Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash 3c15e90bd022a1619161d18b235841fbb951fd9251cbf16baaf9244baed3a840 set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1:
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy log level 0 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash 4d567ef0f878a6ad2f01af44ded41c4b7c634395add3ea1a9d13cc98c8c2dd45 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns resolver local set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
Feb 03 12:07:10.445414 osdx systemd-journald[1718]: Runtime Journal (/run/log/journal/c2388425c8a74bb4bfb70a762bcfe315) is 1.3M, max 9.7M, 8.4M free. Feb 03 12:07:10.449456 osdx systemd-journald[1718]: Received client request to rotate journal, rotating. Feb 03 12:07:10.449772 osdx systemd-journald[1718]: Vacuuming done, freed 0B of archived journals from /run/log/journal/c2388425c8a74bb4bfb70a762bcfe315. Feb 03 12:07:10.469669 osdx OSDxCLI[1937]: User 'admin' executed a new command: 'system journal clear'. Feb 03 12:07:11.291596 osdx osdx-coredump[73296]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Feb 03 12:07:11.304257 osdx OSDxCLI[1937]: User 'admin' executed a new command: 'system coredump delete all'. Feb 03 12:07:13.266469 osdx OSDxCLI[1937]: User 'admin' entered the configuration menu. Feb 03 12:07:13.478710 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Feb 03 12:07:13.631357 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 03 12:07:13.763650 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service ssh'. Feb 03 12:07:13.937237 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'show working'. Feb 03 12:07:14.146469 osdx INFO[73324]: FRR daemons did not change Feb 03 12:07:14.181168 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 03 12:07:14.486035 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Feb 03 12:07:14.511400 osdx sshd[73391]: Server listening on 0.0.0.0 port 22. Feb 03 12:07:14.511753 osdx sshd[73391]: Server listening on :: port 22. Feb 03 12:07:14.511987 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Feb 03 12:07:14.545330 osdx cfgd[1427]: [1937]Completed change to active configuration Feb 03 12:07:14.584880 osdx OSDxCLI[1937]: User 'admin' committed the configuration. Feb 03 12:07:14.635262 osdx OSDxCLI[1937]: User 'admin' left the configuration menu. Feb 03 12:07:14.878404 osdx OSDxCLI[1937]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Feb 03 12:07:17.843580 osdx OSDxCLI[1937]: User 'admin' entered the configuration menu. Feb 03 12:07:17.970421 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Feb 03 12:07:18.072546 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Feb 03 12:07:18.181524 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Feb 03 12:07:18.303355 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Feb 03 12:07:18.468339 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Feb 03 12:07:18.609173 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Feb 03 12:07:18.701667 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 4d567ef0f878a6ad2f01af44ded41c4b7c634395add3ea1a9d13cc98c8c2dd45'. Feb 03 12:07:18.861180 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Feb 03 12:07:19.011419 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'set service dns resolver local'. Feb 03 12:07:19.228165 osdx OSDxCLI[1937]: User 'admin' added a new cfg line: 'show working'. Feb 03 12:07:19.354350 osdx INFO[73454]: FRR daemons did not change Feb 03 12:07:19.375052 osdx ca-certificates[73470]: Updating certificates in /etc/ssl/certs... Feb 03 12:07:20.129363 osdx ca-certificates[74473]: 1 added, 0 removed; done. Feb 03 12:07:20.133787 osdx ca-certificates[74480]: Running hooks in /etc/ca-certificates/update.d... Feb 03 12:07:20.138534 osdx ca-certificates[74482]: done. Feb 03 12:07:20.305871 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Feb 03 12:07:20.308321 osdx cfgd[1427]: [1937]Completed change to active configuration Feb 03 12:07:20.311819 osdx OSDxCLI[1937]: User 'admin' committed the configuration. Feb 03 12:07:20.342695 osdx OSDxCLI[1937]: User 'admin' left the configuration menu. Feb 03 12:07:20.353098 osdx dnscrypt-proxy[74542]: dnscrypt-proxy 2.0.45 Feb 03 12:07:20.353207 osdx dnscrypt-proxy[74542]: Network connectivity detected Feb 03 12:07:20.353514 osdx dnscrypt-proxy[74542]: Dropping privileges Feb 03 12:07:20.356938 osdx dnscrypt-proxy[74542]: Network connectivity detected Feb 03 12:07:20.357236 osdx dnscrypt-proxy[74542]: Now listening to 127.0.0.1:53 [UDP] Feb 03 12:07:20.357327 osdx dnscrypt-proxy[74542]: Now listening to 127.0.0.1:53 [TCP] Feb 03 12:07:20.357422 osdx dnscrypt-proxy[74542]: Firefox workaround initialized Feb 03 12:07:20.357499 osdx dnscrypt-proxy[74542]: Loading the set of cloaking rules from [/tmp/tmpx4v3g0nm] Feb 03 12:07:20.559724 osdx OSDxCLI[1937]: User 'admin' executed a new command: 'system journal show | cat'. Feb 03 12:07:20.882711 osdx dnscrypt-proxy[74542]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Feb 03 12:07:20.882736 osdx dnscrypt-proxy[74542]: [DUT0] OK (DoH) - rtt: 198ms Feb 03 12:07:20.882750 osdx dnscrypt-proxy[74542]: Server with the lowest initial latency: DUT0 (rtt: 198ms) Feb 03 12:07:20.882759 osdx dnscrypt-proxy[74542]: dnscrypt-proxy is ready - live servers: 1 Feb 03 12:07:20.884878 osdx OSDxCLI[1937]: User 'admin' executed a new command: 'system journal show | cat'.