public ByteBuffer unwrap(ByteBuffer net, ByteBuffer app) throws SSLException {
        ByteBuffer out = app;
        out = resizeApplicationBuffer(out);// guarantees enough room for unwrap

        // Record a hex dump of the buffer, but only when logging on level 'debug'.
        // Create the dump before the buffer is being passed to tlsEngine, to ensure
        // that the original content of the buffer is logged.
        String hexDump = null;
        if ( Log.isDebugEnabled() )
        {
            final ByteBuffer bb = net.duplicate();
            final byte[] data = Arrays.copyOf( bb.array(), bb.limit() );
            hexDump = StringUtils.encodeHex( data );
        }

        try {
            tlsEngineResult = tlsEngine.unwrap( net, out );
        } catch ( SSLException e ) {
            if ( e.getMessage().startsWith( "Unsupported record version Unknown-" ) ) {
                Log.debug( "Buffer that wasn't TLS: {}", hexDump );
                throw new SSLException( "We appear to have received plain text data where we expected encrypted data. A common cause for this is a peer sending us a plain-text error message when it shouldn't send a message, but close the socket instead).", e );
            }
            else {
                throw e;
            }
        }
        log("server unwrap: ", tlsEngineResult);
        if (tlsEngineResult.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
            // If the result indicates that we have outstanding tasks to do, go
            // ahead and run them in this thread.
            doTasks();
        }
        return out;
    }
Attempts to decode TLS network data into a subsequence of plaintext application data
buffers. Depending on the state of the TLSWrapper, this method may consume network data
without producing any application data (for example, it may consume handshake data.)

If this TLSWrapper has not yet started its initial handshake, this method will automatically
start the handshake.

@param net a ByteBuffer containing inbound network data
@param app a ByteBuffer to hold inbound application data
@return a ByteBuffer containing inbound application data
@throws SSLException A problem was encountered while processing the data that caused the
            TLSHandler to abort.
xmppserver/src/main/java/org/jivesoftware/openfire/net/TLSWrapper.java