Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set system certificate trust running://remote.dns-server.crt
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns proxy static RD protocol dns-over-https hash f8bc50bc5ac15ce0f76e30e6a004a073889a788f693866f15b90a61d26d26c4f
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns static host-name teldat.com inet 10.11.12.13

Step 2: Set the following configuration in DUT1:

set service dns static host-name dns.dut0 inet 10.215.168.64
set system certificate trust running://CA.crt
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns proxy static DUT0 protocol dns-over-https hash 5f737cb729268d5663998a977d65b512c53d89c12b0cf55fdc5c9602d67a2f42
set service dns proxy log level 0
set service dns resolver local

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

-- Logs begin at Thu 2024-10-10 07:15:21 UTC, end at Thu 2024-10-10 07:15:26 UTC. --
Oct 10 07:15:21.286994 osdx systemd-journald[1558]: Runtime journal (/run/log/journal/03399a58c21647ee8e0fe05f3adcf81f) is 1.2M, max 9.7M, 8.5M free.
Oct 10 07:15:21.296442 osdx OSDxCLI[1741]: User 'admin' executed a new command: 'system journal clear'.
Oct 10 07:15:21.820970 osdx osdx-coredump[25679]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Oct 10 07:15:21.826882 osdx OSDxCLI[1741]: User 'admin' executed a new command: 'system coredump delete all'.
Oct 10 07:15:22.773459 osdx OSDxCLI[1741]: User 'admin' entered the configuration menu.
Oct 10 07:15:22.863517 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Oct 10 07:15:22.949473 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Oct 10 07:15:22.999142 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service ssh'.
Oct 10 07:15:23.124337 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Oct 10 07:15:23.216434 osdx systemd[1]: Starting OpenBSD Secure Shell server...
Oct 10 07:15:23.224885 osdx sshd[25752]: Server listening on 0.0.0.0 port 22.
Oct 10 07:15:23.225070 osdx sshd[25752]: Server listening on :: port 22.
Oct 10 07:15:23.225165 osdx systemd[1]: Started OpenBSD Secure Shell server.
Oct 10 07:15:23.237266 osdx cfgd[1202]: [1741]Completed change to active configuration
Oct 10 07:15:23.262098 osdx OSDxCLI[1741]: User 'admin' committed the configuration.
Oct 10 07:15:23.276649 osdx OSDxCLI[1741]: User 'admin' left the configuration menu.
Oct 10 07:15:23.413087 osdx OSDxCLI[1741]: User 'admin' executed a new command: 'ping 10.215.168.64      count 1 size 56 timeout 1'.
Oct 10 07:15:24.945513 osdx OSDxCLI[1741]: User 'admin' entered the configuration menu.
Oct 10 07:15:25.008100 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Oct 10 07:15:25.090521 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Oct 10 07:15:25.163433 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Oct 10 07:15:25.235716 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Oct 10 07:15:25.315053 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Oct 10 07:15:25.374586 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Oct 10 07:15:25.472651 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 5f737cb729268d5663998a977d65b512c53d89c12b0cf55fdc5c9602d67a2f42'.
Oct 10 07:15:25.526473 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Oct 10 07:15:25.620956 osdx OSDxCLI[1741]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Oct 10 07:15:25.717554 osdx ca-certificates[25817]: Updating certificates in /etc/ssl/certs...
Oct 10 07:15:26.158256 osdx ca-certificates[26800]: 1 added, 0 removed; done.
Oct 10 07:15:26.162400 osdx ca-certificates[26805]: Running hooks in /etc/ca-certificates/update.d...
Oct 10 07:15:26.166135 osdx ca-certificates[26809]: done.
Oct 10 07:15:26.255571 osdx systemd[1]: Started DNSCrypt client proxy.
Oct 10 07:15:26.257359 osdx cfgd[1202]: [1741]Completed change to active configuration
Oct 10 07:15:26.260417 osdx OSDxCLI[1741]: User 'admin' committed the configuration.
Oct 10 07:15:26.280694 osdx OSDxCLI[1741]: User 'admin' left the configuration menu.
Oct 10 07:15:26.471664 osdx OSDxCLI[1741]: User 'admin' executed a new command: 'system journal show | cat'.
Oct 10 07:15:26.495042 osdx dnscrypt-proxy[26863]: dnscrypt-proxy 2.0.45
Oct 10 07:15:26.495374 osdx dnscrypt-proxy[26863]: Network connectivity detected
Oct 10 07:15:26.495684 osdx dnscrypt-proxy[26863]: Dropping privileges
Oct 10 07:15:26.497540 osdx dnscrypt-proxy[26863]: Network connectivity detected
Oct 10 07:15:26.497769 osdx dnscrypt-proxy[26863]: Now listening to 127.0.0.1:53 [UDP]
Oct 10 07:15:26.497820 osdx dnscrypt-proxy[26863]: Now listening to 127.0.0.1:53 [TCP]
Oct 10 07:15:26.497869 osdx dnscrypt-proxy[26863]: Firefox workaround initialized
Oct 10 07:15:26.497910 osdx dnscrypt-proxy[26863]: Loading the set of cloaking rules from [/tmp/tmpVqUGg6]
Oct 10 07:15:26.666799 osdx OSDxCLI[1741]: User 'admin' executed a new command: 'system journal show | cat'.
Oct 10 07:15:26.684029 osdx dnscrypt-proxy[26863]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Oct 10 07:15:26.684048 osdx dnscrypt-proxy[26863]: [DUT0] OK (DoH) - rtt: 121ms
Oct 10 07:15:26.684059 osdx dnscrypt-proxy[26863]: Server with the lowest initial latency: DUT0 (rtt: 121ms)
Oct 10 07:15:26.684067 osdx dnscrypt-proxy[26863]: dnscrypt-proxy is ready - live servers: 1

---