Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 3da01845fbcfc1579f9eca2d995ba22ecb78951c4fead8f8e986fc6d1e954848
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash 4acf54077ad970fae3393fd128860499c4fe8dfb6d051f342269b4bb14fc4612
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT1 and expect this output:

Show output

Oct 20 17:30:53.307558 osdx systemd-journald[1753]: Runtime Journal (/run/log/journal/4442b1c48b0b445ebeebca784f5233e7) is 900.0K, max 6.5M, 5.6M free.
Oct 20 17:30:53.309723 osdx systemd-journald[1753]: Received client request to rotate journal, rotating.
Oct 20 17:30:53.309780 osdx systemd-journald[1753]: Vacuuming done, freed 0B of archived journals from /run/log/journal/4442b1c48b0b445ebeebca784f5233e7.
Oct 20 17:30:53.322212 osdx OSDxCLI[216315]: User 'admin' executed a new command: 'system journal clear'.
Oct 20 17:30:53.556253 osdx OSDxCLI[216315]: User 'admin' executed a new command: 'system coredump delete all'.
Oct 20 17:30:54.536865 osdx OSDxCLI[216315]: User 'admin' entered the configuration menu.
Oct 20 17:30:54.612865 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Oct 20 17:30:54.703315 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Oct 20 17:30:54.756762 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service ssh'.
Oct 20 17:30:54.887485 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'show working'.
Oct 20 17:30:54.952575 osdx ubnt-cfgd[300439]: inactive
Oct 20 17:30:55.035191 osdx INFO[300458]: FRR daemons did not change
Oct 20 17:30:55.053738 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Oct 20 17:30:55.173962 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Oct 20 17:30:55.185678 osdx sshd[300581]: Server listening on 0.0.0.0 port 22.
Oct 20 17:30:55.185898 osdx sshd[300581]: Server listening on :: port 22.
Oct 20 17:30:55.186030 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Oct 20 17:30:55.186943 osdx cfgd[1444]: [216315]Completed change to active configuration
Oct 20 17:30:55.199211 osdx OSDxCLI[216315]: User 'admin' committed the configuration.
Oct 20 17:30:55.215918 osdx OSDxCLI[216315]: User 'admin' left the configuration menu.
Oct 20 17:30:55.365164 osdx OSDxCLI[216315]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Oct 20 17:30:57.150031 osdx OSDxCLI[216315]: User 'admin' entered the configuration menu.
Oct 20 17:30:57.218512 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Oct 20 17:30:57.315246 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Oct 20 17:30:57.384396 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Oct 20 17:30:57.484918 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Oct 20 17:30:57.576756 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Oct 20 17:30:57.646248 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Oct 20 17:30:57.740010 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 4acf54077ad970fae3393fd128860499c4fe8dfb6d051f342269b4bb14fc4612'.
Oct 20 17:30:57.802786 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Oct 20 17:30:57.888644 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Oct 20 17:30:57.968706 osdx OSDxCLI[216315]: User 'admin' added a new cfg line: 'show working'.
Oct 20 17:30:58.060259 osdx ubnt-cfgd[300628]: inactive
Oct 20 17:30:58.085622 osdx INFO[300636]: FRR daemons did not change
Oct 20 17:30:58.118028 osdx ca-certificates[300652]: Updating certificates in /etc/ssl/certs...
Oct 20 17:30:58.629043 osdx ubnt-cfgd[301650]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Oct 20 17:30:58.638996 osdx ca-certificates[301654]: 1 added, 0 removed; done.
Oct 20 17:30:58.641735 osdx ca-certificates[301662]: Running hooks in /etc/ca-certificates/update.d...
Oct 20 17:30:58.644322 osdx ca-certificates[301664]: done.
Oct 20 17:30:58.761964 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Oct 20 17:30:58.764866 osdx cfgd[1444]: [216315]Completed change to active configuration
Oct 20 17:30:58.766892 osdx OSDxCLI[216315]: User 'admin' committed the configuration.
Oct 20 17:30:58.782851 osdx OSDxCLI[216315]: User 'admin' left the configuration menu.
Oct 20 17:30:58.931941 osdx OSDxCLI[216315]: User 'admin' executed a new command: 'system journal show | cat'.
Oct 20 17:30:58.966399 osdx dnscrypt-proxy[301721]: dnscrypt-proxy 2.0.45
Oct 20 17:30:58.966724 osdx dnscrypt-proxy[301721]: Network connectivity detected
Oct 20 17:30:58.966980 osdx dnscrypt-proxy[301721]: Dropping privileges
Oct 20 17:30:58.969134 osdx dnscrypt-proxy[301721]: Network connectivity detected
Oct 20 17:30:58.969165 osdx dnscrypt-proxy[301721]: Now listening to 127.0.0.1:53 [UDP]
Oct 20 17:30:58.969169 osdx dnscrypt-proxy[301721]: Now listening to 127.0.0.1:53 [TCP]
Oct 20 17:30:58.969190 osdx dnscrypt-proxy[301721]: Firefox workaround initialized
Oct 20 17:30:58.969194 osdx dnscrypt-proxy[301721]: Loading the set of cloaking rules from [/tmp/tmpe9mzo6k2]
Oct 20 17:30:59.195908 osdx dnscrypt-proxy[301721]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Oct 20 17:30:59.195925 osdx dnscrypt-proxy[301721]: [DUT0] OK (DoH) - rtt: 115ms
Oct 20 17:30:59.195935 osdx dnscrypt-proxy[301721]: Server with the lowest initial latency: DUT0 (rtt: 115ms)
Oct 20 17:30:59.195941 osdx dnscrypt-proxy[301721]: dnscrypt-proxy is ready - live servers: 1

---