Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set system certificate trust running://certs/remote.dns-server.crt
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns proxy static RD protocol dns-over-https hash 029f30c34b083de26ae4e176db2577cb64913132c357003e2fa24228571c3b1d
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns static host-name teldat.com inet 10.11.12.13

Step 2: Set the following configuration in DUT1:

set service dns static host-name dns.dut0 inet 10.215.168.10
set system certificate trust running://CA.crt
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10
set service dns proxy static DUT0 protocol dns-over-https hash 0d3badbe6014bb87706b0ca453b10663e5e6cde840ea26b5b627926b72aeff7f
set service dns proxy log level 0
set service dns resolver local

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

-- Logs begin at Mon 2023-10-30 11:31:49 UTC, end at Mon 2023-10-30 11:31:56 UTC. --
Oct 30 11:31:49.373316 osdx systemd-journald[566]: Runtime journal (/run/log/journal/b16522e0298c413ba26ddcc8854c154b) is 1.2M, max 9.7M, 8.5M free.
Oct 30 11:31:49.386291 osdx OSDxCLI[1396]: User 'admin' executed a new command: 'system journal clear'.
Oct 30 11:31:50.556472 osdx OSDxCLI[1396]: User 'admin' entered the configuration menu.
Oct 30 11:31:50.680164 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.20/24'.
Oct 30 11:31:50.775574 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Oct 30 11:31:50.861051 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service ssh'.
Oct 30 11:31:51.025013 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Oct 30 11:31:51.214939 osdx systemd[1]: Starting OpenBSD Secure Shell server...
Oct 30 11:31:51.229160 osdx sshd[25170]: Server listening on 0.0.0.0 port 22.
Oct 30 11:31:51.229471 osdx sshd[25170]: Server listening on :: port 22.
Oct 30 11:31:51.229634 osdx systemd[1]: Started OpenBSD Secure Shell server.
Oct 30 11:31:51.251678 osdx cfgd[983]: [1396]Completed change to active configuration
Oct 30 11:31:51.300784 osdx OSDxCLI[1396]: User 'admin' committed the configuration.
Oct 30 11:31:51.327968 osdx OSDxCLI[1396]: User 'admin' left the configuration menu.
Oct 30 11:31:51.510230 osdx OSDxCLI[1396]: User 'admin' executed a new command: 'ping 10.215.168.10      count 1 size 56 timeout 1'.
Oct 30 11:31:53.922863 osdx OSDxCLI[1396]: User 'admin' entered the configuration menu.
Oct 30 11:31:54.034566 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.10'.
Oct 30 11:31:54.163155 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Oct 30 11:31:54.371042 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Oct 30 11:31:54.482992 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Oct 30 11:31:54.603057 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Oct 30 11:31:54.722375 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10'.
Oct 30 11:31:54.824827 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 0d3badbe6014bb87706b0ca453b10663e5e6cde840ea26b5b627926b72aeff7f'.
Oct 30 11:31:54.908073 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Oct 30 11:31:54.998737 osdx OSDxCLI[1396]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Oct 30 11:31:55.127127 osdx ca-certificates[25235]: Updating certificates in /etc/ssl/certs...
Oct 30 11:31:55.816733 osdx ca-certificates[26219]: 1 added, 0 removed; done.
Oct 30 11:31:55.823902 osdx ca-certificates[26223]: Running hooks in /etc/ca-certificates/update.d...
Oct 30 11:31:55.831940 osdx ca-certificates[26227]: done.
Oct 30 11:31:55.991308 osdx systemd[1]: Started DNSCrypt client proxy.
Oct 30 11:31:55.994048 osdx cfgd[983]: [1396]Completed change to active configuration
Oct 30 11:31:55.998172 osdx OSDxCLI[1396]: User 'admin' committed the configuration.
Oct 30 11:31:56.030398 osdx dnscrypt-proxy[26280]: dnscrypt-proxy 2.0.45
Oct 30 11:31:56.030940 osdx dnscrypt-proxy[26280]: Network connectivity detected
Oct 30 11:31:56.031673 osdx dnscrypt-proxy[26280]: Dropping privileges
Oct 30 11:31:56.035254 osdx dnscrypt-proxy[26280]: Network connectivity detected
Oct 30 11:31:56.035695 osdx dnscrypt-proxy[26280]: Now listening to 127.0.0.1:53 [UDP]
Oct 30 11:31:56.035833 osdx dnscrypt-proxy[26280]: Now listening to 127.0.0.1:53 [TCP]
Oct 30 11:31:56.035978 osdx dnscrypt-proxy[26280]: Firefox workaround initialized
Oct 30 11:31:56.036102 osdx dnscrypt-proxy[26280]: Loading the set of cloaking rules from [/tmp/tmptPM4Vf]
Oct 30 11:31:56.040331 osdx OSDxCLI[1396]: User 'admin' left the configuration menu.
Oct 30 11:31:56.230484 osdx OSDxCLI[1396]: User 'admin' executed a new command: 'system journal show | cat'.
Oct 30 11:31:56.270393 osdx dnscrypt-proxy[26280]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Oct 30 11:31:56.270418 osdx dnscrypt-proxy[26280]: [DUT0] OK (DoH) - rtt: 159ms
Oct 30 11:31:56.270431 osdx dnscrypt-proxy[26280]: Server with the lowest initial latency: DUT0 (rtt: 159ms)
Oct 30 11:31:56.270440 osdx dnscrypt-proxy[26280]: dnscrypt-proxy is ready - live servers: 1

---