DNSCrypt / dnscrypt-proxy

dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols.
https://dnscrypt.info
ISC License
11.41k stars 1.01k forks source link

Feature request: LB Strategy and sorted latencies for relays #1019

Closed Sayrus closed 4 years ago

Sayrus commented 4 years ago

Is it possible to check for the relay with lowest latency just as we check for the server with the lowest latency and add a strategy to select the relay we want?

I might be wrong but I do think it makes sense to allow someone to explicitly configure a random strategy when needed. But the average user might want to use a relay with the lowest total latency to the resolver.

Current behavior seems to be: For each server:

  1. Select a random relay
  2. Benchmark the server

And then sort by latency. This means that sometimes, a relay might have some latency for some reasons and you would end up selecting another dns resolver whereas your lb_strategy is configured to be p2. If you are really unlucky, you might end up with over 200ms for every server you have when there are relay allowing you to get less than 10ms (but this relay wasn't tested as another random relay was selected).

What I do think would be a great behavior: For each server: If behavior is random, select a random relay. Else for each relay, get the latency. Filter the result list using the given strategy.

And then sort by lowest relay/server combo.

Configuration could be something like: lb_relay_strategy with possible values:

The composition of lb_strategy and lb_relay_strategy would allow to customize heavily the behavior and routes used without risking having a high latency for no reason if you don't want to. This should also help when changing region.

Used with #1014 , this would even allow to use a random relay/random server. While it is said that changing relay is planned, it is not said that it will be possible to use a strategy for this, which is why I am opening this issue.

Thanks for the awesome work. Best regards,

ghost commented 4 years ago

That would be great if that could be done and it would be good if a relay online checker was built in to see which anon-dns-relays are online to ensure the anon-dns-relay route.

Does the dns query collapse when an anon-dns-relay is offline in a chain of 6 anon-dns-relays?

Example: Scenario, anon-dns-relay number 4 (anon-cs-pt) has failed in the chain.

{ server_name='suami', via=['anon-cs-md', 'anon-cs-fi', 'anon-cs-nl', 'anon-cs-pt', 'anon-ibksturm', 'anon-kama'] },

What happens if, for example, the anon-dns-relay names "anon-cs-pt" is offline?

Does the dns query still work? Will the next anon-dns-relay be used in the chain?

Thanks,too for that awesome work! :-)

Sayrus commented 4 years ago

You don't route your query through all the relays, you only pick one and it will forward the query. I don't think it makes sense to route through several relays anyway as the only purpose is that the relay rewrite the source while behind unable to read the content. Moreover, it is stated that an anondnscrypt query is the following:

<anondnscrypt-query> ::= <anon-magic> <server-ip> <server-port> <dnscrypt-query>

I don't think this definition does not allowe several relays to be chained.

What currently happen in your case is either:

I need to check the source to answer that.

ghost commented 4 years ago

I'm testing it with 6 relays, but sometimes, a few sites don't load.

Error: Problem loading page - Server not found

Should I better use 2-3 relays?

jedisct1 commented 4 years ago

Use 1 or 2 relays. More is useless and can only decrease reliability.

Sayrus commented 4 years ago

Use 1 or 2 relays. More is useless and can only decrease reliability.

Sorry @jedisct1 but I don't understand why you closed this issue. Even if we don't have advanced scheduling, how can a server be invalid if one of the relay is down?

For instance:

routes = [
  { server_name='suami', via=['anon-ibksturm', 'sdns://<a relay that is sometime down>'] }
]

(You can use an invalid relay like sdns://gQcxLjIuMy40)

If I start dnscrypt-proxy and the relay is down, I have no usable server (dnscrypt-proxy is waiting for at least one server to be reachable). Yet suami via anon-ibksturm is up and running. Moreover, if I get randomed on anon-ibksturm, I don't even get a warning if my other sdns is down. I may have a down server in my configuration without any warning for as long as the random doesn't pick it. Moreover, if it is down and there is no other server, dnscrypt-proxy will random again to find a working server. This is not the case if my relay is very slow, it will just find a server with anything less than timeout delay. So I might end up having 2s per dns query when there is a 2ms relay just under your nose. (Changing the timeout might lead to no server available if you go to another region which is not great either)

This issue is not only about latency, but also about reliability. No matter how little or big your relay list is, if you get randomed on a relay that is down or slow, you loose. Meaning that to get reliability, you need a larger server list, and pray that you don't get randomed on too many bad relay. (Hopefully, this never happen as a relay have great uptime)

That being said, I have not seen anything as reliable and easy to setup as dnscrypt-proxy at the moment. Thanks again for the hard work.

ghost commented 4 years ago

I switched to 4 relays and now I have no problems with that.