Re: [ippm] Roman Danyliw's Discuss on draft-ietf-ippm-ioam-conf-state-07: (with DISCUSS and COMMENT)

[Roman Danyliw <[e-mail]>]

Hi Xiao!

Thanks for the quick response.  The refined text described below addresses my concerns.

Roman

From: iesg <[e-mail]> On Behalf Of [e-mail]
Sent: Wednesday, October 26, 2022 3:36 AM
To: Roman Danyliw <[e-mail]>
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Subject: Re: Roman Danyliw's Discuss on draft-ietf-ippm-ioam-conf-state-07: (with DISCUSS and COMMENT)


Hi Roman



Thank you for the review and thoughtful comments.

Please check inline the proposed changes that will be incorporated into the next revision.



Best Regards,

Xiao Min


Original
From: RomanDanyliwviaDatatracker <[e-mail]<mailto:[e-mail]>>
To: The IESG <[e-mail]<mailto:[e-mail]>>;
Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>;[e-mail] <[e-mail]<mailto:[e-mail]>>;[e-mail] <[e-mail]<mailto:[e-mail]>>;[e-mail] <[e-mail]<mailto:[e-mail]>>;[e-mail] <[e-mail]<mailto:[e-mail]>>;
Date: 2022年10月26日 10:21
Subject: Roman Danyliw's Discuss on draft-ietf-ippm-ioam-conf-state-07: (with DISCUSS and COMMENT)
Roman Danyliw has entered the following ballot position for
draft-ietf-ippm-ioam-conf-state-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-ioam-conf-state/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Section 6.

   A deployment can increase security by using border filtering of
   incoming and outgoing echo requests/replies.

Thanks for calling out the security impact of echo request/replies.  Since the
cited RFC9197 reminds the reader that a “network operator is expected to
enforce policies that prevent IOAM traffic from leaking outside of the
IOAM-Domain”, why is this guidance not mandatory?

Would the following text be more appropriate?

NEW
A deployment MUST ensure that border filtering drops inbound echo requests with
a IOAM Capabilities Container Header from outside of the domain, and drops
outbound echo request/replies with IOAM Capabilities Headers leaving the domain.
[XM]>>> Yes, I think the text proposed by you is more appropriate. Typo s/a IOAM Capabilities/an IOAM Capabilities.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Chris Lonvick for the SECDIR review.

Section 3.1.  Typo. s/begining/beginning/

Section 6.  Typo. s/securiy/security/
[XM]>>> OK, will fix. Thank you for catching them.