Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash be1776c8fd054dc1035f9bd9cce747bd437a0829719601a16e96bc6bbfcd87b0
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash b1402c3ea03f8d1852a7aa1520a615ff14e5cf6c0fecd612262496de4c24bc1d
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.64 from DUT1:

admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1

Show output

PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data.
64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.604 ms

--- 10.215.168.64 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.604/0.604/0.604/0.000 ms

Step 4: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13

Show output

;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
teldat.com has address 10.11.12.13

Step 5: Run command system journal show | cat at DUT1 and expect this output:

Show output

Mar 23 10:24:24.292881 osdx systemd-journald[1995]: Runtime Journal (/run/log/journal/3bae93ce7bf04d9e94142a051157df70) is 908.0K, max 6.4M, 5.5M free.
Mar 23 10:24:24.295503 osdx systemd-journald[1995]: Received client request to rotate journal, rotating.
Mar 23 10:24:24.295571 osdx systemd-journald[1995]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3bae93ce7bf04d9e94142a051157df70.
Mar 23 10:24:24.304273 osdx OSDxCLI[215885]: User 'admin' executed a new command: 'system journal clear'.
Mar 23 10:24:24.522775 osdx OSDxCLI[215885]: User 'admin' executed a new command: 'system coredump delete all'.
Mar 23 10:24:25.546607 osdx OSDxCLI[215885]: User 'admin' entered the configuration menu.
Mar 23 10:24:25.652715 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Mar 23 10:24:25.734887 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Mar 23 10:24:25.840115 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service ssh'.
Mar 23 10:24:25.922594 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'show working'.
Mar 23 10:24:26.024692 osdx ubnt-cfgd[239841]: inactive
Mar 23 10:24:26.111111 osdx INFO[239862]: FRR daemons did not change
Mar 23 10:24:26.139506 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Mar 23 10:24:26.186613 osdx WARNING[239931]: No supported link modes on interface eth0
Mar 23 10:24:26.188025 osdx modulelauncher[239931]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
Mar 23 10:24:26.188036 osdx modulelauncher[239931]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
Mar 23 10:24:26.189205 osdx modulelauncher[239931]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
Mar 23 10:24:26.189211 osdx modulelauncher[239931]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
Mar 23 10:24:26.287950 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Mar 23 10:24:26.299207 osdx sshd[239997]: Server listening on 0.0.0.0 port 22.
Mar 23 10:24:26.299428 osdx sshd[239997]: Server listening on :: port 22.
Mar 23 10:24:26.299604 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Mar 23 10:24:26.301956 osdx cfgd[1631]: [215885]Completed change to active configuration
Mar 23 10:24:26.318116 osdx OSDxCLI[215885]: User 'admin' committed the configuration.
Mar 23 10:24:26.357955 osdx OSDxCLI[215885]: User 'admin' left the configuration menu.
Mar 23 10:24:26.513344 osdx OSDxCLI[215885]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Mar 23 10:24:28.648746 osdx OSDxCLI[215885]: User 'admin' entered the configuration menu.
Mar 23 10:24:28.756937 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Mar 23 10:24:28.819736 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Mar 23 10:24:28.938131 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Mar 23 10:24:29.030235 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Mar 23 10:24:29.158278 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Mar 23 10:24:29.225595 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Mar 23 10:24:29.335416 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash b1402c3ea03f8d1852a7aa1520a615ff14e5cf6c0fecd612262496de4c24bc1d'.
Mar 23 10:24:29.416253 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
Mar 23 10:24:29.506823 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Mar 23 10:24:29.615106 osdx OSDxCLI[215885]: User 'admin' added a new cfg line: 'show working'.
Mar 23 10:24:29.725807 osdx ubnt-cfgd[240046]: inactive
Mar 23 10:24:29.747419 osdx INFO[240054]: FRR daemons did not change
Mar 23 10:24:29.764062 osdx ca-certificates[240070]: Updating certificates in /etc/ssl/certs...
Mar 23 10:24:30.363942 osdx ubnt-cfgd[241082]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Mar 23 10:24:30.375305 osdx ca-certificates[241088]: 1 added, 0 removed; done.
Mar 23 10:24:30.379802 osdx ca-certificates[241094]: Running hooks in /etc/ca-certificates/update.d...
Mar 23 10:24:30.383935 osdx ca-certificates[241096]: done.
Mar 23 10:24:30.508162 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Mar 23 10:24:30.510593 osdx cfgd[1631]: [215885]Completed change to active configuration
Mar 23 10:24:30.514205 osdx OSDxCLI[215885]: User 'admin' committed the configuration.
Mar 23 10:24:30.530260 osdx dnscrypt-proxy[241155]: dnscrypt-proxy 2.0.45
Mar 23 10:24:30.530318 osdx dnscrypt-proxy[241155]: Network connectivity detected
Mar 23 10:24:30.530538 osdx dnscrypt-proxy[241155]: Dropping privileges
Mar 23 10:24:30.532476 osdx dnscrypt-proxy[241155]: Network connectivity detected
Mar 23 10:24:30.532509 osdx dnscrypt-proxy[241155]: Now listening to 127.0.0.1:53 [UDP]
Mar 23 10:24:30.532518 osdx dnscrypt-proxy[241155]: Now listening to 127.0.0.1:53 [TCP]
Mar 23 10:24:30.532539 osdx dnscrypt-proxy[241155]: Firefox workaround initialized
Mar 23 10:24:30.532543 osdx dnscrypt-proxy[241155]: Loading the set of cloaking rules from [/tmp/tmpvlarn5mt]
Mar 23 10:24:30.551035 osdx OSDxCLI[215885]: User 'admin' left the configuration menu.
Mar 23 10:24:30.620147 osdx dnscrypt-proxy[241155]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
Mar 23 10:24:30.620168 osdx dnscrypt-proxy[241155]: [DUT0] OK (DoH) - rtt: 13ms
Mar 23 10:24:30.620178 osdx dnscrypt-proxy[241155]: Server with the lowest initial latency: DUT0 (rtt: 13ms)
Mar 23 10:24:30.620183 osdx dnscrypt-proxy[241155]: dnscrypt-proxy is ready - live servers: 1
Mar 23 10:24:30.714362 osdx OSDxCLI[215885]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Mar 23 10:24:30.848766 osdx OSDxCLI[215885]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

---