Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash dcd7c79d517ef035e12eb8156d635988f90b76b5f45de016aad64fcb8fc998ba set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy log level 0 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash 6d79ba1b190f78d54df2c58471f7d0d28337b1465215f785c7f1dc978fc53814 set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns resolver local set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Run command system journal show | cat at DUT1 and expect this output:
Show output
Mar 21 16:24:14.438340 osdx systemd-journald[1788]: Runtime Journal (/run/log/journal/861e844a51d845da80ca1ef91808d3be) is 1.0M, max 7.2M, 6.2M free. Mar 21 16:24:14.438785 osdx systemd-journald[1788]: Received client request to rotate journal, rotating. Mar 21 16:24:14.438845 osdx systemd-journald[1788]: Vacuuming done, freed 0B of archived journals from /run/log/journal/861e844a51d845da80ca1ef91808d3be. Mar 21 16:24:14.459573 osdx OSDxCLI[2049]: User 'admin' executed a new command: 'system journal clear'. Mar 21 16:24:15.251582 osdx osdx-coredump[28709]: Deleting all coredumps in /opt/vyatta/etc/config/coredump... Mar 21 16:24:15.266784 osdx OSDxCLI[2049]: User 'admin' executed a new command: 'system coredump delete all'. Mar 21 16:24:17.506455 osdx OSDxCLI[2049]: User 'admin' entered the configuration menu. Mar 21 16:24:17.703933 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Mar 21 16:24:17.825716 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Mar 21 16:24:17.933781 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service ssh'. Mar 21 16:24:18.111463 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'show working'. Mar 21 16:24:18.256541 osdx ubnt-cfgd[28732]: inactive Mar 21 16:24:18.416104 osdx INFO[28750]: FRR daemons did not change Mar 21 16:24:18.743132 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Mar 21 16:24:18.762098 osdx sshd[28864]: Server listening on 0.0.0.0 port 22. Mar 21 16:24:18.762414 osdx sshd[28864]: Server listening on :: port 22. Mar 21 16:24:18.765242 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Mar 21 16:24:18.796676 osdx cfgd[1473]: [2049]Completed change to active configuration Mar 21 16:24:18.813474 osdx OSDxCLI[2049]: User 'admin' committed the configuration. Mar 21 16:24:18.844552 osdx OSDxCLI[2049]: User 'admin' left the configuration menu. Mar 21 16:24:19.059215 osdx OSDxCLI[2049]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Mar 21 16:24:22.847497 osdx OSDxCLI[2049]: User 'admin' entered the configuration menu. Mar 21 16:24:22.987544 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Mar 21 16:24:23.150868 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Mar 21 16:24:23.277657 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Mar 21 16:24:23.425934 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Mar 21 16:24:23.547660 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Mar 21 16:24:23.742838 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Mar 21 16:24:23.932589 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 6d79ba1b190f78d54df2c58471f7d0d28337b1465215f785c7f1dc978fc53814'. Mar 21 16:24:24.124715 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Mar 21 16:24:24.306879 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'set service dns resolver local'. Mar 21 16:24:24.446399 osdx OSDxCLI[2049]: User 'admin' added a new cfg line: 'show working'. Mar 21 16:24:24.617696 osdx ubnt-cfgd[28925]: inactive Mar 21 16:24:24.752849 osdx INFO[28937]: FRR daemons did not change Mar 21 16:24:24.775764 osdx ca-certificates[28952]: Updating certificates in /etc/ssl/certs... Mar 21 16:24:25.655985 osdx ca-certificates[29956]: 1 added, 0 removed; done. Mar 21 16:24:25.660782 osdx ca-certificates[29963]: Running hooks in /etc/ca-certificates/update.d... Mar 21 16:24:25.665504 osdx ca-certificates[29965]: done. Mar 21 16:24:25.835225 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Mar 21 16:24:25.838400 osdx cfgd[1473]: [2049]Completed change to active configuration Mar 21 16:24:25.843439 osdx OSDxCLI[2049]: User 'admin' committed the configuration. Mar 21 16:24:25.878582 osdx dnscrypt-proxy[30025]: dnscrypt-proxy 2.0.45 Mar 21 16:24:25.879144 osdx dnscrypt-proxy[30025]: Network connectivity detected Mar 21 16:24:25.879594 osdx dnscrypt-proxy[30025]: Dropping privileges Mar 21 16:24:25.882597 osdx dnscrypt-proxy[30025]: Network connectivity detected Mar 21 16:24:25.882915 osdx dnscrypt-proxy[30025]: Now listening to 127.0.0.1:53 [UDP] Mar 21 16:24:25.882983 osdx dnscrypt-proxy[30025]: Now listening to 127.0.0.1:53 [TCP] Mar 21 16:24:25.883067 osdx dnscrypt-proxy[30025]: Firefox workaround initialized Mar 21 16:24:25.883147 osdx dnscrypt-proxy[30025]: Loading the set of cloaking rules from [/tmp/tmp66t7zie9] Mar 21 16:24:25.886165 osdx OSDxCLI[2049]: User 'admin' left the configuration menu. Mar 21 16:24:26.104454 osdx dnscrypt-proxy[30025]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Mar 21 16:24:26.104471 osdx dnscrypt-proxy[30025]: [DUT0] OK (DoH) - rtt: 102ms Mar 21 16:24:26.104489 osdx dnscrypt-proxy[30025]: Server with the lowest initial latency: DUT0 (rtt: 102ms) Mar 21 16:24:26.104498 osdx dnscrypt-proxy[30025]: dnscrypt-proxy is ready - live servers: 1 Mar 21 16:24:26.106543 osdx OSDxCLI[2049]: User 'admin' executed a new command: 'system journal show | cat'.