Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set system certificate trust running://remote.dns-server.crt
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns proxy static RD protocol dns-over-https hash 563c4f02c5ec6eb3d02a1ff7b1e2ca38884464e5e7e227ba087ee6524ee6fbac
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns static host-name teldat.com inet 10.11.12.13

Step 2: Set the following configuration in DUT1:

set service dns static host-name dns.dut0 inet 10.215.168.64
set system certificate trust running://CA.crt
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns proxy static DUT0 protocol dns-over-https hash 781aca7090cd55c5dd9391dfcaca323ee74b2b698acf1ffe651c496df46d6a85
set service dns proxy log level 0
set service dns resolver local

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

-- Logs begin at Tue 2024-02-13 15:00:00 UTC, end at Tue 2024-02-13 15:00:11 UTC. --
Feb 13 15:00:00.512970 osdx systemd-journald[1572]: Runtime journal (/run/log/journal/7f7d8271ef4745a88013dff99dde6bbe) is 2.4M, max 9.7M, 7.3M free.
Feb 13 15:00:00.528655 osdx OSDxCLI[1768]: User 'admin' executed a new command: 'system journal clear'.
Feb 13 15:00:01.532813 osdx osdx-coredump[22803]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Feb 13 15:00:01.540995 osdx OSDxCLI[1768]: User 'admin' executed a new command: 'system coredump delete all'.
Feb 13 15:00:03.371286 osdx OSDxCLI[1768]: User 'admin' entered the configuration menu.
Feb 13 15:00:03.547934 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Feb 13 15:00:03.680436 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Feb 13 15:00:03.822031 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service ssh'.
Feb 13 15:00:04.016249 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Feb 13 15:00:04.207147 osdx systemd[1]: Starting OpenBSD Secure Shell server...
Feb 13 15:00:04.225598 osdx sshd[22900]: Server listening on 0.0.0.0 port 22.
Feb 13 15:00:04.225966 osdx sshd[22900]: Server listening on :: port 22.
Feb 13 15:00:04.226174 osdx systemd[1]: Started OpenBSD Secure Shell server.
Feb 13 15:00:04.250879 osdx cfgd[1203]: [1768]Completed change to active configuration
Feb 13 15:00:04.307237 osdx OSDxCLI[1768]: User 'admin' committed the configuration.
Feb 13 15:00:04.347854 osdx OSDxCLI[1768]: User 'admin' left the configuration menu.
Feb 13 15:00:04.535516 osdx OSDxCLI[1768]: User 'admin' executed a new command: 'ping 10.215.168.64      count 1 size 56 timeout 1'.
Feb 13 15:00:07.721137 osdx OSDxCLI[1768]: User 'admin' entered the configuration menu.
Feb 13 15:00:07.898620 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Feb 13 15:00:08.140164 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Feb 13 15:00:08.385880 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Feb 13 15:00:08.594112 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Feb 13 15:00:08.821429 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Feb 13 15:00:09.043177 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Feb 13 15:00:09.247777 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 781aca7090cd55c5dd9391dfcaca323ee74b2b698acf1ffe651c496df46d6a85'.
Feb 13 15:00:09.449737 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Feb 13 15:00:09.629609 osdx OSDxCLI[1768]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Feb 13 15:00:09.809585 osdx ca-certificates[22965]: Updating certificates in /etc/ssl/certs...
Feb 13 15:00:10.517028 osdx ca-certificates[23949]: 1 added, 0 removed; done.
Feb 13 15:00:10.522969 osdx ca-certificates[23953]: Running hooks in /etc/ca-certificates/update.d...
Feb 13 15:00:10.528237 osdx ca-certificates[23957]: done.
Feb 13 15:00:10.694866 osdx systemd[1]: Started DNSCrypt client proxy.
Feb 13 15:00:10.697655 osdx cfgd[1203]: [1768]Completed change to active configuration
Feb 13 15:00:10.705762 osdx OSDxCLI[1768]: User 'admin' committed the configuration.
Feb 13 15:00:10.723470 osdx dnscrypt-proxy[24010]: dnscrypt-proxy 2.0.45
Feb 13 15:00:10.723878 osdx dnscrypt-proxy[24010]: Network connectivity detected
Feb 13 15:00:10.724484 osdx dnscrypt-proxy[24010]: Dropping privileges
Feb 13 15:00:10.730680 osdx OSDxCLI[1768]: User 'admin' left the configuration menu.
Feb 13 15:00:10.731803 osdx dnscrypt-proxy[24010]: Network connectivity detected
Feb 13 15:00:10.732124 osdx dnscrypt-proxy[24010]: Now listening to 127.0.0.1:53 [UDP]
Feb 13 15:00:10.732238 osdx dnscrypt-proxy[24010]: Now listening to 127.0.0.1:53 [TCP]
Feb 13 15:00:10.732366 osdx dnscrypt-proxy[24010]: Firefox workaround initialized
Feb 13 15:00:10.732470 osdx dnscrypt-proxy[24010]: Loading the set of cloaking rules from [/tmp/tmp1h2PFJ]
Feb 13 15:00:10.961341 osdx OSDxCLI[1768]: User 'admin' executed a new command: 'system journal show | cat'.
Feb 13 15:00:11.261918 osdx OSDxCLI[1768]: User 'admin' executed a new command: 'system journal show | cat'.
Feb 13 15:00:11.309617 osdx dnscrypt-proxy[24010]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Feb 13 15:00:11.309635 osdx dnscrypt-proxy[24010]: [DUT0] OK (DoH) - rtt: 508ms
Feb 13 15:00:11.309645 osdx dnscrypt-proxy[24010]: Server with the lowest initial latency: DUT0 (rtt: 508ms)
Feb 13 15:00:11.309652 osdx dnscrypt-proxy[24010]: dnscrypt-proxy is ready - live servers: 1

---