Mercurial > hg > orthanc
annotate OrthancFramework/Sources/DicomNetworking/Internals/DicomTls.cpp @ 4657:e8967149d87a
cppcheck
| author | Sebastien Jodogne <s.jodogne@gmail.com> |
|---|---|
| date | Fri, 07 May 2021 06:35:13 +0200 |
| parents | 82a314325351 |
| children | 7053502fbf97 |
| rev | line source |
|---|---|
| 4432 | 1 /** |
| 2 * Orthanc - A Lightweight, RESTful DICOM Store | |
| 3 * Copyright (C) 2012-2016 Sebastien Jodogne, Medical Physics | |
| 4 * Department, University Hospital of Liege, Belgium | |
|
4437
d9473bd5ed43
upgrade to year 2021
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4432
diff
changeset
|
5 * Copyright (C) 2017-2021 Osimis S.A., Belgium |
| 4432 | 6 * |
| 7 * This program is free software: you can redistribute it and/or | |
| 8 * modify it under the terms of the GNU Lesser General Public License | |
| 9 * as published by the Free Software Foundation, either version 3 of | |
| 10 * the License, or (at your option) any later version. | |
| 11 * | |
| 12 * This program is distributed in the hope that it will be useful, but | |
| 13 * WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
| 15 * Lesser General Public License for more details. | |
| 16 * | |
| 17 * You should have received a copy of the GNU Lesser General Public | |
| 18 * License along with this program. If not, see | |
| 19 * <http://www.gnu.org/licenses/>. | |
| 20 **/ | |
| 21 | |
| 22 | |
| 23 #include "../../PrecompiledHeaders.h" | |
| 24 #include "DicomTls.h" | |
| 25 | |
| 26 #include "../../Logging.h" | |
| 27 #include "../../OrthancException.h" | |
| 28 #include "../../SystemToolbox.h" | |
| 29 | |
| 30 | |
| 31 #if DCMTK_VERSION_NUMBER < 364 | |
| 32 # define DCF_Filetype_PEM SSL_FILETYPE_PEM | |
| 33 # if OPENSSL_VERSION_NUMBER >= 0x0090700fL | |
| 34 // This seems to correspond to TSP_Profile_AES: https://support.dcmtk.org/docs/tlsciphr_8h.html | |
| 35 static std::string opt_ciphersuites(TLS1_TXT_RSA_WITH_AES_128_SHA ":" SSL3_TXT_RSA_DES_192_CBC3_SHA); | |
| 36 # else | |
| 37 // This seems to correspond to TSP_Profile_Basic in DCMTK >= 3.6.4: https://support.dcmtk.org/docs/tlsciphr_8h.html | |
| 38 static std::string opt_ciphersuites(SSL3_TXT_RSA_DES_192_CBC3_SHA); | |
| 39 # endif | |
| 40 #endif | |
| 41 | |
| 42 | |
| 43 namespace Orthanc | |
| 44 { | |
| 45 namespace Internals | |
| 46 { | |
| 47 DcmTLSTransportLayer* InitializeDicomTls(T_ASC_Network *network, | |
| 48 T_ASC_NetworkRole role, | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
49 const std::string& ownPrivateKeyPath, |
|
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
50 const std::string& ownCertificatePath, |
|
4656
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
51 const std::string& trustedCertificatesPath, |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
52 bool requireRemoteCertificate) |
| 4432 | 53 { |
| 54 if (network == NULL) | |
| 55 { | |
| 56 throw OrthancException(ErrorCode_NullPointer); | |
| 57 } | |
| 58 | |
| 59 if (role != NET_ACCEPTOR && | |
| 60 role != NET_REQUESTOR) | |
| 61 { | |
| 62 throw OrthancException(ErrorCode_ParameterOutOfRange, "Unknown role"); | |
| 63 } | |
| 64 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
65 if (!SystemToolbox::IsRegularFile(trustedCertificatesPath)) |
| 4432 | 66 { |
| 67 throw OrthancException(ErrorCode_InexistentFile, "Cannot read file with trusted certificates for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
68 trustedCertificatesPath); |
| 4432 | 69 } |
| 70 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
71 if (!SystemToolbox::IsRegularFile(ownPrivateKeyPath)) |
| 4432 | 72 { |
| 73 throw OrthancException(ErrorCode_InexistentFile, "Cannot read file with own private key for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
74 ownPrivateKeyPath); |
| 4432 | 75 } |
| 76 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
77 if (!SystemToolbox::IsRegularFile(ownCertificatePath)) |
| 4432 | 78 { |
| 79 throw OrthancException(ErrorCode_InexistentFile, "Cannot read file with own certificate for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
80 ownCertificatePath); |
| 4432 | 81 } |
| 82 | |
| 83 CLOG(INFO, DICOM) << "Initializing DICOM TLS for Orthanc " | |
| 84 << (role == NET_ACCEPTOR ? "SCP" : "SCU"); | |
| 85 | |
| 86 #if DCMTK_VERSION_NUMBER >= 364 | |
| 87 const T_ASC_NetworkRole tmpRole = role; | |
| 88 #else | |
| 89 int tmpRole; | |
| 90 switch (role) | |
| 91 { | |
| 92 case NET_ACCEPTOR: | |
| 93 tmpRole = DICOM_APPLICATION_ACCEPTOR; | |
| 94 break; | |
| 95 | |
| 96 case NET_REQUESTOR: | |
| 97 tmpRole = DICOM_APPLICATION_REQUESTOR; | |
| 98 break; | |
| 99 | |
| 100 default: | |
| 101 throw OrthancException(ErrorCode_ParameterOutOfRange); | |
| 102 } | |
| 103 #endif | |
| 104 | |
| 105 std::unique_ptr<DcmTLSTransportLayer> tls( | |
| 106 new DcmTLSTransportLayer(tmpRole /*opt_networkRole*/, NULL /*opt_readSeedFile*/, | |
| 107 OFFalse /*initializeOpenSSL, done by Orthanc::Toolbox::InitializeOpenSsl()*/)); | |
| 108 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
109 if (tls->addTrustedCertificateFile(trustedCertificatesPath.c_str(), DCF_Filetype_PEM /*opt_keyFileFormat*/) != TCS_ok) |
| 4432 | 110 { |
| 111 throw OrthancException(ErrorCode_BadFileFormat, "Cannot parse PEM file with trusted certificates for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
112 trustedCertificatesPath); |
| 4432 | 113 } |
| 114 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
115 if (tls->setPrivateKeyFile(ownPrivateKeyPath.c_str(), DCF_Filetype_PEM /*opt_keyFileFormat*/) != TCS_ok) |
| 4432 | 116 { |
| 117 throw OrthancException(ErrorCode_BadFileFormat, "Cannot parse PEM file with private key for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
118 ownPrivateKeyPath); |
| 4432 | 119 } |
| 120 | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
121 if (tls->setCertificateFile(ownCertificatePath.c_str(), DCF_Filetype_PEM /*opt_keyFileFormat*/) != TCS_ok) |
| 4432 | 122 { |
| 123 throw OrthancException(ErrorCode_BadFileFormat, "Cannot parse PEM file with own certificate for DICOM TLS: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
124 ownCertificatePath); |
| 4432 | 125 } |
| 126 | |
| 127 if (!tls->checkPrivateKeyMatchesCertificate()) | |
| 128 { | |
| 129 throw OrthancException(ErrorCode_BadFileFormat, "The private key doesn't match the own certificate: " + | |
|
4438
4a4e33c9082d
configuration options for DICOM TLS in Orthanc SCU
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4437
diff
changeset
|
130 ownPrivateKeyPath + " vs. " + ownCertificatePath); |
| 4432 | 131 } |
| 132 | |
| 133 #if DCMTK_VERSION_NUMBER >= 364 | |
| 134 if (tls->setTLSProfile(TSP_Profile_BCP195 /*opt_tlsProfile*/) != TCS_ok) | |
| 135 { | |
| 136 throw OrthancException(ErrorCode_InternalError, "Cannot set the DICOM TLS profile"); | |
| 137 } | |
| 138 | |
| 139 if (tls->activateCipherSuites()) | |
| 140 { | |
| 141 throw OrthancException(ErrorCode_InternalError, "Cannot activate the cipher suites for DICOM TLS"); | |
| 142 } | |
| 143 #else | |
| 144 CLOG(INFO, DICOM) << "Using the following cipher suites for DICOM TLS: " << opt_ciphersuites; | |
| 145 if (tls->setCipherSuites(opt_ciphersuites.c_str()) != TCS_ok) | |
| 146 { | |
| 147 throw OrthancException(ErrorCode_InternalError, "Unable to set cipher suites to: " + opt_ciphersuites); | |
| 148 } | |
| 149 #endif | |
| 150 | |
|
4656
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
151 if (requireRemoteCertificate) |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
152 { |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
153 // Check remote certificate, fail if no certificate is present |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
154 tls->setCertificateVerification(DCV_requireCertificate /*opt_certVerification*/); |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
155 } |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
156 else |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
157 { |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
158 // Check remote certificate if present, succeed if no certificate is present |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
159 tls->setCertificateVerification(DCV_checkCertificate /*opt_certVerification*/); |
|
82a314325351
New configuration option: "DicomTlsRemoteCertificateRequired"
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4438
diff
changeset
|
160 } |
| 4432 | 161 |
| 162 if (ASC_setTransportLayer(network, tls.get(), 0).bad()) | |
| 163 { | |
| 164 throw OrthancException(ErrorCode_InternalError, "Cannot enable DICOM TLS in the Orthanc " + | |
| 165 std::string(role == NET_ACCEPTOR ? "SCP" : "SCU")); | |
| 166 } | |
| 167 | |
| 168 return tls.release(); | |
| 169 } | |
| 170 } | |
| 171 } |