/* token_builder_context.c
 *
 * This is the main implementation module for the EIP-96 Token Builder.
 */

/*****************************************************************************
* Copyright (c) 2011-2022 by Rambus, Inc. and/or its subsidiaries.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 2 of the License, or
* any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*****************************************************************************/

/*----------------------------------------------------------------------------
 * This module implements (provides) the following interface(s):
 */
#include "token_builder.h"


/*----------------------------------------------------------------------------
 * This module uses (requires) the following interface(s):
 */
#include "c_token_builder.h"
#include "basic_defs.h"
#include "clib.h"
#include "log.h"
#include "sa_builder_params.h"
#include "sa_builder_params_ipsec.h"

#include "token_builder_internal.h"
#include "sa_builder_params.h"
#ifdef TKB_ENABLE_PROTO_IPSEC
#include "sa_builder_params_ipsec.h"
#endif
#ifdef TKB_ENABLE_PROTO_SSLTLS
#include "sa_builder_params_ssltls.h"
#endif
#ifdef TKB_ENABLE_PROTO_BASIC
#include "sa_builder_params_basic.h"
#endif
#ifdef TKB_ENABLE_PROTO_SRTP
#include "sa_builder_params_srtp.h"
#endif


/*----------------------------------------------------------------------------
 * Definitions and macros
 */


/*----------------------------------------------------------------------------
 * TokenBuilder_GetContextSize
 *
 * Determine the size of the token context record in 32-bit words, which may
 * depend on the SA parameters.
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure
 * TokenContextWord32Count_p (output)
 *   Required size of the Token Context Record in 32-bit words.
 *
 * Note: This implementation has one Token Context Record format with a fixed
 *       size. Therefore this function does not look at the SA parameters.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the input data structures are invalid.
 */
TokenBuilder_Status_t
TokenBuilder_GetContextSize(
    const SABuilder_Params_t * const SAParams_p,
    unsigned int * const TokenContextWord32Count_p
    )
{
#ifdef TKB_STRICT_ARGS_CHECK
    if (SAParams_p == NULL || TokenContextWord32Count_p == NULL)
    {
        LOG_CRIT("TokenBuilder_GetContextSize: NULL pointer supplied\n");
        return TKB_INVALID_PARAMETER;
    }
#endif
    *TokenContextWord32Count_p =
        ((unsigned int)sizeof(TokenBuilder_Context_t) +  sizeof(uint32_t) - 1) /
        sizeof(uint32_t);
    return TKB_STATUS_OK;
}


#ifdef TKB_ENABLE_PROTO_IPSEC
#ifdef TKB_ENABLE_EXTENDED_IPSEC
/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext_IPsec
 *
 * Fill in the context fields for extended IPsec operations.
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_Internal_p (output)
 *   Buffer to hold the Token Context Record.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
static TokenBuilder_Status_t
TokenBuilder_BuildContext_Extended(
    const SABuilder_Params_t * const SAParams_p,
    TokenBuilder_Context_t * const TokenContext_Internal_p)
{
    uint8_t HeaderProto;
    SABuilder_Params_IPsec_t *SAParamsIPsec_p;
    SAParamsIPsec_p = (SABuilder_Params_IPsec_t *)
        (SAParams_p->ProtocolExtension_p);
    if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
    {
        if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_IPV6) !=0)
        {
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_PROCESS_IP_HEADERS) !=0)
            {
                if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TUNNEL) !=0)
                {
                    HeaderProto = TKB_HDR_IPV6_OUT_TUNNEL;
                }
                else
                {
                    HeaderProto = TKB_HDR_IPV6_OUT_TRANSP;
                }
            }
            else
            {
                HeaderProto = TKB_HDR_IPV6_OUT_TRANSP_HDRBYPASS;
            }
        }
        else
        {
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_PROCESS_IP_HEADERS) !=0)
            {
                if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TUNNEL) !=0)
                {
                    HeaderProto = TKB_HDR_IPV4_OUT_TUNNEL;
                }
                else
                {
                    HeaderProto = TKB_HDR_IPV4_OUT_TRANSP;
                }
            }
            else
            {
                HeaderProto = TKB_HDR_IPV4_OUT_TRANSP_HDRBYPASS;
            }
        }

    }
    else
    {
        if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_IPV6) !=0)
        {
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_PROCESS_IP_HEADERS) !=0)
            {
                TokenContext_Internal_p->TokenHeaderWord |= TKB_HEADER_UPD_HDR;
                if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TUNNEL) !=0)
                {
                    HeaderProto = TKB_HDR_IPV6_IN_TUNNEL;
                }
                else
                {
                    HeaderProto = TKB_HDR_IPV6_IN_TRANSP;
                }
            }
            else
            {
                HeaderProto = TKB_HDR_IPV6_IN_TRANSP_HDRBYPASS;
            }
        }
        else
        {
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_PROCESS_IP_HEADERS) !=0)
            {
                TokenContext_Internal_p->TokenHeaderWord |= TKB_HEADER_UPD_HDR;
                if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TUNNEL) !=0)
                {
                    HeaderProto = TKB_HDR_IPV4_IN_TUNNEL;
                }
                else
                {
                    HeaderProto = TKB_HDR_IPV4_IN_TRANSP;
                }
            }
            else
            {
                HeaderProto = TKB_HDR_IPV4_IN_TRANSP_HDRBYPASS;
            }
        }

    }
    /* If NAT-T selected, select other header protocol range */
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_NATT) != 0)
        HeaderProto += (TKB_HDR_IPV4_OUT_TRANSP_HDRBYPASS_NATT -
                        TKB_HDR_IPV4_OUT_TRANSP_HDRBYPASS);

    TokenContext_Internal_p->hproto = HeaderProto;

    TokenContext_Internal_p->u.generic.TTL = SAParamsIPsec_p->TTL;
    TokenContext_Internal_p->u.generic.DSCP = SAParamsIPsec_p->DSCP;
    TokenContext_Internal_p->NATT_Ports =
        (SAParamsIPsec_p->NATTSrcPort >> 8) |
        ((SAParamsIPsec_p->NATTSrcPort & 0xff) << 8) |
        ((SAParamsIPsec_p->NATTDestPort & 0xff00) << 8) |
        ((SAParamsIPsec_p->NATTDestPort & 0xff) << 24 );

    TokenContext_Internal_p->u.generic.ESPFlags = 0;
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_CLEAR_DF) != 0)
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_CLEAR_DF;
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_SET_DF) != 0)
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_SET_DF;
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_REPLACE_DSCP) != 0)
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_REPLACE_DSCP;
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_CLEAR_ECN) != 0)
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_CLEAR_ECN;

    if (HeaderProto == TKB_HDR_IPV4_OUT_TUNNEL ||
        HeaderProto == TKB_HDR_IPV6_OUT_TUNNEL ||
        HeaderProto == TKB_HDR_IPV4_OUT_TUNNEL_NATT ||
        HeaderProto == TKB_HDR_IPV6_OUT_TUNNEL_NATT)
    {
        if (SAParamsIPsec_p->SrcIPAddr_p == NULL ||
            SAParamsIPsec_p->DestIPAddr_p == NULL)
        {
            LOG_CRIT("SABuilder: NULL pointer tunnel address.\n");
            return TKB_INVALID_PARAMETER;
        }
        if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_IPV4) != 0)
        {
            memcpy(TokenContext_Internal_p->TunnelIP,
                   SAParamsIPsec_p->SrcIPAddr_p,
                   4);
            memcpy(TokenContext_Internal_p->TunnelIP + 4,
                   SAParamsIPsec_p->DestIPAddr_p,
                   4);
        }
        else
        {
            memcpy(TokenContext_Internal_p->TunnelIP,
                   SAParamsIPsec_p->SrcIPAddr_p,
                   16);
            memcpy(TokenContext_Internal_p->TunnelIP + 16,
                   SAParamsIPsec_p->DestIPAddr_p,
                   16);
        }
    }
    else if ((HeaderProto == TKB_HDR_IPV4_OUT_TRANSP_NATT ||
              HeaderProto == TKB_HDR_IPV4_IN_TRANSP_NATT) &&
             (SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TRANSPORT_NAT) !=0)
    {
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_NAT;
        if (SAParamsIPsec_p->SrcIPAddr_p == NULL ||
            SAParamsIPsec_p->DestIPAddr_p == NULL)
        {
            LOG_CRIT("SABuilder: NULL pointer NAT address.\n");
            return TKB_INVALID_PARAMETER;
        }
        memcpy(TokenContext_Internal_p->TunnelIP,
               SAParamsIPsec_p->SrcIPAddr_p,
               4);
        memcpy(TokenContext_Internal_p->TunnelIP + 4,
               SAParamsIPsec_p->DestIPAddr_p,
               4);
    }
    else if ((HeaderProto == TKB_HDR_IPV6_OUT_TRANSP_NATT ||
              HeaderProto == TKB_HDR_IPV6_IN_TRANSP_NATT) &&
             (SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_TRANSPORT_NAT) !=0)
    {
        TokenContext_Internal_p->u.generic.ESPFlags |= TKB_ESP_FLAG_NAT;
        if (SAParamsIPsec_p->SrcIPAddr_p == NULL ||
            SAParamsIPsec_p->DestIPAddr_p == NULL)
        {
            LOG_CRIT("SABuilder: NULL pointer NAT address.\n");
            return TKB_INVALID_PARAMETER;
        }
        memcpy(TokenContext_Internal_p->TunnelIP,
               SAParamsIPsec_p->SrcIPAddr_p,
               16);
        memcpy(TokenContext_Internal_p->TunnelIP + 16,
               SAParamsIPsec_p->DestIPAddr_p,
               16);
    }
    return TKB_STATUS_OK;
}

/*----------------------------------------------------------------------------
 * TokenBuilder_Next_PktId
 *
 * Increment the PktID if the Token Context describes an IPv4 ESP Tunnel
 * operation
 *
 */
unsigned int
TokenBuilder_Next_PktId(
    const void * const TokenContext_p,
    unsigned int PktId)
{
    const TokenBuilder_Context_t * const TokenContext_Internal_p =
        (const TokenBuilder_Context_t * const )TokenContext_p;
    if (TokenContext_Internal_p->hproto == TKB_HDR_IPV4_OUT_TUNNEL ||
        TokenContext_Internal_p->hproto == TKB_HDR_IPV4_OUT_TUNNEL_NATT)
    {
        return (PktId + 1) & MASK_16_BITS;
    }
    else
    {
        return PktId;
    }
}


#endif

/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext_IPsec
 *
 * Create a Token Context Record for IPsec.
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_Internal_p (output)
 *   Buffer to hold the Token Context Record.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
static TokenBuilder_Status_t
TokenBuilder_BuildContext_IPsec(
    const SABuilder_Params_t * const SAParams_p,
    TokenBuilder_Context_t * const TokenContext_Internal_p)
{
    SABuilder_Params_IPsec_t *SAParamsIPsec_p;
    SAParamsIPsec_p = (SABuilder_Params_IPsec_t *)
        (SAParams_p->ProtocolExtension_p);
    if (SAParamsIPsec_p == NULL)
    {
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " IPsec extension pointer is NULL\n");
        return TKB_INVALID_PARAMETER;
    }
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_ESP) != 0)
    {
#ifdef TKB_ENABLE_IPSEC_ESP
        TokenContext_Internal_p->ExtSeq = 0;
        if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_NO_ANTI_REPLAY) != 0)
            TokenContext_Internal_p->AntiReplay = 0;
        else
            TokenContext_Internal_p->AntiReplay = 1;

        if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
        {
            TokenContext_Internal_p->protocol = TKB_PROTO_ESP_OUT;
            TokenContext_Internal_p->PadBlockByteCount = 4;
            TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_LONG_SEQ) != 0)
                TokenContext_Internal_p->ExtSeq = 1;
        }
        else
        {
            TokenContext_Internal_p->protocol = TKB_PROTO_ESP_IN;
            TokenContext_Internal_p->PadBlockByteCount = 4;
            TokenContext_Internal_p->TokenHeaderWord |=
                TKB_HEADER_PAD_VERIFY;
            TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CBC;
            if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_LONG_SEQ) != 0)
                TokenContext_Internal_p->ExtSeq = 1;
            if (TokenContext_Internal_p->ExtSeq == 0 &&
                SAParams_p->OffsetSeqNum + 2 == SAParams_p->OffsetSeqMask &&
                TokenContext_Internal_p->AntiReplay != 0)
            {
                TokenContext_Internal_p->ExtSeq = 2;
                /* Special case, ExtSeq==2 do not use extended sequence
                   number, but update context as if we have extended
                   sequence number. Special SA format fixed seqnum/mask
                   offsets.
                */
            }
            TokenContext_Internal_p->AntiReplay *=
                SAParamsIPsec_p->SequenceMaskBitCount / 32;
        }
        TokenContext_Internal_p->SeqOffset = SAParams_p->OffsetSeqNum;

        switch (SAParams_p->CryptoAlgo)
        {
        case SAB_CRYPTO_NULL:
            TokenContext_Internal_p->IVByteCount = 0;
            break;
        case SAB_CRYPTO_DES:
        case SAB_CRYPTO_3DES:
            TokenContext_Internal_p->IVByteCount = 8;
            TokenContext_Internal_p->PadBlockByteCount = 8;
            break;
        case SAB_CRYPTO_AES:
        case SAB_CRYPTO_SM4:
        case SAB_CRYPTO_BC0:
            if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_CBC)
            {
                TokenContext_Internal_p->IVByteCount = 16;
                TokenContext_Internal_p->PadBlockByteCount = 16;
            }
            else
            {
                if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_OUTBOUND_CTR;
                else
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_INBOUND_CTR;
                if (SAParams_p->IVSrc == SAB_IV_SRC_IMPLICIT)
                    TokenContext_Internal_p->IVByteCount = 0;
                else
                    TokenContext_Internal_p->IVByteCount = 8;
            }
            break;
        case SAB_CRYPTO_CHACHA20:
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                TokenContext_Internal_p->IVHandling =
                    TKB_IV_OUTBOUND_CTR;
            else
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_INBOUND_CTR;
            if (SAParams_p->IVSrc == SAB_IV_SRC_IMPLICIT)
                TokenContext_Internal_p->IVByteCount = 0;
            else
                TokenContext_Internal_p->IVByteCount = 8;
            break;
        default:
            LOG_CRIT("TokenBuilder_BuildContext:"
                     " unsupported crypto algorithm.\n");
            return TKB_INVALID_PARAMETER;
        }

        /* For all inbound and CTR mode outbound packets there is
           only one supported way to obtain the IV, which is already
           taken care of. Now handle outbound CBC. */
        if(SAParams_p->CryptoMode == SAB_CRYPTO_MODE_CBC &&
           SAParams_p->direction == SAB_DIRECTION_OUTBOUND &&
           SAParams_p->CryptoAlgo != SAB_CRYPTO_NULL)
        {
            switch (SAParams_p->IVSrc)
            {
            case SAB_IV_SRC_DEFAULT:
            case SAB_IV_SRC_PRNG:
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_PRNG;
                break;
            case SAB_IV_SRC_SA: /* No action required */
                break;
            case SAB_IV_SRC_TOKEN:
                if (TokenContext_Internal_p->IVByteCount == 8)
                {
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_OUTBOUND_TOKEN_2WORDS;
                    TokenContext_Internal_p->TokenHeaderWord |=
                        TKB_HEADER_IV_TOKEN_2WORDS;
                }
                else
                {
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_OUTBOUND_TOKEN_4WORDS;
                    TokenContext_Internal_p->TokenHeaderWord |=
                        TKB_HEADER_IV_TOKEN_4WORDS;
                }
                break;
            default:
                LOG_CRIT("TokenBuilder_BuildContext:"
                         "Unsupported IV source\n");
                return TKB_INVALID_PARAMETER;
            }
        }

        if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND &&
            SAParamsIPsec_p->PadAlignment >
            TokenContext_Internal_p->PadBlockByteCount &&
            SAParamsIPsec_p->PadAlignment <= 256)
            TokenContext_Internal_p->PadBlockByteCount =
                SAParamsIPsec_p->PadAlignment;

        switch(SAParams_p->AuthAlgo)
        {
        case SAB_AUTH_NULL:
            TokenContext_Internal_p->ICVByteCount = 0;
            TokenContext_Internal_p->ExtSeq = 0;
            break;
        case SAB_AUTH_HMAC_MD5:
        case SAB_AUTH_HMAC_SHA1:
        case SAB_AUTH_AES_XCBC_MAC:
        case SAB_AUTH_AES_CMAC_128:
            TokenContext_Internal_p->ICVByteCount = 12;
            break;
        case SAB_AUTH_HMAC_SHA2_224:
        case SAB_AUTH_HMAC_SHA2_256:
        case SAB_AUTH_HMAC_SM3:
            TokenContext_Internal_p->ICVByteCount = 16;
            break;
        case SAB_AUTH_HMAC_SHA2_384:
            TokenContext_Internal_p->ICVByteCount = 24;
            break;
        case SAB_AUTH_HMAC_SHA2_512:
            TokenContext_Internal_p->ICVByteCount = 32;
            break;
        case SAB_AUTH_AES_CCM:
        case SAB_AUTH_AES_GCM:
        case SAB_AUTH_AES_GMAC:
            // All these protocols have a selectable ICV length.
            if (SAParamsIPsec_p->ICVByteCount == 8 ||
                SAParamsIPsec_p->ICVByteCount == 12 ||
                SAParamsIPsec_p->ICVByteCount == 16)
            {
                TokenContext_Internal_p->ICVByteCount =
                    SAParamsIPsec_p->ICVByteCount;
            }
            else
            {
                TokenContext_Internal_p->ICVByteCount = 16;
            }
            switch (SAParams_p->AuthAlgo)
            {
                /* These protocols need specialized protocol codes
                   for the token generator.*/
            case SAB_AUTH_AES_CCM:
                if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_CCM_OUT;
                }
                else
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_CCM_IN;
                }
                TokenContext_Internal_p->u.generic.CCMSalt =
                    (SAParams_p->Nonce_p[0] << 8) |
                    (SAParams_p->Nonce_p[1] << 16) |
                    (SAParams_p->Nonce_p[2] << 24) |
                    TKB_CCM_FLAG_ADATA_L4 |
                    ((TokenContext_Internal_p->ICVByteCount-2)*4);
                break;
            case SAB_AUTH_AES_GCM:
                if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_GCM_OUT;
                }
                else
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_GCM_IN;
                }
                break;
            case SAB_AUTH_AES_GMAC:
                if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_GMAC_OUT;
                }
                else
                {
                    TokenContext_Internal_p->protocol = TKB_PROTO_ESP_GMAC_IN;
                }
                break;
            default:
                ;
            }
            break;
        case SAB_AUTH_POLY1305:
            TokenContext_Internal_p->ICVByteCount = 16;
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                TokenContext_Internal_p->protocol =
                    TKB_PROTO_ESP_CHACHAPOLY_OUT;
            }
            else
            {
                TokenContext_Internal_p->protocol =
                    TKB_PROTO_ESP_CHACHAPOLY_IN;
            }
            break;
        default:
            LOG_CRIT("TokenBuilder_BuildContext:"
                     " unsupported authentication algorithm.\n");
            return TKB_INVALID_PARAMETER;
        }
#else /* TKB_ENABLE_IPSEC_ESP */
        LOG_CRIT("TokenBuilder_BuildContext: ESP not supported\n");
        return TKB_INVALID_PARAMETER;
#endif /* TKB_ENABLE_IPSEC_ESP */
    }
    else if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_AH) != 0)
    {
#ifdef TKB_ENABLE_IPSEC_AH

#else /* TKB_ENABLE_IPSEC_AH */
        LOG_CRIT("TokenBuilder_BuildContext: AH not supported\n");
        return TKB_INVALID_PARAMETER;
#endif /* TKB_ENABLE_IPSEC_AH */
    }
    else
    {
        LOG_CRIT("TokenBuilder_BuildContext: Neither ESP nor AH set\n");
        return TKB_INVALID_PARAMETER;
    }
#ifdef TKB_ENABLE_EXTENDED_IPSEC
    if ((SAParamsIPsec_p->IPsecFlags & SAB_IPSEC_EXT_PROCESSING) != 0)
    {
        TokenBuilder_Status_t Rc;

        Rc = TokenBuilder_BuildContext_Extended(SAParams_p,
                                                TokenContext_Internal_p);
        return Rc;
    }
#endif
    return TKB_STATUS_OK;
}
#endif


#ifdef TKB_ENABLE_PROTO_SSLTLS
/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext_SSLTLS
 *
 * Create a Token Context Record for SSL/TLS/DTLS
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_Internal_p (output)
 *   Buffer to hold the Token Context Record.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
static TokenBuilder_Status_t
TokenBuilder_BuildContext_SSLTLS(
    const SABuilder_Params_t * const SAParams_p,
    TokenBuilder_Context_t * const TokenContext_Internal_p)
{
    SABuilder_Params_SSLTLS_t *SAParamsSSLTLS_p;
    SAParamsSSLTLS_p = (SABuilder_Params_SSLTLS_t *)
        (SAParams_p->ProtocolExtension_p);
    if (SAParamsSSLTLS_p == NULL)
    {
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " SSL/TLS extension pointer is NULL\n");
        return TKB_INVALID_PARAMETER;
    }

    TokenContext_Internal_p->ExtSeq = 0;
    TokenContext_Internal_p->AntiReplay = 1;
    TokenContext_Internal_p->IVOffset = 0;
    TokenContext_Internal_p->DigestWordCount = 0;
    TokenContext_Internal_p->u.generic.ESPFlags = 0;
    if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
    {
        TokenContext_Internal_p->protocol = TKB_PROTO_SSLTLS_OUT;
        TokenContext_Internal_p->PadBlockByteCount = 1;
        TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
    }
    else
    {
        TokenContext_Internal_p->protocol = TKB_PROTO_SSLTLS_IN;
        TokenContext_Internal_p->PadBlockByteCount = 1;
        if (SAParams_p->CryptoAlgo != SAB_CRYPTO_NULL &&
            SAParams_p->CryptoAlgo != SAB_CRYPTO_ARCFOUR)
            TokenContext_Internal_p->TokenHeaderWord |=
                TKB_HEADER_PAD_VERIFY;
        TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CBC;
    }
    TokenContext_Internal_p->SeqOffset = SAParams_p->OffsetSeqNum;

    switch (SAParams_p->CryptoAlgo)
    {
    case SAB_CRYPTO_NULL:
        TokenContext_Internal_p->IVByteCount = 0;
        TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
        break;
    case SAB_CRYPTO_ARCFOUR:
        TokenContext_Internal_p->IVByteCount = 0;
        TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_ARC4;
        TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIJPtr;
        break;
    case SAB_CRYPTO_DES:
    case SAB_CRYPTO_3DES:
        TokenContext_Internal_p->IVByteCount = 8;
        TokenContext_Internal_p->PadBlockByteCount = 8;
        TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_IV2;
        TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
        break;
    case SAB_CRYPTO_AES:
    case SAB_CRYPTO_SM4:
    case SAB_CRYPTO_BC0:
        if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_GCM)
        {
            TokenContext_Internal_p->IVByteCount = 8;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CTR;
                if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_TLS13_GCM_OUT;
                }
                else
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_SSLTLS_GCM_OUT;
                }
            }
            else
            {
                TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CTR;
                if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_TLS13_GCM_IN;
                }
                else
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_SSLTLS_GCM_IN;
                }
            }
        }
        else if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_CCM)
        {
            TokenContext_Internal_p->IVByteCount = 8;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CTR;
                if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_TLS13_CCM_OUT;
                }
                else
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_SSLTLS_CCM_OUT;
                }
            }
            else
            {
                TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CTR;
                if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_TLS13_CCM_IN;
                }
                else
                {
                    TokenContext_Internal_p->protocol =
                        TKB_PROTO_SSLTLS_CCM_IN;
                }
            }
            if (SAParamsSSLTLS_p->ICVByteCount == 0)
                TokenContext_Internal_p->ICVByteCount = 16;
            else if (SAParamsSSLTLS_p->ICVByteCount == 8 ||
                     SAParamsSSLTLS_p->ICVByteCount == 16)
            {
                TokenContext_Internal_p->ICVByteCount = SAParamsSSLTLS_p->ICVByteCount;
            }
            else
            {
                LOG_CRIT("TokenBuilder_BuildContext:"
                         " TLS AES-CCM rquires tag length of 8 or 16\n");
                return TKB_INVALID_PARAMETER;
            }
            TokenContext_Internal_p->u.generic.CCMSalt = TKB_CCM_FLAG_ADATA_L3 |
                ((TokenContext_Internal_p->ICVByteCount-2)*4);
        }
        else
        {
            TokenContext_Internal_p->IVByteCount = 16;
            TokenContext_Internal_p->PadBlockByteCount = 16;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_IV4;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
        }
        break;
    case SAB_CRYPTO_CHACHA20:
        TokenContext_Internal_p->IVByteCount = 0;
        TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
        if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
        {
            if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_TLS13_CHACHAPOLY_OUT;
            }
            else
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_SSLTLS_CHACHAPOLY_OUT;
            }
        }
        else
        {
            if (SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_3)
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_TLS13_CHACHAPOLY_IN;
            }
            else
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_SSLTLS_CHACHAPOLY_IN;
            }
        }
        break;
    default:
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " unsupported crypto algorithm.\n");
        return TKB_INVALID_PARAMETER;
    }

    /* For all inbound and ARCFOUR outbound packets there is
       only one supported way to obtain the IV, which is already
       taken care of. Now handle outbound CBC. */
    if(SAParams_p->CryptoMode == SAB_CRYPTO_MODE_CBC &&
       SAParams_p->direction == SAB_DIRECTION_OUTBOUND &&
       SAParams_p->CryptoAlgo != SAB_CRYPTO_NULL)
    {
        switch (SAParams_p->IVSrc)
        {
        case SAB_IV_SRC_DEFAULT:
        case SAB_IV_SRC_PRNG:
            TokenContext_Internal_p->TokenHeaderWord |=
                TKB_HEADER_IV_PRNG;
            break;
        case SAB_IV_SRC_SA: /* No action required */
            break;
        case SAB_IV_SRC_TOKEN:
            if (TokenContext_Internal_p->IVByteCount == 8)
            {
                TokenContext_Internal_p->IVHandling =
                    TKB_IV_OUTBOUND_TOKEN_2WORDS;
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_TOKEN_2WORDS;
            }
            else
            {
                TokenContext_Internal_p->IVHandling =
                    TKB_IV_OUTBOUND_TOKEN_4WORDS;
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_TOKEN_4WORDS;
            }
            break;
        default:
            LOG_CRIT("TokenBuilder_BuildContext:"
                     "Unsupported IV source\n");
            return TKB_INVALID_PARAMETER;
        }
    }

    /* In SSL and TLS1.0 the IV does not appear explicitly in the packet */
    if (SAParamsSSLTLS_p->version == SAB_SSL_VERSION_3_0 ||
        SAParamsSSLTLS_p->version == SAB_TLS_VERSION_1_0)
        TokenContext_Internal_p->IVByteCount = 0;
    else if (TokenContext_Internal_p->u.generic.UpdateHandling == TKB_UPD_IV2 ||
             TokenContext_Internal_p->u.generic.UpdateHandling == TKB_UPD_IV4)
        TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_BLK;

    /* Sequence numbers appear explicitly in the packet in DTLS */
    if (SAParamsSSLTLS_p->version == SAB_DTLS_VERSION_1_0 ||
        SAParamsSSLTLS_p->version == SAB_DTLS_VERSION_1_2)
    {
        if ((SAParamsSSLTLS_p->SSLTLSFlags & SAB_DTLS_CAPWAP) != 0)
            TokenContext_Internal_p->u.generic.ESPFlags |= TKB_DTLS_FLAG_CAPWAP;

        if ((SAParamsSSLTLS_p->SSLTLSFlags & SAB_DTLS_NO_ANTI_REPLAY) != 0)
            TokenContext_Internal_p->ExtSeq = 1;
        else
            TokenContext_Internal_p->ExtSeq = 1 +
                SAParamsSSLTLS_p->SequenceMaskBitCount / 32;
#ifdef TKB_ENABLE_EXTENDED_DTLS
        if ((SAParamsSSLTLS_p->SSLTLSFlags &  SAB_DTLS_EXT_PROCESSING) != 0)
        {
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                if ((SAParamsSSLTLS_p->SSLTLSFlags & SAB_DTLS_IPV6) != 0)
                    TokenContext_Internal_p->hproto = TKB_HDR_IPV6_OUT_DTLS;
                else
                    TokenContext_Internal_p->hproto = TKB_HDR_IPV4_OUT_DTLS;
            }
            else
            {
                TokenContext_Internal_p->hproto = TKB_HDR_DTLS_UDP_IN;
                if ((SAParamsSSLTLS_p->SSLTLSFlags &  SAB_DTLS_PLAINTEXT_HEADERS) != 0)
                    TokenContext_Internal_p->u.generic.ESPFlags |= TKB_DTLS_FLAG_PLAINTEXT_HDR;
            }
        }
#endif
    }

    /* Version field is not hashed in SSL 3.0. */
    if (SAParamsSSLTLS_p->version == SAB_SSL_VERSION_3_0)
        TokenContext_Internal_p->AntiReplay = 0;


    switch(SAParams_p->AuthAlgo)
    {
    case SAB_AUTH_HMAC_MD5:
    case SAB_AUTH_SSLMAC_MD5:
        TokenContext_Internal_p->ICVByteCount = 16;
        break;
    case SAB_AUTH_HMAC_SHA1:
    case SAB_AUTH_SSLMAC_SHA1:
        TokenContext_Internal_p->ICVByteCount = 20;
        break;
    case SAB_AUTH_HMAC_SHA2_224:
        TokenContext_Internal_p->ICVByteCount = 28;
        break;
    case SAB_AUTH_HMAC_SHA2_256:
    case SAB_AUTH_HMAC_SM3:
        TokenContext_Internal_p->ICVByteCount = 32;
        break;
    case SAB_AUTH_HMAC_SHA2_384:
        TokenContext_Internal_p->ICVByteCount = 48;
        break;
    case SAB_AUTH_HMAC_SHA2_512:
        TokenContext_Internal_p->ICVByteCount = 64;
        break;
    case SAB_AUTH_AES_GCM:
        TokenContext_Internal_p->ICVByteCount = 16;
        break;
    case SAB_AUTH_AES_CCM:
        /* Was already set earlier */
        break;
    case SAB_AUTH_POLY1305:
        TokenContext_Internal_p->ICVByteCount = 16;
        break;
    default:
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " unsupported authentication algorithm.\n");
        return TKB_INVALID_PARAMETER;
    }
    if (SAParamsSSLTLS_p->ICVByteCount != 0 &&
        SAParamsSSLTLS_p->ICVByteCount < TokenContext_Internal_p->ICVByteCount)
    {
        TokenContext_Internal_p->ICVByteCount = SAParamsSSLTLS_p->ICVByteCount;
    }
    return TKB_STATUS_OK;
}
#endif


#ifdef TKB_ENABLE_PROTO_BASIC
/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext_Basic
 *
 * Create a Token Context Record for Basic crypto
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_Internal_p (output)
 *   Buffer to hold the Token Context Record.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
static TokenBuilder_Status_t
TokenBuilder_BuildContext_Basic(
    const SABuilder_Params_t * const SAParams_p,
    TokenBuilder_Context_t * const TokenContext_Internal_p)
{
    SABuilder_Params_Basic_t *SAParamsBasic_p;
    SAParamsBasic_p = (SABuilder_Params_Basic_t *)
        (SAParams_p->ProtocolExtension_p);
    if (SAParamsBasic_p == NULL)
    {
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " Basic extension pointer is NULL\n");
        return TKB_INVALID_PARAMETER;
    }

    TokenContext_Internal_p->ExtSeq = 0;
    TokenContext_Internal_p->AntiReplay = 0;
    TokenContext_Internal_p->IVOffset = 0;
    TokenContext_Internal_p->SeqOffset = 0;
    TokenContext_Internal_p->PadBlockByteCount = 1;
    TokenContext_Internal_p->IVByteCount = 0;
    TokenContext_Internal_p->ICVByteCount = 0;
    TokenContext_Internal_p->DigestWordCount = 0;
    TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
    TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
    TokenContext_Internal_p->u.generic.CCMSalt = 0;

    if (SAParams_p->CryptoAlgo != SAB_CRYPTO_NULL)
    {   /* Basic crypto */
        if (SAParams_p->AuthAlgo == SAB_AUTH_NULL)
        {
            TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CRYPTO;
        }
        else if ((SAParamsBasic_p->BasicFlags & SAB_BASIC_FLAG_ENCRYPT_AFTER_HASH) != 0)
        {
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_HASHENC;
            }
            else
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_DECHASH;
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_PAD_VERIFY;
            }
        }
#ifdef TKB_ENABLE_CRYPTO_CHACHAPOLY
        else if (SAParams_p->CryptoAlgo == SAB_CRYPTO_CHACHA20)
        {
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CHACHAPOLY_OUT;
            }
            else
            {
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CHACHAPOLY_IN;
            }
        }
#endif
        else
        {
            TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CRYPTHASH;
        }
        switch (SAParams_p->CryptoAlgo)
        {
        case SAB_CRYPTO_ARCFOUR:
            TokenContext_Internal_p->IVByteCount = 0;
            if (SAParams_p->CryptoMode != SAB_CRYPTO_MODE_STATELESS)
                TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_ARC4;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIJPtr;
            break;
        case SAB_CRYPTO_DES:
        case SAB_CRYPTO_3DES:
            TokenContext_Internal_p->IVByteCount = 8;
            TokenContext_Internal_p->PadBlockByteCount = 8;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_IV2;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            break;
        case SAB_CRYPTO_AES:
        case SAB_CRYPTO_SM4:
        case SAB_CRYPTO_BC0:
            TokenContext_Internal_p->IVByteCount = 16;
            TokenContext_Internal_p->PadBlockByteCount = 16;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_IV4;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            break;
#ifdef TKB_ENABLE_CRYPTO_WIRELESS
        case SAB_CRYPTO_KASUMI:
            TokenContext_Internal_p->IVByteCount = 8;
            TokenContext_Internal_p->PadBlockByteCount = 8;
            TokenContext_Internal_p->IVHandling = TKB_IV_KASUMI_F8;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            break;
        case SAB_CRYPTO_SNOW:
            TokenContext_Internal_p->IVByteCount = 16;
            TokenContext_Internal_p->PadBlockByteCount = 1;
            TokenContext_Internal_p->IVHandling = TKB_IV_SNOW_UEA2;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            break;
        case SAB_CRYPTO_ZUC:
            TokenContext_Internal_p->IVByteCount = 16;
            TokenContext_Internal_p->PadBlockByteCount = 1;
            TokenContext_Internal_p->IVHandling = TKB_IV_ZUC_EEA3;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            TokenContext_Internal_p->IVOffset = SAParams_p->OffsetIV;
            break;
#endif
#ifdef TKB_ENABLE_CRYPTO_CHACHAPOLY
        case SAB_CRYPTO_CHACHA20:
            TokenContext_Internal_p->IVByteCount = 16;
            TokenContext_Internal_p->PadBlockByteCount = 1;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            break;
#endif
        default:
            LOG_CRIT("TokenBuilder_BuildContext:"
                     " unsupported crypto algorithm.\n");
            return TKB_INVALID_PARAMETER;
        }

        switch (SAParams_p->CryptoMode)
        {
        case SAB_CRYPTO_MODE_ECB:
            TokenContext_Internal_p->IVByteCount = 0;
            TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
            break;
        case SAB_CRYPTO_MODE_BASIC:
        case SAB_CRYPTO_MODE_CBC:
        case SAB_CRYPTO_MODE_ICM:
        case SAB_CRYPTO_MODE_CFB:
        case SAB_CRYPTO_MODE_OFB:
        case SAB_CRYPTO_MODE_XTS:
        case SAB_CRYPTO_MODE_XTS_STATEFUL:
        case SAB_CRYPTO_MODE_CHACHA_CTR32:
        case SAB_CRYPTO_MODE_CHACHA_CTR64:
            if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_BASIC)
            {
                TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
                if (SAParams_p->CryptoAlgo == SAB_CRYPTO_KASUMI)
                {
                    TokenContext_Internal_p->IVByteCount = 0;
                    TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
                    break;
                }
                else
                {
                    TokenContext_Internal_p->PadBlockByteCount = 1;
                }
            }
            else if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_ICM)
            {
                TokenContext_Internal_p->PadBlockByteCount = 1;
            }
            else if (SAParams_p->CryptoMode == SAB_CRYPTO_MODE_XTS ||
                     SAParams_p->CryptoMode == SAB_CRYPTO_MODE_XTS_STATEFUL)
            {
                TokenContext_Internal_p->PadBlockByteCount = 1;
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_XTS_CRYPTO;
            }

            if (SAParams_p->IVSrc == SAB_IV_SRC_TOKEN)
            {
                TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
                if (TokenContext_Internal_p->IVByteCount == 8)
                {
                    TokenContext_Internal_p->IVByteCount = 0;
                    if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_COPY_TOKEN_2WORDS;
                    else
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_OUTBOUND_TOKEN_2WORDS;
                    TokenContext_Internal_p->TokenHeaderWord |=
                        TKB_HEADER_IV_TOKEN_2WORDS;
                }
                else
                {
                    TokenContext_Internal_p->IVByteCount = 0;
                    if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_COPY_TOKEN_4WORDS;
                    else
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_OUTBOUND_TOKEN_4WORDS;
                    TokenContext_Internal_p->TokenHeaderWord |=
                        TKB_HEADER_IV_TOKEN_4WORDS;
                }
            }
            else if (SAParams_p->IVSrc == SAB_IV_SRC_INPUT)
            {
                TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
                if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                    TokenContext_Internal_p->IVHandling = TKB_IV_COPY_CBC;
                else
                    TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CBC;
            }
            else
            {
                if(SAParams_p->IVSrc ==  SAB_IV_SRC_PRNG)
                {
                    TokenContext_Internal_p->TokenHeaderWord |=
                        TKB_HEADER_IV_PRNG;
                    TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;
                }
                if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                {
                    if (TokenContext_Internal_p->IVByteCount==8)
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_OUTBOUND_2WORDS;
                    else
                        TokenContext_Internal_p->IVHandling =
                            TKB_IV_OUTBOUND_4WORDS;
                }
                TokenContext_Internal_p->IVByteCount = 0;
            }

            break;
        case SAB_CRYPTO_MODE_CTR:
        case SAB_CRYPTO_MODE_CCM:
        case SAB_CRYPTO_MODE_GCM:
        case SAB_CRYPTO_MODE_GMAC:
            TokenContext_Internal_p->PadBlockByteCount = 1;
            TokenContext_Internal_p->u.generic.UpdateHandling = TKB_UPD_NULL;

            if (SAParams_p->IVSrc == SAB_IV_SRC_TOKEN)
            {
                TokenContext_Internal_p->IVByteCount = 0;
                if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_COPY_TOKEN_4WORDS;
                else
                    TokenContext_Internal_p->IVHandling =
                        TKB_IV_OUTBOUND_TOKEN_4WORDS;
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_TOKEN_4WORDS;
            }
            else if (SAParams_p->IVSrc == SAB_IV_SRC_INPUT)
            {
                TokenContext_Internal_p->IVByteCount = 8;
                if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                    TokenContext_Internal_p->IVHandling = TKB_IV_COPY_CTR;
                else
                    TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CTR;
            }
            else
            {
                TokenContext_Internal_p->IVByteCount = 0;
                if ((SAParams_p->flags & SAB_FLAG_COPY_IV) != 0)
                    TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CTR;
            }
            break;
#ifdef TKB_ENABLE_CRYPTO_WIRELESS
        case SAB_CRYPTO_MODE_F8:
        case SAB_CRYPTO_MODE_UEA2:
        case SAB_CRYPTO_MODE_EEA3:
            TokenContext_Internal_p->PadBlockByteCount = 1;
            TokenContext_Internal_p->u.generic.CCMSalt =
                (SAParamsBasic_p->bearer << 3) |
                (SAParamsBasic_p->direction<<2);
            if (TokenContext_Internal_p->IVByteCount == 8)
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_TOKEN_2WORDS;
            else
                TokenContext_Internal_p->TokenHeaderWord |=
                    TKB_HEADER_IV_TOKEN_4WORDS;
            TokenContext_Internal_p->IVByteCount = 0;
            break;
#endif
            default:
                ;
        }
    }
    else if (SAParams_p->AuthAlgo == SAB_AUTH_NULL)
    {
        TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_BYPASS;
    }
    else if (SAParamsBasic_p->BasicFlags & SAB_BASIC_FLAG_HMAC_PRECOMPUTE &&
             SAParams_p->OffsetDigest1 != 0)
    {
        TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_HMAC_PRECOMPUTE;
    }
    else
    {
        TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_HASH;
    }
    if (SAParams_p->AuthAlgo != SAB_AUTH_NULL)
    {   /* Basic hash */
        if ((SAParams_p->flags & (SAB_FLAG_HASH_SAVE|
                                      SAB_FLAG_HASH_INTERMEDIATE)) != 0)
        {
            /* We intend to store the hash state.*/
            TokenContext_Internal_p->SeqOffset = SAParams_p->OffsetDigest0;
        }
        if(SAParams_p->CryptoAlgo == SAB_CRYPTO_NULL)
        {
            /* Use ExtSeq variable to specify that payload will be copied */
            if ((SAParams_p->flags & SAB_FLAG_SUPPRESS_PAYLOAD) == 0)
                TokenContext_Internal_p->ExtSeq = 1;
        }
        else
        {
            /* Use ExtSeq variable to specify that header
             * (authenticated data( will be copied */
            if ((SAParams_p->flags & SAB_FLAG_SUPPRESS_HEADER) == 0)
                TokenContext_Internal_p->ExtSeq = 1;
        }
        switch(SAParams_p->AuthAlgo)
        {
        case SAB_AUTH_HASH_MD5:
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 16 + 4;
            break;
        case SAB_AUTH_HMAC_MD5:
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            break;
        case SAB_AUTH_HASH_SHA1:
            TokenContext_Internal_p->ICVByteCount = 20;
            TokenContext_Internal_p->DigestWordCount = 16 + 5;
            break;
        case SAB_AUTH_HMAC_SHA1:
            TokenContext_Internal_p->ICVByteCount = 20;
            TokenContext_Internal_p->DigestWordCount = 5;
            break;
        case SAB_AUTH_HASH_SHA2_224:
            TokenContext_Internal_p->ICVByteCount = 32;
            TokenContext_Internal_p->DigestWordCount = 16 + 8;
            break;
        case SAB_AUTH_HMAC_SHA2_224:
            TokenContext_Internal_p->ICVByteCount = 32;
            TokenContext_Internal_p->DigestWordCount = 8;
            break;
        case SAB_AUTH_HASH_SHA2_256:
        case SAB_AUTH_HASH_SM3:
            TokenContext_Internal_p->ICVByteCount = 32;
            TokenContext_Internal_p->DigestWordCount = 16 + 8;
            break;
        case SAB_AUTH_HMAC_SHA2_256:
        case SAB_AUTH_HMAC_SM3:
            TokenContext_Internal_p->ICVByteCount = 32;
            TokenContext_Internal_p->DigestWordCount = 8;
            break;
        case SAB_AUTH_HASH_SHA2_384:
            TokenContext_Internal_p->ICVByteCount = 64;
            TokenContext_Internal_p->DigestWordCount = 16 + 16;
            break;
        case SAB_AUTH_HMAC_SHA2_384:
            if ((SAParamsBasic_p->BasicFlags & SAB_BASIC_FLAG_ENCRYPT_AFTER_HASH) != 0)
                TokenContext_Internal_p->ICVByteCount = 48;
            else
                TokenContext_Internal_p->ICVByteCount = 64;
            TokenContext_Internal_p->DigestWordCount = 16;
            break;
        case SAB_AUTH_HASH_SHA2_512:
            TokenContext_Internal_p->ICVByteCount = 64;
            TokenContext_Internal_p->DigestWordCount = 16 + 16;
            break;
        case SAB_AUTH_HMAC_SHA2_512:
            TokenContext_Internal_p->ICVByteCount = 64;
            TokenContext_Internal_p->DigestWordCount = 16;
            break;
        case SAB_AUTH_HASH_SHA3_224:
        case SAB_AUTH_HMAC_SHA3_224:
        case SAB_AUTH_KEYED_HASH_SHA3_224:
            TokenContext_Internal_p->ICVByteCount = 28;
            TokenContext_Internal_p->DigestWordCount = 7;
            break;
        case SAB_AUTH_HASH_SHA3_256:
        case SAB_AUTH_HMAC_SHA3_256:
        case SAB_AUTH_KEYED_HASH_SHA3_256:
            TokenContext_Internal_p->ICVByteCount = 32;
            TokenContext_Internal_p->DigestWordCount = 8;
            break;
        case SAB_AUTH_HASH_SHA3_384:
        case SAB_AUTH_HMAC_SHA3_384:
        case SAB_AUTH_KEYED_HASH_SHA3_384:
            TokenContext_Internal_p->ICVByteCount = 48;
            TokenContext_Internal_p->DigestWordCount = 12;
            break;
        case SAB_AUTH_HASH_SHA3_512:
        case SAB_AUTH_HMAC_SHA3_512:
        case SAB_AUTH_KEYED_HASH_SHA3_512:
            TokenContext_Internal_p->ICVByteCount = 64;
            TokenContext_Internal_p->DigestWordCount = 16;
            break;

        case SAB_AUTH_AES_XCBC_MAC:
        case SAB_AUTH_AES_CMAC_128:
        case SAB_AUTH_AES_CMAC_192:
        case SAB_AUTH_AES_CMAC_256:
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            break;
        case SAB_AUTH_AES_CCM:
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CCM_OUT;
            else
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_CCM_IN;
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            // Adjust byte count now as it influences the SALT value.
            if (SAParamsBasic_p->ICVByteCount != 0 &&
                SAParamsBasic_p->ICVByteCount <
                TokenContext_Internal_p->ICVByteCount)
                TokenContext_Internal_p->ICVByteCount =
                    SAParamsBasic_p->ICVByteCount;
            TokenContext_Internal_p->u.generic.CCMSalt =
                (SAParams_p->Nonce_p[0] << 8) |
                (SAParams_p->Nonce_p[1] << 16) |
                (SAParams_p->Nonce_p[2] << 24) |
                TKB_CCM_FLAG_ADATA_L4 |
                ((TokenContext_Internal_p->ICVByteCount-2)*4);
            break;
        case SAB_AUTH_AES_GCM:
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_GCM_OUT;
            else
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_GCM_IN;
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            break;
        case SAB_AUTH_AES_GMAC:
            if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_GMAC_OUT;
            else
                TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_GMAC_IN;
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            break;
#ifdef TKB_ENABLE_CRYPTO_WIRELESS
        case SAB_AUTH_KASUMI_F9:
            TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_KASUMI_HASH;
            TokenContext_Internal_p->ICVByteCount = 4;
            TokenContext_Internal_p->DigestWordCount = 4;
            TokenContext_Internal_p->u.generic.CCMSalt =
                SAParamsBasic_p->fresh;
            break;
        case SAB_AUTH_SNOW_UIA2:
            TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_SNOW_HASH;
            TokenContext_Internal_p->ICVByteCount = 4;
            TokenContext_Internal_p->DigestWordCount = 4;
            TokenContext_Internal_p->u.generic.CCMSalt =
                SAParamsBasic_p->fresh;
            break;
        case SAB_AUTH_ZUC_EIA3:
            TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_ZUC_HASH;
            TokenContext_Internal_p->ICVByteCount = 4;
            TokenContext_Internal_p->DigestWordCount = 4;
            TokenContext_Internal_p->u.generic.CCMSalt =
                (SAParamsBasic_p->bearer << 3);
            break;
#endif
#ifdef TKB_ENABLE_CRYPTO_CHACHAPOLY
        case SAB_AUTH_KEYED_HASH_POLY1305:
        case SAB_AUTH_POLY1305:
            TokenContext_Internal_p->ICVByteCount = 16;
            TokenContext_Internal_p->DigestWordCount = 4;
            break;
#endif
        default:
            LOG_CRIT("TokenBuilder_BuildContext:"
                     " unsupported authentication algorithm.\n");
            return TKB_INVALID_PARAMETER;
        }
        if (SAParamsBasic_p->ICVByteCount != 0 &&
            SAParamsBasic_p->ICVByteCount <
            TokenContext_Internal_p->ICVByteCount)
            TokenContext_Internal_p->ICVByteCount =
                SAParamsBasic_p->ICVByteCount;
        if ((SAParamsBasic_p->BasicFlags & SAB_BASIC_FLAG_EXTRACT_ICV) != 0 ||
            ((SAParams_p->AuthAlgo == SAB_AUTH_AES_CCM ||
                 SAParams_p->AuthAlgo == SAB_AUTH_AES_GCM ||
              SAParams_p->AuthAlgo == SAB_AUTH_AES_GMAC) &&
             TokenContext_Internal_p->SeqOffset == 0))
            TokenContext_Internal_p->AntiReplay =
                TokenContext_Internal_p->ICVByteCount;
    }
    return TKB_STATUS_OK;
}
#endif


#ifdef TKB_ENABLE_PROTO_SRTP
/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext_SRTP
 *
 * Create a Token Context Record for SRTP
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_Internal_p (output)
 *   Buffer to hold the Token Context Record.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
static TokenBuilder_Status_t
TokenBuilder_BuildContext_SRTP(
    const SABuilder_Params_t * const SAParams_p,
    TokenBuilder_Context_t * const TokenContext_Internal_p)
{
    // Note: SRTP may not make use of the Token Context fields
    // CW0, CW1 CCMAalt and UpdateHandling as they occupy the same
    // space as the SaltKey fields.
    SABuilder_Params_SRTP_t *SAParamsSRTP_p;
    SAParamsSRTP_p = (SABuilder_Params_SRTP_t *)
        (SAParams_p->ProtocolExtension_p);
    if (SAParamsSRTP_p == NULL)
    {
        LOG_CRIT("TokenBuilder_BuildContext:"
                 " SRTP extension pointer is NULL\n");
        return TKB_INVALID_PARAMETER;
    }

    if (SAParams_p->direction == SAB_DIRECTION_OUTBOUND)
        TokenContext_Internal_p->protocol = TKB_PROTO_SRTP_OUT;
    else
        TokenContext_Internal_p->protocol = TKB_PROTO_SRTP_IN;

    TokenContext_Internal_p->ICVByteCount = SAParamsSRTP_p->ICVByteCount;

    if (SAParams_p->CryptoAlgo != SAB_CRYPTO_NULL)
    {
        TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_TOKEN_SRTP;

        TokenContext_Internal_p->IVByteCount = 16;
        TokenContext_Internal_p->TokenHeaderWord |=
            TKB_HEADER_IV_TOKEN_4WORDS;
        if (SAParams_p->Nonce_p == NULL)
        {
            LOG_CRIT("TokenBuilder_BuildContext: NULL nonce pointer.\n");
            return TKB_INVALID_PARAMETER;
        }

        TokenContext_Internal_p->u.srtp.SaltKey0 =
            (SAParams_p->Nonce_p[0]) |
            (SAParams_p->Nonce_p[1] << 8) |
            (SAParams_p->Nonce_p[2] << 16) |
            (SAParams_p->Nonce_p[3] << 24);
        TokenContext_Internal_p->u.srtp.SaltKey1 =
            (SAParams_p->Nonce_p[4]) |
            (SAParams_p->Nonce_p[5] << 8) |
            (SAParams_p->Nonce_p[6] << 16) |
            (SAParams_p->Nonce_p[7] << 24);
        TokenContext_Internal_p->u.srtp.SaltKey2 =
            (SAParams_p->Nonce_p[8]) |
            (SAParams_p->Nonce_p[9] << 8) |
            (SAParams_p->Nonce_p[10] << 16) |
            (SAParams_p->Nonce_p[11] << 24);
        TokenContext_Internal_p->u.srtp.SaltKey3 =
            (SAParams_p->Nonce_p[12]) |
            (SAParams_p->Nonce_p[13] << 8);
    }
    else
    {
        TokenContext_Internal_p->IVHandling = TKB_IV_OUTBOUND_CBC;
        TokenContext_Internal_p->IVByteCount = 0;
    }

    if ((SAParamsSRTP_p->SRTPFlags & SAB_SRTP_FLAG_SRTCP) != 0)
    {
        TokenContext_Internal_p->ExtSeq = 4;
    }
    else
    {
        TokenContext_Internal_p->ExtSeq = 0;
    }

    if ((SAParamsSRTP_p->SRTPFlags & SAB_SRTP_FLAG_INCLUDE_MKI) != 0)
    {
        TokenContext_Internal_p->AntiReplay = 4;
    }
    else
    {
        TokenContext_Internal_p->AntiReplay = 0;
    }
    return TKB_STATUS_OK;
}
#endif


/*----------------------------------------------------------------------------
 * TokenBuilder_BuildContext
 *
 * Create a Token Context Record.
 *
 * SAParams_p (input)
 *   Points to the SA parameters data structure. It is important that
 *   SABuilder_GetSIze() and SABuilder_BuildSA() have already been called
 *   for this SA.
 * TokenContext_p (output)
 *   Buffer to hold the Token Context Record. It must point to a valid
 *   storage buffer that is large enough to hold the Token
 *   Context. Before calling this function, the application must call
 *   TokeBuilder_GetContextSize() with the same SA parameters and
 *   allocate a buffer of that size.
 *
 * Return:
 * TKB_STATUS_OK if successful.
 * TKB_INVALID_PARAMETER if any of the pointer parameters is NULL or if
 *                      the contents of the SA parameters are invalid.
 */
TokenBuilder_Status_t
TokenBuilder_BuildContext(
    const SABuilder_Params_t * const SAParams_p,
    void * const TokenContext_p
    )
{
    TokenBuilder_Context_t *TokenContext_Internal_p =
        (TokenBuilder_Context_t *)TokenContext_p;
    TokenBuilder_Status_t Rc;
#ifdef TKB_STRICT_ARGS_CHECK
    if (SAParams_p == NULL || TokenContext_p == NULL)
    {
        LOG_CRIT("TokenBuilder_BuildContext: NULL pointer supplied\n");
        return TKB_INVALID_PARAMETER;
    }
#endif

    TokenContext_Internal_p->TokenHeaderWord = TKB_HEADER_DEFAULT;

    TokenContext_Internal_p->u.generic.CW0 = SAParams_p->CW0;
    TokenContext_Internal_p->u.generic.CW1 = SAParams_p->CW1;
    TokenContext_Internal_p->hproto = TKB_HDR_BYPASS;
    switch (SAParams_p->protocol)
    {
#ifdef TKB_ENABLE_PROTO_IPSEC
    case SAB_PROTO_IPSEC:
        Rc = TokenBuilder_BuildContext_IPsec(SAParams_p,
                                             TokenContext_Internal_p);
    break;
#endif  /* TKB_ENABLE_PROTO_IPSEC */
#ifdef TKB_ENABLE_PROTO_SSLTLS
    case SAB_PROTO_SSLTLS:
        Rc = TokenBuilder_BuildContext_SSLTLS(SAParams_p,
                                             TokenContext_Internal_p);
    break;
#endif
#ifdef TKB_ENABLE_PROTO_BASIC
    case SAB_PROTO_BASIC:
        Rc = TokenBuilder_BuildContext_Basic(SAParams_p,
                                             TokenContext_Internal_p);
    break;
#endif
#ifdef TKB_ENABLE_PROTO_SRTP
    case SAB_PROTO_SRTP:
        Rc = TokenBuilder_BuildContext_SRTP(SAParams_p,
                                             TokenContext_Internal_p);
    break;
#endif
    default:
        LOG_CRIT("TokenBuilder_BuildContext: unsupported protocol.\n");
        return TKB_INVALID_PARAMETER;
    }

    if (Rc != TKB_STATUS_OK)
    {
        return Rc;
    }

    if (TokenContext_Internal_p->protocol != TKB_PROTO_BASIC_HMAC_PRECOMPUTE &&
        SAParams_p->OffsetDigest1 != 0 &&
        SAParams_p->AuthKey2_p == NULL)
    {
        /* HMAC key desired, but not supplied, convert context temporarily
           to context prepare context. After the first token, the Token
           Builder will switch it back */
        TokenContext_Internal_p->protocol_next =
            TokenContext_Internal_p->protocol;
        TokenContext_Internal_p->hproto_next =
            TokenContext_Internal_p->hproto;
        TokenContext_Internal_p->IVHandling_next =
            TokenContext_Internal_p->IVHandling;
        TokenContext_Internal_p->HeaderWordFields_next =
            (TokenContext_Internal_p->TokenHeaderWord >> 22) & MASK_8_BITS;
        TokenContext_Internal_p->protocol = TKB_PROTO_BASIC_HMAC_CTXPREPARE;
        TokenContext_Internal_p->hproto = TKB_HDR_BYPASS;
        TokenContext_Internal_p->IVHandling = TKB_IV_INBOUND_CTR;
        /* Clear fields in Token Header word, to prevent IV from token etc.*/
        TokenContext_Internal_p->TokenHeaderWord &= 0xc03fffff;
        TokenContext_Internal_p->DigestWordCount =
            SAParams_p->OffsetDigest1 - SAParams_p->OffsetDigest0;
        TokenContext_Internal_p->DigestOffset = SAParams_p->OffsetDigest0;
    }

    LOG_INFO("TokenBuilderBuildContext: created context, header word=%08x\n"
             "  proto=%d hproto=%d padalign=%d ivsize=%d icvsize=%d\n"
             "  seqoffset=%d extseq=%d antireplay=%d ivhandling=%d\n",
             TokenContext_Internal_p->TokenHeaderWord,
             TokenContext_Internal_p->protocol,
             TokenContext_Internal_p->hproto,
             TokenContext_Internal_p->PadBlockByteCount,
             TokenContext_Internal_p->IVByteCount,
             TokenContext_Internal_p->ICVByteCount,
             TokenContext_Internal_p->SeqOffset,
             TokenContext_Internal_p->ExtSeq,
             TokenContext_Internal_p->AntiReplay,
             TokenContext_Internal_p->IVHandling);

    return TKB_STATUS_OK;
}


/* end of file token_builder_context.c */