From 1a3203b891bd611d2878f345b608cf29b1efcd26 Mon Sep 17 00:00:00 2001
From: Alex Gaynor <alex.gaynor@gmail.com>
Date: Tue, 27 Jan 2015 10:56:23 -0500
Subject: Have the pem public/private key loading docs point to x.509

---
 docs/hazmat/primitives/asymmetric/serialization.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'docs')

diff --git a/docs/hazmat/primitives/asymmetric/serialization.rst b/docs/hazmat/primitives/asymmetric/serialization.rst
index d5da24da..7ff4ce30 100644
--- a/docs/hazmat/primitives/asymmetric/serialization.rst
+++ b/docs/hazmat/primitives/asymmetric/serialization.rst
@@ -71,6 +71,14 @@ don't need to worry about this detail. PEM keys are recognizable because they
 all begin with ``-----BEGIN {format}-----`` and end with ``-----END
 {format}-----``.
 
+.. note::
+
+    A PEM block which starts with ``-----BEGIN CERTIFICATE-----`` is not a
+    public or private key, it's an :doc:`X.509 Certificate </x509>`. You can
+    load it using :func:`~cryptography.x509.load_pem_x509_certificate` and
+    extract the public key with
+    :meth:`Certificate.public_key <cryptography.x509.Certificate.public_key>`.
+
 .. function:: load_pem_private_key(data, password, backend)
 
     .. versionadded:: 0.6
-- 
cgit v1.2.3

tion>
<option value='chaos_calmer'>chaos_calmer</option>
<option value='lede-17.01'>lede-17.01</option>
<option value='less-old-master'>less-old-master</option>
<option value='master'>master</option>
<option value='old-master'>old-master</option>
<option value='openwrt-18.06'>openwrt-18.06</option>
<option value='openwrt-19.07'>openwrt-19.07</option>
<option value='upstream'>upstream</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>upstream openwrt</td><td class='sub right'>James</td></tr></table>
<table class='tabs'><tr><td>
<a href='/cgit/openwrt/upstream/about/?h=v18.06.9'>about</a><a href='/cgit/openwrt/upstream/?h=v18.06.9'>summary</a><a href='/cgit/openwrt/upstream/refs/?h=v18.06.9'>refs</a><a href='/cgit/openwrt/upstream/log/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>log</a><a class='active' href='/cgit/openwrt/upstream/tree/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>tree</a><a href='/cgit/openwrt/upstream/commit/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>commit</a><a href='/cgit/openwrt/upstream/diff/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>diff</a><a href='/cgit/openwrt/upstream/stats/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>stats</a></td><td class='form'><form class='right' method='get' action='/cgit/openwrt/upstream/log/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch'>
<input type='hidden' name='h' value='v18.06.9'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit/openwrt/upstream/tree/?h=v18.06.9'>root</a>/<a href='/cgit/openwrt/upstream/tree/package?h=v18.06.9'>package</a>/<a href='/cgit/openwrt/upstream/tree/package/kernel?h=v18.06.9'>kernel</a>/<a href='/cgit/openwrt/upstream/tree/package/kernel/mac80211?h=v18.06.9'>mac80211</a>/<a href='/cgit/openwrt/upstream/tree/package/kernel/mac80211/patches?h=v18.06.9'>patches</a>/<a href='/cgit/openwrt/upstream/tree/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch</a></div><div class='content'>blob: 1867e809bedc59d0e730eb77758bc9fb60723bdb (<a href='/cgit/openwrt/upstream/plain/package/kernel/mac80211/patches/481-mac80211-Check-port-authorization-in-the-ieee80211_t.patch?h=v18.06.9'>plain</a>)
<table summary='blob content' class='blob'>
<tr><td class='linenumbers'><pre><a id='n1' href='#n1'>1</a>
<a id='n2' href='#n2'>2</a>
<a id='n3' href='#n3'>3</a>
<a id='n4' href='#n4'>4</a>
<a id='n5' href='#n5'>5</a>
<a id='n6' href='#n6'>6</a>
<a id='n7' href='#n7'>7</a>
<a id='n8' href='#n8'>8</a>
<a id='n9' href='#n9'>9</a>
<a id='n10' href='#n10'>10</a>
<a id='n11' href='#n11'>11</a>
<a id='n12' href='#n12'>12</a>
<a id='n13' href='#n13'>13</a>
<a id='n14' href='#n14'>14</a>
<a id='n15' href='#n15'>15</a>
<a id='n16' href='#n16'>16</a>
<a id='n17' href='#n17'>17</a>
<a id='n18' href='#n18'>18</a>
<a id='n19' href='#n19'>19</a>
<a id='n20' href='#n20'>20</a>
<a id='n21' href='#n21'>21</a>
<a id='n22' href='#n22'>22</a>
<a id='n23' href='#n23'>23</a>
<a id='n24' href='#n24'>24</a>
<a id='n25' href='#n25'>25</a>
<a id='n26' href='#n26'>26</a>
<a id='n27' href='#n27'>27</a>
<a id='n28' href='#n28'>28</a>
<a id='n29' href='#n29'>29</a>
<a id='n30' href='#n30'>30</a>
<a id='n31' href='#n31'>31</a>
<a id='n32' href='#n32'>32</a>
<a id='n33' href='#n33'>33</a>
<a id='n34' href='#n34'>34</a>
<a id='n35' href='#n35'>35</a>
<a id='n36' href='#n36'>36</a>
<a id='n37' href='#n37'>37</a>
<a id='n38' href='#n38'>38</a>
<a id='n39' href='#n39'>39</a>
<a id='n40' href='#n40'>40</a>
<a id='n41' href='#n41'>41</a>
<a id='n42' href='#n42'>42</a>
<a id='n43' href='#n43'>43</a>
<a id='n44' href='#n44'>44</a>
<a id='n45' href='#n45'>45</a>
<a id='n46' href='#n46'>46</a>
<a id='n47' href='#n47'>47</a>
<a id='n48' href='#n48'>48</a>
<a id='n49' href='#n49'>49</a>
<a id='n50' href='#n50'>50</a>
<a id='n51' href='#n51'>51</a>
<a id='n52' href='#n52'>52</a>
<a id='n53' href='#n53'>53</a>
<a id='n54' href='#n54'>54</a>
</pre></td>
<td class='lines'><pre><code><style>pre { line-height: 125%; margin: 0; }
td.linenos pre { color: #000000; background-color: #f0f0f0; padding: 0 5px 0 5px; }
span.linenos { color: #000000; background-color: #f0f0f0; padding: 0 5px 0 5px; }
td.linenos pre.special { color: #000000; background-color: #ffffc0; padding: 0 5px 0 5px; }
span.linenos.special { color: #000000; background-color: #ffffc0; padding: 0 5px 0 5px; }
.highlight .hll { background-color: #ffffcc }
.highlight { background: #ffffff; }
.highlight .c { color: #888888 } /* Comment */
.highlight .err { color: #a61717; background-color: #e3d2d2 } /* Error */
.highlight .k { color: #008800; font-weight: bold } /* Keyword */
.highlight .ch { color: #888888 } /* Comment.Hashbang */
.highlight .cm { color: #888888 } /* Comment.Multiline */
.highlight .cp { color: #cc0000; font-weight: bold } /* Comment.Preproc */
.highlight .cpf { color: #888888 } /* Comment.PreprocFile */
.highlight .c1 { color: #888888 } /* Comment.Single */
.highlight .cs { color: #cc0000; font-weight: bold; background-color: #fff0f0 } /* Comment.Special */
.highlight .gd { color: #000000; background-color: #ffdddd } /* Generic.Deleted */
.highlight .ge { font-style: italic } /* Generic.Emph */
.highlight .gr { color: #aa0000 } /* Generic.Error */
.highlight .gh { color: #333333 } /* Generic.Heading */
.highlight .gi { color: #000000; background-color: #ddffdd } /* Generic.Inserted */
.highlight .go { color: #888888 } /* Generic.Output */
.highlight .gp { color: #555555 } /* Generic.Prompt */
.highlight .gs { font-weight: bold } /* Generic.Strong */
.highlight .gu { color: #666666 } /* Generic.Subheading */
.highlight .gt { color: #aa0000 } /* Generic.Traceback */
.highlight .kc { color: #008800; font-weight: bold } /* Keyword.Constant */
.highlight .kd { color: #008800; font-weight: bold } /* Keyword.Declaration */
.highlight .kn { color: #008800; font-weight: bold } /* Keyword.Namespace */
.highlight .kp { color: #008800 } /* Keyword.Pseudo */
.highlight .kr { color: #008800; font-weight: bold } /* Keyword.Reserved */
.highlight .kt { color: #888888; font-weight: bold } /* Keyword.Type */
.highlight .m { color: #0000DD; font-weight: bold } /* Literal.Number */
.highlight .s { color: #dd2200; background-color: #fff0f0 } /* Literal.String */
.highlight .na { color: #336699 } /* Name.Attribute */
.highlight .nb { color: #003388 } /* Name.Builtin */
.highlight .nc { color: #bb0066; font-weight: bold } /* Name.Class */
.highlight .no { color: #003366; font-weight: bold } /* Name.Constant */
.highlight .nd { color: #555555 } /* Name.Decorator */
.highlight .ne { color: #bb0066; font-weight: bold } /* Name.Exception */
.highlight .nf { color: #0066bb; font-weight: bold } /* Name.Function */
.highlight .nl { color: #336699; font-style: italic } /* Name.Label */
.highlight .nn { color: #bb0066; font-weight: bold } /* Name.Namespace */
.highlight .py { color: #336699; font-weight: bold } /* Name.Property */
.highlight .nt { color: #bb0066; font-weight: bold } /* Name.Tag */
.highlight .nv { color: #336699 } /* Name.Variable */
.highlight .ow { color: #008800 } /* Operator.Word */
.highlight .w { color: #bbbbbb } /* Text.Whitespace */
.highlight .mb { color: #0000DD; font-weight: bold } /* Literal.Number.Bin */
.highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */
.highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */
.highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */
.highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */
.highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */
.highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */
.highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */
.highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */
.highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */
.highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */
.highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */
.highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */
.highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */
.highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */
.highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */
.highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */
.highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */
.highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */
.highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */
.highlight .vc { color: #336699 } /* Name.Variable.Class */
.highlight .vg { color: #dd7700 } /* Name.Variable.Global */
.highlight .vi { color: #3333bb } /* Name.Variable.Instance */
.highlight .vm { color: #336699 } /* Name.Variable.Magic */
.highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */</style><div class="highlight"><pre><span></span>From 07dc42ff9b9c38eae221b36acda7134ab8670af8 Mon Sep 17 00:00:00 2001
From: Jouni Malinen &lt;jouni@codeaurora.org&gt;
Date: Thu, 26 Mar 2020 15:51:34 +0100
Subject: [PATCH] mac80211: Check port authorization in the
 ieee80211_tx_dequeue() case

commit ce2e1ca703071723ca2dd94d492a5ab6d15050da upstream.

mac80211 used to check port authorization in the Data frame enqueue case
when going through start_xmit(). However, that authorization status may
change while the frame is waiting in a queue. Add a similar check in the
dequeue case to avoid sending previously accepted frames after
authorization change. This provides additional protection against
potential leaking of frames after a station has been disconnected and
the keys for it are being removed.

Cc: stable@vger.kernel.org
Signed-off-by: Jouni Malinen &lt;jouni@codeaurora.org&gt;
Link: https://lore.kernel.org/r/20200326155133.ced84317ea29.I34d4c47cd8cc8a4042b38a76f16a601fbcbfd9b3@changeid
Signed-off-by: Johannes Berg &lt;johannes.berg@intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
<span class="gd">---</span>
 net/mac80211/tx.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

<span class="gd">--- a/net/mac80211/tx.c</span>
<span class="gi">+++ b/net/mac80211/tx.c</span>
<span class="gu">@@ -3496,8 +3496,25 @@ begin:</span>
 	tx.sdata = vif_to_sdata(info-&gt;control.vif);
 	tx.hdrlen = ieee80211_padded_hdrlen(hw, hdr-&gt;frame_control);
 
<span class="gd">-	if (txq-&gt;sta)</span>
<span class="gi">+	if (txq-&gt;sta) {</span>
 		tx.sta = container_of(txq-&gt;sta, struct sta_info, sta);
<span class="gi">+		/*</span>
<span class="gi">+		 * Drop unicast frames to unauthorised stations unless they are</span>
<span class="gi">+		 * EAPOL frames from the local station.</span>
<span class="gi">+		 */</span>
<span class="gi">+		if (unlikely(!ieee80211_vif_is_mesh(&amp;tx.sdata-&gt;vif) &amp;&amp;</span>
<span class="gi">+			     tx.sdata-&gt;vif.type != NL80211_IFTYPE_OCB &amp;&amp;</span>
<span class="gi">+			     !is_multicast_ether_addr(hdr-&gt;addr1) &amp;&amp;</span>
<span class="gi">+			     !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &amp;&amp;</span>
<span class="gi">+			     (!(info-&gt;control.flags &amp;</span>
<span class="gi">+				IEEE80211_TX_CTRL_PORT_CTRL_PROTO) ||</span>
<span class="gi">+			      !ether_addr_equal(tx.sdata-&gt;vif.addr,</span>
<span class="gi">+						hdr-&gt;addr2)))) {</span>
<span class="gi">+			I802_DEBUG_INC(local-&gt;tx_handlers_drop_unauth_port);</span>
<span class="gi">+			ieee80211_free_txskb(&amp;local-&gt;hw, skb);</span>
<span class="gi">+			goto begin;</span>
<span class="gi">+		}</span>
<span class="gi">+	}</span>
 
 	/*
 	 * The key can be removed while the packet was queued, so need to call
</pre></div>
</code></pre></td></tr></table>
</div> <!-- class=content -->
<div class='footer'>generated by <a href='https://git.zx2c4.com/cgit/about/'>cgit v1.2.3</a> (<a href='https://git-scm.com/'>git 2.25.1</a>) at 2025-09-25 07:30:27 +0000</div>
</div> <!-- id=cgit -->
</body>
</html>
