[nbs] New draft related to name-based sockets

[Pete McCann <[e-mail]>]

I've uploaded a new draft relevant to the name-based sockets
discussion and several others that have been going on in the
Internet Area and elsewhere:

https://datatracker.ietf.org/doc/draft-mccann-picklepacket/

It describes a framework for putting DNS names into transport
packets that is a bit different from the approaches I've seen
advocated on the NBS list.  For one thing, I wanted to work
with IPv4 as well as IPv6, which means avoiding all IP options
which cause packets to go on the slow path or get dropped.
The TCP options space is too limited for carrying DNS names,
let alone the extra authentication payloads that I wanted to
put there.  So, I'm proposing essentially extending the transport
options space in a non-backwards compatible way by shimming
in a magic number where the transport payload would normally
go.  This would apply to UDP as well.  I've defined a new header
which I think is relatively compact yet provides all the flexibility
we need, and a TLV format for carrying the DNS names and
public-key authentication tags.  I'm proposing to put public keys
into DNS TXT records so that they can be retrieved by middleboxes
that want to verify the transport connections passing through them.
Also, middleboxes can add their own names and authentication
tags, which allows them to make themselves known to the endpoints.
This enables them to be used as mobility anchor points in case the
path changes.

The focus of the introduction is on preventing denial-of-service attacks
but I think the protocol has many other useful features.
Names can be used to route connections such as multiple servers
sitting behind a NAT all on the same port.  Routing on names does
require some state to be kept in the middleboxes if we don't want
to put DNS names into every packet.  So, I'm proposing that each
middlebox choose a 32-bit cookie value that it can use to index the
flow state.  These cookies get distributed in the same round-trip as
the initial transport connection setup.

I'm very curious to have your feedback on the approach.  There is a
lot of stuff in the draft and the protocol is rather heavyweight, but
I think it addresses a lot of different themes that I've seen being
discussed in different working groups (TCP Auth Option, MPTCP,
NBS, MEXT, DKIM, KEYASSURE, etc).

-Pete