On Tue, 2019-06-11 at 15:53 +0200, Ard Biesheuvel wrote: > On Tue, 11 Jun 2019 at 15:52, Johannes Berg <johannes@xxxxxxxxxxxxxxxx> wrote: > > > > On Tue, 2019-06-11 at 15:47 +0200, Ard Biesheuvel wrote: > > > > > > +++ b/net/mac80211/mlme.c > > > @@ -5038,8 +5038,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata, > > > auth_alg = WLAN_AUTH_OPEN; > > > break; > > > case NL80211_AUTHTYPE_SHARED_KEY: > > > - if (IS_ERR(local->wep_tx_tfm)) > > > - return -EOPNOTSUPP; > > > auth_alg = WLAN_AUTH_SHARED_KEY; > > > > This bit is probably not right, we directly use the WEP functions for > > shared key authentication. > > > > OK. So we need to change this test to > > > > - if (fips_enabled) > > > - return -EOPNOTSUPP; Right. > Does this also apply to > > diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c > index a1973a26c7fc..9d8a8878a487 100644 > --- a/net/mac80211/cfg.c > +++ b/net/mac80211/cfg.c > @@ -402,9 +402,6 @@ static int ieee80211_add_key(struct wiphy *wiphy, > struct net_device *dev, > case WLAN_CIPHER_SUITE_WEP40: > case WLAN_CIPHER_SUITE_TKIP: > case WLAN_CIPHER_SUITE_WEP104: > - if (IS_ERR(local->wep_tx_tfm)) > - return -EINVAL; > - break; This shouldn't be possible because in cfg80211 we should be checking that only ciphers are allowed that are in the cipher list (which we built with the "have_wep" thing before), but perhaps better to be safe here just in case we forgot something in cfg80211 - I could see e.g. the old WEXT compatibility code not checking too carefully... johannes
