Skip to content

Releases: cilium/pwru

Release v1.0.6

24 Apr 14:14
@github-actions github-actions
v1.0.6
133b041
Compare
Choose a tag to compare
Release v1.0.6 Latest
Latest

We are pleased to release the 1.0.6 version of pwru.

The major changes include:

  • pwru can track non-skb functions specified via --filter-non-skb-funcs (#355). For example, one can use pwru --filter-non-skb-funcs='xfrm_state_look_at,xfrm_state_lookup,xfrm_state_lookup_byaddr,xfrm_state_lookup_byspi' to enrich IPsec packet traces.
  • Added tracing of skb's even if they were kfree-d (#354). By specifying --filter-track-skb-by-stackid, one can trace packets if they were freed, and then rebuilt (e.g., L2 bridge traffic).
  • pwru is now able to output in JSON (#285). For example:
# pwru --output-tuple --output-meta --output-json 'host 1.1.1.1' | jq .
<..>
{
  "skb": "0xffff8fad947baf00",
  "cpu": 10,
  "process": "/usr/lib/firefox/firefox:1416291",
  "func": "kfree_skbmem",
  "iface": "0",
  "proto": 2048,
  "len": 94,
  "tuple": {
    "saddr": "1.1.1.1",
    "daddr": "192.168.1.159",
    "sport": 53,
    "dport": 34815,
    "proto": 17
  }
}
  • (De)attaching kprobes got ~1.2 times faster (#277).

Functional changes:

Dependency changes:

  • 133b041 - build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3
  • 5c2c5b3 - build(deps): bump github.com/cilium/ebpf from 0.14.0 to 0.15.0
  • edaa366 - build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
  • 5a9c525 - build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0
  • a591840 - build(deps): bump github.com/cilium/ebpf from 0.13.2 to 0.14.0
  • 43200e2 - build(deps): bump golang.org/x/net from 0.21.0 to 0.24.0
  • 0a9e2d1 - build(deps): bump cilium/little-vm-helper from 0.0.16 to 0.0.17
  • c825d7f - build(deps): bump actions/checkout from 4.1.1 to 4.1.2
  • 4ca5c81 - build(deps): bump golang.org/x/sys from 0.17.0 to 0.18.0
  • e2d32b2 - build(deps): bump actions/download-artifact from 4.1.3 to 4.1.4
  • 17830c3 - build(deps): bump actions/download-artifact from 4.1.2 to 4.1.3
  • 97398fc - build(deps): bump golang.org/x/sync from 0.3.0 to 0.6.0
  • fa55033 - build(deps): bump github.com/cilium/ebpf from 0.13.0 to 0.13.2
  • 18c7bdf - build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1
  • 9e40901 - build(deps): bump actions/download-artifact from 4.1.1 to 4.1.2
  • 732586d - build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0
  • b8c253d - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.4 to 3.1.5
  • 5d8da3d - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.0 to 1.4.1
  • b1a5273 - build(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0
  • 2172e77 - build(deps): bump actions/download-artifact from 4.1.0 to 4.1.1
  • 587aa49 - build(deps): bump golang.org/x/net from 0.19.0 to 0.20.0
  • 4aceb7f - build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
  • 50bd586 - build(deps): bump golang.org/x/sys from 0.15.0 to 0.16.0

Contributors

brb, tklauser, and 5 other contributors
Assets 6

Release v1.0.5

20 Dec 14:15
@github-actions github-actions
v1.0.5
d86733b
Compare
Choose a tag to compare
Release v1.0.5

We are pleased to release the 1.0.5 version of pwru.

The major changes include:

  • Fix loading on >= the 6.6 kernel when there are multiple functions with the same name (#302, #284).

Functional changes:

Dependency changes:

  • d86733b - build(deps): bump github.com/jsimonetti/rtnetlink from 1.3.5 to 1.4.0
  • c5ae578 - build(deps): bump actions/setup-go from 4.1.0 to 5.0.0
  • 0d23d55 - build(deps): bump cilium/little-vm-helper from 0.0.12 to 0.0.13
  • 4e5205c - build(deps): bump golang.org/x/net from 0.17.0 to 0.19.0

Contributors

brb, jschwinger233, and qmonnet
Assets 6

Release v1.0.4

31 Oct 09:01
@github-actions github-actions
v1.0.4
37227ac
Compare
Choose a tag to compare
Release v1.0.4

We are pleased to release the 1.0.4 version of pwru.

The major changes include:

  • pwru is able to show TC BPF programs execution when --filter-trace-tc is set (#271). For example: 
    0xffff91d7c885f0e8      5   [curl(261789)]  cil_from_container netns=... mark=0x0 iface=11(lxc9376ae2995cc)
    shows execution of the Cilium's cil_from_container BPF program.
  • Fixed outputing of network interface and process name (#279, #280). The latter gives better insight which user or kernel process handles a packet. For example: 
    0xffffa0fbe16e1500     15 [kworker/15:3-wg-crypt-cilium_wg0(82260)] ....
    shows a kernel thread handling WireGuard encryption for cilium_wg0 device.
  • The packet tracing is extended to support skb_clone() and skb_copy when --filter-trace-skb is set (#275). This is useful to trace packets which get modified and no longer match given filters (e.g., after SNAT, tunnel encapsulation, encryption, etc).

Functional changes:

Dependency changes:

  • d6d604d - build(deps): bump github.com/cilium/ebpf from 0.12.0 to 0.12.2
  • 514bedf - build(deps): bump actions/checkout from 4.1.0 to 4.1.1
  • 3abc99e - build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0

Contributors

brb, tklauser, and 4 other contributors
Assets 6

Release v1.0.3

28 Sep 12:26
@github-actions github-actions
v1.0.3
93ca1a5
Compare
Choose a tag to compare
Release v1.0.3

We are pleased to release the 1.0.3 version of pwru.

The major changes include:

  • Added support for L2 filters. For example, to filter ARP replies you can run pwru 'arp and arp[6:2] == 2' (#255).
  • Added --filter-ifname which allows users to select which device packets should be filtered. The option can be used with --filter-netns which was changed to accept either inode number (inode:) or a file path to a network namespace. For example, to filter only eth0 packets in the 42 pid's network namespace you can run pwru --filter-iface eth0 --filter-netns /proc/42/ns/net (#257).
  • The --output-meta was extended to print a network interface name. For example, iface=3(wlan0) (#259).

Functional changes:

Dependency changes:

  • 7849235 - build(deps): bump actions/checkout from 4.0.0 to 4.1.0 dependabot[bot]
  • df2c42a - build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 dependabot[bot]
  • b781f31 - build(deps): bump golang.org/x/tools from 0.12.0 to 0.13.0 dependabot[bot]

Contributors

brb, jschwinger233, and azzid
Assets 6

Release v1.0.2

05 Sep 08:53
@github-actions github-actions
v1.0.2
908776a
Compare
Choose a tag to compare
Release v1.0.2

We are pleased to release the 1.0.2 version of pwru.

This release fixes the bug in the v1.0.1 pwru due to invalid byte code produced by libpcap.a when compiled with LLVM 13 (#245):

Failed to inject filter ebpf for kprobe_skb_2: register r8 used twice

Functional changes:

  • 908776a - gh/workflows: Use "make release" to build pwru for testing (@brb)
  • 50c2e2f - make: Use LLVM 15 for release builds (@brb)

Dependency changes:

  • 80d7973 - build(deps): bump actions/checkout from 3.6.0 to 4.0.0
  • cea9128 - build(deps): bump golang.org/x/sys from 0.11.0 to 0.12.0

Contributors

brb
Assets 6

Release v1.0.1

04 Sep 10:03
@github-actions github-actions
v1.0.1
cc9c63f
Compare
Choose a tag to compare
Release v1.0.1

We are pleased to release the 1.0.1 version of pwru.

The major changes include:

  • When --filter-track-skb is used, stop tracking a packet once it hits kfree_skbmem. This significantly helps to reduce pwru output volume.

Functional changes:

Dependency changes:

  • bdfbfbe - build(deps): bump actions/checkout from 3.5.3 to 3.6.0
  • 44708d3 - build(deps): bump actions/setup-go from 4.0.1 to 4.1.0
  • ad4c372 - build(deps): bump golang.org/x/tools from 0.11.0 to 0.12.0
  • 8d5ffa2 - build(deps): bump cilium/little-vm-helper from 0.0.11 to 0.0.12
  • 10e84a2 - build(deps): bump cilium/little-vm-helper from 0.0.7 to 0.0.11

Contributors

brb, benner, and jschwinger233
Assets 6

Release v1.0.0

14 Jul 13:43
@github-actions github-actions
v1.0.0
bc07418
Compare
Choose a tag to compare
Release v1.0.0

We are pleased to release the 1.0.0 version of pwru. It is the first major version ever released 🎉

The major changes include:

  • Added support for libpcap-based filtering (#198 by @jschwinger233). Now it's possible to filter packets in the same way as with tcpdump. For example, to trace only TCP SYN packets to 1.1.1.1 run pwru 'host 1.1.1.1 and tcp[tcpflags] == tcp-syn'. Please refer to man 7 pcap-filter for the full filtering syntax.

  • Added --filter-track-skb to trace packets even if they were modified and no longer match given filters (#194 by @jschwinger233). Useful when tracing packets which can be (d)encapsulated, SNAT-ed, encrypted, etc.

  • Fixed pwru slow loading on Ubuntu due to the bug in pahole (cilium/ebpf#1084 by @lmb).

  • Fixed trace loses due to perf ring buffer being full (#195 by @jschwinger233). Now traces are stored in BPF_MAP_TYPE_QUEUE instead of BPF_MAP_TYPE_PERF_EVENT_ARRAY.

  • The userspace code was re-licensed under Apache-2.0, while the BPF under BSD 2-Clause and GPL-2.0 (#190 by @brb).

Functional changes:

Dependency changes:

  • 658dbbc - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.2 to 3.1.4
  • f7c232d - build(deps): bump golang.org/x/tools from 0.10.0 to 0.11.0
  • 4554207 - build(deps): bump KyleMayes/install-llvm-action from 1.8.2 to 1.8.3
  • ef0d566 - build(deps): bump golang.org/x/sys from 0.9.0 to 0.10.0
  • 7fbf855 - build(deps): bump KyleMayes/install-llvm-action from 1.8.1 to 1.8.2
  • 5291216 - Bump cilium/little-vm-helper from 0.0.5 to 0.0.7
  • 7753fe6 - Bump golang.org/x/tools from 0.9.3 to 0.10.0
  • 45794bd - Bump actions/checkout from 3.5.2 to 3.5.3
  • b915176 - Bump golang.org/x/sys from 0.8.0 to 0.9.0
  • 8f35632 - Bump KyleMayes/install-llvm-action from 1.8.0 to 1.8.1
  • 74dc67b - Bump golang.org/x/tools from 0.9.2 to 0.9.3
  • beded6f - Bump cilium/little-vm-helper from 0.0.4 to 0.0.5
  • ce78405 - Bump golang.org/x/tools from 0.9.1 to 0.9.2
  • 3315bec - Bump cilium/little-vm-helper from 0.0.3 to 0.0.4
  • 232f2da - Bump actions/setup-go from 4.0.0 to 4.0.1
  • 3d78bb2 - Bump golang.org/x/tools from 0.9.0 to 0.9.1
  • d87353a - Bump golang.org/x/tools from 0.8.0 to 0.9.0
  • 0a08823 - Bump golang.org/x/sys from 0.7.0 to 0.8.0
  • bbc414b - Bump actions/checkout from 3.5.0 to 3.5.2
  • 347e780 - Bump golang.org/x/tools from 0.7.0 to 0.8.0
  • fadf199 - Bump golang.org/x/sys from 0.6.0 to 0.7.0
  • f699d81 - Bump KyleMayes/install-llvm-action from 1.7.0 to 1.8.0
  • 5106872 - Bump actions/checkout from 3.4.0 to 3.5.0

Contributors

brb, lmb, and 6 other contributors
Assets 6

Release v0.0.9

17 Mar 15:55
@github-actions github-actions
v0.0.9
c895af3
Compare
Choose a tag to compare
Release v0.0.9

We are pleased to release the 0.0.9 version of pwru.

The major changes include:

  • Fix the IPv6 filtering, in particular --filter-{src,dst}-ip and --filter-proto=icmp6 (#157 and #165).

Functional changes:

Dependency changes:

  • c895af3 - Bump actions/checkout from 3.3.0 to 3.4.0
  • 53e2e55 - Bump actions/setup-go from 3.5.0 to 4.0.0
  • 6654c61 - Bump actions/cache from 3.3.0 to 3.3.1
  • 9e64551 - Bump actions/cache from 3.2.6 to 3.3.0
  • 84d00b7 - Bump golang.org/x/tools from 0.5.0 to 0.7.0
  • a097dfa - Bump golang.org/x/sys from 0.5.0 to 0.6.0
  • a33df81 - Bump github.com/cheggaaa/pb/v3 from 3.1.0 to 3.1.2
  • 227c9cf - Bump actions/cache from 3.2.5 to 3.2.6
  • 4b97395 - Bump cilium/ebpf to v0.10.0
  • 0cbf834 - Bump actions/cache from 3.2.4 to 3.2.5
  • a1ddc97 - Bump golang.org/x/sys from 0.4.0 to 0.5.0

Contributors

brb, Asphaltt, and sterchelen
Assets 6

Release v0.0.8

07 Feb 10:47
@github-actions github-actions
v0.0.8
8426338
Compare
Choose a tag to compare
Release v0.0.8

We are pleased to release the 0.0.8 version of pwru.

The major changes include:

  • New filter --filter-port to allow users to filter either source or destination L4 port (#141).
  • Print packet drop reason from kfree_skb_reason (#148). For example: 
     kfree_skb_reason(SKB_DROP_REASON_NETFILTER_DROP) 2.2.2.2:52276->1.1.1.1:4240(tcp)

Functional changes:

Dependency changes (dependabot):

  • 1a55e48 - Bump actions/cache from 3.2.3 to 3.2.4
  • 4c5f6c1 - Bump KyleMayes/install-llvm-action from 1.6.1 to 1.7.0
  • 7fffe1f - Bump actions/cache from 3.2.2 to 3.2.3
  • 2c1d48c - Bump golang.org/x/tools from 0.4.0 to 0.5.0
  • f003c72 - Bump actions/upload-artifact from 3.1.1 to 3.1.2
  • afa3cf1 - Bump golang.org/x/sys from 0.3.0 to 0.4.0
  • 1039b26 - Bump actions/checkout from 3.2.0 to 3.3.0
  • f1790aa - Bump actions/cache from 3.2.0 to 3.2.2
  • 5b5f886 - Bump actions/cache from 3.0.11 to 3.2.0
  • 8d5ac07 - Bump cilium/little-vm-helper
  • eea1a65 - Bump actions/checkout from 3.1.0 to 3.2.0

Contributors

gandro, brb, and 2 other contributors
Assets 6

Release v0.0.7

14 Dec 14:44
@github-actions github-actions
v0.0.7
12fcaef
Compare
Choose a tag to compare
Release v0.0.7

We are pleased to release the 0.0.7 version of pwru.

The major changes include:

  • Blazingly fast load time thanks to the multi-link kprobes #99.
  • Continuous integration tests #111.
  • Fix of the IPv6 filtering #121.

12fcaef - make: Use git safe.directory instead of mangling uid/gid (@brb)
120e969 - Add IPv6 test case (@brb)
6b118cf - Fix ipv6 filtering (@brb)
fe62d2c - Small vars declaration cleanup (@brb)
ee7e5e7 - Add type shim for kprobes representation in Go (@brb)
820fbb2 - Add multi-link kprobe support (@brb)
feba59a - Add HaveBPFLinkKprobeMulti (@brb)
5bd118a - bpf: Add kprobe.multi (@brb)
19ca0ed - bpf: Prepare for bpf_get_func_ip() (@brb)
93cf26f - Bump actions/setup-go from 3.4.0 to 3.5.0 (dependabot)
f37867b - Bump KyleMayes/install-llvm-action from 1.6.0 to 1.6.1 (dependabot)
f4bb669 - Bump actions/setup-go from 3.3.1 to 3.4.0 (dependabot)
32cf9dd - Bump actions/upload-artifact from 3.1.0 to 3.1.1 (dependabot)
fbdd809 - Bump cilium/little-vm-helper (dependabot)
b8de3be - Bump cilium/little-vm-helper (dependabot)
3d205fe - Add CI tests (@brb)
0a23f88 - Add hidden --ready-file (@brb)
0a62618 - Add --output-file to log traces (@brb)
2692f2e - Update after renaming to main branch (@tklauser)

Contributors

brb and tklauser
Assets 6