Re: [mif] AD review of draft-ietf-mif-current-practices

[Ted Lemon <[e-mail]>]

FYI, this is a rough approximation of the text I would want to add:

4.1a.  DNS resolution issues with captive portals

   A MIF node (M1) has an active interface(I1) connected to a network
   (N1) which has its DNS server (S1) and another active interface
   (I2) connected to a network (N2) which has its DNS server (S2).  S1
   is configured to respond to any A or AAAA record query with the
   IP address of a captive portal, so as to redirect web browsers to an
   access control portal web page.  Any of the following situations
   may occur:

   1.  M1 stack, based on its routing table, uses I2 to reach S1 to
       resolve "a.example.com".  M1 never reaches S1.  The name
       is not resolved.
   2.  M1 keeps only one set of DNS server addresses from the received
       configuration objects and kept S2 address.  M1 sends the
       forward DNS query for a.example.com to S2.  S2 responds with the
       correct answer, R1.   M1 attempts to contact R1 by way of I1.
       The connection fails.     Or, the connection succeeds,
       bypassing the security policy on N1, possibly exposing the
       owner of M1 to prosecution.
   3.  M1 keeps only one set of DNS server addresses from the received
       configuration objects and kept S1 address.  M1 sends the DNS
       query for a.example.com to S1.  S1 provides the address of its
       captive portal.   S1 attempts to contact this IP address using
       I1.   The application tries to connect to the wrong destination
       node, resulting in lack of service and possible security issues.
   4.  M1 has resolved an FQDN to the IP address of the captive portal
       connected to N1.  If the node loses connection to N1, the node
       may try to connect, via N2, to the same IP address as earlier,
       but as the address was only locally valid, connection setup
       fails.