Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash ce5bfb07edc17945305c52b77f54ddda93ca3edba3b5213add895927eb42f82a
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash 6a4b8408b01ef9407f9aa4d7c36655c45f767177954d6dd93b383c9e3ef59172
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Jun 20 15:41:59.288282 osdx systemd-journald[1554]: Runtime Journal (/run/log/journal/6007ddf378ad466885280cbf52ccf316) is 1012.0K, max 7.2M, 6.2M free.
Jun 20 15:41:59.289624 osdx systemd-journald[1554]: Received client request to rotate journal, rotating.
Jun 20 15:41:59.289674 osdx systemd-journald[1554]: Vacuuming done, freed 0B of archived journals from /run/log/journal/6007ddf378ad466885280cbf52ccf316.
Jun 20 15:41:59.297716 osdx OSDxCLI[170436]: User 'admin' executed a new command: 'system journal clear'.
Jun 20 15:41:59.502551 osdx OSDxCLI[170436]: User 'admin' executed a new command: 'system coredump delete all'.
Jun 20 15:42:00.444237 osdx OSDxCLI[170436]: User 'admin' entered the configuration menu.
Jun 20 15:42:00.532178 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Jun 20 15:42:00.621617 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Jun 20 15:42:00.685215 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service ssh'.
Jun 20 15:42:00.787431 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'show working'.
Jun 20 15:42:00.850095 osdx ubnt-cfgd[243102]: inactive
Jun 20 15:42:00.881530 osdx INFO[243116]: FRR daemons did not change
Jun 20 15:42:00.901620 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Jun 20 15:42:01.050011 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Jun 20 15:42:01.064862 osdx sshd[243230]: Server listening on 0.0.0.0 port 22.
Jun 20 15:42:01.065150 osdx sshd[243230]: Server listening on :: port 22.
Jun 20 15:42:01.065289 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Jun 20 15:42:01.091123 osdx cfgd[1254]: [170436]Completed change to active configuration
Jun 20 15:42:01.103718 osdx OSDxCLI[170436]: User 'admin' committed the configuration.
Jun 20 15:42:01.157391 osdx OSDxCLI[170436]: User 'admin' left the configuration menu.
Jun 20 15:42:01.313499 osdx OSDxCLI[170436]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Jun 20 15:42:03.360048 osdx OSDxCLI[170436]: User 'admin' entered the configuration menu.
Jun 20 15:42:03.473386 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Jun 20 15:42:03.531946 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Jun 20 15:42:03.640712 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Jun 20 15:42:03.720096 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Jun 20 15:42:03.821913 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Jun 20 15:42:03.937492 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Jun 20 15:42:03.997520 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 6a4b8408b01ef9407f9aa4d7c36655c45f767177954d6dd93b383c9e3ef59172'.
Jun 20 15:42:04.092617 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Jun 20 15:42:04.144823 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Jun 20 15:42:04.293543 osdx OSDxCLI[170436]: User 'admin' added a new cfg line: 'show working'.
Jun 20 15:42:04.362841 osdx ubnt-cfgd[243290]: inactive
Jun 20 15:42:04.385089 osdx INFO[243298]: FRR daemons did not change
Jun 20 15:42:04.417211 osdx ca-certificates[243314]: Updating certificates in /etc/ssl/certs...
Jun 20 15:42:04.920524 osdx ubnt-cfgd[244312]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Jun 20 15:42:04.940950 osdx ca-certificates[244316]: 1 added, 0 removed; done.
Jun 20 15:42:04.943997 osdx ca-certificates[244324]: Running hooks in /etc/ca-certificates/update.d...
Jun 20 15:42:04.946848 osdx ca-certificates[244326]: done.
Jun 20 15:42:05.077983 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Jun 20 15:42:05.079751 osdx cfgd[1254]: [170436]Completed change to active configuration
Jun 20 15:42:05.082718 osdx OSDxCLI[170436]: User 'admin' committed the configuration.
Jun 20 15:42:05.105931 osdx OSDxCLI[170436]: User 'admin' left the configuration menu.
Jun 20 15:42:05.248434 osdx OSDxCLI[170436]: User 'admin' executed a new command: 'system journal show | cat'.
Jun 20 15:42:05.301503 osdx dnscrypt-proxy[244386]: dnscrypt-proxy 2.0.45
Jun 20 15:42:05.301571 osdx dnscrypt-proxy[244386]: Network connectivity detected
Jun 20 15:42:05.301767 osdx dnscrypt-proxy[244386]: Dropping privileges
Jun 20 15:42:05.303753 osdx dnscrypt-proxy[244386]: Network connectivity detected
Jun 20 15:42:05.303783 osdx dnscrypt-proxy[244386]: Now listening to 127.0.0.1:53 [UDP]
Jun 20 15:42:05.303787 osdx dnscrypt-proxy[244386]: Now listening to 127.0.0.1:53 [TCP]
Jun 20 15:42:05.303806 osdx dnscrypt-proxy[244386]: Firefox workaround initialized
Jun 20 15:42:05.303809 osdx dnscrypt-proxy[244386]: Loading the set of cloaking rules from [/tmp/tmpx_2yinrh]
Jun 20 15:42:05.468436 osdx dnscrypt-proxy[244386]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Jun 20 15:42:05.468449 osdx dnscrypt-proxy[244386]: [DUT0] OK (DoH) - rtt: 103ms
Jun 20 15:42:05.468458 osdx dnscrypt-proxy[244386]: Server with the lowest initial latency: DUT0 (rtt: 103ms)
Jun 20 15:42:05.468463 osdx dnscrypt-proxy[244386]: dnscrypt-proxy is ready - live servers: 1

---