Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0:
set system certificate trust running://remote.dns-server.crt set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns proxy static RD protocol dns-over-https hash ec4467518bda940b10464a7630c570e7717035cc032e5ae3bec7c4f937f00d8e set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns static host-name teldat.com inet 10.11.12.13
Step 2: Set the following configuration in DUT1:
set service dns static host-name dns.dut0 inet 10.215.168.64 set system certificate trust running://CA.crt set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns proxy static DUT0 protocol dns-over-https hash 6df814c10daac8c0ab632ce0f7d811f1a6f5f5a0711323212772473fd542b7f0 set service dns proxy log level 0 set service dns resolver local
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
-- Logs begin at Mon 2024-06-24 12:27:17 UTC, end at Mon 2024-06-24 12:27:25 UTC. -- Jun 24 12:27:17.396806 osdx systemd-journald[1367]: Runtime journal (/run/log/journal/049b8f2538614231939f1117c2f6fd80) is 1.2M, max 9.7M, 8.5M free. Jun 24 12:27:17.416446 osdx OSDxCLI[1483]: User 'admin' executed a new command: 'system journal clear'. Jun 24 12:27:18.370523 osdx osdx-coredump[30744]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Jun 24 12:27:18.378324 osdx OSDxCLI[1483]: User 'admin' executed a new command: 'system coredump delete all'. Jun 24 12:27:19.831489 osdx OSDxCLI[1483]: User 'admin' entered the configuration menu. Jun 24 12:27:19.988703 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jun 24 12:27:20.091498 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jun 24 12:27:20.205741 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service ssh'. Jun 24 12:27:20.371666 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jun 24 12:27:20.545328 osdx systemd[1]: Starting OpenBSD Secure Shell server... Jun 24 12:27:20.560857 osdx sshd[30817]: Server listening on 0.0.0.0 port 22. Jun 24 12:27:20.561244 osdx sshd[30817]: Server listening on :: port 22. Jun 24 12:27:20.561442 osdx systemd[1]: Started OpenBSD Secure Shell server. Jun 24 12:27:20.586432 osdx cfgd[1004]: [1483]Completed change to active configuration Jun 24 12:27:20.628878 osdx OSDxCLI[1483]: User 'admin' committed the configuration. Jun 24 12:27:20.659980 osdx OSDxCLI[1483]: User 'admin' left the configuration menu. Jun 24 12:27:20.831802 osdx OSDxCLI[1483]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jun 24 12:27:23.224155 osdx OSDxCLI[1483]: User 'admin' entered the configuration menu. Jun 24 12:27:23.343659 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jun 24 12:27:23.426085 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jun 24 12:27:23.540703 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jun 24 12:27:23.652217 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Jun 24 12:27:23.744132 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Jun 24 12:27:23.830449 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Jun 24 12:27:23.948945 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 6df814c10daac8c0ab632ce0f7d811f1a6f5f5a0711323212772473fd542b7f0'. Jun 24 12:27:24.021898 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Jun 24 12:27:24.133686 osdx OSDxCLI[1483]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jun 24 12:27:24.270046 osdx ca-certificates[30882]: Updating certificates in /etc/ssl/certs... Jun 24 12:27:24.943466 osdx ca-certificates[31866]: 1 added, 0 removed; done. Jun 24 12:27:24.949457 osdx ca-certificates[31870]: Running hooks in /etc/ca-certificates/update.d... Jun 24 12:27:24.954605 osdx ca-certificates[31874]: done. Jun 24 12:27:25.081190 osdx systemd[1]: Started DNSCrypt client proxy. Jun 24 12:27:25.083912 osdx cfgd[1004]: [1483]Completed change to active configuration Jun 24 12:27:25.088207 osdx OSDxCLI[1483]: User 'admin' committed the configuration. Jun 24 12:27:25.109512 osdx dnscrypt-proxy[31927]: dnscrypt-proxy 2.0.45 Jun 24 12:27:25.109895 osdx dnscrypt-proxy[31927]: Network connectivity detected Jun 24 12:27:25.110462 osdx dnscrypt-proxy[31927]: Dropping privileges Jun 24 12:27:25.112712 osdx dnscrypt-proxy[31927]: Network connectivity detected Jun 24 12:27:25.112997 osdx dnscrypt-proxy[31927]: Now listening to 127.0.0.1:53 [UDP] Jun 24 12:27:25.113088 osdx dnscrypt-proxy[31927]: Now listening to 127.0.0.1:53 [TCP] Jun 24 12:27:25.113183 osdx dnscrypt-proxy[31927]: Firefox workaround initialized Jun 24 12:27:25.113265 osdx dnscrypt-proxy[31927]: Loading the set of cloaking rules from [/tmp/tmpdCKjfL] Jun 24 12:27:25.119584 osdx OSDxCLI[1483]: User 'admin' left the configuration menu. Jun 24 12:27:25.311663 osdx dnscrypt-proxy[31927]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Jun 24 12:27:25.311687 osdx dnscrypt-proxy[31927]: [DUT0] OK (DoH) - rtt: 124ms Jun 24 12:27:25.311699 osdx dnscrypt-proxy[31927]: Server with the lowest initial latency: DUT0 (rtt: 124ms) Jun 24 12:27:25.311707 osdx dnscrypt-proxy[31927]: dnscrypt-proxy is ready - live servers: 1 Jun 24 12:27:25.314659 osdx OSDxCLI[1483]: User 'admin' executed a new command: 'system journal show | cat'.