rte_ipsec.h(3)

📦
version 25.11.3 · 10 versions
, in ubuntu resolute, ubuntu stonking

💖 rte_ipsec.h — Library Functions Manual 💖

okay bestie, so this is the manual page for rte_ipsec.h, like from the DPDK family, and I'm gonna walk you through every single thing in it, no skipping, no gatekeeping, periodt. 🫶

✨ NAME ✨

rte_ipsec.h — that's the whole name, simple, iconic, no notes. 💅

🌸 SYNOPSIS 🌸

First things first, you gotta pull in the headers, like:

#include <rte_ipsec_sa.h>
#include <rte_mbuf.h>
#include <rte_ipsec_group.h>

🦋 Data Structures

okay so these are the structs living in here:

  • struct rte_ipsec_state
  • struct rte_ipsec_sa_pkt_func
  • struct rte_ipsec_session

🎀 Functions

and here's every function, laid out exactly how the page has them:

  • int rte_ipsec_session_prepare (struct rte_ipsec_session *ss)
  • static uint16_t rte_ipsec_pkt_crypto_prepare (const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num)
  • static __rte_experimental uint16_t rte_ipsec_pkt_crypto_prepare_stateless (const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], struct rte_crypto_op *cop[], uint16_t num, struct rte_ipsec_state *state)
  • static __rte_experimental uint16_t rte_ipsec_pkt_cpu_prepare_stateless (const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num, struct rte_ipsec_state *state)
  • static uint16_t rte_ipsec_pkt_process (const struct rte_ipsec_session *ss, struct rte_mbuf *mb[], uint16_t num)
  • int rte_ipsec_telemetry_sa_add (const struct rte_ipsec_sa *sa)
  • void rte_ipsec_telemetry_sa_del (const struct rte_ipsec_sa *sa)

💜 Detailed Description 💜

So, RTE IPsec support. That's the vibe.

librte_ipsec hands you a whole framework for doing data-path IPsec protocol processing (ESP/AH). That's the main character energy right there. 👑

Definition in file rte_ipsec.h.

🔥 Function Documentation 🔥

int rte_ipsec_session_prepare (struct rte_ipsec_session * ss)

This one checks that inside the given rte_ipsec_session, the crypto/security fields are actually filled in correctly, and then it sets up the function pointers based on those values. Important though — it expects that the caller has already filled in every field correctly except the IPsec processing function pointers (pkt_func). So don't come to it half-done, bestie, it's not gonna do that part for you. 😭

Parameters

  • ss — Pointer to the rte_ipsec_session object.

Returns

  • Zero if operation completed successfully. ✨
  • -EINVAL if the parameters are invalid. 💀

uint16_t rte_ipsec_pkt_crypto_prepare (const struct rte_ipsec_session * ss, struct rte_mbuf * mb[], struct rte_crypto_op * cop[], uint16_t num)

[inline], [static]

okay so for the input mbufs and a given IPsec session, this prepares crypto ops that you can enqueue into the cryptodev associated with that session. It expects that for each input packet:

  • l2_len, l3_len are setup correctly.

Note that erroneous mbufs are not freed by the function — instead they get placed beyond the last valid mbuf in the mb array. It is a user responsibility to handle them further. So yeah, they're just sitting there past the valid ones, and that's on you. 🙈

Parameters

  • ss — Pointer to the rte_ipsec_session object the packets belong to.
  • mb — The address of an array of num pointers to rte_mbuf structures which contain the input packets.
  • cop — The address of an array of num pointers to the output rte_crypto_op structures.
  • num — The maximum number of packets to process.

Returns

Number of successfully processed packets, with error code set in rte_errno.

Definition at line 138 of file rte_ipsec.h.

__rte_experimental uint16_t rte_ipsec_pkt_crypto_prepare_stateless (const struct rte_ipsec_session * ss, struct rte_mbuf * mb[], struct rte_crypto_op * cop[], uint16_t num, struct rte_ipsec_state * state)

[inline], [static]

Same as rte_ipsec_pkt_crypto_prepare, but the processing is done based on the IPsec state provided by the state parameter. And listen — internal IPsec state won't be updated when this API is called. Stateless means stateless, bestie. 💅

For input mbufs and given IPsec session prepare crypto ops that can be enqueued into the cryptodev associated with given session. expects that for each input packet:

  • l2_len, l3_len are setup correctly.

Note that erroneous mbufs are not freed by the function, but are placed beyond last valid mbuf in the mb array. It is a user responsibility to handle them further.

Parameters

  • ss — Pointer to the rte_ipsec_session object the packets belong to.
  • mb — The address of an array of num pointers to rte_mbuf structures which contain the input packets.
  • cop — The address of an array of num pointers to the output rte_crypto_op structures.
  • num — The maximum number of packets to process.
  • state — The IPsec state to be used for processing current batch of packets.

Returns

Number of successfully processed packets, with error code set in rte_errno.

Definition at line 180 of file rte_ipsec.h.

__rte_experimental uint16_t rte_ipsec_pkt_cpu_prepare_stateless (const struct rte_ipsec_session * ss, struct rte_mbuf * mb[], uint16_t num, struct rte_ipsec_state * state)

[inline], [static]

Same as rte_ipsec_pkt_crypto_prepare_stateless, but this time the processing happens in synchronous mode. Slay. ✨

Parameters

  • ss — Pointer to the rte_ipsec_session object the packets belong to.
  • mb — The address of an array of num pointers to rte_mbuf structures which contain the input packets.
  • num — The maximum number of packets to process.
  • state — The IPsec state to be used for processing current batch of packets.

Returns

Number of successfully processed packets, with error code set in rte_errno.

Definition at line 205 of file rte_ipsec.h.

uint16_t rte_ipsec_pkt_process (const struct rte_ipsec_session * ss, struct rte_mbuf * mb[], uint16_t num)

[inline], [static]

This is the closer 🎬 — it finalises processing of packets after crypto-dev finished with them, or it processes packets that are subjects to inline IPsec offload.

Expects that for each input packet:

  • l2_len, l3_len are setup correctly.

Output mbufs will be:

  • inbound — decrypted & authenticated, ESP(AH) related headers removed, l2_len and l3_len fields are updated.
  • outbound — appropriate mbuf fields (ol_flags, tx_offloads, etc.) properly setup, if necessary — IP headers updated, ESP(AH) fields added.

Note that erroneous mbufs are not freed by the function, but are placed beyond last valid mbuf in the mb array. It is a user responsibility to handle them further. 🫶

Parameters

  • ss — Pointer to the rte_ipsec_session object the packets belong to.
  • mb — The address of an array of num pointers to rte_mbuf structures which contain the input packets.
  • num — The maximum number of packets to process.

Returns

Number of successfully processed packets, with error code set in rte_errno.

Definition at line 235 of file rte_ipsec.h.

int rte_ipsec_telemetry_sa_add (const struct rte_ipsec_sa * sa)

Turns on per-SA telemetry for a specific SA. Obsessed. 🎀

Heads up bestie: note that this function is not thread safe. 😭

Parameters

  • sa — Pointer to the rte_ipsec_sa object that will have telemetry enabled.

Returns

0 on success, negative value otherwise.

void rte_ipsec_telemetry_sa_del (const struct rte_ipsec_sa * sa)

Turns off per-SA telemetry for a specific SA. The reverse of a slay.

Same warning, no cap: note that this function is not thread safe. 💀

Parameters

  • sa — Pointer to the rte_ipsec_sa object that will have telemetry disabled.

🌈 Author 🌈

Generated automatically by Doxygen for DPDK from the source code. (Not a human, just a robot doing its little robot thing. 🤖🫶)

and that's the whole page, bestie!! DPDK Version 25.11.3, rte_ipsec.h(3), bye bestie, go encrypt something responsibly 💖✨🎀🦋🌸💅

📦 where this page comes from