From f6cadb7f54f82cf01451d60c08d5a34169032609 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Thu, 17 Oct 2013 11:36:32 +0200
Subject: [PATCH] libipsec: Don't print ciphertext with ICV in log message

---
 src/libipsec/esp_packet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libipsec/esp_packet.c b/src/libipsec/esp_packet.c
index 7de765ecd..ebe13ce77 100644
--- a/src/libipsec/esp_packet.c
+++ b/src/libipsec/esp_packet.c
@@ -232,7 +232,6 @@ METHOD(esp_packet_t, decrypt, status_t,
 		return PARSE_ERROR;
 	}
 	ciphertext = reader->peek(reader);
-	ciphertext.len += icv.len;
 	reader->destroy(reader);
 
 	if (!esp_context->verify_seqno(esp_context, seq))
@@ -245,6 +244,8 @@ METHOD(esp_packet_t, decrypt, status_t,
 	DBG3(DBG_ESP, "ESP decryption:\n  SPI %.8x [seq %u]\n  IV %B\n  "
 		 "encrypted %B\n  ICV %B", spi, seq, &iv, &ciphertext, &icv);
 
+	/* include ICV in ciphertext for decryption/verification */
+	ciphertext.len += icv.len;
 	/* aad = spi + seq */
 	aad = chunk_create(data.ptr, 8);