Skip to content

Releases: cilium/pwru

Release v1.0.8

13 Sep 09:45
@github-actions github-actions
v1.0.8
81b7b62
Compare
Choose a tag to compare
Release v1.0.8 Latest
Latest

We are pleased to release the 1.0.8 version of pwru.

The major changes include:

  • pwru is now able to trace BPF helpers (#390). To enable it, set --filter-track-bpf-helpers. In addition, when it is set together with --output-caller, it can be used to roughly trace BPF tailcalls. For example:
# pwru --output-caller --output-tuple --filter-track-bpf-helpers
...
10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem          bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) array_map_update_elem        bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) trie_lookup_elem             bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) percpu_array_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem       bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
...
  • Fix tracking of sk_buff built from xdp_md when --filter-track-skb is used (#410).

Functional changes:

Dependency changes:

  • 5b08f7c - build(deps): bump golang.org/x/net from 0.27.0 to 0.28.0
  • 332cff1 - build(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6
  • 325cab1 - build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
  • d7cc422 - build(deps): bump actions/upload-artifact from 4.3.4 to 4.3.5
  • e510628 - build(deps): bump golang.org/x/sys from 0.22.0 to 0.23.0
  • c0806cf - build(deps): bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  • 6d10c6f - build(deps): bump golang.org/x/sys from 0.23.0 to 0.24.0
  • ce305f0 - build(deps): bump actions/setup-go from 5.0.1 to 5.0.2
  • f23574b - build(deps): bump cilium/little-vm-helper from 0.0.18 to 0.0.19

Contributors

brb, jschwinger233, and Huweicai
Assets 6
Loading

Release v1.0.7

10 Jul 16:05
@github-actions github-actions
v1.0.7
cf5229b
Compare
Choose a tag to compare
Release v1.0.7

We are pleased to release the 1.0.7 version of pwru.

The major changes include:

  • pwru is now able to trace XDP programs (#339). To enable it, use the --filter-trace-xdp flag. For example:
# pwru --filter-trace-xdp --output-tuple 'tcp and port 80 and host 100.64.0.101'
<..>
SKB                CPU PROCESS          TUPLE FUNC
0xffff97de3826d2c0 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:45509(tcp) cil_xdp_entry(xdp)
0xffff97ddbf541840 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)
0xffff97df1390b000 3   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)
  • The MTU, which is printed when using --output-meta, can show modifications due to route MTU, XFRM policies, etc (#388).
  • The new --output-skb-shared-info can be used to show skb_shared_info (#364).
  • Improved tracking of SKBs when --filter-track-skb is used. For example, pwru is able to trace packets after they have been handled by XDP progs attached to veth (#384, #391, #397).

Functional changes:

Dependency changes:

  • 063d67b - build(deps): bump actions/download-artifact from 4.1.7 to 4.1.8
  • 489330c - build(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4
  • d5956c1 - build(deps): bump golang.org/x/net from 0.26.0 to 0.27.0
  • adb9cb1 - build(deps): bump golang.org/x/sys from 0.21.0 to 0.22.0
  • 7bacf08 - build(deps): bump golang.org/x/net from 0.25.0 to 0.26.0
  • 1a5a781 - build(deps): bump cilium/little-vm-helper from 0.0.17 to 0.0.18
  • 27f4cbe - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.1 to 1.4.2
  • 734d7f7 - build(deps): bump golang.org/x/net from 0.24.0 to 0.25.0
  • cfb0851 - build(deps): bump actions/checkout from 4.1.4 to 4.1.6
  • a576523 - build(deps): bump actions/setup-go from 5.0.0 to 5.0.1
  • a9236c7 - build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
  • 836fa22 - build(deps): bump actions/checkout from 4.1.2 to 4.1.4
  • 23ced3e - build(deps): bump actions/download-artifact from 4.1.5 to 4.1.7
  • 42cfb38 - build(deps): bump github.com/tklauser/ps from 0.0.2 to 0.0.3

Contributors

brb, Asphaltt, and 2 other contributors
Assets 6
Loading

Release v1.0.6

24 Apr 14:14
@github-actions github-actions
v1.0.6
133b041
Compare
Choose a tag to compare
Release v1.0.6

We are pleased to release the 1.0.6 version of pwru.

The major changes include:

  • pwru can track non-skb functions specified via --filter-non-skb-funcs (#355). For example, one can use pwru --filter-non-skb-funcs='xfrm_state_look_at,xfrm_state_lookup,xfrm_state_lookup_byaddr,xfrm_state_lookup_byspi' to enrich IPsec packet traces.
  • Added tracing of skb's even if they were kfree-d (#354). By specifying --filter-track-skb-by-stackid, one can trace packets if they were freed, and then rebuilt (e.g., L2 bridge traffic).
  • pwru is now able to output in JSON (#285). For example:
# pwru --output-tuple --output-meta --output-json 'host 1.1.1.1' | jq .
<..>
{
  "skb": "0xffff8fad947baf00",
  "cpu": 10,
  "process": "/usr/lib/firefox/firefox:1416291",
  "func": "kfree_skbmem",
  "iface": "0",
  "proto": 2048,
  "len": 94,
  "tuple": {
    "saddr": "1.1.1.1",
    "daddr": "192.168.1.159",
    "sport": 53,
    "dport": 34815,
    "proto": 17
  }
}
  • (De)attaching kprobes got ~1.2 times faster (#277).

Functional changes:

Dependency changes:

  • 133b041 - build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3
  • 5c2c5b3 - build(deps): bump github.com/cilium/ebpf from 0.14.0 to 0.15.0
  • edaa366 - build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
  • 5a9c525 - build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0
  • a591840 - build(deps): bump github.com/cilium/ebpf from 0.13.2 to 0.14.0
  • 43200e2 - build(deps): bump golang.org/x/net from 0.21.0 to 0.24.0
  • 0a9e2d1 - build(deps): bump cilium/little-vm-helper from 0.0.16 to 0.0.17
  • c825d7f - build(deps): bump actions/checkout from 4.1.1 to 4.1.2
  • 4ca5c81 - build(deps): bump golang.org/x/sys from 0.17.0 to 0.18.0
  • e2d32b2 - build(deps): bump actions/download-artifact from 4.1.3 to 4.1.4
  • 17830c3 - build(deps): bump actions/download-artifact from 4.1.2 to 4.1.3
  • 97398fc - build(deps): bump golang.org/x/sync from 0.3.0 to 0.6.0
  • fa55033 - build(deps): bump github.com/cilium/ebpf from 0.13.0 to 0.13.2
  • 18c7bdf - build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1
  • 9e40901 - build(deps): bump actions/download-artifact from 4.1.1 to 4.1.2
  • 732586d - build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0
  • b8c253d - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.4 to 3.1.5
  • 5d8da3d - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.0 to 1.4.1
  • b1a5273 - build(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0
  • 2172e77 - build(deps): bump actions/download-artifact from 4.1.0 to 4.1.1
  • 587aa49 - build(deps): bump golang.org/x/net from 0.19.0 to 0.20.0
  • 4aceb7f - build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
  • 50bd586 - build(deps): bump golang.org/x/sys from 0.15.0 to 0.16.0

Contributors

brb, tklauser, and 5 other contributors
Assets 6
Loading

Release v1.0.5

20 Dec 14:15
@github-actions github-actions
v1.0.5
d86733b
Compare
Choose a tag to compare
Release v1.0.5

We are pleased to release the 1.0.5 version of pwru.

The major changes include:

  • Fix loading on >= the 6.6 kernel when there are multiple functions with the same name (#302, #284).

Functional changes:

Dependency changes:

  • d86733b - build(deps): bump github.com/jsimonetti/rtnetlink from 1.3.5 to 1.4.0
  • c5ae578 - build(deps): bump actions/setup-go from 4.1.0 to 5.0.0
  • 0d23d55 - build(deps): bump cilium/little-vm-helper from 0.0.12 to 0.0.13
  • 4e5205c - build(deps): bump golang.org/x/net from 0.17.0 to 0.19.0

Contributors

brb, jschwinger233, and qmonnet
Assets 6
Loading

Release v1.0.4

31 Oct 09:01
@github-actions github-actions
v1.0.4
37227ac
Compare
Choose a tag to compare
Release v1.0.4

We are pleased to release the 1.0.4 version of pwru.

The major changes include:

  • pwru is able to show TC BPF programs execution when --filter-trace-tc is set (#271). For example: 
    0xffff91d7c885f0e8      5   [curl(261789)]  cil_from_container netns=... mark=0x0 iface=11(lxc9376ae2995cc)
    shows execution of the Cilium's cil_from_container BPF program.
  • Fixed outputing of network interface and process name (#279, #280). The latter gives better insight which user or kernel process handles a packet. For example: 
    0xffffa0fbe16e1500     15 [kworker/15:3-wg-crypt-cilium_wg0(82260)] ....
    shows a kernel thread handling WireGuard encryption for cilium_wg0 device.
  • The packet tracing is extended to support skb_clone() and skb_copy when --filter-trace-skb is set (#275). This is useful to trace packets which get modified and no longer match given filters (e.g., after SNAT, tunnel encapsulation, encryption, etc).

Functional changes:

Dependency changes:

  • d6d604d - build(deps): bump github.com/cilium/ebpf from 0.12.0 to 0.12.2
  • 514bedf - build(deps): bump actions/checkout from 4.1.0 to 4.1.1
  • 3abc99e - build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0

Contributors

brb, tklauser, and 4 other contributors
Assets 6
Loading

Release v1.0.3

28 Sep 12:26
@github-actions github-actions
v1.0.3
93ca1a5
Compare
Choose a tag to compare
Release v1.0.3

We are pleased to release the 1.0.3 version of pwru.

The major changes include:

  • Added support for L2 filters. For example, to filter ARP replies you can run pwru 'arp and arp[6:2] == 2' (#255).
  • Added --filter-ifname which allows users to select which device packets should be filtered. The option can be used with --filter-netns which was changed to accept either inode number (inode:) or a file path to a network namespace. For example, to filter only eth0 packets in the 42 pid's network namespace you can run pwru --filter-iface eth0 --filter-netns /proc/42/ns/net (#257).
  • The --output-meta was extended to print a network interface name. For example, iface=3(wlan0) (#259).

Functional changes:

Dependency changes:

  • 7849235 - build(deps): bump actions/checkout from 4.0.0 to 4.1.0 dependabot[bot]
  • df2c42a - build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 dependabot[bot]
  • b781f31 - build(deps): bump golang.org/x/tools from 0.12.0 to 0.13.0 dependabot[bot]

Contributors

brb, jschwinger233, and azzid
Assets 6
Loading

Release v1.0.2

05 Sep 08:53
@github-actions github-actions
v1.0.2
908776a
Compare
Choose a tag to compare
Release v1.0.2

We are pleased to release the 1.0.2 version of pwru.

This release fixes the bug in the v1.0.1 pwru due to invalid byte code produced by libpcap.a when compiled with LLVM 13 (#245):

Failed to inject filter ebpf for kprobe_skb_2: register r8 used twice

Functional changes:

  • 908776a - gh/workflows: Use "make release" to build pwru for testing (@brb)
  • 50c2e2f - make: Use LLVM 15 for release builds (@brb)

Dependency changes:

  • 80d7973 - build(deps): bump actions/checkout from 3.6.0 to 4.0.0
  • cea9128 - build(deps): bump golang.org/x/sys from 0.11.0 to 0.12.0

Contributors

brb
Assets 6
Loading

Release v1.0.1

04 Sep 10:03
@github-actions github-actions
v1.0.1
cc9c63f
Compare
Choose a tag to compare
Release v1.0.1

We are pleased to release the 1.0.1 version of pwru.

The major changes include:

  • When --filter-track-skb is used, stop tracking a packet once it hits kfree_skbmem. This significantly helps to reduce pwru output volume.

Functional changes:

Dependency changes:

  • bdfbfbe - build(deps): bump actions/checkout from 3.5.3 to 3.6.0
  • 44708d3 - build(deps): bump actions/setup-go from 4.0.1 to 4.1.0
  • ad4c372 - build(deps): bump golang.org/x/tools from 0.11.0 to 0.12.0
  • 8d5ffa2 - build(deps): bump cilium/little-vm-helper from 0.0.11 to 0.0.12
  • 10e84a2 - build(deps): bump cilium/little-vm-helper from 0.0.7 to 0.0.11

Contributors

brb, benner, and jschwinger233
Assets 6
Loading

Release v1.0.0

14 Jul 13:43
@github-actions github-actions
v1.0.0
bc07418
Compare
Choose a tag to compare
Release v1.0.0

We are pleased to release the 1.0.0 version of pwru. It is the first major version ever released 🎉

The major changes include:

  • Added support for libpcap-based filtering (#198 by @jschwinger233). Now it's possible to filter packets in the same way as with tcpdump. For example, to trace only TCP SYN packets to 1.1.1.1 run pwru 'host 1.1.1.1 and tcp[tcpflags] == tcp-syn'. Please refer to man 7 pcap-filter for the full filtering syntax.

  • Added --filter-track-skb to trace packets even if they were modified and no longer match given filters (#194 by @jschwinger233). Useful when tracing packets which can be (d)encapsulated, SNAT-ed, encrypted, etc.

  • Fixed pwru slow loading on Ubuntu due to the bug in pahole (cilium/ebpf#1084 by @lmb).

  • Fixed trace loses due to perf ring buffer being full (#195 by @jschwinger233). Now traces are stored in BPF_MAP_TYPE_QUEUE instead of BPF_MAP_TYPE_PERF_EVENT_ARRAY.

  • The userspace code was re-licensed under Apache-2.0, while the BPF under BSD 2-Clause and GPL-2.0 (#190 by @brb).

Functional changes:

Dependency changes:

  • 658dbbc - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.2 to 3.1.4
  • f7c232d - build(deps): bump golang.org/x/tools from 0.10.0 to 0.11.0
  • 4554207 - build(deps): bump KyleMayes/install-llvm-action from 1.8.2 to 1.8.3
  • ef0d566 - build(deps): bump golang.org/x/sys from 0.9.0 to 0.10.0
  • 7fbf855 - build(deps): bump KyleMayes/install-llvm-action from 1.8.1 to 1.8.2
  • 5291216 - Bump cilium/little-vm-helper from 0.0.5 to 0.0.7
  • 7753fe6 - Bump golang.org/x/tools from 0.9.3 to 0.10.0
  • 45794bd - Bump actions/checkout from 3.5.2 to 3.5.3
  • b915176 - Bump golang.org/x/sys from 0.8.0 to 0.9.0
  • 8f35632 - Bump KyleMayes/install-llvm-action from 1.8.0 to 1.8.1
  • 74dc67b - Bump golang.org/x/tools from 0.9.2 to 0.9.3
  • beded6f - Bump cilium/little-vm-helper from 0.0.4 to 0.0.5
  • ce78405 - Bump golang.org/x/tools from 0.9.1 to 0.9.2
  • 3315bec - Bump cilium/little-vm-helper from 0.0.3 to 0.0.4
  • 232f2da - Bump actions/setup-go from 4.0.0 to 4.0.1
  • 3d78bb2 - Bump golang.org/x/tools from 0.9.0 to 0.9.1
  • d87353a - Bump golang.org/x/tools from 0.8.0 to 0.9.0
  • 0a08823 - Bump golang.org/x/sys from 0.7.0 to 0.8.0
  • bbc414b - Bump actions/checkout from 3.5.0 to 3.5.2
  • 347e780 - Bump golang.org/x/tools from 0.7.0 to 0.8.0
  • fadf199 - Bump golang.org/x/sys from 0.6.0 to 0.7.0
  • f699d81 - Bump KyleMayes/install-llvm-action from 1.7.0 to 1.8.0
  • 5106872 - Bump actions/checkout from 3.4.0 to 3.5.0

Contributors

brb, lmb, and 6 other contributors
Assets 6
Loading

Release v0.0.9

17 Mar 15:55
@github-actions github-actions
v0.0.9
c895af3
Compare
Choose a tag to compare
Release v0.0.9

We are pleased to release the 0.0.9 version of pwru.

The major changes include:

  • Fix the IPv6 filtering, in particular --filter-{src,dst}-ip and --filter-proto=icmp6 (#157 and #165).

Functional changes:

Dependency changes:

  • c895af3 - Bump actions/checkout from 3.3.0 to 3.4.0
  • 53e2e55 - Bump actions/setup-go from 3.5.0 to 4.0.0
  • 6654c61 - Bump actions/cache from 3.3.0 to 3.3.1
  • 9e64551 - Bump actions/cache from 3.2.6 to 3.3.0
  • 84d00b7 - Bump golang.org/x/tools from 0.5.0 to 0.7.0
  • a097dfa - Bump golang.org/x/sys from 0.5.0 to 0.6.0
  • a33df81 - Bump github.com/cheggaaa/pb/v3 from 3.1.0 to 3.1.2
  • 227c9cf - Bump actions/cache from 3.2.5 to 3.2.6
  • 4b97395 - Bump cilium/ebpf to v0.10.0
  • 0cbf834 - Bump actions/cache from 3.2.4 to 3.2.5
  • a1ddc97 - Bump golang.org/x/sys from 0.4.0 to 0.5.0

Contributors

brb, Asphaltt, and sterchelen
Assets 6
Loading