Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0:
set system certificate trust running://remote.dns-server.crt set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns proxy static RD protocol dns-over-https hash ec4467518bda940b10464a7630c570e7717035cc032e5ae3bec7c4f937f00d8e set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns static host-name teldat.com inet 10.11.12.13
Step 2: Set the following configuration in DUT1:
set service dns static host-name dns.dut0 inet 10.215.168.64 set system certificate trust running://CA.crt set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns proxy static DUT0 protocol dns-over-https hash 9a327b60951dd8929ebf0fd92abf1750d713153db8c17bf83b6492e588247c8a set service dns proxy log level 0 set service dns resolver local
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
-- Logs begin at Thu 2024-06-20 17:45:26 UTC, end at Thu 2024-06-20 17:45:35 UTC. -- Jun 20 17:45:26.474093 osdx systemd-journald[1579]: Runtime journal (/run/log/journal/d2ff267f764c4c0d91552e08315d2756) is 1.2M, max 9.7M, 8.5M free. Jun 20 17:45:26.493451 osdx OSDxCLI[1761]: User 'admin' executed a new command: 'system journal clear'. Jun 20 17:45:27.488902 osdx osdx-coredump[16730]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Jun 20 17:45:27.500040 osdx OSDxCLI[1761]: User 'admin' executed a new command: 'system coredump delete all'. Jun 20 17:45:29.153403 osdx OSDxCLI[1761]: User 'admin' entered the configuration menu. Jun 20 17:45:29.258447 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jun 20 17:45:29.348696 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jun 20 17:45:29.435159 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service ssh'. Jun 20 17:45:29.605952 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jun 20 17:45:29.746046 osdx systemd[1]: Starting OpenBSD Secure Shell server... Jun 20 17:45:29.760127 osdx sshd[16803]: Server listening on 0.0.0.0 port 22. Jun 20 17:45:29.760424 osdx sshd[16803]: Server listening on :: port 22. Jun 20 17:45:29.760589 osdx systemd[1]: Started OpenBSD Secure Shell server. Jun 20 17:45:29.779821 osdx cfgd[1210]: [1761]Completed change to active configuration Jun 20 17:45:29.817210 osdx OSDxCLI[1761]: User 'admin' committed the configuration. Jun 20 17:45:29.841995 osdx OSDxCLI[1761]: User 'admin' left the configuration menu. Jun 20 17:45:30.037637 osdx OSDxCLI[1761]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jun 20 17:45:32.454696 osdx OSDxCLI[1761]: User 'admin' entered the configuration menu. Jun 20 17:45:32.755388 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jun 20 17:45:32.851615 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jun 20 17:45:32.976598 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jun 20 17:45:33.131567 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Jun 20 17:45:33.231371 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Jun 20 17:45:33.351644 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Jun 20 17:45:33.481941 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 9a327b60951dd8929ebf0fd92abf1750d713153db8c17bf83b6492e588247c8a'. Jun 20 17:45:33.591099 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Jun 20 17:45:33.713194 osdx OSDxCLI[1761]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jun 20 17:45:33.875703 osdx ca-certificates[16868]: Updating certificates in /etc/ssl/certs... Jun 20 17:45:34.612797 osdx ca-certificates[17853]: 1 added, 0 removed; done. Jun 20 17:45:34.619506 osdx ca-certificates[17857]: Running hooks in /etc/ca-certificates/update.d... Jun 20 17:45:34.625091 osdx ca-certificates[17861]: done. Jun 20 17:45:34.765030 osdx systemd[1]: Started DNSCrypt client proxy. Jun 20 17:45:34.767809 osdx cfgd[1210]: [1761]Completed change to active configuration Jun 20 17:45:34.772180 osdx OSDxCLI[1761]: User 'admin' committed the configuration. Jun 20 17:45:34.794789 osdx dnscrypt-proxy[17914]: dnscrypt-proxy 2.0.45 Jun 20 17:45:34.795173 osdx dnscrypt-proxy[17914]: Network connectivity detected Jun 20 17:45:34.795670 osdx dnscrypt-proxy[17914]: Dropping privileges Jun 20 17:45:34.798092 osdx dnscrypt-proxy[17914]: Network connectivity detected Jun 20 17:45:34.798392 osdx dnscrypt-proxy[17914]: Now listening to 127.0.0.1:53 [UDP] Jun 20 17:45:34.798487 osdx dnscrypt-proxy[17914]: Now listening to 127.0.0.1:53 [TCP] Jun 20 17:45:34.798612 osdx dnscrypt-proxy[17914]: Firefox workaround initialized Jun 20 17:45:34.798709 osdx dnscrypt-proxy[17914]: Loading the set of cloaking rules from [/tmp/tmpbf_oCO] Jun 20 17:45:34.818151 osdx OSDxCLI[1761]: User 'admin' left the configuration menu. Jun 20 17:45:35.015448 osdx dnscrypt-proxy[17914]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Jun 20 17:45:35.015473 osdx dnscrypt-proxy[17914]: [DUT0] OK (DoH) - rtt: 121ms Jun 20 17:45:35.015486 osdx dnscrypt-proxy[17914]: Server with the lowest initial latency: DUT0 (rtt: 121ms) Jun 20 17:45:35.015496 osdx dnscrypt-proxy[17914]: dnscrypt-proxy is ready - live servers: 1 Jun 20 17:45:35.035219 osdx OSDxCLI[1761]: User 'admin' executed a new command: 'system journal show | cat'.