///|
pub(all) struct SslTlv {
  client_flags : Byte
  verify : UInt
  sub_tlvs : Array[RawTlv]
} derive(Debug)

///|
pub fn parse_ssl_tlv(
  value : Bytes,
  offset? : Int = 0,
) -> Result[SslTlv, ProxyError] {
  if value.length() < 5 {
    return Err(
      proxy_error(
        InvalidSslTlv,
        offset,
        "SSL TLV requires a 5-byte fixed prefix",
      ),
    )
  }
  let verify = (value[1].to_uint() << 24) |
    (value[2].to_uint() << 16) |
    (value[3].to_uint() << 8) |
    value[4].to_uint()
  let nested = Bytes::from_array(value.to_array()[5:])
  match parse_tlvs(nested, offset=offset + 5) {
    Err(err) => Err(proxy_error(InvalidSslTlv, err.offset, err.context))
    Ok(sub_tlvs) => Ok({ client_flags: value[0], verify, sub_tlvs })
  }
}

///|
pub fn encode_ssl_tlv(ssl : SslTlv) -> Result[RawTlv, ProxyError] {
  match encode_tlvs(ssl.sub_tlvs) {
    Err(err) => Err(err)
    Ok(nested) => {
      let buffer = @buffer.Buffer(size_hint=5 + nested.length())
      buffer.write_byte(ssl.client_flags)
      buffer.write_bytes(write_u32_be(ssl.verify))
      buffer.write_bytes(nested)
      Ok({ type_code: TLV_SSL, value: buffer.to_bytes() })
    }
  }
}