windows-xp/Source/XPSP1/NT/net/tcpip/driver/ipsec/sys/macros.h

/*++

Copyright (c) 1997-2001  Microsoft Corporation

Module Name:

    macros.h

Abstract:

    Contains all the macros.

Author:

    Sanjay Anand (SanjayAn) 2-January-1997
    ChunYe

Environment:

    Kernel mode

Revision History:

--*/


#ifndef  _MACROS_H
#define  _MACROS_H

#define REGISTER register

#define EXTENDED_MULTIPLY   RtlExtendedIntegerMultiply

#ifndef MAX
#define MAX(x,y)    ((x) < (y)) ? (y) : (x)
#endif
#ifndef MIN
#define MIN(x,y)    ((x) < (y)) ? (x) : (y)
#endif

#define MAX_IP_DATA_LENGTH  ((USHORT)0xfffff)

#define MAX_AH_OUTPUT_LEN   MAX(MD5DIGESTLEN, A_SHA_DIGEST_LEN)

//
// This macro adds a ULONG to a LARGE_INTEGER.
//

#define ADD_TO_LARGE_INTEGER(_LargeInteger,_Ulong) \
    ExInterlockedAddLargeStatistic((PLARGE_INTEGER)(_LargeInteger),(ULONG)(_Ulong))

#define IPSecEqualMemory(_p1, _p2, _len)  RtlEqualMemory(_p1, _p2, _len)

#define IPSecMoveMemory(_p1, _p2, _len)  RtlMoveMemory(_p1, _p2, _len)

#define IPSecZeroMemory(_p1, _len)  RtlZeroMemory(_p1, _len)

//
// Truncates _src to _numbytes and copies into _dest
// then zeroes out the rest in _dest
//
#define TRUNCATE(_dest, _src, _numbytes, _destlen) {        \
    IPSecZeroMemory ( _dest+_numbytes, _destlen - _numbytes); \
}

//
// Some macros
//
#ifdef  NET_SHORT
#undef  NET_SHORT
#endif
__inline
USHORT
FASTCALL
NET_SHORT(USHORT x)
{
#if (defined(_M_IX86) && (_MSC_FULL_VER > 13009037)) || ((defined(_M_AMD64) || defined(_M_IA64)) && (_MSC_FULL_VER > 13009175))
    return _byteswap_ushort(x);
#else
    ASSERT(x <= 0xffff);

    return (x << 8) | (x >> 8);
#endif
}

#define NET_TO_HOST_SHORT(Val)  NET_SHORT(Val)
#define HOST_TO_NET_SHORT(Val)  NET_SHORT(Val)

#ifdef  NET_LONG
#undef  NET_LONG
#endif
__inline
ULONG
FASTCALL
NET_LONG(ULONG x)
{
#if (defined(_M_IX86) && (_MSC_FULL_VER > 13009037)) || ((defined(_M_AMD64) || defined(_M_IA64)) && (_MSC_FULL_VER > 13009175))
    return _byteswap_ulong(x);
#else
    REGISTER ULONG  BytesSwapped;

    BytesSwapped = ((x & 0x00ff00ff) << 8) | ((x & 0xff00ff00) >> 8);
    return (BytesSwapped << 16) | (BytesSwapped >> 16);
#endif
}

#define NET_TO_HOST_LONG(Val)   NET_LONG(Val)
#define HOST_TO_NET_LONG(Val)   NET_LONG(Val)

#define IPSEC_100NS_FACTOR      10000000

#define IPSEC_CONVERT_SECS_TO_100NS(_li, _delta) {      \
    (_li).LowPart = _delta;                             \
    (_li) = EXTENDED_MULTIPLY(_li, IPSEC_100NS_FACTOR); \
}

#define IS_CLASSD(i)            (((long)(i) & 0xf0000000) == 0xe0000000)

//
// Check SA against Lifetime information - we try to anticipate in advance if the
// SA is going to expire and start off a re-key so that when it actually does expire,
// we have the new SA setup.
//

//
// IPSEC_EXPIRE_TIME_PAD is the time before expiration when we start re-keying
//
#define IPSEC_EXPIRE_TIME_PAD_I         (75 * IPSEC_100NS_FACTOR)
#define IPSEC_EXPIRE_TIME_PAD_R         (40 * IPSEC_100NS_FACTOR)
#define IPSEC_EXPIRE_TIME_PAD_OAKLEY    (1 * IPSEC_100NS_FACTOR)

//
// IPSEC_INBOUND_KEEPALIVE_TIME is the time an expired inboundSA will be kept
// alive in the driver
//
#define IPSEC_INBOUND_KEEPALIVE_TIME    (60)

//
// IPSEC_MAX_EXPIRE_TIME is the maximum phase-2 lifetime allowed in driver
//
#define IPSEC_MAX_EXPIRE_TIME           (48 * 3600 - 1)

//
// IPSEC_MIN_EXPIRE_TIME is the minimum phase-2 lifetime allowed in driver
//
#define IPSEC_MIN_EXPIRE_TIME           (60)

#define IPSEC_EXPIRE_THRESHOLD_I        (50)
#define IPSEC_EXPIRE_THRESHOLD_R        (75)

//
// skew the initiator and responder with Pads
//
#define IPSEC_DEFAULT_SA_IDLE_TIME_PAD_I  0
#define IPSEC_DEFAULT_SA_IDLE_TIME_PAD_R  30

//
// The # of packets before which we start reneg. because of replay rollover
// 1M bytes / 1500 packets
//
#define IPSEC_EXPIRE_REPLAY_MASK    (0x80000000)
#define MAX_ULONG                   ((ULONG) -1)
#define MAX_LONG                    (0x7fffffff)

//
// Some constants used for POST_EXPIRE_NOTIFY
//
#define IPSEC_INVALID_SPI           0
#define IPSEC_INVALID_ADDR          (-1)

//
// Check the lifetime (kbytes and seconds) and replay rollover.
// FALSE => expired
//
#define IPSEC_CHECK_PADDED_LIFETIME(__pSA, _status, _index) {   \
    LARGE_INTEGER   __curtime;                                  \
    (_status) = TRUE;                                           \
    if (((__pSA)->sa_ReplaySendSeq[0] &                         \
         IPSEC_EXPIRE_REPLAY_MASK) &&                           \
        ((__pSA)->sa_Flags & FLAGS_SA_OUTBOUND)) {              \
        _status = FALSE;                                        \
    } else {                                                    \
        KeQuerySystemTime(&__curtime);                          \
        if (((__pSA)->sa_KeyExpirationTimeWithPad.QuadPart > 0i64) && \
            ((__pSA)->sa_KeyExpirationTimeWithPad.QuadPart < __curtime.QuadPart)) {\
            _status = FALSE;                                    \
        } else if (((__pSA)->sa_KeyExpirationBytesWithPad.QuadPart > 0i64) &&   \
                   ((__pSA)->sa_KeyExpirationBytesWithPad.QuadPart < (__pSA)->sa_TotalBytesTransformed.QuadPart)) {   \
            _status = FALSE;                                    \
        }                                                       \
    }                                                           \
}

#define IPSEC_CHECK_LIFETIME(__pSA, _status, _index) {          \
    LARGE_INTEGER   __curtime;                                  \
    (_status) = TRUE;                                           \
    if ((__pSA)->sa_ReplaySendSeq[_index] == MAX_ULONG) {       \
        _status = FALSE;                                        \
    } else {                                                    \
        KeQuerySystemTime(&__curtime);                          \
        if (((__pSA)->sa_KeyExpirationTime.QuadPart > 0i64) &&  \
            ((__pSA)->sa_KeyExpirationTime.QuadPart < __curtime.QuadPart)) { \
            _status = FALSE;                                    \
        } else if (((__pSA)->sa_KeyExpirationBytes.QuadPart > 0i64) &&   \
                   ((__pSA)->sa_KeyExpirationBytes.QuadPart < (__pSA)->sa_TotalBytesTransformed.QuadPart)) { \
            _status = FALSE;                                    \
        }                                                       \
    }                                                           \
}

#define IPSEC_SA_EXPIRED(__pSA, __fexpired) {           \
    LARGE_INTEGER   __curtime;                          \
    KeQuerySystemTime(&__curtime);                      \
    (__fexpired) = FALSE;                               \
    __curtime.QuadPart -= pSA->sa_LastUsedTime.QuadPart;\
    if (__pSA->sa_IdleTime.QuadPart < __curtime.QuadPart) { \
        __fexpired = TRUE;                              \
    }                                                   \
}

//
// Max tolerated collisions when trying to allocate SPIs.
//
#define MAX_SPI_RETRIES 50

#define IPSEC_SPI_TO_ENTRY(_spi, _entry, _dst) {        \
    KIRQL   kIrql;                                      \
    AcquireReadLock(&g_ipsec.SPIListLock, &kIrql);      \
    *(_entry) = IPSecLookupSABySPIWithLock(_spi, _dst); \
    if (*(_entry)) {                                    \
        IPSecRefSA((*(_entry)));                        \
    }                                                   \
    ReleaseReadLock(&g_ipsec.SPIListLock, kIrql);       \
}

//
// Generic memory allocators
//
#define IPSecAllocatePktInfo(__tag) \
    IPSecAllocateMemory(sizeof(NDIS_IPSEC_PACKET_INFO), __tag)

#define IPSecFreePktInfo(__p) \
    IPSecFreeMemory(__p)

#define IPSecAllocatePktExt(__tag) \
    IPSecAllocateMemory(sizeof(NDIS_IPSEC_PACKET_INFO), __tag)

#define IPSecFreePktExt(__p) \
    IPSecFreeMemory(__p)

#define IPSecAllocateBuffer(_ntstatus, _ppBuf, _ppData, _size, _tag) {  \
    PIPSEC_LA_BUFFER    __labuf;                                        \
    *(_ntstatus) = STATUS_SUCCESS;                                      \
    __labuf = IPSecGetBuffer(_size, _tag);                              \
    if (__labuf) {                                                      \
        if (ARGUMENT_PRESENT(_ppData)) {                                \
            *(PVOID *)(_ppData) = __labuf->Buffer;                      \
        }                                                               \
        *(_ppBuf) = __labuf->Mdl;                                       \
        NdisAdjustBufferLength(__labuf->Mdl, _size);                    \
        NDIS_BUFFER_LINKAGE(__labuf->Mdl) = NULL;                       \
    } else {                                                            \
        *(_ntstatus) = STATUS_INSUFFICIENT_RESOURCES;                   \
    }                                                                   \
}

#define IPSecFreeBuffer(_ntstatus, _pBuf) {                             \
    PIPSEC_LA_BUFFER    __buffer;                                       \
    *(_ntstatus) = STATUS_SUCCESS;                                      \
    __buffer = CONTAINING_RECORD((_pBuf), IPSEC_LA_BUFFER, Data);       \
    IPSecReturnBuffer(__buffer);                                        \
}

#define IPSecAllocateSendCompleteCtx(__tag)                 \
    ExAllocateFromNPagedLookasideList(&g_ipsec.IPSecLookasideLists->SendCompleteCtxList)

#define IPSecFreeSendCompleteCtx(_buffer)                   \
    ExFreeToNPagedLookasideList(&g_ipsec.IPSecLookasideLists->SendCompleteCtxList, _buffer);    \
    IPSEC_DECREMENT(g_ipsec.NumSends);

#define IPSEC_GET_TOTAL_LEN(_pbuf, _plen)       {           \
    PNDIS_BUFFER _ptemp = (PNDIS_BUFFER)(_pbuf);            \
    *(_plen) = 0;                                           \
    while (_ptemp) {                                        \
        *(_plen) += _ptemp->ByteCount;                      \
        _ptemp = NDIS_BUFFER_LINKAGE(_ptemp);               \
    }                                                       \
}

#define IPSEC_GET_TOTAL_LEN_RCV_BUF(_pbuf, _plen)       {   \
    IPRcvBuf *_ptemp = (_pbuf);                             \
    *(_plen) = 0;                                           \
    while (_ptemp) {                                        \
        *(_plen) += _ptemp->ipr_size;                       \
        _ptemp = IPSEC_BUFFER_LINKAGE(_ptemp);              \
    }                                                       \
}

//
// Copy len bytes from RcvBuf chain to mdl (only one MDL)
//
#define IPSEC_COPY_FROM_RCVBUF(_pMdl, _pRcvBuf, _len, _offset) {                    \
    IPRcvBuf    *__pBuf=(_pRcvBuf);                                                 \
    PMDL        __pMdl=(_pMdl);                                                     \
    ULONG       __srclen;                                                           \
    ULONG       __destlen;                                                          \
    ULONG       __totallen=0;                                                       \
    PUCHAR      __pSrc;                                                             \
    PUCHAR      __pDest;                                                            \
    ULONG       __curroffset = (_offset);                                           \
    IPSecQueryNdisBuf(__pMdl, &__pDest, &__destlen);                                \
    while (__pBuf) {                                                                \
        IPSecQueryRcvBuf(__pBuf, &__pSrc, &__srclen);                               \
        if (__srclen > __curroffset) {                                              \
            RtlCopyMemory(__pDest, __pSrc+__curroffset, __srclen-__curroffset);     \
            __pDest += (__srclen - __curroffset);                                   \
            __totallen += (__srclen - __curroffset);                                \
        }                                                                           \
        __curroffset = 0;                                                           \
        __pBuf = IPSEC_BUFFER_LINKAGE(__pBuf);                                      \
    }                                                                               \
    ASSERT(__totallen == __destlen);                                                \
}

//
// Copy len bytes from Ndis Buffer chain to mdl (only one MDL)
//
#define IPSEC_COPY_FROM_NDISBUF(_pMdl, _pRcvBuf, _len, _offset) {                   \
    NDIS_BUFFER *__pBuf=(_pRcvBuf);                                                 \
    PMDL        __pMdl=(_pMdl);                                                     \
    ULONG       __srclen;                                                           \
    ULONG       __destlen;                                                          \
    ULONG       __totallen=0;                                                       \
    PUCHAR      __pSrc;                                                             \
    PUCHAR      __pDest;                                                            \
    ULONG       __curroffset = (_offset);                                           \
    IPSecQueryNdisBuf(__pMdl, &__pDest, &__destlen);                                \
    while (__pBuf) {                                                                \
        IPSecQueryNdisBuf(__pBuf, &__pSrc, &__srclen);                              \
        if (__srclen > __curroffset) {                                              \
            RtlCopyMemory(__pDest, __pSrc+__curroffset, __srclen-__curroffset);     \
            __pDest += (__srclen - __curroffset);                                   \
            __totallen += (__srclen - __curroffset);                                \
        }                                                                           \
        __curroffset = 0;                                                           \
        __pBuf = NDIS_BUFFER_LINKAGE(__pBuf);                                       \
    }                                                                               \
    ASSERT(__totallen == __destlen);                                                \
}

#define IPSecAllocateMemory(_size, _tag)    \
        ExAllocatePoolWithTag (NonPagedPool, _size, _tag)

#define IPSecAllocateMemoryLowPriority(_size, _tag) \
        ExAllocatePoolWithTagPriority (NonPagedPool, _size, _tag, LowPoolPriority)

#define IPSecFreeMemory(_addr)  ExFreePool (_addr)

#define IPSecQueryNdisBuf(_Buffer, _VirtualAddress, _Length)    \
{                                                               \
    PNDIS_BUFFER    __Mdl = (PNDIS_BUFFER) (_Buffer);           \
    if (ARGUMENT_PRESENT(_VirtualAddress)) {                    \
        *(PVOID *)(_VirtualAddress) = (__Mdl)->MappedSystemVa;  \
    }                                                           \
    *(_Length) = (__Mdl)->ByteCount;                            \
}

#define IPSecQueryRcvBuf(_Buffer, _VirtualAddress, _Length) \
{                                                           \
    IPRcvBuf    *__buf = (IPRcvBuf *) (_Buffer);            \
    if (ARGUMENT_PRESENT(_VirtualAddress)) {                \
        *(PVOID *)(_VirtualAddress) = (__buf)->ipr_buffer;  \
    }                                                       \
    *(_Length) = (__buf)->ipr_size;                         \
}

#define IPSEC_ADJUST_BUFFER_LEN(_pBuf, _len)    \
    ((IPRcvBuf *)(_pBuf))->ipr_size = (_len)

#define IPSEC_ADJUST_BUFFER(_pBuf, _offset) \
    ((IPRcvBuf *)(_pBuf))->ipr_buffer += (_offset)

#define IPSEC_ADJUST_BUFFER_RCVOFFSET(_pBuf, _offset)   \
    ((IPRcvBuf *)(_pBuf))->ipr_RcvOffset += (_offset)

#define IPSEC_BUFFER_LINKAGE(_pBuf) \
    ((IPRcvBuf *)(_pBuf))->ipr_next

#define IPSEC_BUFFER_LEN(_pBuf) \
    ((IPRcvBuf *)(_pBuf))->ipr_size

#define IPSEC_BUFFER_OWNER(_pBuf)   \
    (((IPRcvBuf *)(_pBuf))->ipr_owner)

#define IPSEC_SET_OFFSET_IN_BUFFER(_pBuf, _offset)  {               \
    PUCHAR  _p;                                                     \
    LONG    _len;                                                   \
    IPSecQueryRcvBuf((_pBuf), &(_p), &(_len));                      \
    if ((_offset) > 0 && (_offset) < (_len)) {                      \
        if (IPSEC_BUFFER_OWNER(_pBuf) == IPR_OWNER_FIREWALL) {      \
            IPSecMoveMemory((_p), (_p) + (_offset), (_len) - (_offset));\
        } else {                                                    \
            IPSEC_ADJUST_BUFFER((_pBuf), (_offset));                \
            IPSEC_ADJUST_BUFFER_RCVOFFSET((_pBuf), (_offset));      \
        }                                                           \
        IPSEC_ADJUST_BUFFER_LEN((_pBuf), (_len) - (_offset));       \
    } else {                                                        \
        ASSERT(FALSE);                                              \
        return  STATUS_INVALID_PARAMETER;                           \
    }                                                               \
}

#define IPSEC_ADD_VALUE(_val, _inc) InterlockedExchangeAdd((PULONG)&(_val), _inc)

#define IPSEC_INCREMENT(_val)  InterlockedIncrement(&(_val))
#define IPSEC_DECREMENT(_val)  InterlockedDecrement(&(_val))
#define IPSEC_GET_VALUE(_val)  InterlockedExchangeAdd((PULONG)&(_val), 0)
#define IPSEC_SET_VALUE(_target, _val)  \
    InterlockedExchange((PULONG)&(_target), _val)

#define IPSEC_DRIVER_IS_EMPTY()     (g_ipsec.NumPolicies == 0)
#define IPSEC_DRIVER_IS_INACTIVE()  (g_ipsec.DriverUnloading || !g_ipsec.InitTcpip)

#define IPSEC_DRIVER_UNLOADING()    (g_ipsec.DriverUnloading)
#define IPSEC_DRIVER_BOUND()        (g_ipsec.BoundToIP)
#define IPSEC_DRIVER_SEND_BOUND()   (g_ipsec.SendBoundToIP)
#define IPSEC_DRIVER_INIT_CRYPTO()  (g_ipsec.InitCrypto)
#define IPSEC_DRIVER_INIT_RNG()     (g_ipsec.InitRNG)
#define IPSEC_DRIVER_INIT_TCPIP()   (g_ipsec.InitTcpip)
#if FIPS
#define IPSEC_DRIVER_INIT_FIPS()    (g_ipsec.InitFips)
#endif
#if GPC
#define IPSEC_DRIVER_INIT_GPC()     (g_ipsec.InitGpc)
#endif

#if DBG
#define IPSecRemoveEntryList(_x)                        \
{                                                       \
    RemoveEntryList(_x);                                \
    (_x)->Flink = (_x)->Blink = (PLIST_ENTRY)__LINE__;  \
}
#else
#define IPSecRemoveEntryList(_x)    RemoveEntryList(_x)
#endif

//
// macros for filter list management
//
#define IS_TRANSPORT_FILTER(f)  (!(f)->TunnelFilter)
#define IS_TUNNEL_FILTER(f)     ((f)->TunnelFilter)
#define IS_INBOUND_FILTER(f)    ((f)->Flags & FILTER_FLAGS_INBOUND)
#define IS_OUTBOUND_FILTER(f)   ((f)->Flags & FILTER_FLAGS_OUTBOUND)

#define IS_EXEMPT_FILTER(f)     (((f)->Flags & FILTER_FLAGS_DROP) || ((f)->Flags & FILTER_FLAGS_PASS_THRU))

#define IS_MULTICAST_FILTER(f)  (IS_CLASSD(NET_LONG((f)->SRC_ADDR)) || \
                                 IS_CLASSD(NET_LONG((f)->DEST_ADDR)))

__inline
PLIST_ENTRY
IPSecResolveFilterList(
    IN  BOOLEAN     fTunnel,
    IN  BOOLEAN     fOutbound
    )
{
    PLIST_ENTRY pEntry;

    if (fTunnel) {
        if (fOutbound) {
            pEntry = &g_ipsec.FilterList[OUTBOUND_TUNNEL_FILTER];
        } else {
            pEntry = &g_ipsec.FilterList[INBOUND_TUNNEL_FILTER];
        }
    } else {
        if (fOutbound) {
            pEntry = &g_ipsec.FilterList[OUTBOUND_TRANSPORT_FILTER];
        } else {
            pEntry = &g_ipsec.FilterList[INBOUND_TRANSPORT_FILTER];
        }
    }

    return  pEntry;
}

//
// Filter/SA Cache Table
//
#define CacheMatch(uliAddr, uliPort, pInCache)              \
        ((uliAddr).QuadPart == pInCache->uliSrcDstAddr.QuadPart) &&    \
        ((uliPort).QuadPart == pInCache->uliProtoSrcDstPort.QuadPart)

#define IS_VALID_CACHE_ENTRY(_entry)    ((_entry)->pFilter != NULL)

#define INVALIDATE_CACHE_ENTRY(_entry)              \
{                                                   \
    ((PFILTER_CACHE)(_entry))->pSAEntry = NULL;     \
    ((PFILTER_CACHE)(_entry))->pNextSAEntry = NULL; \
}                                                   \

__inline
ULONG
FASTCALL
CalcCacheIndex(
    IN  IPAddr  SrcAddr,
    IN  IPAddr  DestAddr,
    IN  UCHAR   Protocol,
    IN  USHORT  SrcPort,
    IN  USHORT  DestPort,
    IN  BOOLEAN fOutbound
    )
{
    REGISTER ULONG  dwIndex;
    REGISTER ULONG  Address;
    REGISTER USHORT Port;

    Address = SrcAddr ^ DestAddr;
    Port = SrcPort ^ DestPort;

    dwIndex = NET_TO_HOST_LONG(Address);
    dwIndex += Protocol;
    dwIndex += NET_TO_HOST_SHORT(Port);

    dwIndex %= g_ipsec.CacheHalfSize;
    if (fOutbound) {
        dwIndex += g_ipsec.CacheHalfSize;
    }

    return  dwIndex;
}

__inline
VOID
CacheUpdate(
    IN  ULARGE_INTEGER  uliAddr,
    IN  ULARGE_INTEGER  uliPort,
    IN  PVOID           _pCtxt1,
    IN  PVOID           _pCtxt2,
    IN  ULONG           dwId,
    IN  BOOLEAN         fFilter
    )
{
    PFILTER_CACHE   __pCache;
    PFILTER_CACHE   __pTempCache;
    PFILTER         __pFilter;
    PSA_TABLE_ENTRY __pSA;
    PSA_TABLE_ENTRY __pNextSA;

    __pCache = g_ipsec.ppCache[(dwId)];

    if (IS_VALID_CACHE_ENTRY(__pCache)) {
        if (__pCache->FilterEntry) {
            __pCache->pFilter->FilterCache = NULL;
        } else {
            __pCache->pSAEntry->sa_FilterCache = NULL;
            if (__pCache->pNextSAEntry) {
                __pCache->pNextSAEntry->sa_FilterCache = NULL;
                __pCache->pNextSAEntry = NULL;
            }
        }
    }

    if (fFilter) {
        __pFilter = (PFILTER)(_pCtxt1);

        if (__pFilter->FilterCache) {
            INVALIDATE_CACHE_ENTRY(__pFilter->FilterCache);
            __pFilter->FilterCache = NULL;
        }

        __pCache->uliSrcDstAddr = (uliAddr);
        __pCache->uliProtoSrcDstPort = (uliPort);
        __pCache->FilterEntry = TRUE;
        __pCache->pFilter = __pFilter;
        __pFilter->FilterCache = __pCache;
    } else {
        __pSA = (PSA_TABLE_ENTRY)(_pCtxt1);
        __pNextSA = (PSA_TABLE_ENTRY)(_pCtxt2);

        if ((__pTempCache = __pSA->sa_FilterCache)) {
            __pTempCache->pSAEntry->sa_FilterCache = NULL;
            if (__pTempCache->pNextSAEntry) {
                __pTempCache->pNextSAEntry->sa_FilterCache = NULL;
            }
            INVALIDATE_CACHE_ENTRY(__pTempCache);
        }

        if (__pNextSA && (__pTempCache = __pNextSA->sa_FilterCache)) {
            __pTempCache->pSAEntry->sa_FilterCache = NULL;
            if (__pTempCache->pNextSAEntry) {
                __pTempCache->pNextSAEntry->sa_FilterCache = NULL;
            }
            INVALIDATE_CACHE_ENTRY(__pTempCache);
        }

        __pCache->uliSrcDstAddr = (uliAddr);
        __pCache->uliProtoSrcDstPort = (uliPort);
        __pCache->FilterEntry = FALSE;
        __pCache->pSAEntry = __pSA;
        __pSA->sa_FilterCache = __pCache;
        if (__pNextSA) {
            __pCache->pNextSAEntry = __pNextSA;
            __pNextSA->sa_FilterCache = __pCache;
        }
    }
}

__inline
VOID
IPSecInvalidateSACacheEntry(
    IN  PSA_TABLE_ENTRY     pSA
    )
{
    PFILTER_CACHE   pCache;

    pCache = pSA->sa_FilterCache;

    if (pCache) {
        ASSERT(IS_VALID_CACHE_ENTRY(pCache));
        ASSERT(pSA == pCache->pSAEntry || pSA == pCache->pNextSAEntry);
        pCache->pSAEntry->sa_FilterCache = NULL;
        if (pCache->pNextSAEntry) {
            pCache->pNextSAEntry->sa_FilterCache = NULL;
        }
        INVALIDATE_CACHE_ENTRY(pCache);
    }
}

__inline
VOID
IPSecInvalidateFilterCacheEntry(
    IN  PFILTER         pFilter
    )
{
    PFILTER_CACHE   pCache;

    pCache = pFilter->FilterCache;

    if (pCache) {
        ASSERT(IS_VALID_CACHE_ENTRY(pCache));
        ASSERT(IS_EXEMPT_FILTER(pFilter));
        pFilter->FilterCache = NULL;
        INVALIDATE_CACHE_ENTRY(pCache);
    }
}

__inline
VOID
IPSecStartSATimer(
    IN  PSA_TABLE_ENTRY         pSA,
    IN  IPSEC_TIMEOUT_HANDLER   TimeoutHandler,
    IN  ULONG                   SecondsToGo
    )
{
    if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) {
        if (IPSecStopTimer(&pSA->sa_Timer)) {
            IPSecStartTimer(&pSA->sa_Timer,
                            TimeoutHandler,
                            SecondsToGo,
                            (PVOID)pSA);
        }
    } else {
        pSA->sa_Flags |= FLAGS_SA_TIMER_STARTED;
        IPSecStartTimer(&pSA->sa_Timer,
                        TimeoutHandler,
                        SecondsToGo,
                        (PVOID)pSA);
    }
}

__inline
VOID
IPSecStopSATimer(
    IN  PSA_TABLE_ENTRY pSA
    )
{
    if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) {
        pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;
        IPSecStopTimer(&pSA->sa_Timer);
    }
}

__inline
VOID
IPSecStopTimerDerefSA(
    IN  PSA_TABLE_ENTRY pSA
    )
{
    if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) {
        if (IPSecStopTimer(&pSA->sa_Timer)) {
            pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;
            IPSecDerefSA(pSA);
        }
    } else {
        IPSecDerefSA(pSA);
    }
}

__inline
VOID
IPSecDerefSANextSA(
    IN  PSA_TABLE_ENTRY pSA,
    IN  PSA_TABLE_ENTRY pNextSA
    )
{
    if (pNextSA) {
        IPSecDerefSA(pNextSA);
    }
    IPSecDerefSA(pSA);
}

__inline
VOID
IPSecRemoveSPIEntry(
    IN  PSA_TABLE_ENTRY pSA
    )
{
    if (pSA->sa_Flags & FLAGS_SA_ON_SPI_HASH) {
        IPSecRemoveEntryList(&pSA->sa_SPILinkage);
        pSA->sa_Flags &= ~FLAGS_SA_ON_SPI_HASH;
    }
}

//
// Packs the src/dest IP addrs in a large integer
//
#define IPSEC_BUILD_SRC_DEST_ADDR(_li, _src, _dest) {   \
    (_li).LowPart = _src;                               \
    (_li).HighPart = _dest;                             \
}

#define IPSEC_BUILD_SRC_DEST_MASK   IPSEC_BUILD_SRC_DEST_ADDR

//
// Packs the Proto and Src/Dest ports into a large int
//
//
// Ports make sense only for TCP and UDP
//
//
// TCP/UDP header
// 0                 15 16               31
// |----|----|----|----|----|----|----|----|
// |    Source Port    |    Dst Port       |
//
#define IPSEC_BUILD_PROTO_PORT_LI(_li, _proto, _sport, _dport) {    \
    (_li).LowPart =                                                 \
      MAKELONG(MAKEWORD((_proto),0x00),0x0000);                     \
    switch((_li).LowPart) {                                         \
        case 6:                                                     \
        case 17: {                                                  \
            (_li).HighPart =  MAKELONG((_sport),(_dport));          \
            break;                                                  \
        }                                                           \
        default: {                                                  \
            (_li).HighPart = 0x00000000;                            \
            break;                                                  \
        }                                                           \
    }                                                               \
}

#define IPSecRefFilter(__pfilter)   IPSEC_INCREMENT((__pfilter)->Reference)

#define IPSecFreeFilter(__pfilter)  IPSecFreeMemory(__pfilter)

#define IPSecDerefFilter(__pfilter)                     \
{                                                       \
    if (IPSEC_DECREMENT((__pfilter)->Reference) == 0) { \
        IPSecFreeFilter(__pfilter);                     \
    }                                                   \
}

#define IPSecAllocateKeyBuffer(_size)   IPSecAllocateMemory(_size, IPSEC_TAG_KEY)
#define IPSecFreeKeyBuffer(_key)    IPSecFreeMemory(_key)


#define IPSecAllocateLogBuffer(_size)   IPSecAllocateMemory(_size, IPSEC_TAG_LOG)
#define IPSecFreeLogBuffer(_key)    IPSecFreeMemory(_key)


#define IPSecFreeSA(_sa) {                          \
    LONG    _i;                                     \
    for (_i=0; _i<(_sa)->sa_NumOps; _i++) {         \
        if ((_sa)->INT_KEY(_i)) {                   \
            IPSecFreeKeyBuffer((_sa)->INT_KEY(_i)); \
        }                                           \
        if ((_sa)->CONF_KEY(_i)) {                  \
            IPSecFreeKeyBuffer((_sa)->CONF_KEY(_i));\
        }                                           \
    }                                               \
    IPSecFreeMemory(_sa);                           \
}

#define IPSecGetAcquireContext()        IPSecAllocateMemory(sizeof(IPSEC_ACQUIRE_CONTEXT), IPSEC_TAG_ACQUIRE_CTX)
#define IPSecFreeAcquireContext(_ctx)   IPSecFreeMemory(_ctx)

#define IPSecGetNotifyExpire()        IPSecAllocateMemory(sizeof(IPSEC_NOTIFY_EXPIRE), IPSEC_TAG_ACQUIRE_CTX)

//
// Hashes <SPI, Dest>
//
#define IPSEC_HASH_SPI(_dest, _spi, _phash) {                               \
    DWORD   dwIndex;                                                        \
    dwIndex = NET_TO_HOST_LONG(_dest) + (_spi);                             \
    dwIndex %= g_ipsec.SAHashSize;                                          \
    pHash = &g_ipsec.pSADb[dwIndex];                                        \
    IPSEC_DEBUG(ALL, ("SPI: Index: %lx for S: %lx, D: %lx, pHash: %lx\n",   \
                    dwIndex,                                                \
                    (_spi),                                                 \
                    (_dest),                                                \
                    pHash));                                                \
}

//
// Hashes <Src, Dest>
//
#define IPSEC_HASH_ADDR(_src, _dest,_phash) {                               \
    DWORD   dwIndex;                                                        \
    dwIndex = (_src)+(_dest);                                               \
    dwIndex %= g_ipsec.SpFilterHashSize;                                    \
    pHash = &g_ipsec.pSpFilter[dwIndex];                                    \
    IPSEC_DEBUG(ALL, ("ADDR: Index: %lx for S: %lx, D: %lx, pHash: %lx\n",  \
                    dwIndex,                                                \
                    (_src),                                                 \
                    (_dest),                                                \
                    pHash));                                                \
}

#define SRC_ADDR   uliSrcDstAddr.LowPart
#define DEST_ADDR  uliSrcDstAddr.HighPart
#define SRC_MASK   uliSrcDstMask.LowPart
#define DEST_MASK  uliSrcDstMask.HighPart
#define PROTO      uliProtoSrcDstPort.LowPart
#define SRC_PORT   LOWORD(uliProtoSrcDstPort.HighPart)
#define DEST_PORT  HIWORD(uliProtoSrcDstPort.HighPart)

#define FI_SRC_PORT(_filter)    LOWORD((_filter)->uliProtoSrcDstPort.HighPart)
#define FI_DEST_PORT(_filter)   HIWORD((_filter)->uliProtoSrcDstPort.HighPart)

#define SA_SRC_ADDR  sa_uliSrcDstAddr.LowPart
#define SA_DEST_ADDR sa_uliSrcDstAddr.HighPart
#define SA_SRC_MASK  sa_uliSrcDstMask.LowPart
#define SA_DEST_MASK sa_uliSrcDstMask.HighPart
#define SA_PROTO     sa_uliProtoSrcDstPort.LowPart

#define SA_SRC_PORT(_psa)       LOWORD((_psa)->sa_uliProtoSrcDstPort.HighPart)
#define SA_DEST_PORT(_psa)      HIWORD((_psa)->sa_uliProtoSrcDstPort.HighPart)

#define FILTER_PROTO(ProtoId)   MAKELONG(MAKEWORD((ProtoId),0x00),0x00000)
#define FILTER_PROTO_ANY        FILTER_PROTO(0x00)
#define FILTER_PROTO_ICMP       FILTER_PROTO(0x01)
#define FILTER_PROTO_TCP        FILTER_PROTO(0x06)
#define FILTER_PROTO_UDP        FILTER_PROTO(0x11)

#define FILTER_TCPUDP_PORT_ANY  (WORD)0x0000

#define FILTER_ICMP_TYPE_ANY    (BYTE)0xff
#define FILTER_ICMP_CODE_ANY    (BYTE)0xff

#define FILTER_MASK_ALL         (DWORD)0xffffffff
#define FILTER_MASK_NONE        (DWORD)0x00000000

//
// macros to parse the ALGORITHM structure
//
#define INT_ALGO(_i)    sa_Algorithm[_i].integrityAlgo.algoIdentifier
#define INT_KEY(_i)     sa_Algorithm[_i].integrityAlgo.algoKey
#define INT_KEYLEN(_i)  sa_Algorithm[_i].integrityAlgo.algoKeylen
#define INT_ROUNDS(_i)  sa_Algorithm[_i].integrityAlgo.algoRounds

#define CONF_ALGO(_i)   sa_Algorithm[_i].confAlgo.algoIdentifier
#define CONF_KEY(_i)    sa_Algorithm[_i].confAlgo.algoKey
#define CONF_KEYLEN(_i) sa_Algorithm[_i].confAlgo.algoKeylen
#define CONF_ROUNDS(_i) sa_Algorithm[_i].confAlgo.algoRounds

#define COMP_ALGO(_i)   sa_Algorithm[_i].compAlgo.algoIdentifier

#define EXT_INT_ALGO    IntegrityAlgo.algoIdentifier
#define EXT_INT_KEY     IntegrityAlgo.algoKey
#define EXT_INT_KEYLEN  IntegrityAlgo.algoKeylen
#define EXT_INT_ROUNDS  IntegrityAlgo.algoRounds

#define EXT_CONF_ALGO   ConfAlgo.algoIdentifier
#define EXT_CONF_KEY    ConfAlgo.algoKey
#define EXT_CONF_KEYLEN ConfAlgo.algoKeylen
#define EXT_CONF_ROUNDS ConfAlgo.algoRounds

#define EXT_INT_ALGO_EX(_i)    AlgoInfo[_i].IntegrityAlgo.algoIdentifier
#define EXT_INT_KEYLEN_EX(_i)  AlgoInfo[_i].IntegrityAlgo.algoKeylen
#define EXT_INT_ROUNDS_EX(_i)  AlgoInfo[_i].IntegrityAlgo.algoRounds

#define EXT_CONF_ALGO_EX(_i)   AlgoInfo[_i].ConfAlgo.algoIdentifier
#define EXT_CONF_KEYLEN_EX(_i) AlgoInfo[_i].ConfAlgo.algoKeylen
#define EXT_CONF_ROUNDS_EX(_i) AlgoInfo[_i].ConfAlgo.algoRounds

#define IS_AH_SA(_psa)  ((_psa)->sa_Operation[0] == Auth ||     \
                         (_psa)->sa_Operation[1] == Auth ||     \
                         (_psa)->sa_Operation[2] == Auth)
#define IS_ESP_SA(_psa) ((_psa)->sa_Operation[0] == Encrypt ||  \
                         (_psa)->sa_Operation[1] == Encrypt ||  \
                         (_psa)->sa_Operation[2] == Encrypt)

//
// Increment/decrement statistics
//
#define IPSEC_INC_STATISTIC(_stat) \
    (g_ipsec.Statistics.##_stat)++;

#define IPSEC_DEC_STATISTIC(_stat) \
    (g_ipsec.Statistics.##_stat)--;

#define IPSEC_INC_TUNNELS(_pSA) {           \
    if ((_pSA)->sa_Flags & FLAGS_SA_TUNNEL) \
        g_ipsec.Statistics.dwNumActiveTunnels++; \
}

#define IPSEC_DEC_TUNNELS(_pSA) {           \
    if ((_pSA)->sa_Flags & FLAGS_SA_TUNNEL) \
        g_ipsec.Statistics.dwNumActiveTunnels--; \
}

//
// Macro to read a dword from registry and init the variable passed in.
//
#define IPSEC_REG_READ_DWORD(_hRegKey, _param, _var, _def, _max, _min) {    \
    NTSTATUS    __status;                                                   \
    __status = GetRegDWORDValue(_hRegKey,                                   \
                                _param,                                     \
                                (_var));                                    \
                                                                            \
    if (!NT_SUCCESS(__status)) {                                            \
        *(_var) = _def;                                                     \
    } else if (*(_var) > _max) {                                            \
        *(_var) = _max;                                                     \
    } else if (*(_var) <= _min) {                                           \
        *(_var) = _min;                                                     \
    }                                                                       \
}

//
// Macro for computing incremental checksum (RFC 1624)
//
#define UpdateIPLength(_piph, _length)                          \
{                                                               \
    ULONG   _sum;                                               \
    USHORT  _old;                                               \
                                                                \
    _old = NET_SHORT((_piph)->iph_length);                      \
    (_piph)->iph_length = (_length);                            \
    _sum = (~NET_SHORT((_piph)->iph_xsum) & 0xffff) +           \
           (~_old & 0xffff) +                                   \
           NET_SHORT((_piph)->iph_length);                      \
    _sum = (_sum & 0xffff) + (_sum >> 16);                      \
    _sum += (_sum >> 16);                                       \
    (_piph)->iph_xsum = NET_SHORT((USHORT)(~_sum & 0xffff));    \
}

#define UpdateIPProtocol(_piph, _proto)                         \
{                                                               \
    ULONG   _sum;                                               \
    USHORT  _old;                                               \
                                                                \
    _old = NET_SHORT(*(USHORT *)&(_piph)->iph_ttl);             \
    (_piph)->iph_protocol = (_proto);                           \
    _sum = (~NET_SHORT((_piph)->iph_xsum) & 0xffff) +           \
           (~_old & 0xffff) +                                   \
           NET_SHORT(*(USHORT *)&(_piph)->iph_ttl);             \
    _sum = (_sum & 0xffff) + (_sum >> 16);                      \
    _sum += (_sum >> 16);                                       \
    (_piph)->iph_xsum = NET_SHORT((USHORT)(~_sum & 0xffff));    \
}

#define IPSecPrint4Long(_key)               \
    DbgPrint("Key: %lx-%lx-%lx-%lx\n",      \
            *(ULONG *)&(_key)[0],           \
            *(ULONG *)&(_key)[4],           \
            *(ULONG *)&(_key)[8],           \
            *(ULONG *)&(_key)[12]);

#define IPSEC_DELAY_INTERVAL    ((LONGLONG)(-1 * 1000 * 1000))  // 1/10 sec.

#define IPSEC_DELAY_EXECUTION()                                     \
{                                                                   \
    IPSecDelayInterval.QuadPart = IPSEC_DELAY_INTERVAL;             \
    KeDelayExecutionThread(UserMode, FALSE, &IPSecDelayInterval);   \
}

#define IS_DRIVER_BLOCK()   (g_ipsec.OperationMode == IPSEC_BLOCK_MODE)
#define IS_DRIVER_BYPASS()  (g_ipsec.OperationMode == IPSEC_BYPASS_MODE)
#define IS_DRIVER_SECURE()  (g_ipsec.OperationMode == IPSEC_SECURE_MODE)

#define IS_DRIVER_DIAGNOSTIC()  (g_ipsec.DiagnosticMode)

#define LOG_EVENT   NdisWriteEventLogEntry

#define IPSEC_NULL_GUIDS    "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"

#define IPSEC_EQUAL_GUIDS(_A, _B)     \
    ((*(UNALIGNED ULONG *)((PUCHAR)(_A)) == *(UNALIGNED ULONG *)((PUCHAR)(_B))) &&         \
     (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+4) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+4)) && \
     (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+8) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+8)) && \
     (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+12) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+12)))

//
// Get the next non-zero length NDIS buffer.
//
__inline
PNDIS_BUFFER
FASTCALL
IPSEC_NEXT_BUFFER(
    IN  PNDIS_BUFFER    pBuffer
    )
{
    PVOID   *pDummy = NULL;
    ULONG   Length = 0;

    if (!pBuffer) {
        ASSERT(FALSE);
        return  NULL;
    }

    pBuffer = NDIS_BUFFER_LINKAGE(pBuffer);

    while (pBuffer) {
        IPSecQueryNdisBuf(pBuffer, &pDummy, &Length);
        if (Length == 0) {
            pBuffer = NDIS_BUFFER_LINKAGE(pBuffer);
            continue;
        } else {
            return  pBuffer;
        }
    }

    return  NULL;
}

#define SA_CHAIN_WIDTH  4

//
// Count number of 1's in the IP mask
//
__inline
LONG
CountNumberOfOnes(
    IN  IPMask  IpMask
    )
{
    INT     i;
    LONG    NumberOfOnes = 0;
    IPMask  Mask = IpMask;

    for (i = 0; i < sizeof(IPMask) * 8; i++) {
        if ((Mask & 0x1) == 0x1) {
            NumberOfOnes++;
        }

        Mask = Mask >> 1;
    }

    return  NumberOfOnes;
}

__inline
PLIST_ENTRY
FASTCALL
IPSecResolveSAChain(
    IN  PFILTER pFilter,
    IN  IPAddr  IpAddr
    )
{
    PLIST_ENTRY pEntry;
    ULONG       Index;

    if (IS_TUNNEL_FILTER(pFilter)) {
        pEntry = &pFilter->SAChain[0];
    } else {
        Index = NET_TO_HOST_LONG(IpAddr) % pFilter->SAChainSize;
        pEntry = &pFilter->SAChain[Index];
    }

    return  pEntry;
}

#if GPC
#define IPSEC_GPC_MASK_ALL      (0xff)
#define IPSEC_GPC_MASK_NONE     (0x0)

#define GPC_REGISTER_CLIENT     g_ipsec.GpcEntries.GpcRegisterClientHandler
#define GPC_DEREGISTER_CLIENT   g_ipsec.GpcEntries.GpcDeregisterClientHandler
#define GPC_ADD_CFINFO          g_ipsec.GpcEntries.GpcAddCfInfoHandler
#define GPC_REMOVE_CFINFO       g_ipsec.GpcEntries.GpcRemoveCfInfoHandler
#define GPC_ADD_PATTERN         g_ipsec.GpcEntries.GpcAddPatternHandler
#define GPC_REMOVE_PATTERN      g_ipsec.GpcEntries.GpcRemovePatternHandler
#define GPC_CLASSIFY_PATTERN    g_ipsec.GpcEntries.GpcClassifyPatternHandler
#define GPC_GET_CLIENT_CONTEXT  g_ipsec.GpcEntries.GpcGetCfInfoClientContextHandler

#define IPSEC_GPC_ACTIVE        (0x12345678)
#define IPSEC_NUM_GPC_FILTERS() (g_ipsec.NumMaskedFilters)

#define IS_GPC_ACTIVE()         (g_ipsec.GpcActive == IPSEC_GPC_ACTIVE)

#define IPSEC_SET_GPC_ACTIVE()              \
{                                           \
    g_ipsec.GpcActive = IPSEC_GPC_ACTIVE;   \
}

#define IPSEC_UNSET_GPC_ACTIVE()            \
{                                           \
    g_ipsec.GpcActive = 0;                  \
}

__inline
INT
FASTCALL
IPSecResolveGpcCf(
    IN  BOOLEAN fOutbound
    )
{
    return  fOutbound? GPC_CF_IPSEC_OUT: GPC_CF_IPSEC_IN;
}

__inline
PLIST_ENTRY
FASTCALL
IPSecResolveGpcFilterList(
    IN  BOOLEAN     fTunnel,
    IN  BOOLEAN     fOutbound
    )
{
    PLIST_ENTRY pEntry;

    if (fTunnel) {
        if (fOutbound) {
            pEntry = &g_ipsec.GpcFilterList[OUTBOUND_TUNNEL_FILTER];
        } else {
            pEntry = &g_ipsec.GpcFilterList[INBOUND_TUNNEL_FILTER];
        }
    } else {
        if (fOutbound) {
            pEntry = &g_ipsec.GpcFilterList[OUTBOUND_TRANSPORT_FILTER];
        } else {
            pEntry = &g_ipsec.GpcFilterList[INBOUND_TRANSPORT_FILTER];
        }
    }

    return  pEntry;
}

__inline
VOID
IPSEC_CLASSIFY_PACKET(
    IN  INT                     GpcCf,
    IN  ULARGE_INTEGER          uliSrcDstAddr,
    IN  ULARGE_INTEGER          uliProtoSrcDstPort,
    OUT PFILTER                 *ppFilter,
    OUT PCLASSIFICATION_HANDLE  pGpcHandle
    )
{
    GPC_IP_PATTERN  Pattern;

    *ppFilter = NULL;
    *pGpcHandle = 0;

    Pattern.SrcAddr = SRC_ADDR;
    Pattern.DstAddr = DEST_ADDR;
    Pattern.ProtocolId = (UCHAR)PROTO;
    if (PROTO == PROTOCOL_TCP || PROTO == PROTOCOL_UDP) {
        Pattern.gpcSrcPort = SRC_PORT;
        Pattern.gpcDstPort = DEST_PORT;
    } else {
        Pattern.gpcSrcPort = 0;
        Pattern.gpcDstPort = 0;
    }
    Pattern.InterfaceId.InterfaceId = 0;
    Pattern.InterfaceId.LinkId = 0;

    GPC_CLASSIFY_PATTERN(   g_ipsec.GpcClients[GpcCf],
                            GPC_PROTOCOL_TEMPLATE_IP,
                            &Pattern,
                            ppFilter,
                            pGpcHandle,
                            0,
                            NULL,
                            TRUE);
}

#define IS_GPC_FILTER(f)    (g_ipsec.InitGpc &&                 \
                             f->SRC_MASK == FILTER_MASK_ALL &&  \
                             f->DEST_MASK == FILTER_MASK_ALL)
#endif

#if FIPS
#define IPSEC_DES_ALGO      FIPS_CBC_DES
#define IPSEC_3DES_ALGO     FIPS_CBC_3DES
#define IPSEC_SHA_INIT      g_ipsec.FipsFunctionTable.FipsSHAInit
#define IPSEC_SHA_UPDATE    g_ipsec.FipsFunctionTable.FipsSHAUpdate
#define IPSEC_SHA_FINAL     g_ipsec.FipsFunctionTable.FipsSHAFinal
#define IPSEC_DES_KEY       g_ipsec.FipsFunctionTable.FipsDesKey
#define IPSEC_3DES_KEY      g_ipsec.FipsFunctionTable.Fips3Des3Key
#define IPSEC_CBC           g_ipsec.FipsFunctionTable.FipsCBC
#define IPSEC_GEN_RANDOM    g_ipsec.FipsFunctionTable.FIPSGenRandom
#define IPSEC_HMAC_SHA_INIT g_ipsec.FipsFunctionTable.FipsHmacSHAInit
#define IPSEC_HMAC_SHA_UPDATE g_ipsec.FipsFunctionTable.FipsHmacSHAUpdate
#define IPSEC_HMAC_SHA_FINAL g_ipsec.FipsFunctionTable.FipsHmacSHAFinal
#define IPSEC_HMAC_MD5_INIT g_ipsec.FipsFunctionTable.HmacMD5Init
#define IPSEC_HMAC_MD5_UPDATE g_ipsec.FipsFunctionTable.HmacMD5Update
#define IPSEC_HMAC_MD5_FINAL g_ipsec.FipsFunctionTable.HmacMD5Final
#else
#define IPSEC_DES_ALGO      des
#define IPSEC_3DES_ALGO     tripledes
#define IPSEC_SHA_INIT      A_SHAInit
#define IPSEC_SHA_UPDATE    A_SHAUpdate
#define IPSEC_SHA_FINAL     A_SHAFinal
#define IPSEC_DES_KEY       deskey
#define IPSEC_3DES_KEY      tripledes3key
#define IPSEC_CBC(_EncryptionAlgo, _pOut, _pIn, _pKeyTable, _Operation, _pFeedback) \
    CBC(_EncryptionAlgo,    \
        DES_BLOCKLEN,       \
        _pOut,              \
        _pIn,               \
        _pKeyTable,         \
        _Operation,         \
        _pFeedback)
#define IPSEC_GEN_RANDOM(_pBuf, _KeySize)   NewGenRandom(NULL, NULL, _pBuf, _KeySize)
#endif
#define IPSEC_MD5_INIT      MD5Init
#define IPSEC_MD5_UPDATE    MD5Update
#define IPSEC_MD5_FINAL     MD5Final
#define IPSEC_RC4_KEY       rc4_key        
#define IPSEC_RC4           rc4

#define IS_CLASS_D_ADDR(x)  (((x) & 0x000000f0) == 0x000000e0)

#define DEFAULT_IPSEC_OPERATION_MODE    IPSEC_BYPASS_MODE

#define TCPIP_FREE_BUFF         g_ipsec.TcpipFreeBuff
#define TCPIP_ALLOC_BUFF        g_ipsec.TcpipAllocBuff
#define TCPIP_GET_ADDRTYPE      g_ipsec.TcpipGetAddrType
#define TCPIP_GET_INFO          g_ipsec.TcpipGetInfo
#define TCPIP_NDIS_REQUEST      g_ipsec.TcpipNdisRequest
#define TCPIP_REGISTER_PROTOCOL g_ipsec.TcpipRegisterProtocol
#define TCPIP_SET_IPSEC_STATUS  g_ipsec.TcpipSetIPSecStatus
#define TCPIP_IP_TRANSMIT       g_ipsec.TcpipIPTransmit
#define TCPIP_SET_IPSEC         g_ipsec.TcpipSetIPSecPtr
#define TCPIP_UNSET_IPSEC       g_ipsec.TcpipUnSetIPSecPtr
#define TCPIP_UNSET_IPSEC_SEND  g_ipsec.TcpipUnSetIPSecSendPtr
#define TCPIP_TCP_XSUM          g_ipsec.TcpipTCPXsum
#define TCPIP_GEN_IPID          g_ipsec.TcpipGenIpId
#define TCPIP_DEREGISTER_PROTOCOL g_ipsec.TcpipDeRegisterProtocol

#ifdef xsum
#undef xsum
#define xsum(Buffer, Length)    ((USHORT)TCPIP_TCP_XSUM(0, (PUCHAR)(Buffer), (Length)))
#endif


#define SAFETY_LEN  (TRUNCATED_HASH_LEN+MAX_PAD_LEN)


//
// Compares the src/dest ports out of a word with the number input
//
#define IPSEC_COMPARE_SD_PORT(_pport, _port)    \
    (   ((_pport)[0] == (_port)) ||     \
        ((_pport)[1] == (_port)))

#define IPSEC_COMPARE_D_PORT(_pport, _port) ((_pport)[1] == (_port))

//
// Bypass traffic logic for IKE, Kerberos and RSVP
//
#define IPSEC_KERBEROS_TRAFFIC()                            \
    ((pIPHeader->iph_protocol == PROTOCOL_UDP ||            \
      pIPHeader->iph_protocol == PROTOCOL_TCP) &&           \
     IPSEC_COMPARE_SD_PORT(pwPort, IPSEC_KERBEROS_PORT))

#define IPSEC_ISAKMP_TRAFFIC()                              \
    (pIPHeader->iph_protocol == PROTOCOL_UDP &&             \
     IPSEC_COMPARE_D_PORT(pwPort, IPSEC_ISAKMP_PORT))       \

#define IPSEC_RSVP_TRAFFIC()                                \
    (pIPHeader->iph_protocol == PROTOCOL_RSVP)

#define IPSEC_NO_UNICAST_EXEMPT   0x00000001
#define IPSEC_NO_MANDBCAST_EXEMPT 0x00000002

#define IPSEC_NO_DEFAULT_EXEMPT()   (g_ipsec.NoDefaultExempt & IPSEC_NO_UNICAST_EXEMPT)
#define IPSEC_HANDLE_MANDBCAST()   (g_ipsec.NoDefaultExempt & IPSEC_NO_MANDBCAST_EXEMPT)

#define IPSEC_MANDBCAST_PROCESS() (IPSEC_GET_VALUE(g_ipsec.NumMulticastFilters) || \
                                   IPSEC_HANDLE_MANDBCAST())

#define IPSEC_BYPASS_TRAFFIC()                              \
    (IPSEC_ISAKMP_TRAFFIC() ||                              \
     (!IPSEC_NO_DEFAULT_EXEMPT() &&                         \
      (IPSEC_KERBEROS_TRAFFIC() ||                          \
       IPSEC_RSVP_TRAFFIC())))

//
// Forwarding path is either reinject a detunneled forward packet or route
//
#define IPSEC_FORWARD_PATH()    (fFWPacket || (fOutbound && TCPIP_GET_ADDRTYPE(pIPHeader->iph_src) != DEST_LOCAL))


/*++

Routine Description:

    Fills in the DELETE_SA hw request from pSA

Arguments:

    pSA - the SA
    Buf - buffer to set info
    Len - length

Return Value:

    status of the operation

--*/
#define IPSecFillHwDelSA(_pSA, _Buf, _Len) \
    ((POFFLOAD_IPSEC_DELETE_SA)(_Buf))->OffloadHandle = (_pSA)->sa_OffloadHandle;


#endif  _MACROS_H