---
name: "rte_ipsec.h"
section: "3"
platform: "linux"
package: "dpdk-doc"
version: "24.11.4-0+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/rte_ipsec.h"
---

# rte\_ipsec.h(3)

## NAME

rte\_ipsec.h

## SYNOPSIS

`#include <rte_ipsec_sa.h>`\
 `#include <rte_mbuf.h>`\
 `#include <rte_ipsec_group.h>`\

### Data Structures

struct **rte\_ipsec\_state**\
 struct **rte\_ipsec\_sa\_pkt\_func**\
 struct **rte\_ipsec\_session**\

### Functions

int **rte\_ipsec\_session\_prepare** (struct **rte\_ipsec\_session** \*ss)\
 static uint16\_t **rte\_ipsec\_pkt\_crypto\_prepare** (const struct **rte\_ipsec\_session** \*ss, struct **rte\_mbuf** \*mb\[\], struct **rte\_crypto\_op** \*cop\[\], uint16\_t num)\
 static \_\_rte\_experimental uint16\_t **rte\_ipsec\_pkt\_crypto\_prepare\_stateless** (const struct **rte\_ipsec\_session** \*ss, struct **rte\_mbuf** \*mb\[\], struct **rte\_crypto\_op** \*cop\[\], uint16\_t num, struct **rte\_ipsec\_state** \*state)\
 static \_\_rte\_experimental uint16\_t **rte\_ipsec\_pkt\_cpu\_prepare\_stateless** (const struct **rte\_ipsec\_session** \*ss, struct **rte\_mbuf** \*mb\[\], uint16\_t num, struct **rte\_ipsec\_state** \*state)\
 static uint16\_t **rte\_ipsec\_pkt\_process** (const struct **rte\_ipsec\_session** \*ss, struct **rte\_mbuf** \*mb\[\], uint16\_t num)\
 int **rte\_ipsec\_telemetry\_sa\_add** (const struct rte\_ipsec\_sa \*sa)\
 void **rte\_ipsec\_telemetry\_sa\_del** (const struct rte\_ipsec\_sa \*sa)\

## Detailed Description

RTE IPsec support.

librte\_ipsec provides a framework for data-path IPsec protocol processing (ESP/AH).

Definition in file **rte\_ipsec.h**.

## Function Documentation

### int rte\_ipsec\_session\_prepare (struct rte\_ipsec\_session \* ss)

Checks that inside given **rte\_ipsec\_session** crypto/security fields are filled correctly and setups function pointers based on these values. Expects that all fields except IPsec processing function pointers (*pkt\_func*) will be filled correctly by caller.

**Parameters**

*ss* Pointer to the **rte\_ipsec\_session object**

**Returns**

- •

  **Zero if operation completed successfully.**

- •

  **-EINVAL if the parameters are invalid.**

### static uint16\_t rte\_ipsec\_pkt\_crypto\_prepare (const struct rte\_ipsec\_session \* ss, struct rte\_mbuf \* mb\[\], struct rte\_crypto\_op \* cop\[\], uint16\_t num)` [inline]`, ` [static]`

**For input mbufs and given IPsec session prepare crypto ops that can be enqueued into the cryptodev associated with given session. expects that for each input packet:**

- •

  **l2\_len, l3\_len are setup correctly Note that erroneous mbufs are not freed by the function, but are placed beyond last valid mbuf in the** *mb* **array. It is a user responsibility to handle them further.**

**Parameters**

*ss* **Pointer to the rte\_ipsec\_session object the packets belong to.** \
 *mb* **The address of an array of** *num* **pointers to rte\_mbuf structures which contain the input packets.** \
 *cop* **The address of an array of** *num* **pointers to the output rte\_crypto\_op structures.** \
 *num* **The maximum number of packets to process.**

**Returns**

**Number of successfully processed packets, with error code set in rte\_errno.**

**Definition at line 138 of file rte\_ipsec.h.**

### static \_\_rte\_experimental uint16\_t rte\_ipsec\_pkt\_crypto\_prepare\_stateless (const struct rte\_ipsec\_session \* ss, struct rte\_mbuf \* mb\[\], struct rte\_crypto\_op \* cop\[\], uint16\_t num, struct rte\_ipsec\_state \* state)` [inline]`, ` [static]`

**Same as** *rte\_ipsec\_pkt\_crypto\_prepare***, but processing is done based on IPsec state provided by the 'state' parameter. Internal IPsec state won't be updated when this API is called.**

**For input mbufs and given IPsec session prepare crypto ops that can be enqueued into the cryptodev associated with given session. expects that for each input packet:**

- •

  **l2\_len, l3\_len are setup correctly Note that erroneous mbufs are not freed by the function, but are placed beyond last valid mbuf in the** *mb* **array. It is a user responsibility to handle them further.**

**Parameters**

*ss* **Pointer to the rte\_ipsec\_session object the packets belong to.** \
 *mb* **The address of an array of** *num* **pointers to rte\_mbuf structures which contain the input packets.** \
 *cop* **The address of an array of** *num* **pointers to the output rte\_crypto\_op structures.** \
 *num* **The maximum number of packets to process.** \
 *state* **The IPsec state to be used for processing current batch of packets.**

**Returns**

**Number of successfully processed packets, with error code set in rte\_errno.**

**Definition at line 180 of file rte\_ipsec.h.**

### static \_\_rte\_experimental uint16\_t rte\_ipsec\_pkt\_cpu\_prepare\_stateless (const struct rte\_ipsec\_session \* ss, struct rte\_mbuf \* mb\[\], uint16\_t num, struct rte\_ipsec\_state \* state)` [inline]`, ` [static]`

**Same as** *rte\_ipsec\_pkt\_crypto\_prepare\_stateless***, but processing is done in synchronous mode.**

**Parameters**

*ss* **Pointer to the rte\_ipsec\_session object the packets belong to.** \
 *mb* **The address of an array of** *num* **pointers to rte\_mbuf structures which contain the input packets.** \
 *num* **The maximum number of packets to process.** \
 *state* **The IPsec state to be used for processing current batch of packets.**

**Returns**

**Number of successfully processed packets, with error code set in rte\_errno.**

**Definition at line 205 of file rte\_ipsec.h.**

### static uint16\_t rte\_ipsec\_pkt\_process (const struct rte\_ipsec\_session \* ss, struct rte\_mbuf \* mb\[\], uint16\_t num)` [inline]`, ` [static]`

**Finalise processing of packets after crypto-dev finished with them or process packets that are subjects to inline IPsec offload. Expects that for each input packet:**

- •

  **l2\_len, l3\_len are setup correctly Output mbufs will be: inbound - decrypted & authenticated, ESP(AH) related headers removed,** *l2\_len* **and** *l3\_len* **fields are updated. outbound - appropriate mbuf fields (ol\_flags, tx\_offloads, etc.) properly setup, if necessary - IP headers updated, ESP(AH) fields added, Note that erroneous mbufs are not freed by the function, but are placed beyond last valid mbuf in the** *mb* **array. It is a user responsibility to handle them further.**

**Parameters**

*ss* **Pointer to the rte\_ipsec\_session object the packets belong to.** \
 *mb* **The address of an array of** *num* **pointers to rte\_mbuf structures which contain the input packets.** \
 *num* **The maximum number of packets to process.**

**Returns**

**Number of successfully processed packets, with error code set in rte\_errno.**

**Definition at line 235 of file rte\_ipsec.h.**

### int rte\_ipsec\_telemetry\_sa\_add (const struct rte\_ipsec\_sa \* sa)

**Enable per SA telemetry for a specific SA. Note that this function is not thread safe**

**Parameters**

*sa* **Pointer to the** *rte\_ipsec\_sa* **object that will have telemetry enabled.**

**Returns**

**0 on success, negative value otherwise.**

### void rte\_ipsec\_telemetry\_sa\_del (const struct rte\_ipsec\_sa \* sa)

**Disable per SA telemetry for a specific SA. Note that this function is not thread safe**

**Parameters**

*sa* **Pointer to the** *rte\_ipsec\_sa* **object that will have telemetry disabled.**

## Author

**Generated automatically by Doxygen for DPDK from the source code.**