- s = format (s, "\n crypto alg %U%s%U",
- format_ipsec_crypto_alg, sa->crypto_alg,
- sa->crypto_alg ? " key " : "",
- format_ipsec_key, &sa->crypto_key);
- s = format (s, "\n integrity alg %U%s%U",
- format_ipsec_integ_alg, sa->integ_alg,
- sa->integ_alg ? " key " : "", format_ipsec_key, &sa->integ_key);
+ s = format (s, "\n crypto alg %U",
+ format_ipsec_crypto_alg, sa->crypto_alg);
+ if (sa->crypto_alg && (flags & IPSEC_FORMAT_INSECURE))
+ s = format (s, " key %U", format_ipsec_key, &sa->crypto_key);
+ else
+ s = format (s, " key [redacted]");
+ s = format (s, "\n integrity alg %U",
+ format_ipsec_integ_alg, sa->integ_alg);
+ if (sa->integ_alg && (flags & IPSEC_FORMAT_INSECURE))
+ s = format (s, " key %U", format_ipsec_key, &sa->integ_key);
+ else
+ s = format (s, " key [redacted]");
+