Po roce vývoje od vydání verze 1.24.0 byla vydána nová stabilní verze 1.26.0 webového serveru a reverzní proxy nginx (Wikipedie). Nová verze přináší řadu novinek. Podrobný přehled v souboru CHANGES-1.26.
Byla vydána nová verze 6.2 živé linuxové distribuce Tails (The Amnesic Incognito Live System), jež klade důraz na ochranu soukromí uživatelů a anonymitu. Přehled změn v příslušném seznamu. Tor Browser byl povýšen na verzi 13.0.14.
Byla vydána nová verze 30.0.0 frameworku pro vývoj multiplatformních desktopových aplikací pomocí JavaScriptu, HTML a CSS Electron (Wikipedie, GitHub). Chromium bylo aktualizováno na verzi 124.0.6367.49, V8 na verzi 12.4 a Node.js na verzi 20.11.1. Electron byl původně vyvíjen pro editor Atom pod názvem Atom Shell. Dnes je na Electronu postavena celá řada dalších aplikací.
Byla vydána nová verze 9.0.0 otevřeného emulátoru procesorů a virtualizačního nástroje QEMU (Wikipedie). Přispělo 220 vývojářů. Provedeno bylo více než 2 700 commitů. Přehled úprav a nových vlastností v seznamu změn.
Evropský parlament dnes přijal směrnici týkající se tzv. práva spotřebitele na opravu. Poslanci ji podpořili 584 hlasy (3 bylo proti a 14 se zdrželo hlasování). Směrnice ujasňuje povinnosti výrobců opravovat zboží a motivovat spotřebitele k tomu, aby si výrobky nechávali opravit a prodloužili tak jejich životnost.
Bylo oznámeno (cs) vydání Fedora Linuxu 40. Přehled novinek ve Fedora Workstation 40 a Fedora KDE 40 na stránkách Fedora Magazinu. Současně byl oznámen notebook Slimbook Fedora 2.
ČTK (Česká tisková kancelář) upozorňuje (X), že na jejím zpravodajském webu České noviny byly dnes dopoledne neznámým útočníkem umístěny dva smyšlené texty, které nepocházejí z její produkce. Jde o text s titulkem „BIS zabránila pokusu o atentát na nově zvoleného slovenského prezidenta Petra Pelligriniho“ a o údajné mimořádné prohlášení ministra Lipavského k témuž. Tyto dezinformace byly útočníky zveřejněny i s příslušnými notifikacemi v mobilní aplikaci Českých novin. ČTK ve svém zpravodajském servisu žádnou informaci v tomto znění nevydala.
Byla založena nadace Open Home Foundation zastřešující více než 240 projektů, standardů, ovladačů a knihoven (Home Assistant, ESPHome, Zigpy, Piper, Improv Wi-Fi, Wyoming, …) pro otevřenou chytrou domácnost s důrazem na soukromí, možnost výběru a udržitelnost.
Společnost Meta otevírá svůj operační systém Meta Horizon OS pro headsety pro virtuální a rozšířenou realitu. Vedle Meta Quest se bude používat i v připravovaných headsetech od Asusu a Lenova.
Společnost Espressif (ESP8266, ESP32, …) získala většinový podíl ve společnosti M5Stack, čímž posiluje ekosystém AIoT.
This article describes problems in configuration of traffic shaping in unusual circumstances. These circumstances are not as unusual as may by seem on first view. It's about real life situations.
This article expects basic knowledge about traffic shaping in GNU/Linux and packet path in Linux kernel.
Common usage of shaping in small network is traffic limiting on internet gateway. Company is connected to internet using DSL provider, WIFI or something similar, which doesn't have guaranteed quality. Configuring traffic shaping and QoS in this environment is hard. It may by impossible to guarantee anything.
The first problem is link quality. Internet service provider doesn't guarentee bandwidth, latency, nothing. Traffic shaping is typicaly based on slowing down packets. It handles TCP flow control. TCP sends packets as fast as client is able to send responses. Slowing down packets causes less inbound traffic, which is our mission. It's usual that there are many data streams which competes against. Each stream has its own data speed control and it is trying to take as much bandwidth as it is avaliable. Traffic shaping is applied at internet service provider's router, all data streams are same priority, when link capacity is filled up, all packets are delayed. It may be OK at home, but if you want to use IP telephony which quality will be realy bad, user will call for some solution.
Basic solution is to configure linux router, set traffic shaper, for example HTB and limit internet line. ISP limits our line to 1Mb/s so we configure shaper to 1Mb/s. (We follow only download part in this example.) One rule for basic internet traffic with limit to 512Mb/s and second one with limit to 512Mb/s for VoIP. There is too much unused conectivity for VoIP but there is reserve for more VoIP calls. But you want to use all your connectivity. It's possible with HTB, create one root rule with limit to 1Mb/s, one child rule with rate 128Mb/s and ceil 1Mb/s, next one child rule with rate 256Mb/s and ceil 512Mb/s. This configuration will work quite well - internet trafic will use first child rule, VoIP second one. If there is no VoIP traffic, internet traffic will use all available bandwidth. VoIP has guaranteed 256Mb/s which should be enought but if more VoIP traffic requirements occurs, it will be available with highier priority than common internet traffic. This is quite good solution, but there are some problems. When clients uses all available connectivity, VoIP quality suddenly drop. It will be close to quality without shaping. Where is problem? ISP does traffic shaping too and limitation of inbound traffic is firstly applied at ISP side and then by our router so ability to eliminate latency and priorize VoIP is minimal. Standard solution is to limit maximal bandwidth to 80 % or less of total bandwidth. It's usually the only one realizable sollution because it is realizable without ISP cooperation. It is nearly impossible to take some unusual configuration of ISP's traffic shaper.
Problem with shaping cascades is that there is no way to pass through traffic at not last shaper, it's solvable by underflow ISP's limitation, but it's not 100% solution in networks with aggregation of multiple clients, with speed unstable lines and so on.
If you are internet service provider, provides connectivity to your clients using multiple network cards and would share your unused connectivity between network cards, you hit limitation of linux shaping principles. Linux shaping usually uses output buffer of network card so it isn't possible to share bandwidth between more network cards. You can reserve bandwidth for each network card but you cannot share unused bandwidth between them.
There is solution which can help – IMQ. It creates special network interface used only for shaping. IMQ is not part of vanilla Linux kernel, it isn't included in distribution kernels, it's distributed only as patches. Installation requires patching kernel and iptables. IMQ is controlled using kernel module parameters – number of IMQ devices and iptables – packet routing. Typical solution uses two IMQ devices, one for upload and one for download. It is able to use iptables configuration to separate inbound and outbound traffic, separate networks, join and share network connectivity via many network cards.
Many ISPs provides Half-duplex lines or your users are connected using half-duplex technology, for example IEEE802.11 wifi. Maximum line capacity is usually known but its limit is for upload and download together. Basic Linux kernel limits at outbound interface output buffer so limiting together is not possible. Solution is to use IMQ as described in chapter Multiple network cards.
You can configure one IMQ devices for all traffic and route there all traffic – inbound and outbound. Using iptables and tc you can configure root rule with total line capacity and child nodes for upload and download. It's possible to provide limits such as 2Mb/s download and 512kb/s upload for many clients and use as much bandwidth as is currently available.
If you are administrator of small company network your network is probably connected to internet using router with nat and you want configure this router to equalize clients so you configure linux shaping using tc. Simple solution is routing packets to shapper using tc filter's u32 filter. It will work well without nat, but not with it. Problem is packet path in Linux kernel – shaping is applied after iptables changes source address so all upload traffic is count as only one address. It's usually solved by marking packets by iptables before address modification.
Second solution is using IMQ – it allows compile time configuration of hook in packet path which is able to shape traffic before nat.
Tiskni Sdílej: