Release v1.0.11

Major Changes

• pwru can trace BPF map operations with --output-bpfmap #453 #632. For example:

  pwru --filter-track-bpf-helpers --output-bpfmap 'udp' 
  ...
  0xffff8aecbed7b200 4   qemu-kvm:98915   4026533848 0             eth0:2      0x0800 1500  148   172.128.0.7:52228->172.128.0.6:8472(udp)   bpf_skb_load_bytes
  0x0                4   qemu-kvm:98915   4026533848 0             eth0:2      0x0800 1500  148   172.128.0.7:52228->172.128.0.6:8472(udp)   __htab_map_lookup_elem
  map_id: 466
  map_name: cilium_lb4_serv
  key(12):
  00000000  ac 80 00 06 21 18 00 00  11 00 00 00              |....!.......|
  value(12):
  00000000  00 00 00 00 00 00 00 00  00 00 00 00              |............|
  ...
  

  BTF-based pretty-printing is coming in a next release.
• libpcap-based filtering for XDP with --filter-track-xdp was fixed #603 #609 #635.
• pwru can filter based on sk_buff and xdp_buff fields #499. For example, you can use `skb->dev->ifindex == 42' to show traces of packets which are processed by a netdev with the interface index equal to 42.
• pwru was ported to run on RISC-V64 #604.
• Performance was improved for pwru trace outputting and process name resolution #634.

What's Changed

• Update README.md by @brb in #590
• pwru: Add --filter-skb-expr and --filter-xdp-expr by @Asphaltt in #499
• chore(deps): update all dependencies by @renovate[bot] in #592
• gh/workflows: Add test for --filter-skb-expr by @brb in #593
• Automatically LVH update kernels by @brb in #594
• chore(deps): update all dependencies by @renovate[bot] in #595
• fix(deps): update module github.com/spf13/pflag to v1.0.10 by @renovate[bot] in #596
• fix(deps): update all go dependencies main by @renovate[bot] in #598
• chore(deps): update softprops/action-gh-release action to v2.3.3 by @renovate[bot] in #597
• chore(deps): update actions/setup-go digest to c0137ca by @renovate[bot] in #599
• cleanup: small code cleanups by @Andreagit97 in #600
• new: add logs for traced ebpf progs by @Andreagit97 in #601
• libpcap: build without DPDK by @hack3ric in #606
• chore(deps): update all dependencies by @renovate[bot] in #605
• renovate: update release Go image by @tklauser in #607
• chore(deps): update all dependencies by @renovate[bot] in #608
• chore(deps): update all dependencies to v1.25.2 by @renovate[bot] in #611
• fix(deps): update all go dependencies main by @renovate[bot] in #612
• Add repology badge to list all distro pkgs by @brb in #614
• chore(deps): update all dependencies by @renovate[bot] in #613
• gh/workflows: Renovate lvh-version by @brb in #615
• bpf: Harden getting func ip by @Asphaltt in #609
• chore(deps): update all dependencies by @renovate[bot] in #616
• update: use bpf_get_func_ip if available by @Andreagit97 in #603
• chore(deps): update all dependencies by @renovate[bot] in #618
• fix(deps): update module github.com/jsimonetti/rtnetlink/v2 to v2.1.0 by @renovate[bot] in #617
• fix(deps): update module github.com/cilium/ebpf to v0.20.0 by @renovate[bot] in #619
• fix(deps): update module github.com/cilium/ebpf to v0.20.0 by @renovate[bot] in #620
• Add riscv64 support by @hack3ric in #604
• chore(deps): update all dependencies by @renovate[bot] in #622
• Fix path for available_filter_functions access by @Seas0 in #623
• chore(deps): update all dependencies by @renovate[bot] in #624
• fix(deps): update all go dependencies main by @renovate[bot] in #625
• chore(deps): update all dependencies by @renovate[bot] in #626
• chore(deps): update all dependencies by @renovate[bot] in #628
• chore(deps): update all dependencies by @renovate[bot] in #630
• fix(deps): update all go dependencies main by @renovate[bot] in #629
• chore(deps): update all dependencies by @renovate[bot] in #631
• Collect bpf helper arguments related to bpf map by @jschwinger233 in #453
• bpf: Use get_addr() in BPF map kprobes by @brb in #632
• Improve logging by @brb in #633
• bpf: Fix pcap filter bypass with --filter-trace-xdp and --filter-track-skb by @brb in #635
• chore(deps): update golang:1.25.5 docker digest to 6cc2338 by @renovate[bot] in #636
• Misc improvements by @brb in #634
• chore(deps): update all dependencies by @renovate[bot] in #637
• fix(deps): update module golang.org/x/sys to v0.40.0 by @renovate[bot] in #638
• chore(deps): update all dependencies by @renovate[bot] in #640
• fix(deps): update module golang.org/x/net to v0.49.0 - autoclosed by @renovate[bot] in #641
• chore(deps): update actions/checkout action to v6.0.2 by @renovate[bot] in #643
• chore(deps): update all dependencies by @renovate[bot] in #647
• Modernize Go code by @tklauser in #644
• go.mod, tools: use Go 1.24 tool dependencies by @tklauser in #645

New Contributors

• @Andreagit97 made their first contribution in #600
• @hack3ric made their first contribution in #606
• @Seas0 made their first contribution in #623

Full Changelog: v1.0.10...v1.0.11

Release v1.0.10

Major Changes

• Users can now select which SKB/XDP fields to output using --output-{skb,xdp}-metadata #509. For example:

  pwru --filter-trace-xdp --output-xdp-metadata 'xdp->rxq->dev->ifindex' host 1.1.1.1
  ... 1.1.1.1:0->192.168.241.133:0(icmp) bpf_prog_3b185187f1855c4c_dummy[bpf](xdp) ifindex=2
  

• Added support for tunnel traffic filtering and output #494. For example:

  pwru --filter-func=udp_queue_rcv_skb  'port 8472' --output-tunnel --filter-tunnel-pcap-l3 'port 8080'  --output-tcp-flags
  ...
  172.18.0.5:54806->172.18.0.2:8472(udp) udp_queue_rcv_skb 52:2e:36:8d:11:23 -> ba:44:d8:6c:66:5a 10.244.1.205:36739->10.244.3.122:8080(tcp:SYN)
  

• pwru now accepts an SKB mark mask via --filter-mark mark[/mask] #471. For example, you can run pwru --filter-mask 0xa00/0xf00.
• The fast kprobe-multi backend is now supported for tracing kernel modules #470. For example:

  pwru --all-kmods
  ... Attaching kprobes (via kprobe-multi)...
  

• TCP flags can now be displayed when --output-tcp-flags is set #466. For example:

  pwru --output-tcp-flags 'host 1.1.1.1'
  ...
  ... 192.168.1.165:44884->1.1.1.1:80(tcp:SYN) ip_local_out
  

• In addition to amd64, pwru is now published for arm64 in the Docker container image #569.
• pwru is now tested in CI tested on both amd64, but also arm64 #576.
• pwru can now run on the LoongArch architecture #337.

Full Changelog

• README: Mention that debugfs is optional by @brb in #447
• build(deps): bump golang.org/x/net from 0.28.0 to 0.30.0 by @dependabot[bot] in #443
• Dockerfile: build arm64 variants by @akerouanton in #449
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 by @dependabot[bot] in #454
• build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot[bot] in #456
• build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot[bot] in #446
• bpf: Remove OUTPUT_SKB&HAS_KPROBE_MULTI macros by @Asphaltt in #455
• Ensure fentry and kprobe programs share the maps by @jschwinger233 in #459
• Fix tracing tc-bpf with --filter-track-skb-by-stackid by @Asphaltt in #452
• Collect and output skb->cb when --filter-trace-tc by @jschwinger233 in #461
• Add --output-skb-cb by @brb in #465
• build(deps): bump golang.org/x/net from 0.30.0 to 0.32.0 by @dependabot[bot] in #463
• build(deps): bump actions/setup-go from 5.0.2 to 5.2.0 by @dependabot[bot] in #467
• build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0 by @dependabot[bot] in #473
• build(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 by @dependabot[bot] in #472
• Support --filter-mark mark/[/mask] by @rgo3 in #471
• build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 by @dependabot[bot] in #474
• Enable kprobe-multi for kmods by default by @rgo3 in #470
• build(deps): bump github.com/vishvananda/netns from 0.0.4 to 0.0.5 by @dependabot[bot] in #475
• build(deps): bump golang.org/x/arch from 0.11.0 to 0.13.0 by @dependabot[bot] in #478
• build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 by @dependabot[bot] in #479
• gh/workflows: Fix fetching pwru logs by @brb in #375
• gh/workflows: Bump LVH images by @brb in #440
• Bump cilium/ebpf to 0.17.1 by @brb in #481
• Events from kprobe.multi have eventTypeKprobeMulti set in .type by @jschwinger233 in #477
• gh/workflows: Add --backend=kprobe-multi test by @brb in #482
• cleanup: setting LogSize is deprecated/unused. by @tommyp1ckles in #487
• build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.5 to 3.1.6 by @dependabot[bot] in #490
• Output TCP flags alongside tuple by @Asphaltt in #466
• gh/workflows: Set up traffic before running pwru by @brb in #493
• build(deps): bump github.com/cilium/ebpf from 0.17.1 to 0.17.2 by @dependabot[bot] in #495
• Fix broken --filter-trace-xdp caused by go-ebpf v0.17.1 by @Asphaltt in #484
• Add dummy --filter-track-{tc,xdp} tests by @brb in #492
• build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by @dependabot[bot] in #496
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot[bot] in #500
• build(deps): bump golang.org/x/sys from 0.29.0 to 0.30.0 by @dependabot[bot] in #501
• build(deps): bump golang.org/x/arch from 0.13.0 to 0.14.0 by @dependabot[bot] in #504
• build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot[bot] in #505
• build(deps): bump github.com/cilium/ebpf from 0.17.2 to 0.17.3 by @dependabot[bot] in #506
• Add LoongArch support by @chenhengqi in #337
• CI: Fix Failures: Bump LVM action version to latest release. by @tommyp1ckles in #511
• Support outputting and filtering by vxlan/geneve tunnel data by @tommyp1ckles in #494
• deps: Bump github.com/cheggaaa/pb/v3 from 3.1.6 to 3.1.7 by @brb in #512
• Move static variables of big size to percpu array by @jschwinger233 in #503
• chore: Configure Renovate by @renovate[bot] in #515
• chore(deps): update actions/download-artifact digest to 95815c3 by @renovate[bot] in #521
• chore(deps): update actions/checkout digest to 85e6279 by @renovate[bot] in #517
• chore(deps): update actions/create-release digest to 4c11c9f - autoclosed by @renovate[bot] in #520
• renovate: Run go mod tidy by @brb in #524
• fix(deps): update github.com/cloudflare/cbpfc digest to ff978e9 by @renovate[bot] in #526
• chore(deps): update actions/setup-go digest to dca8468 by @renovate[bot] in #522
• fix(deps): update module golang.org/x/net to v0.36.0 [security] by @renovate[bot] in #516
• fix(deps): update module golang.org/x/sys to v0.31.0 by @renovate[bot] in #532
• chore(deps): update dependency go to v1.24.2 by @renovate[bot] in #528
• chore(deps): update docker.io/library/golang docker tag to v1.24.2 by @renovate[bot] in #529
• renovate: Run on Fri and group all deps by @brb in #535
• Remove dependabot.yml by @brb in #536
• Introduce two enhancements for func IP by @Asphaltt in #468
• go.mod: Bump to 1.24.1 by @brb in #538
• fix(deps): update all dependencies by @renovate[bot] in #537
• pwru: Add --output-skb-metadata and --output-xdp-metadata by @Asphaltt in #509
• fix(deps): update all dependencies by @renovate[bot] in #542
• Support output tuple for 802.1Q by @chenhengqi in #544
• fix(deps): update all dependencies by @renovate[bot] in #547
• fix(deps): update all dependencies by @renovate[bot] in #550
• Move Contributing to a separate file by @xmulligan in #510
• renovate: Try to fix go mod tidy issues by @brb in #553
• renovate: Fix syntax by @brb in #555
• Compile libpcap with --disable-protochain by @jschwinger233 in #558
• Add percpu buffer flag by @AdvH039 in #552
• chore(deps): update all dependencies by @renovate[bot] in #556
• renovate: Run go mod vendor by @brb in #561
• renovate: Fix syntax error by @brb in #563
• ci: add workflow to validate renovate config by @tklauser in #564
• renovate: Try go mod vendor/tidy for the group by @brb in #565
• renovate: Allow go.sum updates by @brb in #567
• vendor: Switch to rtnetlink@v2 by @brb in #568
• fix(deps): update all go dependencies main by @renovate[bot] in #566
• ci: release workfl...

Release v1.0.9

We are pleased to release the 1.0.9 version of pwru.

The major changes include:

• Fixed libpcap filtering for tracing XDP programs (--filter-trace-xdp) #439.
• Added drop reasons when sk_skb_reason_drop() is called #430.

Functional changes:

• aebb893 - README.md: Update Clang/LLVM dependency to 12 (@joestringer)
• 1c354fa - bpf: Fix broken filter with --filter-trace-xdp (@jschwinger233)
• 195950a - Skip kprobing bpf progs for --filter-track-bpf-helpers (@Asphaltt)
• 5455e74 - Fix verifier error to run --filter-trace-tc + --filter-track-bpf-helpers (@Asphaltt)
• bde4f64 - gh/workflows: Use ubuntu-latest (@brb)
• 2ed349d - Print drop reason from sk_skb_reason_drop (@DanPartelly)
• 0dc9829 - Fix a minor code logic issue of xdp tracing (@Asphaltt)
• 1de15ff - Fix broken --filter-trace-xdp (@Asphaltt)
• 759fc7a - Fix broken --filter-trace-tc (@Asphaltt)

Dependency changes:

• 8a4dd24 - build(deps): bump actions/checkout from 4.1.7 to 4.2.1
• 925df0e - build(deps): bump golang.org/x/sys from 0.24.0 to 0.26.0
• c7c2ed7 - build(deps): bump actions/upload-artifact from 4.3.6 to 4.4.3
• 82dbbf3 - build(deps): bump golang.org/x/arch from 0.8.0 to 0.11.0

Release v1.0.8

We are pleased to release the 1.0.8 version of pwru.

The major changes include:

• pwru is now able to trace BPF helpers (#390). To enable it, set --filter-track-bpf-helpers. In addition, when it is set together with --output-caller, it can be used to roughly trace BPF tailcalls. For example:

# pwru --output-caller --output-tuple --filter-track-bpf-helpers
...
10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem          bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) array_map_update_elem        bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) trie_lookup_elem             bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) percpu_array_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem       bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
...

• Fix tracking of sk_buff built from xdp_md when --filter-track-skb is used (#410).

Functional changes:

• 81b7b62 - Enable --output-tuple and --output-meta by default (@brb)
• ca38cef - Do not open kcore in init() (@brb)
• 4a5c234 - Fix Dockerfile (@brb)
• db68c01 - Bump Go version to 1.23.1 (@brb)
• 3bf9d91 - Abort if runtime.GOARCH is not amd64 (@jschwinger233)
• 18838c4 - Update vendor (@jschwinger233)
• 7deb4a0 - Add --filter-track-bpf-helpers (@jschwinger233)
• fc7e097 - Add GetBpfHelpers() API (@jschwinger233)
• 2893168 - Track xdp_md built from skb (@jschwinger233)
• 2f09d77 - Track skb built from xdp_md (@jschwinger233)
• 3824944 - bpf: Use &skb for --filter-track-skb again (@jschwinger233)
• ce21b83 - bpf: Use percpu array to replace __sync_fetch_and_add (@jschwinger233)
• 57280a7 - Update README.md (@Huweicai)
• 0aa10ab - Update README.md (@brb)

Dependency changes:

• 5b08f7c - build(deps): bump golang.org/x/net from 0.27.0 to 0.28.0
• 332cff1 - build(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6
• 325cab1 - build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
• d7cc422 - build(deps): bump actions/upload-artifact from 4.3.4 to 4.3.5
• e510628 - build(deps): bump golang.org/x/sys from 0.22.0 to 0.23.0
• c0806cf - build(deps): bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
• 6d10c6f - build(deps): bump golang.org/x/sys from 0.23.0 to 0.24.0
• ce305f0 - build(deps): bump actions/setup-go from 5.0.1 to 5.0.2
• f23574b - build(deps): bump cilium/little-vm-helper from 0.0.18 to 0.0.19

Release v1.0.7

We are pleased to release the 1.0.7 version of pwru.

The major changes include:

• pwru is now able to trace XDP programs (#339). To enable it, use the --filter-trace-xdp flag. For example:

# pwru --filter-trace-xdp --output-tuple 'tcp and port 80 and host 100.64.0.101'
<..>
SKB                CPU PROCESS          TUPLE FUNC
0xffff97de3826d2c0 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:45509(tcp) cil_xdp_entry(xdp)
0xffff97ddbf541840 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)
0xffff97df1390b000 3   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)

• The MTU, which is printed when using --output-meta, can show modifications due to route MTU, XFRM policies, etc (#388).
• The new --output-skb-shared-info can be used to show skb_shared_info (#364).
• Improved tracking of SKBs when --filter-track-skb is used. For example, pwru is able to trace packets after they have been handled by XDP progs attached to veth (#384, #391, #397).

Functional changes:

• cf5229b - Trace veth_convert_skb_to_xdp_buff using skb->head (@jschwinger233)
• 5699a37 - Rename skb_addr to skb_head (@jschwinger233)
• 7a33683 - --filter-track-skb can track skbs re-built from veth_convert_skb_to_xdp_buff (@jschwinger233)
• b33c3bb - Collect MTU from skb->_skb_refdst (@jschwinger233)
• 438ea99 - Rename KprobeFuncs to NewKprober (@Asphaltt)
• 96fe764 - Track and output hard start of packet data (@Asphaltt)
• 509efb3 - Support tracing XDP (@Asphaltt)
• cfe9a88 - bpf: Add bpf_endian.h (@Asphaltt)
• 9f660df - Skip trace BTF-not-annotated bpf progs (@Asphaltt)
• 0ab0dc1 - fix: Get bpf prog entry func name from insns (@Asphaltt)
• c857506 - build(deps): bump actions/checkout from 4.1.6 to 4.1.7
• 3871a44 - Refactor code of attaching kprobe to non-skb funcs (@Asphaltt)
• 2c0afa8 - Refactor code of attaching skb-tracking kprobe (@Asphaltt)
• e064545 - Refactor code of attaching kprobe (@Asphaltt)
• 059997a - bpf: Differentiate skb tracking reasons (@jschwinger233)
• 7988665 - output: Print funcname with padding if caller is required (@jschwinger233)
• 75ca355 - Implement --output-caller (@jschwinger233)
• 8e35676 - Add --output-caller flag (@jschwinger233)
• 0c793e9 - Use using bit fields for FilterCfg (@jschwinger233)
• 05fe67e - Use 0 instead of 00000000 for MARK (@jschwinger233)
• f06dd79 - Left align zero NETNS (@jschwinger233)
• f262fd0 - ci: Adjust test cases (@jschwinger233)
• 58b4021 - Print TUPLE with historical max length (@jschwinger233)
• b123b02 - LEN has 5 bytes (@jschwinger233)
• b296ec8 - MTU has 5 bytes (@jschwinger233)
• dd37d45 - Limit PROTO column to 6 bytes (@jschwinger233)
• db8a495 - Set 16 to IFACE column width (@jschwinger233)
• 278ca66 - Set 8 width to MARK column (@jschwinger233)
• 350c654 - Set 10 width to NETNS column (@jschwinger233)
• 7c1f219 - Limit PROCESS to 16 bytes (@jschwinger233)
• f6e8733 - Reduce CPU column width to 3 (@jschwinger233)
• ceaeb5e - Left align (@jschwinger233)
• e3b2c66 - Move FUNC to the last column (@jschwinger233)
• 90d8c4c - Complete column names (@jschwinger233)
• 8d64575 - gh/workflows: Upload pwru logs upon failure (@brb)
• c076a4c - Add support for printing skb_shared_info (@YutaroHayakawa)

Dependency changes:

• 063d67b - build(deps): bump actions/download-artifact from 4.1.7 to 4.1.8
• 489330c - build(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4
• d5956c1 - build(deps): bump golang.org/x/net from 0.26.0 to 0.27.0
• adb9cb1 - build(deps): bump golang.org/x/sys from 0.21.0 to 0.22.0
• 7bacf08 - build(deps): bump golang.org/x/net from 0.25.0 to 0.26.0
• 1a5a781 - build(deps): bump cilium/little-vm-helper from 0.0.17 to 0.0.18
• 27f4cbe - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.1 to 1.4.2
• 734d7f7 - build(deps): bump golang.org/x/net from 0.24.0 to 0.25.0
• cfb0851 - build(deps): bump actions/checkout from 4.1.4 to 4.1.6
• a576523 - build(deps): bump actions/setup-go from 5.0.0 to 5.0.1
• a9236c7 - build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
• 836fa22 - build(deps): bump actions/checkout from 4.1.2 to 4.1.4
• 23ced3e - build(deps): bump actions/download-artifact from 4.1.5 to 4.1.7
• 42cfb38 - build(deps): bump github.com/tklauser/ps from 0.0.2 to 0.0.3

Release v1.0.6

We are pleased to release the 1.0.6 version of pwru.

The major changes include:

• pwru can track non-skb functions specified via --filter-non-skb-funcs (#355). For example, one can use pwru --filter-non-skb-funcs='xfrm_state_look_at,xfrm_state_lookup,xfrm_state_lookup_byaddr,xfrm_state_lookup_byspi' to enrich IPsec packet traces.
• Added tracing of skb's even if they were kfree-d (#354). By specifying --filter-track-skb-by-stackid, one can trace packets if they were freed, and then rebuilt (e.g., L2 bridge traffic).
• pwru is now able to output in JSON (#285). For example:

# pwru --output-tuple --output-meta --output-json 'host 1.1.1.1' | jq .
<..>
{
  "skb": "0xffff8fad947baf00",
  "cpu": 10,
  "process": "/usr/lib/firefox/firefox:1416291",
  "func": "kfree_skbmem",
  "iface": "0",
  "proto": 2048,
  "len": 94,
  "tuple": {
    "saddr": "1.1.1.1",
    "daddr": "192.168.1.159",
    "sport": 53,
    "dport": 34815,
    "proto": 17
  }
}

• (De)attaching kprobes got ~1.2 times faster (#277).

Functional changes:

• 4111cd8 - Remove skb-func from non-skb-func slice (@jschwinger233)
• 0257005 - Remove duplicate funcs from --filter-non-skb-funcs (@jschwinger233)
• 65d506d - Add --filter-non-skb-funcs (@jschwinger233)
• 088a54a - bpf: kprobe_skb_by_stackid (@jschwinger233)
• 3694303 - Implement --filter-track-skb-by-stackid (@jschwinger233)
• a7cb537 - Print header line for once (@jschwinger233)
• cebc409 - Avoid printing garvage skb written by previous writer (@YutaroHayakawa)
• e4b8499 - reduce the build context sent during a docker build (@lpmi-13)
• d10f9c4 - Output: Add json output (@darox)
• 9ea2ba5 - Attach tracing of tc-bpf concurrently (@Asphaltt)
• 47a823e - chore: Show detaching progress always (@Asphaltt)
• 4ee0356 - Change license of build.go to Apache-2 (@brb)
• 359e753 - chore: Update copyright statement of bpf_prog.go (@Asphaltt)
• 29a7ef0 - chore: Add comment for addr of tc bpf prog (@Asphaltt)
• 20a13ad - Reject to run --filter-trace-tc when not support fentry/fexit (@Asphaltt)
• 8945a2b - Fix get_func_ip for --filter-trace-tc (@Asphaltt)
• b47cfab - Fix go.mod (@Asphaltt)
• f539556 - Flush output file (@Asphaltt)
• 53e8f30 - Accelerate attaching/detaching kprobes (@Asphaltt)
• 817bf7c - Add CODEOWNERS (@brb)
• d53537a - Update .gitignore (@brb)
• ce2d747 - Update cilium/ebpf to v0.13.0 (@brb)
• 6258125 - gh/github: Bump LVH dependency in pwru-test (@brb)
• 724fd83 - Revert "gh/workflows: Use the kprobe backend" (@Asphaltt)
• f7c6303 - Do kprobe.multi on addresses instead of symbols (@Asphaltt)
• 7b444b3 - Refactor code of getting kprobe_skb bpf prog (@Asphaltt)
• 5a90a02 - gh/workflows: Bump LVH action depedency (@brb)
• 1adec8b - gh/workflows: Change test kernels (@brb)
• 8f10df1 - gh/workflows: Do not set dns-resolver (@brb)
• 0b3d5e1 - Add actions: pwru-run, pwru-log (@jschwinger233)
• f4087c2 - README.md: fix kernel config table rendering (@tklauser)
• 5919ba7 - README.md: adjust kernel config table (@tklauser)
• 860705a - Automatically fallback to kprobe backend if available_filter_functions not found (@jschwinger233)
• 58ecef0 - Filter with available_filter_functions only for kprobe-multi (@jschwinger233)
• af9ed1c - Remove unused relative timestamp config option (@tklauser)
• 05cc882 - Bump Go to 1.21.5 (@tklauser)
• fd88377 - internal/pwru: replace unmaintained mitchellh/go-ps dependency (@tklauser)

Dependency changes:

• 133b041 - build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3
• 5c2c5b3 - build(deps): bump github.com/cilium/ebpf from 0.14.0 to 0.15.0
• edaa366 - build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
• 5a9c525 - build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0
• a591840 - build(deps): bump github.com/cilium/ebpf from 0.13.2 to 0.14.0
• 43200e2 - build(deps): bump golang.org/x/net from 0.21.0 to 0.24.0
• 0a9e2d1 - build(deps): bump cilium/little-vm-helper from 0.0.16 to 0.0.17
• c825d7f - build(deps): bump actions/checkout from 4.1.1 to 4.1.2
• 4ca5c81 - build(deps): bump golang.org/x/sys from 0.17.0 to 0.18.0
• e2d32b2 - build(deps): bump actions/download-artifact from 4.1.3 to 4.1.4
• 17830c3 - build(deps): bump actions/download-artifact from 4.1.2 to 4.1.3
• 97398fc - build(deps): bump golang.org/x/sync from 0.3.0 to 0.6.0
• fa55033 - build(deps): bump github.com/cilium/ebpf from 0.13.0 to 0.13.2
• 18c7bdf - build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1
• 9e40901 - build(deps): bump actions/download-artifact from 4.1.1 to 4.1.2
• 732586d - build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0
• b8c253d - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.4 to 3.1.5
• 5d8da3d - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.0 to 1.4.1
• b1a5273 - build(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0
• 2172e77 - build(deps): bump actions/download-artifact from 4.1.0 to 4.1.1
• 587aa49 - build(deps): bump golang.org/x/net from 0.19.0 to 0.20.0
• 4aceb7f - build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
• 50bd586 - build(deps): bump golang.org/x/sys from 0.15.0 to 0.16.0

Release v1.0.5

We are pleased to release the 1.0.5 version of pwru.

The major changes include:

• Fix loading on >= the 6.6 kernel when there are multiple functions with the same name (#302, #284).

Functional changes:

• c3a9091 - gh/workflows: Use the kprobe backend (@brb)
• 9d8ead7 - Temporarily fix loading err on >= 6.6 kernels (@brb)
• 9b6449a - internal/pwru: Implement a proper help function (@qmonnet)
• 9f5a386 - Makefile: Remove compiler versions for "make local-release" (@qmonnet)
• 3307e5c - Makefile: Fix awk command in "make help" (@qmonnet)
• a8c2661 - ci: Print artifacts with filename (@jschwinger233)
• 1e10c19 - Update README (@brb)

Dependency changes:

• d86733b - build(deps): bump github.com/jsimonetti/rtnetlink from 1.3.5 to 1.4.0
• c5ae578 - build(deps): bump actions/setup-go from 4.1.0 to 5.0.0
• 0d23d55 - build(deps): bump cilium/little-vm-helper from 0.0.12 to 0.0.13
• 4e5205c - build(deps): bump golang.org/x/net from 0.17.0 to 0.19.0

Release v1.0.4

We are pleased to release the 1.0.4 version of pwru.

The major changes include:

• pwru is able to show TC BPF programs execution when --filter-trace-tc is set (#271). For example:

  0xffff91d7c885f0e8      5   [curl(261789)]  cil_from_container netns=... mark=0x0 iface=11(lxc9376ae2995cc)
  

  shows execution of the Cilium's cil_from_container BPF program.
• Fixed outputing of network interface and process name (#279, #280). The latter gives better insight which user or kernel process handles a packet. For example:

  0xffffa0fbe16e1500     15 [kworker/15:3-wg-crypt-cilium_wg0(82260)] ....
  

  shows a kernel thread handling WireGuard encryption for cilium_wg0 device.
• The packet tracing is extended to support skb_clone() and skb_copy when --filter-trace-skb is set (#275). This is useful to trace packets which get modified and no longer match given filters (e.g., after SNAT, tunnel encapsulation, encryption, etc).

Functional changes:

• 37227ac - Find process using pid instead of tid (@jschwinger233)
• c2819f3 - Fix ifname output (@jschwinger233)
• 0d4fc40 - Support tracking skb clones (@Asphaltt)
• eedae43 - Refactor code of skb tracking (@Asphaltt)
• 2347755 - Support tracing tc-bpf (@Asphaltt)
• eee498c - Makefile: add pwru as default target (@darox)
• a4850ab - Makefile: Add help target (@darox)
• 3ecaaa0 - vendor: Bump cilium/ebpf (@brb)
• 8f8c52f - remove instruction to build libpcap (@darox)
• f687e34 - Readme: Improve instructions (@darox)
• 8ff06c8 - typo: Availble -> Available (@mauriciovasquezbernal)
• 6639252 - Remove unnecessary libraries (@Asphaltt)
• 1ad3cce - Replace objs with collection (@Asphaltt)
• 88ccb27 - internal/pwru: report skb->protocol in host byte order (@tklauser)
• b110eb8 - internal/pwru: use %#x formatting verb for hex values (@tklauser)
• 39a4ea2 - Add CI status and latest release badges (@brb)
• 8753023 - Improve err reporting when filter-netns cannot be found (@brb)
• 773775a - Add --filter-ifname to README.md (@brb)

Dependency changes:

• d6d604d - build(deps): bump github.com/cilium/ebpf from 0.12.0 to 0.12.2
• 514bedf - build(deps): bump actions/checkout from 4.1.0 to 4.1.1
• 3abc99e - build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0

Release v1.0.3

We are pleased to release the 1.0.3 version of pwru.

The major changes include:

• Added support for L2 filters. For example, to filter ARP replies you can run pwru 'arp and arp[6:2] == 2' (#255).
• Added --filter-ifname which allows users to select which device packets should be filtered. The option can be used with --filter-netns which was changed to accept either inode number (inode:) or a file path to a network namespace. For example, to filter only eth0 packets in the 42 pid's network namespace you can run pwru --filter-iface eth0 --filter-netns /proc/42/ns/net (#257).
• The --output-meta was extended to print a network interface name. For example, iface=3(wlan0) (#259).

Functional changes:

• 93ca1a5 - Output iface name when --output-meta is set (@brb)
• e98de68 - Vendor jsimonetti/rtnetlink (@brb)
• 0ea4a67 - Add CI test for --filter-ifname (@jschwinger233)
• 77ad6fc - Update README (@jschwinger233)
• 0e514b0 - Vendor vishvananda/netns (@jschwinger233)
• 0deaf79 - Add --filter-ifname (@jschwinger233)
• 207ae70 - Add CI test for arp filter (@jschwinger233)
• 088110f - Reject L3 skb more efficiently (@jschwinger233)
• 8a14820 - Allow to inject L2 filters (@jschwinger233)
• 8f4317a - Compile and inject ebpf for both L3 and L2 skb (@jschwinger233)
• 02f0619 - Distinguish L3 skb and L2 skb in bpf (@jschwinger233)
• 5d66305 - Correctly calculate data_end (@jschwinger233)
• b8dbecf - Add CI testcases (@jschwinger233)
• f26ea48 - Add action pwru-test (@jschwinger233)
• f87a0c4 - Define StackOffset constant vars to avoid hardcode (@jschwinger233)
• 97ab6e2 - Use bpf2bpf to simplify libpcap ebpf injection (@jschwinger233)
• 03e1711 - Allow example to run as script (@azzid)

Dependency changes:

• 7849235 - build(deps): bump actions/checkout from 4.0.0 to 4.1.0 dependabot[bot]
• df2c42a - build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 dependabot[bot]
• b781f31 - build(deps): bump golang.org/x/tools from 0.12.0 to 0.13.0 dependabot[bot]

Release v1.0.2

We are pleased to release the 1.0.2 version of pwru.

This release fixes the bug in the v1.0.1 pwru due to invalid byte code produced by libpcap.a when compiled with LLVM 13 (#245):

Failed to inject filter ebpf for kprobe_skb_2: register r8 used twice

Functional changes:

• 908776a - gh/workflows: Use "make release" to build pwru for testing (@brb)
• 50c2e2f - make: Use LLVM 15 for release builds (@brb)

Dependency changes:

• 80d7973 - build(deps): bump actions/checkout from 3.6.0 to 4.0.0
• cea9128 - build(deps): bump golang.org/x/sys from 0.11.0 to 0.12.0