Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0:
set system certificate trust running://remote.dns-server.crt set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns proxy static RD protocol dns-over-https hash 563c4f02c5ec6eb3d02a1ff7b1e2ca38884464e5e7e227ba087ee6524ee6fbac set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns static host-name teldat.com inet 10.11.12.13
Step 2: Set the following configuration in DUT1:
set service dns static host-name dns.dut0 inet 10.215.168.10 set system certificate trust running://CA.crt set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10 set service dns proxy static DUT0 protocol dns-over-https hash d42bef8383d2ec432c95cf76db00aecef12afd76b8bf685bfedd4cd409603e06 set service dns proxy log level 0 set service dns resolver local
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
-- Logs begin at Wed 2024-04-03 21:41:13 UTC, end at Wed 2024-04-03 21:41:21 UTC. -- Apr 03 21:41:13.369743 osdx systemd-journald[568]: Runtime journal (/run/log/journal/267898f4bf544adbb4c1fc962594dcef) is 1.2M, max 9.7M, 8.5M free. Apr 03 21:41:13.382907 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'system journal clear'. Apr 03 21:41:14.694868 osdx OSDxCLI[27939]: User 'admin' entered the configuration menu. Apr 03 21:41:14.809232 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.20/24'. Apr 03 21:41:14.904011 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Apr 03 21:41:15.028751 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service ssh'. Apr 03 21:41:15.168273 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Apr 03 21:41:15.322425 osdx systemd[1]: Starting OpenBSD Secure Shell server... Apr 03 21:41:15.336187 osdx sshd[26375]: Server listening on 0.0.0.0 port 22. Apr 03 21:41:15.336598 osdx sshd[26375]: Server listening on :: port 22. Apr 03 21:41:15.336759 osdx systemd[1]: Started OpenBSD Secure Shell server. Apr 03 21:41:15.355609 osdx cfgd[976]: [27939]Completed change to active configuration Apr 03 21:41:15.399020 osdx OSDxCLI[27939]: User 'admin' committed the configuration. Apr 03 21:41:15.436448 osdx OSDxCLI[27939]: User 'admin' left the configuration menu. Apr 03 21:41:15.647585 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'ping 10.215.168.10 count 1 size 56 timeout 1'. Apr 03 21:41:18.025454 osdx OSDxCLI[27939]: User 'admin' entered the configuration menu. Apr 03 21:41:18.170398 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.10'. Apr 03 21:41:18.259400 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Apr 03 21:41:18.375516 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Apr 03 21:41:18.495866 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Apr 03 21:41:18.579319 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Apr 03 21:41:18.686195 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10'. Apr 03 21:41:18.784584 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash d42bef8383d2ec432c95cf76db00aecef12afd76b8bf685bfedd4cd409603e06'. Apr 03 21:41:18.912045 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Apr 03 21:41:19.009138 osdx OSDxCLI[27939]: User 'admin' added a new cfg line: 'set service dns resolver local'. Apr 03 21:41:19.184108 osdx ca-certificates[26440]: Updating certificates in /etc/ssl/certs... Apr 03 21:41:20.055224 osdx ca-certificates[27422]: 1 added, 0 removed; done. Apr 03 21:41:20.060933 osdx ca-certificates[27428]: Running hooks in /etc/ca-certificates/update.d... Apr 03 21:41:20.066140 osdx ca-certificates[27432]: done. Apr 03 21:41:20.203889 osdx systemd[1]: Started DNSCrypt client proxy. Apr 03 21:41:20.205824 osdx cfgd[976]: [27939]Completed change to active configuration Apr 03 21:41:20.210297 osdx OSDxCLI[27939]: User 'admin' committed the configuration. Apr 03 21:41:20.246184 osdx OSDxCLI[27939]: User 'admin' left the configuration menu. Apr 03 21:41:20.461023 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'system journal show | cat'. Apr 03 21:41:20.785683 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'system journal show | cat'. Apr 03 21:41:20.922469 osdx dnscrypt-proxy[27485]: dnscrypt-proxy 2.0.45 Apr 03 21:41:20.922889 osdx dnscrypt-proxy[27485]: Network connectivity detected Apr 03 21:41:20.923292 osdx dnscrypt-proxy[27485]: Dropping privileges Apr 03 21:41:20.925652 osdx dnscrypt-proxy[27485]: Network connectivity detected Apr 03 21:41:20.925964 osdx dnscrypt-proxy[27485]: Now listening to 127.0.0.1:53 [UDP] Apr 03 21:41:20.926054 osdx dnscrypt-proxy[27485]: Now listening to 127.0.0.1:53 [TCP] Apr 03 21:41:20.926146 osdx dnscrypt-proxy[27485]: Firefox workaround initialized Apr 03 21:41:20.926227 osdx dnscrypt-proxy[27485]: Loading the set of cloaking rules from [/tmp/tmpCVMyE8] Apr 03 21:41:21.057607 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'system journal show | cat'. Apr 03 21:41:21.280909 osdx dnscrypt-proxy[27485]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Apr 03 21:41:21.280934 osdx dnscrypt-proxy[27485]: [DUT0] OK (DoH) - rtt: 130ms Apr 03 21:41:21.280947 osdx dnscrypt-proxy[27485]: Server with the lowest initial latency: DUT0 (rtt: 130ms) Apr 03 21:41:21.280956 osdx dnscrypt-proxy[27485]: dnscrypt-proxy is ready - live servers: 1 Apr 03 21:41:21.301570 osdx OSDxCLI[27939]: User 'admin' executed a new command: 'system journal show | cat'.