[BitBucket user: Sébastien Jodogne]
[BitBucket date: 2017-07-18.14:35:59]

To forbid connections where the `-aec` (Application Entity Title of the remote DICOM server) does not correspond to the AET of Orthanc, the [configuration option](http://book.orthanc-server.com/users/configuration.html) `DicomCheckCalledAet` has to be set to `true`. Here is a sample session with this option enabled:

```
$ echoscu -v localhost 4242 -aec ORTHANC
I: Requesting Association
I: Association Accepted (Max Send PDV: 16372)
I: Sending Echo Request (MsgID 1)
I: Received Echo Response (Success)
I: Releasing Association

$ echoscu -v localhost 4242 -aec WRONG_ORTHANC
I: Requesting Association
F: Association Rejected:
F: Result: Rejected Permanent, Source: Service User
F: Reason: Called AE Title Not Recognized

$ findscu -P -k QueryRetrieveLevel=STUDY localhost 4242 -aec WRONG_ORTHANC
E: Association Rejected:
E: Result: Rejected Permanent, Source: Service User
E: Reason: Called AE Title Not Recognized

$ storescu localhost 4242 xr_hands.dcm -aec WRONG_ORTHANC
F: Association Rejected:
F: Result: Rejected Permanent, Source: Service User
F: Reason: Called AE Title Not Recognized
```

The `DicomCheckCalledAet` configuration option has been around since the very first releases of Orthanc. I will discuss the `-aet` (AET of the local DICOM client) part together with the IP addresses below.

[BitBucket user: Sébastien Jodogne]
[BitBucket date: 2017-07-18.15:33:31]

Fix issue 52 (DICOM level security association problems)

→ https://hg.orthanc-server.com/orthanc/changeset/3ab96768d144

[BitBucket user: Sébastien Jodogne]
[BitBucket date: 2017-07-18.15:46:35]

The philosophy of Orthanc consists in making configuration as simple as possible for basic use cases. I have therefore added [two new security-related configuration options](https://hg.orthanc-server.com/orthanc/raw-file/default/Resources/Configuration.json) to solve this issue: `DicomAlwaysAllowStore` and `DicomCheckModalityHost`. The former forbids C-Store from unknown modalities, the second checks the IP address of the remote modality.

Here is a sample, minimalist configuration file illustrating those 2 options:

``` json
{
  "DicomCheckCalledAet" : true,
  "DicomModalities" : {
    "peer" : [ "PEER", "127.0.0.1", 2000 ],
    "peer2" : [ "BAD_IP", "1.1.1.1", 2000 ]
  },
  "DicomAlwaysAllowStore" : false,
  "DicomCheckModalityHost" : true
}
```

Here is now an interactive session (run from the localhost `127.0.0.1`) that shows how the security now works as you initially expected:

``` text
$ echoscu -aec ORTHANC -aet PEER localhost 4242 -v 2>&1 | tail -n2
I: Received Echo Response (Success)
I: Releasing Association

$ echoscu -aec ORTHANC -aet BAD_AET localhost 4242 -v 2>&1 | tail -n2
E: Echo Failed: 0006:0317 Peer aborted Association (or never connected)
I: Peer Aborted Association

$ echoscu -aec ORTHANC -aet BAD_IP localhost 4242 -v 2>&1 | tail -n2
E: Echo Failed: 0006:0317 Peer aborted Association (or never connected)
I: Peer Aborted Association

$ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet PEER localhost 4242 -v 2>&1 | tail -n2
I: Received Final Find Response (Success)
I: Releasing Association

$ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet BAD_AET localhost 4242 -v 2>&1 | tail -n2
E: 0006:0317 Peer aborted Association (or never connected)
I: Peer Aborted Association

$ findscu -S -k QueryRetrieveLevel=STUDY -aec ORTHANC -aet BAD_IP localhost 4242 -v 2>&1 | tail -n2
E: 0006:0317 Peer aborted Association (or never connected)
I: Peer Aborted Association

$ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet PEER -v 2>&1 | tail -n2
I: Received Store Response (Success)
I: Releasing Association

$ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet BAD_AET -v 2>&1 | tail -n2
I: Aborting Association
E: Association Abort Failed: 0006:031d TCP I/O Error (Broken pipe) occurred in routine: sendAbortTCP

$ storescu localhost 4242 /tmp/xr_hands.dcm -aec ORTHANC -aet BAD_IP -v 2>&1 | tail -n2
I: Aborting Association
E: Association Abort Failed: 0006:031d TCP I/O Error (Broken pipe) occurred in routine: sendAbortTCP
```

The log file of Orthanc shows that `BAD_AET` and `BAD_IP` are treated differently:

```
W0718 17:43:13.212854 OrthancInitialization.cpp:865] Modality "BAD_AET" is not listed in the "DicomModalities" configuration option
W0718 17:43:13.212882 CommandDispatcher.cpp:812] Rejected Echo request from remote DICOM modality with AET "BAD_AET" and hostname "127.0.0.1"
W0718 17:43:14.458409 OrthancInitialization.cpp:876] Forbidding access from AET "BAD_IP" given its hostname (127.0.0.1) does not match the "DicomModalities" configuration option (1.1.1.1 was expected)
W0718 17:43:14.458440 CommandDispatcher.cpp:812] Rejected Echo request from remote DICOM modality with AET "BAD_IP" and hostname "127.0.0.1"
```

[BitBucket user: Sébastien Jodogne]
[BitBucket date: 2017-08-25.14:45:48]

For further reference: In the mainline of Orthanc and for releases >= 1.3.1, configuration option `DicomAlwaysAllowEcho` will have to be set to `false` to protect C-Echo from arising from unknown modalities.

Here is the related changeset: https://hg.orthanc-server.com/orthanc/changeset/3ec85ff48374803e0e796ba8bf0923f53f591e4b