Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 56f84956a81b8326accde7f3159265ae8dee5f1377cc2cbee7baf4ff8b8c82c6
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash 39f48ff1beed8e3ec2edca637eb2b3a353352081258766497512231dfcfc2fa5
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Mar 10 12:52:25.270421 osdx systemd-journald[1541]: Runtime Journal (/run/log/journal/37bd014e8df84dd2aee0f9bf8ac2600d) is 992.0K, max 7.2M, 6.2M free.
Mar 10 12:52:25.274381 osdx systemd-journald[1541]: Received client request to rotate journal, rotating.
Mar 10 12:52:25.274437 osdx systemd-journald[1541]: Vacuuming done, freed 0B of archived journals from /run/log/journal/37bd014e8df84dd2aee0f9bf8ac2600d.
Mar 10 12:52:25.279439 osdx OSDxCLI[145235]: User 'admin' executed a new command: 'system journal clear'.
Mar 10 12:52:25.731712 osdx osdx-coredump[231273]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Mar 10 12:52:25.739355 osdx OSDxCLI[145235]: User 'admin' executed a new command: 'system coredump delete all'.
Mar 10 12:52:26.959399 osdx OSDxCLI[145235]: User 'admin' entered the configuration menu.
Mar 10 12:52:27.073417 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Mar 10 12:52:27.128716 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Mar 10 12:52:27.223100 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service ssh'.
Mar 10 12:52:27.297260 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'show working'.
Mar 10 12:52:27.403344 osdx INFO[231304]: FRR daemons did not change
Mar 10 12:52:27.422412 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Mar 10 12:52:27.606829 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Mar 10 12:52:27.619056 osdx sshd[231374]: Server listening on 0.0.0.0 port 22.
Mar 10 12:52:27.619295 osdx sshd[231374]: Server listening on :: port 22.
Mar 10 12:52:27.619421 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Mar 10 12:52:27.642974 osdx cfgd[1242]: [145235]Completed change to active configuration
Mar 10 12:52:27.673646 osdx OSDxCLI[145235]: User 'admin' committed the configuration.
Mar 10 12:52:27.696204 osdx OSDxCLI[145235]: User 'admin' left the configuration menu.
Mar 10 12:52:27.859547 osdx OSDxCLI[145235]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Mar 10 12:52:29.723362 osdx OSDxCLI[145235]: User 'admin' entered the configuration menu.
Mar 10 12:52:29.781000 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Mar 10 12:52:29.874109 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Mar 10 12:52:29.931907 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Mar 10 12:52:30.036402 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Mar 10 12:52:30.090338 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Mar 10 12:52:30.187957 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Mar 10 12:52:30.252087 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 39f48ff1beed8e3ec2edca637eb2b3a353352081258766497512231dfcfc2fa5'.
Mar 10 12:52:30.338485 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Mar 10 12:52:30.391581 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Mar 10 12:52:30.517370 osdx OSDxCLI[145235]: User 'admin' added a new cfg line: 'show working'.
Mar 10 12:52:30.589929 osdx INFO[231437]: FRR daemons did not change
Mar 10 12:52:30.603626 osdx ca-certificates[231453]: Updating certificates in /etc/ssl/certs...
Mar 10 12:52:31.104329 osdx ca-certificates[232458]: 1 added, 0 removed; done.
Mar 10 12:52:31.107096 osdx ca-certificates[232463]: Running hooks in /etc/ca-certificates/update.d...
Mar 10 12:52:31.109724 osdx ca-certificates[232465]: done.
Mar 10 12:52:31.214830 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Mar 10 12:52:31.217024 osdx cfgd[1242]: [145235]Completed change to active configuration
Mar 10 12:52:31.221042 osdx OSDxCLI[145235]: User 'admin' committed the configuration.
Mar 10 12:52:31.239601 osdx dnscrypt-proxy[232525]: dnscrypt-proxy 2.0.45
Mar 10 12:52:31.239864 osdx dnscrypt-proxy[232525]: Network connectivity detected
Mar 10 12:52:31.240095 osdx dnscrypt-proxy[232525]: Dropping privileges
Mar 10 12:52:31.242069 osdx dnscrypt-proxy[232525]: Network connectivity detected
Mar 10 12:52:31.242245 osdx dnscrypt-proxy[232525]: Now listening to 127.0.0.1:53 [UDP]
Mar 10 12:52:31.242290 osdx dnscrypt-proxy[232525]: Now listening to 127.0.0.1:53 [TCP]
Mar 10 12:52:31.242347 osdx dnscrypt-proxy[232525]: Firefox workaround initialized
Mar 10 12:52:31.242438 osdx dnscrypt-proxy[232525]: Loading the set of cloaking rules from [/tmp/tmp7z0aco4b]
Mar 10 12:52:31.251001 osdx OSDxCLI[145235]: User 'admin' left the configuration menu.
Mar 10 12:52:31.360237 osdx dnscrypt-proxy[232525]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Mar 10 12:52:31.360257 osdx dnscrypt-proxy[232525]: [DUT0] OK (DoH) - rtt: 75ms
Mar 10 12:52:31.360267 osdx dnscrypt-proxy[232525]: Server with the lowest initial latency: DUT0 (rtt: 75ms)
Mar 10 12:52:31.360273 osdx dnscrypt-proxy[232525]: dnscrypt-proxy is ready - live servers: 1

---