Cipher Server

Test suite to validate using one or multiple ciphers to protect DoH connection

TLS v1.3 Connection

Description

Sets up the DUT0 as a server, DUT1 as a client and ensures the communication between them is secured by TLS v1.3.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 2f188ce6386e1a21b422ea2145dc5bb65c4e8922988c617cdd6046218cd8885b
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy log level 0
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash 2ea093d0d001c2bb9fc03fb1a97d4447a36ca0b52906a44857c6f5472d7f9536
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns resolver local
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.64 from DUT1:

admin@DUT1$ ping 10.215.168.64 count 1 size 56 timeout 1

Show output

PING 10.215.168.64 (10.215.168.64) 56(84) bytes of data.
64 bytes from 10.215.168.64: icmp_seq=1 ttl=64 time=0.443 ms

--- 10.215.168.64 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.443/0.443/0.443/0.000 ms

Step 4: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13

Show output

;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
teldat.com has address 10.11.12.13

Step 5: Run command system journal show | cat at DUT1 and expect this output:

Show output

May 04 23:07:27.301984 osdx systemd-journald[1804]: Runtime Journal (/run/log/journal/535ba18673ea4b63ad160634860bb768) is 952.0K, max 6.4M, 5.5M free.
May 04 23:07:27.305426 osdx systemd-journald[1804]: Received client request to rotate journal, rotating.
May 04 23:07:27.305480 osdx systemd-journald[1804]: Vacuuming done, freed 0B of archived journals from /run/log/journal/535ba18673ea4b63ad160634860bb768.
May 04 23:07:27.310930 osdx OSDxCLI[461384]: User 'admin' executed a new command: 'system journal clear'.
May 04 23:07:27.537011 osdx OSDxCLI[461384]: User 'admin' executed a new command: 'system coredump delete all'.
May 04 23:07:28.486368 osdx OSDxCLI[461384]: User 'admin' entered the configuration menu.
May 04 23:07:28.561601 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
May 04 23:07:28.638904 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
May 04 23:07:28.695865 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service ssh'.
May 04 23:07:28.790147 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'show working'.
May 04 23:07:28.850952 osdx ubnt-cfgd[478726]: inactive
May 04 23:07:28.932653 osdx INFO[478747]: FRR daemons did not change
May 04 23:07:28.965451 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
May 04 23:07:29.004452 osdx WARNING[478816]: No supported link modes on interface eth0
May 04 23:07:29.005803 osdx modulelauncher[478816]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on
May 04 23:07:29.005814 osdx modulelauncher[478816]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76.
May 04 23:07:29.006978 osdx modulelauncher[478816]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --
May 04 23:07:29.006985 osdx modulelauncher[478816]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75.
May 04 23:07:29.097907 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
May 04 23:07:29.109193 osdx sshd[478882]: Server listening on 0.0.0.0 port 22.
May 04 23:07:29.109219 osdx sshd[478882]: Server listening on :: port 22.
May 04 23:07:29.109312 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
May 04 23:07:29.110723 osdx cfgd[1440]: [461384]Completed change to active configuration
May 04 23:07:29.123408 osdx OSDxCLI[461384]: User 'admin' committed the configuration.
May 04 23:07:29.157404 osdx OSDxCLI[461384]: User 'admin' left the configuration menu.
May 04 23:07:29.318151 osdx OSDxCLI[461384]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
May 04 23:07:31.027501 osdx OSDxCLI[461384]: User 'admin' entered the configuration menu.
May 04 23:07:31.103336 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
May 04 23:07:31.207871 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
May 04 23:07:31.276190 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
May 04 23:07:31.370228 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
May 04 23:07:31.424828 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
May 04 23:07:31.515666 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
May 04 23:07:31.580849 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash 2ea093d0d001c2bb9fc03fb1a97d4447a36ca0b52906a44857c6f5472d7f9536'.
May 04 23:07:31.663258 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns proxy log level 0'.
May 04 23:07:31.714221 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'set service dns resolver local'.
May 04 23:07:31.822736 osdx OSDxCLI[461384]: User 'admin' added a new cfg line: 'show working'.
May 04 23:07:31.880547 osdx ubnt-cfgd[478932]: inactive
May 04 23:07:31.901394 osdx INFO[478940]: FRR daemons did not change
May 04 23:07:31.925890 osdx ca-certificates[478956]: Updating certificates in /etc/ssl/certs...
May 04 23:07:32.442175 osdx ubnt-cfgd[479968]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
May 04 23:07:32.452447 osdx ca-certificates[479972]: 1 added, 0 removed; done.
May 04 23:07:32.455271 osdx ca-certificates[479980]: Running hooks in /etc/ca-certificates/update.d...
May 04 23:07:32.457973 osdx ca-certificates[479982]: done.
May 04 23:07:32.569801 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
May 04 23:07:32.571817 osdx cfgd[1440]: [461384]Completed change to active configuration
May 04 23:07:32.574396 osdx OSDxCLI[461384]: User 'admin' committed the configuration.
May 04 23:07:32.588915 osdx OSDxCLI[461384]: User 'admin' left the configuration menu.
May 04 23:07:32.736816 osdx OSDxCLI[461384]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
May 04 23:07:32.763003 osdx dnscrypt-proxy[480041]: dnscrypt-proxy 2.0.45
May 04 23:07:32.763055 osdx dnscrypt-proxy[480041]: Network connectivity detected
May 04 23:07:32.763229 osdx dnscrypt-proxy[480041]: Dropping privileges
May 04 23:07:32.765229 osdx dnscrypt-proxy[480041]: Network connectivity detected
May 04 23:07:32.765255 osdx dnscrypt-proxy[480041]: Now listening to 127.0.0.1:53 [UDP]
May 04 23:07:32.765258 osdx dnscrypt-proxy[480041]: Now listening to 127.0.0.1:53 [TCP]
May 04 23:07:32.765270 osdx dnscrypt-proxy[480041]: Firefox workaround initialized
May 04 23:07:32.765274 osdx dnscrypt-proxy[480041]: Loading the set of cloaking rules from [/tmp/tmp6lsz5a60]
May 04 23:07:33.113664 osdx dnscrypt-proxy[480041]: [DUT0] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
May 04 23:07:33.113681 osdx dnscrypt-proxy[480041]: [DUT0] OK (DoH) - rtt: 247ms
May 04 23:07:33.113690 osdx dnscrypt-proxy[480041]: Server with the lowest initial latency: DUT0 (rtt: 247ms)
May 04 23:07:33.113694 osdx dnscrypt-proxy[480041]: dnscrypt-proxy is ready - live servers: 1
May 04 23:07:37.845474 osdx OSDxCLI[461384]: User 'admin' entered an invalid command: 'show host lookup teldat.com type A'.
May 04 23:07:47.945952 osdx OSDxCLI[461384]: User 'admin' executed a new command: 'show host lookup teldat.com type A'.

---