Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash 9d38fcf8d31bd0c819098a15b7711210323b893c2912cc4defd8ae8cb3fb99fb set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy log level 0 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash 4fe081a78d77d58bc76c17ee16d4d381732aafc7f6eca553698041b62c09b9d1 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns resolver local set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 10.215.168.64 from DUT1:
admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1Show output
PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data. 64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.596 ms --- 10.215.168.64 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.596/0.596/0.596/0.000 ms
Step 4: Run the command show host lookup teldat.com type A on DUT1 and check whether the output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Step 5: Run the command system journal show | cat on DUT1 and expect the following output:
Show output
Sep 17 00:30:52.400638 osdx systemd-journald[2055]: Runtime Journal (/run/log/journal/db82908865474f16bd4eb2f983136eff) is 896.0K, max 6.4M, 5.6M free. Sep 17 00:30:52.403991 osdx systemd-journald[2055]: Received client request to rotate journal, rotating. Sep 17 00:30:52.404075 osdx systemd-journald[2055]: Vacuuming done, freed 0B of archived journals from /run/log/journal/db82908865474f16bd4eb2f983136eff. Sep 17 00:30:52.413792 osdx OSDxCLI[844846]: User 'admin' executed a new command: 'system journal clear'. Sep 17 00:30:52.702307 osdx OSDxCLI[844846]: User 'admin' executed a new command: 'system coredump delete all'. Sep 17 00:30:53.940007 osdx OSDxCLI[844846]: User 'admin' entered the configuration menu. Sep 17 00:30:54.035283 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Sep 17 00:30:54.103163 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Sep 17 00:30:54.234061 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service ssh'. Sep 17 00:30:54.318519 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'show working'. Sep 17 00:30:54.412414 osdx ubnt-cfgd[866978]: inactive Sep 17 00:30:54.496994 osdx INFO[867004]: FRR daemons did not change Sep 17 00:30:54.527961 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Sep 17 00:30:54.580497 osdx WARNING[867075]: No supported link modes on interface eth0 Sep 17 00:30:54.582344 osdx modulelauncher[867075]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Sep 17 00:30:54.582405 osdx modulelauncher[867075]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Sep 17 00:30:54.583604 osdx modulelauncher[867075]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Sep 17 00:30:54.583649 osdx modulelauncher[867075]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Sep 17 00:30:54.668291 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Sep 17 00:30:54.681827 osdx sshd[867136]: Server listening on 0.0.0.0 port 22. Sep 17 00:30:54.682006 osdx sshd[867136]: Server listening on :: port 22. Sep 17 00:30:54.682111 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Sep 17 00:30:54.857490 osdx cfgd[1770]: [844846]Completed change to active configuration Sep 17 00:30:54.858373 osdx OSDxCLI[844846]: User 'admin' committed the configuration. Sep 17 00:30:54.886508 osdx OSDxCLI[844846]: User 'admin' left the configuration menu. Sep 17 00:30:55.039013 osdx OSDxCLI[844846]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Sep 17 00:30:57.170849 osdx OSDxCLI[844846]: User 'admin' entered the configuration menu. Sep 17 00:30:57.279781 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Sep 17 00:30:57.351462 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Sep 17 00:30:57.465105 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Sep 17 00:30:57.545433 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Sep 17 00:30:57.631668 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Sep 17 00:30:57.691751 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Sep 17 00:30:57.787244 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 4fe081a78d77d58bc76c17ee16d4d381732aafc7f6eca553698041b62c09b9d1'. Sep 17 00:30:57.858180 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Sep 17 00:30:57.952764 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'set service dns resolver local'. Sep 17 00:30:58.038390 osdx OSDxCLI[844846]: User 'admin' added a new cfg line: 'show working'. Sep 17 00:30:58.129856 osdx ubnt-cfgd[867201]: inactive Sep 17 00:30:58.156604 osdx INFO[867210]: FRR daemons did not change Sep 17 00:30:58.195985 osdx ca-certificates[867225]: Updating certificates in /etc/ssl/certs... Sep 17 00:30:58.753748 osdx ubnt-cfgd[868238]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Sep 17 00:30:58.766144 osdx ca-certificates[868242]: 1 added, 0 removed; done. Sep 17 00:30:58.769289 osdx ca-certificates[868250]: Running hooks in /etc/ca-certificates/update.d... Sep 17 00:30:58.773210 osdx ca-certificates[868252]: done. Sep 17 00:30:58.900367 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Sep 17 00:30:58.916366 osdx cfgd[1770]: [844846]Completed change to active configuration Sep 17 00:30:58.917111 osdx OSDxCLI[844846]: User 'admin' committed the configuration. Sep 17 00:30:58.932891 osdx OSDxCLI[844846]: User 'admin' left the configuration menu. Sep 17 00:30:59.100411 osdx OSDxCLI[844846]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Sep 17 00:30:59.110091 osdx dnscrypt-proxy[868311]: dnscrypt-proxy 2.0.45 Sep 17 00:30:59.110147 osdx dnscrypt-proxy[868311]: Network connectivity detected Sep 17 00:30:59.110336 osdx dnscrypt-proxy[868311]: Dropping privileges Sep 17 00:30:59.112988 osdx dnscrypt-proxy[868311]: Network connectivity detected Sep 17 00:30:59.113015 osdx dnscrypt-proxy[868311]: Now listening to 127.0.0.1:53 [UDP] Sep 17 00:30:59.113018 osdx dnscrypt-proxy[868311]: Now listening to 127.0.0.1:53 [TCP] Sep 17 00:30:59.113033 osdx dnscrypt-proxy[868311]: Firefox workaround initialized Sep 17 00:30:59.113036 osdx dnscrypt-proxy[868311]: Loading the set of cloaking rules from [/tmp/tmpjvflbw10] Sep 17 00:30:59.313906 osdx dnscrypt-proxy[868311]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Sep 17 00:30:59.313923 osdx dnscrypt-proxy[868311]: [DUT0] OK (DoH) - rtt: 110ms Sep 17 00:30:59.313932 osdx dnscrypt-proxy[868311]: Server with the lowest initial latency: DUT0 (rtt: 110ms) Sep 17 00:30:59.313937 osdx dnscrypt-proxy[868311]: dnscrypt-proxy is ready - live servers: 1 Sep 17 00:31:04.230623 osdx OSDxCLI[844846]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'. Sep 17 00:31:14.416266 osdx OSDxCLI[844846]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.