Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 3fa6a7cd749d822eac8d17037f1600eb6339d7b285a5edb3613f8a2148729baa
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash b167e023797687d1811f956743b1639529805efc1c9b6cc3d2a1a941570c50cd
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.215.168.64 from DUT1:

admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1

Show output

PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data.
64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.397 ms

--- 10.215.168.64 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.397/0.397/0.397/0.000 ms

Step 4: Run the command show host lookup teldat.com type A on DUT1 and check whether the output contains the following tokens:

teldat.com has address 10.11.12.13

Show output

;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
teldat.com has address 10.11.12.13

Step 5: Run the command system journal show | cat on DUT1 and expect the following output:

Show output

May 19 18:06:30.249274 osdx systemd-journald[2065]: Runtime Journal (/run/log/journal/c781b4f3f2134c23a5bd07e1836f7bfd) is 896.0K, max 6.4M, 5.6M free.
May 19 18:06:30.249671 osdx systemd-journald[2065]: Received client request to rotate journal, rotating.
May 19 18:06:30.249717 osdx systemd-journald[2065]: Vacuuming done, freed 0B of archived journals from /run/log/journal/c781b4f3f2134c23a5bd07e1836f7bfd.
May 19 18:06:30.258879 osdx OSDxCLI[434456]: User 'admin' executed a new command: 'system journal clear'.
May 19 18:06:30.445384 osdx OSDxCLI[434456]: User 'admin' executed a new command: 'system coredump delete all'.
May 19 18:06:31.538761 osdx OSDxCLI[434456]: User 'admin' entered the configuration menu.
May 19 18:06:31.616642 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
May 19 18:06:31.686562 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
May 19 18:06:31.777391 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service ssh'.
May 19 18:06:31.833816 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'show working'.
May 19 18:06:31.924025 osdx ubnt-cfgd[593389]: inactive
May 19 18:06:31.988346 osdx INFO[593411]: FRR daemons did not change
May 19 18:06:32.013706 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
May 19 18:06:32.062249 osdx WARNING[593482]: No supported link modes on interface eth0
May 19 18:06:32.063542 osdx modulelauncher[593482]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
May 19 18:06:32.063552 osdx modulelauncher[593482]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
May 19 18:06:32.064695 osdx modulelauncher[593482]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
May 19 18:06:32.064701 osdx modulelauncher[593482]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
May 19 18:06:32.150226 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
May 19 18:06:32.162024 osdx sshd[593543]: Server listening on 0.0.0.0 port 22.
May 19 18:06:32.162048 osdx sshd[593543]: Server listening on :: port 22.
May 19 18:06:32.162132 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
May 19 18:06:32.324566 osdx cfgd[1789]: [434456]Completed change to active configuration
May 19 18:06:32.325064 osdx OSDxCLI[434456]: User 'admin' committed the configuration.
May 19 18:06:32.338965 osdx OSDxCLI[434456]: User 'admin' left the configuration menu.
May 19 18:06:32.483506 osdx OSDxCLI[434456]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
May 19 18:06:34.097897 osdx OSDxCLI[434456]: User 'admin' entered the configuration menu.
May 19 18:06:34.153783 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
May 19 18:06:34.244620 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
May 19 18:06:34.297914 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
May 19 18:06:34.396691 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
May 19 18:06:34.451890 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
May 19 18:06:34.546546 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
May 19 18:06:34.604612 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash b167e023797687d1811f956743b1639529805efc1c9b6cc3d2a1a941570c50cd'.
May 19 18:06:34.689188 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
May 19 18:06:34.741362 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'set service dns resolver local'.
May 19 18:06:34.848154 osdx OSDxCLI[434456]: User 'admin' added a new cfg line: 'show working'.
May 19 18:06:34.909962 osdx ubnt-cfgd[593607]: inactive
May 19 18:06:34.941559 osdx INFO[593616]: FRR daemons did not change
May 19 18:06:34.953169 osdx ca-certificates[593632]: Updating certificates in /etc/ssl/certs...
May 19 18:06:35.403113 osdx ubnt-cfgd[594644]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
May 19 18:06:35.409945 osdx ca-certificates[594650]: 1 added, 0 removed; done.
May 19 18:06:35.412523 osdx ca-certificates[594656]: Running hooks in /etc/ca-certificates/update.d...
May 19 18:06:35.415041 osdx ca-certificates[594658]: done.
May 19 18:06:35.513914 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
May 19 18:06:35.525770 osdx cfgd[1789]: [434456]Completed change to active configuration
May 19 18:06:35.526186 osdx OSDxCLI[434456]: User 'admin' committed the configuration.
May 19 18:06:35.540581 osdx OSDxCLI[434456]: User 'admin' left the configuration menu.
May 19 18:06:35.613496 osdx dnscrypt-proxy[594717]: dnscrypt-proxy 2.0.45
May 19 18:06:35.613549 osdx dnscrypt-proxy[594717]: Network connectivity detected
May 19 18:06:35.613902 osdx dnscrypt-proxy[594717]: Dropping privileges
May 19 18:06:35.615605 osdx dnscrypt-proxy[594717]: Network connectivity detected
May 19 18:06:35.615630 osdx dnscrypt-proxy[594717]: Now listening to 127.0.0.1:53 [UDP]
May 19 18:06:35.615634 osdx dnscrypt-proxy[594717]: Now listening to 127.0.0.1:53 [TCP]
May 19 18:06:35.615648 osdx dnscrypt-proxy[594717]: Firefox workaround initialized
May 19 18:06:35.615651 osdx dnscrypt-proxy[594717]: Loading the set of cloaking rules from [/tmp/tmps4a8574m]
May 19 18:06:35.681049 osdx OSDxCLI[434456]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
May 19 18:06:35.832630 osdx dnscrypt-proxy[594717]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
May 19 18:06:35.832647 osdx dnscrypt-proxy[594717]: [DUT0] OK (DoH) - rtt: 115ms
May 19 18:06:35.832655 osdx dnscrypt-proxy[594717]: Server with the lowest initial latency: DUT0 (rtt: 115ms)
May 19 18:06:35.832660 osdx dnscrypt-proxy[594717]: dnscrypt-proxy is ready - live servers: 1
May 19 18:06:40.763549 osdx OSDxCLI[434456]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'.
May 19 18:06:50.957925 osdx OSDxCLI[434456]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

---