v0.8.0

Release Highlight

• Display module name to trace output 36986c4
• Module-based regex filtering 0e220c2
• libbpf v1.0.0 support 5da963a

Full Changelog: v0.7.0...v0.8.0

Display module name to trace output

Now both of aggregated (default) output and JSON output includes kernel module name by default.

4383592522664911     006             nf_conntrack                ipv4_conntrack_in
4383592522667659     006             nf_conntrack                  nf_conntrack_in
4383592522668702     006             nf_conntrack                resolve_normal_ct
4383592522670093     006             nf_conntrack       nf_conntrack_handle_packet
4383592522671173     006             nf_conntrack          nf_conntrack_tcp_packet
4383592522672257     006                  vmlinux                      nf_checksum
4383592522673321     006                  vmlinux                   nf_ip_checksum
4383592522674599     006                   nf_nat          nf_nat_ipv4_pre_routing
4383592522675668     006                   nf_nat                   nf_nat_inet_fn
4383592522677146     006                  vmlinux               tcp_v4_early_demux
4383592522678949     006                  vmlinux                 ip_local_deliver
4383592522679910     006                  vmlinux                     nf_hook_slow
4383592522680986     006                nf_tables                nft_do_chain_ipv4
4383592522682869     006                   nf_nat             nf_nat_ipv4_local_in
4383592522683810     006                   nf_nat                   nf_nat_inet_fn
4383592522684916     006             nf_conntrack                     ipv4_confirm
4383592522686317     006             nf_conntrack                       nf_confirm
4383592522687451     006                  vmlinux          ip_local_deliver_finish
4383592522688806     006                  vmlinux          ip_protocol_deliver_rcu

{"packet_id":"0xffff998bdbeec800","timestamp":4383908208987951,"processor_id":0,"module":"vmlinux","function":"nf_ip_checksum","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208989663,"processor_id":0,"module":"nf_nat","function":"nf_nat_ipv4_pre_routing","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208990837,"processor_id":0,"module":"nf_nat","function":"nf_nat_inet_fn","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208992985,"processor_id":0,"module":"vmlinux","function":"tcp_v4_early_demux","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208995575,"processor_id":0,"module":"vmlinux","function":"ip_local_deliver","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208996525,"processor_id":0,"module":"vmlinux","function":"nf_hook_slow","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208997448,"processor_id":0,"module":"nf_tables","function":"nft_do_chain_ipv4","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908208999436,"processor_id":0,"module":"nf_nat","function":"nf_nat_ipv4_local_in","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908209000178,"processor_id":0,"module":"nf_nat","function":"nf_nat_inet_fn","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908209001170,"processor_id":0,"module":"nf_conntrack","function":"ipv4_confirm","is_return":false}
{"packet_id":"0xffff998bdbeec800","timestamp":4383908209002501,"processor_id":0,"module":"nf_conntrack","function":"nf_confirm","is_return":false}

Module-based regex filtering

As well as displaying the module name, we now allow filtering the symbols to trace by module name with --module-regex. For example, if you want to trace Netfilter-related functions you can do like below. As you can see, Netfilter functions are not always prefixed with nf_ (e.g. resolve_normal_ct), so it was impossible with symbol-based regex filtering.

$ sudo ipft -l --module-regex "nf_"
                                                            NAME	             MOD	              ADDR	SKB_POSITION
                                                   nft_data_dump	       nf_tables	0xffffffffc1e34380	0
                                                nft_verdict_dump	       nf_tables	0xffffffffc1e34290	0
                                               nft_dump_register	       nf_tables	0xffffffffc1e22370	0
<skip...>
                                         __nf_nat_decode_session	          nf_nat	0xffffffffc1ebf250	0
                                 nf_nat_icmpv6_reply_translation	          nf_nat	0xffffffffc1ec13e0	0
                                   nf_nat_icmp_reply_translation	          nf_nat	0xffffffffc1ec18a0	0
<skip...>
                                                nf_tproxy_laddr4	  nf_tproxy_ipv4	0xffffffffc242b320	0
                                     nf_tproxy_handle_time_wait6	  nf_tproxy_ipv6	0xffffffffc2431390	0
                                                nf_tproxy_laddr6	  nf_tproxy_ipv6	0xffffffffc2431540	0
                                                 nf_send_unreach	  nf_reject_ipv4	0xffffffffc1d5b6a0	0
                                          nf_reject_fill_skb_dst	  nf_reject_ipv4	0xffffffffc1d5b090	0
<skip...>
                                               resolve_normal_ct	    nf_conntrack	0xffffffffc1e769e0	1
                                            ipv6_conntrack_local	    nf_conntrack	0xffffffffc1e7b1a0	1
                                               ipv6_conntrack_in	    nf_conntrack	0xffffffffc1e7b1c0	1

libbpf v1.0.0 support

It may not be interesting for users, but we fully migrated to libbpf v1.0.0.

New Contributors

• @stepnem made their first contribution in #10

Thanks for your contribution!