Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 20cbb339f943b7564dfff33f0d2ef3d34de1e142130cc6df36ef782f2bd85194
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1:

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash c37ed0fd5c36397db24cc6fc47abbba6f93d3c4d886dd8811cfbc2c93fcdb674
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Dec 03 13:17:20.420236 osdx systemd-journald[1705]: Runtime Journal (/run/log/journal/7b9b4b4f707a49f795f87bcc6955a259) is 1.2M, max 9.7M, 8.4M free.
Dec 03 13:17:20.423772 osdx systemd-journald[1705]: Received client request to rotate journal, rotating.
Dec 03 13:17:20.423829 osdx systemd-journald[1705]: Vacuuming done, freed 0B of archived journals from /run/log/journal/7b9b4b4f707a49f795f87bcc6955a259.
Dec 03 13:17:20.429935 osdx OSDxCLI[1924]: User 'admin' executed a new command: 'system journal clear'.
Dec 03 13:17:20.924815 osdx osdx-coredump[37439]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Dec 03 13:17:20.932774 osdx OSDxCLI[1924]: User 'admin' executed a new command: 'system coredump delete all'.
Dec 03 13:17:22.178607 osdx OSDxCLI[1924]: User 'admin' entered the configuration menu.
Dec 03 13:17:22.251761 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Dec 03 13:17:22.345661 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Dec 03 13:17:22.405700 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service ssh'.
Dec 03 13:17:22.538273 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'show working'.
Dec 03 13:17:22.659788 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Dec 03 13:17:22.884085 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Dec 03 13:17:22.899123 osdx sshd[37532]: Server listening on 0.0.0.0 port 22.
Dec 03 13:17:22.899370 osdx sshd[37532]: Server listening on :: port 22.
Dec 03 13:17:22.899509 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Dec 03 13:17:22.921327 osdx cfgd[1418]: [1924]Completed change to active configuration
Dec 03 13:17:22.949153 osdx OSDxCLI[1924]: User 'admin' committed the configuration.
Dec 03 13:17:22.966527 osdx OSDxCLI[1924]: User 'admin' left the configuration menu.
Dec 03 13:17:23.144163 osdx OSDxCLI[1924]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Dec 03 13:17:25.749900 osdx OSDxCLI[1924]: User 'admin' entered the configuration menu.
Dec 03 13:17:25.910412 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Dec 03 13:17:26.023935 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Dec 03 13:17:26.127197 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Dec 03 13:17:26.256279 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Dec 03 13:17:26.333392 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Dec 03 13:17:26.409889 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Dec 03 13:17:26.543213 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash c37ed0fd5c36397db24cc6fc47abbba6f93d3c4d886dd8811cfbc2c93fcdb674'.
Dec 03 13:17:26.646580 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Dec 03 13:17:26.734524 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Dec 03 13:17:26.888031 osdx OSDxCLI[1924]: User 'admin' added a new cfg line: 'show working'.
Dec 03 13:17:27.003599 osdx ca-certificates[37610]: Updating certificates in /etc/ssl/certs...
Dec 03 13:17:27.644133 osdx ca-certificates[38614]: 1 added, 0 removed; done.
Dec 03 13:17:27.647069 osdx ca-certificates[38620]: Running hooks in /etc/ca-certificates/update.d...
Dec 03 13:17:27.649916 osdx ca-certificates[38622]: done.
Dec 03 13:17:27.800390 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Dec 03 13:17:27.804134 osdx cfgd[1418]: [1924]Completed change to active configuration
Dec 03 13:17:27.808000 osdx OSDxCLI[1924]: User 'admin' committed the configuration.
Dec 03 13:17:27.829624 osdx dnscrypt-proxy[38682]: dnscrypt-proxy 2.0.45
Dec 03 13:17:27.829989 osdx dnscrypt-proxy[38682]: Network connectivity detected
Dec 03 13:17:27.830243 osdx dnscrypt-proxy[38682]: Dropping privileges
Dec 03 13:17:27.832747 osdx dnscrypt-proxy[38682]: Network connectivity detected
Dec 03 13:17:27.832780 osdx dnscrypt-proxy[38682]: Now listening to 127.0.0.1:53 [UDP]
Dec 03 13:17:27.832785 osdx dnscrypt-proxy[38682]: Now listening to 127.0.0.1:53 [TCP]
Dec 03 13:17:27.832814 osdx dnscrypt-proxy[38682]: Firefox workaround initialized
Dec 03 13:17:27.832819 osdx dnscrypt-proxy[38682]: Loading the set of cloaking rules from [/tmp/tmpts5gwdss]
Dec 03 13:17:27.852052 osdx OSDxCLI[1924]: User 'admin' left the configuration menu.
Dec 03 13:17:28.020028 osdx OSDxCLI[1924]: User 'admin' executed a new command: 'system journal show | cat'.
Dec 03 13:17:28.271267 osdx OSDxCLI[1924]: User 'admin' executed a new command: 'system journal show | cat'.
Dec 03 13:17:28.309363 osdx dnscrypt-proxy[38682]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Dec 03 13:17:28.309383 osdx dnscrypt-proxy[38682]: [DUT0] OK (DoH) - rtt: 137ms
Dec 03 13:17:28.309394 osdx dnscrypt-proxy[38682]: Server with the lowest initial latency: DUT0 (rtt: 137ms)
Dec 03 13:17:28.309399 osdx dnscrypt-proxy[38682]: dnscrypt-proxy is ready - live servers: 1

---