|
I've updated master such that now there is a single function which in `command.clj` which dispatches to the various "command functions", e.g. replace-catalogs, store-reports... called `process-command`. This function (which replace a defmulti by the same name) should do the validation of the ssl-client-cn. We should also grab the cert-whitelist like we do for our pdb-routing service and use the whitelist to check if the node is authorized before we match the command client-cn and the actual client-cn.
To summarize, grab the cert-whitelist from the config, use that to make a function which takes a ssl-client-cn and the certname (retrieved from one of our entities) and will produce a fatal error if the command isn't authorized.
|
