Research:Beacon - Revision history

Woody: /* Web Page */

2022-04-21T20:11:13Z

Web Page

Woody at 20:00, 21 April 2022

2022-04-21T20:00:59Z

Woody: /* Domain Beacon */

2022-04-18T09:42:31Z

Domain Beacon

Woody at 14:16, 11 April 2022

2022-04-11T14:16:17Z

Woody: /* IPv4 Beacon */

2022-04-07T15:15:48Z

IPv4 Beacon

Woody: /* IPv4 Beacon */

2022-04-07T15:15:30Z

IPv4 Beacon

Woody: /* Domain Beacon */

2022-04-07T15:12:30Z

Domain Beacon

Woody: /* Domain Beacon */

2022-04-07T15:09:50Z

Domain Beacon

Woody: /* IPv6 Beacon */

2022-04-07T15:04:31Z

IPv6 Beacon

Woody: /* ASN Beacon */

2022-04-07T15:04:18Z

ASN Beacon

← Older revision		Revision as of 20:11, 21 April 2022
Line 7:		Line 7:
	The beacon should be visible to the public in the form of a web page which attempts to load a variety of web objects, testing for sanction enforcement and a variety of forms of over-compliance. The web page should also display to the client the client's apparent IP address, source port number, and a timestamp that can be used by the client to validate what if anything might be between it and the beacon web server.		The beacon should be visible to the public in the form of a web page which attempts to load a variety of web objects, testing for sanction enforcement and a variety of forms of over-compliance. The web page should also display to the client the client's apparent IP address, source port number, and a timestamp that can be used by the client to validate what if anything might be between it and the beacon web server.

		+	The web page should test:
		+
		+	* Whether a sanctioned domain loads (green background indicates correct blocking, red overlay indicates failure to block)
		+	* Whether a subdomain loads (green background indicates correct blocking, red overlay indicates failure to block)
		+	* Whether a different domain hosted at the same IP address loads (red background indicates over-blocking, green overlay indicates correct non-blocking)
		+	* Whether a previously-but-no-longer-blocked domain loads (red background indicates over-blocking, green overlay indicates correct non-blocking)
		+	* Whether a blocked IP address loads (green background indicates correct blocking, red overlay indicates failure to block)
		+	* Whether a different IP address in the same subnet loads (red background indicates over-blocking, green overlay indicates correct non-blocking)
		+	* Whether a previously-but-no-longer-blocked IP address loads (red background indicates over-blocking, green overlay indicates correct non-blocking)
		+	* Whether a blocked Autonomous System Number loads (green background indicates correct blocking, red overlay indicates failure to block)
		+
		+	Potentially, we could test over-blocking of ASNs by multi-homing a beacon on a blocked and an un-blocked ASN, and testing to make sure the multi-homed object was not blocked.

	==== Domain Beacon ====		==== Domain Beacon ====

@@ Line 2: / Line 2: @@
 The design of the beacon which will be used to verify operation and reach of the program is currently underway on the mailing list, and will be described here when it reaches stable consensus. It is intended to allow independent verification of IPv4 and IPv6 routing and domain name resolution, and to be robust against orthogonal DNSSEC validation errors.
-Generally, our goal is to use two of each type of beacon, on independent and unrelated infrastructure, with one strobing on a one-hour period.
+Generally, our goal is to use two of each type of beacon, on independent and unrelated infrastructure, with one changing on a regular period, perhaps hourly.
 ==== Domain Beacon ====

@@ Line 10: / Line 10: @@
 [https://lookup.icann.org/lookup?q=sanctions-beacon.com&t=a '''sanctions-beacon.com''']
-Each will be set up to host the necessary responders, on two different independent network connections, using IP addresses not in any of our beacon IP address blocks. We will presumably need to get TLS certs for them as well.  Because these should be blocked by name ''and not'' by number, we will also host positive beacons on the same servers (which should be visible, although resources identified by the beacon domains should ''not'' be visible).  Depending upon the decision of the policy group on the matter of [[Policy:More Specific Domains|more specific domain names]], we may also want to host separate beacons on more-specific subdomains, c.f. http://more-specific.sanctions-beacon.net.
+Each will be set up to host the necessary responders, on two different independent network connections, using IP addresses not in any of our beacon IP address blocks. We will presumably need to get TLS certs for them as well.  Because these should be blocked by name ''and not'' by number, we will also host positive beacons on the same servers (which should be visible, although resources identified by the beacon domains should ''not'' be visible).  Depending upon the decision of the policy group on the matter of [[Policy:More Specific Domains|more specific domain names]], we may also want to host separate beacons on more-specific subdomains, c.f. http://more-specific.sanctions-beacon.net. We may also need two other ("negative") domains, to host on the same IP addresses as these, which should '''not''' be blocked, to make sure that it's the domain, not the IP, that's being blocked.
 {{plainlist|

@@ Line 18: / Line 18: @@
 ==== IPv4 Beacon ====
-As of April 7, 2022, ARIN's 8.4 transfer group has acknowledged that the transfer of our two /24s is approved, but has not yet completed the transfer.
+As of April 11, 2022, we've received the two independent IPv4 /24 beacon subnets for which we performed an 8.4 inward transfer.  They are:
 ==== IPv6 Beacon ====

@@ Line 18: / Line 18: @@
 ==== IPv4 Beacon ====
-As of April 7, ARIN's 8.4 transfer group has acknowledged that the transfer of our two /24s is approved, but has not yet completed the transfer.
+As of April 7, 2022, ARIN's 8.4 transfer group has acknowledged that the transfer of our two /24s is approved, but has not yet completed the transfer.
 ==== IPv6 Beacon ====

@@ Line 6: / Line 6: @@
 ==== Domain Beacon ====
 As of March 27, 2022, we have two domain name beacons. They are:
 {{plainlist|
-* [https://lookup.icann.org/lookup?q=sanctions-beacon.net&t=a sanctions-beacon.net]
+* [https://lookup.icann.org/lookup?q=sanctions-beacon.net&t=a '''sanctions-beacon.net''']
-* [https://lookup.icann.org/lookup?q=sanctions-beacon.com&t=a sanctions-beacon.com]
+* [https://lookup.icann.org/lookup?q=sanctions-beacon.com&t=a '''sanctions-beacon.com''']
 }}
 ==== IPv4 Beacon ====

@@ Line 11: / Line 11: @@
 ==== IPv6 Beacon ====
-As of April 7, we've received the two independent IPv6 /48 beacon subnets that we applied for.  They are:
+As of April 7, 2022, we've received the two independent IPv6 /48 beacon subnets that we applied for.  They are:
 {{plainlist|
 * [https://account.arin.net/public/secure/net/view/NET6-2620-A9-2000-1 '''SANCTIONS-BEACON-IPV6-A''', 2620:A9:2000::/48]

@@ Line 18: / Line 18: @@
 ==== ASN Beacon ====
-The 16-bit beacon ASN is [https://account.arin.net/public/secure/asn/view/AS13400 13400]<br>
+As of April 5, 2022, we've received both the 16-bit and 32-bit beacon ASNs we requested. They are:
-The 32-bit beacon ASN is [https://account.arin.net/public/secure/asn/view/AS400603 400603]