Re: [dnsext] SCTP trials on NANOG, 3 of 3 (Re: DNS hardening)

[Doug Otis <[e-mail]>]

On 8/8/09 8:46 AM, Paul Vixie wrote:

>> Am I missing something?  The SCTP cookie guards against the equivalent
>> of SYN-flooding attacks.  The problem with SCTP is normal operations.
>> A UDP DNS query today takes a message and a reply, with no (kernel)
>> state created on the server end.  For SCTP, it takes two round trips to
>> set up the connection -- which includes kernel state -- followed by the
>> query and reply, and tear-down.

There is info within initial exchanges (beyond that exchanged with TCP) 
that allows SCTP to be robust.  TCP transitions from Listen to SYN_RCVD 
send SYN ACK, ACK recv, Established. From SYN_RVCD, it might also send 
FIN, transition with recv ACK, and stick on FIN-WAIT2 for recv FIN.

>> I confess that I don't remember the
>> SCTP state diagram; in TCP, the side that closes first can end up in
>> FIN-WAIT2 state, which is stable.  That is, suppose the server -- the
>> loaded party -- tries to shed kernel state by closing its DNS socket
>> first.  If the client goes away or is otherwise uncooperative, the
>> server will then end up in FIN-WAIT2, in which case kernel memory is
>> consumed "forever" by conforming server TCPs.  Does SCTP have that
>> problem?

SCTP state diagram:
http://www.csm.ornl.gov/~dunigan/netperf/SCTPstate.png

TCP state diagram:
http://www.csm.ornl.gov/~dunigan/netperf/TCPstate.gif

SCTP goes from Closed, recv Cookie ECHO, Send Cookie ACK to Established. 
   Shutdown sent with Timer.  SCTP can transitions from any to state to 
Closed with Abort for any reason.  Minor state adjustments are handled 
by the Out-of-the-Blue (OOTB) routines.

RFC4460 provides SCTP errata and issue review.

As part of a long term strategy, the concept of allowing (somewhat) 
persistent SCTP DNS associations versus single transactions per TCP 
connection is to retain the low latency obtained with UDP, in that the 
next query might be bundled in a separate stream or issued within some 
period of time later.  Deciding when an association is to be shutdown 
should weigh the overhead of retaining associations and heartbeats, 
against establishing new associations.

SCTP DNS handled in this fashion should help eliminate spoofing between 
ISP recursive resolvers, and provide reliable transactions with 
authoritative name servers without extra ordinary provisioning.  SCTP 
HTTP should also help make web sites more impervious to DDoS attacks and 
various types of exploits.  Using SCTP with DNS should also ensure 
teething issues are quickly overcome.

Flood protections often put in place for TCP may block without verifying 
the source's involvement.  This means TCP can be globally flooded, or 
have sources selectively inhibited due to address spoofing.  In 
addition, as a result of DNSSEC response sizes, UDP responses may also 
imperil the networks reaching the addresses being spoofed.  SCTP 
eliminates these threats while demanding the least amount of additional 
resources.

SCTP multi-home feature work best within an IPv6 environment, however 
SCTP's use with DNS should also help ensure it works well with IPv4 as well.

-Doug

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>