Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash a40f12bde09499f71a7f233a3d6b7dab165d2d4b8f21456db726f7a863d7a414 set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy log level 0 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash a960b6596f73014de324fd8c1bb671f5c0fa1f425372a76c9022a6c5e7231de3 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns resolver local set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 10.215.168.64 from DUT1:
admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1Show output
PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data. 64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.630 ms --- 10.215.168.64 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.630/0.630/0.630/0.000 ms
Step 4: Run the command show host lookup teldat.com type A on DUT1 and check whether the output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Step 5: Run the command system journal show | cat on DUT1 and expect the following output:
Show output
Jul 24 10:25:14.255040 osdx systemd-journald[2060]: Runtime Journal (/run/log/journal/81882c36df9d4e5d8ea319c786369faf) is 908.0K, max 6.4M, 5.5M free. Jul 24 10:25:14.258665 osdx systemd-journald[2060]: Received client request to rotate journal, rotating. Jul 24 10:25:14.258740 osdx systemd-journald[2060]: Vacuuming done, freed 0B of archived journals from /run/log/journal/81882c36df9d4e5d8ea319c786369faf. Jul 24 10:25:14.265504 osdx OSDxCLI[2419]: User 'admin' executed a new command: 'system journal clear'. Jul 24 10:25:14.462113 osdx OSDxCLI[2419]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 10:25:15.646553 osdx OSDxCLI[2419]: User 'admin' entered the configuration menu. Jul 24 10:25:15.730984 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jul 24 10:25:15.800523 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 24 10:25:15.892702 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service ssh'. Jul 24 10:25:15.954142 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'show working'. Jul 24 10:25:16.041236 osdx ubnt-cfgd[376178]: inactive Jul 24 10:25:16.116829 osdx INFO[376202]: FRR daemons did not change Jul 24 10:25:16.142681 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 10:25:16.193624 osdx WARNING[376273]: No supported link modes on interface eth0 Jul 24 10:25:16.195084 osdx modulelauncher[376273]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 10:25:16.195097 osdx modulelauncher[376273]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 10:25:16.196342 osdx modulelauncher[376273]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 10:25:16.196353 osdx modulelauncher[376273]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 10:25:16.291099 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 24 10:25:16.303477 osdx sshd[376334]: Server listening on 0.0.0.0 port 22. Jul 24 10:25:16.303676 osdx sshd[376334]: Server listening on :: port 22. Jul 24 10:25:16.303800 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 24 10:25:16.484102 osdx cfgd[1777]: [2419]Completed change to active configuration Jul 24 10:25:16.485096 osdx OSDxCLI[2419]: User 'admin' committed the configuration. Jul 24 10:25:16.506330 osdx OSDxCLI[2419]: User 'admin' left the configuration menu. Jul 24 10:25:16.666113 osdx OSDxCLI[2419]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 24 10:25:18.599819 osdx OSDxCLI[2419]: User 'admin' entered the configuration menu. Jul 24 10:25:18.661792 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jul 24 10:25:18.773801 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jul 24 10:25:18.841736 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jul 24 10:25:18.944329 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Jul 24 10:25:19.005645 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Jul 24 10:25:19.125917 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Jul 24 10:25:19.192740 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash a960b6596f73014de324fd8c1bb671f5c0fa1f425372a76c9022a6c5e7231de3'. Jul 24 10:25:19.286340 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Jul 24 10:25:19.337461 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jul 24 10:25:19.463788 osdx OSDxCLI[2419]: User 'admin' added a new cfg line: 'show working'. Jul 24 10:25:19.573859 osdx ubnt-cfgd[376399]: inactive Jul 24 10:25:19.600039 osdx INFO[376408]: FRR daemons did not change Jul 24 10:25:19.614683 osdx ca-certificates[376424]: Updating certificates in /etc/ssl/certs... Jul 24 10:25:20.124842 osdx ubnt-cfgd[377436]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 24 10:25:20.132519 osdx ca-certificates[377441]: 1 added, 0 removed; done. Jul 24 10:25:20.135612 osdx ca-certificates[377448]: Running hooks in /etc/ca-certificates/update.d... Jul 24 10:25:20.138617 osdx ca-certificates[377450]: done. Jul 24 10:25:20.258982 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 24 10:25:20.272041 osdx cfgd[1777]: [2419]Completed change to active configuration Jul 24 10:25:20.272659 osdx OSDxCLI[2419]: User 'admin' committed the configuration. Jul 24 10:25:20.289744 osdx OSDxCLI[2419]: User 'admin' left the configuration menu. Jul 24 10:25:20.450969 osdx OSDxCLI[2419]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 24 10:25:20.474701 osdx dnscrypt-proxy[377509]: dnscrypt-proxy 2.0.45 Jul 24 10:25:20.474760 osdx dnscrypt-proxy[377509]: Network connectivity detected Jul 24 10:25:20.474958 osdx dnscrypt-proxy[377509]: Dropping privileges Jul 24 10:25:20.477848 osdx dnscrypt-proxy[377509]: Network connectivity detected Jul 24 10:25:20.477883 osdx dnscrypt-proxy[377509]: Now listening to 127.0.0.1:53 [UDP] Jul 24 10:25:20.477888 osdx dnscrypt-proxy[377509]: Now listening to 127.0.0.1:53 [TCP] Jul 24 10:25:20.477904 osdx dnscrypt-proxy[377509]: Firefox workaround initialized Jul 24 10:25:20.477908 osdx dnscrypt-proxy[377509]: Loading the set of cloaking rules from [/tmp/tmpj1zdxeac] Jul 24 10:25:21.741880 osdx dnscrypt-proxy[377509]: [DUT0] may be a lying resolver Jul 24 10:25:21.741890 osdx dnscrypt-proxy[377509]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Jul 24 10:25:21.741898 osdx dnscrypt-proxy[377509]: [DUT0] OK (DoH) - rtt: 1020ms Jul 24 10:25:21.741904 osdx dnscrypt-proxy[377509]: Server with the lowest initial latency: DUT0 (rtt: 1020ms) Jul 24 10:25:21.741909 osdx dnscrypt-proxy[377509]: dnscrypt-proxy is ready - live servers: 1 Jul 24 10:25:25.536227 osdx OSDxCLI[2419]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'. Jul 24 10:25:35.667770 osdx OSDxCLI[2419]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.