Subject: [Hipsec] incorrect examples in RFC 5202

From: "Ahrenholz, Jeffrey M" <[email-masked]>
Date: Fri, 27 Mar 2009 11:52:32 -0700

The examples in sections 5.2.1.1 and 5.2.1.2 of RFC 5202 seem incorrect.

Here is the "Modifications in R1" example:
      IP ( HIP ( [ R1_COUNTER, ]
                 PUZZLE,
                 DIFFIE_HELLMAN,
                 HIP_TRANSFORM,
                 ESP_TRANSFORM,
                 HOST_ID,
                 [ ECHO_REQUEST, ]
                 HIP_SIGNATURE_2 )
                 [, ECHO_REQUEST ])

The ESP_TRANSFORM (4095) belongs after the HOST_ID (705) (and any
ECHO_REQUEST) and before HIP_SIGNATURE_2 (61633) so it should look like
this:
      IP ( HIP ( [ R1_COUNTER, ]
                 PUZZLE,
                 DIFFIE_HELLMAN,
                 HIP_TRANSFORM,
                 HOST_ID,
                 [ ECHO_REQUEST, ]
                 ESP_TRANSFORM,
                 HIP_SIGNATURE_2 )
                 [, ECHO_REQUEST ])

A similar change is needed for the "Modifications in I2" example with
the I2 packet.

Note that RFC 5201 does contain this text:
"  Parameters using type values from 2048 up to 4095 are transport
   formats.  Currently, one transport format is defined: the ESP
   transport format [RFC5202].  The order of these parameters does not
   follow the order of their type value, but they are put in the packet
   in order of preference.  The first of the transport formats it the
   most preferred, and so on."

...but that TLV parameter ordering seems to apply only to types 2048
through 4095, the order of preference of any transport formats; it is
not saying that types 2048-4095 can go anywhere in the packet. This came
up with some interop tests performed by Oleg Ponomarev.

-Jeff