dnscrypt-cake

Note

The goal of this project is to provide another alternative that "just works" for not-so-technical users. Thus, users only need to set these values correctly: uplinkInterface, downlinkInterface, maxDL, and maxUL.

Table of Contents

1. About
2. What to expect
3. Congestion Control Consideration
4. How it works
5. How to compile the code
6. See dnscrypt-cake in action
7. Credits

---

About

⬆️ Go to Table of Contents

CAKE (Common Applications Kept Enhanced) is a comprehensive smart queue management that is available as a queue discipline (qdisc) for the Linux kernel. It is one of the best qdiscs designed to solve bufferbloat problems at the network edge.

According to the CAKE's ROUND TRIP TIME PARAMETERS man7 page, if there is a way to adjust the RTT dynamically in real-time, it should theoretically make CAKE able to give the best possible AQM results between latency and throughput.

dnscrypt-cake is an attempt to adjust CAKE's rtt parameter in real-time based on real latency per DNS request using a slightly modified version of dnscrypt-proxy 2. In addition to that, it will also adjust bandwidth intelligently while constantly monitoring your real RTT.

This is an adaptation of the cake-autorate project implemented in Go, but it's adjusting CAKE's rtt and bandwidth based on your every DNS request and what website you are visiting, not by only ping-ing to 1.1.1.1, 8.8.8.8 and/or any other DNS servers.

This implementation is suitable for servers and networks where most of the users are actively sending DNS requests.

---

What to expect

⬆️ Go to Table of Contents

There are several things you can expect from using this implementation:

1. You only need to worry about setting up uplinkInterface, downlinkInterface, maxDL, and maxUL correctly.
2. It will manage bandwidth intelligently (do a speedtest using Speedtest CLI or similar tools to see it in action).
3. It will manage rtt ranging from 10ms - 1000ms.
4. It will manage split-gso automatically.
5. It is able to scale CAKE's bandwidth from 1 Mbit/s to 1 Gbit/s (or even more) in seconds.

Note

Just set maxDL and maxUL based on whatever speed advertised by your ISP. No need to limit them to 90% or something like that. The code logic will try to handle that automatically.

---

Congestion Control Consideration

⬆️ Go to Table of Contents

You may want to consider what TCP CC algorithm to use that works best for your workloads. Different CC handles congestion differently, and that will affect how fast dnscrypt-cake is able to restore the configured bandwidth when a latency increase is detected.

Below are the CC algorithms that we have tested and worked well with dnscrypt-cake in a server environment:

1. reno — The Reno TCP CC
2. cubic — The CUBIC TCP CC
3. scalable — The Scalable TCP CC
4. dctcp — The DCTCP TCP CC
5. htcp — The H-TCP TCP CC
6. highspeed — The High Speed TCP CC
7. yeah — The YeAH TCP CC
8. bbr — The BBR TCP CC (v1 and v3)

Important

1. dctcp must not be deployed over the public Internet without additional measures.
2. Using bbr might cause issues such as frequent captchas on some websites or any other issues. This article by APNIC can give you some references on when you may want to use it.

---

How it works

⬆️ Go to Table of Contents

1. When a latency increase is detected, dnscrypt-cake will try to check if the DNS latency is in the range of 10ms - 1000ms or not. If yes, then use that as CAKE's rtt, if not then use rtt 10ms if it's less than 10ms, and rtt 1000ms if it's more than 1000ms.
2. dnscrypt-cake will then adjust CAKE's bandwidth using all data in the dataTotal slice/array.
3. The cake() function will try to handle bandwidth, rtt, and split-gso in milliseconds.

Note

The cake() function will configure CAKE and re-calculate rtt and bandwidth, then save the latest data into several slices/arrays. The arrays can hold up to 100000 data, and the cake() function will loop infinitely with a sleep of 100 microseconds for each loop. All data will be used to calculate the final values for configuring CAKE's rtt and bandwidth.

This is an attempt to intelligently configure CAKE's rtt and bandwidth based on all the data, so it doesn't need to aggressively probe DNS servers like what the original cake-autorate implementation does.

---

How to compile the code

⬆️ Go to Table of Contents

1. Download and install The Go Programming Language.

2. Copy the files from ./dnscrypt-cake/cake-support to ./dnscrypt-cake/dnscrypt/dnscrypt-proxy.

3. Edit the plugin_query_log.go file and adjust these values:

   1. uplinkInterface and downlinkInterface to your network interface names.
   2. maxDL and maxUL to your maximum network bandwidth (in kilobit/s format) advertised by your ISP.
   3. CertFilePath and KeyFilePath to where your SSL certificate is located.

4. Then, simply compile the code with the following commands:

$ cd ./dnscrypt-cake/dnscrypt/dnscrypt-proxy
$ go mod tidy
$ go build

Important

1. You have to run the binary with sudo since it needs to change the linux qdisc, so it needs enough permissions to do that.
2. It's not recommended to change cakeUplink and cakeDownlink parameters in the plugin_query_log.go file as they are intended to only handle bandwidth and rtt. If you need to change CAKE's parameters, change them directly from the terminal.
3. Use httpserverGin.ListenAndServe() instead of httpserverGin.ListenAndServeTLS(CertFilePath, KeyFilePath) in the plugin_query_log.go file if you don't want to use SSL certificate (i.e. you're using localhost instead of 0.0.0.0).

---

See dnscrypt-cake in action

⬆️ Go to Table of Contents

We are testing dnscrypt-cake in our server here:

https://net.0ms.dev:7777/netstat

See dnscrypt-cake metrics here:

https://net.0ms.dev:22222/cake

---

Credits

⬆️ Go to Table of Contents

Although we are writing this guide to let people know about our implementation, it was made possible by using other things provided by the developers and/or companies mentioned in this guide.

All credits and copyrights go to the respective owners.