git: d3eedbcb799d - stable/15 - ktls: Fix capability checks in ktls_reset_receive_tag()

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=d3eedbcb799ded5d7aa811558f7d73de3c6fcb23

commit d3eedbcb799ded5d7aa811558f7d73de3c6fcb23
Author:     Olivier Cochard <olivier@FreeBSD.org>
AuthorDate: 2026-10-16 04:40:03 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-30 17:40:18 +0000

    ktls: Fix capability checks in ktls_reset_receive_tag()
    
    IFCAP2_RXTLS4 and IFCAP2_RXTLS6 are bit numbers, not masks, so
    ktls_reset_receive_tag() tested if_capenable2 against 0 for IPv4 and against the
    RXTLS4 bit for IPv6. An IPv4 connection with NIC receive TLS offload thus never
    got a new receive tag after its packets moved to another interface, and fell
    back to software decryption for good.
    c721694 fixed the same checks in ktls_alloc_rcv_tag(); use IFCAP2_BIT() here
    as well.
    
    Fixes: fe8c78f ("ktls: Add full support for TLS RX offloading via network interface.")
    
    Approved by:    gallatin, kib
    Sponsored by:   Netflix
    Differential Revision:  https://reviews.freebsd.org/D60757
    
    (cherry picked from commit 32a981471c0147ea494745477434807cf8b6dadb)
---
 sys/kern/uipc_ktls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
index 4ba4bf44dcd2..255277134777 100644
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -1731,10 +1731,10 @@ ktls_reset_receive_tag(void *context, int pending)
 	INP_RUNLOCK(inp);
 
 	if (inp->inp_vflag & INP_IPV6) {
-		if ((if_getcapenable2(ifp) & IFCAP2_RXTLS6) == 0)
+		if ((if_getcapenable2(ifp) & IFCAP2_BIT(IFCAP2_RXTLS6)) == 0)
 			goto out;
 	} else {
-		if ((if_getcapenable2(ifp) & IFCAP2_RXTLS4) == 0)
+		if ((if_getcapenable2(ifp) & IFCAP2_BIT(IFCAP2_RXTLS4)) == 0)
 			goto out;
 	}