| Summary: | DICOM level security association problems | ||
|---|---|---|---|
| Product: | Orthanc | Reporter: | Sébastien Jodogne <s.jodogne> |
| Component: | Orthanc Core | Assignee: | Sébastien Jodogne <s.jodogne> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | ||
| Priority: | --- | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
|
Description
Sébastien Jodogne
2020-06-29 15:12:38 CEST
[BitBucket user: Sébastien Jodogne] [BitBucket date: 2017-07-18.14:35:59] To forbid connections where the `-aec` (Application Entity Title of the remote DICOM server) does not correspond to the AET of Orthanc, the [configuration option](http://book.orthanc-server.com/users/configuration.html) `DicomCheckCalledAet` has to be set to `true`. Here is a sample session with this option enabled: ``` $ echoscu -v localhost 4242 -aec ORTHANC I: Requesting Association I: Association Accepted (Max Send PDV: 16372) I: Sending Echo Request (MsgID 1) I: Received Echo Response (Success) I: Releasing Association $ echoscu -v localhost 4242 -aec WRONG_ORTHANC I: Requesting Association F: Association Rejected: F: Result: Rejected Permanent, Source: Service User F: Reason: Called AE Title Not Recognized $ findscu -P -k QueryRetrieveLevel=STUDY localhost 4242 -aec WRONG_ORTHANC E: Association Rejected: E: Result: Rejected Permanent, Source: Service User E: Reason: Called AE Title Not Recognized $ storescu localhost 4242 xr_hands.dcm -aec WRONG_ORTHANC F: Association Rejected: F: Result: Rejected Permanent, Source: Service User F: Reason: Called AE Title Not Recognized ``` The `DicomCheckCalledAet` configuration option has been around since the very first releases of Orthanc. I will discuss the `-aet` (AET of the local DICOM client) part together with the IP addresses below. [BitBucket user: Sébastien Jodogne] [BitBucket date: 2017-07-18.15:33:31] Fix issue 52 (DICOM level security association problems) → https://hg.orthanc-server.com/orthanc/changeset/3ab96768d144 [BitBucket user: Sébastien Jodogne] [BitBucket date: 2017-07-18.15:46:35] The philosophy of Orthanc consists in making configuration as simple as possible for basic use cases. I have therefore added [two new security-related configuration options](https://hg.orthanc-server.com/orthanc/raw-file/default/Resources/Configuration.json) to solve this issue: `DicomAlwaysAllowStore` and `DicomCheckModalityHost`. The former forbids C-Store from unknown modalities, the second checks the IP address of the remote modality. Here is a sample, minimalist configuration file illustrating those 2 options: ``` json { "DicomCheckCalledAet" : true, "DicomModalities" : { "peer" : [ "PEER", "127.0.0.1", 2000 ], "peer2" : [ "BAD_IP", "1.1.1.1", 2000 ] }, "DicomAlwaysAllowStore" : false, "DicomCheckModalityHost" : true } ``` Here is now an interactive session (run from the localhost `127.0.0.1`) that shows how the security now works as you initially expected: ``` text $ echoscu -aec ORTHANC -aet PEER localhost 4242 -v 2>&1 | tail -n2 I: Received Echo Response (Success) I: Releasing Association $ echoscu -aec ORTHANC -aet BAD_AET localhost 4242 -v 2>&1 | tail -n2 E: Echo Failed: 0006:0317 Peer aborted Association (or never connected) I: Peer Aborted Association $ echoscu -aec ORTHANC -aet BAD_IP localhost 4242 -v 2>&1 | tail -n2 E: Echo Failed: 0006:0317 Peer aborted Association (or never connected) I: Peer Aborted Association $ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet PEER localhost 4242 -v 2>&1 | tail -n2 I: Received Final Find Response (Success) I: Releasing Association $ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet BAD_AET localhost 4242 -v 2>&1 | tail -n2 E: 0006:0317 Peer aborted Association (or never connected) I: Peer Aborted Association $ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet BAD_IP localhost 4242 -v 2>&1 | tail -n2 E: 0006:0317 Peer aborted Association (or never connected) I: Peer Aborted Association $ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet PEER -v 2>&1 | tail -n2 I: Received Store Response (Success) I: Releasing Association $ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet BAD_AET -v 2>&1 | tail -n2 I: Aborting Association E: Association Abort Failed: 0006:031d TCP I/O Error (Broken pipe) occurred in routine: sendAbortTCP $ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet BAD_IP -v 2>&1 | tail -n2 I: Aborting Association E: Association Abort Failed: 0006:031d TCP I/O Error (Broken pipe) occurred in routine: sendAbortTCP ``` The log file of Orthanc shows that `BAD_AET` and `BAD_IP` are treated differently: ``` W0718 17:43:13.212854 OrthancInitialization.cpp:865] Modality "BAD_AET" is not listed in the "DicomModalities" configuration option W0718 17:43:13.212882 CommandDispatcher.cpp:812] Rejected Echo request from remote DICOM modality with AET "BAD_AET" and hostname "127.0.0.1" W0718 17:43:14.458409 OrthancInitialization.cpp:876] Forbidding access from AET "BAD_IP" given its hostname (127.0.0.1) does not match the "DicomModalities" configuration option (1.1.1.1 was expected) W0718 17:43:14.458440 CommandDispatcher.cpp:812] Rejected Echo request from remote DICOM modality with AET "BAD_IP" and hostname "127.0.0.1" ``` [BitBucket user: Sébastien Jodogne] [BitBucket date: 2017-08-25.14:45:48] For further reference: In the mainline of Orthanc and for releases >= 1.3.1, configuration option `DicomAlwaysAllowEcho` will have to be set to `false` to protect C-Echo from arising from unknown modalities. Here is the related changeset: https://hg.orthanc-server.com/orthanc/changeset/3ec85ff48374803e0e796ba8bf0923f53f591e4b |