Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash ce5bfb07edc17945305c52b77f54ddda93ca3edba3b5213add895927eb42f82a
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash fc983a43c8f2d93efe020c3623e14a02d4e5c6efe803dee6cac810286527b2b1
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Jun 25 09:53:33.260705 osdx systemd-journald[1559]: Runtime Journal (/run/log/journal/4da79601fcd1495d87d4eb077a64e8bc) is 1012.0K, max 7.2M, 6.2M free.
Jun 25 09:53:33.263983 osdx systemd-journald[1559]: Received client request to rotate journal, rotating.
Jun 25 09:53:33.264032 osdx systemd-journald[1559]: Vacuuming done, freed 0B of archived journals from /run/log/journal/4da79601fcd1495d87d4eb077a64e8bc.
Jun 25 09:53:33.270830 osdx OSDxCLI[1830]: User 'admin' executed a new command: 'system journal clear'.
Jun 25 09:53:33.470334 osdx OSDxCLI[1830]: User 'admin' executed a new command: 'system coredump delete all'.
Jun 25 09:53:34.407383 osdx OSDxCLI[1830]: User 'admin' entered the configuration menu.
Jun 25 09:53:34.479753 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Jun 25 09:53:34.567400 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jun 25 09:53:34.624097 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service ssh'.
Jun 25 09:53:34.738613 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'show working'.
Jun 25 09:53:34.806914 osdx ubnt-cfgd[142341]: inactive
Jun 25 09:53:34.829677 osdx INFO[142355]: FRR daemons did not change
Jun 25 09:53:34.851972 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jun 25 09:53:34.996201 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Jun 25 09:53:35.007500 osdx sshd[142469]: Server listening on 0.0.0.0 port 22.
Jun 25 09:53:35.007698 osdx sshd[142469]: Server listening on :: port 22.
Jun 25 09:53:35.007791 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Jun 25 09:53:35.127628 osdx cfgd[1261]: [1830]Completed change to active configuration
Jun 25 09:53:35.152164 osdx OSDxCLI[1830]: User 'admin' committed the configuration.
Jun 25 09:53:35.171806 osdx OSDxCLI[1830]: User 'admin' left the configuration menu.
Jun 25 09:53:35.315457 osdx OSDxCLI[1830]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Jun 25 09:53:37.111505 osdx OSDxCLI[1830]: User 'admin' entered the configuration menu.
Jun 25 09:53:37.176284 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Jun 25 09:53:37.298208 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Jun 25 09:53:37.354914 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Jun 25 09:53:37.496291 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Jun 25 09:53:37.556521 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Jun 25 09:53:37.653082 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Jun 25 09:53:37.721650 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash fc983a43c8f2d93efe020c3623e14a02d4e5c6efe803dee6cac810286527b2b1'.
Jun 25 09:53:37.812675 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jun 25 09:53:37.870449 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Jun 25 09:53:37.990692 osdx OSDxCLI[1830]: User 'admin' added a new cfg line: 'show working'.
Jun 25 09:53:38.078501 osdx ubnt-cfgd[142526]: inactive
Jun 25 09:53:38.106719 osdx INFO[142534]: FRR daemons did not change
Jun 25 09:53:38.141285 osdx ca-certificates[142549]: Updating certificates in /etc/ssl/certs...
Jun 25 09:53:38.661144 osdx ubnt-cfgd[143548]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jun 25 09:53:38.674990 osdx ca-certificates[143552]: 1 added, 0 removed; done.
Jun 25 09:53:38.678221 osdx ca-certificates[143560]: Running hooks in /etc/ca-certificates/update.d...
Jun 25 09:53:38.681455 osdx ca-certificates[143562]: done.
Jun 25 09:53:38.816312 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jun 25 09:53:38.818397 osdx cfgd[1261]: [1830]Completed change to active configuration
Jun 25 09:53:38.820371 osdx OSDxCLI[1830]: User 'admin' committed the configuration.
Jun 25 09:53:38.840158 osdx OSDxCLI[1830]: User 'admin' left the configuration menu.
Jun 25 09:53:39.003157 osdx dnscrypt-proxy[143622]: dnscrypt-proxy 2.0.45
Jun 25 09:53:39.003231 osdx dnscrypt-proxy[143622]: Network connectivity detected
Jun 25 09:53:39.003447 osdx dnscrypt-proxy[143622]: Dropping privileges
Jun 25 09:53:39.024864 osdx dnscrypt-proxy[143622]: Network connectivity detected
Jun 25 09:53:39.025095 osdx dnscrypt-proxy[143622]: Now listening to 127.0.0.1:53 [UDP]
Jun 25 09:53:39.025147 osdx dnscrypt-proxy[143622]: Now listening to 127.0.0.1:53 [TCP]
Jun 25 09:53:39.025220 osdx dnscrypt-proxy[143622]: Firefox workaround initialized
Jun 25 09:53:39.025255 osdx dnscrypt-proxy[143622]: Loading the set of cloaking rules from [/tmp/tmpl1jum_9_]
Jun 25 09:53:39.026044 osdx OSDxCLI[1830]: User 'admin' executed a new command: 'system journal show | cat'.
Jun 25 09:53:39.295524 osdx dnscrypt-proxy[143622]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Jun 25 09:53:39.295540 osdx dnscrypt-proxy[143622]: [DUT0] OK (DoH) - rtt: 113ms
Jun 25 09:53:39.295548 osdx dnscrypt-proxy[143622]: Server with the lowest initial latency: DUT0 (rtt: 113ms)
Jun 25 09:53:39.295553 osdx dnscrypt-proxy[143622]: dnscrypt-proxy is ready - live servers: 1

---