[ippm] Warren Kumari's Discuss on draft-ietf-ippm-ioam-conf-state-07: (with DISCUSS)

[Warren Kumari via Datatracker <[e-mail]>]

Warren Kumari has entered the following ballot position for
draft-ietf-ippm-ioam-conf-state-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-ioam-conf-state/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you very much for writing this document.
Please see:
https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/

My concerns are closely related to Roman's DISCUSS point:

The document says: "A deployment can increase security by using border
filtering of incoming and outgoing echo requests/replies."

I'm unclear why this is just a "can increase security", and not something much
much stronger -- but, also, I'm unclear how exactly an operator would be
expected to filter these. The Abstract says: "This document describes an
extension to the echo request/reply mechanisms used in [...]", but from what I
can tell, it is more "here are some containers that you could use in some other
protocols".

It seems like, instead of only relying on the network for filtering (which
doesn't yet seem to be implemented), the: "To protect against unauthorized
sources using echo request messages to obtain IOAM Capabilities information, it
is RECOMMENDED that implementations provide a means of checking the source
addresses of echo request messages against an access list before accepting the
message." should be made stronger. Implementations need to be created to
understand IOAM, and so requiring that they have the capability to only accept
configured source addresses seems simple.