private int pull(ByteBuffer dst) throws IOException {
    inStream.checkNoWait(5);
    //if (!inStream.checkNoWait(5)) {
    //  return 0;
    //}

    byte[] header = new byte[5];
    inStream.readBytes(header, 0, 5);

    // Reference: http://publib.boulder.ibm.com/infocenter/tpfhelp/current/index.jsp?topic=%2Fcom.ibm.ztpf-ztpfdf.doc_put.cur%2Fgtps5%2Fs5rcd.html
    int sslRecordType = header[0] & 0xFF;
    int sslVersion = header[1] & 0xFF;
    int sslDataLength = (int)((header[3] << 8) | (header[4] & 0xFF));

    if (sslRecordType < 20 || sslRecordType > 23 || sslVersion != 3 ||
        sslDataLength == 0) {
      // Not SSL v3 or TLS.  Could be SSL v2 or bad data

      // Reference: http://www.homeport.org/~adam/ssl.html
      // and the SSL v2 protocol specification
      int headerBytes;
      if ((header[0] & 0x80) != 0x80) {
        headerBytes = 2;
        sslDataLength = (int)(((header[0] & 0x7f) << 8) | header[1]);
      } else {
        headerBytes = 3;
        sslDataLength = (int)(((header[0] & 0x3f) << 8) | header[1]);
      }

      // In SSL v2, the version is part of the handshake
      sslVersion = header[headerBytes + 1] & 0xFF;
      if (sslVersion < 2 || sslVersion > 3 || sslDataLength == 0)
        throw new ErrorException("Not an SSL/TLS record");

      // The number of bytes left to read
      sslDataLength -= (5 - headerBytes);
    }

    assert sslDataLength > 0;

    byte[] buf = new byte[sslDataLength];
    inStream.readBytes(buf, 0, sslDataLength);
    dst.put(header);
    dst.put(buf);
    return sslDataLength;
  }