git: 874035c11cd4 - main - net80211: fix WEP transmit

The branch main has been updated by adrian:

URL: https://cgit.FreeBSD.org/src/commit/?id=874035c11cd40282cb5d654749a99b03b9233502

commit 874035c11cd40282cb5d654749a99b03b9233502
Author:     Adrian Chadd <[email protected]>
AuthorDate: 2026-08-19 02:01:53 +0000
Commit:     Adrian Chadd <[email protected]>
CommitDate: 2026-08-19 02:01:53 +0000

    net80211: fix WEP transmit
    
    This was broken in 2022 with a security fix (61605e0ae5d8f) which
    disallowed defaulting to the default TX key if there's no unicast
    key.  Unfortunately this path was also used by WEP transmit.
    
    To fix it, add a separate check which ensures that WEP is configured
    (authtype OPEN, privacy enabled) - then also check if the default TX
    key is set and that said key is a WEP key.
    
    Fixes: 61605e0ae5d8f
    
    Locally tested:
    
    * rtwn(4) AP and rtwn(4) STA w/ static WEP keys configured
    
    Differential Revision:  https://reviews.freebsd.org/D58854
---
 sys/net80211/ieee80211_crypto.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/sys/net80211/ieee80211_crypto.c b/sys/net80211/ieee80211_crypto.c
index 3dad4ce77d3c..2d85d3d5ecad 100644
--- a/sys/net80211/ieee80211_crypto.c
+++ b/sys/net80211/ieee80211_crypto.c
@@ -674,6 +674,24 @@ ieee80211_crypto_get_txkey(struct ieee80211_node *ni, struct mbuf *m)
 	struct ieee80211vap *vap = ni->ni_vap;
 	struct ieee80211_frame *wh;
 
+	/*
+	 * Explicitly check whether we're doing WEP and allow
+	 * the use of the default TX key.
+	 */
+	if ((ni->ni_authmode == IEEE80211_AUTH_OPEN) &&
+	    ((vap->iv_flags & IEEE80211_F_PRIVACY) != 0) &&
+	    (vap->iv_def_txkey != IEEE80211_KEYIX_NONE)) {
+		struct ieee80211_key *k;
+		/*
+		 * Check to see if the TX key is a WEP cipher key.
+		 * Only allow transmit using it here if it's
+		 * a WEP key.
+		 */
+		k = &vap->iv_nw_keys[vap->iv_def_txkey];
+		if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP)
+			return (k);
+	}
+
 	/*
 	 * Multicast traffic always uses the multicast key.
 	 *