private ByteBuffer decrypt(ByteBuffer input, ByteBuffer output) throws IOException {
        ByteBuffer out = output;
        input.flip();
        do {
            // Decode TLS network data and place it in the app buffer
            out = wrapper.unwrap(input, out);

            lastStatus = wrapper.getStatus();
        }
        while ((lastStatus == TLSStatus.NEED_READ || lastStatus == TLSStatus.OK) &&
                input.hasRemaining());

        if (input.hasRemaining()) {
            // Complete TLS packets have been read, decrypted and written to the output buffer.
            // However, the input buffer contains incomplete TLS packets that cannot be decrpted.
            // Discard the read data and keep the unread data in the input buffer. The channel will
            // be read again to obtain the missing data to complete the TLS packet. So in the next
            // round the TLS packet will be decrypted and written to the output buffer
            input.compact();
        } else {
            // All the encrypted data in the inpu buffer was decrypted so we can clear
            // the input buffer.
            input.clear();
        }

        return out;
    }
<code>inAppBB</code> buffer keeps decypted data.
xmppserver/src/main/java/org/jivesoftware/openfire/net/TLSStreamReader.java