---
name: "rte_security_ipsec_sa_options"
section: "3"
platform: "linux"
package: "dpdk-doc"
version: "24.11.4-0+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/rte_security_ipsec_sa_options"
---

# rte\_security\_ipsec\_sa\_options(3)

## NAME

rte\_security\_ipsec\_sa\_options

## SYNOPSIS

`#include <rte_security.h>`

### Data Fields

uint32\_t **esn**: 1\
 uint32\_t **udp\_encap**: 1\
 uint32\_t **copy\_dscp**: 1\
 uint32\_t **copy\_flabel**: 1\
 uint32\_t **copy\_df**: 1\
 uint32\_t **dec\_ttl**: 1\
 uint32\_t **ecn**: 1\
 uint32\_t **stats**: 1\
 uint32\_t **iv\_gen\_disable**: 1\
 uint32\_t **tunnel\_hdr\_verify**: 2\
 uint32\_t **udp\_ports\_verify**: 1\
 uint32\_t **ip\_csum\_enable**: 1\
 uint32\_t **l4\_csum\_enable**: 1\
 uint32\_t **ip\_reassembly\_en**: 1\
 uint32\_t **ingress\_oop**: 1\

## Detailed Description

IPsec Security Association option flags

Definition at line **111** of file **rte\_security.h**.

## Field Documentation

### uint32\_t esn

Extended Sequence Numbers (ESN)

- •

  1: Use extended (64 bit) sequence numbers

- •

  0: Use normal sequence numbers

Definition at line **117** of file **rte\_security.h**.

### uint32\_t udp\_encap

UDP encapsulation

- •

  1: Do UDP encapsulation/decapsulation so that IPSEC packets can traverse through NAT boxes.

- •

  0: No UDP encapsulation

Definition at line **125** of file **rte\_security.h**.

### uint32\_t copy\_dscp

Copy DSCP bits

- •

  1: Copy IPv4 or IPv6 DSCP bits from inner IP header to the outer IP header in encapsulation, and vice versa in decapsulation.

- •

  0: Do not change DSCP field.

Definition at line **134** of file **rte\_security.h**.

### uint32\_t copy\_flabel

Copy IPv6 Flow Label

- •

  1: Copy IPv6 flow label from inner IPv6 header to the outer IPv6 header.

- •

  0: Outer header is not modified.

Definition at line **142** of file **rte\_security.h**.

### uint32\_t copy\_df

Copy IPv4 Don't Fragment bit

- •

  1: Copy the DF bit from the inner IPv4 header to the outer IPv4 header.

- •

  0: Outer header is not modified.

Definition at line **150** of file **rte\_security.h**.

### uint32\_t dec\_ttl

Decrement inner packet Time To Live (TTL) field

- •

  1: In tunnel mode, decrement inner packet IPv4 TTL or IPv6 Hop Limit after tunnel decapsulation, or before tunnel encapsulation.

- •

  0: Inner packet is not modified.

Definition at line **159** of file **rte\_security.h**.

### uint32\_t ecn

Explicit Congestion Notification (ECN)

- •

  1: In tunnel mode, enable outer header ECN Field copied from inner header in tunnel encapsulation, or inner header ECN field construction in decapsulation.

- •

  0: Inner/outer header are not modified.

Definition at line **168** of file **rte\_security.h**.

### uint32\_t stats

Security statistics

- •

  1: Enable per session security statistics collection for this SA, if supported by the driver.

- •

  0: Disable per session security statistics collection for this SA.

Definition at line **176** of file **rte\_security.h**.

### uint32\_t iv\_gen\_disable

Disable IV generation in PMD

- •

  1: Disable IV generation in PMD. When disabled, IV provided in **rte\_crypto\_op** will be used by the PMD.

- •

  0: Enable IV generation in PMD. When enabled, PMD generated random value would be used and application is not required to provide IV.

Note: For inline cases, IV generation would always need to be handled by the PMD.

Definition at line **190** of file **rte\_security.h**.

### uint32\_t tunnel\_hdr\_verify

Verify tunnel header in inbound

- •

  `RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR`: Verify destination IP address.

- •

  `RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR`: Verify both source and destination IP addresses.

Definition at line **199** of file **rte\_security.h**.

### uint32\_t udp\_ports\_verify

Verify UDP encapsulation ports in inbound

- •

  1: Match UDP source and destination ports

- •

  0: Do not match UDP ports

Definition at line **206** of file **rte\_security.h**.

### uint32\_t ip\_csum\_enable

Compute/verify inner packet IPv4 header checksum in tunnel mode

- •

  1: For outbound, compute inner packet IPv4 header checksum before tunnel encapsulation and for inbound, verify after tunnel decapsulation.

- •

  0: Inner packet IP header checksum is not computed/verified.

The checksum verification status would be set in mbuf using RTE\_MBUF\_F\_RX\_IP\_CKSUM\_xxx flags.

Inner IP checksum computation can also be enabled(per operation) by setting the flag RTE\_MBUF\_F\_TX\_IP\_CKSUM in mbuf.

Definition at line **221** of file **rte\_security.h**.

### uint32\_t l4\_csum\_enable

Compute/verify inner packet L4 checksum in tunnel mode

- •

  1: For outbound, compute inner packet L4 checksum before tunnel encapsulation and for inbound, verify after tunnel decapsulation.

- •

  0: Inner packet L4 checksum is not computed/verified.

The checksum verification status would be set in mbuf using RTE\_MBUF\_F\_RX\_L4\_CKSUM\_xxx flags.

Inner L4 checksum computation can also be enabled(per operation) by setting the flags RTE\_MBUF\_F\_TX\_TCP\_CKSUM or RTE\_MBUF\_F\_TX\_SCTP\_CKSUM or RTE\_MBUF\_F\_TX\_UDP\_CKSUM or RTE\_MBUF\_F\_TX\_L4\_MASK in mbuf.

Definition at line **237** of file **rte\_security.h**.

### uint32\_t ip\_reassembly\_en

Enable IP reassembly on inline inbound packets.

- •

  1: Enable driver to try reassembly of encrypted IP packets for this SA, if supported by the driver. This feature will work only if user has successfully set IP reassembly config params using **rte\_eth\_ip\_reassembly\_conf\_set()** for the inline Ethernet device. PMD need to register mbuf dynamic fields using rte\_eth\_ip\_reassembly\_dynfield\_register() and security session creation would fail if dynfield is not registered successfully.

- •

  0: Disable IP reassembly of packets (default).

Definition at line **250** of file **rte\_security.h**.

### uint32\_t ingress\_oop

Enable out of place processing on inline inbound packets.

- •

  1: Enable driver to perform Out-of-place(OOP) processing for this inline inbound SA if supported by driver. PMD need to register mbuf dynamic field using rte\_security\_oop\_dynfield\_register() and security session creation would fail if dynfield is not registered successfully.

- •

  0: Disable OOP processing for this session (default).

Definition at line **261** of file **rte\_security.h**.

## Author

Generated automatically by Doxygen for DPDK from the source code.