Cipher Server
Test suite to validate using one or multiple ciphers to protect DoH connection
TLS v1.3 Connection
Description
Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash 61e33b590507053cca7bb79fc3cc0fec356bca904a3aa16313af16399684db2e set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy log level 0 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash 0112706bb4476995db6ac22d67b4f0770557e6026dd979b6d7cc8f03836c6dcf set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns resolver local set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping IP address 10.215.168.64 from DUT1:
admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1Show output
PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data. 64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.192 ms --- 10.215.168.64 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.192/0.192/0.192/0.000 ms
Step 4: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Step 5: Run command system journal show | cat at DUT1 and expect this output:
Show output
Feb 19 10:26:03.296447 osdx systemd-journald[1946]: Runtime Journal (/run/log/journal/23713d8b40eb43dfbc54dc8903f4bf64) is 912.0K, max 6.5M, 5.6M free. Feb 19 10:26:03.296980 osdx systemd-journald[1946]: Received client request to rotate journal, rotating. Feb 19 10:26:03.297034 osdx systemd-journald[1946]: Vacuuming done, freed 0B of archived journals from /run/log/journal/23713d8b40eb43dfbc54dc8903f4bf64. Feb 19 10:26:03.309931 osdx OSDxCLI[2298]: User 'admin' executed a new command: 'system journal clear'. Feb 19 10:26:03.538599 osdx OSDxCLI[2298]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 10:26:04.997010 osdx OSDxCLI[2298]: User 'admin' entered the configuration menu. Feb 19 10:26:05.117204 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Feb 19 10:26:05.210902 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 10:26:05.304199 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service ssh'. Feb 19 10:26:05.389963 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:26:05.518213 osdx ubnt-cfgd[238355]: inactive Feb 19 10:26:05.604845 osdx INFO[238376]: FRR daemons did not change Feb 19 10:26:05.636586 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 10:26:05.697658 osdx WARNING[238445]: No supported link modes on interface eth0 Feb 19 10:26:05.699192 osdx modulelauncher[238445]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Feb 19 10:26:05.699206 osdx modulelauncher[238445]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Feb 19 10:26:05.700832 osdx modulelauncher[238445]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Feb 19 10:26:05.700841 osdx modulelauncher[238445]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 19 10:26:05.801114 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Feb 19 10:26:05.812256 osdx sshd[238511]: Server listening on 0.0.0.0 port 22. Feb 19 10:26:05.812280 osdx sshd[238511]: Server listening on :: port 22. Feb 19 10:26:05.812364 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Feb 19 10:26:05.813304 osdx cfgd[1621]: [2298]Completed change to active configuration Feb 19 10:26:05.831067 osdx OSDxCLI[2298]: User 'admin' committed the configuration. Feb 19 10:26:05.848816 osdx OSDxCLI[2298]: User 'admin' left the configuration menu. Feb 19 10:26:06.008065 osdx OSDxCLI[2298]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Feb 19 10:26:08.203023 osdx OSDxCLI[2298]: User 'admin' entered the configuration menu. Feb 19 10:26:08.269869 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Feb 19 10:26:08.375195 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Feb 19 10:26:08.440610 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Feb 19 10:26:08.561230 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Feb 19 10:26:08.618733 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Feb 19 10:26:08.729794 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Feb 19 10:26:08.799947 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 0112706bb4476995db6ac22d67b4f0770557e6026dd979b6d7cc8f03836c6dcf'. Feb 19 10:26:08.944800 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'. Feb 19 10:26:09.036202 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'set service dns resolver local'. Feb 19 10:26:09.156135 osdx OSDxCLI[2298]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:26:09.267512 osdx ubnt-cfgd[238560]: inactive Feb 19 10:26:09.299295 osdx INFO[238568]: FRR daemons did not change Feb 19 10:26:09.368638 osdx ca-certificates[238584]: Updating certificates in /etc/ssl/certs... Feb 19 10:26:10.155871 osdx ubnt-cfgd[239596]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Feb 19 10:26:10.170402 osdx ca-certificates[239600]: 1 added, 0 removed; done. Feb 19 10:26:10.174941 osdx ca-certificates[239608]: Running hooks in /etc/ca-certificates/update.d... Feb 19 10:26:10.179277 osdx ca-certificates[239610]: done. Feb 19 10:26:10.321057 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Feb 19 10:26:10.322443 osdx cfgd[1621]: [2298]Completed change to active configuration Feb 19 10:26:10.324696 osdx OSDxCLI[2298]: User 'admin' committed the configuration. Feb 19 10:26:10.366516 osdx OSDxCLI[2298]: User 'admin' left the configuration menu. Feb 19 10:26:10.542014 osdx dnscrypt-proxy[239669]: dnscrypt-proxy 2.0.45 Feb 19 10:26:10.542081 osdx dnscrypt-proxy[239669]: Network connectivity detected Feb 19 10:26:10.542303 osdx dnscrypt-proxy[239669]: Dropping privileges Feb 19 10:26:10.546012 osdx dnscrypt-proxy[239669]: Network connectivity detected Feb 19 10:26:10.546053 osdx dnscrypt-proxy[239669]: Now listening to 127.0.0.1:53 [UDP] Feb 19 10:26:10.546059 osdx dnscrypt-proxy[239669]: Now listening to 127.0.0.1:53 [TCP] Feb 19 10:26:10.546080 osdx dnscrypt-proxy[239669]: Firefox workaround initialized Feb 19 10:26:10.546086 osdx dnscrypt-proxy[239669]: Loading the set of cloaking rules from [/tmp/tmp7wzwj5l2] Feb 19 10:26:10.550240 osdx OSDxCLI[2298]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Feb 19 10:26:10.684594 osdx dnscrypt-proxy[239669]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867 Feb 19 10:26:10.684613 osdx dnscrypt-proxy[239669]: [DUT0] OK (DoH) - rtt: 90ms Feb 19 10:26:10.684625 osdx dnscrypt-proxy[239669]: Server with the lowest initial latency: DUT0 (rtt: 90ms) Feb 19 10:26:10.684631 osdx dnscrypt-proxy[239669]: dnscrypt-proxy is ready - live servers: 1 Feb 19 10:26:15.639379 osdx OSDxCLI[2298]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'. Feb 19 10:26:25.813997 osdx OSDxCLI[2298]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.