We are pleased to release the 1.0.6 version of pwru.

The major changes include:

• pwru can track non-skb functions specified via --filter-non-skb-funcs (#355). For example, one can use pwru --filter-non-skb-funcs='xfrm_state_look_at,xfrm_state_lookup,xfrm_state_lookup_byaddr,xfrm_state_lookup_byspi' to enrich IPsec packet traces.
• Added tracing of skb's even if they were kfree-d (#354). By specifying --filter-track-skb-by-stackid, one can trace packets if they were freed, and then rebuilt (e.g., L2 bridge traffic).

• pwru is now able to output in JSON (#285). For example:

  pwru --output-tuple --output-meta --output-json 'host 1.1.1.1' | jq .

  <..> { "skb": "0xffff8fad947baf00", "cpu": 10, "process": "/usr/lib/firefox/firefox:1416291", "func": "kfree_skbmem", "iface": "0", "proto": 2048, "len": 94, "tuple": { "saddr": "1.1.1.1", "daddr": "192.168.1.159", "sport": 53, "dport": 34815, "proto": 17 } } * (De)attaching kprobes got ~1.2 times faster (#277).

Functional changes:

• 4111cd8 - Remove skb-func from non-skb-func slice (@jschwinger233)
• 0257005 - Remove duplicate funcs from --filter-non-skb-funcs (@jschwinger233)
• 65d506d - Add --filter-non-skb-funcs (@jschwinger233)
• 088a54a - bpf: kprobe_skb_by_stackid (@jschwinger233)
• 3694303 - Implement --filter-track-skb-by-stackid (@jschwinger233)
• a7cb537 - Print header line for once (@jschwinger233)
• cebc409 - Avoid printing garvage skb written by previous writer (@YutaroHayakawa)
• e4b8499 - reduce the build context sent during a docker build (@lpmi-13)
• d10f9c4 - Output: Add json output (@darox)
• 9ea2ba5 - Attach tracing of tc-bpf concurrently (@Asphaltt)
• 47a823e - chore: Show detaching progress always (@Asphaltt)
• 4ee0356 - Change license of build.go to Apache-2 (@brb)
• 359e753 - chore: Update copyright statement of bpf_prog.go (@Asphaltt)
• 29a7ef0 - chore: Add comment for addr of tc bpf prog (@Asphaltt)
• 20a13ad - Reject to run --filter-trace-tc when not support fentry/fexit (@Asphaltt)
• 8945a2b - Fix get_func_ip for --filter-trace-tc (@Asphaltt)
• b47cfab - Fix go.mod (@Asphaltt)
• f539556 - Flush output file (@Asphaltt)
• 53e8f30 - Accelerate attaching/detaching kprobes (@Asphaltt)
• 817bf7c - Add CODEOWNERS (@brb)
• d53537a - Update .gitignore (@brb)
• ce2d747 - Update cilium/ebpf to v0.13.0 (@brb)
• 6258125 - gh/github: Bump LVH dependency in pwru-test (@brb)
• 724fd83 - Revert "gh/workflows: Use the kprobe backend" (@Asphaltt)
• f7c6303 - Do kprobe.multi on addresses instead of symbols (@Asphaltt)
• 7b444b3 - Refactor code of getting kprobe_skb bpf prog (@Asphaltt)
• 5a90a02 - gh/workflows: Bump LVH action depedency (@brb)
• 1adec8b - gh/workflows: Change test kernels (@brb)
• 8f10df1 - gh/workflows: Do not set dns-resolver (@brb)
• 0b3d5e1 - Add actions: pwru-run, pwru-log (@jschwinger233)
• f4087c2 - README.md: fix kernel config table rendering (@tklauser)
• 5919ba7 - README.md: adjust kernel config table (@tklauser)
• 860705a - Automatically fallback to kprobe backend if available_filter_functions not found (@jschwinger233)
• 58ecef0 - Filter with available_filter_functions only for kprobe-multi (@jschwinger233)
• af9ed1c - Remove unused relative timestamp config option (@tklauser)
• 05cc882 - Bump Go to 1.21.5 (@tklauser)
• fd88377 - internal/pwru: replace unmaintained mitchellh/go-ps dependency (@tklauser)

Dependency changes:

• 133b041 - build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3
• 5c2c5b3 - build(deps): bump github.com/cilium/ebpf from 0.14.0 to 0.15.0
• edaa366 - build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
• 5a9c525 - build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0
• a591840 - build(deps): bump github.com/cilium/ebpf from 0.13.2 to 0.14.0
• 43200e2 - build(deps): bump golang.org/x/net from 0.21.0 to 0.24.0
• 0a9e2d1 - build(deps): bump cilium/little-vm-helper from 0.0.16 to 0.0.17
• c825d7f - build(deps): bump actions/checkout from 4.1.1 to 4.1.2
• 4ca5c81 - build(deps): bump golang.org/x/sys from 0.17.0 to 0.18.0
• e2d32b2 - build(deps): bump actions/download-artifact from 4.1.3 to 4.1.4
• 17830c3 - build(deps): bump actions/download-artifact from 4.1.2 to 4.1.3
• 97398fc - build(deps): bump golang.org/x/sync from 0.3.0 to 0.6.0
• fa55033 - build(deps): bump github.com/cilium/ebpf from 0.13.0 to 0.13.2
• 18c7bdf - build(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1
• 9e40901 - build(deps): bump actions/download-artifact from 4.1.1 to 4.1.2
• 732586d - build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0
• b8c253d - build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.4 to 3.1.5
• 5d8da3d - build(deps): bump github.com/jsimonetti/rtnetlink from 1.4.0 to 1.4.1
• b1a5273 - build(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0
• 2172e77 - build(deps): bump actions/download-artifact from 4.1.0 to 4.1.1
• 587aa49 - build(deps): bump golang.org/x/net from 0.19.0 to 0.20.0
• 4aceb7f - build(deps): bump actions/upload-artifact from 3.1.3 to 4.0.0
• 50bd586 - build(deps): bump golang.org/x/sys from 0.15.0 to 0.16.0