Method generateSocketErrorTracepoint

shell/tracescript.go:281–346

generateSocketErrorTracepoint creates the inet_sk_error_report tracepoint. This captures socket errors like ECONNREFUSED, ETIMEDOUT, etc.

()

// generateSocketErrorTracepoint creates the inet_sk_error_report tracepoint.
// This captures socket errors like ECONNREFUSED, ETIMEDOUT, etc.
func (g *ScriptGenerator) generateSocketErrorTracepoint() string {
	var sb strings.Builder

	sb.WriteString("tracepoint:sock:inet_sk_error_report\n")
	sb.WriteString("{\n")

	// Only process IPv4 (family == 2) and skip error=0 (not a real error)
	sb.WriteString(`    if (args->family != 2) { return; }
    if (args->error == 0) { return; }  // Skip non-error events (socket cleanup)

`)

	// Extract bytes into local vars first (required for BPF verifier)
	if g.hasIPFilter() {
		sb.WriteString(`    // Read IP bytes into local vars for filtering
    $s0 = args->saddr[0]; $s1 = args->saddr[1]; $s2 = args->saddr[2]; $s3 = args->saddr[3];
    $d0 = args->daddr[0]; $d1 = args->daddr[1]; $d2 = args->daddr[2]; $d3 = args->daddr[3];

`)
		// Add IP filter using local vars
		sb.WriteString(g.buildTCPIPFilterCheckFromLocalVars())
	}

	sb.WriteString(`    $saddr = ntop(2, args->saddr);
    $daddr = ntop(2, args->daddr);
    $sport = args->sport;
    $dport = args->dport;
    $error = args->error;

`)

	if g.config.OutputJSON {
		// JSON output: use error code only (parsers can decode POSIX errno)
		sb.WriteString(`    printf("{\"time\":\"%s\",\"type\":\"SOCK_ERR\",\"errno\":%d,\"probe\":\"inet_sk_error_report\",\"src_ip\":\"%s\",\"src_port\":%d,\"dst_ip\":\"%s\",\"dst_port\":%d}\n",
           strftime("%H:%M:%S", nsecs),
           $error,
           $saddr, $sport,
           $daddr, $dport);
`)
	} else {
		// Table output: decode errno to human-readable name
		sb.WriteString(`    // Decode common socket errno values (POSIX standard)
    $errno_name = $error == 104 ? "ECONNRESET" :
                  $error == 110 ? "ETIMEDOUT" :
                  $error == 111 ? "ECONNREFUSED" :
                  $error == 113 ? "EHOSTUNREACH" :
                  $error == 101 ? "ENETUNREACH" :
                  $error == 99  ? "EADDRNOTAVAIL" :
                  $error == 112 ? "EHOSTDOWN" :
                  $error == 103 ? "ECONNABORTED" :
                  "UNKNOWN";

    printf("%-12s %-10s %-18s %-18s %-18s %s:%-5d  ->  %s:%-5d\n",
           strftime("%H:%M:%S", nsecs),
           "SOCK_ERR",
           $errno_name,
           "-",
           "inet_sk_error_report",