Release v1.0.12

What's Changed

• Add script to run pwru on k8s node to own file by @tklauser in #646
• Replace byteorder.Native by Go stdlib binary.NativeEndian by @tklauser in #648
• output: add file rotation support by @gyutaeb in #639
• Use Cilium lumberjack/v2 fork by @tklauser in #651
• output: include date and timezone in absolute timestamp by @gyutaeb in #656
• Add libpcap dependency to README by @alagoutte in #663
• Free cached BTF and verifier log to reduce memory use by @jschwinger233 in #668
• fixed issue# 649 Report recursion_misses for each probe on exit by @Aditya-132 in #683
• Bump cilium/ebpf to v0.22.0 and get rid of test-app vendoring by @brb in #687
• fix: honor output-tunnel in JSON output by @immanuwell in #690
• Added the option to show network namespace names where possible by @owen5mith in #692
• fix: honor output-tcp-flags in JSON output by @immanuwell in #691
• Fix release by @brb in #696

Dependency Updates

• chore(deps): update actions/upload-artifact digest to 47309c9 by @renovate[bot] in #650
• chore(deps): update all dependencies to v1.25.7 by @renovate[bot] in #652
• chore(deps): update all dependencies by @renovate[bot] in #653
• fix(deps): update all go dependencies main by @renovate[bot] in #654
• fix(deps): update all go dependencies main by @renovate[bot] in #655
• fix(deps): update module golang.org/x/net to v0.51.0 by @renovate[bot] in #657
• chore(deps): update all dependencies by @renovate[bot] in #658
• fix(deps): update all go dependencies main by @renovate[bot] in #661
• fix(deps): update all dependencies by @renovate[bot] in #662
• chore(deps): update golang:1.26.1 docker digest to 595c784 by @renovate[bot] in #665
• fix(deps): update all go dependencies main by @renovate[bot] in #667
• chore(deps): update all dependencies by @renovate[bot] in #666
• chore(deps): update golang:1.26.2 docker digest to 1e598ea by @renovate[bot] in #669
• chore(deps): update golang:1.26.2 docker digest to b54cbf5 by @renovate[bot] in #670
• chore(deps): update all dependencies to v1.26.3 by @renovate[bot] in #671
• fix(deps): update all go dependencies main by @renovate[bot] in #672
• fix(deps): update module golang.org/x/net to v0.54.0 by @renovate[bot] in #673
• chore(deps): update golang:1.26.3 docker digest to 313faae by @renovate[bot] in #674
• fix(deps): update module github.com/tklauser/ps to v0.0.4 by @renovate[bot] in #675
• chore(deps): update all dependencies by @renovate[bot] in #676
• fix(deps): update all go dependencies main by @renovate[bot] in #677
• chore(deps): update all dependencies by @renovate[bot] in #678
• chore(deps): update all dependencies by @renovate[bot] in #679
• fix(deps): update all go dependencies main by @renovate[bot] in #681
• chore(deps): update all dependencies by @renovate[bot] in #680
• chore(deps): update all dependencies by @renovate[bot] in #682
• chore(deps): update golang:1.26.4 docker digest to 32c0e6e by @renovate[bot] in #684
• fix(deps): update module github.com/cilium/ebpf to v0.22.0 by @renovate[bot] in #686
• chore(deps): update all dependencies by @renovate[bot] in #688
• chore(deps): update docker/login-action action to v4.4.0 by @renovate[bot] in #689
• chore(deps): update all dependencies to v1.26.5 by @renovate[bot] in #693
• fix(deps): update all go dependencies main by @renovate[bot] in #694

New Contributors

• @gyutaeb made their first contribution in #639
• @alagoutte made their first contribution in #663
• @Aditya-132 made their first contribution in #683
• @immanuwell made their first contribution in #690
• @owen5mith made their first contribution in #692

Full Changelog: v1.0.11...v1.0.12

Release v1.0.11

Major Changes

• pwru can trace BPF map operations with --output-bpfmap #453 #632. For example:

  pwru --filter-track-bpf-helpers --output-bpfmap 'udp' 
  ...
  0xffff8aecbed7b200 4   qemu-kvm:98915   4026533848 0             eth0:2      0x0800 1500  148   172.128.0.7:52228->172.128.0.6:8472(udp)   bpf_skb_load_bytes
  0x0                4   qemu-kvm:98915   4026533848 0             eth0:2      0x0800 1500  148   172.128.0.7:52228->172.128.0.6:8472(udp)   __htab_map_lookup_elem
  map_id: 466
  map_name: cilium_lb4_serv
  key(12):
  00000000  ac 80 00 06 21 18 00 00  11 00 00 00              |....!.......|
  value(12):
  00000000  00 00 00 00 00 00 00 00  00 00 00 00              |............|
  ...
  

  BTF-based pretty-printing is coming in a next release.
• libpcap-based filtering for XDP with --filter-track-xdp was fixed #603 #609 #635.
• pwru can filter based on sk_buff and xdp_buff fields #499. For example, you can use `skb->dev->ifindex == 42' to show traces of packets which are processed by a netdev with the interface index equal to 42.
• pwru was ported to run on RISC-V64 #604.
• Performance was improved for pwru trace outputting and process name resolution #634.

What's Changed

• Update README.md by @brb in #590
• pwru: Add --filter-skb-expr and --filter-xdp-expr by @Asphaltt in #499
• chore(deps): update all dependencies by @renovate[bot] in #592
• gh/workflows: Add test for --filter-skb-expr by @brb in #593
• Automatically LVH update kernels by @brb in #594
• chore(deps): update all dependencies by @renovate[bot] in #595
• fix(deps): update module github.com/spf13/pflag to v1.0.10 by @renovate[bot] in #596
• fix(deps): update all go dependencies main by @renovate[bot] in #598
• chore(deps): update softprops/action-gh-release action to v2.3.3 by @renovate[bot] in #597
• chore(deps): update actions/setup-go digest to c0137ca by @renovate[bot] in #599
• cleanup: small code cleanups by @Andreagit97 in #600
• new: add logs for traced ebpf progs by @Andreagit97 in #601
• libpcap: build without DPDK by @hack3ric in #606
• chore(deps): update all dependencies by @renovate[bot] in #605
• renovate: update release Go image by @tklauser in #607
• chore(deps): update all dependencies by @renovate[bot] in #608
• chore(deps): update all dependencies to v1.25.2 by @renovate[bot] in #611
• fix(deps): update all go dependencies main by @renovate[bot] in #612
• Add repology badge to list all distro pkgs by @brb in #614
• chore(deps): update all dependencies by @renovate[bot] in #613
• gh/workflows: Renovate lvh-version by @brb in #615
• bpf: Harden getting func ip by @Asphaltt in #609
• chore(deps): update all dependencies by @renovate[bot] in #616
• update: use bpf_get_func_ip if available by @Andreagit97 in #603
• chore(deps): update all dependencies by @renovate[bot] in #618
• fix(deps): update module github.com/jsimonetti/rtnetlink/v2 to v2.1.0 by @renovate[bot] in #617
• fix(deps): update module github.com/cilium/ebpf to v0.20.0 by @renovate[bot] in #619
• fix(deps): update module github.com/cilium/ebpf to v0.20.0 by @renovate[bot] in #620
• Add riscv64 support by @hack3ric in #604
• chore(deps): update all dependencies by @renovate[bot] in #622
• Fix path for available_filter_functions access by @Seas0 in #623
• chore(deps): update all dependencies by @renovate[bot] in #624
• fix(deps): update all go dependencies main by @renovate[bot] in #625
• chore(deps): update all dependencies by @renovate[bot] in #626
• chore(deps): update all dependencies by @renovate[bot] in #628
• chore(deps): update all dependencies by @renovate[bot] in #630
• fix(deps): update all go dependencies main by @renovate[bot] in #629
• chore(deps): update all dependencies by @renovate[bot] in #631
• Collect bpf helper arguments related to bpf map by @jschwinger233 in #453
• bpf: Use get_addr() in BPF map kprobes by @brb in #632
• Improve logging by @brb in #633
• bpf: Fix pcap filter bypass with --filter-trace-xdp and --filter-track-skb by @brb in #635
• chore(deps): update golang:1.25.5 docker digest to 6cc2338 by @renovate[bot] in #636
• Misc improvements by @brb in #634
• chore(deps): update all dependencies by @renovate[bot] in #637
• fix(deps): update module golang.org/x/sys to v0.40.0 by @renovate[bot] in #638
• chore(deps): update all dependencies by @renovate[bot] in #640
• fix(deps): update module golang.org/x/net to v0.49.0 - autoclosed by @renovate[bot] in #641
• chore(deps): update actions/checkout action to v6.0.2 by @renovate[bot] in #643
• chore(deps): update all dependencies by @renovate[bot] in #647
• Modernize Go code by @tklauser in #644
• go.mod, tools: use Go 1.24 tool dependencies by @tklauser in #645

New Contributors

• @Andreagit97 made their first contribution in #600
• @hack3ric made their first contribution in #606
• @Seas0 made their first contribution in #623

Full Changelog: v1.0.10...v1.0.11

Release v1.0.10

Major Changes

• Users can now select which SKB/XDP fields to output using --output-{skb,xdp}-metadata #509. For example:

  pwru --filter-trace-xdp --output-xdp-metadata 'xdp->rxq->dev->ifindex' host 1.1.1.1
  ... 1.1.1.1:0->192.168.241.133:0(icmp) bpf_prog_3b185187f1855c4c_dummy[bpf](xdp) ifindex=2
  

• Added support for tunnel traffic filtering and output #494. For example:

  pwru --filter-func=udp_queue_rcv_skb  'port 8472' --output-tunnel --filter-tunnel-pcap-l3 'port 8080'  --output-tcp-flags
  ...
  172.18.0.5:54806->172.18.0.2:8472(udp) udp_queue_rcv_skb 52:2e:36:8d:11:23 -> ba:44:d8:6c:66:5a 10.244.1.205:36739->10.244.3.122:8080(tcp:SYN)
  

• pwru now accepts an SKB mark mask via --filter-mark mark[/mask] #471. For example, you can run pwru --filter-mask 0xa00/0xf00.
• The fast kprobe-multi backend is now supported for tracing kernel modules #470. For example:

  pwru --all-kmods
  ... Attaching kprobes (via kprobe-multi)...
  

• TCP flags can now be displayed when --output-tcp-flags is set #466. For example:

  pwru --output-tcp-flags 'host 1.1.1.1'
  ...
  ... 192.168.1.165:44884->1.1.1.1:80(tcp:SYN) ip_local_out
  

• In addition to amd64, pwru is now published for arm64 in the Docker container image #569.
• pwru is now tested in CI tested on both amd64, but also arm64 #576.
• pwru can now run on the LoongArch architecture #337.

Full Changelog

• README: Mention that debugfs is optional by @brb in #447
• build(deps): bump golang.org/x/net from 0.28.0 to 0.30.0 by @dependabot[bot] in #443
• Dockerfile: build arm64 variants by @akerouanton in #449
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 by @dependabot[bot] in #454
• build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0 by @dependabot[bot] in #456
• build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot[bot] in #446
• bpf: Remove OUTPUT_SKB&HAS_KPROBE_MULTI macros by @Asphaltt in #455
• Ensure fentry and kprobe programs share the maps by @jschwinger233 in #459
• Fix tracing tc-bpf with --filter-track-skb-by-stackid by @Asphaltt in #452
• Collect and output skb->cb when --filter-trace-tc by @jschwinger233 in #461
• Add --output-skb-cb by @brb in #465
• build(deps): bump golang.org/x/net from 0.30.0 to 0.32.0 by @dependabot[bot] in #463
• build(deps): bump actions/setup-go from 5.0.2 to 5.2.0 by @dependabot[bot] in #467
• build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0 by @dependabot[bot] in #473
• build(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 by @dependabot[bot] in #472
• Support --filter-mark mark/[/mask] by @rgo3 in #471
• build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 by @dependabot[bot] in #474
• Enable kprobe-multi for kmods by default by @rgo3 in #470
• build(deps): bump github.com/vishvananda/netns from 0.0.4 to 0.0.5 by @dependabot[bot] in #475
• build(deps): bump golang.org/x/arch from 0.11.0 to 0.13.0 by @dependabot[bot] in #478
• build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 by @dependabot[bot] in #479
• gh/workflows: Fix fetching pwru logs by @brb in #375
• gh/workflows: Bump LVH images by @brb in #440
• Bump cilium/ebpf to 0.17.1 by @brb in #481
• Events from kprobe.multi have eventTypeKprobeMulti set in .type by @jschwinger233 in #477
• gh/workflows: Add --backend=kprobe-multi test by @brb in #482
• cleanup: setting LogSize is deprecated/unused. by @tommyp1ckles in #487
• build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.5 to 3.1.6 by @dependabot[bot] in #490
• Output TCP flags alongside tuple by @Asphaltt in #466
• gh/workflows: Set up traffic before running pwru by @brb in #493
• build(deps): bump github.com/cilium/ebpf from 0.17.1 to 0.17.2 by @dependabot[bot] in #495
• Fix broken --filter-trace-xdp caused by go-ebpf v0.17.1 by @Asphaltt in #484
• Add dummy --filter-track-{tc,xdp} tests by @brb in #492
• build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by @dependabot[bot] in #496
• build(deps): bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot[bot] in #500
• build(deps): bump golang.org/x/sys from 0.29.0 to 0.30.0 by @dependabot[bot] in #501
• build(deps): bump golang.org/x/arch from 0.13.0 to 0.14.0 by @dependabot[bot] in #504
• build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot[bot] in #505
• build(deps): bump github.com/cilium/ebpf from 0.17.2 to 0.17.3 by @dependabot[bot] in #506
• Add LoongArch support by @chenhengqi in #337
• CI: Fix Failures: Bump LVM action version to latest release. by @tommyp1ckles in #511
• Support outputting and filtering by vxlan/geneve tunnel data by @tommyp1ckles in #494
• deps: Bump github.com/cheggaaa/pb/v3 from 3.1.6 to 3.1.7 by @brb in #512
• Move static variables of big size to percpu array by @jschwinger233 in #503
• chore: Configure Renovate by @renovate[bot] in #515
• chore(deps): update actions/download-artifact digest to 95815c3 by @renovate[bot] in #521
• chore(deps): update actions/checkout digest to 85e6279 by @renovate[bot] in #517
• chore(deps): update actions/create-release digest to 4c11c9f - autoclosed by @renovate[bot] in #520
• renovate: Run go mod tidy by @brb in #524
• fix(deps): update github.com/cloudflare/cbpfc digest to ff978e9 by @renovate[bot] in #526
• chore(deps): update actions/setup-go digest to dca8468 by @renovate[bot] in #522
• fix(deps): update module golang.org/x/net to v0.36.0 [security] by @renovate[bot] in #516
• fix(deps): update module golang.org/x/sys to v0.31.0 by @renovate[bot] in #532
• chore(deps): update dependency go to v1.24.2 by @renovate[bot] in #528
• chore(deps): update docker.io/library/golang docker tag to v1.24.2 by @renovate[bot] in #529
• renovate: Run on Fri and group all deps by @brb in #535
• Remove dependabot.yml by @brb in #536
• Introduce two enhancements for func IP by @Asphaltt in #468
• go.mod: Bump to 1.24.1 by @brb in #538
• fix(deps): update all dependencies by @renovate[bot] in #537
• pwru: Add --output-skb-metadata and --output-xdp-metadata by @Asphaltt in #509
• fix(deps): update all dependencies by @renovate[bot] in #542
• Support output tuple for 802.1Q by @chenhengqi in #544
• fix(deps): update all dependencies by @renovate[bot] in #547
• fix(deps): update all dependencies by @renovate[bot] in #550
• Move Contributing to a separate file by @xmulligan in #510
• renovate: Try to fix go mod tidy issues by @brb in #553
• renovate: Fix syntax by @brb in #555
• Compile libpcap with --disable-protochain by @jschwinger233 in #558
• Add percpu buffer flag by @AdvH039 in #552
• chore(deps): update all dependencies by @renovate[bot] in #556
• renovate: Run go mod vendor by @brb in #561
• renovate: Fix syntax error by @brb in #563
• ci: add workflow to validate renovate config by @tklauser in #564
• renovate: Try go mod vendor/tidy for the group by @brb in #565
• renovate: Allow go.sum updates by @brb in #567
• vendor: Switch to rtnetlink@v2 by @brb in #568
• fix(deps): update all go dependencies main by @renovate[bot] in #566
• ci: release workfl...

Release v1.0.9

We are pleased to release the 1.0.9 version of pwru.

The major changes include:

• Fixed libpcap filtering for tracing XDP programs (--filter-trace-xdp) #439.
• Added drop reasons when sk_skb_reason_drop() is called #430.

Functional changes:

• aebb893 - README.md: Update Clang/LLVM dependency to 12 (@joestringer)
• 1c354fa - bpf: Fix broken filter with --filter-trace-xdp (@jschwinger233)
• 195950a - Skip kprobing bpf progs for --filter-track-bpf-helpers (@Asphaltt)
• 5455e74 - Fix verifier error to run --filter-trace-tc + --filter-track-bpf-helpers (@Asphaltt)
• bde4f64 - gh/workflows: Use ubuntu-latest (@brb)
• 2ed349d - Print drop reason from sk_skb_reason_drop (@DanPartelly)
• 0dc9829 - Fix a minor code logic issue of xdp tracing (@Asphaltt)
• 1de15ff - Fix broken --filter-trace-xdp (@Asphaltt)
• 759fc7a - Fix broken --filter-trace-tc (@Asphaltt)

Dependency changes:

• 8a4dd24 - build(deps): bump actions/checkout from 4.1.7 to 4.2.1
• 925df0e - build(deps): bump golang.org/x/sys from 0.24.0 to 0.26.0
• c7c2ed7 - build(deps): bump actions/upload-artifact from 4.3.6 to 4.4.3
• 82dbbf3 - build(deps): bump golang.org/x/arch from 0.8.0 to 0.11.0

Release v1.0.8

We are pleased to release the 1.0.8 version of pwru.

The major changes include:

• pwru is now able to trace BPF helpers (#390). To enable it, set --filter-track-bpf-helpers. In addition, when it is set together with --output-caller, it can be used to roughly trace BPF tailcalls. For example:

# pwru --output-caller --output-tuple --filter-track-bpf-helpers
...
10.244.1.141:45000->10.244.3.20:8080(tcp) bpf_map_lookup_elem          bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) array_map_update_elem        bpf_prog_5fd02288bd4a682e_tail_ipv4_ct_egress[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) trie_lookup_elem             bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) percpu_array_map_lookup_elem bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
10.244.1.141:45000->10.244.3.20:8080(tcp) __htab_map_lookup_elem       bpf_prog_4f62c9416e340c61_tail_handle_ipv4_cont[bpf]
...

• Fix tracking of sk_buff built from xdp_md when --filter-track-skb is used (#410).

Functional changes:

• 81b7b62 - Enable --output-tuple and --output-meta by default (@brb)
• ca38cef - Do not open kcore in init() (@brb)
• 4a5c234 - Fix Dockerfile (@brb)
• db68c01 - Bump Go version to 1.23.1 (@brb)
• 3bf9d91 - Abort if runtime.GOARCH is not amd64 (@jschwinger233)
• 18838c4 - Update vendor (@jschwinger233)
• 7deb4a0 - Add --filter-track-bpf-helpers (@jschwinger233)
• fc7e097 - Add GetBpfHelpers() API (@jschwinger233)
• 2893168 - Track xdp_md built from skb (@jschwinger233)
• 2f09d77 - Track skb built from xdp_md (@jschwinger233)
• 3824944 - bpf: Use &skb for --filter-track-skb again (@jschwinger233)
• ce21b83 - bpf: Use percpu array to replace __sync_fetch_and_add (@jschwinger233)
• 57280a7 - Update README.md (@Huweicai)
• 0aa10ab - Update README.md (@brb)

Dependency changes:

• 5b08f7c - build(deps): bump golang.org/x/net from 0.27.0 to 0.28.0
• 332cff1 - build(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6
• 325cab1 - build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
• d7cc422 - build(deps): bump actions/upload-artifact from 4.3.4 to 4.3.5
• e510628 - build(deps): bump golang.org/x/sys from 0.22.0 to 0.23.0
• c0806cf - build(deps): bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
• 6d10c6f - build(deps): bump golang.org/x/sys from 0.23.0 to 0.24.0
• ce305f0 - build(deps): bump actions/setup-go from 5.0.1 to 5.0.2
• f23574b - build(deps): bump cilium/little-vm-helper from 0.0.18 to 0.0.19

Release v1.0.7

We are pleased to release the 1.0.7 version of pwru.

The major changes include:

• pwru is now able to trace XDP programs (#339). To enable it, use the --filter-trace-xdp flag. For example:

# pwru --filter-trace-xdp --output-tuple 'tcp and port 80 and host 100.64.0.101'
<..>
SKB                CPU PROCESS          TUPLE FUNC
0xffff97de3826d2c0 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:45509(tcp) cil_xdp_entry(xdp)
0xffff97ddbf541840 2   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)
0xffff97df1390b000 3   ~m-agent:2825426 100.64.0.101:80->172.20.0.2:44879(tcp) cil_xdp_entry(xdp)

• The MTU, which is printed when using --output-meta, can show modifications due to route MTU, XFRM policies, etc (#388).
• The new --output-skb-shared-info can be used to show skb_shared_info (#364).
• Improved tracking of SKBs when --filter-track-skb is used. For example, pwru is able to trace packets after they have been handled by XDP progs attached to veth (#384, #391, #397).

Functional changes:

• cf5229b - Trace veth_convert_skb_to_xdp_buff using skb->head (@jschwinger233)
• 5699a37 - Rename skb_addr to skb_head (@jschwinger233)
• 7a33683 - --filter-track-skb can track skbs re-built from veth_convert_skb_to_xdp_buff (@jschwinger233)
• b33c3bb - Collect MTU from skb->_skb_refdst (@jschwinger233)
• 438ea99 - Rename KprobeFuncs to NewKprober (@Asphaltt)
• 96fe764 - Track and output hard start of packet data (@Asphaltt)
• 509efb3 - Support tracing XDP (@Asphaltt)
• cfe9a88 - bpf: Add bpf_endian.h (@Asphaltt)
• 9f660df - Skip trace BTF-not-annotated bpf progs (@Asphaltt)
• 0ab0dc1 - fix: Get bpf prog entry func name from insns (@Asphaltt)
• c857506 - build(deps): bump actions/checkout from 4.1.6 to 4.1.7
• 3871a44 - Refactor code of attaching kprobe to non-skb funcs (@Asphaltt)
• 2c0afa8 - Refactor code of attaching skb-tracking kprobe (@Asphaltt)
• e064545 - Refactor code of attaching kprobe (@Asphaltt)
• 059997a - bpf: Differentiate skb tracking reasons (@jschwinger233)
• 7988665 - output: Print funcname with padding if caller is required (@jschwinger233)
• 75ca355 - Implement --output-caller (@jschwinger233)
• 8e35676 - Add --output-caller flag (@jschwinger233)
• 0c793e9 - Use using bit fields for FilterCfg (@jschwinger233)
• 05fe67e - Use 0 instead of 00000000 for MARK (@jschwinger233)
• f06dd79 - Left align zero NETNS (@jschwinger233)
• f262fd0 - ci: Adjust test cases (@jschwinger233)
• 58b4021 - Print TUPLE with historical max length (@jschwinger233)
• b123b02 - LEN has 5 bytes (@jschwinger233)
• b296ec8 - MTU has 5 bytes (@jschwinger233)
• dd37d45 - Limit PROTO column to 6 bytes (@jschwinger233)
• db8a495 - Set 16 to IFACE column width (@jschwinger233)
• 278ca66 - Set 8 width to MARK column (@jschwinger233)
• 350c654 - Set 10 width to NETNS column (@jschwinger233)
• 7c1f219 - Limit PROCESS to 16 bytes (@jschwinger233)
• f6e8733 - Reduce CPU column width to 3 (@jschwinger233)
• ceaeb5e - Left align (@jschwinger233)
• e3b2c66 - Move FUNC to the last column (@jschwinger233)
• 90d8c4c - Complete column names (@jschwinger233)
• 8d64575 - gh/workflows: Upload pwru logs upon failure (@brb)
• c076a4c - Add support for printing skb_shared_info (@YutaroHayakawa)

Dependency changes:

• 063d67b - build(deps): bump actions/download-artifact from 4.1.7 to 4.1.8
• 489330c - build(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4
• d5956c1 - build(deps): bump golang.org/x/net from 0.26.0 to 0.27.0
• adb9cb1 - build(deps): bump golang.org/x/sys from 0.21.0 to 0.22.0
• 7bacf08 - build(deps): bump golang.org/x/net from 0.25.0 to 0.26.0
• 1a5a781 - build(deps): bump cilium/little-vm-helper from 0.0.17 to 0.0.18
• 27f4cbe - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.1 to 1.4.2
• 734d7f7 - build(deps): bump golang.org/x/net from 0.24.0 to 0.25.0
• cfb0851 - build(deps): bump actions/checkout from 4.1.4 to 4.1.6
• a576523 - build(deps): bump actions/setup-go from 5.0.0 to 5.0.1
• a9236c7 - build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
• 836fa22 - build(deps): bump actions/checkout from 4.1.2 to 4.1.4
• 23ced3e - build(deps): bump actions/download-artifact from 4.1.5 to 4.1.7
• 42cfb38 - build(deps): bump github.com/tklauser/ps from 0.0.2 to 0.0.3

Release v1.0.6

We are pleased to release the 1.0.6 version of pwru.

The major changes include:

• pwru can track non-skb functions specified via --filter-non-skb-funcs (#355). For example, one can use pwru --filter-non-skb-funcs='xfrm_state_look_at,xfrm_state_lookup,xfrm_state_lookup_byaddr,xfrm_state_lookup_byspi' to enrich IPsec packet traces.
• Added tracing of skb's even if they were kfree-d (#354). By specifying --filter-track-skb-by-stackid, one can trace packets if they were freed, and then rebuilt (e.g., L2 bridge traffic).
• pwru is now able to output in JSON (#285). For example:

# pwru --output-tuple --output-meta --output-json 'host 1.1.1.1' | jq .
<..>
{
  "skb": "0xffff8fad947baf00",
  "cpu": 10,
  "process": "/usr/lib/firefox/firefox:1416291",
  "func": "kfree_skbmem",
  "iface": "0",
  "proto": 2048,
  "len": 94,
  "tuple": {
    "saddr": "1.1.1.1",
    "daddr": "192.168.1.159",
    "sport": 53,
    "dport": 34815,
    "proto": 17
  }
}

• (De)attaching kprobes got ~1.2 times faster (#277).

Functional changes:

• 4111cd8 - Remove skb-func from non-skb-func slice (@jschwinger233)
• 0257005 - Remove duplicate funcs from --filter-non-skb-funcs (@jschwinger233)
• 65d506d - Add --filter-non-skb-funcs (@jschwinger233)
• 088a54a - bpf: kprobe_skb_by_stackid (@jschwinger233)
• 3694303 - Implement --filter-track-skb-by-stackid (@jschwinger233)
• a7cb537 - Print header line for once (@jschwinger233)
• cebc409 - Avoid printing garvage skb written by previous writer (@YutaroHayakawa)
• e4b8499 - reduce the build context sent during a docker build (@lpmi-13)
• d10f9c4 - Output: Add json output (@darox)
• 9ea2ba5 - Attach tracing of tc-bpf concurrently (@Asphaltt)
• 47a823e - chore: Show detaching progress always (@Asphaltt)
• 4ee0356 - Change license of build.go to Apache-2 (@brb)
• 359e753 - chore: Update copyright statement of bpf_prog.go (@Asphaltt)
• 29a7ef0 - chore: Add comment for addr of tc bpf prog (@Asphaltt)
• 20a13ad - Reject to run --filter-trace-tc when not support fentry/fexit (@Asphaltt)
• 8945a2b - Fix get_func_ip for --filter-trace-tc (@Asphaltt)
• b47cfab - Fix go.mod (@Asphaltt)
• f539556 - Flush output file (@Asphaltt)
• 53e8f30 - Accelerate attaching/detaching kprobes (@Asphaltt)
• 817bf7c - Add CODEOWNERS (@brb)
• d53537a - Update .gitignore (@brb)
• ce2d747 - Update cilium/ebpf to v0.13.0 (@brb)
• 6258125 - gh/github: Bump LVH dependency in pwru-test (@brb)
• 724fd83 - Revert "gh/workflows: Use the kprobe backend" (@Asphaltt)
• f7c6303 - Do kprobe.multi on addresses instead of symbols (@Asphaltt)
• 7b444b3 - Refactor code of getting kprobe_skb bpf prog (@Asphaltt)
• 5a90a02 - gh/workflows: Bump LVH action depedency (@brb)
• 1adec8b - gh/workflows: Change test kernels (@brb)
• 8f10df1 - gh/workflows: Do not set dns-resolver (@brb)
• 0b3d5e1 - Add actions: pwru-run, pwru-log (@jschwinger233)
• f4087c2 - README.md: fix kernel config table rendering (@tklauser)
• 5919ba7 - README.md: adjust kernel config table (@tklauser)
• 860705a - Automatically fallback to kprobe backend if available_filter_functions not found (@jschwinger233)
• 58ecef0 - Filter with available_filter_functions only for kprobe-multi (@jschwinger233)
• af9ed1c - Remove unused relative timestamp config option (@tklauser)
• 05cc882 - Bump Go to 1.21.5 (@tklauser)
• fd88377 - internal/pwru: replace unmaintained mitchellh/go-ps dependency (@tklauser)

Dependency changes:

• 133b041 - build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3
• 5c2c5b3 - build(deps): bump github.com/cilium/ebpf from 0.14.0 to 0.15.0
• edaa366 - build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
• 5a9c525 - build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0
• a591840 - build(deps): bump github.com/cilium/ebpf from 0.13.2 to 0.14.0
• 43200e2 - build(deps): bump golang.org/x/net from 0.21.0 to 0.24.0
• 0a9e2d1 - build(deps): bump cilium/little-vm-helper from 0.0.16 to 0.0.17
• c825d7f - build(deps): bump actions/checkout from 4.1.1 to 4.1.2
• 4ca5c81 - build(deps): bump golang.org/x/sys from 0.17.0 to 0.18.0
• e2d32b2 - build(deps): bump actions/download-artifact from 4.1.3 to 4.1.4
• 17830c3 - build(deps): bump actions/download-artifact from 4.1.2 to 4.1.3
• 97398fc - build(deps): bump golang.org/x/sync from 0.3.0 to 0.6.0
• fa55033 - build(deps): bump github.com/cilium/ebpf from 0.13.0 to 0.13.2
• 18c7bdf - build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1
• 9e40901 - build(deps): bump actions/download-artifact from 4.1.1 to 4.1.2
• 732586d - build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0
• b8c253d - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.4 to 3.1.5
• 5d8da3d - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.0 to 1.4.1
• b1a5273 - build(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0
• 2172e77 - build(deps): bump actions/download-artifact from 4.1.0 to 4.1.1
• 587aa49 - build(deps): bump golang.org/x/net from 0.19.0 to 0.20.0
• 4aceb7f - build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
• 50bd586 - build(deps): bump golang.org/x/sys from 0.15.0 to 0.16.0

Release v1.0.5

We are pleased to release the 1.0.5 version of pwru.

The major changes include:

• Fix loading on >= the 6.6 kernel when there are multiple functions with the same name (#302, #284).

Functional changes:

• c3a9091 - gh/workflows: Use the kprobe backend (@brb)
• 9d8ead7 - Temporarily fix loading err on >= 6.6 kernels (@brb)
• 9b6449a - internal/pwru: Implement a proper help function (@qmonnet)
• 9f5a386 - Makefile: Remove compiler versions for "make local-release" (@qmonnet)
• 3307e5c - Makefile: Fix awk command in "make help" (@qmonnet)
• a8c2661 - ci: Print artifacts with filename (@jschwinger233)
• 1e10c19 - Update README (@brb)

Dependency changes:

• d86733b - build(deps): bump github.com/jsimonetti/rtnetlink from 1.3.5 to 1.4.0
• c5ae578 - build(deps): bump actions/setup-go from 4.1.0 to 5.0.0
• 0d23d55 - build(deps): bump cilium/little-vm-helper from 0.0.12 to 0.0.13
• 4e5205c - build(deps): bump golang.org/x/net from 0.17.0 to 0.19.0

Release v1.0.4

We are pleased to release the 1.0.4 version of pwru.

The major changes include:

• pwru is able to show TC BPF programs execution when --filter-trace-tc is set (#271). For example:

  0xffff91d7c885f0e8      5   [curl(261789)]  cil_from_container netns=... mark=0x0 iface=11(lxc9376ae2995cc)
  

  shows execution of the Cilium's cil_from_container BPF program.
• Fixed outputing of network interface and process name (#279, #280). The latter gives better insight which user or kernel process handles a packet. For example:

  0xffffa0fbe16e1500     15 [kworker/15:3-wg-crypt-cilium_wg0(82260)] ....
  

  shows a kernel thread handling WireGuard encryption for cilium_wg0 device.
• The packet tracing is extended to support skb_clone() and skb_copy when --filter-trace-skb is set (#275). This is useful to trace packets which get modified and no longer match given filters (e.g., after SNAT, tunnel encapsulation, encryption, etc).

Functional changes:

• 37227ac - Find process using pid instead of tid (@jschwinger233)
• c2819f3 - Fix ifname output (@jschwinger233)
• 0d4fc40 - Support tracking skb clones (@Asphaltt)
• eedae43 - Refactor code of skb tracking (@Asphaltt)
• 2347755 - Support tracing tc-bpf (@Asphaltt)
• eee498c - Makefile: add pwru as default target (@darox)
• a4850ab - Makefile: Add help target (@darox)
• 3ecaaa0 - vendor: Bump cilium/ebpf (@brb)
• 8f8c52f - remove instruction to build libpcap (@darox)
• f687e34 - Readme: Improve instructions (@darox)
• 8ff06c8 - typo: Availble -> Available (@mauriciovasquezbernal)
• 6639252 - Remove unnecessary libraries (@Asphaltt)
• 1ad3cce - Replace objs with collection (@Asphaltt)
• 88ccb27 - internal/pwru: report skb->protocol in host byte order (@tklauser)
• b110eb8 - internal/pwru: use %#x formatting verb for hex values (@tklauser)
• 39a4ea2 - Add CI status and latest release badges (@brb)
• 8753023 - Improve err reporting when filter-netns cannot be found (@brb)
• 773775a - Add --filter-ifname to README.md (@brb)

Dependency changes:

• d6d604d - build(deps): bump github.com/cilium/ebpf from 0.12.0 to 0.12.2
• 514bedf - build(deps): bump actions/checkout from 4.1.0 to 4.1.1
• 3abc99e - build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0

Release v1.0.3

We are pleased to release the 1.0.3 version of pwru.

The major changes include:

• Added support for L2 filters. For example, to filter ARP replies you can run pwru 'arp and arp[6:2] == 2' (#255).
• Added --filter-ifname which allows users to select which device packets should be filtered. The option can be used with --filter-netns which was changed to accept either inode number (inode:) or a file path to a network namespace. For example, to filter only eth0 packets in the 42 pid's network namespace you can run pwru --filter-iface eth0 --filter-netns /proc/42/ns/net (#257).
• The --output-meta was extended to print a network interface name. For example, iface=3(wlan0) (#259).

Functional changes:

• 93ca1a5 - Output iface name when --output-meta is set (@brb)
• e98de68 - Vendor jsimonetti/rtnetlink (@brb)
• 0ea4a67 - Add CI test for --filter-ifname (@jschwinger233)
• 77ad6fc - Update README (@jschwinger233)
• 0e514b0 - Vendor vishvananda/netns (@jschwinger233)
• 0deaf79 - Add --filter-ifname (@jschwinger233)
• 207ae70 - Add CI test for arp filter (@jschwinger233)
• 088110f - Reject L3 skb more efficiently (@jschwinger233)
• 8a14820 - Allow to inject L2 filters (@jschwinger233)
• 8f4317a - Compile and inject ebpf for both L3 and L2 skb (@jschwinger233)
• 02f0619 - Distinguish L3 skb and L2 skb in bpf (@jschwinger233)
• 5d66305 - Correctly calculate data_end (@jschwinger233)
• b8dbecf - Add CI testcases (@jschwinger233)
• f26ea48 - Add action pwru-test (@jschwinger233)
• f87a0c4 - Define StackOffset constant vars to avoid hardcode (@jschwinger233)
• 97ab6e2 - Use bpf2bpf to simplify libpcap ebpf injection (@jschwinger233)
• 03e1711 - Allow example to run as script (@azzid)

Dependency changes:

• 7849235 - build(deps): bump actions/checkout from 4.0.0 to 4.1.0 dependabot[bot]
• df2c42a - build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 dependabot[bot]
• b781f31 - build(deps): bump golang.org/x/tools from 0.12.0 to 0.13.0 dependabot[bot]