---
name: "RTE_SWX_IPSEC_NAME_SIZE"
section: "3"
platform: "linux"
package: "dpdk-doc"
version: "24.11.4-0+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/rte_swx_ipsec.h"
---

# RTE\_SWX\_IPSEC\_NAME\_SIZE(3)

Part of [rte\_swx\_ipsec.h(3)](/rte_swx_ipsec.h/3.md).

## NAME

rte\_swx\_ipsec.h

## SYNOPSIS

`#include <stdint.h>`\
 `#include <stdio.h>`\
 `#include <netinet/in.h>`\
 `#include <rte_compat.h>`\
 `#include <rte_crypto_sym.h>`\
 `#include <rte_ip6.h>`\

### Data Structures

struct **rte\_swx\_ipsec\_burst\_size**\
 struct **rte\_swx\_ipsec\_params**\
 struct **rte\_swx\_ipsec\_input\_packet\_metadata**\
 struct **rte\_swx\_ipsec\_sa\_cipher\_params**\
 struct **rte\_swx\_ipsec\_sa\_authentication\_params**\
 struct **rte\_swx\_ipsec\_sa\_aead\_params**\
 struct **rte\_swx\_ipsec\_sa\_encap\_params**\
 struct **rte\_swx\_ipsec\_sa\_params**\

### Macros

\#define **RTE\_SWX\_IPSEC\_NAME\_SIZE**   64\
 \#define **RTE\_SWX\_IPSEC\_BURST\_SIZE\_MAX**   256\
 \#define **RTE\_SWX\_IPSEC\_KEY\_SIZE\_MAX**   64\

### Functions

\_\_rte\_experimental struct rte\_swx\_ipsec \* **rte\_swx\_ipsec\_find** (const char \*name)\
 \_\_rte\_experimental int **rte\_swx\_ipsec\_create** (struct rte\_swx\_ipsec \*\*ipsec, const char \*name, struct **rte\_swx\_ipsec\_params** \*params, int numa\_node)\
 \_\_rte\_experimental void **rte\_swx\_ipsec\_free** (struct rte\_swx\_ipsec \*ipsec)\
 \_\_rte\_experimental void **rte\_swx\_ipsec\_run** (struct rte\_swx\_ipsec \*ipsec)\
 \_\_rte\_experimental int **rte\_swx\_ipsec\_sa\_add** (struct rte\_swx\_ipsec \*ipsec, struct **rte\_swx\_ipsec\_sa\_params** \*sa\_params, uint32\_t \*sa\_id)\
 \_\_rte\_experimental void **rte\_swx\_ipsec\_sa\_delete** (struct rte\_swx\_ipsec \*ipsec, uint32\_t sa\_id)\
 \_\_rte\_experimental struct **rte\_swx\_ipsec\_sa\_params** \* **rte\_swx\_ipsec\_sa\_read** (struct rte\_swx\_ipsec \*ipsec, const char \*string, int \*is\_blank\_or\_comment, const char \*\*errmsg)\

## Detailed Description

RTE SWX Internet Protocol Security (IPsec)

The IPsec block is a companion block for the SWX pipeline used to provide IPsec support to the pipeline. The block is external to the pipeline, hence it needs to be explicitly instantiated by the user and connected to a pipeline instance through the pipeline I/O ports.

Main features:

- •

  IPsec inbound (encrypted input packets -\> clear text output packets) and outbound (clear text input packets -\> encrypted output packets) processing support for tunnel and transport modes.

Security Association (SA):

- •

  Each IPsec block instance has its own set of SAs used to process the input packets. Each SA is identified by its unique SA ID. The IPsec inbound and outbound SAs share the same ID space.

- •

  Each input packet is first mapped to one of the existing SAs by using the SA ID and then processed according to the identified SA. The SA ID is read from input packet. The SA ID field is typically written by the pipeline before sending the packet to the IPsec block.

Packet format:

- •

  IPsec block input packet (i.e. pipeline output packet):

- •

  IPsec block meta-data header:

**See also**

struct **rte\_swx\_ipsec\_input\_packet\_metadata**.

- •

  IPv4 header.

- •

  IPv4 payload: on the inbound path, it includes the encrypted ESP packet.

- •

  IPsec block output packet (i.e. pipeline input packet):

- •

  IPv4 header.

- •

  IPv4 payload: on the outbound path, it includes the encrypted ESP packet.

SA update procedure:

- •

  To add a new SA,

**See also**

function **rte\_swx\_ipsec\_sa\_add()**.

- •

  To delete an existing SA,

**See also**

function **rte\_swx\_ipsec\_sa\_delete()**.

- •

  To update an existing SA, the control plane has to follow the following steps:

- 1\.

  Add a new SA with potentially a different set of configuration parameters. This step can fail, for example when the SA table is full.

- 2\.

  Wait until no more packets are using the old SA.

- 3\.

  Delete the old SA.

Definition in file **rte\_swx\_ipsec.h**.

## Macro Definition Documentation

### #define RTE\_SWX\_IPSEC\_NAME\_SIZE 64

Name size.

Definition at line **66** of file **rte\_swx\_ipsec.h**.

### #define RTE\_SWX\_IPSEC\_BURST\_SIZE\_MAX 256

Maximum burst size.

Definition at line **71** of file **rte\_swx\_ipsec.h**.

### #define RTE\_SWX\_IPSEC\_KEY\_SIZE\_MAX 64

Maximum key size in bytes.

Definition at line **186** of file **rte\_swx\_ipsec.h**.

## Function Documentation

### \_\_rte\_experimental struct rte\_swx\_ipsec \* rte\_swx\_ipsec\_find (const char \* name)

IPsec instance find

**Parameters**

*name* IPsec instance name.

**Returns**

Valid IPsec instance handle if found or NULL otherwise.

### \_\_rte\_experimental int rte\_swx\_ipsec\_create (struct rte\_swx\_ipsec \*\* ipsec, const char \* name, struct rte\_swx\_ipsec\_params \* params, int numa\_node)

IPsec instance create

**Parameters**

*ipsec* IPsec instance handle. Must point to valid memory. Contains valid pipeline handle once this function returns successfully. \
 *name* IPsec instance unique name. \
 *params* IPsec instance configuration parameters. \
 *numa\_node* Non-Uniform Memory Access (NUMA) node.

**Returns**

0 on success or the following error codes otherwise: -EINVAL: Invalid argument; -ENOMEM: Not enough space/cannot allocate memory; -EEXIST: Pipeline with this name already exists.

### \_\_rte\_experimental void rte\_swx\_ipsec\_free (struct rte\_swx\_ipsec \* ipsec)

IPsec instance free

**Parameters**

*ipsec* IPsec instance handle.

### \_\_rte\_experimental void rte\_swx\_ipsec\_run (struct rte\_swx\_ipsec \* ipsec)

IPsec Data Plane API IPsec instance run

**Parameters**

*ipsec* IPsec instance handle.

### \_\_rte\_experimental int rte\_swx\_ipsec\_sa\_add (struct rte\_swx\_ipsec \* ipsec, struct rte\_swx\_ipsec\_sa\_params \* sa\_params, uint32\_t \* sa\_id)

IPsec SA add

**Parameters**

*ipsec* IPsec instance handle. \
 *sa\_params* SA parameters. \
 *sa\_id* On success, the SA ID.

**Returns**

0 on success or error code otherwise.

### \_\_rte\_experimental void rte\_swx\_ipsec\_sa\_delete (struct rte\_swx\_ipsec \* ipsec, uint32\_t sa\_id)

IPsec SA delete

It is the responibility of the Control Plane to make sure the SA to be deleted is no longer used by the Data Plane.

**Parameters**

*ipsec* IPsec instance handle. \
 *sa\_id* The SA ID.

### \_\_rte\_experimental struct rte\_swx\_ipsec\_sa\_params \* rte\_swx\_ipsec\_sa\_read (struct rte\_swx\_ipsec \* ipsec, const char \* string, int \* is\_blank\_or\_comment, const char \*\* errmsg)

IPsec SA read from string

IPsec SA syntax:

\<sa\> : encrypt \<crypto\_params\> \<encap\_params\> \| decrypt \<crypto\_params\> \<encap\_params\> ;

\<crypto\_params\> : \<cipher\> \<auth\> \| \<aead\> ;

\<cipher\> : cipher \<ciher\_alg\> key \<cipher\_key\> \| cipher \<cipher\_alg\> ;

\<auth\> : auth \<authentication\_alg\> key \<authentication\_key\> \| auth \<authentication\_alg\> ;

\<aead\> : aead \<aead\_alg\> key \<aead\_key\> ;

\<encap\_params\> : esp spi \<spi\> tunnel ipv4 srcaddr \<ipv4\_src\_addr\> dstaddr \<ipv4\_dst\_addr\> \| esp spi \<spi\> tunnel ipv6 srcaddr \<ipv6\_src\_addr\> dstaddr \<ipv6\_dst\_addr\> \| esp spi \<spi\> transport ;

**Parameters**

*ipsec* IPsec instance handle. \
 *string* String containing the SA. \
 *is\_blank\_or\_comment* On error, when its input value is not NULL, this argument is set to a non-zero value when *string* contains a blank or comment line and to zero otherwise. \
 *errmsg* On error, when its input value is not NULL, this argument points to a string with details on the detected error.

**Returns**

Pointer to valid IPsec SA parameters data structure on success or NULL on error.

## Author

Generated automatically by Doxygen for DPDK from the source code.