From b159261a35b35909fa6c75b184121c2f2bb36abf Mon Sep 17 00:00:00 2001 From: Tony Mack Date: Thu, 29 Apr 2010 02:29:49 +0000 Subject: [PATCH] make sure the trusted cert's hrn is a prefix of the signed cert's hrn --- sfa/trust/certificate.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sfa/trust/certificate.py b/sfa/trust/certificate.py index 9b488357..8150ae10 100644 --- a/sfa/trust/certificate.py +++ b/sfa/trust/certificate.py @@ -525,6 +525,10 @@ class Certificate: #print "TRUSTED CERT", trusted_cert.dump() #print "Client is signed by Trusted?", self.is_signed_by_cert(trusted_cert) if self.is_signed_by_cert(trusted_cert): + # make sure sure the trusted cert's hrn is a prefix of the + # signed cert's hrn + if not self.get_subject().startswith(trusted_cert.get_subject()): + raise GidParentHrn(trusted_cert.get_subject()) #print self.get_subject(), "is signed by a root" return -- 2.43.0