Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set system certificate trust running://remote.dns-server.crt
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns proxy static RD protocol dns-over-https hash 171e241c983e5338d0576e20b4a1cb028529a8b59a18a90702379e01bd2a26af
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns static host-name teldat.com inet 10.11.12.13

Step 2: Set the following configuration in DUT1:

set service dns static host-name dns.dut0 inet 10.215.168.10
set system certificate trust running://CA.crt
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10
set service dns proxy static DUT0 protocol dns-over-https hash 384eca0ca946b0bb7b88b367be78de53a8bdb7a32efbdb96e44ea6122321e8bf
set service dns proxy log level 0
set service dns resolver local

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

-- Logs begin at Tue 2024-04-23 16:44:08 UTC, end at Tue 2024-04-23 16:44:12 UTC. --
Apr 23 16:44:08.238516 osdx systemd-journald[562]: Runtime journal (/run/log/journal/d4e47729ada341c793dfbfab0a48290e) is 1.2M, max 9.7M, 8.5M free.
Apr 23 16:44:08.246499 osdx OSDxCLI[1593]: User 'admin' executed a new command: 'system journal clear'.
Apr 23 16:44:09.057937 osdx OSDxCLI[1593]: User 'admin' entered the configuration menu.
Apr 23 16:44:09.114418 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.20/24'.
Apr 23 16:44:09.203674 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Apr 23 16:44:09.248224 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service ssh'.
Apr 23 16:44:09.381221 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Apr 23 16:44:09.505260 osdx systemd[1]: Starting OpenBSD Secure Shell server...
Apr 23 16:44:09.514566 osdx sshd[20015]: Server listening on 0.0.0.0 port 22.
Apr 23 16:44:09.514816 osdx sshd[20015]: Server listening on :: port 22.
Apr 23 16:44:09.514924 osdx systemd[1]: Started OpenBSD Secure Shell server.
Apr 23 16:44:09.531051 osdx cfgd[1178]: [1593]Completed change to active configuration
Apr 23 16:44:09.562766 osdx OSDxCLI[1593]: User 'admin' committed the configuration.
Apr 23 16:44:09.580277 osdx OSDxCLI[1593]: User 'admin' left the configuration menu.
Apr 23 16:44:09.717881 osdx OSDxCLI[1593]: User 'admin' executed a new command: 'ping 10.215.168.10      count 1 size 56 timeout 1'.
Apr 23 16:44:11.126155 osdx OSDxCLI[1593]: User 'admin' entered the configuration menu.
Apr 23 16:44:11.179241 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.10'.
Apr 23 16:44:11.273846 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Apr 23 16:44:11.325135 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Apr 23 16:44:11.420839 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Apr 23 16:44:11.471242 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Apr 23 16:44:11.564073 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.10'.
Apr 23 16:44:11.617434 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 384eca0ca946b0bb7b88b367be78de53a8bdb7a32efbdb96e44ea6122321e8bf'.
Apr 23 16:44:11.708823 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Apr 23 16:44:11.765846 osdx OSDxCLI[1593]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Apr 23 16:44:11.888202 osdx ca-certificates[20080]: Updating certificates in /etc/ssl/certs...
Apr 23 16:44:12.355006 osdx ca-certificates[21062]: 1 added, 0 removed; done.
Apr 23 16:44:12.358996 osdx ca-certificates[21067]: Running hooks in /etc/ca-certificates/update.d...
Apr 23 16:44:12.362666 osdx ca-certificates[21071]: done.
Apr 23 16:44:12.454302 osdx systemd[1]: Started DNSCrypt client proxy.
Apr 23 16:44:12.455596 osdx cfgd[1178]: [1593]Completed change to active configuration
Apr 23 16:44:12.458893 osdx OSDxCLI[1593]: User 'admin' committed the configuration.
Apr 23 16:44:12.474434 osdx OSDxCLI[1593]: User 'admin' left the configuration menu.
Apr 23 16:44:12.674342 osdx OSDxCLI[1593]: User 'admin' executed a new command: 'system journal show | cat'.
Apr 23 16:44:12.684286 osdx dnscrypt-proxy[21125]: dnscrypt-proxy 2.0.45
Apr 23 16:44:12.684555 osdx dnscrypt-proxy[21125]: Network connectivity detected
Apr 23 16:44:12.684860 osdx dnscrypt-proxy[21125]: Dropping privileges
Apr 23 16:44:12.686583 osdx dnscrypt-proxy[21125]: Network connectivity detected
Apr 23 16:44:12.686788 osdx dnscrypt-proxy[21125]: Now listening to 127.0.0.1:53 [UDP]
Apr 23 16:44:12.686834 osdx dnscrypt-proxy[21125]: Now listening to 127.0.0.1:53 [TCP]
Apr 23 16:44:12.686883 osdx dnscrypt-proxy[21125]: Firefox workaround initialized
Apr 23 16:44:12.686921 osdx dnscrypt-proxy[21125]: Loading the set of cloaking rules from [/tmp/tmpkS1P1p]
Apr 23 16:44:12.861370 osdx OSDxCLI[1593]: User 'admin' executed a new command: 'system journal show | cat'.
Apr 23 16:44:12.970332 osdx dnscrypt-proxy[21125]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Apr 23 16:44:12.970344 osdx dnscrypt-proxy[21125]: [DUT0] OK (DoH) - rtt: 132ms
Apr 23 16:44:12.970352 osdx dnscrypt-proxy[21125]: Server with the lowest initial latency: DUT0 (rtt: 132ms)
Apr 23 16:44:12.970356 osdx dnscrypt-proxy[21125]: dnscrypt-proxy is ready - live servers: 1

---