http://hexler.net/software/touchosc - cheap, with some periodic glitches (at least for me), but till you plan to use it live on stage, can do what you want.
https://liine.net/en/products/lemur/ - more expensive, but many users claim it is more stable (and capable).
You need to configure both using one or both ways:
1) using related daemon on PC (both apps have such daemon) convert OSC to MIDI, then use MIDI in Sonar with some standard Control Surface (f.e. ACT MIDI) and/or MIDI Learn inside VSTi
2) use my plug-in (AZ Controller, see my signature) to translate commands from app directly into Sonar functionality.
(1) is simpler to deploy, (2) has more functionality (f.e. can indicate transport state in applet, display VSTi preset name, etc.) but significantly more complicated at the beginning (see
http://www.azslow.com/index.php/topic,295.0.html) and is not "standard" (also free... some people see that a problem
)