- Add a new send tag type for a send that that supports both packet pacing and TLS offload (mostly similar to D22669 but adds a separate structure when allocating the new tag type).
- When allocating a send tag for TLS offload, check to see if the connection already has a rate limiting tag. If so, allocate a tag that supports both rate limiting and TLS offload rather than a plain TLS offload tag.
- When re-allocating a TLS offload tag due to a route change, pass the old tag to ktls_alloc_snd_tag() so that its pacing rate can be copied to the new tag if the old tag supported rate limiting.
- When setting an initial rate on an existing ifnet KTLS connection, set the rate on the inp and then reset the TLS send tag (via ktls_output_eagain) to reallocate a TLS + ratelimit send tag. This allocates the TLS send tag asynchronously from a task queue, so the TLS rate limit tag alloc is always sleepable.
- When modifying a rate on a connection using KTLS, look for a TLS send tag. If the send tag is only a plain TLS send tag, assume we failed to allocate a TLS ratelimit tag (either during the TCP_TXTLS_ENABLE socket option, or during the send tag reset triggered by ktls_output_eagain) and ignore the new rate. If the send tag is a ratelimit TLS send tag, change the rate on the TLS tag and leave the inp tag alone.
- Lock the inp lock when setting sb_tls_info for a socket send buffer so that the routines in tcp_ratelimit can safely deref the pointer without needing to grab the socket buffer lock.
- Add a IFCAP_TXTLS_RTLMT capability flag and associated administrative controls in ifconfig(8). TLS rate limit tags are only allocated if this capability is enabled. Note that TLS offload (whether unlimited or rate limited) always requires IFCAP_TXTLS[46].