Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0:
set system certificate trust running://remote.dns-server.crt set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns proxy static RD protocol dns-over-https hash 3c15e90bd022a1619161d18b235841fbb951fd9251cbf16baaf9244baed3a840 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns static host-name teldat.com inet 10.11.12.13
Step 2: Set the following configuration in DUT1:
set service dns static host-name dns.dut0 inet 10.215.168.64 set system certificate trust running://CA.crt set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns proxy static DUT0 protocol dns-over-https hash 371ab4531a86cdb3fddfa1774824a8b27922cf7857f73ea4f01dd59c7f2f4fff set service dns proxy log level 0 set service dns resolver local
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
-- Logs begin at Mon 2024-12-02 20:16:36 UTC, end at Mon 2024-12-02 20:16:45 UTC. -- Dec 02 20:16:36.457314 osdx systemd-journald[1404]: Runtime journal (/run/log/journal/ab253656914a476e9961f9c5e382e7a7) is 1.2M, max 9.7M, 8.5M free. Dec 02 20:16:36.479864 osdx OSDxCLI[2173]: User 'admin' executed a new command: 'system journal clear'. Dec 02 20:16:37.609480 osdx osdx-coredump[17740]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Dec 02 20:16:37.619869 osdx OSDxCLI[2173]: User 'admin' executed a new command: 'system coredump delete all'. Dec 02 20:16:39.411548 osdx OSDxCLI[2173]: User 'admin' entered the configuration menu. Dec 02 20:16:39.554362 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Dec 02 20:16:39.666433 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Dec 02 20:16:39.793162 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service ssh'. Dec 02 20:16:39.991219 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Dec 02 20:16:40.282341 osdx systemd[1]: Starting OpenBSD Secure Shell server... Dec 02 20:16:40.300074 osdx sshd[17838]: Server listening on 0.0.0.0 port 22. Dec 02 20:16:40.300423 osdx sshd[17838]: Server listening on :: port 22. Dec 02 20:16:40.300647 osdx systemd[1]: Started OpenBSD Secure Shell server. Dec 02 20:16:40.323815 osdx cfgd[1031]: [2173]Completed change to active configuration Dec 02 20:16:40.385951 osdx OSDxCLI[2173]: User 'admin' committed the configuration. Dec 02 20:16:40.430407 osdx OSDxCLI[2173]: User 'admin' left the configuration menu. Dec 02 20:16:40.657579 osdx OSDxCLI[2173]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Dec 02 20:16:43.411199 osdx OSDxCLI[2173]: User 'admin' entered the configuration menu. Dec 02 20:16:43.546548 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Dec 02 20:16:43.657429 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Dec 02 20:16:43.764756 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Dec 02 20:16:43.923069 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Dec 02 20:16:44.024800 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Dec 02 20:16:44.177437 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Dec 02 20:16:44.323819 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 371ab4531a86cdb3fddfa1774824a8b27922cf7857f73ea4f01dd59c7f2f4fff'. Dec 02 20:16:44.440878 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Dec 02 20:16:44.569553 osdx OSDxCLI[2173]: User 'admin' added a new cfg line: 'set service dns resolver local'. Dec 02 20:16:44.729457 osdx ca-certificates[17903]: Updating certificates in /etc/ssl/certs... Dec 02 20:16:45.483447 osdx ca-certificates[18890]: 1 added, 0 removed; done. Dec 02 20:16:45.489599 osdx ca-certificates[18897]: Running hooks in /etc/ca-certificates/update.d... Dec 02 20:16:45.495929 osdx ca-certificates[18899]: done. Dec 02 20:16:45.678015 osdx systemd[1]: Started DNSCrypt client proxy. Dec 02 20:16:45.681324 osdx cfgd[1031]: [2173]Completed change to active configuration Dec 02 20:16:45.691003 osdx OSDxCLI[2173]: User 'admin' committed the configuration. Dec 02 20:16:45.705749 osdx dnscrypt-proxy[18950]: dnscrypt-proxy 2.0.45 Dec 02 20:16:45.705845 osdx dnscrypt-proxy[18950]: Network connectivity detected Dec 02 20:16:45.706308 osdx dnscrypt-proxy[18950]: Dropping privileges Dec 02 20:16:45.709871 osdx dnscrypt-proxy[18950]: Network connectivity detected Dec 02 20:16:45.710213 osdx dnscrypt-proxy[18950]: Now listening to 127.0.0.1:53 [UDP] Dec 02 20:16:45.710302 osdx dnscrypt-proxy[18950]: Now listening to 127.0.0.1:53 [TCP] Dec 02 20:16:45.710425 osdx dnscrypt-proxy[18950]: Firefox workaround initialized Dec 02 20:16:45.710509 osdx dnscrypt-proxy[18950]: Loading the set of cloaking rules from [/tmp/tmpThCnYU] Dec 02 20:16:45.726551 osdx OSDxCLI[2173]: User 'admin' left the configuration menu. Dec 02 20:16:45.935085 osdx dnscrypt-proxy[18950]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Dec 02 20:16:45.935110 osdx dnscrypt-proxy[18950]: [DUT0] OK (DoH) - rtt: 122ms Dec 02 20:16:45.935123 osdx dnscrypt-proxy[18950]: Server with the lowest initial latency: DUT0 (rtt: 122ms) Dec 02 20:16:45.935132 osdx dnscrypt-proxy[18950]: dnscrypt-proxy is ready - live servers: 1 Dec 02 20:16:45.940068 osdx OSDxCLI[2173]: User 'admin' executed a new command: 'system journal show | cat'.