---
name: "rte_security.h"
section: "3"
platform: "linux"
package: "dpdk-doc"
version: "24.11.4-0+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/rte_security.h"
---

# rte\_security.h(3)

## NAME

rte\_security.h

## SYNOPSIS

`#include <sys/types.h>`\
 `#include <rte_compat.h>`\
 `#include <rte_common.h>`\
 `#include <rte_crypto.h>`\
 `#include <rte_ip.h>`\
 `#include <rte_mbuf_dyn.h>`\

### Data Structures

struct **rte\_security\_ipsec\_tunnel\_param**\
 struct **rte\_security\_ipsec\_sa\_options**\
 struct **rte\_security\_ipsec\_lifetime**\
 struct **rte\_security\_ipsec\_xform**\
 struct **rte\_security\_macsec\_sa**\
 struct **rte\_security\_macsec\_sc**\
 struct **rte\_security\_macsec\_xform**\
 struct **rte\_security\_pdcp\_xform**\
 struct **rte\_security\_docsis\_xform**\
 struct **rte\_security\_tls\_record\_sess\_options**\
 struct **rte\_security\_tls\_record\_lifetime**\
 struct **rte\_security\_tls\_record\_xform**\
 struct **rte\_security\_session\_conf**\
 struct **rte\_security\_capability**\
 struct **rte\_security\_capability\_idx**\

### Macros

\#define **RTE\_SECURITY\_IPSEC\_TUNNEL\_VERIFY\_DST\_ADDR**   0x1\
 \#define **RTE\_SEC\_CTX\_F\_FAST\_SET\_MDATA**   0x00000001\
 \#define **RTE\_SECURITY\_MACSEC\_NUM\_AN**   4\
 \#define **RTE\_SECURITY\_MACSEC\_SALT\_LEN**   12\
 \#define **RTE\_SECURITY\_MACSEC\_VALIDATE\_DISABLE**   0\
 \#define **RTE\_SECURITY\_MACSEC\_VALIDATE\_NO\_DISCARD**   1\
 \#define **RTE\_SECURITY\_MACSEC\_VALIDATE\_STRICT**   2\
 \#define **RTE\_SECURITY\_MACSEC\_VALIDATE\_NO\_OP**   3\
 \#define **RTE\_SECURITY\_TLS\_1\_2\_IMP\_NONCE\_LEN**   4\
 \#define **RTE\_SECURITY\_TLS\_1\_3\_IMP\_NONCE\_LEN**   12\
 \#define **RTE\_SECURITY\_DTLS\_1\_2\_IMP\_NONCE\_LEN**   4\
 \#define **RTE\_SECURITY\_PDCP\_ORDERING\_CAP**   0x00000001\
 \#define **RTE\_SECURITY\_PDCP\_DUP\_DETECT\_CAP**   0x00000002\
 \#define **RTE\_SECURITY\_TX\_OLOAD\_NEED\_MDATA**   0x00000001\
 \#define **RTE\_SECURITY\_TX\_HW\_TRAILER\_OFFLOAD**   0x00000002\
 \#define **RTE\_SECURITY\_RX\_HW\_TRAILER\_OFFLOAD**   0x00010000\

### Typedefs

**typedef** uint64\_t **rte\_security\_dynfield\_t**\
 **typedef** struct **rte\_mbuf** \* **rte\_security\_oop\_dynfield\_t**\

### Enumerations

enum **rte\_security\_ipsec\_sa\_mode** { **RTE\_SECURITY\_IPSEC\_SA\_MODE\_TRANSPORT** = 1, **RTE\_SECURITY\_IPSEC\_SA\_MODE\_TUNNEL** }\
 enum **rte\_security\_ipsec\_sa\_protocol** { **RTE\_SECURITY\_IPSEC\_SA\_PROTO\_AH** = 1, **RTE\_SECURITY\_IPSEC\_SA\_PROTO\_ESP** }\
 enum **rte\_security\_ipsec\_tunnel\_type** { **RTE\_SECURITY\_IPSEC\_TUNNEL\_IPV4** = 1, **RTE\_SECURITY\_IPSEC\_TUNNEL\_IPV6** }\
 enum **rte\_security\_ipsec\_sa\_direction** { **RTE\_SECURITY\_IPSEC\_SA\_DIR\_EGRESS**, **RTE\_SECURITY\_IPSEC\_SA\_DIR\_INGRESS** }\
 enum **rte\_security\_macsec\_direction** { **RTE\_SECURITY\_MACSEC\_DIR\_TX**, **RTE\_SECURITY\_MACSEC\_DIR\_RX** }\
 enum **rte\_security\_macsec\_alg** { **RTE\_SECURITY\_MACSEC\_ALG\_GCM\_128**, **RTE\_SECURITY\_MACSEC\_ALG\_GCM\_256**, **RTE\_SECURITY\_MACSEC\_ALG\_GCM\_XPN\_128**, **RTE\_SECURITY\_MACSEC\_ALG\_GCM\_XPN\_256** }\
 enum **rte\_security\_pdcp\_domain** { **RTE\_SECURITY\_PDCP\_MODE\_CONTROL**, **RTE\_SECURITY\_PDCP\_MODE\_DATA**, **RTE\_SECURITY\_PDCP\_MODE\_SHORT\_MAC** }\
 enum **rte\_security\_pdcp\_direction** { **RTE\_SECURITY\_PDCP\_UPLINK**, **RTE\_SECURITY\_PDCP\_DOWNLINK** }\
 enum **rte\_security\_pdcp\_sn\_size** { **RTE\_SECURITY\_PDCP\_SN\_SIZE\_5** = 5, **RTE\_SECURITY\_PDCP\_SN\_SIZE\_7** = 7, **RTE\_SECURITY\_PDCP\_SN\_SIZE\_12** = 12, **RTE\_SECURITY\_PDCP\_SN\_SIZE\_15** = 15, **RTE\_SECURITY\_PDCP\_SN\_SIZE\_18** = 18 }\
 enum **rte\_security\_docsis\_direction** { **RTE\_SECURITY\_DOCSIS\_UPLINK**, **RTE\_SECURITY\_DOCSIS\_DOWNLINK** }\
 enum **rte\_security\_tls\_version** { **RTE\_SECURITY\_VERSION\_TLS\_1\_2**, **RTE\_SECURITY\_VERSION\_TLS\_1\_3**, **RTE\_SECURITY\_VERSION\_DTLS\_1\_2** }\
 enum **rte\_security\_tls\_sess\_type** { **RTE\_SECURITY\_TLS\_SESS\_TYPE\_READ**, **RTE\_SECURITY\_TLS\_SESS\_TYPE\_WRITE** }\
 enum **rte\_security\_session\_action\_type** { **RTE\_SECURITY\_ACTION\_TYPE\_NONE**, **RTE\_SECURITY\_ACTION\_TYPE\_INLINE\_CRYPTO**, **RTE\_SECURITY\_ACTION\_TYPE\_INLINE\_PROTOCOL**, **RTE\_SECURITY\_ACTION\_TYPE\_LOOKASIDE\_PROTOCOL**, **RTE\_SECURITY\_ACTION\_TYPE\_CPU\_CRYPTO** }\
 enum **rte\_security\_session\_protocol** { **RTE\_SECURITY\_PROTOCOL\_IPSEC** = 1, **RTE\_SECURITY\_PROTOCOL\_MACSEC**, **RTE\_SECURITY\_PROTOCOL\_PDCP**, **RTE\_SECURITY\_PROTOCOL\_DOCSIS**, **RTE\_SECURITY\_PROTOCOL\_TLS\_RECORD** }\

### Functions

void \* **rte\_security\_session\_create** (void \*instance, struct **rte\_security\_session\_conf** \*conf, struct **rte\_mempool** \*mp)\
 int **rte\_security\_session\_update** (void \*instance, void \*sess, struct **rte\_security\_session\_conf** \*conf)\
 unsigned int **rte\_security\_session\_get\_size** (void \*instance)\
 int **rte\_security\_session\_destroy** (void \*instance, void \*sess)\
 int **rte\_security\_macsec\_sc\_create** (void \*instance, struct **rte\_security\_macsec\_sc** \*conf)\
 int **rte\_security\_macsec\_sc\_destroy** (void \*instance, uint16\_t sc\_id, enum **rte\_security\_macsec\_direction** dir)\
 int **rte\_security\_macsec\_sa\_create** (void \*instance, struct **rte\_security\_macsec\_sa** \*conf)\
 int **rte\_security\_macsec\_sa\_destroy** (void \*instance, uint16\_t sa\_id, enum **rte\_security\_macsec\_direction** dir)\
 static **rte\_security\_dynfield\_t** \* **rte\_security\_dynfield** (struct **rte\_mbuf** \*mbuf)\
 static \_\_rte\_experimental **rte\_security\_oop\_dynfield\_t** \* **rte\_security\_oop\_dynfield** (struct **rte\_mbuf** \*mbuf)\
 static bool **rte\_security\_dynfield\_is\_registered** (void)\
 static uint32\_t **rte\_security\_ctx\_flags\_get** (void \*ctx)\
 static void **rte\_security\_ctx\_flags\_set** (void \*ctx, uint32\_t flags)\
 static uint64\_t **rte\_security\_session\_opaque\_data\_get** (void \*sess)\
 static void **rte\_security\_session\_opaque\_data\_set** (void \*sess, uint64\_t opaque)\
 static uint64\_t **rte\_security\_session\_fast\_mdata\_get** (void \*sess)\
 static void **rte\_security\_session\_fast\_mdata\_set** (void \*sess, uint64\_t fdata)\
 int **\_\_rte\_security\_set\_pkt\_metadata** (void \*instance, void \*sess, struct **rte\_mbuf** \*m, void \*params)\
 static int **rte\_security\_set\_pkt\_metadata** (void \*instance, void \*sess, struct **rte\_mbuf** \*mb, void \*params)\
 static int **\_\_rte\_security\_attach\_session** (struct **rte\_crypto\_sym\_op** \*sym\_op, void \*sess)\
 static int **rte\_security\_attach\_session** (struct **rte\_crypto\_op** \*op, void \*sess)\
 int **rte\_security\_session\_stats\_get** (void \*instance, void \*sess, struct rte\_security\_stats \*stats)\
 int **rte\_security\_macsec\_sa\_stats\_get** (void \*instance, uint16\_t sa\_id, enum **rte\_security\_macsec\_direction** dir, struct rte\_security\_macsec\_sa\_stats \*stats)\
 int **rte\_security\_macsec\_sc\_stats\_get** (void \*instance, uint16\_t sc\_id, enum **rte\_security\_macsec\_direction** dir, struct rte\_security\_macsec\_sc\_stats \*stats)\
 const struct **rte\_security\_capability** \* **rte\_security\_capabilities\_get** (void \*instance)\
 const struct **rte\_security\_capability** \* **rte\_security\_capability\_get** (void \*instance, struct **rte\_security\_capability\_idx** \*idx)\
 \_\_rte\_experimental int **rte\_security\_rx\_inject\_configure** (void \*ctx, uint16\_t port\_id, bool enable)\
 \_\_rte\_experimental uint16\_t **rte\_security\_inb\_pkt\_rx\_inject** (void \*ctx, struct **rte\_mbuf** \*\*pkts, void \*\*sess, uint16\_t nb\_pkts)\

### Variables

int **rte\_security\_dynfield\_offset**\
 int **rte\_security\_oop\_dynfield\_offset**\

## Detailed Description

RTE Security Common Definitions

Definition in file **rte\_security.h**.

## Macro Definition Documentation

### #define RTE\_SECURITY\_IPSEC\_TUNNEL\_VERIFY\_DST\_ADDR 0x1

IPSEC tunnel header verification mode

Controls how outer IP header is verified in inbound.

Definition at line **56** of file **rte\_security.h**.

### #define RTE\_SEC\_CTX\_F\_FAST\_SET\_MDATA 0x00000001

Driver uses fast metadata update without using driver specific callback. For fast mdata, mbuf dynamic field would be registered by driver via rte\_security\_dynfield\_register().

Definition at line **63** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_NUM\_AN 4

Maximum number of association numbers for a secure channel.

Definition at line **345** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_SALT\_LEN 12

Salt length for MACsec SA.

Definition at line **347** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_VALIDATE\_DISABLE 0

Disable Validation of MACsec frame.

Definition at line **418** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_VALIDATE\_NO\_DISCARD 1

Validate MACsec frame but do not discard invalid frame.

Definition at line **420** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_VALIDATE\_STRICT 2

Validate MACsec frame and discart invalid frame.

Definition at line **422** of file **rte\_security.h**.

### #define RTE\_SECURITY\_MACSEC\_VALIDATE\_NO\_OP 3

Do not perform any MACsec operation.

Definition at line **424** of file **rte\_security.h**.

### #define RTE\_SECURITY\_TLS\_1\_2\_IMP\_NONCE\_LEN 4

Implicit nonce length to be used with AEAD algos in TLS 1.2

Definition at line **601** of file **rte\_security.h**.

### #define RTE\_SECURITY\_TLS\_1\_3\_IMP\_NONCE\_LEN 12

Implicit nonce length to be used with AEAD algos in TLS 1.3

Definition at line **603** of file **rte\_security.h**.

### #define RTE\_SECURITY\_DTLS\_1\_2\_IMP\_NONCE\_LEN 4

Implicit nonce length to be used with AEAD algos in DTLS 1.2

Definition at line **605** of file **rte\_security.h**.

### #define RTE\_SECURITY\_PDCP\_ORDERING\_CAP 0x00000001

Underlying Hardware/driver which support PDCP may or may not support packet ordering. Set RTE\_SECURITY\_PDCP\_ORDERING\_CAP if it support. If it is not set, driver/HW assumes packets received are in order and it will be application's responsibility to maintain ordering.

Definition at line **1340** of file **rte\_security.h**.

### #define RTE\_SECURITY\_PDCP\_DUP\_DETECT\_CAP 0x00000002

Underlying Hardware/driver which support PDCP may or may not detect duplicate packet. Set RTE\_SECURITY\_PDCP\_DUP\_DETECT\_CAP if it support. If it is not set, driver/HW assumes there is no duplicate packet received.

Definition at line **1346** of file **rte\_security.h**.

### #define RTE\_SECURITY\_TX\_OLOAD\_NEED\_MDATA 0x00000001

HW needs metadata update, see **rte\_security\_set\_pkt\_metadata()**.

Definition at line **1350** of file **rte\_security.h**.

### #define RTE\_SECURITY\_TX\_HW\_TRAILER\_OFFLOAD 0x00000002

HW constructs trailer of packets Transmitted packets will have the trailer added to them by hardware. The next protocol field will be based on the mbuf-\>inner\_esp\_next\_proto field.

Definition at line **1357** of file **rte\_security.h**.

### #define RTE\_SECURITY\_RX\_HW\_TRAILER\_OFFLOAD 0x00010000

HW removes trailer of packets Received packets have no trailer, the next protocol field is supplied in the mbuf-\>inner\_esp\_next\_proto field. Inner packet is not modified.

Definition at line **1363** of file **rte\_security.h**.

## Typedef Documentation

### typedef uint64\_t rte\_security\_dynfield\_t

Device-specific metadata field type

Definition at line **915** of file **rte\_security.h**.

### typedef struct rte\_mbuf\* rte\_security\_oop\_dynfield\_t

Out-of-Place(OOP) processing field type

Definition at line **920** of file **rte\_security.h**.

## Enumeration Type Documentation

### enum rte\_security\_ipsec\_sa\_mode

IPSec protocol mode

**Enumerator**

- *RTE\_SECURITY\_IPSEC\_SA\_MODE\_TRANSPORT*

  *IPSec Transport mode*

- *RTE\_SECURITY\_IPSEC\_SA\_MODE\_TUNNEL*

  *IPSec Tunnel mode*

*Definition at line* **28** *of file* **rte\_security.h***.*

### enum rte\_security\_ipsec\_sa\_protocol

*IPSec Protocol*

**Enumerator**

- *RTE\_SECURITY\_IPSEC\_SA\_PROTO\_AH*

  *AH protocol*

- *RTE\_SECURITY\_IPSEC\_SA\_PROTO\_ESP*

  *ESP protocol*

*Definition at line* **36** *of file* **rte\_security.h***.*

### enum rte\_security\_ipsec\_tunnel\_type

*IPSEC tunnel type*

**Enumerator**

- *RTE\_SECURITY\_IPSEC\_TUNNEL\_IPV4*

  *Outer header is IPv4*

- *RTE\_SECURITY\_IPSEC\_TUNNEL\_IPV6*

  *Outer header is IPv6*

*Definition at line* **44** *of file* **rte\_security.h***.*

### enum rte\_security\_ipsec\_sa\_direction

*IPSec security association direction*

**Enumerator**

- *RTE\_SECURITY\_IPSEC\_SA\_DIR\_EGRESS*

  *Encrypt and generate digest*

- *RTE\_SECURITY\_IPSEC\_SA\_DIR\_INGRESS*

  *Verify digest and decrypt*

*Definition at line* **265** *of file* **rte\_security.h***.*

### enum rte\_security\_macsec\_direction

*MACSec packet flow direction*

**Enumerator**

- *RTE\_SECURITY\_MACSEC\_DIR\_TX*

  *Generate SecTag and encrypt/authenticate*

- *RTE\_SECURITY\_MACSEC\_DIR\_RX*

  *Remove SecTag and decrypt/verify*

*Definition at line* **337** *of file* **rte\_security.h***.*

### enum rte\_security\_macsec\_alg

*MACsec Supported Algorithm list as per IEEE Std 802.1AE.*

**Enumerator**

- *RTE\_SECURITY\_MACSEC\_ALG\_GCM\_128*

  *AES-GCM 128 bit block cipher*

- *RTE\_SECURITY\_MACSEC\_ALG\_GCM\_256*

  *AES-GCM 256 bit block cipher*

- *RTE\_SECURITY\_MACSEC\_ALG\_GCM\_XPN\_128*

  *AES-GCM 128 bit block cipher with unique SSCI*

- *RTE\_SECURITY\_MACSEC\_ALG\_GCM\_XPN\_256*

  *AES-GCM 256 bit block cipher with unique SSCI*

*Definition at line* **410** *of file* **rte\_security.h***.*

### enum rte\_security\_pdcp\_domain

*PDCP Mode of session*

**Enumerator**

- *RTE\_SECURITY\_PDCP\_MODE\_CONTROL*

  *PDCP control plane*

- *RTE\_SECURITY\_PDCP\_MODE\_DATA*

  *PDCP data plane*

- *RTE\_SECURITY\_PDCP\_MODE\_SHORT\_MAC*

  *PDCP short mac*

*Definition at line* **505** *of file* **rte\_security.h***.*

### enum rte\_security\_pdcp\_direction

*PDCP Frame direction*

**Enumerator**

- *RTE\_SECURITY\_PDCP\_UPLINK*

  *Uplink*

- *RTE\_SECURITY\_PDCP\_DOWNLINK*

  *Downlink*

*Definition at line* **512** *of file* **rte\_security.h***.*

### enum rte\_security\_pdcp\_sn\_size

*PDCP Sequence Number Size selectors*

**Enumerator**

- *RTE\_SECURITY\_PDCP\_SN\_SIZE\_5*

  *PDCP\_SN\_SIZE\_5: 5bit sequence number*

- *RTE\_SECURITY\_PDCP\_SN\_SIZE\_7*

  *PDCP\_SN\_SIZE\_7: 7bit sequence number*

- *RTE\_SECURITY\_PDCP\_SN\_SIZE\_12*

  *PDCP\_SN\_SIZE\_12: 12bit sequence number*

- *RTE\_SECURITY\_PDCP\_SN\_SIZE\_15*

  *PDCP\_SN\_SIZE\_15: 15bit sequence number*

- *RTE\_SECURITY\_PDCP\_SN\_SIZE\_18*

  *PDCP\_SN\_SIZE\_18: 18bit sequence number*

*Definition at line* **518** *of file* **rte\_security.h***.*

### enum rte\_security\_docsis\_direction

*DOCSIS direction*

**Enumerator**

- *RTE\_SECURITY\_DOCSIS\_UPLINK*

  *Uplink*

- •

  *Decryption, followed by CRC Verification*

- *RTE\_SECURITY\_DOCSIS\_DOWNLINK*

  *Downlink*

- •

  *CRC Generation, followed by Encryption*

*Definition at line* **579** *of file* **rte\_security.h***.*

### enum rte\_security\_tls\_version

*TLS version*

**Enumerator**

- *RTE\_SECURITY\_VERSION\_TLS\_1\_2*

  *TLS 1.2*

- *RTE\_SECURITY\_VERSION\_TLS\_1\_3*

  *TLS 1.3*

- *RTE\_SECURITY\_VERSION\_DTLS\_1\_2*

  *DTLS 1.2*

*Definition at line* **608** *of file* **rte\_security.h***.*

### enum rte\_security\_tls\_sess\_type

*TLS session type*

**Enumerator**

- *RTE\_SECURITY\_TLS\_SESS\_TYPE\_READ*

  *Record read session*

- •

  *Decrypt & digest verification.*

- *RTE\_SECURITY\_TLS\_SESS\_TYPE\_WRITE*

  *Record write session*

- •

  *Encrypt & digest generation.*

*Definition at line* **615** *of file* **rte\_security.h***.*

### enum rte\_security\_session\_action\_type

*Security session action type.*

**Enumerator**

- *RTE\_SECURITY\_ACTION\_TYPE\_NONE*

  *No security actions*

- *RTE\_SECURITY\_ACTION\_TYPE\_INLINE\_CRYPTO*

  *Crypto processing for security protocol is processed inline during transmission*

- *RTE\_SECURITY\_ACTION\_TYPE\_INLINE\_PROTOCOL*

  *All security protocol processing is performed inline during transmission*

- *RTE\_SECURITY\_ACTION\_TYPE\_LOOKASIDE\_PROTOCOL*

  *All security protocol processing including crypto is performed on a lookaside accelerator*

- *RTE\_SECURITY\_ACTION\_TYPE\_CPU\_CRYPTO*

  *Similar to ACTION\_TYPE\_NONE but crypto processing for security protocol is processed synchronously by a CPU.*

*Definition at line* **731** *of file* **rte\_security.h***.*

### enum rte\_security\_session\_protocol

*Security session protocol definition*

**Enumerator**

- *RTE\_SECURITY\_PROTOCOL\_IPSEC*

  *IPsec Protocol*

- *RTE\_SECURITY\_PROTOCOL\_MACSEC*

  *MACSec Protocol*

- *RTE\_SECURITY\_PROTOCOL\_PDCP*

  *PDCP Protocol*

- *RTE\_SECURITY\_PROTOCOL\_DOCSIS*

  *DOCSIS Protocol*

- *RTE\_SECURITY\_PROTOCOL\_TLS\_RECORD*

  *TLS Record Protocol*

*Definition at line* **755** *of file* **rte\_security.h***.*

## Function Documentation

### void \* rte\_security\_session\_create (void \* instance, struct rte\_security\_session\_conf \* conf, struct rte\_mempool \* mp)

*Create security session as specified by the session configuration*

**Parameters**

*instance security instance* \
 *conf session configuration parameters* \
 *mp mempool to allocate session objects from*

**Returns**

- •

  *On success, pointer to session*

- •

  *On failure, NULL*

### int rte\_security\_session\_update (void \* instance, void \* sess, struct rte\_security\_session\_conf \* conf)

*Update security session as specified by the session configuration*

**Parameters**

*instance security instance* \
 *sess session to update parameters* \
 *conf update configuration parameters*

**Returns**

- •

  *On success returns 0*

- •

  *On failure returns a negative errno value.*

### unsigned int rte\_security\_session\_get\_size (void \* instance)

*Get the size of the security session data for a device.*

**Parameters**

*instance security instance.*

**Returns**

- •

  *Size of the private data, if successful*

- •

  *0 if device is invalid or does not support the operation.*

### int rte\_security\_session\_destroy (void \* instance, void \* sess)

*Free security session header and the session private data and return it to its original mempool.*

**Parameters**

*instance security instance* \
 *sess security session to be freed*

**Returns**

- •

  *0 if successful.*

- •

  *-EINVAL if session or context instance is NULL.*

- •

  *-EBUSY if not all device private data has been freed.*

- •

  *-ENOTSUP if destroying private data is not supported.*

- •

  *other negative values in case of freeing private data errors.*

### int rte\_security\_macsec\_sc\_create (void \* instance, struct rte\_security\_macsec\_sc \* conf)

*Create MACsec security channel (SC).*

**Parameters**

*instance security instance* \
 *conf MACsec SC configuration params*

**Returns**

- •

  *secure channel ID if successful.*

- •

  *-EINVAL if configuration params are invalid of instance is NULL.*

- •

  *-ENOTSUP if device does not support MACsec.*

- •

  *-ENOMEM if PMD is not capable to create more SC.*

- •

  *other negative value for other errors.*

### int rte\_security\_macsec\_sc\_destroy (void \* instance, uint16\_t sc\_id, enum rte\_security\_macsec\_direction dir)

*Destroy MACsec security channel (SC).*

**Parameters**

*instance security instance* \
 *sc\_id SC ID to be destroyed* \
 *dir direction of the SC*

**Returns**

- •

  *0 if successful.*

- •

  *-EINVAL if sc\_id is invalid or instance is NULL.*

- •

  *-EBUSY if sc is being used by some session.*

### int rte\_security\_macsec\_sa\_create (void \* instance, struct rte\_security\_macsec\_sa \* conf)

*Create MACsec security association (SA).*

**Parameters**

*instance security instance* \
 *conf MACsec SA configuration params*

**Returns**

- •

  *positive SA ID if successful.*

- •

  *-EINVAL if configuration params are invalid of instance is NULL.*

- •

  *-ENOTSUP if device does not support MACsec.*

- •

  *-ENOMEM if PMD is not capable to create more SAs.*

- •

  *other negative value for other errors.*

### int rte\_security\_macsec\_sa\_destroy (void \* instance, uint16\_t sa\_id, enum rte\_security\_macsec\_direction dir)

*Destroy MACsec security association (SA).*

**Parameters**

*instance security instance* \
 *sa\_id SA ID to be destroyed* \
 *dir direction of the SA*

**Returns**

- •

  *0 if successful.*

- •

  *-EINVAL if sa\_id is invalid or instance is NULL.*

- •

  *-EBUSY if sa is being used by some session.*

### static rte\_security\_dynfield\_t \* rte\_security\_dynfield (struct rte\_mbuf \* mbuf)` [inline]`, ` [static]`

*Get pointer to mbuf field for device-specific metadata.*

*For performance reason, no check is done, the dynamic field may not be registered.*

**See also**

**rte\_security\_dynfield\_is\_registered**

**Parameters**

*mbuf packet to access*

**Returns**

*pointer to mbuf field*

*Definition at line* **937** *of file* **rte\_security.h***.*

### static \_\_rte\_experimental rte\_security\_oop\_dynfield\_t \* rte\_security\_oop\_dynfield (struct rte\_mbuf \* mbuf)` [inline]`, ` [static]`

**Warning**

**EXPERIMENTAL:** *this API may change without prior notice*

*Get pointer to mbuf field for original mbuf pointer when Out-Of-Place(OOP) processing is enabled in security session.*

**Parameters**

*mbuf packet to access*

**Returns**

*pointer to mbuf field*

*Definition at line* **956** *of file* **rte\_security.h***.*

### static bool rte\_security\_dynfield\_is\_registered (void)` [inline]`, ` [static]`

*Check whether the dynamic field is registered.*

**Returns**

*true if rte\_security\_dynfield\_register() has been called.*

*Definition at line* **968** *of file* **rte\_security.h***.*

### static uint32\_t rte\_security\_ctx\_flags\_get (void \* ctx)` [inline]`, ` [static]`

*Get security flags from security instance.*

*Definition at line* **978** *of file* **rte\_security.h***.*

### static void rte\_security\_ctx\_flags\_set (void \* ctx, uint32\_t flags)` [inline]`, ` [static]`

*Set security flags in security instance.*

*Definition at line* **987** *of file* **rte\_security.h***.*

### static uint64\_t rte\_security\_session\_opaque\_data\_get (void \* sess)` [inline]`, ` [static]`

*Get opaque data from session handle*

*Definition at line* **1000** *of file* **rte\_security.h***.*

### static void rte\_security\_session\_opaque\_data\_set (void \* sess, uint64\_t opaque)` [inline]`, ` [static]`

*Set opaque data in session handle*

*Definition at line* **1009** *of file* **rte\_security.h***.*

### static uint64\_t rte\_security\_session\_fast\_mdata\_get (void \* sess)` [inline]`, ` [static]`

*Get fast mdata from session handle*

*Definition at line* **1020** *of file* **rte\_security.h***.*

### static void rte\_security\_session\_fast\_mdata\_set (void \* sess, uint64\_t fdata)` [inline]`, ` [static]`

*Set fast mdata in session handle*

*Definition at line* **1029** *of file* **rte\_security.h***.*

### int \_\_rte\_security\_set\_pkt\_metadata (void \* instance, void \* sess, struct rte\_mbuf \* m, void \* params)

*Function to call PMD specific function pointer set\_pkt\_metadata()*

### static int rte\_security\_set\_pkt\_metadata (void \* instance, void \* sess, struct rte\_mbuf \* mb, void \* params)` [inline]`, ` [static]`

*Updates the buffer with device-specific defined metadata*

**Parameters**

*instance security instance* \
 *sess security session* \
 *mb packet mbuf to set metadata on.* \
 *params device-specific defined parameters required for metadata*

**Returns**

- •

  *On success, zero.*

- •

  *On failure, a negative value.*

*Definition at line* **1055** *of file* **rte\_security.h***.*

### static int \_\_rte\_security\_attach\_session (struct rte\_crypto\_sym\_op \* sym\_op, void \* sess)` [inline]`, ` [static]`

*Attach a session to a symmetric crypto operation*

**Parameters**

*sym\_op crypto operation* \
 *sess security session*

*Definition at line* **1077** *of file* **rte\_security.h***.*

### static int rte\_security\_attach\_session (struct rte\_crypto\_op \* op, void \* sess)` [inline]`, ` [static]`

*Attach a session to a crypto operation. This API is needed only in case of RTE\_SECURITY\_SESS\_CRYPTO\_PROTO\_OFFLOAD For other rte\_security\_session\_action\_type, ol\_flags in* **rte\_mbuf** *may be defined to perform security operations.*

**Parameters**

*op crypto operation* \
 *sess security session*

*Definition at line* **1094** *of file* **rte\_security.h***.*

### int rte\_security\_session\_stats\_get (void \* instance, void \* sess, struct rte\_security\_stats \* stats)

*Get security session statistics*

**Parameters**

*instance security instance* \
 *sess security session If security session is NULL then global (per security instance) statistics will be retrieved, if supported. Global statistics collection is not dependent on the per session statistics configuration.* \
 *stats statistics*

**Returns**

- •

  *On success, return 0*

- •

  *On failure, a negative value*

### int rte\_security\_macsec\_sa\_stats\_get (void \* instance, uint16\_t sa\_id, enum rte\_security\_macsec\_direction dir, struct rte\_security\_macsec\_sa\_stats \* stats)

*Get MACsec SA statistics.*

**Parameters**

*instance security instance* \
 *sa\_id SA ID for which stats are needed* \
 *dir direction of the SA* \
 *stats statistics*

**Returns**

- •

  *On success, return 0.*

- •

  *On failure, a negative value.*

### int rte\_security\_macsec\_sc\_stats\_get (void \* instance, uint16\_t sc\_id, enum rte\_security\_macsec\_direction dir, struct rte\_security\_macsec\_sc\_stats \* stats)

*Get MACsec SC statistics.*

**Parameters**

*instance security instance* \
 *sc\_id SC ID for which stats are needed* \
 *dir direction of the SC* \
 *stats SC statistics*

**Returns**

- •

  *On success, return 0.*

- •

  *On failure, a negative value.*

### const struct rte\_security\_capability \* rte\_security\_capabilities\_get (void \* instance)

*Returns array of security instance capabilities*

**Parameters**

*instance Security instance.*

**Returns**

- •

  *Returns array of security capabilities.*

- •

  *Return NULL if no capabilities available.*

### const struct rte\_security\_capability \* rte\_security\_capability\_get (void \* instance, struct rte\_security\_capability\_idx \* idx)

*Query if a specific capability is available on security instance*

**Parameters**

*instance security instance.* \
 *idx security capability index to match against*

**Returns**

- •

  *Returns pointer to security capability on match of capability index criteria.*

- •

  *Return NULL if the capability not matched on security instance.*

### \_\_rte\_experimental int rte\_security\_rx\_inject\_configure (void \* ctx, uint16\_t port\_id, bool enable)

**Warning**

**EXPERIMENTAL:** *this API may change, or be removed, without prior notice*

*Configure security device to inject packets to an ethdev port.*

*This API must be called only when both security device and the ethdev is in stopped state. The security device need to be configured before any packets are submitted to* `rte_security_inb_pkt_rx_inject` *API.*

**Parameters**

*ctx Security ctx* \
 *port\_id Port identifier of the ethernet device to which packets need to be injected.* \
 *enable Flag to enable and disable connection between a security device and an ethdev port.*

**Returns**

- •

  *0 if successful.*

- •

  *-EINVAL if context NULL or port\_id is invalid.*

- •

  *-EBUSY if devices are not in stopped state.*

- •

  *-ENOTSUP if security device does not support injecting to ethdev port.*

**See also**

**rte\_security\_inb\_pkt\_rx\_inject**

### \_\_rte\_experimental uint16\_t rte\_security\_inb\_pkt\_rx\_inject (void \* ctx, struct rte\_mbuf \*\* pkts, void \*\* sess, uint16\_t nb\_pkts)

**Warning**

**EXPERIMENTAL:** *this API may change, or be removed, without prior notice*

*Perform security processing of packets and inject the processed packet to ethdev Rx.*

*Rx inject would behave similarly to ethdev loopback but with the additional security processing. In case of ethdev loopback, application would be submitting packets to ethdev Tx queues and would be received as is from ethdev Rx queues. With Rx inject, packets would be received after security processing from ethdev Rx queues.*

*With inline protocol offload capable ethdevs, Rx injection can be used to handle packets which failed the regular security Rx path. This can be due to cases such as outer fragmentation, in which case applications can reassemble the fragments and then subsequently submit for inbound processing and Rx injection, so that packets are received as regular security processed packets.*

*With lookaside protocol offload capable cryptodevs, Rx injection can be used to perform packet parsing after security processing. This would allow for re-classification after security protocol processing is done (ie, inner packet parsing). The ethdev queue on which the packet would be received would be based on rte\_flow rules matching the packet after security processing.*

*The security device which is injecting packets to ethdev Rx need to be configured using* `rte_security_rx_inject_configure` *with enable flag set to* `true` *before any packets are submitted.*

*If* `hash.fdir.h` *field is set in mbuf, it would be treated as the value for* `MARK` *pattern for the subsequent rte\_flow parsing. The packet would appear as if it is received from* `port` *field in mbuf.*

*Since the packet would be received back from ethdev Rx queues, it is expected that application retains/adds L2 header with the mbuf field 'l2\_len' reflecting the size of L2 header in the packet.*

**Parameters**

*ctx Security ctx* \
 *pkts The address of an array of nb\_pkts pointers to* **rte\_mbuf structures which contain the packets.** \
 *sess* **The address of an array of** *nb\_pkts* **pointers to security sessions corresponding to each packet.** \
 *nb\_pkts* **The maximum number of packets to process.**

**Returns**

**The number of packets successfully injected to ethdev Rx. The return value can be less than the value of the** *nb\_pkts* **parameter when the PMD internal queues have been filled up.**

**See also**

**rte\_security\_rx\_inject\_configure**

## Variable Documentation

### int rte\_security\_dynfield\_offset` [extern]`

**Dynamic mbuf field for device-specific metadata**

### int rte\_security\_oop\_dynfield\_offset` [extern]`

**Dynamic mbuf field for pointer to original mbuf for OOP processing session.**

## Author

**Generated automatically by Doxygen for DPDK from the source code.**