Cipher

Test suite to validate using one or multiple ciphers to protect DoH connection

Single Valid Cipher

Description

Configures a single, valid cipher and tries to communicate with the server. No refusal of the proposed cipher is expected.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49199

Show output

Jul 24 10:22:52.313312 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:22:52.313742 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:22:52.313798 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:22:52.322781 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:22:52.526459 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 24 10:22:52.890945 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:22:53.018065 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:22:53.095019 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:22:53.191840 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:22:53.253466 osdx ubnt-cfgd[513304]: inactive
Jul 24 10:22:53.279215 osdx INFO[513313]: FRR daemons did not change
Jul 24 10:22:53.309753 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:22:53.355003 osdx WARNING[513384]: No supported link modes on interface eth0
Jul 24 10:22:53.356497 osdx modulelauncher[513384]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:22:53.356511 osdx modulelauncher[513384]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:22:53.357927 osdx modulelauncher[513384]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:22:53.357936 osdx modulelauncher[513384]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:22:53.572403 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:22:53.572879 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:22:53.588074 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:22:53.758858 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Jul 24 10:22:53.824531 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 24 10:22:54.006488 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:22:54.061889 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:22:54.154193 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:22:54.216486 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:22:54.305139 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:22:54.362245 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:22:54.443340 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'.
Jul 24 10:22:54.495486 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:22:54.632872 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:22:54.695315 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:22:54.814574 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:22:54.883504 osdx ubnt-cfgd[513499]: inactive
Jul 24 10:22:54.918856 osdx INFO[513508]: FRR daemons did not change
Jul 24 10:22:54.937809 osdx ca-certificates[513523]: Updating certificates in /etc/ssl/certs...
Jul 24 10:22:55.477313 osdx ubnt-cfgd[514536]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:22:55.485486 osdx ca-certificates[514541]: 1 added, 0 removed; done.
Jul 24 10:22:55.489009 osdx ca-certificates[514548]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:22:55.492192 osdx ca-certificates[514550]: done.
Jul 24 10:22:55.562055 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:22:55.571213 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:22:55.571762 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:22:55.584100 osdx dnscrypt-proxy[514554]: dnscrypt-proxy 2.0.45
Jul 24 10:22:55.584189 osdx dnscrypt-proxy[514554]: Network connectivity detected
Jul 24 10:22:55.584411 osdx dnscrypt-proxy[514554]: Dropping privileges
Jul 24 10:22:55.586496 osdx dnscrypt-proxy[514554]: Network connectivity detected
Jul 24 10:22:55.586528 osdx dnscrypt-proxy[514554]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:22:55.586533 osdx dnscrypt-proxy[514554]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:22:55.586558 osdx dnscrypt-proxy[514554]: Firefox workaround initialized
Jul 24 10:22:55.586563 osdx dnscrypt-proxy[514554]: Loading the set of cloaking rules from [/tmp/tmpy0tpjqx2]
Jul 24 10:22:55.589146 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:22:55.733128 osdx dnscrypt-proxy[514554]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49199
Jul 24 10:22:55.733145 osdx dnscrypt-proxy[514554]: [RD] OK (DoH) - rtt: 126ms
Jul 24 10:22:55.733153 osdx dnscrypt-proxy[514554]: Server with the lowest initial latency: RD (rtt: 126ms)
Jul 24 10:22:55.733158 osdx dnscrypt-proxy[514554]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:22:55.747036 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Multiple Valid Cipher

Description

Configures a valid cipher each time, and tries to communicate with the server. No refusal of the proposed cipher is expected.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49199

Show output

Jul 24 10:23:04.297078 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:23:04.299604 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:04.299670 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:04.307213 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:04.522038 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 24 10:23:04.754614 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:04.840530 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:04.931334 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:05.040604 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:05.097746 osdx ubnt-cfgd[516325]: inactive
Jul 24 10:23:05.123347 osdx INFO[516334]: FRR daemons did not change
Jul 24 10:23:05.151598 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:23:05.199627 osdx WARNING[516405]: No supported link modes on interface eth0
Jul 24 10:23:05.201078 osdx modulelauncher[516405]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:05.201094 osdx modulelauncher[516405]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:05.202281 osdx modulelauncher[516405]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:05.202292 osdx modulelauncher[516405]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:05.426152 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:05.426728 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:05.462879 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:05.615266 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Jul 24 10:23:05.686800 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 24 10:23:06.040325 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:06.166255 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:23:06.224489 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:23:06.329438 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:23:06.384914 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:23:06.487375 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:23:06.539880 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'.
Jul 24 10:23:06.631297 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:23:06.716242 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:06.791604 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:06.867039 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:06.969226 osdx ubnt-cfgd[516520]: inactive
Jul 24 10:23:06.991451 osdx INFO[516529]: FRR daemons did not change
Jul 24 10:23:07.004145 osdx ca-certificates[516545]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:07.587084 osdx ubnt-cfgd[517557]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:07.594972 osdx ca-certificates[517563]: 1 added, 0 removed; done.
Jul 24 10:23:07.598641 osdx ca-certificates[517569]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:07.602223 osdx ca-certificates[517571]: done.
Jul 24 10:23:07.664037 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:07.673191 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:07.673627 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:07.690239 osdx dnscrypt-proxy[517575]: dnscrypt-proxy 2.0.45
Jul 24 10:23:07.690302 osdx dnscrypt-proxy[517575]: Network connectivity detected
Jul 24 10:23:07.690502 osdx dnscrypt-proxy[517575]: Dropping privileges
Jul 24 10:23:07.692841 osdx dnscrypt-proxy[517575]: Network connectivity detected
Jul 24 10:23:07.692874 osdx dnscrypt-proxy[517575]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:23:07.692879 osdx dnscrypt-proxy[517575]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:23:07.692896 osdx dnscrypt-proxy[517575]: Firefox workaround initialized
Jul 24 10:23:07.692902 osdx dnscrypt-proxy[517575]: Loading the set of cloaking rules from [/tmp/tmptk2ktuq2]
Jul 24 10:23:07.697717 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:07.836877 osdx dnscrypt-proxy[517575]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49199
Jul 24 10:23:07.836905 osdx dnscrypt-proxy[517575]: [RD] OK (DoH) - rtt: 122ms
Jul 24 10:23:07.836914 osdx dnscrypt-proxy[517575]: Server with the lowest initial latency: RD (rtt: 122ms)
Jul 24 10:23:07.836919 osdx dnscrypt-proxy[517575]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:23:07.855630 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 2

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49200

Show output

Jul 24 10:23:08.127494 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:23:08.128027 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:08.128060 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:08.139073 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:08.503818 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:08.595622 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:23:08.730787 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:23:08.797204 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:08.935431 osdx ubnt-cfgd[517642]: inactive
Jul 24 10:23:08.961166 osdx dnscrypt-proxy[517575]: Stopped.
Jul 24 10:23:08.961236 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:23:08.962342 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:23:08.962447 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:09.028944 osdx WARNING[517706]: No supported link modes on interface eth0
Jul 24 10:23:09.030638 osdx modulelauncher[517706]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:09.030652 osdx modulelauncher[517706]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:09.032212 osdx modulelauncher[517706]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:09.032224 osdx modulelauncher[517706]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:09.051706 osdx ca-certificates[517728]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:23:09.349713 osdx ca-certificates[518306]: done.
Jul 24 10:23:09.352901 osdx ca-certificates[518315]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:09.855492 osdx ubnt-cfgd[519172]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:09.866816 osdx ca-certificates[519178]: 142 added, 0 removed; done.
Jul 24 10:23:09.869916 osdx ca-certificates[519184]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:09.873746 osdx ca-certificates[519186]: done.
Jul 24 10:23:09.927354 osdx INFO[519198]: FRR daemons did not change
Jul 24 10:23:10.041838 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:10.042378 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:10.059164 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:11.426129 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:11.501675 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:23:11.590356 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:23:11.658867 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:23:11.783726 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:23:11.905129 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:23:12.009350 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'.
Jul 24 10:23:12.092942 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:23:12.220899 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:12.278069 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:12.401436 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:12.530912 osdx ubnt-cfgd[519252]: inactive
Jul 24 10:23:12.566408 osdx INFO[519263]: FRR daemons did not change
Jul 24 10:23:12.581806 osdx ca-certificates[519279]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:13.142637 osdx ubnt-cfgd[520291]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:13.152096 osdx ca-certificates[520296]: 1 added, 0 removed; done.
Jul 24 10:23:13.155187 osdx ca-certificates[520303]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:13.158056 osdx ca-certificates[520305]: done.
Jul 24 10:23:13.187602 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:23:13.236477 osdx WARNING[520374]: No supported link modes on interface eth0
Jul 24 10:23:13.238277 osdx modulelauncher[520374]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:13.238291 osdx modulelauncher[520374]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:13.239823 osdx modulelauncher[520374]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:13.239837 osdx modulelauncher[520374]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:13.367975 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:13.396287 osdx dnscrypt-proxy[520418]: dnscrypt-proxy 2.0.45
Jul 24 10:23:13.396367 osdx dnscrypt-proxy[520418]: Network connectivity detected
Jul 24 10:23:13.396601 osdx dnscrypt-proxy[520418]: Dropping privileges
Jul 24 10:23:13.398856 osdx dnscrypt-proxy[520418]: Network connectivity detected
Jul 24 10:23:13.398887 osdx dnscrypt-proxy[520418]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:23:13.398891 osdx dnscrypt-proxy[520418]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:23:13.398909 osdx dnscrypt-proxy[520418]: Firefox workaround initialized
Jul 24 10:23:13.398915 osdx dnscrypt-proxy[520418]: Loading the set of cloaking rules from [/tmp/tmpp0rq0rlw]
Jul 24 10:23:13.538613 osdx dnscrypt-proxy[520418]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49200
Jul 24 10:23:13.538631 osdx dnscrypt-proxy[520418]: [RD] OK (DoH) - rtt: 123ms
Jul 24 10:23:13.538640 osdx dnscrypt-proxy[520418]: Server with the lowest initial latency: RD (rtt: 123ms)
Jul 24 10:23:13.538643 osdx dnscrypt-proxy[520418]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:23:13.557443 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:13.557963 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:13.577525 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:13.753561 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 3

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 52392

Show output

Jul 24 10:23:14.000608 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:23:14.003607 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:14.003664 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:14.011810 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:14.284264 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:14.377845 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:23:14.470346 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:23:14.558105 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:14.692262 osdx ubnt-cfgd[520515]: inactive
Jul 24 10:23:14.716914 osdx dnscrypt-proxy[520418]: Stopped.
Jul 24 10:23:14.716957 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:23:14.717822 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:23:14.717960 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:14.782279 osdx WARNING[520579]: No supported link modes on interface eth0
Jul 24 10:23:14.783823 osdx modulelauncher[520579]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:14.783836 osdx modulelauncher[520579]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:14.784985 osdx modulelauncher[520579]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:14.784994 osdx modulelauncher[520579]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:14.801737 osdx ca-certificates[520602]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:23:15.099983 osdx ca-certificates[521180]: done.
Jul 24 10:23:15.103087 osdx ca-certificates[521189]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:15.577127 osdx ubnt-cfgd[522046]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:15.585680 osdx ca-certificates[522051]: 142 added, 0 removed; done.
Jul 24 10:23:15.588580 osdx ca-certificates[522058]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:15.591311 osdx ca-certificates[522060]: done.
Jul 24 10:23:15.636754 osdx INFO[522072]: FRR daemons did not change
Jul 24 10:23:15.751158 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:15.751753 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:15.774037 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:17.239367 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:17.315629 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:23:17.419209 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:23:17.489677 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:23:17.591175 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:23:17.693956 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:23:17.765461 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256'.
Jul 24 10:23:17.868717 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:23:17.974667 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:18.050085 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:18.203947 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:18.305763 osdx ubnt-cfgd[522126]: inactive
Jul 24 10:23:18.337328 osdx INFO[522137]: FRR daemons did not change
Jul 24 10:23:18.350775 osdx ca-certificates[522153]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:19.033154 osdx ubnt-cfgd[523165]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:19.043867 osdx ca-certificates[523171]: 1 added, 0 removed; done.
Jul 24 10:23:19.047804 osdx ca-certificates[523177]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:19.051614 osdx ca-certificates[523179]: done.
Jul 24 10:23:19.083602 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:23:19.129479 osdx WARNING[523248]: No supported link modes on interface eth0
Jul 24 10:23:19.130869 osdx modulelauncher[523248]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:19.130881 osdx modulelauncher[523248]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:19.132088 osdx modulelauncher[523248]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:19.132096 osdx modulelauncher[523248]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:19.251932 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:19.270764 osdx dnscrypt-proxy[523292]: dnscrypt-proxy 2.0.45
Jul 24 10:23:19.270839 osdx dnscrypt-proxy[523292]: Network connectivity detected
Jul 24 10:23:19.271063 osdx dnscrypt-proxy[523292]: Dropping privileges
Jul 24 10:23:19.273652 osdx dnscrypt-proxy[523292]: Network connectivity detected
Jul 24 10:23:19.273681 osdx dnscrypt-proxy[523292]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:23:19.273685 osdx dnscrypt-proxy[523292]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:23:19.273702 osdx dnscrypt-proxy[523292]: Firefox workaround initialized
Jul 24 10:23:19.273706 osdx dnscrypt-proxy[523292]: Loading the set of cloaking rules from [/tmp/tmpdoypfa1j]
Jul 24 10:23:19.437835 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:19.438410 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:19.466688 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:20.311194 osdx dnscrypt-proxy[523292]: [RD] may be a lying resolver
Jul 24 10:23:20.311205 osdx dnscrypt-proxy[523292]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:23:20.311215 osdx dnscrypt-proxy[523292]: [RD] OK (DoH) - rtt: 1020ms
Jul 24 10:23:20.311223 osdx dnscrypt-proxy[523292]: Server with the lowest initial latency: RD (rtt: 1020ms)
Jul 24 10:23:20.311227 osdx dnscrypt-proxy[523292]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:23:24.634449 osdx OSDxCLI[414651]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'.
Jul 24 10:23:34.030381 osdx systemd[1]: systemd-timedated.service: Deactivated successfully.
Jul 24 10:23:34.719650 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Single Invalid Cipher

Description

Configures a single, invalid cipher and tries to communicate with the server. A refusal of the proposed cipher is expected.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file

Show output

Jul 24 10:23:42.333788 osdx systemd[1]: Started systemd-timedated.service - Time & Date Service.
Jul 24 10:23:42.000238 osdx systemd-timedated[525077]: Changed local time to Fri 2026-07-24 10:23:42 UTC
Jul 24 10:23:42.001873 osdx systemd-journald[2180]: Time jumped backwards, rotating.
Jul 24 10:23:42.002055 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'set date 2026-07-24 10:23:42'.
Jul 24 10:23:42.301503 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:23:42.302143 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:42.302191 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:42.312391 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:42.585953 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 24 10:23:42.856532 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:42.942268 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:43.018881 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:43.124818 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:43.191543 osdx ubnt-cfgd[525106]: inactive
Jul 24 10:23:43.216984 osdx INFO[525115]: FRR daemons did not change
Jul 24 10:23:43.245868 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:23:43.293177 osdx WARNING[525186]: No supported link modes on interface eth0
Jul 24 10:23:43.294891 osdx modulelauncher[525186]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:43.294903 osdx modulelauncher[525186]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:43.296133 osdx modulelauncher[525186]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:43.296141 osdx modulelauncher[525186]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:43.516209 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:43.516717 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:43.531308 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:43.692369 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Jul 24 10:23:43.763886 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 24 10:23:43.959775 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:44.040743 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:23:44.147796 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:23:44.214931 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:23:44.304234 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:23:44.379038 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:23:44.498089 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:23:44.569382 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:23:44.698970 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:44.757179 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:44.872904 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:44.949629 osdx ubnt-cfgd[525301]: inactive
Jul 24 10:23:44.973009 osdx INFO[525310]: FRR daemons did not change
Jul 24 10:23:44.988448 osdx ca-certificates[525326]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:45.529111 osdx ubnt-cfgd[526338]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:45.540044 osdx ca-certificates[526344]: 1 added, 0 removed; done.
Jul 24 10:23:45.543760 osdx ca-certificates[526350]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:45.547285 osdx ca-certificates[526352]: done.
Jul 24 10:23:45.618193 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:45.629263 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:45.629822 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:45.641100 osdx dnscrypt-proxy[526356]: dnscrypt-proxy 2.0.45
Jul 24 10:23:45.641158 osdx dnscrypt-proxy[526356]: Network connectivity detected
Jul 24 10:23:45.641376 osdx dnscrypt-proxy[526356]: Dropping privileges
Jul 24 10:23:45.643336 osdx dnscrypt-proxy[526356]: Network connectivity detected
Jul 24 10:23:45.643370 osdx dnscrypt-proxy[526356]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:23:45.643374 osdx dnscrypt-proxy[526356]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:23:45.643394 osdx dnscrypt-proxy[526356]: Firefox workaround initialized
Jul 24 10:23:45.643399 osdx dnscrypt-proxy[526356]: Loading the set of cloaking rules from [/tmp/tmpup7y29wd]
Jul 24 10:23:45.644126 osdx dnscrypt-proxy[526356]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file
Jul 24 10:23:45.653781 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:45.781700 osdx dnscrypt-proxy[526356]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:23:45.781719 osdx dnscrypt-proxy[526356]: [RD] OK (DoH) - rtt: 117ms
Jul 24 10:23:45.781727 osdx dnscrypt-proxy[526356]: Server with the lowest initial latency: RD (rtt: 117ms)
Jul 24 10:23:45.781730 osdx dnscrypt-proxy[526356]: dnscrypt-proxy is ready - live servers: 1

Multiple Invalid Cipher

Description

Configures either one or two invalid ciphers and tries to communicate with the server. A refusal of all proposed ciphers is expected.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file

Show output

Jul 24 10:23:53.319192 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.9M, max 13.8M, 11.9M free.
Jul 24 10:23:53.319771 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:53.319836 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:53.329098 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:53.537980 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 24 10:23:53.783846 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:53.866129 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:53.939632 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:54.042349 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:54.104169 osdx ubnt-cfgd[528123]: inactive
Jul 24 10:23:54.127789 osdx INFO[528132]: FRR daemons did not change
Jul 24 10:23:54.155813 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:23:54.203913 osdx WARNING[528203]: No supported link modes on interface eth0
Jul 24 10:23:54.205275 osdx modulelauncher[528203]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:54.205286 osdx modulelauncher[528203]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:54.206760 osdx modulelauncher[528203]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:54.206767 osdx modulelauncher[528203]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:54.397582 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:54.398049 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:54.413166 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:54.556775 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Jul 24 10:23:54.621112 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 24 10:23:54.828137 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:54.902549 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:23:55.021709 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:23:55.085480 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:23:55.184835 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:23:55.243211 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:23:55.345023 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:23:55.417984 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:23:55.550530 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:23:55.613659 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:23:55.731290 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:55.806050 osdx ubnt-cfgd[528318]: inactive
Jul 24 10:23:55.828988 osdx INFO[528327]: FRR daemons did not change
Jul 24 10:23:55.844413 osdx ca-certificates[528343]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:56.389733 osdx ubnt-cfgd[529355]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:56.399303 osdx ca-certificates[529360]: 1 added, 0 removed; done.
Jul 24 10:23:56.402353 osdx ca-certificates[529367]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:56.405166 osdx ca-certificates[529369]: done.
Jul 24 10:23:56.476211 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:56.485533 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:56.486166 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:56.501497 osdx dnscrypt-proxy[529373]: dnscrypt-proxy 2.0.45
Jul 24 10:23:56.501580 osdx dnscrypt-proxy[529373]: Network connectivity detected
Jul 24 10:23:56.501904 osdx dnscrypt-proxy[529373]: Dropping privileges
Jul 24 10:23:56.502876 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:23:56.504896 osdx dnscrypt-proxy[529373]: Network connectivity detected
Jul 24 10:23:56.504935 osdx dnscrypt-proxy[529373]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:23:56.504940 osdx dnscrypt-proxy[529373]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:23:56.504957 osdx dnscrypt-proxy[529373]: Firefox workaround initialized
Jul 24 10:23:56.504962 osdx dnscrypt-proxy[529373]: Loading the set of cloaking rules from [/tmp/tmpoa6fvzr7]
Jul 24 10:23:56.505936 osdx dnscrypt-proxy[529373]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file
Jul 24 10:23:56.649873 osdx dnscrypt-proxy[529373]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:23:56.649896 osdx dnscrypt-proxy[529373]: [RD] OK (DoH) - rtt: 125ms
Jul 24 10:23:56.649905 osdx dnscrypt-proxy[529373]: Server with the lowest initial latency: RD (rtt: 125ms)
Jul 24 10:23:56.649911 osdx dnscrypt-proxy[529373]: dnscrypt-proxy is ready - live servers: 1

Example 2

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file

Show output

Jul 24 10:23:56.814316 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:23:56.815796 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:23:56.815884 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:23:56.829138 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:23:57.138676 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:23:57.214481 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:23:57.360097 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:23:57.441378 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:23:57.533981 osdx ubnt-cfgd[529434]: inactive
Jul 24 10:23:57.574276 osdx dnscrypt-proxy[529373]: Stopped.
Jul 24 10:23:57.574321 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:23:57.575512 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:23:57.575643 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:23:57.653676 osdx WARNING[529499]: No supported link modes on interface eth0
Jul 24 10:23:57.655496 osdx modulelauncher[529499]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:23:57.655512 osdx modulelauncher[529499]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:23:57.656993 osdx modulelauncher[529499]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:23:57.657004 osdx modulelauncher[529499]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:23:57.676718 osdx ca-certificates[529521]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:23:57.994427 osdx ca-certificates[530098]: done.
Jul 24 10:23:57.998071 osdx ca-certificates[530107]: Updating certificates in /etc/ssl/certs...
Jul 24 10:23:58.583345 osdx ubnt-cfgd[530965]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:23:58.593265 osdx ca-certificates[530971]: 142 added, 0 removed; done.
Jul 24 10:23:58.597280 osdx ca-certificates[530977]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:23:58.601625 osdx ca-certificates[530979]: done.
Jul 24 10:23:58.665624 osdx INFO[530991]: FRR daemons did not change
Jul 24 10:23:58.766962 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:23:58.767596 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:23:58.793620 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:00.239505 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:00.324996 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:00.431639 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:00.499784 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:00.602736 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:00.712735 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:00.781113 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA'.
Jul 24 10:24:00.873659 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:00.985132 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:01.083150 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:01.209754 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:01.306611 osdx ubnt-cfgd[531045]: inactive
Jul 24 10:24:01.355907 osdx INFO[531056]: FRR daemons did not change
Jul 24 10:24:01.376662 osdx ca-certificates[531072]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:02.088837 osdx ubnt-cfgd[532084]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:02.099682 osdx ca-certificates[532090]: 1 added, 0 removed; done.
Jul 24 10:24:02.102736 osdx ca-certificates[532096]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:02.105837 osdx ca-certificates[532098]: done.
Jul 24 10:24:02.147774 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:02.198612 osdx WARNING[532167]: No supported link modes on interface eth0
Jul 24 10:24:02.200136 osdx modulelauncher[532167]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:02.200150 osdx modulelauncher[532167]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:02.201321 osdx modulelauncher[532167]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:02.201330 osdx modulelauncher[532167]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:02.312165 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:02.341288 osdx dnscrypt-proxy[532211]: dnscrypt-proxy 2.0.45
Jul 24 10:24:02.341371 osdx dnscrypt-proxy[532211]: Network connectivity detected
Jul 24 10:24:02.341614 osdx dnscrypt-proxy[532211]: Dropping privileges
Jul 24 10:24:02.344472 osdx dnscrypt-proxy[532211]: Network connectivity detected
Jul 24 10:24:02.344507 osdx dnscrypt-proxy[532211]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:02.344513 osdx dnscrypt-proxy[532211]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:02.344533 osdx dnscrypt-proxy[532211]: Firefox workaround initialized
Jul 24 10:24:02.344541 osdx dnscrypt-proxy[532211]: Loading the set of cloaking rules from [/tmp/tmphc5l9uxr]
Jul 24 10:24:02.346191 osdx dnscrypt-proxy[532211]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file
Jul 24 10:24:02.499824 osdx dnscrypt-proxy[532211]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:24:02.499849 osdx dnscrypt-proxy[532211]: [RD] OK (DoH) - rtt: 109ms
Jul 24 10:24:02.499859 osdx dnscrypt-proxy[532211]: Server with the lowest initial latency: RD (rtt: 109ms)
Jul 24 10:24:02.499864 osdx dnscrypt-proxy[532211]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:02.514010 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:02.514729 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:02.535231 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.

Example 3

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy cipher 2 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file

Show output

Jul 24 10:24:02.844118 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:02.847795 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:02.847874 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:02.854876 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:03.171658 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:03.236355 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:03.364595 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:03.426355 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:03.512048 osdx ubnt-cfgd[532303]: inactive
Jul 24 10:24:03.534920 osdx dnscrypt-proxy[532211]: Stopped.
Jul 24 10:24:03.535022 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:03.536042 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:03.536160 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:03.599904 osdx WARNING[532367]: No supported link modes on interface eth0
Jul 24 10:24:03.601680 osdx modulelauncher[532367]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:03.601693 osdx modulelauncher[532367]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:03.602912 osdx modulelauncher[532367]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:03.602920 osdx modulelauncher[532367]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:03.622814 osdx ca-certificates[532389]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:03.914947 osdx ca-certificates[532967]: done.
Jul 24 10:24:03.917721 osdx ca-certificates[532975]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:04.370282 osdx ubnt-cfgd[533833]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:04.378601 osdx ca-certificates[533838]: 142 added, 0 removed; done.
Jul 24 10:24:04.381446 osdx ca-certificates[533845]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:04.385013 osdx ca-certificates[533847]: done.
Jul 24 10:24:04.432965 osdx INFO[533859]: FRR daemons did not change
Jul 24 10:24:04.535139 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:04.535822 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:04.553667 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:05.995349 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:06.109206 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:06.190148 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:06.288092 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:06.369452 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:06.479949 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:06.543613 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:24:06.639006 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA'.
Jul 24 10:24:06.693274 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:06.836114 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:06.890283 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:07.008635 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:07.084420 osdx ubnt-cfgd[533914]: inactive
Jul 24 10:24:07.111023 osdx INFO[533925]: FRR daemons did not change
Jul 24 10:24:07.125606 osdx ca-certificates[533940]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:07.683272 osdx ubnt-cfgd[534953]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:07.692512 osdx ca-certificates[534958]: 1 added, 0 removed; done.
Jul 24 10:24:07.695654 osdx ca-certificates[534965]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:07.699495 osdx ca-certificates[534967]: done.
Jul 24 10:24:07.731780 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:07.782199 osdx WARNING[535036]: No supported link modes on interface eth0
Jul 24 10:24:07.783956 osdx modulelauncher[535036]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:07.783970 osdx modulelauncher[535036]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:07.785418 osdx modulelauncher[535036]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:07.785430 osdx modulelauncher[535036]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:07.892293 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:07.912343 osdx dnscrypt-proxy[535080]: dnscrypt-proxy 2.0.45
Jul 24 10:24:07.912648 osdx dnscrypt-proxy[535080]: Network connectivity detected
Jul 24 10:24:07.912847 osdx dnscrypt-proxy[535080]: Dropping privileges
Jul 24 10:24:07.915155 osdx dnscrypt-proxy[535080]: Network connectivity detected
Jul 24 10:24:07.915356 osdx dnscrypt-proxy[535080]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:07.915361 osdx dnscrypt-proxy[535080]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:07.915383 osdx dnscrypt-proxy[535080]: Firefox workaround initialized
Jul 24 10:24:07.915387 osdx dnscrypt-proxy[535080]: Loading the set of cloaking rules from [/tmp/tmp1ezcm_2b]
Jul 24 10:24:07.916410 osdx dnscrypt-proxy[535080]: TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file
Jul 24 10:24:08.058544 osdx dnscrypt-proxy[535080]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:24:08.058558 osdx dnscrypt-proxy[535080]: [RD] OK (DoH) - rtt: 120ms
Jul 24 10:24:08.058572 osdx dnscrypt-proxy[535080]: Server with the lowest initial latency: RD (rtt: 120ms)
Jul 24 10:24:08.058576 osdx dnscrypt-proxy[535080]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:08.073775 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:08.074327 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:08.090753 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.

Invalid Cipher With Fallback

Description

Configures an invalid cipher and a valid fallback one. It then tries to communicate with the server. No refusal of the cipher is expected, as long as the valid one proposed is used.

Scenario

Example 1

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49199

Show output

Jul 24 10:24:15.294719 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:15.298053 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:15.298100 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:15.303884 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:15.524146 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 24 10:24:15.777592 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:15.862981 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:15.943201 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:16.051277 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:16.122562 osdx ubnt-cfgd[536880]: inactive
Jul 24 10:24:16.156522 osdx INFO[536889]: FRR daemons did not change
Jul 24 10:24:16.190064 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:16.246647 osdx WARNING[536960]: No supported link modes on interface eth0
Jul 24 10:24:16.248780 osdx modulelauncher[536960]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:16.248794 osdx modulelauncher[536960]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:16.250272 osdx modulelauncher[536960]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:16.250280 osdx modulelauncher[536960]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:16.451873 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:16.452441 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:16.467209 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:16.642069 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Jul 24 10:24:16.719294 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 24 10:24:16.950980 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:17.574916 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:17.649102 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:17.753478 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:17.809751 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:17.902327 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:17.957470 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:24:18.068719 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'.
Jul 24 10:24:18.148972 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:18.277174 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:18.332542 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:18.446774 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:18.511967 osdx ubnt-cfgd[537076]: inactive
Jul 24 10:24:18.544639 osdx INFO[537085]: FRR daemons did not change
Jul 24 10:24:18.562272 osdx ca-certificates[537101]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:19.174481 osdx ubnt-cfgd[538113]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:19.188779 osdx ca-certificates[538118]: 1 added, 0 removed; done.
Jul 24 10:24:19.197446 osdx ca-certificates[538125]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:19.198236 osdx ca-certificates[538127]: done.
Jul 24 10:24:19.278478 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:19.289612 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:19.290138 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:19.302837 osdx dnscrypt-proxy[538131]: dnscrypt-proxy 2.0.45
Jul 24 10:24:19.302910 osdx dnscrypt-proxy[538131]: Network connectivity detected
Jul 24 10:24:19.303126 osdx dnscrypt-proxy[538131]: Dropping privileges
Jul 24 10:24:19.305794 osdx dnscrypt-proxy[538131]: Network connectivity detected
Jul 24 10:24:19.305830 osdx dnscrypt-proxy[538131]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:19.305835 osdx dnscrypt-proxy[538131]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:19.305874 osdx dnscrypt-proxy[538131]: Firefox workaround initialized
Jul 24 10:24:19.305879 osdx dnscrypt-proxy[538131]: Loading the set of cloaking rules from [/tmp/tmplwvtln0b]
Jul 24 10:24:19.317040 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:19.454970 osdx dnscrypt-proxy[538131]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49199
Jul 24 10:24:19.454995 osdx dnscrypt-proxy[538131]: [RD] OK (DoH) - rtt: 119ms
Jul 24 10:24:19.455005 osdx dnscrypt-proxy[538131]: Server with the lowest initial latency: RD (rtt: 119ms)
Jul 24 10:24:19.455010 osdx dnscrypt-proxy[538131]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:19.488739 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 2

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49200

Show output

Jul 24 10:24:19.704473 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:19.706075 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:19.706140 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:19.716490 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:20.035616 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:20.111895 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:20.247320 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:20.310794 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:20.410241 osdx ubnt-cfgd[538195]: inactive
Jul 24 10:24:20.437013 osdx dnscrypt-proxy[538131]: Stopped.
Jul 24 10:24:20.437111 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:20.438490 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:20.438598 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:20.505478 osdx WARNING[538259]: No supported link modes on interface eth0
Jul 24 10:24:20.507008 osdx modulelauncher[538259]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:20.507022 osdx modulelauncher[538259]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:20.508238 osdx modulelauncher[538259]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:20.508246 osdx modulelauncher[538259]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:20.527581 osdx ca-certificates[538281]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:20.852402 osdx ca-certificates[538859]: done.
Jul 24 10:24:20.855942 osdx ca-certificates[538867]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:21.371932 osdx ubnt-cfgd[539725]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:21.381060 osdx ca-certificates[539731]: 142 added, 0 removed; done.
Jul 24 10:24:21.384731 osdx ca-certificates[539737]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:21.388316 osdx ca-certificates[539739]: done.
Jul 24 10:24:21.443058 osdx INFO[539751]: FRR daemons did not change
Jul 24 10:24:21.544913 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:21.545502 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:21.566742 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:23.206286 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:23.834747 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:23.904405 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:23.998894 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:24.056458 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:24.157407 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:24.224366 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:24:24.316724 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'.
Jul 24 10:24:24.369107 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:24.504487 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:24.555102 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:24.650512 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:24.718176 osdx ubnt-cfgd[539806]: inactive
Jul 24 10:24:24.748417 osdx INFO[539817]: FRR daemons did not change
Jul 24 10:24:24.765466 osdx ca-certificates[539833]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:25.301433 osdx ubnt-cfgd[540845]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:25.309336 osdx ca-certificates[540851]: 1 added, 0 removed; done.
Jul 24 10:24:25.312183 osdx ca-certificates[540857]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:25.314880 osdx ca-certificates[540859]: done.
Jul 24 10:24:25.346077 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:25.388495 osdx WARNING[540928]: No supported link modes on interface eth0
Jul 24 10:24:25.389885 osdx modulelauncher[540928]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:25.389896 osdx modulelauncher[540928]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:25.391129 osdx modulelauncher[540928]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:25.391137 osdx modulelauncher[540928]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:25.494343 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:25.544603 osdx dnscrypt-proxy[540972]: dnscrypt-proxy 2.0.45
Jul 24 10:24:25.544678 osdx dnscrypt-proxy[540972]: Network connectivity detected
Jul 24 10:24:25.544929 osdx dnscrypt-proxy[540972]: Dropping privileges
Jul 24 10:24:25.548044 osdx dnscrypt-proxy[540972]: Network connectivity detected
Jul 24 10:24:25.548091 osdx dnscrypt-proxy[540972]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:25.548097 osdx dnscrypt-proxy[540972]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:25.548119 osdx dnscrypt-proxy[540972]: Firefox workaround initialized
Jul 24 10:24:25.548125 osdx dnscrypt-proxy[540972]: Loading the set of cloaking rules from [/tmp/tmp7f16gjna]
Jul 24 10:24:25.675138 osdx dnscrypt-proxy[540972]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49200
Jul 24 10:24:25.675152 osdx dnscrypt-proxy[540972]: [RD] OK (DoH) - rtt: 111ms
Jul 24 10:24:25.675159 osdx dnscrypt-proxy[540972]: Server with the lowest initial latency: RD (rtt: 111ms)
Jul 24 10:24:25.675163 osdx dnscrypt-proxy[540972]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:25.721511 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:25.722098 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:25.736779 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:25.886938 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 3

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 52392

Show output

Jul 24 10:24:26.094698 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:26.098062 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:26.098118 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:26.103978 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:26.354435 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:26.420914 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:26.552927 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:26.613091 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:26.705149 osdx ubnt-cfgd[541071]: inactive
Jul 24 10:24:26.727555 osdx dnscrypt-proxy[540972]: Stopped.
Jul 24 10:24:26.727632 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:26.728598 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:26.728721 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:26.792218 osdx WARNING[541135]: No supported link modes on interface eth0
Jul 24 10:24:26.794033 osdx modulelauncher[541135]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:26.794132 osdx modulelauncher[541135]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:26.795288 osdx modulelauncher[541135]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:26.795295 osdx modulelauncher[541135]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:26.815154 osdx ca-certificates[541157]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:27.100591 osdx ca-certificates[541735]: done.
Jul 24 10:24:27.106068 osdx ca-certificates[541744]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:27.568225 osdx ubnt-cfgd[542601]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:27.576666 osdx ca-certificates[542607]: 142 added, 0 removed; done.
Jul 24 10:24:27.579562 osdx ca-certificates[542613]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:27.582304 osdx ca-certificates[542615]: done.
Jul 24 10:24:27.634953 osdx INFO[542627]: FRR daemons did not change
Jul 24 10:24:27.732538 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:27.733098 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:27.781151 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:29.058456 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:29.651459 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:29.708763 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:29.830882 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:29.894797 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:30.010570 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:30.093430 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_RC4_128_SHA'.
Jul 24 10:24:30.207295 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256'.
Jul 24 10:24:30.273823 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:30.395698 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:30.463937 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:30.574093 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:30.686784 osdx ubnt-cfgd[542682]: inactive
Jul 24 10:24:30.712240 osdx INFO[542693]: FRR daemons did not change
Jul 24 10:24:30.724911 osdx ca-certificates[542709]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:31.303715 osdx ubnt-cfgd[543721]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:31.312833 osdx ca-certificates[543726]: 1 added, 0 removed; done.
Jul 24 10:24:31.316808 osdx ca-certificates[543733]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:31.320619 osdx ca-certificates[543735]: done.
Jul 24 10:24:31.350064 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:31.404124 osdx WARNING[543804]: No supported link modes on interface eth0
Jul 24 10:24:31.405700 osdx modulelauncher[543804]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:31.405715 osdx modulelauncher[543804]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:31.407143 osdx modulelauncher[543804]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:31.407156 osdx modulelauncher[543804]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:31.514445 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:31.543653 osdx dnscrypt-proxy[543848]: dnscrypt-proxy 2.0.45
Jul 24 10:24:31.543727 osdx dnscrypt-proxy[543848]: Network connectivity detected
Jul 24 10:24:31.543972 osdx dnscrypt-proxy[543848]: Dropping privileges
Jul 24 10:24:31.546840 osdx dnscrypt-proxy[543848]: Network connectivity detected
Jul 24 10:24:31.546888 osdx dnscrypt-proxy[543848]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:31.546894 osdx dnscrypt-proxy[543848]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:31.546920 osdx dnscrypt-proxy[543848]: Firefox workaround initialized
Jul 24 10:24:31.546926 osdx dnscrypt-proxy[543848]: Loading the set of cloaking rules from [/tmp/tmp8q400nef]
Jul 24 10:24:31.686824 osdx dnscrypt-proxy[543848]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:24:31.686839 osdx dnscrypt-proxy[543848]: [RD] OK (DoH) - rtt: 113ms
Jul 24 10:24:31.686852 osdx dnscrypt-proxy[543848]: Server with the lowest initial latency: RD (rtt: 113ms)
Jul 24 10:24:31.686858 osdx dnscrypt-proxy[543848]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:31.705440 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:31.706072 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:31.732685 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:31.880399 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 4

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49199

Show output

Jul 24 10:24:32.134854 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:32.138120 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:32.138207 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:32.147302 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:32.456857 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:32.519939 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:32.644639 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:32.705894 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:32.791933 osdx ubnt-cfgd[543944]: inactive
Jul 24 10:24:32.817692 osdx dnscrypt-proxy[543848]: Stopped.
Jul 24 10:24:32.817704 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:32.818588 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:32.818682 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:32.879642 osdx WARNING[544008]: No supported link modes on interface eth0
Jul 24 10:24:32.880977 osdx modulelauncher[544008]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:32.880988 osdx modulelauncher[544008]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:32.882471 osdx modulelauncher[544008]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:32.882483 osdx modulelauncher[544008]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:32.901295 osdx ca-certificates[544030]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:33.189270 osdx ca-certificates[544607]: done.
Jul 24 10:24:33.192601 osdx ca-certificates[544616]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:33.771307 osdx ubnt-cfgd[545474]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:33.782237 osdx ca-certificates[545480]: 142 added, 0 removed; done.
Jul 24 10:24:33.785212 osdx ca-certificates[545486]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:33.787939 osdx ca-certificates[545488]: done.
Jul 24 10:24:33.850252 osdx INFO[545500]: FRR daemons did not change
Jul 24 10:24:33.960994 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:33.961578 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:33.977903 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:35.377730 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:36.029406 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:36.105312 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:36.216267 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:36.328072 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:36.442579 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:36.547807 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA'.
Jul 24 10:24:36.662466 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'.
Jul 24 10:24:36.749700 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:36.834271 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:36.911716 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:37.021732 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:37.112210 osdx ubnt-cfgd[545555]: inactive
Jul 24 10:24:37.146003 osdx INFO[545566]: FRR daemons did not change
Jul 24 10:24:37.159540 osdx ca-certificates[545582]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:37.785100 osdx ubnt-cfgd[546594]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:37.795206 osdx ca-certificates[546600]: 1 added, 0 removed; done.
Jul 24 10:24:37.798278 osdx ca-certificates[546606]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:37.801839 osdx ca-certificates[546608]: done.
Jul 24 10:24:37.830093 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:37.881893 osdx WARNING[546677]: No supported link modes on interface eth0
Jul 24 10:24:37.883576 osdx modulelauncher[546677]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:37.883591 osdx modulelauncher[546677]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:37.885158 osdx modulelauncher[546677]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:37.885168 osdx modulelauncher[546677]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:38.010441 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:38.036786 osdx dnscrypt-proxy[546721]: dnscrypt-proxy 2.0.45
Jul 24 10:24:38.036859 osdx dnscrypt-proxy[546721]: Network connectivity detected
Jul 24 10:24:38.037109 osdx dnscrypt-proxy[546721]: Dropping privileges
Jul 24 10:24:38.039899 osdx dnscrypt-proxy[546721]: Network connectivity detected
Jul 24 10:24:38.039934 osdx dnscrypt-proxy[546721]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:38.039939 osdx dnscrypt-proxy[546721]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:38.039961 osdx dnscrypt-proxy[546721]: Firefox workaround initialized
Jul 24 10:24:38.039966 osdx dnscrypt-proxy[546721]: Loading the set of cloaking rules from [/tmp/tmp6f24fybf]
Jul 24 10:24:38.191499 osdx dnscrypt-proxy[546721]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49199
Jul 24 10:24:38.191522 osdx dnscrypt-proxy[546721]: [RD] OK (DoH) - rtt: 134ms
Jul 24 10:24:38.191531 osdx dnscrypt-proxy[546721]: Server with the lowest initial latency: RD (rtt: 134ms)
Jul 24 10:24:38.191537 osdx dnscrypt-proxy[546721]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:38.192814 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:38.193295 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:38.208454 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:38.386415 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 5

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 49200

Show output

Jul 24 10:24:38.631899 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:38.634057 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:38.634116 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:38.642678 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:38.878972 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:38.937590 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:39.047327 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:39.129926 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:39.192828 osdx ubnt-cfgd[546819]: inactive
Jul 24 10:24:39.213883 osdx dnscrypt-proxy[546721]: Stopped.
Jul 24 10:24:39.213977 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:39.214647 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:39.214761 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:39.277633 osdx WARNING[546883]: No supported link modes on interface eth0
Jul 24 10:24:39.279283 osdx modulelauncher[546883]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:39.279298 osdx modulelauncher[546883]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:39.280872 osdx modulelauncher[546883]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:39.280883 osdx modulelauncher[546883]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:39.300042 osdx ca-certificates[546905]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:39.604410 osdx ca-certificates[547483]: done.
Jul 24 10:24:39.608277 osdx ca-certificates[547491]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:40.102786 osdx ubnt-cfgd[548349]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:40.111046 osdx ca-certificates[548354]: 142 added, 0 removed; done.
Jul 24 10:24:40.113982 osdx ca-certificates[548361]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:40.116794 osdx ca-certificates[548363]: done.
Jul 24 10:24:40.162518 osdx INFO[548375]: FRR daemons did not change
Jul 24 10:24:40.272443 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:40.272895 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:40.288586 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:41.712295 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:42.449492 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:42.515268 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:42.672634 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:42.749767 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:42.877836 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:42.992326 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA'.
Jul 24 10:24:43.129308 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'.
Jul 24 10:24:43.243525 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:43.375823 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:43.430468 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:43.548549 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:43.634967 osdx ubnt-cfgd[548430]: inactive
Jul 24 10:24:43.665423 osdx INFO[548441]: FRR daemons did not change
Jul 24 10:24:43.681578 osdx ca-certificates[548457]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:44.432929 osdx ubnt-cfgd[549469]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:44.446534 osdx ca-certificates[549475]: 1 added, 0 removed; done.
Jul 24 10:24:44.458215 osdx ca-certificates[549480]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:44.464689 osdx ca-certificates[549483]: done.
Jul 24 10:24:44.538165 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:44.628464 osdx WARNING[549552]: No supported link modes on interface eth0
Jul 24 10:24:44.635858 osdx modulelauncher[549552]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:44.635914 osdx modulelauncher[549552]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:44.638948 osdx modulelauncher[549552]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:44.638961 osdx modulelauncher[549552]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:44.778581 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:44.802075 osdx dnscrypt-proxy[549596]: dnscrypt-proxy 2.0.45
Jul 24 10:24:44.802155 osdx dnscrypt-proxy[549596]: Network connectivity detected
Jul 24 10:24:44.802486 osdx dnscrypt-proxy[549596]: Dropping privileges
Jul 24 10:24:44.809522 osdx dnscrypt-proxy[549596]: Network connectivity detected
Jul 24 10:24:44.809564 osdx dnscrypt-proxy[549596]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:44.809569 osdx dnscrypt-proxy[549596]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:44.809592 osdx dnscrypt-proxy[549596]: Firefox workaround initialized
Jul 24 10:24:44.809598 osdx dnscrypt-proxy[549596]: Loading the set of cloaking rules from [/tmp/tmp8lq3p5vo]
Jul 24 10:24:44.953734 osdx dnscrypt-proxy[549596]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 49200
Jul 24 10:24:44.953751 osdx dnscrypt-proxy[549596]: [RD] OK (DoH) - rtt: 113ms
Jul 24 10:24:44.953759 osdx dnscrypt-proxy[549596]: Server with the lowest initial latency: RD (rtt: 113ms)
Jul 24 10:24:44.953765 osdx dnscrypt-proxy[549596]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:44.978179 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:44.979094 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:45.010714 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:45.031141 osdx systemd[1]: systemd-timedated.service: Deactivated successfully.
Jul 24 10:24:45.203093 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

Example 6

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA
set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
set service dns proxy log level 0
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run the command show host lookup teldat.com type A on DUT0 and check whether the output contains the following tokens:

teldat.com has address 19.18.17.16

Step 3: Run the command system journal show | cat on DUT0 and check whether the output contains the following tokens:

Cipher suite: 52392

Show output

Jul 24 10:24:45.453318 osdx systemd-journald[2180]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free.
Jul 24 10:24:45.454074 osdx systemd-journald[2180]: Received client request to rotate journal, rotating.
Jul 24 10:24:45.454132 osdx systemd-journald[2180]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b.
Jul 24 10:24:45.464858 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'system journal clear'.
Jul 24 10:24:45.744564 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:45.805264 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'delete '.
Jul 24 10:24:45.950501 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system login user admin authentication plaintext-password ******'.
Jul 24 10:24:46.035866 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:46.094989 osdx ubnt-cfgd[549694]: inactive
Jul 24 10:24:46.117423 osdx dnscrypt-proxy[549596]: Stopped.
Jul 24 10:24:46.117456 osdx systemd[1]: Stopping dnscrypt-proxy.service - DNSCrypt client proxy...
Jul 24 10:24:46.118734 osdx systemd[1]: dnscrypt-proxy.service: Deactivated successfully.
Jul 24 10:24:46.118839 osdx systemd[1]: Stopped dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:46.188279 osdx WARNING[549758]: No supported link modes on interface eth0
Jul 24 10:24:46.190080 osdx modulelauncher[549758]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:46.190094 osdx modulelauncher[549758]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:46.191611 osdx modulelauncher[549758]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:46.191625 osdx modulelauncher[549758]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:46.222034 osdx ca-certificates[549780]: Clearing symlinks in /etc/ssl/certs...
Jul 24 10:24:46.627334 osdx ca-certificates[550358]: done.
Jul 24 10:24:46.630687 osdx ca-certificates[550366]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:47.210984 osdx ubnt-cfgd[551224]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:47.221585 osdx ca-certificates[551230]: 142 added, 0 removed; done.
Jul 24 10:24:47.224640 osdx ca-certificates[551236]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:47.227810 osdx ca-certificates[551238]: done.
Jul 24 10:24:47.273390 osdx INFO[551250]: FRR daemons did not change
Jul 24 10:24:47.376556 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:47.377014 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:47.399324 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:48.876825 osdx OSDxCLI[414651]: User 'admin' entered the configuration menu.
Jul 24 10:24:49.538253 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Jul 24 10:24:49.611783 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Jul 24 10:24:49.721057 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Jul 24 10:24:49.785825 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Jul 24 10:24:49.895884 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414'.
Jul 24 10:24:49.956309 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 1 algorithm TLS_RSA_WITH_3DES_EDE_CBC_SHA'.
Jul 24 10:24:50.055320 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy cipher 2 algorithm TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256'.
Jul 24 10:24:50.113091 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 24 10:24:50.249998 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Jul 24 10:24:50.308507 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 24 10:24:50.446474 osdx OSDxCLI[414651]: User 'admin' added a new cfg line: 'show working'.
Jul 24 10:24:50.523128 osdx ubnt-cfgd[551305]: inactive
Jul 24 10:24:50.562569 osdx INFO[551316]: FRR daemons did not change
Jul 24 10:24:50.587251 osdx ca-certificates[551331]: Updating certificates in /etc/ssl/certs...
Jul 24 10:24:51.308119 osdx ubnt-cfgd[552344]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 24 10:24:51.318628 osdx ca-certificates[552350]: 1 added, 0 removed; done.
Jul 24 10:24:51.321728 osdx ca-certificates[552356]: Running hooks in /etc/ca-certificates/update.d...
Jul 24 10:24:51.324701 osdx ca-certificates[552358]: done.
Jul 24 10:24:51.366080 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 24 10:24:51.423042 osdx WARNING[552427]: No supported link modes on interface eth0
Jul 24 10:24:51.424862 osdx modulelauncher[552427]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Jul 24 10:24:51.424876 osdx modulelauncher[552427]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Jul 24 10:24:51.426416 osdx modulelauncher[552427]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Jul 24 10:24:51.426425 osdx modulelauncher[552427]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Jul 24 10:24:51.538400 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 24 10:24:51.561518 osdx dnscrypt-proxy[552471]: dnscrypt-proxy 2.0.45
Jul 24 10:24:51.561586 osdx dnscrypt-proxy[552471]: Network connectivity detected
Jul 24 10:24:51.561788 osdx dnscrypt-proxy[552471]: Dropping privileges
Jul 24 10:24:51.564435 osdx dnscrypt-proxy[552471]: Network connectivity detected
Jul 24 10:24:51.564471 osdx dnscrypt-proxy[552471]: Now listening to 127.0.0.1:53 [UDP]
Jul 24 10:24:51.564476 osdx dnscrypt-proxy[552471]: Now listening to 127.0.0.1:53 [TCP]
Jul 24 10:24:51.564497 osdx dnscrypt-proxy[552471]: Firefox workaround initialized
Jul 24 10:24:51.564503 osdx dnscrypt-proxy[552471]: Loading the set of cloaking rules from [/tmp/tmpqmm5mqws]
Jul 24 10:24:51.716996 osdx cfgd[1923]: [414651]Completed change to active configuration
Jul 24 10:24:51.717676 osdx OSDxCLI[414651]: User 'admin' committed the configuration.
Jul 24 10:24:51.743054 osdx dnscrypt-proxy[552471]: [RD] TLS version: 303 - Protocol: h2 - Cipher suite: 52392
Jul 24 10:24:51.743086 osdx dnscrypt-proxy[552471]: [RD] OK (DoH) - rtt: 155ms
Jul 24 10:24:51.743096 osdx dnscrypt-proxy[552471]: Server with the lowest initial latency: RD (rtt: 155ms)
Jul 24 10:24:51.743105 osdx dnscrypt-proxy[552471]: dnscrypt-proxy is ready - live servers: 1
Jul 24 10:24:51.745554 osdx OSDxCLI[414651]: User 'admin' left the configuration menu.
Jul 24 10:24:51.905235 osdx OSDxCLI[414651]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.