Sends ATNA audit messages via Syslog protocol. More...

#include <atna_syslog_transport.h>

Collaboration diagram for kcenon::pacs::security::atna_syslog_transport:

Classes
struct	tls_context

Public Member Functions
	atna_syslog_transport (const syslog_transport_config &config)
	Construct transport with configuration.

	~atna_syslog_transport ()

	atna_syslog_transport (const atna_syslog_transport &)=delete

atna_syslog_transport &	operator= (const atna_syslog_transport &)=delete

	atna_syslog_transport (atna_syslog_transport &&other) noexcept

atna_syslog_transport &	operator= (atna_syslog_transport &&other) noexcept

kcenon::pacs::VoidResult	send (const std::string &xml_message)
	Send an RFC 3881 XML audit message via Syslog.

std::string	format_syslog_message (const std::string &xml_message) const
	Format an XML audit message as an RFC 5424 Syslog message.

bool	is_connected () const noexcept
	Check if the transport is connected (TLS only)

void	close ()
	Close the transport connection.

size_t	messages_sent () const noexcept

size_t	send_errors () const noexcept

void	reset_statistics () noexcept

const syslog_transport_config &	config () const noexcept

Private Types
using	socket_type = int

Private Member Functions
kcenon::pacs::VoidResult	send_udp (const std::string &syslog_message)

kcenon::pacs::VoidResult	send_tls (const std::string &syslog_message)

kcenon::pacs::VoidResult	ensure_tls_connected ()

Static Private Member Functions
static std::string	get_local_hostname ()

static std::string	get_timestamp ()

static uint8_t	compute_priority (syslog_facility facility, syslog_severity severity)

Private Attributes
syslog_transport_config	config_

socket_type	socket_ {invalid_socket}

tls_context *	tls_ {nullptr}

std::atomic< size_t >	messages_sent_ {0}

std::atomic< size_t >	send_errors_ {0}

Static Private Attributes
static constexpr socket_type	invalid_socket = -1

Detailed Description

Sends ATNA audit messages via Syslog protocol.

Formats RFC 3881 XML audit messages into RFC 5424 Syslog messages and sends them to an Audit Record Repository via UDP or TLS.

Usage

syslog_transport_config config;
config.host = "audit-server.hospital.local";
config.port = 6514;
config.protocol = syslog_transport_protocol::tls;
config.ca_cert_path = "/etc/pacs/certs/ca.pem";
 
atna_syslog_transport transport(config);
 
auto msg = atna_audit_logger::build_user_authentication(...);
auto xml = atna_audit_logger::to_xml(msg);
auto result = transport.send(xml);

Definition at line 164 of file atna_syslog_transport.h.

Member Typedef Documentation

◆ socket_type

using kcenon::pacs::security::atna_syslog_transport::socket_type = int

private

Definition at line 274 of file atna_syslog_transport.h.

Constructor & Destructor Documentation

◆ atna_syslog_transport() [1/3]

kcenon::pacs::security::atna_syslog_transport::atna_syslog_transport ( const syslog_transport_config & config )

explicit

Construct transport with configuration.

Parameters

config Transport configuration

Definition at line 91 of file atna_syslog_transport.cpp.

    : config_(config) {
    if (config_.hostname.empty()) {
        config_.hostname = get_local_hostname();
    }
}

References config_, and kcenon::pacs::security::syslog_transport_config::hostname.

◆ ~atna_syslog_transport()

kcenon::pacs::security::atna_syslog_transport::~atna_syslog_transport ( )

Definition at line 99 of file atna_syslog_transport.cpp.

                                              {
    close();
}

References close().

Here is the call graph for this function:

◆ atna_syslog_transport() [2/3]

kcenon::pacs::security::atna_syslog_transport::atna_syslog_transport ( const atna_syslog_transport & )

delete

◆ atna_syslog_transport() [3/3]

kcenon::pacs::security::atna_syslog_transport::atna_syslog_transport ( atna_syslog_transport && other )

noexcept

Definition at line 103 of file atna_syslog_transport.cpp.

    : config_(std::move(other.config_)),
      socket_(other.socket_),
      tls_(other.tls_),
      messages_sent_(other.messages_sent_.load(std::memory_order_relaxed)),
      send_errors_(other.send_errors_.load(std::memory_order_relaxed)) {
    other.socket_ = invalid_socket;
    other.tls_ = nullptr;
}

References kcenon::pacs::security::other.

Member Function Documentation

◆ close()

void kcenon::pacs::security::atna_syslog_transport::close ( )

Close the transport connection.

For TLS, performs graceful shutdown. For UDP, closes the socket.

Definition at line 195 of file atna_syslog_transport.cpp.

                                  {
    delete tls_;
    tls_ = nullptr;
 
    if (socket_ != invalid_socket) {
        close_socket(socket_);
        socket_ = invalid_socket;
    }
}

References invalid_socket, socket_, and tls_.

Referenced by ensure_tls_connected(), send_tls(), and ~atna_syslog_transport().

Here is the caller graph for this function:

◆ compute_priority()

uint8_t kcenon::pacs::security::atna_syslog_transport::compute_priority	(	syslog_facility	facility,
		syslog_severity	severity )

staticnodiscardprivate

Definition at line 487 of file atna_syslog_transport.cpp.

                                                        {
    // PRI = Facility * 8 + Severity
    return static_cast<uint8_t>(
        static_cast<uint8_t>(facility) * 8 +
        static_cast<uint8_t>(severity));
}

Referenced by format_syslog_message().

Here is the caller graph for this function:

◆ config()

const syslog_transport_config & kcenon::pacs::security::atna_syslog_transport::config ( ) const

nodiscardnoexcept

Definition at line 222 of file atna_syslog_transport.cpp.

                                                                            {
    return config_;
}

References config_.

◆ ensure_tls_connected()

kcenon::pacs::VoidResult kcenon::pacs::security::atna_syslog_transport::ensure_tls_connected ( )

nodiscardprivate

Definition at line 320 of file atna_syslog_transport.cpp.

                                                                 {
#ifndef PACS_WITH_DIGITAL_SIGNATURES
    return kcenon::pacs::pacs_void_error(
        kcenon::pacs::error_codes::connection_failed,
        "TLS not available — OpenSSL not linked");
#else
    if (tls_ && tls_->ssl && socket_ != invalid_socket) {
        return kcenon::common::ok();  // Already connected
    }
 
    // Clean up previous state
    close();
 
    // Create SSL context
    tls_ = new tls_context();
    tls_->ctx = SSL_CTX_new(TLS_client_method());
    if (!tls_->ctx) {
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to create TLS context: " + get_openssl_error());
    }
 
    // Set minimum TLS version to 1.2 (IHE ATNA requirement)
    SSL_CTX_set_min_proto_version(tls_->ctx, TLS1_2_VERSION);
 
    // Load CA certificate for server verification
    if (!config_.ca_cert_path.empty()) {
        if (SSL_CTX_load_verify_locations(
                tls_->ctx, config_.ca_cert_path.c_str(), nullptr) != 1) {
            close();
            return kcenon::pacs::pacs_void_error(
                kcenon::pacs::error_codes::connection_failed,
                "Failed to load CA certificate: " + get_openssl_error());
        }
    }
 
    // Load client certificate (mutual TLS)
    if (!config_.client_cert_path.empty()) {
        if (SSL_CTX_use_certificate_file(
                tls_->ctx, config_.client_cert_path.c_str(),
                SSL_FILETYPE_PEM) != 1) {
            close();
            return kcenon::pacs::pacs_void_error(
                kcenon::pacs::error_codes::connection_failed,
                "Failed to load client certificate: " + get_openssl_error());
        }
    }
 
    if (!config_.client_key_path.empty()) {
        if (SSL_CTX_use_PrivateKey_file(
                tls_->ctx, config_.client_key_path.c_str(),
                SSL_FILETYPE_PEM) != 1) {
            close();
            return kcenon::pacs::pacs_void_error(
                kcenon::pacs::error_codes::connection_failed,
                "Failed to load client key: " + get_openssl_error());
        }
    }
 
    // Set verification mode
    if (config_.verify_server) {
        SSL_CTX_set_verify(tls_->ctx, SSL_VERIFY_PEER, nullptr);
    } else {
        SSL_CTX_set_verify(tls_->ctx, SSL_VERIFY_NONE, nullptr);
    }
 
    // Resolve and connect TCP socket
    struct addrinfo hints{};
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_protocol = IPPROTO_TCP;
 
    struct addrinfo* result = nullptr;
    std::string port_str = std::to_string(config_.port);
 
    int ret = ::getaddrinfo(
        config_.host.c_str(), port_str.c_str(), &hints, &result);
    if (ret != 0 || result == nullptr) {
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to resolve TLS syslog host: " + config_.host);
    }
 
    socket_ = ::socket(
        result->ai_family, result->ai_socktype, result->ai_protocol);
    if (socket_ == invalid_socket) {
        ::freeaddrinfo(result);
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to create TCP socket");
    }
 
    if (::connect(socket_, result->ai_addr,
                  static_cast<int>(result->ai_addrlen)) != 0) {
        ::freeaddrinfo(result);
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to connect to TLS syslog server: " +
            config_.host + ":" + port_str);
    }
    ::freeaddrinfo(result);
 
    // Create SSL object and perform handshake
    tls_->ssl = SSL_new(tls_->ctx);
    if (!tls_->ssl) {
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to create SSL object: " + get_openssl_error());
    }
 
    SSL_set_fd(tls_->ssl, static_cast<int>(socket_));
 
    // Set SNI hostname
    SSL_set_tlsext_host_name(tls_->ssl, config_.host.c_str());
 
    if (SSL_connect(tls_->ssl) != 1) {
        std::string err = get_openssl_error();
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "TLS handshake failed: " + err);
    }
 
    return kcenon::common::ok();
#endif
}

References kcenon::pacs::security::syslog_transport_config::ca_cert_path, kcenon::pacs::security::syslog_transport_config::client_cert_path, kcenon::pacs::security::syslog_transport_config::client_key_path, close(), config_, kcenon::pacs::error_codes::connection_failed, kcenon::pacs::security::syslog_transport_config::host, invalid_socket, kcenon::pacs::pacs_void_error(), kcenon::pacs::security::syslog_transport_config::port, socket_, tls_, and kcenon::pacs::security::syslog_transport_config::verify_server.

Referenced by send_tls().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ format_syslog_message()

std::string kcenon::pacs::security::atna_syslog_transport::format_syslog_message ( const std::string & xml_message ) const

nodiscard

Format an XML audit message as an RFC 5424 Syslog message.

Produces the complete Syslog message without sending it. Useful for testing and logging.

Parameters

xml_message The audit XML payload

Returns: Formatted RFC 5424 message string

Definition at line 159 of file atna_syslog_transport.cpp.

                                        {
 
    // RFC 5424 format:
    // <PRI>VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID
    //   SP STRUCTURED-DATA SP MSG
 
    uint8_t pri = compute_priority(config_.facility, config_.severity);
    std::string timestamp = get_timestamp();
 
    std::ostringstream oss;
    oss << "<" << static_cast<int>(pri) << ">"
        << "1"  // Version
        << " " << timestamp
        << " " << (config_.hostname.empty() ? "-" : config_.hostname)
        << " " << (config_.app_name.empty() ? "-" : config_.app_name)
        << " " << "-"  // PROCID (NIL)
        << " " << "IHE+RFC-3881"  // MSGID — IHE ATNA identifier
        << " " << "-"  // STRUCTURED-DATA (NIL)
        << " " << "\xEF\xBB\xBF"  // BOM (RFC 5424 Section 6.4)
        << xml_message;
 
    return oss.str();
}

References kcenon::pacs::security::syslog_transport_config::app_name, compute_priority(), config_, kcenon::pacs::security::syslog_transport_config::facility, get_timestamp(), kcenon::pacs::security::syslog_transport_config::hostname, and kcenon::pacs::security::syslog_transport_config::severity.

Referenced by send().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ get_local_hostname()

std::string kcenon::pacs::security::atna_syslog_transport::get_local_hostname ( )

staticnodiscardprivate

Definition at line 456 of file atna_syslog_transport.cpp.

                                                    {
    char hostname[256];
    if (::gethostname(hostname, sizeof(hostname)) == 0) {
        hostname[sizeof(hostname) - 1] = '\0';
        return std::string(hostname);
    }
    return "localhost";
}

◆ get_timestamp()

std::string kcenon::pacs::security::atna_syslog_transport::get_timestamp ( )

staticnodiscardprivate

Definition at line 465 of file atna_syslog_transport.cpp.

                                               {
    // RFC 5424 TIMESTAMP format: YYYY-MM-DDThh:mm:ss.sssZ
    auto now = std::chrono::system_clock::now();
    auto time_t_val = std::chrono::system_clock::to_time_t(now);
    auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
        now.time_since_epoch()) % 1000;
 
    std::tm tm_val{};
#if defined(_WIN32)
    gmtime_s(&tm_val, &time_t_val);
#else
    gmtime_r(&time_t_val, &tm_val);
#endif
 
    std::ostringstream oss;
    oss << std::put_time(&tm_val, "%Y-%m-%dT%H:%M:%S")
        << '.' << std::setfill('0') << std::setw(3) << ms.count()
        << "Z";
 
    return oss.str();
}

Referenced by format_syslog_message().

Here is the caller graph for this function:

◆ is_connected()

bool kcenon::pacs::security::atna_syslog_transport::is_connected ( ) const

nodiscardnoexcept

Check if the transport is connected (TLS only)

For UDP, always returns true since UDP is connectionless.

Definition at line 188 of file atna_syslog_transport.cpp.

                                                        {
    if (config_.protocol == syslog_transport_protocol::udp) {
        return true;  // UDP is connectionless
    }
    return socket_ != invalid_socket && tls_ != nullptr;
}

References config_, invalid_socket, kcenon::pacs::security::syslog_transport_config::protocol, socket_, tls_, and kcenon::pacs::security::udp.

◆ messages_sent()

size_t kcenon::pacs::security::atna_syslog_transport::messages_sent ( ) const

nodiscardnoexcept

Definition at line 209 of file atna_syslog_transport.cpp.

                                                           {
    return messages_sent_.load(std::memory_order_relaxed);
}

References messages_sent_.

◆ operator=() [1/2]

atna_syslog_transport & kcenon::pacs::security::atna_syslog_transport::operator= ( atna_syslog_transport && other )

noexcept

Definition at line 114 of file atna_syslog_transport.cpp.

                                            {
    if (this != &other) {
        close();
        config_ = std::move(other.config_);
        socket_ = other.socket_;
        tls_ = other.tls_;
        messages_sent_.store(
            other.messages_sent_.load(std::memory_order_relaxed),
            std::memory_order_relaxed);
        send_errors_.store(
            other.send_errors_.load(std::memory_order_relaxed),
            std::memory_order_relaxed);
        other.socket_ = invalid_socket;
        other.tls_ = nullptr;
    }
    return *this;
}

References kcenon::pacs::security::other.

◆ operator=() [2/2]

atna_syslog_transport & kcenon::pacs::security::atna_syslog_transport::operator= ( const atna_syslog_transport & )

delete

◆ reset_statistics()

void kcenon::pacs::security::atna_syslog_transport::reset_statistics ( )

noexcept

Definition at line 217 of file atna_syslog_transport.cpp.

                                                      {
    messages_sent_.store(0, std::memory_order_relaxed);
    send_errors_.store(0, std::memory_order_relaxed);
}

References messages_sent_, and send_errors_.

◆ send()

kcenon::pacs::VoidResult kcenon::pacs::security::atna_syslog_transport::send ( const std::string & xml_message )

nodiscard

Send an RFC 3881 XML audit message via Syslog.

Wraps the XML payload in an RFC 5424 Syslog message and sends it to the configured Audit Record Repository.

Parameters

xml_message RFC 3881 XML audit message string

Returns: VoidResult indicating success or transport error

Definition at line 137 of file atna_syslog_transport.cpp.

                                  {
 
    auto syslog_msg = format_syslog_message(xml_message);
 
    auto result = (config_.protocol == syslog_transport_protocol::tls)
        ? send_tls(syslog_msg)
        : send_udp(syslog_msg);
 
    if (result.is_ok()) {
        messages_sent_.fetch_add(1, std::memory_order_relaxed);
    } else {
        send_errors_.fetch_add(1, std::memory_order_relaxed);
    }
 
    return result;
}

References config_, format_syslog_message(), messages_sent_, kcenon::pacs::security::syslog_transport_config::protocol, send_errors_, send_tls(), send_udp(), and kcenon::pacs::security::tls.

Referenced by kcenon::pacs::security::atna_service_auditor::send_audit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ send_errors()

size_t kcenon::pacs::security::atna_syslog_transport::send_errors ( ) const

nodiscardnoexcept

Definition at line 213 of file atna_syslog_transport.cpp.

                                                         {
    return send_errors_.load(std::memory_order_relaxed);
}

References send_errors_.

◆ send_tls()

kcenon::pacs::VoidResult kcenon::pacs::security::atna_syslog_transport::send_tls ( const std::string & syslog_message )

nodiscardprivate

Definition at line 285 of file atna_syslog_transport.cpp.

                                     {
 
#ifndef PACS_WITH_DIGITAL_SIGNATURES
    (void)syslog_message;
    return kcenon::pacs::pacs_void_error(
        kcenon::pacs::error_codes::connection_failed,
        "TLS syslog transport requires OpenSSL (PACS_WITH_DIGITAL_SIGNATURES)");
#else
    auto connect_result = ensure_tls_connected();
    if (!connect_result.is_ok()) {
        return connect_result;
    }
 
    // RFC 5425: Octet-counting framing
    // MSG-LEN SP SYSLOG-MSG
    std::string framed =
        std::to_string(syslog_message.size()) + " " + syslog_message;
 
    int bytes_written = SSL_write(
        tls_->ssl, framed.data(), static_cast<int>(framed.size()));
 
    if (bytes_written <= 0) {
        int ssl_err = SSL_get_error(tls_->ssl, bytes_written);
        close();
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::send_failed,
            "TLS write failed (SSL error: " +
            std::to_string(ssl_err) + ")");
    }
 
    return kcenon::common::ok();
#endif
}

References close(), kcenon::pacs::error_codes::connection_failed, ensure_tls_connected(), kcenon::pacs::pacs_void_error(), kcenon::pacs::error_codes::send_failed, and tls_.

Referenced by send().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ send_udp()

kcenon::pacs::VoidResult kcenon::pacs::security::atna_syslog_transport::send_udp ( const std::string & syslog_message )

nodiscardprivate

Definition at line 230 of file atna_syslog_transport.cpp.

                                     {
 
    // Resolve destination address
    struct addrinfo hints{};
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_DGRAM;
    hints.ai_protocol = IPPROTO_UDP;
 
    struct addrinfo* result = nullptr;
    std::string port_str = std::to_string(config_.port);
 
    int ret = ::getaddrinfo(
        config_.host.c_str(), port_str.c_str(), &hints, &result);
    if (ret != 0 || result == nullptr) {
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to resolve syslog host: " + config_.host);
    }
 
    // Create UDP socket
    socket_type sock = ::socket(
        result->ai_family, result->ai_socktype, result->ai_protocol);
    if (sock == invalid_socket) {
        ::freeaddrinfo(result);
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::connection_failed,
            "Failed to create UDP socket");
    }
 
    // Send the message
    auto bytes_sent = ::sendto(
        sock,
        syslog_message.data(),
        static_cast<int>(syslog_message.size()),
        0,
        result->ai_addr,
        static_cast<int>(result->ai_addrlen));
 
    ::freeaddrinfo(result);
    close_socket(sock);
 
    if (bytes_sent < 0) {
        return kcenon::pacs::pacs_void_error(
            kcenon::pacs::error_codes::send_failed,
            "Failed to send UDP syslog message");
    }
 
    return kcenon::common::ok();
}

References config_, kcenon::pacs::error_codes::connection_failed, kcenon::pacs::security::syslog_transport_config::host, invalid_socket, kcenon::pacs::pacs_void_error(), kcenon::pacs::security::syslog_transport_config::port, and kcenon::pacs::error_codes::send_failed.

Referenced by send().

Here is the call graph for this function:

Here is the caller graph for this function:

Member Data Documentation

◆ config_

syslog_transport_config kcenon::pacs::security::atna_syslog_transport::config_

private

Definition at line 267 of file atna_syslog_transport.h.

Referenced by atna_syslog_transport(), config(), ensure_tls_connected(), format_syslog_message(), is_connected(), send(), and send_udp().

◆ invalid_socket

socket_type kcenon::pacs::security::atna_syslog_transport::invalid_socket = -1

staticconstexprprivate

Definition at line 275 of file atna_syslog_transport.h.

Referenced by close(), ensure_tls_connected(), is_connected(), and send_udp().

◆ messages_sent_

std::atomic<size_t> kcenon::pacs::security::atna_syslog_transport::messages_sent_ {0}

private

Definition at line 283 of file atna_syslog_transport.h.

283{0};

Referenced by messages_sent(), reset_statistics(), and send().

◆ send_errors_

std::atomic<size_t> kcenon::pacs::security::atna_syslog_transport::send_errors_ {0}

private

Definition at line 284 of file atna_syslog_transport.h.

284{0};

Referenced by reset_statistics(), send(), and send_errors().

◆ socket_

socket_type kcenon::pacs::security::atna_syslog_transport::socket_ {invalid_socket}

private

Definition at line 277 of file atna_syslog_transport.h.

277{invalid_socket};

Referenced by close(), ensure_tls_connected(), and is_connected().

◆ tls_

tls_context* kcenon::pacs::security::atna_syslog_transport::tls_ {nullptr}

private

Definition at line 281 of file atna_syslog_transport.h.

281{nullptr};

Referenced by close(), ensure_tls_connected(), is_connected(), and send_tls().

The documentation for this class was generated from the following files:

include/kcenon/pacs/security/atna_syslog_transport.h
src/security/atna_syslog_transport.cpp

Classes

Public Member Functions

Private Types

Private Member Functions

Static Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Usage

Member Typedef Documentation

◆ socket_type

Constructor & Destructor Documentation

◆ atna_syslog_transport() [1/3]

◆ ~atna_syslog_transport()

◆ atna_syslog_transport() [2/3]

◆ atna_syslog_transport() [3/3]

Member Function Documentation

◆ close()

◆ compute_priority()

◆ config()

◆ ensure_tls_connected()

◆ format_syslog_message()

◆ get_local_hostname()

◆ get_timestamp()

◆ is_connected()

◆ messages_sent()

◆ operator=() [1/2]

◆ operator=() [2/2]

◆ reset_statistics()

◆ send()

◆ send_errors()

◆ send_tls()

◆ send_udp()

Member Data Documentation

◆ config_

◆ invalid_socket

◆ messages_sent_

◆ send_errors_

◆ socket_

◆ tls_