[dnsext] DNS over SCTP and correcting security concerns

[Douglas Otis <[e-mail]>]

Mea copa.

A statement made regarding what was thought to have been security 
concerns related to SCTP tie-tags turned out to be based upon a dated 
understanding of SCTP.  In reading recent drafts, important changes 
escaped notice.  Michael Tüxen clarified how these issues have been 
resolved, and also mentioned these improvements have been incorporated 
in current releases of FreeBSD.  FreeBSD also supports SCTP tunneling 
over UDP port 9899.

http://tools.ietf.org/id/draft-ietf-sigtran-sctptunnel-00.txt

Although Intel offers 1Gb NICs (82576) and 10Gb NICs (X520) that 
off-load SCTP checksum calculations, and offer i7-core processors that 
have CRC32c functions contained within the new SSE4 math coprocessor, it 
seems doubtful SCTP checksum offloading will work with tunneling. 
Nevertheless, use of the SSE4 math coprocessor should reduce the 
overhead for handling an SCTP tunneling option.

The SCTP_AUTOCLOSE option in the one-to-many Socket mode appears ideal 
for DNS.  When the SCTP_AUTOCLOSE option is set in a one-to-many socket, 
the application (DNS) is able to reuse assigned association IDs once the 
associations terminate automatically.  The application would receive 
association change notifications to track unused association IDs.

http://tools.ietf.org/html/draft-ietf-tsvwg-sctpsocket-19

Using SCTP_AUTOCLOSE should allow associations to remain persistent 
until no longer being used.  This approach should reduce the overhead 
related with establishing an association, where repetitive transactions 
should obtain a significant benefit.  In addition, any number of DNS 
messages can be bundled into a single packet that fits within the PMTU. 
  Such bundling should also improve performance as well.

-Doug