+
+@:coreApi
+class Digest {
+	public static function make(data:haxe.io.Bytes, alg:DigestAlgorithm):haxe.io.Bytes {
+		var size = 0;
+		var b = @:privateAccess dgst_make(data.b, data.length, (alg : String).toUtf8(), size);
+		return @:privateAccess new haxe.io.Bytes(b, size);
+	}
+
+	public static function sign(data:haxe.io.Bytes, privKey:Key, alg:DigestAlgorithm):haxe.io.Bytes {
+		var size = 0;
+		var b = @:privateAccess dgst_sign(data.b, data.length, privKey.__k, (alg : String).toUtf8(), size);
+		return @:privateAccess new haxe.io.Bytes(b, size);
+	}
+
+	public static function verify(data:haxe.io.Bytes, signature:haxe.io.Bytes, pubKey:Key, alg:DigestAlgorithm):Bool {
+		return @:privateAccess dgst_verify(data.b, data.length, signature.b, signature.length, pubKey.__k, (alg : String).toUtf8());
+	}
+
+	@:hlNative("ssl", "dgst_make") static function dgst_make(data:hl.Bytes, len:Int, alg:hl.Bytes, size:hl.Ref<Int>):hl.Bytes {
+		return null;
+	}
+
+	@:hlNative("ssl", "dgst_sign") static function dgst_sign(data:hl.Bytes, len:Int, key:sys.ssl.Key.KeyPtr, alg:hl.Bytes, size:hl.Ref<Int>):hl.Bytes {
+		return null;
+	}
+
+	@:hlNative("ssl", "dgst_verify") static function dgst_verify(data:hl.Bytes, dlen:Int, sign:hl.Bytes, slen:Int, key:sys.ssl.Key.KeyPtr, alg:hl.Bytes):Bool {
+		return false;
+	}
+}

Kha/Tools/macos/std/hl/_std/sys/ssl/Key.hx

@@ -0,0 +1,62 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+import sys.ssl.Lib;
+
+@:noDoc
+typedef KeyPtr = hl.Abstract<"hl_ssl_pkey">;
+
+@:coreApi
+class Key {
+	private var __k:KeyPtr;
+
+	private function new(k:KeyPtr) {
+		__k = k;
+	}
+
+	public static function loadFile(file:String, ?isPublic:Bool, ?pass:String):Key {
+		var data = sys.io.File.getBytes(file);
+		var start = data.getString(0, 11);
+		if (start == "-----BEGIN ")
+			return readPEM(data.toString(), isPublic == true, pass);
+		else
+			return readDER(data, isPublic == true);
+	}
+
+	public static function readPEM(data:String, isPublic:Bool, ?pass:String):Key {
+		return new Key(key_from_pem(@:privateAccess data.toUtf8(), isPublic, pass == null ? null : @:privateAccess pass.toUtf8()));
+	}
+
+	public static function readDER(data:haxe.io.Bytes, isPublic:Bool):Key {
+		return new Key(key_from_der(@:privateAccess data.b, @:privateAccess data.length, isPublic));
+	}
+
+	@:hlNative("ssl", "key_from_pem") static function key_from_pem(data:hl.Bytes, pub:Bool, pass:Null<hl.Bytes>):KeyPtr {
+		return null;
+	}
+
+	@:hlNative("ssl", "key_from_der") static function key_from_der(data:hl.Bytes, len:Int, pub:Bool):KeyPtr {
+		return null;
+	}
+}

Kha/Tools/macos/std/hl/_std/sys/ssl/Lib.hx

@@ -0,0 +1,32 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+@:noDoc @:keep
+class Lib {
+	static function __init__():Void {
+		ssl_init();
+	}
+
+	@:hlNative("ssl", "ssl_init") static function ssl_init() {};
+}

Kha/Tools/macos/std/hl/_std/sys/ssl/Socket.hx

@@ -0,0 +1,255 @@
+/*
+ * Copyright (C)2005-2019 Haxe Foundation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+package sys.ssl;
+
+import sys.ssl.Lib;
+import sys.ssl.Key.KeyPtr;
+import sys.ssl.Certificate.CertificatePtr;
+import sys.net.Socket.SocketHandle;
+
+private class SocketInput extends haxe.io.Input {
+	@:allow(sys.ssl.Socket) private var __s:Socket;
+
+	public function new(s:Socket) {
+		this.__s = s;
+	}
+
+	public override function readByte() {
+		__s.handshake();
+		var r = @:privateAccess __s.ssl.recvChar();
+		if (r == -1)
+			throw haxe.io.Error.Blocked;
+		else if (r < 0)
+			throw new haxe.io.Eof();
+		return r;
+	}
+
+	public override function readBytes(buf:haxe.io.Bytes, pos:Int, len:Int):Int {
+		if (pos < 0 || len < 0 || ((pos + len) : UInt) > (buf.length : UInt))
+			throw haxe.io.Error.OutsideBounds;
+		__s.handshake();
+		var r = @:privateAccess __s.ssl.recv(buf, pos, len);
+		if (r == -1)
+			throw haxe.io.Error.Blocked;
+		else if (r <= 0)
+			throw new haxe.io.Eof();
+		return r;
+	}
+
+	public override function close() {
+		super.close();
+		if (__s != null)
+			__s.close();
+	}
+}
+
+private class SocketOutput extends haxe.io.Output {
+	@:allow(sys.ssl.Socket) private var __s:Socket;
+
+	public function new(s:Socket) {
+		this.__s = s;
+	}
+
+	public override function writeByte(c:Int) {
+		__s.handshake();
+		var r = @:privateAccess __s.ssl.sendChar(c);
+		if (r == -1)
+			throw haxe.io.Error.Blocked;
+		else if (r < 0)
+			throw new haxe.io.Eof();
+	}
+
+	public override function writeBytes(buf:haxe.io.Bytes, pos:Int, len:Int):Int {
+		if (pos < 0 || len < 0 || ((pos + len) : UInt) > (buf.length : UInt))
+			throw haxe.io.Error.OutsideBounds;
+		__s.handshake();
+		var r = @:privateAccess __s.ssl.send(buf, pos, len);
+		if (r == -1)
+			throw haxe.io.Error.Blocked;
+		else if (r < 0)
+			throw new haxe.io.Eof();
+		return r;
+	}
+
+	public override function close() {
+		super.close();
+		if (__s != null)
+			__s.close();
+	}
+}
+
+@:coreApi @:access(sys.net.Socket)
+class Socket extends sys.net.Socket {
+	public static var DEFAULT_VERIFY_CERT:Null<Bool> = true;
+
+	public static var DEFAULT_CA:Null<Certificate>;
+
+	private var conf:Context.Config;
+	private var ssl:Context;
+
+	public var verifyCert:Null<Bool>;
+
+	private var caCert:Null<Certificate>;
+	private var hostname:String;
+
+	private var ownCert:Null<Certificate>;
+	private var ownKey:Null<Key>;
+	private var altSNIContexts:Null<Array<{match:String->Bool, key:Key, cert:Certificate}>>;
+	private var sniCallback:hl.Bytes->Context.SNICbResult;
+	private var handshakeDone:Bool;
+	private var isBlocking:Bool = true;
+
+	private override function init():Void {
+		__s = sys.net.Socket.socket_new(false);
+		input = new SocketInput(this);
+		output = new SocketOutput(this);
+		if (DEFAULT_VERIFY_CERT && DEFAULT_CA == null) {
+			try {
+				DEFAULT_CA = Certificate.loadDefaults();
+			} catch (e:Dynamic) {}
+		}
+		verifyCert = DEFAULT_VERIFY_CERT;
+		caCert = DEFAULT_CA;
+	}
+
+	public override function connect(host:sys.net.Host, port:Int):Void {
+		conf = buildConfig(false);
+		ssl = new Context(conf);
+		ssl.setSocket(__s);
+		handshakeDone = false;
+		if (hostname == null)
+			hostname = host.host;
+		if (hostname != null)
+			ssl.setHostname(@:privateAccess hostname.toUtf8());
+		if (!sys.net.Socket.socket_connect(__s, host.ip, port))
+			throw new Sys.SysError("Failed to connect on " + host.toString() + ":" + port);
+		if (isBlocking)
+			handshake();
+	}
+
+	public function handshake():Void {
+		if (!handshakeDone) {
+			var r = ssl.handshake();
+			if (r == 0)
+				handshakeDone = true;
+			else if (r == -1)
+				throw haxe.io.Error.Blocked;
+			else
+				throw new haxe.io.Eof();
+		}
+	}
+
+	override function setBlocking(b:Bool):Void {
+		super.setBlocking(b);
+		isBlocking = b;
+	}
+
+	public function setCA(cert:Certificate):Void {
+		caCert = cert;
+	}
+
+	public function setHostname(name:String):Void {
+		hostname = name;
+	}
+
+	public function setCertificate(cert:Certificate, key:Key):Void {
+		ownCert = cert;
+		ownKey = key;
+	}
+
+	public override function close():Void {
+		if (ssl != null)
+			ssl.close();
+		if (conf != null)
+			conf.close();
+		if (altSNIContexts != null)
+			sniCallback = null;
+		sys.net.Socket.socket_close(__s);
+		var input:SocketInput = cast input;
+		var output:SocketOutput = cast output;
+		@:privateAccess input.__s = output.__s = null;
+		input.close();
+		output.close();
+	}
+
+	public function addSNICertificate(cbServernameMatch:String->Bool, cert:Certificate, key:Key):Void {
+		if (altSNIContexts == null)
+			altSNIContexts = [];
+		altSNIContexts.push({match: cbServernameMatch, cert: cert, key: key});
+	}
+
+	public override function bind(host:sys.net.Host, port:Int):Void {
+		conf = buildConfig(true);
+
+		sys.net.Socket.socket_bind(__s, host.ip, port);
+	}
+
+	public override function accept():Socket {
+		var c = sys.net.Socket.socket_accept(__s);
+		if(c == null)
+			throw "Blocking";
+		var cssl = new Context(conf);
+		cssl.setSocket(c);
+
+		var s = Type.createEmptyInstance(sys.ssl.Socket);
+		s.__s = c;
+		s.ssl = cssl;
+		s.input = new SocketInput(s);
+		s.output = new SocketOutput(s);
+		s.handshakeDone = false;
+
+		return s;
+	}
+
+	public function peerCertificate():sys.ssl.Certificate {
+		var x = ssl.getPeerCertificate();
+		return x == null ? null : new sys.ssl.Certificate(x);
+	}
+
+	private function buildConfig(server:Bool):Context.Config {
+		var conf = new Context.Config(server);
+
+		if (ownCert != null && ownKey != null)
+			conf.setCert(@:privateAccess ownCert.__x, @:privateAccess ownKey.__k);
+
+		if (altSNIContexts != null) {
+			sniCallback = function(servername:hl.Bytes):Context.SNICbResult {
+				var servername = @:privateAccess String.fromUTF8(servername);
+				for (c in altSNIContexts) {
+					if (c.match(servername))
+						return new Context.SNICbResult(c.cert, c.key);
+				}
+				if (ownKey != null && ownCert != null)
+					return new Context.SNICbResult(ownCert, ownKey);
+				return null;
+			}
+			conf.setServernameCallback(sniCallback);
+		}
+
+		if (caCert != null)
+			conf.setCa(caCert == null ? null : @:privateAccess caCert.__x);
+		conf.setVerify(if (verifyCert) 1 else if (verifyCert == null) 2 else 0);
+
+		return conf;
+	}
+}