diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -1362,7 +1362,7 @@
 }
 
 int
-ktls_get_rx_mode(struct socket *so, int *modep)
+ktls_get_rx_mode(struct socket *so, tcp_tls_mode_t *modep)
 {
 	struct ktls_session *tls;
 	struct inpcb *inp __diagused;
@@ -1425,7 +1425,7 @@
 }
 
 int
-ktls_get_tx_mode(struct socket *so, int *modep)
+ktls_get_tx_mode(struct socket *so, tcp_tls_mode_t *modep)
 {
 	struct ktls_session *tls;
 	struct inpcb *inp __diagused;
@@ -1448,7 +1448,7 @@
  * Switch between SW and ifnet TLS sessions as requested.
  */
 int
-ktls_set_tx_mode(struct socket *so, int mode)
+ktls_set_tx_mode(struct socket *so, tcp_tls_mode_t mode)
 {
 	struct ktls_session *tls, *tls_new;
 	struct inpcb *inp;
@@ -1937,6 +1937,8 @@
 		}
 		break;
 #endif
+	default:
+		break;
 	}
 	if (tls->ocf_session != NULL)
 		ktls_ocf_free(tls);
diff --git a/sys/netinet/tcp.h b/sys/netinet/tcp.h
--- a/sys/netinet/tcp.h
+++ b/sys/netinet/tcp.h
@@ -468,12 +468,6 @@
 	uint32_t pcbcnt;
 };
 
-/* TLS modes for TCP_TXTLS_MODE */
-#define	TCP_TLS_MODE_NONE	0
-#define	TCP_TLS_MODE_SW		1
-#define	TCP_TLS_MODE_IFNET	2
-#define	TCP_TLS_MODE_TOE	3
-
 /*
  * TCP Control message types
  */
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -2660,14 +2660,14 @@
 #endif
 #ifdef KERN_TLS
 		case TCP_TXTLS_MODE:
-			error = ktls_get_tx_mode(so, &optval);
+			error = ktls_get_tx_mode(so, (tcp_tls_mode_t *)&optval);
 			INP_WUNLOCK(inp);
 			if (error == 0)
 				error = sooptcopyout(sopt, &optval,
 				    sizeof(optval));
 			break;
 		case TCP_RXTLS_MODE:
-			error = ktls_get_rx_mode(so, &optval);
+			error = ktls_get_rx_mode(so, (tcp_tls_mode_t *)&optval);
 			INP_WUNLOCK(inp);
 			if (error == 0)
 				error = sooptcopyout(sopt, &optval,
diff --git a/sys/sys/ktls.h b/sys/sys/ktls.h
--- a/sys/sys/ktls.h
+++ b/sys/sys/ktls.h
@@ -142,6 +142,14 @@
 	uint16_t tls_length;
 };
 
+/* TLS modes for TCP_TXTLS_MODE */
+typedef enum {
+	TCP_TLS_MODE_NONE =	0,
+	TCP_TLS_MODE_SW =	1,
+	TCP_TLS_MODE_IFNET =	2,
+	TCP_TLS_MODE_TOE =	3
+} tcp_tls_mode_t;
+
 #ifdef _KERNEL
 
 struct tls_session_params {
@@ -181,7 +189,7 @@
 	struct tls_session_params params;
 	u_int	wq_index;
 	volatile u_int refcount;
-	int mode;
+	tcp_tls_mode_t mode;
 
 	struct task reset_tag_task;
 	struct task disable_ifnet_task;
@@ -224,9 +232,9 @@
 void ktls_seq(struct sockbuf *sb, struct mbuf *m);
 void ktls_enqueue(struct mbuf *m, struct socket *so, int page_count);
 void ktls_enqueue_to_free(struct mbuf *m);
-int ktls_get_rx_mode(struct socket *so, int *modep);
-int ktls_set_tx_mode(struct socket *so, int mode);
-int ktls_get_tx_mode(struct socket *so, int *modep);
+int ktls_get_rx_mode(struct socket *so, tcp_tls_mode_t *modep);
+int ktls_set_tx_mode(struct socket *so, tcp_tls_mode_t mode);
+int ktls_get_tx_mode(struct socket *so, tcp_tls_mode_t *modep);
 int ktls_get_rx_sequence(struct inpcb *inp, uint32_t *tcpseq, uint64_t *tlsseq);
 void ktls_input_ifp_mismatch(struct sockbuf *sb, struct ifnet *ifp);
 int ktls_output_eagain(struct inpcb *inp, struct ktls_session *tls);