Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set system certificate trust running://remote.dns-server.crt
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns proxy static RD protocol dns-over-https hash d2be24e65ff372013da62ec4ec3f6031758ee573acef6552a41a6d4de0353831
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns static host-name teldat.com inet 10.11.12.13

Step 2: Set the following configuration in DUT1:

set service dns static host-name dns.dut0 inet 10.215.168.64
set system certificate trust running://CA.crt
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns proxy static DUT0 protocol dns-over-https hash 6ca660ddfe7db04c33ed2b5dcd5ac100fd43138bec40ae293cc1f0a944d954c1
set service dns proxy log level 0
set service dns resolver local

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

-- Logs begin at Mon 2024-02-26 19:06:15 UTC, end at Mon 2024-02-26 19:06:24 UTC. --
Feb 26 19:06:15.416928 osdx systemd-journald[1366]: Runtime journal (/run/log/journal/9107378b3879427292e8ecff8d61e29e) is 2.4M, max 9.7M, 7.3M free.
Feb 26 19:06:15.435994 osdx OSDxCLI[1560]: User 'admin' executed a new command: 'system journal clear'.
Feb 26 19:06:16.424574 osdx osdx-coredump[5715]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Feb 26 19:06:16.435375 osdx OSDxCLI[1560]: User 'admin' executed a new command: 'system coredump delete all'.
Feb 26 19:06:18.125098 osdx OSDxCLI[1560]: User 'admin' entered the configuration menu.
Feb 26 19:06:18.249044 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Feb 26 19:06:18.389846 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Feb 26 19:06:18.499075 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service ssh'.
Feb 26 19:06:18.667641 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Feb 26 19:06:18.868749 osdx systemd[1]: Starting OpenBSD Secure Shell server...
Feb 26 19:06:18.887372 osdx sshd[5808]: Server listening on 0.0.0.0 port 22.
Feb 26 19:06:18.887877 osdx sshd[5808]: Server listening on :: port 22.
Feb 26 19:06:18.888115 osdx systemd[1]: Started OpenBSD Secure Shell server.
Feb 26 19:06:18.913733 osdx cfgd[1003]: [1560]Completed change to active configuration
Feb 26 19:06:18.969034 osdx OSDxCLI[1560]: User 'admin' committed the configuration.
Feb 26 19:06:19.007214 osdx OSDxCLI[1560]: User 'admin' left the configuration menu.
Feb 26 19:06:19.216591 osdx OSDxCLI[1560]: User 'admin' executed a new command: 'ping 10.215.168.64      count 1 size 56 timeout 1'.
Feb 26 19:06:21.820467 osdx OSDxCLI[1560]: User 'admin' entered the configuration menu.
Feb 26 19:06:21.945333 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Feb 26 19:06:22.085681 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Feb 26 19:06:22.229081 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Feb 26 19:06:22.390143 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Feb 26 19:06:22.515476 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Feb 26 19:06:22.631436 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Feb 26 19:06:22.753798 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 6ca660ddfe7db04c33ed2b5dcd5ac100fd43138bec40ae293cc1f0a944d954c1'.
Feb 26 19:06:22.858150 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Feb 26 19:06:22.972369 osdx OSDxCLI[1560]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Feb 26 19:06:23.148343 osdx ca-certificates[5873]: Updating certificates in /etc/ssl/certs...
Feb 26 19:06:24.011727 osdx ca-certificates[6855]: 1 added, 0 removed; done.
Feb 26 19:06:24.019837 osdx ca-certificates[6862]: Running hooks in /etc/ca-certificates/update.d...
Feb 26 19:06:24.026288 osdx ca-certificates[6865]: done.
Feb 26 19:06:24.207198 osdx systemd[1]: Started DNSCrypt client proxy.
Feb 26 19:06:24.209852 osdx cfgd[1003]: [1560]Completed change to active configuration
Feb 26 19:06:24.216098 osdx OSDxCLI[1560]: User 'admin' committed the configuration.
Feb 26 19:06:24.249949 osdx OSDxCLI[1560]: User 'admin' left the configuration menu.
Feb 26 19:06:24.537926 osdx dnscrypt-proxy[6918]: dnscrypt-proxy 2.0.45
Feb 26 19:06:24.538522 osdx dnscrypt-proxy[6918]: Network connectivity detected
Feb 26 19:06:24.540509 osdx dnscrypt-proxy[6918]: Dropping privileges
Feb 26 19:06:24.547332 osdx OSDxCLI[1560]: User 'admin' executed a new command: 'system journal show | cat'.
Feb 26 19:06:24.549393 osdx dnscrypt-proxy[6918]: Network connectivity detected
Feb 26 19:06:24.549804 osdx dnscrypt-proxy[6918]: Now listening to 127.0.0.1:53 [UDP]
Feb 26 19:06:24.549925 osdx dnscrypt-proxy[6918]: Now listening to 127.0.0.1:53 [TCP]
Feb 26 19:06:24.550067 osdx dnscrypt-proxy[6918]: Firefox workaround initialized
Feb 26 19:06:24.550187 osdx dnscrypt-proxy[6918]: Loading the set of cloaking rules from [/tmp/tmpEEv7RL]
Feb 26 19:06:24.777528 osdx dnscrypt-proxy[6918]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Feb 26 19:06:24.777787 osdx dnscrypt-proxy[6918]: [DUT0] OK (DoH) - rtt: 119ms
Feb 26 19:06:24.777922 osdx dnscrypt-proxy[6918]: Server with the lowest initial latency: DUT0 (rtt: 119ms)
Feb 26 19:06:24.778049 osdx dnscrypt-proxy[6918]: dnscrypt-proxy is ready - live servers: 1

---