fix: correct return statements and improve error handling in BoringSSL #816

cfc4n · 2025-08-09T08:56:03Z

This pull request makes several small but important changes to improve robustness and compatibility in the SSL/TLS probing code, especially when handling BoringSSL and OpenSSL differences. The main focus is on error handling and initialization logic, ensuring the code does not return prematurely in certain edge cases, and making pointer casting explicit for clarity.

Error handling and robustness improvements:

Commented out early return statements in several BPF probe functions (probe_ssl_master_key in boringssl_masterkey.h and probe_entry_SSL_read in openssl.h) to prevent premature exit when encountering expected conditions, such as version being zero in BoringSSL or pointer reads failing, which can be normal in some cases. This allows the probes to continue processing and handle these cases more gracefully. [1] [2] [3]
Added comments explaining why early returns are suppressed, particularly noting BoringSSL's use of ssl->s3->hs and the possibility of ssl->version being empty. [1] [2]

Pointer casting and initialization:

Explicitly casted pointers to void* in calls to bpf_probe_read_user for clarity and correctness in probe_entry_SSL_read (openssl.h).

Initialization logic fix:

Moved the initialization of eventCollectorWriter outside of the error check in the runModule function in root.go, ensuring it is always set when needed.

…L and OpenSSL integration Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

github-actions · 2025-08-09T08:57:23Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T08:57:27Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

Copilot

Pull Request Overview

This pull request fixes error handling and improves robustness in SSL/TLS probing code, particularly for BoringSSL compatibility. The changes prevent premature exits from BPF probe functions when encountering expected conditions that can be normal in certain SSL implementations.

Commented out early return statements in BPF probe functions to allow continued processing when pointer reads fail or version values are zero
Added explicit pointer casting to void* for bpf_probe_read_user calls
Fixed initialization logic for eventCollectorWriter to ensure it's always set when needed

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
kern/openssl.h	Removes early returns and adds explicit pointer casting in SSL_read probe function
kern/boringssl_masterkey.h	Prevents early return when version reading fails in BoringSSL master key probe
cli/cmd/root.go	Fixes eventCollectorWriter initialization to occur outside error check

Copilot · 2025-08-09T08:57:28Z

kern/openssl.h

+//        return 0;
+    } else {
+    //  在BoringSSL中，主要使用ssl_st->s3->hs对象， ssl_st->version 可能为空
+        ssl_rbio_ptr = (u64 *)(ssl + SSL_ST_RBIO);
+            ret = bpf_probe_read_user(&ssl_rbio_addr, sizeof(ssl_rbio_addr),
+                                      ssl_rbio_ptr);
+            if (ret) {
+                debug_bpf_printk(
+                    "(OPENSSL) bpf_probe_read ssl_rbio_ptr failed, ret: %d\n",
+                    ret);
+        //        return 0;
+            }
+            // get ssl->bio->method->type
+            u32 bio_type = process_BIO_type(ssl_rbio_addr);


Instead of commenting out the return statement, consider using a more explicit approach like setting a flag or adding a specific condition check. Commented-out code reduces maintainability and makes the control flow unclear.

Copilot · 2025-08-09T08:57:28Z

kern/openssl.h

+                debug_bpf_printk(
+                    "(OPENSSL) bpf_probe_read ssl_rbio_ptr failed, ret: %d\n",
+                    ret);
+        //        return 0;


Instead of commenting out the return statement, consider using a more explicit approach like setting a flag or adding a specific condition check. Commented-out code reduces maintainability and makes the control flow unclear.

Suggested change

// return 0;

return 0;

Copilot · 2025-08-09T08:57:29Z

kern/openssl.h

+                debug_bpf_printk(
+                    "(OPENSSL) bpf_probe_read ssl_rbio_num_ptr failed, ret: %d\n",
+                    ret);
+        //        return 0;


Instead of commenting out the return statement, consider using a more explicit approach like setting a flag or adding a specific condition check. Commented-out code reduces maintainability and makes the control flow unclear.

Suggested change

// return 0;

return 0;

Copilot · 2025-08-09T08:57:29Z

kern/boringssl_masterkey.h

@@ -200,7 +200,7 @@ int probe_ssl_master_key(struct pt_regs *ctx) {
    int ret = bpf_probe_read_user(&version, sizeof(version), (void *)ssl_version_ptr);
    if (ret) {
        debug_bpf_printk("bpf_probe_read tls_version failed, ret :%d\n", ret);
-        return 0;
+//        return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象


Instead of commenting out the return statement, consider using a more explicit approach like setting a flag or adding a specific condition check. Commented-out code reduces maintainability and makes the control flow unclear.

Suggested change

// return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象

// In BoringSSL, version may be 0, mainly because ssl->s3->hs object is used. Do not return here.

Copilot · 2025-08-09T08:57:29Z

kern/openssl.h

-        }
+//        return 0;
+    } else {
+    //  在BoringSSL中，主要使用ssl_st->s3->hs对象， ssl_st->version 可能为空


[nitpick] The comment contains mixed languages (Chinese and English) and inconsistent formatting. Consider using English consistently for code comments to improve maintainability for international development teams.

Suggested change

// 在BoringSSL中，主要使用ssl_st->s3->hs对象， ssl_st->version 可能为空

// In BoringSSL, the ssl_st->s3->hs object is mainly used; ssl_st->version may be null

Copilot · 2025-08-09T08:57:29Z

kern/boringssl_masterkey.h

@@ -200,7 +200,7 @@ int probe_ssl_master_key(struct pt_regs *ctx) {
    int ret = bpf_probe_read_user(&version, sizeof(version), (void *)ssl_version_ptr);
    if (ret) {
        debug_bpf_printk("bpf_probe_read tls_version failed, ret :%d\n", ret);
-        return 0;
+//        return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象


[nitpick] The comment contains Chinese text. Consider using English consistently for code comments to improve maintainability for international development teams.

Suggested change

// return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象

// return 0; // In BoringSSL, version may be 0, mainly because the ssl->s3->hs object is used

github-actions · 2025-08-09T08:57:39Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T08:57:46Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T08:57:49Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T08:58:00Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

…tegration Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

github-actions · 2025-08-09T09:28:40Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:28:50Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:28:52Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:28:56Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:29:01Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:29:20Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

github-actions · 2025-08-09T09:53:38Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:53:42Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:53:46Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:53:55Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:54:02Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

github-actions · 2025-08-09T09:54:12Z

🔧 Debug Build Complete

📦 Download Links:

PR 816 Debug Binary

⏰ Files will be retained for 7 days, please download and test promptly.

fix: correct return statements and improve error handling in BoringSS…

dac6e7c

…L and OpenSSL integration Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

cfc4n requested a review from Copilot August 9, 2025 08:56

cfc4n added 🐞 bug Something isn't working fix bug fix PR labels Aug 9, 2025

cfc4n linked an issue Aug 9, 2025 that may be closed by this pull request

pixel6 抓不到包用的v1.3.1 #813

Closed

dosubot bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Aug 9, 2025

Copilot AI reviewed Aug 9, 2025

View reviewed changes

fix: update pointer casting and variable initialization in OpenSSL in…

c5fd1bf

…tegration Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

fix: update comments for clarity in BoringSSL and OpenSSL integration

4a17d15

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

cfc4n merged commit 7dd4e9e into master Aug 10, 2025
11 checks passed

cfc4n deleted the bugfix/pixel6-capture-failed branch August 10, 2025 16:41

dosubot bot mentioned this pull request Aug 22, 2025

Failed to get master key via keylog mode for OpenSSL 3.0.12 #825

Closed

	// return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象
	// In BoringSSL, version may be 0, mainly because ssl->s3->hs object is used. Do not return here.

	// 在BoringSSL中，主要使用ssl_st->s3->hs对象， ssl_st->version 可能为空
	// In BoringSSL, the ssl_st->s3->hs object is mainly used; ssl_st->version may be null

	// return 0; // 在BoringSSL中，version可能为0，主要是使用了ssl->s3->hs对象
	// return 0; // In BoringSSL, version may be 0, mainly because the ssl->s3->hs object is used

fix: correct return statements and improve error handling in BoringSSL #816

fix: correct return statements and improve error handling in BoringSSL #816

Uh oh!

Conversation

cfc4n commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

Uh oh!

Uh oh!