/*++ Copyright (c) 1997-2001 Microsoft Corporation Module Name: macros.h Abstract: Contains all the macros. Author: Sanjay Anand (SanjayAn) 2-January-1997 ChunYe Environment: Kernel mode Revision History: --*/ #ifndef _MACROS_H #define _MACROS_H #define REGISTER register #define EXTENDED_MULTIPLY RtlExtendedIntegerMultiply #ifndef MAX #define MAX(x,y) ((x) < (y)) ? (y) : (x) #endif #ifndef MIN #define MIN(x,y) ((x) < (y)) ? (x) : (y) #endif #define MAX_IP_DATA_LENGTH ((USHORT)0xfffff) #define MAX_AH_OUTPUT_LEN MAX(MD5DIGESTLEN, A_SHA_DIGEST_LEN) // // This macro adds a ULONG to a LARGE_INTEGER. // #define ADD_TO_LARGE_INTEGER(_LargeInteger,_Ulong) \ ExInterlockedAddLargeStatistic((PLARGE_INTEGER)(_LargeInteger),(ULONG)(_Ulong)) #define IPSecEqualMemory(_p1, _p2, _len) RtlEqualMemory(_p1, _p2, _len) #define IPSecMoveMemory(_p1, _p2, _len) RtlMoveMemory(_p1, _p2, _len) #define IPSecZeroMemory(_p1, _len) RtlZeroMemory(_p1, _len) // // Truncates _src to _numbytes and copies into _dest // then zeroes out the rest in _dest // #define TRUNCATE(_dest, _src, _numbytes, _destlen) { \ IPSecZeroMemory ( _dest+_numbytes, _destlen - _numbytes); \ } // // Some macros // #ifdef NET_SHORT #undef NET_SHORT #endif __inline USHORT FASTCALL NET_SHORT(USHORT x) { #if (defined(_M_IX86) && (_MSC_FULL_VER > 13009037)) || ((defined(_M_AMD64) || defined(_M_IA64)) && (_MSC_FULL_VER > 13009175)) return _byteswap_ushort(x); #else ASSERT(x <= 0xffff); return (x << 8) | (x >> 8); #endif } #define NET_TO_HOST_SHORT(Val) NET_SHORT(Val) #define HOST_TO_NET_SHORT(Val) NET_SHORT(Val) #ifdef NET_LONG #undef NET_LONG #endif __inline ULONG FASTCALL NET_LONG(ULONG x) { #if (defined(_M_IX86) && (_MSC_FULL_VER > 13009037)) || ((defined(_M_AMD64) || defined(_M_IA64)) && (_MSC_FULL_VER > 13009175)) return _byteswap_ulong(x); #else REGISTER ULONG BytesSwapped; BytesSwapped = ((x & 0x00ff00ff) << 8) | ((x & 0xff00ff00) >> 8); return (BytesSwapped << 16) | (BytesSwapped >> 16); #endif } #define NET_TO_HOST_LONG(Val) NET_LONG(Val) #define HOST_TO_NET_LONG(Val) NET_LONG(Val) #define IPSEC_100NS_FACTOR 10000000 #define IPSEC_CONVERT_SECS_TO_100NS(_li, _delta) { \ (_li).LowPart = _delta; \ (_li) = EXTENDED_MULTIPLY(_li, IPSEC_100NS_FACTOR); \ } #define IS_CLASSD(i) (((long)(i) & 0xf0000000) == 0xe0000000) // // Check SA against Lifetime information - we try to anticipate in advance if the // SA is going to expire and start off a re-key so that when it actually does expire, // we have the new SA setup. // // // IPSEC_EXPIRE_TIME_PAD is the time before expiration when we start re-keying // #define IPSEC_EXPIRE_TIME_PAD_I (75 * IPSEC_100NS_FACTOR) #define IPSEC_EXPIRE_TIME_PAD_R (40 * IPSEC_100NS_FACTOR) #define IPSEC_EXPIRE_TIME_PAD_OAKLEY (1 * IPSEC_100NS_FACTOR) // // IPSEC_INBOUND_KEEPALIVE_TIME is the time an expired inboundSA will be kept // alive in the driver // #define IPSEC_INBOUND_KEEPALIVE_TIME (60) // // IPSEC_MAX_EXPIRE_TIME is the maximum phase-2 lifetime allowed in driver // #define IPSEC_MAX_EXPIRE_TIME (48 * 3600 - 1) // // IPSEC_MIN_EXPIRE_TIME is the minimum phase-2 lifetime allowed in driver // #define IPSEC_MIN_EXPIRE_TIME (60) #define IPSEC_EXPIRE_THRESHOLD_I (50) #define IPSEC_EXPIRE_THRESHOLD_R (75) // // skew the initiator and responder with Pads // #define IPSEC_DEFAULT_SA_IDLE_TIME_PAD_I 0 #define IPSEC_DEFAULT_SA_IDLE_TIME_PAD_R 30 // // The # of packets before which we start reneg. because of replay rollover // 1M bytes / 1500 packets // #define IPSEC_EXPIRE_REPLAY_MASK (0x80000000) #define MAX_ULONG ((ULONG) -1) #define MAX_LONG (0x7fffffff) // // Some constants used for POST_EXPIRE_NOTIFY // #define IPSEC_INVALID_SPI 0 #define IPSEC_INVALID_ADDR (-1) // // Check the lifetime (kbytes and seconds) and replay rollover. // FALSE => expired // #define IPSEC_CHECK_PADDED_LIFETIME(__pSA, _status, _index) { \ LARGE_INTEGER __curtime; \ (_status) = TRUE; \ if (((__pSA)->sa_ReplaySendSeq[0] & \ IPSEC_EXPIRE_REPLAY_MASK) && \ ((__pSA)->sa_Flags & FLAGS_SA_OUTBOUND)) { \ _status = FALSE; \ } else { \ KeQuerySystemTime(&__curtime); \ if (((__pSA)->sa_KeyExpirationTimeWithPad.QuadPart > 0i64) && \ ((__pSA)->sa_KeyExpirationTimeWithPad.QuadPart < __curtime.QuadPart)) {\ _status = FALSE; \ } else if (((__pSA)->sa_KeyExpirationBytesWithPad.QuadPart > 0i64) && \ ((__pSA)->sa_KeyExpirationBytesWithPad.QuadPart < (__pSA)->sa_TotalBytesTransformed.QuadPart)) { \ _status = FALSE; \ } \ } \ } #define IPSEC_CHECK_LIFETIME(__pSA, _status, _index) { \ LARGE_INTEGER __curtime; \ (_status) = TRUE; \ if ((__pSA)->sa_ReplaySendSeq[_index] == MAX_ULONG) { \ _status = FALSE; \ } else { \ KeQuerySystemTime(&__curtime); \ if (((__pSA)->sa_KeyExpirationTime.QuadPart > 0i64) && \ ((__pSA)->sa_KeyExpirationTime.QuadPart < __curtime.QuadPart)) { \ _status = FALSE; \ } else if (((__pSA)->sa_KeyExpirationBytes.QuadPart > 0i64) && \ ((__pSA)->sa_KeyExpirationBytes.QuadPart < (__pSA)->sa_TotalBytesTransformed.QuadPart)) { \ _status = FALSE; \ } \ } \ } #define IPSEC_SA_EXPIRED(__pSA, __fexpired) { \ LARGE_INTEGER __curtime; \ KeQuerySystemTime(&__curtime); \ (__fexpired) = FALSE; \ __curtime.QuadPart -= pSA->sa_LastUsedTime.QuadPart;\ if (__pSA->sa_IdleTime.QuadPart < __curtime.QuadPart) { \ __fexpired = TRUE; \ } \ } // // Max tolerated collisions when trying to allocate SPIs. // #define MAX_SPI_RETRIES 50 #define IPSEC_SPI_TO_ENTRY(_spi, _entry, _dst) { \ KIRQL kIrql; \ AcquireReadLock(&g_ipsec.SPIListLock, &kIrql); \ *(_entry) = IPSecLookupSABySPIWithLock(_spi, _dst); \ if (*(_entry)) { \ IPSecRefSA((*(_entry))); \ } \ ReleaseReadLock(&g_ipsec.SPIListLock, kIrql); \ } // // Generic memory allocators // #define IPSecAllocatePktInfo(__tag) \ IPSecAllocateMemory(sizeof(NDIS_IPSEC_PACKET_INFO), __tag) #define IPSecFreePktInfo(__p) \ IPSecFreeMemory(__p) #define IPSecAllocatePktExt(__tag) \ IPSecAllocateMemory(sizeof(NDIS_IPSEC_PACKET_INFO), __tag) #define IPSecFreePktExt(__p) \ IPSecFreeMemory(__p) #define IPSecAllocateBuffer(_ntstatus, _ppBuf, _ppData, _size, _tag) { \ PIPSEC_LA_BUFFER __labuf; \ *(_ntstatus) = STATUS_SUCCESS; \ __labuf = IPSecGetBuffer(_size, _tag); \ if (__labuf) { \ if (ARGUMENT_PRESENT(_ppData)) { \ *(PVOID *)(_ppData) = __labuf->Buffer; \ } \ *(_ppBuf) = __labuf->Mdl; \ NdisAdjustBufferLength(__labuf->Mdl, _size); \ NDIS_BUFFER_LINKAGE(__labuf->Mdl) = NULL; \ } else { \ *(_ntstatus) = STATUS_INSUFFICIENT_RESOURCES; \ } \ } #define IPSecFreeBuffer(_ntstatus, _pBuf) { \ PIPSEC_LA_BUFFER __buffer; \ *(_ntstatus) = STATUS_SUCCESS; \ __buffer = CONTAINING_RECORD((_pBuf), IPSEC_LA_BUFFER, Data); \ IPSecReturnBuffer(__buffer); \ } #define IPSecAllocateSendCompleteCtx(__tag) \ ExAllocateFromNPagedLookasideList(&g_ipsec.IPSecLookasideLists->SendCompleteCtxList) #define IPSecFreeSendCompleteCtx(_buffer) \ ExFreeToNPagedLookasideList(&g_ipsec.IPSecLookasideLists->SendCompleteCtxList, _buffer); \ IPSEC_DECREMENT(g_ipsec.NumSends); #define IPSEC_GET_TOTAL_LEN(_pbuf, _plen) { \ PNDIS_BUFFER _ptemp = (PNDIS_BUFFER)(_pbuf); \ *(_plen) = 0; \ while (_ptemp) { \ *(_plen) += _ptemp->ByteCount; \ _ptemp = NDIS_BUFFER_LINKAGE(_ptemp); \ } \ } #define IPSEC_GET_TOTAL_LEN_RCV_BUF(_pbuf, _plen) { \ IPRcvBuf *_ptemp = (_pbuf); \ *(_plen) = 0; \ while (_ptemp) { \ *(_plen) += _ptemp->ipr_size; \ _ptemp = IPSEC_BUFFER_LINKAGE(_ptemp); \ } \ } // // Copy len bytes from RcvBuf chain to mdl (only one MDL) // #define IPSEC_COPY_FROM_RCVBUF(_pMdl, _pRcvBuf, _len, _offset) { \ IPRcvBuf *__pBuf=(_pRcvBuf); \ PMDL __pMdl=(_pMdl); \ ULONG __srclen; \ ULONG __destlen; \ ULONG __totallen=0; \ PUCHAR __pSrc; \ PUCHAR __pDest; \ ULONG __curroffset = (_offset); \ IPSecQueryNdisBuf(__pMdl, &__pDest, &__destlen); \ while (__pBuf) { \ IPSecQueryRcvBuf(__pBuf, &__pSrc, &__srclen); \ if (__srclen > __curroffset) { \ RtlCopyMemory(__pDest, __pSrc+__curroffset, __srclen-__curroffset); \ __pDest += (__srclen - __curroffset); \ __totallen += (__srclen - __curroffset); \ } \ __curroffset = 0; \ __pBuf = IPSEC_BUFFER_LINKAGE(__pBuf); \ } \ ASSERT(__totallen == __destlen); \ } // // Copy len bytes from Ndis Buffer chain to mdl (only one MDL) // #define IPSEC_COPY_FROM_NDISBUF(_pMdl, _pRcvBuf, _len, _offset) { \ NDIS_BUFFER *__pBuf=(_pRcvBuf); \ PMDL __pMdl=(_pMdl); \ ULONG __srclen; \ ULONG __destlen; \ ULONG __totallen=0; \ PUCHAR __pSrc; \ PUCHAR __pDest; \ ULONG __curroffset = (_offset); \ IPSecQueryNdisBuf(__pMdl, &__pDest, &__destlen); \ while (__pBuf) { \ IPSecQueryNdisBuf(__pBuf, &__pSrc, &__srclen); \ if (__srclen > __curroffset) { \ RtlCopyMemory(__pDest, __pSrc+__curroffset, __srclen-__curroffset); \ __pDest += (__srclen - __curroffset); \ __totallen += (__srclen - __curroffset); \ } \ __curroffset = 0; \ __pBuf = NDIS_BUFFER_LINKAGE(__pBuf); \ } \ ASSERT(__totallen == __destlen); \ } #define IPSecAllocateMemory(_size, _tag) \ ExAllocatePoolWithTag (NonPagedPool, _size, _tag) #define IPSecAllocateMemoryLowPriority(_size, _tag) \ ExAllocatePoolWithTagPriority (NonPagedPool, _size, _tag, LowPoolPriority) #define IPSecFreeMemory(_addr) ExFreePool (_addr) #define IPSecQueryNdisBuf(_Buffer, _VirtualAddress, _Length) \ { \ PNDIS_BUFFER __Mdl = (PNDIS_BUFFER) (_Buffer); \ if (ARGUMENT_PRESENT(_VirtualAddress)) { \ *(PVOID *)(_VirtualAddress) = (__Mdl)->MappedSystemVa; \ } \ *(_Length) = (__Mdl)->ByteCount; \ } #define IPSecQueryRcvBuf(_Buffer, _VirtualAddress, _Length) \ { \ IPRcvBuf *__buf = (IPRcvBuf *) (_Buffer); \ if (ARGUMENT_PRESENT(_VirtualAddress)) { \ *(PVOID *)(_VirtualAddress) = (__buf)->ipr_buffer; \ } \ *(_Length) = (__buf)->ipr_size; \ } #define IPSEC_ADJUST_BUFFER_LEN(_pBuf, _len) \ ((IPRcvBuf *)(_pBuf))->ipr_size = (_len) #define IPSEC_ADJUST_BUFFER(_pBuf, _offset) \ ((IPRcvBuf *)(_pBuf))->ipr_buffer += (_offset) #define IPSEC_ADJUST_BUFFER_RCVOFFSET(_pBuf, _offset) \ ((IPRcvBuf *)(_pBuf))->ipr_RcvOffset += (_offset) #define IPSEC_BUFFER_LINKAGE(_pBuf) \ ((IPRcvBuf *)(_pBuf))->ipr_next #define IPSEC_BUFFER_LEN(_pBuf) \ ((IPRcvBuf *)(_pBuf))->ipr_size #define IPSEC_BUFFER_OWNER(_pBuf) \ (((IPRcvBuf *)(_pBuf))->ipr_owner) #define IPSEC_SET_OFFSET_IN_BUFFER(_pBuf, _offset) { \ PUCHAR _p; \ LONG _len; \ IPSecQueryRcvBuf((_pBuf), &(_p), &(_len)); \ if ((_offset) > 0 && (_offset) < (_len)) { \ if (IPSEC_BUFFER_OWNER(_pBuf) == IPR_OWNER_FIREWALL) { \ IPSecMoveMemory((_p), (_p) + (_offset), (_len) - (_offset));\ } else { \ IPSEC_ADJUST_BUFFER((_pBuf), (_offset)); \ IPSEC_ADJUST_BUFFER_RCVOFFSET((_pBuf), (_offset)); \ } \ IPSEC_ADJUST_BUFFER_LEN((_pBuf), (_len) - (_offset)); \ } else { \ ASSERT(FALSE); \ return STATUS_INVALID_PARAMETER; \ } \ } #define IPSEC_ADD_VALUE(_val, _inc) InterlockedExchangeAdd((PULONG)&(_val), _inc) #define IPSEC_INCREMENT(_val) InterlockedIncrement(&(_val)) #define IPSEC_DECREMENT(_val) InterlockedDecrement(&(_val)) #define IPSEC_GET_VALUE(_val) InterlockedExchangeAdd((PULONG)&(_val), 0) #define IPSEC_SET_VALUE(_target, _val) \ InterlockedExchange((PULONG)&(_target), _val) #define IPSEC_DRIVER_IS_EMPTY() (g_ipsec.NumPolicies == 0) #define IPSEC_DRIVER_IS_INACTIVE() (g_ipsec.DriverUnloading || !g_ipsec.InitTcpip) #define IPSEC_DRIVER_UNLOADING() (g_ipsec.DriverUnloading) #define IPSEC_DRIVER_BOUND() (g_ipsec.BoundToIP) #define IPSEC_DRIVER_SEND_BOUND() (g_ipsec.SendBoundToIP) #define IPSEC_DRIVER_INIT_CRYPTO() (g_ipsec.InitCrypto) #define IPSEC_DRIVER_INIT_RNG() (g_ipsec.InitRNG) #define IPSEC_DRIVER_INIT_TCPIP() (g_ipsec.InitTcpip) #if FIPS #define IPSEC_DRIVER_INIT_FIPS() (g_ipsec.InitFips) #endif #if GPC #define IPSEC_DRIVER_INIT_GPC() (g_ipsec.InitGpc) #endif #if DBG #define IPSecRemoveEntryList(_x) \ { \ RemoveEntryList(_x); \ (_x)->Flink = (_x)->Blink = (PLIST_ENTRY)__LINE__; \ } #else #define IPSecRemoveEntryList(_x) RemoveEntryList(_x) #endif // // macros for filter list management // #define IS_TRANSPORT_FILTER(f) (!(f)->TunnelFilter) #define IS_TUNNEL_FILTER(f) ((f)->TunnelFilter) #define IS_INBOUND_FILTER(f) ((f)->Flags & FILTER_FLAGS_INBOUND) #define IS_OUTBOUND_FILTER(f) ((f)->Flags & FILTER_FLAGS_OUTBOUND) #define IS_EXEMPT_FILTER(f) (((f)->Flags & FILTER_FLAGS_DROP) || ((f)->Flags & FILTER_FLAGS_PASS_THRU)) #define IS_MULTICAST_FILTER(f) (IS_CLASSD(NET_LONG((f)->SRC_ADDR)) || \ IS_CLASSD(NET_LONG((f)->DEST_ADDR))) __inline PLIST_ENTRY IPSecResolveFilterList( IN BOOLEAN fTunnel, IN BOOLEAN fOutbound ) { PLIST_ENTRY pEntry; if (fTunnel) { if (fOutbound) { pEntry = &g_ipsec.FilterList[OUTBOUND_TUNNEL_FILTER]; } else { pEntry = &g_ipsec.FilterList[INBOUND_TUNNEL_FILTER]; } } else { if (fOutbound) { pEntry = &g_ipsec.FilterList[OUTBOUND_TRANSPORT_FILTER]; } else { pEntry = &g_ipsec.FilterList[INBOUND_TRANSPORT_FILTER]; } } return pEntry; } // // Filter/SA Cache Table // #define CacheMatch(uliAddr, uliPort, pInCache) \ ((uliAddr).QuadPart == pInCache->uliSrcDstAddr.QuadPart) && \ ((uliPort).QuadPart == pInCache->uliProtoSrcDstPort.QuadPart) #define IS_VALID_CACHE_ENTRY(_entry) ((_entry)->pFilter != NULL) #define INVALIDATE_CACHE_ENTRY(_entry) \ { \ ((PFILTER_CACHE)(_entry))->pSAEntry = NULL; \ ((PFILTER_CACHE)(_entry))->pNextSAEntry = NULL; \ } \ __inline ULONG FASTCALL CalcCacheIndex( IN IPAddr SrcAddr, IN IPAddr DestAddr, IN UCHAR Protocol, IN USHORT SrcPort, IN USHORT DestPort, IN BOOLEAN fOutbound ) { REGISTER ULONG dwIndex; REGISTER ULONG Address; REGISTER USHORT Port; Address = SrcAddr ^ DestAddr; Port = SrcPort ^ DestPort; dwIndex = NET_TO_HOST_LONG(Address); dwIndex += Protocol; dwIndex += NET_TO_HOST_SHORT(Port); dwIndex %= g_ipsec.CacheHalfSize; if (fOutbound) { dwIndex += g_ipsec.CacheHalfSize; } return dwIndex; } __inline VOID CacheUpdate( IN ULARGE_INTEGER uliAddr, IN ULARGE_INTEGER uliPort, IN PVOID _pCtxt1, IN PVOID _pCtxt2, IN ULONG dwId, IN BOOLEAN fFilter ) { PFILTER_CACHE __pCache; PFILTER_CACHE __pTempCache; PFILTER __pFilter; PSA_TABLE_ENTRY __pSA; PSA_TABLE_ENTRY __pNextSA; __pCache = g_ipsec.ppCache[(dwId)]; if (IS_VALID_CACHE_ENTRY(__pCache)) { if (__pCache->FilterEntry) { __pCache->pFilter->FilterCache = NULL; } else { __pCache->pSAEntry->sa_FilterCache = NULL; if (__pCache->pNextSAEntry) { __pCache->pNextSAEntry->sa_FilterCache = NULL; __pCache->pNextSAEntry = NULL; } } } if (fFilter) { __pFilter = (PFILTER)(_pCtxt1); if (__pFilter->FilterCache) { INVALIDATE_CACHE_ENTRY(__pFilter->FilterCache); __pFilter->FilterCache = NULL; } __pCache->uliSrcDstAddr = (uliAddr); __pCache->uliProtoSrcDstPort = (uliPort); __pCache->FilterEntry = TRUE; __pCache->pFilter = __pFilter; __pFilter->FilterCache = __pCache; } else { __pSA = (PSA_TABLE_ENTRY)(_pCtxt1); __pNextSA = (PSA_TABLE_ENTRY)(_pCtxt2); if ((__pTempCache = __pSA->sa_FilterCache)) { __pTempCache->pSAEntry->sa_FilterCache = NULL; if (__pTempCache->pNextSAEntry) { __pTempCache->pNextSAEntry->sa_FilterCache = NULL; } INVALIDATE_CACHE_ENTRY(__pTempCache); } if (__pNextSA && (__pTempCache = __pNextSA->sa_FilterCache)) { __pTempCache->pSAEntry->sa_FilterCache = NULL; if (__pTempCache->pNextSAEntry) { __pTempCache->pNextSAEntry->sa_FilterCache = NULL; } INVALIDATE_CACHE_ENTRY(__pTempCache); } __pCache->uliSrcDstAddr = (uliAddr); __pCache->uliProtoSrcDstPort = (uliPort); __pCache->FilterEntry = FALSE; __pCache->pSAEntry = __pSA; __pSA->sa_FilterCache = __pCache; if (__pNextSA) { __pCache->pNextSAEntry = __pNextSA; __pNextSA->sa_FilterCache = __pCache; } } } __inline VOID IPSecInvalidateSACacheEntry( IN PSA_TABLE_ENTRY pSA ) { PFILTER_CACHE pCache; pCache = pSA->sa_FilterCache; if (pCache) { ASSERT(IS_VALID_CACHE_ENTRY(pCache)); ASSERT(pSA == pCache->pSAEntry || pSA == pCache->pNextSAEntry); pCache->pSAEntry->sa_FilterCache = NULL; if (pCache->pNextSAEntry) { pCache->pNextSAEntry->sa_FilterCache = NULL; } INVALIDATE_CACHE_ENTRY(pCache); } } __inline VOID IPSecInvalidateFilterCacheEntry( IN PFILTER pFilter ) { PFILTER_CACHE pCache; pCache = pFilter->FilterCache; if (pCache) { ASSERT(IS_VALID_CACHE_ENTRY(pCache)); ASSERT(IS_EXEMPT_FILTER(pFilter)); pFilter->FilterCache = NULL; INVALIDATE_CACHE_ENTRY(pCache); } } __inline VOID IPSecStartSATimer( IN PSA_TABLE_ENTRY pSA, IN IPSEC_TIMEOUT_HANDLER TimeoutHandler, IN ULONG SecondsToGo ) { if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) { if (IPSecStopTimer(&pSA->sa_Timer)) { IPSecStartTimer(&pSA->sa_Timer, TimeoutHandler, SecondsToGo, (PVOID)pSA); } } else { pSA->sa_Flags |= FLAGS_SA_TIMER_STARTED; IPSecStartTimer(&pSA->sa_Timer, TimeoutHandler, SecondsToGo, (PVOID)pSA); } } __inline VOID IPSecStopSATimer( IN PSA_TABLE_ENTRY pSA ) { if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) { pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED; IPSecStopTimer(&pSA->sa_Timer); } } __inline VOID IPSecStopTimerDerefSA( IN PSA_TABLE_ENTRY pSA ) { if (pSA->sa_Flags & FLAGS_SA_TIMER_STARTED) { if (IPSecStopTimer(&pSA->sa_Timer)) { pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED; IPSecDerefSA(pSA); } } else { IPSecDerefSA(pSA); } } __inline VOID IPSecDerefSANextSA( IN PSA_TABLE_ENTRY pSA, IN PSA_TABLE_ENTRY pNextSA ) { if (pNextSA) { IPSecDerefSA(pNextSA); } IPSecDerefSA(pSA); } __inline VOID IPSecRemoveSPIEntry( IN PSA_TABLE_ENTRY pSA ) { if (pSA->sa_Flags & FLAGS_SA_ON_SPI_HASH) { IPSecRemoveEntryList(&pSA->sa_SPILinkage); pSA->sa_Flags &= ~FLAGS_SA_ON_SPI_HASH; } } // // Packs the src/dest IP addrs in a large integer // #define IPSEC_BUILD_SRC_DEST_ADDR(_li, _src, _dest) { \ (_li).LowPart = _src; \ (_li).HighPart = _dest; \ } #define IPSEC_BUILD_SRC_DEST_MASK IPSEC_BUILD_SRC_DEST_ADDR // // Packs the Proto and Src/Dest ports into a large int // // // Ports make sense only for TCP and UDP // // // TCP/UDP header // 0 15 16 31 // |----|----|----|----|----|----|----|----| // | Source Port | Dst Port | // #define IPSEC_BUILD_PROTO_PORT_LI(_li, _proto, _sport, _dport) { \ (_li).LowPart = \ MAKELONG(MAKEWORD((_proto),0x00),0x0000); \ switch((_li).LowPart) { \ case 6: \ case 17: { \ (_li).HighPart = MAKELONG((_sport),(_dport)); \ break; \ } \ default: { \ (_li).HighPart = 0x00000000; \ break; \ } \ } \ } #define IPSecRefFilter(__pfilter) IPSEC_INCREMENT((__pfilter)->Reference) #define IPSecFreeFilter(__pfilter) IPSecFreeMemory(__pfilter) #define IPSecDerefFilter(__pfilter) \ { \ if (IPSEC_DECREMENT((__pfilter)->Reference) == 0) { \ IPSecFreeFilter(__pfilter); \ } \ } #define IPSecAllocateKeyBuffer(_size) IPSecAllocateMemory(_size, IPSEC_TAG_KEY) #define IPSecFreeKeyBuffer(_key) IPSecFreeMemory(_key) #define IPSecAllocateLogBuffer(_size) IPSecAllocateMemory(_size, IPSEC_TAG_LOG) #define IPSecFreeLogBuffer(_key) IPSecFreeMemory(_key) #define IPSecFreeSA(_sa) { \ LONG _i; \ for (_i=0; _i<(_sa)->sa_NumOps; _i++) { \ if ((_sa)->INT_KEY(_i)) { \ IPSecFreeKeyBuffer((_sa)->INT_KEY(_i)); \ } \ if ((_sa)->CONF_KEY(_i)) { \ IPSecFreeKeyBuffer((_sa)->CONF_KEY(_i));\ } \ } \ IPSecFreeMemory(_sa); \ } #define IPSecGetAcquireContext() IPSecAllocateMemory(sizeof(IPSEC_ACQUIRE_CONTEXT), IPSEC_TAG_ACQUIRE_CTX) #define IPSecFreeAcquireContext(_ctx) IPSecFreeMemory(_ctx) #define IPSecGetNotifyExpire() IPSecAllocateMemory(sizeof(IPSEC_NOTIFY_EXPIRE), IPSEC_TAG_ACQUIRE_CTX) // // Hashes // #define IPSEC_HASH_SPI(_dest, _spi, _phash) { \ DWORD dwIndex; \ dwIndex = NET_TO_HOST_LONG(_dest) + (_spi); \ dwIndex %= g_ipsec.SAHashSize; \ pHash = &g_ipsec.pSADb[dwIndex]; \ IPSEC_DEBUG(ALL, ("SPI: Index: %lx for S: %lx, D: %lx, pHash: %lx\n", \ dwIndex, \ (_spi), \ (_dest), \ pHash)); \ } // // Hashes // #define IPSEC_HASH_ADDR(_src, _dest,_phash) { \ DWORD dwIndex; \ dwIndex = (_src)+(_dest); \ dwIndex %= g_ipsec.SpFilterHashSize; \ pHash = &g_ipsec.pSpFilter[dwIndex]; \ IPSEC_DEBUG(ALL, ("ADDR: Index: %lx for S: %lx, D: %lx, pHash: %lx\n", \ dwIndex, \ (_src), \ (_dest), \ pHash)); \ } #define SRC_ADDR uliSrcDstAddr.LowPart #define DEST_ADDR uliSrcDstAddr.HighPart #define SRC_MASK uliSrcDstMask.LowPart #define DEST_MASK uliSrcDstMask.HighPart #define PROTO uliProtoSrcDstPort.LowPart #define SRC_PORT LOWORD(uliProtoSrcDstPort.HighPart) #define DEST_PORT HIWORD(uliProtoSrcDstPort.HighPart) #define FI_SRC_PORT(_filter) LOWORD((_filter)->uliProtoSrcDstPort.HighPart) #define FI_DEST_PORT(_filter) HIWORD((_filter)->uliProtoSrcDstPort.HighPart) #define SA_SRC_ADDR sa_uliSrcDstAddr.LowPart #define SA_DEST_ADDR sa_uliSrcDstAddr.HighPart #define SA_SRC_MASK sa_uliSrcDstMask.LowPart #define SA_DEST_MASK sa_uliSrcDstMask.HighPart #define SA_PROTO sa_uliProtoSrcDstPort.LowPart #define SA_SRC_PORT(_psa) LOWORD((_psa)->sa_uliProtoSrcDstPort.HighPart) #define SA_DEST_PORT(_psa) HIWORD((_psa)->sa_uliProtoSrcDstPort.HighPart) #define FILTER_PROTO(ProtoId) MAKELONG(MAKEWORD((ProtoId),0x00),0x00000) #define FILTER_PROTO_ANY FILTER_PROTO(0x00) #define FILTER_PROTO_ICMP FILTER_PROTO(0x01) #define FILTER_PROTO_TCP FILTER_PROTO(0x06) #define FILTER_PROTO_UDP FILTER_PROTO(0x11) #define FILTER_TCPUDP_PORT_ANY (WORD)0x0000 #define FILTER_ICMP_TYPE_ANY (BYTE)0xff #define FILTER_ICMP_CODE_ANY (BYTE)0xff #define FILTER_MASK_ALL (DWORD)0xffffffff #define FILTER_MASK_NONE (DWORD)0x00000000 // // macros to parse the ALGORITHM structure // #define INT_ALGO(_i) sa_Algorithm[_i].integrityAlgo.algoIdentifier #define INT_KEY(_i) sa_Algorithm[_i].integrityAlgo.algoKey #define INT_KEYLEN(_i) sa_Algorithm[_i].integrityAlgo.algoKeylen #define INT_ROUNDS(_i) sa_Algorithm[_i].integrityAlgo.algoRounds #define CONF_ALGO(_i) sa_Algorithm[_i].confAlgo.algoIdentifier #define CONF_KEY(_i) sa_Algorithm[_i].confAlgo.algoKey #define CONF_KEYLEN(_i) sa_Algorithm[_i].confAlgo.algoKeylen #define CONF_ROUNDS(_i) sa_Algorithm[_i].confAlgo.algoRounds #define COMP_ALGO(_i) sa_Algorithm[_i].compAlgo.algoIdentifier #define EXT_INT_ALGO IntegrityAlgo.algoIdentifier #define EXT_INT_KEY IntegrityAlgo.algoKey #define EXT_INT_KEYLEN IntegrityAlgo.algoKeylen #define EXT_INT_ROUNDS IntegrityAlgo.algoRounds #define EXT_CONF_ALGO ConfAlgo.algoIdentifier #define EXT_CONF_KEY ConfAlgo.algoKey #define EXT_CONF_KEYLEN ConfAlgo.algoKeylen #define EXT_CONF_ROUNDS ConfAlgo.algoRounds #define EXT_INT_ALGO_EX(_i) AlgoInfo[_i].IntegrityAlgo.algoIdentifier #define EXT_INT_KEYLEN_EX(_i) AlgoInfo[_i].IntegrityAlgo.algoKeylen #define EXT_INT_ROUNDS_EX(_i) AlgoInfo[_i].IntegrityAlgo.algoRounds #define EXT_CONF_ALGO_EX(_i) AlgoInfo[_i].ConfAlgo.algoIdentifier #define EXT_CONF_KEYLEN_EX(_i) AlgoInfo[_i].ConfAlgo.algoKeylen #define EXT_CONF_ROUNDS_EX(_i) AlgoInfo[_i].ConfAlgo.algoRounds #define IS_AH_SA(_psa) ((_psa)->sa_Operation[0] == Auth || \ (_psa)->sa_Operation[1] == Auth || \ (_psa)->sa_Operation[2] == Auth) #define IS_ESP_SA(_psa) ((_psa)->sa_Operation[0] == Encrypt || \ (_psa)->sa_Operation[1] == Encrypt || \ (_psa)->sa_Operation[2] == Encrypt) // // Increment/decrement statistics // #define IPSEC_INC_STATISTIC(_stat) \ (g_ipsec.Statistics.##_stat)++; #define IPSEC_DEC_STATISTIC(_stat) \ (g_ipsec.Statistics.##_stat)--; #define IPSEC_INC_TUNNELS(_pSA) { \ if ((_pSA)->sa_Flags & FLAGS_SA_TUNNEL) \ g_ipsec.Statistics.dwNumActiveTunnels++; \ } #define IPSEC_DEC_TUNNELS(_pSA) { \ if ((_pSA)->sa_Flags & FLAGS_SA_TUNNEL) \ g_ipsec.Statistics.dwNumActiveTunnels--; \ } // // Macro to read a dword from registry and init the variable passed in. // #define IPSEC_REG_READ_DWORD(_hRegKey, _param, _var, _def, _max, _min) { \ NTSTATUS __status; \ __status = GetRegDWORDValue(_hRegKey, \ _param, \ (_var)); \ \ if (!NT_SUCCESS(__status)) { \ *(_var) = _def; \ } else if (*(_var) > _max) { \ *(_var) = _max; \ } else if (*(_var) <= _min) { \ *(_var) = _min; \ } \ } // // Macro for computing incremental checksum (RFC 1624) // #define UpdateIPLength(_piph, _length) \ { \ ULONG _sum; \ USHORT _old; \ \ _old = NET_SHORT((_piph)->iph_length); \ (_piph)->iph_length = (_length); \ _sum = (~NET_SHORT((_piph)->iph_xsum) & 0xffff) + \ (~_old & 0xffff) + \ NET_SHORT((_piph)->iph_length); \ _sum = (_sum & 0xffff) + (_sum >> 16); \ _sum += (_sum >> 16); \ (_piph)->iph_xsum = NET_SHORT((USHORT)(~_sum & 0xffff)); \ } #define UpdateIPProtocol(_piph, _proto) \ { \ ULONG _sum; \ USHORT _old; \ \ _old = NET_SHORT(*(USHORT *)&(_piph)->iph_ttl); \ (_piph)->iph_protocol = (_proto); \ _sum = (~NET_SHORT((_piph)->iph_xsum) & 0xffff) + \ (~_old & 0xffff) + \ NET_SHORT(*(USHORT *)&(_piph)->iph_ttl); \ _sum = (_sum & 0xffff) + (_sum >> 16); \ _sum += (_sum >> 16); \ (_piph)->iph_xsum = NET_SHORT((USHORT)(~_sum & 0xffff)); \ } #define IPSecPrint4Long(_key) \ DbgPrint("Key: %lx-%lx-%lx-%lx\n", \ *(ULONG *)&(_key)[0], \ *(ULONG *)&(_key)[4], \ *(ULONG *)&(_key)[8], \ *(ULONG *)&(_key)[12]); #define IPSEC_DELAY_INTERVAL ((LONGLONG)(-1 * 1000 * 1000)) // 1/10 sec. #define IPSEC_DELAY_EXECUTION() \ { \ IPSecDelayInterval.QuadPart = IPSEC_DELAY_INTERVAL; \ KeDelayExecutionThread(UserMode, FALSE, &IPSecDelayInterval); \ } #define IS_DRIVER_BLOCK() (g_ipsec.OperationMode == IPSEC_BLOCK_MODE) #define IS_DRIVER_BYPASS() (g_ipsec.OperationMode == IPSEC_BYPASS_MODE) #define IS_DRIVER_SECURE() (g_ipsec.OperationMode == IPSEC_SECURE_MODE) #define IS_DRIVER_DIAGNOSTIC() (g_ipsec.DiagnosticMode) #define LOG_EVENT NdisWriteEventLogEntry #define IPSEC_NULL_GUIDS "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" #define IPSEC_EQUAL_GUIDS(_A, _B) \ ((*(UNALIGNED ULONG *)((PUCHAR)(_A)) == *(UNALIGNED ULONG *)((PUCHAR)(_B))) && \ (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+4) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+4)) && \ (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+8) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+8)) && \ (*(UNALIGNED ULONG *)(((PUCHAR)(_A))+12) == *(UNALIGNED ULONG *)(((PUCHAR)(_B))+12))) // // Get the next non-zero length NDIS buffer. // __inline PNDIS_BUFFER FASTCALL IPSEC_NEXT_BUFFER( IN PNDIS_BUFFER pBuffer ) { PVOID *pDummy = NULL; ULONG Length = 0; if (!pBuffer) { ASSERT(FALSE); return NULL; } pBuffer = NDIS_BUFFER_LINKAGE(pBuffer); while (pBuffer) { IPSecQueryNdisBuf(pBuffer, &pDummy, &Length); if (Length == 0) { pBuffer = NDIS_BUFFER_LINKAGE(pBuffer); continue; } else { return pBuffer; } } return NULL; } #define SA_CHAIN_WIDTH 4 // // Count number of 1's in the IP mask // __inline LONG CountNumberOfOnes( IN IPMask IpMask ) { INT i; LONG NumberOfOnes = 0; IPMask Mask = IpMask; for (i = 0; i < sizeof(IPMask) * 8; i++) { if ((Mask & 0x1) == 0x1) { NumberOfOnes++; } Mask = Mask >> 1; } return NumberOfOnes; } __inline PLIST_ENTRY FASTCALL IPSecResolveSAChain( IN PFILTER pFilter, IN IPAddr IpAddr ) { PLIST_ENTRY pEntry; ULONG Index; if (IS_TUNNEL_FILTER(pFilter)) { pEntry = &pFilter->SAChain[0]; } else { Index = NET_TO_HOST_LONG(IpAddr) % pFilter->SAChainSize; pEntry = &pFilter->SAChain[Index]; } return pEntry; } #if GPC #define IPSEC_GPC_MASK_ALL (0xff) #define IPSEC_GPC_MASK_NONE (0x0) #define GPC_REGISTER_CLIENT g_ipsec.GpcEntries.GpcRegisterClientHandler #define GPC_DEREGISTER_CLIENT g_ipsec.GpcEntries.GpcDeregisterClientHandler #define GPC_ADD_CFINFO g_ipsec.GpcEntries.GpcAddCfInfoHandler #define GPC_REMOVE_CFINFO g_ipsec.GpcEntries.GpcRemoveCfInfoHandler #define GPC_ADD_PATTERN g_ipsec.GpcEntries.GpcAddPatternHandler #define GPC_REMOVE_PATTERN g_ipsec.GpcEntries.GpcRemovePatternHandler #define GPC_CLASSIFY_PATTERN g_ipsec.GpcEntries.GpcClassifyPatternHandler #define GPC_GET_CLIENT_CONTEXT g_ipsec.GpcEntries.GpcGetCfInfoClientContextHandler #define IPSEC_GPC_ACTIVE (0x12345678) #define IPSEC_NUM_GPC_FILTERS() (g_ipsec.NumMaskedFilters) #define IS_GPC_ACTIVE() (g_ipsec.GpcActive == IPSEC_GPC_ACTIVE) #define IPSEC_SET_GPC_ACTIVE() \ { \ g_ipsec.GpcActive = IPSEC_GPC_ACTIVE; \ } #define IPSEC_UNSET_GPC_ACTIVE() \ { \ g_ipsec.GpcActive = 0; \ } __inline INT FASTCALL IPSecResolveGpcCf( IN BOOLEAN fOutbound ) { return fOutbound? GPC_CF_IPSEC_OUT: GPC_CF_IPSEC_IN; } __inline PLIST_ENTRY FASTCALL IPSecResolveGpcFilterList( IN BOOLEAN fTunnel, IN BOOLEAN fOutbound ) { PLIST_ENTRY pEntry; if (fTunnel) { if (fOutbound) { pEntry = &g_ipsec.GpcFilterList[OUTBOUND_TUNNEL_FILTER]; } else { pEntry = &g_ipsec.GpcFilterList[INBOUND_TUNNEL_FILTER]; } } else { if (fOutbound) { pEntry = &g_ipsec.GpcFilterList[OUTBOUND_TRANSPORT_FILTER]; } else { pEntry = &g_ipsec.GpcFilterList[INBOUND_TRANSPORT_FILTER]; } } return pEntry; } __inline VOID IPSEC_CLASSIFY_PACKET( IN INT GpcCf, IN ULARGE_INTEGER uliSrcDstAddr, IN ULARGE_INTEGER uliProtoSrcDstPort, OUT PFILTER *ppFilter, OUT PCLASSIFICATION_HANDLE pGpcHandle ) { GPC_IP_PATTERN Pattern; *ppFilter = NULL; *pGpcHandle = 0; Pattern.SrcAddr = SRC_ADDR; Pattern.DstAddr = DEST_ADDR; Pattern.ProtocolId = (UCHAR)PROTO; if (PROTO == PROTOCOL_TCP || PROTO == PROTOCOL_UDP) { Pattern.gpcSrcPort = SRC_PORT; Pattern.gpcDstPort = DEST_PORT; } else { Pattern.gpcSrcPort = 0; Pattern.gpcDstPort = 0; } Pattern.InterfaceId.InterfaceId = 0; Pattern.InterfaceId.LinkId = 0; GPC_CLASSIFY_PATTERN( g_ipsec.GpcClients[GpcCf], GPC_PROTOCOL_TEMPLATE_IP, &Pattern, ppFilter, pGpcHandle, 0, NULL, TRUE); } #define IS_GPC_FILTER(f) (g_ipsec.InitGpc && \ f->SRC_MASK == FILTER_MASK_ALL && \ f->DEST_MASK == FILTER_MASK_ALL) #endif #if FIPS #define IPSEC_DES_ALGO FIPS_CBC_DES #define IPSEC_3DES_ALGO FIPS_CBC_3DES #define IPSEC_SHA_INIT g_ipsec.FipsFunctionTable.FipsSHAInit #define IPSEC_SHA_UPDATE g_ipsec.FipsFunctionTable.FipsSHAUpdate #define IPSEC_SHA_FINAL g_ipsec.FipsFunctionTable.FipsSHAFinal #define IPSEC_DES_KEY g_ipsec.FipsFunctionTable.FipsDesKey #define IPSEC_3DES_KEY g_ipsec.FipsFunctionTable.Fips3Des3Key #define IPSEC_CBC g_ipsec.FipsFunctionTable.FipsCBC #define IPSEC_GEN_RANDOM g_ipsec.FipsFunctionTable.FIPSGenRandom #define IPSEC_HMAC_SHA_INIT g_ipsec.FipsFunctionTable.FipsHmacSHAInit #define IPSEC_HMAC_SHA_UPDATE g_ipsec.FipsFunctionTable.FipsHmacSHAUpdate #define IPSEC_HMAC_SHA_FINAL g_ipsec.FipsFunctionTable.FipsHmacSHAFinal #define IPSEC_HMAC_MD5_INIT g_ipsec.FipsFunctionTable.HmacMD5Init #define IPSEC_HMAC_MD5_UPDATE g_ipsec.FipsFunctionTable.HmacMD5Update #define IPSEC_HMAC_MD5_FINAL g_ipsec.FipsFunctionTable.HmacMD5Final #else #define IPSEC_DES_ALGO des #define IPSEC_3DES_ALGO tripledes #define IPSEC_SHA_INIT A_SHAInit #define IPSEC_SHA_UPDATE A_SHAUpdate #define IPSEC_SHA_FINAL A_SHAFinal #define IPSEC_DES_KEY deskey #define IPSEC_3DES_KEY tripledes3key #define IPSEC_CBC(_EncryptionAlgo, _pOut, _pIn, _pKeyTable, _Operation, _pFeedback) \ CBC(_EncryptionAlgo, \ DES_BLOCKLEN, \ _pOut, \ _pIn, \ _pKeyTable, \ _Operation, \ _pFeedback) #define IPSEC_GEN_RANDOM(_pBuf, _KeySize) NewGenRandom(NULL, NULL, _pBuf, _KeySize) #endif #define IPSEC_MD5_INIT MD5Init #define IPSEC_MD5_UPDATE MD5Update #define IPSEC_MD5_FINAL MD5Final #define IPSEC_RC4_KEY rc4_key #define IPSEC_RC4 rc4 #define IS_CLASS_D_ADDR(x) (((x) & 0x000000f0) == 0x000000e0) #define DEFAULT_IPSEC_OPERATION_MODE IPSEC_BYPASS_MODE #define TCPIP_FREE_BUFF g_ipsec.TcpipFreeBuff #define TCPIP_ALLOC_BUFF g_ipsec.TcpipAllocBuff #define TCPIP_GET_ADDRTYPE g_ipsec.TcpipGetAddrType #define TCPIP_GET_INFO g_ipsec.TcpipGetInfo #define TCPIP_NDIS_REQUEST g_ipsec.TcpipNdisRequest #define TCPIP_REGISTER_PROTOCOL g_ipsec.TcpipRegisterProtocol #define TCPIP_SET_IPSEC_STATUS g_ipsec.TcpipSetIPSecStatus #define TCPIP_IP_TRANSMIT g_ipsec.TcpipIPTransmit #define TCPIP_SET_IPSEC g_ipsec.TcpipSetIPSecPtr #define TCPIP_UNSET_IPSEC g_ipsec.TcpipUnSetIPSecPtr #define TCPIP_UNSET_IPSEC_SEND g_ipsec.TcpipUnSetIPSecSendPtr #define TCPIP_TCP_XSUM g_ipsec.TcpipTCPXsum #define TCPIP_GEN_IPID g_ipsec.TcpipGenIpId #define TCPIP_DEREGISTER_PROTOCOL g_ipsec.TcpipDeRegisterProtocol #ifdef xsum #undef xsum #define xsum(Buffer, Length) ((USHORT)TCPIP_TCP_XSUM(0, (PUCHAR)(Buffer), (Length))) #endif #define SAFETY_LEN (TRUNCATED_HASH_LEN+MAX_PAD_LEN) // // Compares the src/dest ports out of a word with the number input // #define IPSEC_COMPARE_SD_PORT(_pport, _port) \ ( ((_pport)[0] == (_port)) || \ ((_pport)[1] == (_port))) #define IPSEC_COMPARE_D_PORT(_pport, _port) ((_pport)[1] == (_port)) // // Bypass traffic logic for IKE, Kerberos and RSVP // #define IPSEC_KERBEROS_TRAFFIC() \ ((pIPHeader->iph_protocol == PROTOCOL_UDP || \ pIPHeader->iph_protocol == PROTOCOL_TCP) && \ IPSEC_COMPARE_SD_PORT(pwPort, IPSEC_KERBEROS_PORT)) #define IPSEC_ISAKMP_TRAFFIC() \ (pIPHeader->iph_protocol == PROTOCOL_UDP && \ IPSEC_COMPARE_D_PORT(pwPort, IPSEC_ISAKMP_PORT)) \ #define IPSEC_RSVP_TRAFFIC() \ (pIPHeader->iph_protocol == PROTOCOL_RSVP) #define IPSEC_NO_UNICAST_EXEMPT 0x00000001 #define IPSEC_NO_MANDBCAST_EXEMPT 0x00000002 #define IPSEC_NO_DEFAULT_EXEMPT() (g_ipsec.NoDefaultExempt & IPSEC_NO_UNICAST_EXEMPT) #define IPSEC_HANDLE_MANDBCAST() (g_ipsec.NoDefaultExempt & IPSEC_NO_MANDBCAST_EXEMPT) #define IPSEC_MANDBCAST_PROCESS() (IPSEC_GET_VALUE(g_ipsec.NumMulticastFilters) || \ IPSEC_HANDLE_MANDBCAST()) #define IPSEC_BYPASS_TRAFFIC() \ (IPSEC_ISAKMP_TRAFFIC() || \ (!IPSEC_NO_DEFAULT_EXEMPT() && \ (IPSEC_KERBEROS_TRAFFIC() || \ IPSEC_RSVP_TRAFFIC()))) // // Forwarding path is either reinject a detunneled forward packet or route // #define IPSEC_FORWARD_PATH() (fFWPacket || (fOutbound && TCPIP_GET_ADDRTYPE(pIPHeader->iph_src) != DEST_LOCAL)) /*++ Routine Description: Fills in the DELETE_SA hw request from pSA Arguments: pSA - the SA Buf - buffer to set info Len - length Return Value: status of the operation --*/ #define IPSecFillHwDelSA(_pSA, _Buf, _Len) \ ((POFFLOAD_IPSEC_DELETE_SA)(_Buf))->OffloadHandle = (_pSA)->sa_OffloadHandle; #endif _MACROS_H