test_tls_integration.cpp

Go to the documentation of this file.

 
#include "test_fixtures.h"
 
#include <catch2/catch_test_macros.hpp>
#include <catch2/matchers/catch_matchers_string.hpp>
 
#include "kcenon/pacs/integration/network_adapter.h"
#include "kcenon/pacs/network/dimse/dimse_message.h"
#include "kcenon/pacs/services/verification_scp.h"
 
#include <filesystem>
#include <thread>
 
using namespace kcenon::pacs::integration_test;
using namespace kcenon::pacs::services;
using kcenon::pacs::integration::tls_config;
using kcenon::pacs::integration::network_adapter;
 
namespace {
 
// =============================================================================
// TLS Test Fixtures
// =============================================================================
 
struct test_certificate_bundle {
    std::filesystem::path ca_cert;
    std::filesystem::path ca_key;
    std::filesystem::path server_cert;
    std::filesystem::path server_key;
    std::filesystem::path client_cert;
    std::filesystem::path client_key;
    std::filesystem::path other_ca_cert;
 
    [[nodiscard]] bool all_exist() const {
        return std::filesystem::exists(ca_cert) &&
               std::filesystem::exists(ca_key) &&
               std::filesystem::exists(server_cert) &&
               std::filesystem::exists(server_key) &&
               std::filesystem::exists(client_cert) &&
               std::filesystem::exists(client_key);
    }
};
 
test_certificate_bundle get_test_certificates() {
    // Look for certificates in build directory first, then source directory
    std::vector<std::filesystem::path> search_paths = {
        std::filesystem::current_path() / "test_data" / "certs",
        std::filesystem::current_path() / "bin" / "test_data" / "certs",
        std::filesystem::path(__FILE__).parent_path() / "test_data" / "certs"
    };
 
    // Also check environment variable
    if (const char* cert_dir = std::getenv("PACS_TEST_CERT_DIR")) {
        search_paths.insert(search_paths.begin(), cert_dir);
    }
 
    for (const auto& cert_dir : search_paths) {
        if (std::filesystem::exists(cert_dir / "ca.crt")) {
            return {
                cert_dir / "ca.crt",
                cert_dir / "ca.key",
                cert_dir / "server.crt",
                cert_dir / "server.key",
                cert_dir / "client.crt",
                cert_dir / "client.key",
                cert_dir / "other_ca.crt"
            };
        }
    }
 
    // Return default paths (tests will skip if not found)
    auto default_dir = std::filesystem::path(__FILE__).parent_path() / "test_data" / "certs";
    return {
        default_dir / "ca.crt",
        default_dir / "ca.key",
        default_dir / "server.crt",
        default_dir / "server.key",
        default_dir / "client.crt",
        default_dir / "client.key",
        default_dir / "other_ca.crt"
    };
}
 
class tls_test_server {
public:
    explicit tls_test_server(
        uint16_t port,
        const std::string& ae_title,
        const tls_config& tls_cfg)
        : port_(port == 0 ? find_available_port() : port)
        , ae_title_(ae_title)
        , tls_cfg_(tls_cfg) {
 
        kcenon::pacs::network::server_config config;
        config.ae_title = ae_title_;
        config.port = port_;
        config.max_associations = 10;
        config.idle_timeout = std::chrono::seconds{30};
        config.implementation_class_uid = "1.2.826.0.1.3680043.9.9999.1";
        config.implementation_version_name = "TLS_TEST_SCP";
 
        // Validate TLS config first
        auto tls_result = network_adapter::configure_tls(tls_cfg_);
        if (tls_result.is_err()) {
            tls_valid_ = false;
            return;
        }
        tls_valid_ = true;
 
        // Create server with TLS
        server_ = network_adapter::create_server(config, tls_cfg_);
    }
 
    ~tls_test_server() {
        stop();
    }
 
    // Non-copyable, non-movable
    tls_test_server(const tls_test_server&) = delete;
    tls_test_server& operator=(const tls_test_server&) = delete;
    tls_test_server(tls_test_server&&) = delete;
    tls_test_server& operator=(tls_test_server&&) = delete;
 
    template <typename Service>
    void register_service(std::shared_ptr<Service> service) {
        if (server_) {
            server_->register_service(std::move(service));
        }
    }
 
    [[nodiscard]] bool start() {
        if (!server_ || !tls_valid_) {
            return false;
        }
        auto result = server_->start();
        if (result.is_ok()) {
            running_ = true;
            std::this_thread::sleep_for(std::chrono::milliseconds{100});
        }
        return result.is_ok();
    }
 
    void stop() {
        if (running_ && server_) {
            server_->stop();
            running_ = false;
        }
    }
 
    [[nodiscard]] uint16_t port() const noexcept { return port_; }
    [[nodiscard]] const std::string& ae_title() const noexcept { return ae_title_; }
    [[nodiscard]] bool is_running() const noexcept { return running_; }
    [[nodiscard]] bool is_tls_valid() const noexcept { return tls_valid_; }
    [[nodiscard]] kcenon::pacs::network::dicom_server* server() { return server_.get(); }
 
private:
    uint16_t port_;
    std::string ae_title_;
    tls_config tls_cfg_;
    std::unique_ptr<kcenon::pacs::network::dicom_server> server_;
    bool running_{false};
    bool tls_valid_{false};
};
 
class tls_test_client {
public:
    static kcenon::pacs::network::Result<kcenon::pacs::network::association> connect(
        const std::string& host,
        uint16_t port,
        const std::string& called_ae,
        const std::string& calling_ae,
        const tls_config& tls_cfg,
        const std::vector<std::string>& sop_classes = {std::string(verification_sop_class_uid)}) {
 
        // Validate TLS configuration
        auto tls_result = network_adapter::configure_tls(tls_cfg);
        if (tls_result.is_err()) {
            return tls_result.error();
        }
 
        // Configure association
        kcenon::pacs::network::association_config config;
        config.calling_ae_title = calling_ae;
        config.called_ae_title = called_ae;
        config.implementation_class_uid = "1.2.826.0.1.3680043.9.9999.2";
        config.implementation_version_name = "TLS_TEST_SCU";
 
        uint8_t context_id = 1;
        for (const auto& sop_class : sop_classes) {
            config.proposed_contexts.push_back({
                context_id,
                sop_class,
                {
                    "1.2.840.10008.1.2.1",  // Explicit VR Little Endian
                    "1.2.840.10008.1.2"     // Implicit VR Little Endian
                }
            });
            context_id += 2;
        }
 
        // Connect with TLS configuration
        // Note: In full implementation, TLS config would be passed to connect
        return kcenon::pacs::network::association::connect(host, port, config, default_timeout());
    }
};
 
}  // namespace
 
// =============================================================================
// Scenario 1: Basic TLS Connection
// =============================================================================
 
TEST_CASE("TLS C-ECHO connection", "[tls][connectivity]") {
    auto certs = get_test_certificates();
 
    // Skip if certificates not available
    if (!certs.all_exist()) {
        WARN("Skipping TLS tests: certificates not found at " << certs.ca_cert.parent_path());
        SKIP("Test certificates not available");
    }
 
    SECTION("TLS server accepts connection and responds to C-ECHO") {
        // Configure TLS server
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = false;  // Don't require client cert
        server_tls.min_version = tls_config::tls_version::v1_2;
 
        auto port = find_available_port();
        tls_test_server server(port, "TLS_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            WARN("TLS configuration not valid, skipping test");
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
        REQUIRE(server.is_running());
 
        // Configure TLS client
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;  // Verify server cert
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto connect_result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS_SCU", client_tls);
 
        REQUIRE(connect_result.is_ok());
        auto& assoc = connect_result.value();
 
        // Verify connection
        REQUIRE(assoc.has_accepted_context(verification_sop_class_uid));
 
        auto context_id_opt = assoc.accepted_context_id(verification_sop_class_uid);
        REQUIRE(context_id_opt.has_value());
 
        // Send C-ECHO
        using namespace kcenon::pacs::network::dimse;
        auto echo_rq = make_c_echo_rq(1, verification_sop_class_uid);
        auto send_result = assoc.send_dimse(*context_id_opt, echo_rq);
        REQUIRE(send_result.is_ok());
 
        auto recv_result = assoc.receive_dimse(default_timeout());
        REQUIRE(recv_result.is_ok());
 
        auto& [recv_ctx, echo_rsp] = recv_result.value();
        REQUIRE(echo_rsp.command() == command_field::c_echo_rsp);
        REQUIRE(echo_rsp.status() == status_success);
 
        // Clean up
        (void)assoc.release(default_timeout());
        server.stop();
    }
}
 
// =============================================================================
// Scenario 2: Certificate Validation
// =============================================================================
 
TEST_CASE("TLS certificate validation", "[tls][security]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        SKIP("Test certificates not available");
    }
 
    // Start TLS server
    tls_config server_tls;
    server_tls.enabled = true;
    server_tls.cert_path = certs.server_cert;
    server_tls.key_path = certs.server_key;
    server_tls.ca_path = certs.ca_cert;
    server_tls.verify_peer = false;
    server_tls.min_version = tls_config::tls_version::v1_2;
 
    auto port = find_available_port();
    tls_test_server server(port, "TLS_SCP", server_tls);
 
    if (!server.is_tls_valid()) {
        SKIP("TLS not properly configured");
    }
 
    server.register_service(std::make_shared<verification_scp>());
    REQUIRE(server.start());
 
    SECTION("Valid certificate succeeds") {
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS_SCU", client_tls);
 
        REQUIRE(result.is_ok());
        auto& assoc = result.value();
        (void)assoc.release(default_timeout());
    }
 
    SECTION("Wrong CA fails validation") {
        // Skip if other_ca doesn't exist
        if (!std::filesystem::exists(certs.other_ca_cert)) {
            WARN("other_ca.crt not found, skipping wrong CA test");
            server.stop();
            return;
        }
 
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.other_ca_cert;  // Wrong CA
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS_SCU", client_tls);
 
        // Should fail due to certificate verification failure
        // Note: Actual behavior depends on implementation
        // Some implementations may still connect but with warnings
        if (result.is_ok()) {
            auto& assoc = result.value();
            assoc.abort();
        }
    }
 
    SECTION("TLS configuration validation") {
        // Test invalid TLS configuration
        tls_config invalid_tls;
        invalid_tls.enabled = true;
        invalid_tls.cert_path = "/nonexistent/cert.pem";
        invalid_tls.key_path = "/nonexistent/key.pem";
 
        auto result = network_adapter::configure_tls(invalid_tls);
        // Should fail validation
        REQUIRE(result.is_err());
    }
 
    server.stop();
}
 
// =============================================================================
// Scenario 3: Mutual TLS (mTLS)
// =============================================================================
 
TEST_CASE("Mutual TLS authentication", "[tls][mtls]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        SKIP("Test certificates not available");
    }
 
    SECTION("Client with valid certificate succeeds") {
        // Server requires client certificate
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = true;  // Require client cert
        server_tls.min_version = tls_config::tls_version::v1_2;
 
        auto port = find_available_port();
        tls_test_server server(port, "MTLS_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
 
        // Client with certificate
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.cert_path = certs.client_cert;
        client_tls.key_path = certs.client_key;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "MTLS_SCU", client_tls);
 
        REQUIRE(result.is_ok());
        auto& assoc = result.value();
 
        // Verify we can communicate
        REQUIRE(assoc.has_accepted_context(verification_sop_class_uid));
 
        using namespace kcenon::pacs::network::dimse;
        auto ctx_id = *assoc.accepted_context_id(verification_sop_class_uid);
        auto echo_rq = make_c_echo_rq(1, verification_sop_class_uid);
        auto send_result = assoc.send_dimse(ctx_id, echo_rq);
        REQUIRE(send_result.is_ok());
 
        auto recv_result = assoc.receive_dimse(default_timeout());
        REQUIRE(recv_result.is_ok());
 
        auto& [recv_ctx, rsp] = recv_result.value();
        REQUIRE(rsp.status() == status_success);
 
        (void)assoc.release(default_timeout());
        server.stop();
    }
 
    SECTION("Client without certificate fails when server requires it") {
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = true;  // Require client cert
        server_tls.min_version = tls_config::tls_version::v1_2;
 
        auto port = find_available_port();
        tls_test_server server(port, "MTLS_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
 
        // Client without certificate
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        // No client cert/key
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "NO_CERT_SCU", client_tls);
 
        // Should fail due to missing client certificate
        // Note: Actual behavior depends on server configuration
        if (result.is_ok()) {
            auto& assoc = result.value();
            // Connection might succeed but operations may fail
            assoc.abort();
        }
 
        server.stop();
    }
}
 
// =============================================================================
// Scenario 4: TLS Version Negotiation
// =============================================================================
 
TEST_CASE("TLS version negotiation", "[tls][version]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        SKIP("Test certificates not available");
    }
 
    SECTION("TLS 1.2 connection") {
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = false;
        server_tls.min_version = tls_config::tls_version::v1_2;
 
        auto port = find_available_port();
        tls_test_server server(port, "TLS12_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
 
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS12_SCU", client_tls);
 
        REQUIRE(result.is_ok());
        auto& assoc = result.value();
        (void)assoc.release(default_timeout());
        server.stop();
    }
 
    SECTION("TLS 1.3 connection") {
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = false;
        server_tls.min_version = tls_config::tls_version::v1_3;
 
        auto port = find_available_port();
        tls_test_server server(port, "TLS13_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
 
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_3;
 
        auto result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS13_SCU", client_tls);
 
        // TLS 1.3 may not be supported on all systems
        if (result.is_ok()) {
            auto& assoc = result.value();
            (void)assoc.release(default_timeout());
        } else {
            INFO("TLS 1.3 not supported: " << result.error().message);
        }
 
        server.stop();
    }
}
 
// =============================================================================
// Scenario 5: Multiple TLS Connections
// =============================================================================
 
TEST_CASE("Multiple concurrent TLS connections", "[tls][concurrent]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        SKIP("Test certificates not available");
    }
 
    tls_config server_tls;
    server_tls.enabled = true;
    server_tls.cert_path = certs.server_cert;
    server_tls.key_path = certs.server_key;
    server_tls.ca_path = certs.ca_cert;
    server_tls.verify_peer = false;
    server_tls.min_version = tls_config::tls_version::v1_2;
 
    auto port = find_available_port();
    tls_test_server server(port, "CONCURRENT_TLS", server_tls);
 
    if (!server.is_tls_valid()) {
        SKIP("TLS not properly configured");
    }
 
    server.register_service(std::make_shared<verification_scp>());
    REQUIRE(server.start());
 
    constexpr int num_connections = 3;
    std::vector<std::thread> threads;
    std::atomic<int> success_count{0};
 
    for (int i = 0; i < num_connections; ++i) {
        threads.emplace_back([&, i]() {
            tls_config client_tls;
            client_tls.enabled = true;
            client_tls.ca_path = certs.ca_cert;
            client_tls.verify_peer = true;
            client_tls.min_version = tls_config::tls_version::v1_2;
 
            auto result = tls_test_client::connect(
                "localhost", port, server.ae_title(),
                "TLS_SCU_" + std::to_string(i), client_tls);
 
            if (result.is_err()) {
                return;
            }
 
            auto& assoc = result.value();
            auto ctx_opt = assoc.accepted_context_id(verification_sop_class_uid);
            if (!ctx_opt) {
                return;
            }
 
            using namespace kcenon::pacs::network::dimse;
            auto echo_rq = make_c_echo_rq(1, verification_sop_class_uid);
            auto send_result = assoc.send_dimse(*ctx_opt, echo_rq);
            if (send_result.is_err()) {
                return;
            }
 
            auto recv_result = assoc.receive_dimse(default_timeout());
            if (recv_result.is_ok()) {
                auto& [ctx, rsp] = recv_result.value();
                if (rsp.status() == status_success) {
                    ++success_count;
                }
            }
 
            (void)assoc.release(default_timeout());
        });
    }
 
    for (auto& t : threads) {
        t.join();
    }
 
    server.stop();
 
    REQUIRE(success_count == num_connections);
}
 
// =============================================================================
// TLS Configuration Validation Tests
// =============================================================================
 
TEST_CASE("TLS configuration validation", "[tls][config]") {
    SECTION("Disabled TLS is always valid") {
        tls_config cfg;
        cfg.enabled = false;
 
        REQUIRE(cfg.is_valid() == true);
    }
 
    SECTION("Enabled TLS requires cert and key") {
        tls_config cfg;
        cfg.enabled = true;
 
        // Missing both cert and key
        REQUIRE(cfg.is_valid() == false);
 
        // Only cert
        cfg.cert_path = "/some/cert.pem";
        REQUIRE(cfg.is_valid() == false);
 
        // Both cert and key
        cfg.key_path = "/some/key.pem";
        REQUIRE(cfg.is_valid() == true);
    }
 
    SECTION("CA path is optional") {
        tls_config cfg;
        cfg.enabled = true;
        cfg.cert_path = "/some/cert.pem";
        cfg.key_path = "/some/key.pem";
 
        // Valid without CA
        REQUIRE(cfg.is_valid() == true);
 
        // Still valid with CA
        cfg.ca_path = "/some/ca.pem";
        REQUIRE(cfg.is_valid() == true);
    }
}
 
// =============================================================================
// Scenario 6: TLS Integration with dicom_server_v2
// =============================================================================
 
#ifdef PACS_WITH_NETWORK_SYSTEM
 
#include "kcenon/pacs/network/v2/dicom_server_v2.h"
 
namespace {
 
class tls_test_server_v2 {
public:
    explicit tls_test_server_v2(
        uint16_t port,
        const std::string& ae_title,
        const tls_config& tls_cfg)
        : port_(port == 0 ? find_available_port() : port)
        , ae_title_(ae_title)
        , tls_cfg_(tls_cfg) {
 
        kcenon::pacs::network::server_config config;
        config.ae_title = ae_title_;
        config.port = port_;
        config.max_associations = 10;
        config.idle_timeout = std::chrono::seconds{30};
        config.implementation_class_uid = "1.2.826.0.1.3680043.9.9999.200";
        config.implementation_version_name = "TLS_V2_SCP";
 
        // Validate TLS config first
        auto tls_result = network_adapter::configure_tls(tls_cfg_);
        if (tls_result.is_err()) {
            tls_valid_ = false;
            return;
        }
        tls_valid_ = true;
 
        // Create V2 server
        // Note: TLS integration for V2 server uses network_system's TLS support
        server_ = std::make_unique<kcenon::pacs::network::v2::dicom_server_v2>(config);
    }
 
    ~tls_test_server_v2() {
        stop();
    }
 
    tls_test_server_v2(const tls_test_server_v2&) = delete;
    tls_test_server_v2& operator=(const tls_test_server_v2&) = delete;
    tls_test_server_v2(tls_test_server_v2&&) = delete;
    tls_test_server_v2& operator=(tls_test_server_v2&&) = delete;
 
    template <typename Service>
    void register_service(std::shared_ptr<Service> service) {
        if (server_) {
            server_->register_service(std::move(service));
        }
    }
 
    [[nodiscard]] bool start() {
        if (!server_ || !tls_valid_) {
            return false;
        }
        auto result = server_->start();
        if (result.is_ok()) {
            running_ = true;
            std::this_thread::sleep_for(std::chrono::milliseconds{100});
        }
        return result.is_ok();
    }
 
    void stop() {
        if (running_ && server_) {
            server_->stop();
            running_ = false;
        }
    }
 
    [[nodiscard]] uint16_t port() const noexcept { return port_; }
    [[nodiscard]] const std::string& ae_title() const noexcept { return ae_title_; }
    [[nodiscard]] bool is_running() const noexcept { return running_; }
    [[nodiscard]] bool is_tls_valid() const noexcept { return tls_valid_; }
    [[nodiscard]] kcenon::pacs::network::v2::dicom_server_v2* server() { return server_.get(); }
 
private:
    uint16_t port_;
    std::string ae_title_;
    tls_config tls_cfg_;
    std::unique_ptr<kcenon::pacs::network::v2::dicom_server_v2> server_;
    bool running_{false};
    bool tls_valid_{false};
};
 
}  // namespace
 
TEST_CASE("TLS C-ECHO with dicom_server_v2", "[tls][v2][connectivity]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        WARN("Skipping TLS V2 tests: certificates not found");
        SKIP("Test certificates not available");
    }
 
    SECTION("V2 TLS server accepts connection and responds to C-ECHO") {
        tls_config server_tls;
        server_tls.enabled = true;
        server_tls.cert_path = certs.server_cert;
        server_tls.key_path = certs.server_key;
        server_tls.ca_path = certs.ca_cert;
        server_tls.verify_peer = false;
        server_tls.min_version = tls_config::tls_version::v1_2;
 
        auto port = find_available_port();
        tls_test_server_v2 server(port, "TLS_V2_SCP", server_tls);
 
        if (!server.is_tls_valid()) {
            WARN("TLS configuration not valid for V2, skipping test");
            SKIP("TLS not properly configured");
        }
 
        server.register_service(std::make_shared<verification_scp>());
        REQUIRE(server.start());
        REQUIRE(server.is_running());
 
        tls_config client_tls;
        client_tls.enabled = true;
        client_tls.ca_path = certs.ca_cert;
        client_tls.verify_peer = true;
        client_tls.min_version = tls_config::tls_version::v1_2;
 
        auto connect_result = tls_test_client::connect(
            "localhost", port, server.ae_title(), "TLS_V2_SCU", client_tls);
 
        REQUIRE(connect_result.is_ok());
        auto& assoc = connect_result.value();
 
        REQUIRE(assoc.has_accepted_context(verification_sop_class_uid));
 
        auto context_id_opt = assoc.accepted_context_id(verification_sop_class_uid);
        REQUIRE(context_id_opt.has_value());
 
        using namespace kcenon::pacs::network::dimse;
        auto echo_rq = make_c_echo_rq(1, verification_sop_class_uid);
        auto send_result = assoc.send_dimse(*context_id_opt, echo_rq);
        REQUIRE(send_result.is_ok());
 
        auto recv_result = assoc.receive_dimse(default_timeout());
        REQUIRE(recv_result.is_ok());
 
        auto& [recv_ctx, echo_rsp] = recv_result.value();
        REQUIRE(echo_rsp.command() == command_field::c_echo_rsp);
        REQUIRE(echo_rsp.status() == status_success);
 
        (void)assoc.release(default_timeout());
        server.stop();
    }
}
 
TEST_CASE("TLS concurrent connections with dicom_server_v2", "[tls][v2][concurrent]") {
    auto certs = get_test_certificates();
 
    if (!certs.all_exist()) {
        SKIP("Test certificates not available");
    }
 
    tls_config server_tls;
    server_tls.enabled = true;
    server_tls.cert_path = certs.server_cert;
    server_tls.key_path = certs.server_key;
    server_tls.ca_path = certs.ca_cert;
    server_tls.verify_peer = false;
    server_tls.min_version = tls_config::tls_version::v1_2;
 
    auto port = find_available_port();
    tls_test_server_v2 server(port, "TLS_V2_CONCURRENT", server_tls);
 
    if (!server.is_tls_valid()) {
        SKIP("TLS not properly configured for V2");
    }
 
    server.register_service(std::make_shared<verification_scp>());
    REQUIRE(server.start());
 
    constexpr int num_connections = 5;
    std::vector<std::thread> threads;
    std::atomic<int> success_count{0};
 
    for (int i = 0; i < num_connections; ++i) {
        threads.emplace_back([&, i]() {
            tls_config client_tls;
            client_tls.enabled = true;
            client_tls.ca_path = certs.ca_cert;
            client_tls.verify_peer = true;
            client_tls.min_version = tls_config::tls_version::v1_2;
 
            auto result = tls_test_client::connect(
                "localhost", port, server.ae_title(),
                "TLS_V2_SCU_" + std::to_string(i), client_tls);
 
            if (result.is_err()) {
                return;
            }
 
            auto& assoc = result.value();
            auto ctx_opt = assoc.accepted_context_id(verification_sop_class_uid);
            if (!ctx_opt) {
                return;
            }
 
            using namespace kcenon::pacs::network::dimse;
            auto echo_rq = make_c_echo_rq(1, verification_sop_class_uid);
            auto send_result = assoc.send_dimse(*ctx_opt, echo_rq);
            if (send_result.is_err()) {
                return;
            }
 
            auto recv_result = assoc.receive_dimse(default_timeout());
            if (recv_result.is_ok()) {
                auto& [ctx, rsp] = recv_result.value();
                if (rsp.status() == status_success) {
                    ++success_count;
                }
            }
 
            (void)assoc.release(default_timeout());
        });
    }
 
    for (auto& t : threads) {
        t.join();
    }
 
    server.stop();
 
    REQUIRE(success_count == num_connections);
}
 
#endif  // PACS_WITH_NETWORK_SYSTEM