mirrord

Removed

• Removed armv7 builds that were wrongly added

Added

• Add ignore_ports to incoming configuration so you can have ports that
  only listen
  locally (mirrord will not steal/mirror those ports).
  #1295
• Add support for xstatfs to prevent unexpected behavior with SQLite.
  #1270

Changed

• Improved bad target error
  #1291

Added

• Notify clients about errors happening in agent's background tasks.
  #1163
• Add support for the imagePullSecrets parameter on the agent pod. This can be
  specified in the configuration file, under agent.image_pull_secrets.
  #1276

Added

• Added an error prompt to the VS Code extension when there is no available
  target in the configured namespace.
  #1266

Changed

• HTTP traffic stealer now supports HTTP/2 requests.
  #922

Fixed

• Executable field was set to null if present, but no SIP patching was done.
  #1271
• Fixed random crash in close_layer_fd caused by supposed closing of
  stdout/stderr then calling to log that writes to it

Added

• Support for running SIP binaries via the vscode extension, for common
  configuration types.
  #1061

Changed

• Add the failed connection address on failure to debug easily
• New IntelliJ icons - feel free to give feedback

Fixed

• Fix internal proxy receiving signals from terminal targeted for the mirrord
  process/parent process by using setsid
  #1232
• fix listing pods failing when config file exists on macOS
  #1245

3.33.1 - 2023-03-28

Changed

• Add default requests and limits values to mirrord-operator setup
  (100m/100Mi).

Fixed

• Change CLI's version update message to display the correct command when
  mirrord has been installed with homebrew.
  #1194
• fix using config with WSL on JetBrains
  #1210
• Fix internal proxy exiting before IntelliJ connects to it in some situations
  (maven). Issue was parent process closing causing child to exit. Fixed by
  waiting from the extension call to the child.
  #1211
• mirrord-cli: update cli so failing to use operator will fallback to
  no-operator mode.
  #1218
• Add option to install specific version using the install.sh script via
  command line argument or VERSION environment variable
  #1222
• Change connection reset to be a trace message instead of error
• Error when agent exits.

Internal

• Bring the testing documentation into the repo, link it in readme, and add
  some information.

• Introduce CheckedInto trait to convert raw pointers (checking for null) in
  Detour values.
  #detours

• Re-enable http mirror e2e tests..
  #947

• Change OPEN_FILES from Mutex HashMap to just using DashMap.
  #1206

• Refactor file ops open/read/close to allow us to directly manipulate the
  remote file (in agent) withouht going through C (mainly used to not leak the
  remote file due to how gethostname works).

  Change dup to take an argument that signals if we should change the fd from
  SOCKETS to OPEN_FILES (or vice-versa).
  #1202

3.33.0 - 2023-03-22

Added

• Support for outgoing unix stream sockets (configurable via config file or
  environment variable).
  #1105
• Add version of hooked functions.
  #1203

Changed

• add Hash trait on mirrord_operator::license::License struct
• dependencies bump and cleanup
• fix mirrord loading twice (to build also) and improve error message when no
  pods found

Fixed

• fix f-stream functions by removing its hooks and add missing underlying libc
  calls #947
• fix deadlock in go20 test (remove trace?)
  #1206

Changed

• change outgoing connection drop to be trace instead of error since it's not
  an error

Fixed

• Support stealing on meshed services with ports specified in
  --skip-inbound-ports on linkerd and itsio equivalent.
  #1041

Fixed

• fix microk8s support by adding possible containerd socket path
  #1186
• fix gethostname null termination missing
  #1189
• Update webbrowser dependency to fix security issue.

Fixed

• fix mirroring not handling big requests - increase buffer size (in rawsocket
  dependency).
  also trace logs to not log the data.
  #1178
• fix environment regression by mixing the two approaches together.
  priority is proc > oci (via container api)
  #1180

Changed

• mirrord-layer: changed result of getsockname to return requested socket on
  bind instead of the detoured socket address
  #1047
• mirrord-layer: Added SocketId to UserSocket as a better way of
  identifying sockets, part of #1054.
  #1054
• CHANGELOG - changed to use towncrier
• Change socket error on reading from outgoing sockets and mirror to be info
  instead of error

Fixed

• Possible bug when bound address is bypassed and socket stays in SOCKETS
  map.

Added

• config: ignore_localhost to outgoing config for ignoring localhost connections, meaning it will connect to local
  instead of remote localhost.
• config: ignore_localhost to incoming config for ignoring localhost bound sockets, meaning it will not steal/mirror those.
• combination of ignore_localhost in incoming and outgoing can be useful when you run complex processes that does
  IPC over localhost.
• sip_binaries to config file to allow specifying SIP-protected binaries that needs to be patched
  when mirrord doesn't detect those. See #1152.

Fixed

• Unnecessary error logs when running a script that uses env in its shebang.
• VSCode extension: running Python script with debugger fails because it tries to connect to the debugger port remotely.

Changed

• improved mirrord cli help message.
• mirrord-config: Change flush_connections default to true, related to
  #1029.

3.30.0

Added

• mirrord-layer: Added port_mapping under incoming configuration to allow mapping local ports to custom
  remote port, for example you can listen on port 9999 locally and it will steal/mirror
  the remote 80 port if port_mapping: [[9999, 80]]. See #1129

Fixed

• Fix issue when two (or more) containerd sockets exist and we use the wrong one. Fixes #1133.
• Invalid toml in environment variables configuration examples.

Changed

• Use container's runtime env instead of reading it from /proc/{container_root_pid}/environ as some processes (such as nginx) wipe it. Fixes #1135
• Removed the prefix "test" from all test names - #1065.
• Created symbolic link from the vscode directory to the LICENSE and CHANGELOG.md files so that mirrord developers
  don't need to copy them there before building the app.
• mirrord-layer: socket hook will now block ipv6 requests and will return EAFNOSUPPORT. See #1121.

New Contributors

• @gautamprikshit1 made their first contribution in https://github.com/metalbear-co/mirrord/pull/1130

Full Changelog: https://github.com/metalbear-co/mirrord/compare/3.29.0...3.30.0

Added

• mirrord debug feature (for mirrord developers to debug mirrord): Cause the agent to exit early with an error.
• mirrord E2E tests: support for custom namespaces.

Fixed

• Unpause the target container before exiting if the agent exits early on an error and the container is paused -
  #1111.
• intellij-plugin: fix issue where execution hangs when running using Gradle. Fixes #1120.
• intellij-plugin: fix issue where mirrord doesn't load into gradle, was found when fixing [#1120].
• mirrord-agent: reintroduce -o lo back to iptable rules to prevent issue where outinging messags could be intersepted by mirrord as incoming ones.
• mirrord-layer: binding same port on different IPs leads to a crash due to ListenAlreadyExists error.
  This is now ignored with a info message since we can't know if the IP/Port was already bound
  or not. Created a follow up issue to complete implementation and error at application's bind.

Fixed

• VSCode Extension: Fix wrong CLI path on Linux

Fixed

• VSCode Extension: Fix wrong CLI path

Fixed

• Fix error in VSCode extension compilation

Fixed

• CI: fix error caused by missing dir

Changed

• Change VSCode extension to package all binaries and select the correct one based on the platform. Fixes #1101.
• agent: add log to error when handling a client message fails.

Fixed

• agent: Make sniffer optional to support cases when it's not available and mirroring is not required.

Changed

• Update operator version

Fixed

• mirrord now handles it when the local app closes a forwarded stolen tcp connection instead of exiting with an error. Potential fix for #1063.
• missing kubeconfig doesn't fail extensions (it failed because it first tried to resolve the default then used custom one)

Changed

• layer: Don't print error when tcp socket faces error as it can be a normal flow.
• internal proxy - set different timeout for mirrord exec and running from extension
  fixing race conditions when running from IntelliJ/VSCode.
• Changed with_span_events from FmtSpan::Active to FmtSpan::NEW | FmtSpan::CLOSE.
  Practically this means we will have less logs on enter/exit to span and only when it's first created
  and when it's closed.
• JetBrains Plugin: Add debug logs for investigating user issues.
• JetBrains compatability: set limit from 222 (2022.2.4) since 221 isn't supported by us.
• Make kubeconfig setting effective always by using -f in mirrord ls.
• mirrord agent can now run without sniffer, will not be able to mirror but can still steal.
  this is to enable users who have older kernel (4.20>=) to use the steal feature.