git: 32a981471c01 - main - ktls: Fix capability checks in ktls_reset_receive_tag()

The branch main has been updated by olivier:

URL: https://cgit.FreeBSD.org/src/commit/?id=32a981471c0147ea494745477434807cf8b6dadb

commit 32a981471c0147ea494745477434807cf8b6dadb
Author:     Olivier Cochard <olivier@FreeBSD.org>
AuthorDate: 2026-10-16 04:40:03 +0000
Commit:     Olivier Cochard <olivier@FreeBSD.org>
CommitDate: 2026-10-16 04:40:03 +0000

    ktls: Fix capability checks in ktls_reset_receive_tag()
    
    IFCAP2_RXTLS4 and IFCAP2_RXTLS6 are bit numbers, not masks, so
    ktls_reset_receive_tag() tested if_capenable2 against 0 for IPv4 and against the
    RXTLS4 bit for IPv6. An IPv4 connection with NIC receive TLS offload thus never
    got a new receive tag after its packets moved to another interface, and fell
    back to software decryption for good.
    c721694 fixed the same checks in ktls_alloc_rcv_tag(); use IFCAP2_BIT() here
    as well.
    
    Fixes: fe8c78f ("ktls: Add full support for TLS RX offloading via network interface.")
    
    Approved by:    gallatin, kib
    Sponsored by:   Netflix
    Differential Revision:  https://reviews.freebsd.org/D60757
---
 sys/kern/uipc_ktls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
index c1eb080b1455..cfd1f07ba4a7 100644
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -1708,10 +1708,10 @@ ktls_reset_receive_tag(void *context, int pending)
 	INP_RUNLOCK(inp);
 
 	if (inp->inp_vflag & INP_IPV6) {
-		if ((if_getcapenable2(ifp) & IFCAP2_RXTLS6) == 0)
+		if ((if_getcapenable2(ifp) & IFCAP2_BIT(IFCAP2_RXTLS6)) == 0)
 			goto out;
 	} else {
-		if ((if_getcapenable2(ifp) & IFCAP2_RXTLS4) == 0)
+		if ((if_getcapenable2(ifp) & IFCAP2_BIT(IFCAP2_RXTLS4)) == 0)
 			goto out;
 	}