git: 9cee48180d7a - main - ktls: Centralize the check for CBC ciphers

The branch main has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=9cee48180d7a3d612110b4433f82bade288f326b

commit 9cee48180d7a3d612110b4433f82bade288f326b
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-07-01 00:52:55 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-07-01 00:52:55 +0000

    ktls: Centralize the check for CBC ciphers
    
    Move the check out of ktls_enable_(rx|tx) and into ktls_create_session.
    
    Reviewed by:    gallatin, markj
    Sponsored by:   Chelsio Communications
    Differential Revision:  https://reviews.freebsd.org/D57973
---
 sys/kern/uipc_ktls.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
index 17189514c2cb..629fe8923466 100644
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -656,6 +656,9 @@ ktls_create_session(struct socket *so, struct tls_enable *en,
 		}
 		break;
 	case CRYPTO_AES_CBC:
+		if (!ktls_cbc_enable)
+			return (EOPNOTSUPP);
+
 		switch (en->auth_algorithm) {
 		case CRYPTO_SHA1_HMAC:
 			break;
@@ -1301,9 +1304,6 @@ ktls_enable_rx(struct socket *so, struct tls_enable *en)
 	if (so->so_rcv.sb_tls_info != NULL)
 		return (EALREADY);
 
-	if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable)
-		return (ENOTSUP);
-
 	error = ktls_create_session(so, en, &tls, KTLS_RX);
 	if (error)
 		return (error);
@@ -1387,9 +1387,6 @@ ktls_enable_tx(struct socket *so, struct tls_enable *en)
 	if (so->so_snd.sb_tls_info != NULL)
 		return (EALREADY);
 
-	if (en->cipher_algorithm == CRYPTO_AES_CBC && !ktls_cbc_enable)
-		return (ENOTSUP);
-
 	/* TLS requires ext pgs */
 	if (mb_use_ext_pgs == 0)
 		return (ENXIO);