From: Tony Mack <tmack@cs.princeton.edu>
Date: Thu, 29 Apr 2010 02:29:49 +0000 (+0000)
Subject: make sure the trusted cert's hrn is a prefix of the signed cert's hrn
X-Git-Tag: sfa-0.9-11~6^2~20
X-Git-Url: http://git.onelab.eu/?p=sfa.git;a=commitdiff_plain;h=b159261a35b35909fa6c75b184121c2f2bb36abf

make sure the trusted cert's hrn is a prefix of the signed cert's hrn
---

diff --git a/sfa/trust/certificate.py b/sfa/trust/certificate.py
index 9b488357..8150ae10 100644
--- a/sfa/trust/certificate.py
+++ b/sfa/trust/certificate.py
@@ -525,6 +525,10 @@ class Certificate:
             #print "TRUSTED CERT", trusted_cert.dump()
             #print "Client is signed by Trusted?", self.is_signed_by_cert(trusted_cert)
             if self.is_signed_by_cert(trusted_cert):
+                # make sure sure the trusted cert's hrn is a prefix of the
+                # signed cert's hrn
+                if not self.get_subject().startswith(trusted_cert.get_subject()):
+                    raise GidParentHrn(trusted_cert.get_subject()) 
                 #print self.get_subject(), "is signed by a root"
                 return