Reject instances based on AE Title in Python callback

Google Groups archive
1

Hello!

I know it is possible to reject C-STORE from certain modalities if we configure orthanc.json like this:

{ “DicomModalities” : { “untrusted” : { “AET” : “CT”, “Port” : 104, “Host” : “192.168.0.10”, “AllowEcho” : false, “AllowFind” : false, “AllowMove” : false, “AllowGet” : false, “AllowStore” : false } } }

It is also possible to see the remote AET of an instance by using orthanc.RegisterOnStoredInstanceCallback like this:

def OnStoredInstance(dicom, instanceId):

print(dicom.GetInstanceRemoteAet())

What I would like to do is use the AET to decide whether to accept or reject an instance in the orthanc.RegisterReceivedInstanceCallback. How can I retrieve the AET of an incoming instance?

2

Hi Diego,

I’m afraid this is not possible.

Have you looked at RegisterIncomingCStoreInstanceFilter ? However, note that it happens after the ReceivedInstanceCallback.

HTH

Alain.

3

Hi Alain! Is this a new feature? Definitely worth taking a look. I’ll try and let you know.

A quarta-feira, 15 de junho de 2022 à(s) 15:35:37 UTC+1, alain...@osimis.io escreveu:

4

It was part of python 4.0 but we forgot to document it :slight_smile:

5

Hello!

Perhaps running Orthanc behind NGINX could solve it:

https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/

https://book.orthanc-server.com/faq/nginx.html

Regards

Ludwig

6

Hi Ludwig!

Would be nice to do it at the TCP/NGINX level, but since I want to block based on AET I don’t think it will be possible. I will check the RegisterIncomingCStoreInstanceFilter but since it happens after ReceivedInstanceCallback I guess the DICOM instances are stored in Orthanc, then removed. My understanding is that the ReceivedInstanceCallback goes a step further and does not allow the instances to even get into Orthanc (like a rejected POST request), so I would say it is the optimal event for DICOM denial logics.

A sexta-feira, 17 de junho de 2022 à(s) 13:19:05 UTC+1, ludwig...@gmail.com escreveu: