int ensure_connection_intialized(tls_uv_connection_state_t* state) {
	if (state->flags & CONNECTION_STATUS_INIT_DONE)
		return 1;

	if (SSL_is_init_finished(state->ssl)) {
		state->flags |= CONNECTION_STATUS_INIT_DONE;
		if (validate_connection_certificate(state) == 0) {
			state->flags |= CONNECTION_STATUS_WRITE_AND_ABORT;
			return 0;
		}
		return connection_write(state, "OK\r\n", 4);
	}

	return 1;
}

void handle_read(uv_stream_t *client, ssize_t nread, const uv_buf_t *buf) {
	tls_uv_connection_state_t* state = client->data;
	if (nread <= 0) {
		push_libuv_error(nread, "Unable to read");
		state->server->options.handler->connection_error(state);
		abort_connection_on_error(state);
		return;
	}


	int rc = BIO_write(state->read, buf->base, nread);
	assert(rc == nread);
	while (1)
	{
		int rc = SSL_read(state->ssl, buf->base, buf->len);
		if (rc <= 0) {
			rc = SSL_get_error(state->ssl, rc);
			if (rc != SSL_ERROR_WANT_READ) {
				push_ssl_errors();
				state->server->options.handler->connection_error(state);
				abort_connection_on_error(state);
				break;
			}

			maybe_flush_ssl(state);
			ensure_connection_intialized(state);
			// need to read more, we'll let libuv handle this
			break;
		}

		// should be rare: can only happen if we go for 0rtt or something like that
		// and we do the handshake and have real data in one network roundtrip
		if (ensure_connection_intialized(state) == 0)
			break;

		if (state->flags & CONNECTION_STATUS_WRITE_AND_ABORT) {
			// we won't accept anything from this kind of connection
			// just read it out of the network and let's give the write
			// a chance to kill it
			continue;
		}
		if (read_message(state, buf->base, rc) == 0) {
			// handler asked to close the socket
			if (maybe_flush_ssl(state)) {
				state->flags |= CONNECTION_STATUS_WRITE_AND_ABORT;
				break;
			}
			abort_connection_on_error(state);
			break;
		}
	}

	free(buf->base);
}