Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 10.215.168.80/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 7a276ec6f016f07a2d927114530d93b01a6cd79114899028c0cea34c7e3237d1
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.81/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash 1265399cc19acda6a09e39ea5b66d5c5e1e2128599f639309475f401ae04340c
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.80
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.80
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Jul 28 14:27:56.663108 osdx systemd-journald[1562]: Runtime Journal (/run/log/journal/3248c2e55740427a863e61fc635dbed1) is 1.0M, max 7.2M, 6.2M free.
Jul 28 14:27:56.669186 osdx systemd-journald[1562]: Received client request to rotate journal, rotating.
Jul 28 14:27:56.669263 osdx systemd-journald[1562]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3248c2e55740427a863e61fc635dbed1.
Jul 28 14:27:56.692116 osdx OSDxCLI[163666]: User 'admin' executed a new command: 'system journal clear'.
Jul 28 14:27:57.189510 osdx OSDxCLI[163666]: User 'admin' executed a new command: 'system coredump delete all'.
Jul 28 14:28:04.404930 osdx OSDxCLI[163666]: User 'admin' entered the configuration menu.
Jul 28 14:28:04.668900 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.81/24'.
Jul 28 14:28:04.823447 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jul 28 14:28:04.968944 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service ssh'.
Jul 28 14:28:05.176448 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'show working'.
Jul 28 14:28:05.393121 osdx ubnt-cfgd[303445]: inactive
Jul 28 14:28:05.465291 osdx INFO[303459]: FRR daemons did not change
Jul 28 14:28:05.523378 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jul 28 14:28:05.776347 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Jul 28 14:28:05.801978 osdx sshd[303575]: Server listening on 0.0.0.0 port 22.
Jul 28 14:28:05.802369 osdx sshd[303575]: Server listening on :: port 22.
Jul 28 14:28:05.802614 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Jul 28 14:28:05.843831 osdx cfgd[1258]: [163666]Completed change to active configuration
Jul 28 14:28:05.867817 osdx OSDxCLI[163666]: User 'admin' committed the configuration.
Jul 28 14:28:05.910723 osdx OSDxCLI[163666]: User 'admin' left the configuration menu.
Jul 28 14:28:06.150653 osdx OSDxCLI[163666]: User 'admin' executed a new command: 'ping 10.215.168.80 count 1 size 56 timeout 1'.
Jul 28 14:28:11.001881 osdx OSDxCLI[163666]: User 'admin' entered the configuration menu.
Jul 28 14:28:11.160544 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.80'.
Jul 28 14:28:11.332069 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Jul 28 14:28:11.489274 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Jul 28 14:28:11.721784 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Jul 28 14:28:11.901443 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Jul 28 14:28:12.063777 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.80'.
Jul 28 14:28:12.288746 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 1265399cc19acda6a09e39ea5b66d5c5e1e2128599f639309475f401ae04340c'.
Jul 28 14:28:12.460830 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jul 28 14:28:12.640485 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Jul 28 14:28:12.844870 osdx OSDxCLI[163666]: User 'admin' added a new cfg line: 'show working'.
Jul 28 14:28:13.063508 osdx ubnt-cfgd[303632]: inactive
Jul 28 14:28:13.143292 osdx INFO[303640]: FRR daemons did not change
Jul 28 14:28:13.196576 osdx ca-certificates[303656]: Updating certificates in /etc/ssl/certs...
Jul 28 14:28:14.357637 osdx ubnt-cfgd[304654]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jul 28 14:28:14.372125 osdx ca-certificates[304659]: 1 added, 0 removed; done.
Jul 28 14:28:14.377187 osdx ca-certificates[304666]: Running hooks in /etc/ca-certificates/update.d...
Jul 28 14:28:14.382432 osdx ca-certificates[304668]: done.
Jul 28 14:28:14.615873 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jul 28 14:28:14.620265 osdx cfgd[1258]: [163666]Completed change to active configuration
Jul 28 14:28:14.623564 osdx OSDxCLI[163666]: User 'admin' committed the configuration.
Jul 28 14:28:14.657264 osdx dnscrypt-proxy[304728]: dnscrypt-proxy 2.0.45
Jul 28 14:28:14.657368 osdx dnscrypt-proxy[304728]: Network connectivity detected
Jul 28 14:28:14.657686 osdx dnscrypt-proxy[304728]: Dropping privileges
Jul 28 14:28:14.664568 osdx dnscrypt-proxy[304728]: Network connectivity detected
Jul 28 14:28:14.664607 osdx dnscrypt-proxy[304728]: Now listening to 127.0.0.1:53 [UDP]
Jul 28 14:28:14.664612 osdx dnscrypt-proxy[304728]: Now listening to 127.0.0.1:53 [TCP]
Jul 28 14:28:14.664641 osdx dnscrypt-proxy[304728]: Firefox workaround initialized
Jul 28 14:28:14.664647 osdx dnscrypt-proxy[304728]: Loading the set of cloaking rules from [/tmp/tmp9kydba8r]
Jul 28 14:28:14.673198 osdx OSDxCLI[163666]: User 'admin' left the configuration menu.
Jul 28 14:28:14.967790 osdx OSDxCLI[163666]: User 'admin' executed a new command: 'system journal show | cat'.
Jul 28 14:28:15.045247 osdx dnscrypt-proxy[304728]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4865
Jul 28 14:28:15.045276 osdx dnscrypt-proxy[304728]: [DUT0] OK (DoH) - rtt: 142ms
Jul 28 14:28:15.045286 osdx dnscrypt-proxy[304728]: Server with the lowest initial latency: DUT0 (rtt: 142ms)
Jul 28 14:28:15.045292 osdx dnscrypt-proxy[304728]: dnscrypt-proxy is ready - live servers: 1

---