Skip to content

Invalid ENR node being transmitted in DNS for mainnet #11

Open
@lu-pinto

Description

@lu-pinto

I spotted this DNS TXT record with Besu on mainnet which was actually crashing our DNS client and quite possibly affecting our peering discovery through DNS:

{"@timestamp":"2025-05-23T02:26:27,631","level":"ERROR","thread":"vert.x-virtual-thread-3681","class":"DNSResolver","message":"Failed to parse record: enr:-Lu4QMFaKrYJyYO06WxKfW8njcWATSuGJZV72zCIv6dTsihJJ4QM48Sxpi1xN--CI3MX4MTy-qhknkn9ESZF3_AOvhuGAZS-S2T2g2V0aMrJhPxk7ASDEYwwgmlkgnY0gmlwhLkcZFKDaXA2kCABFegBEChSAAAAAAAAAAGJc2VjcDI1NmsxoQM9Tj7Od8vEHMK8qCD8T0RHeN_LeLbbETpKFlfhx4UVzIRzbmFwwIN0Y3CCdl-DdWRwg","throwable":""}

The ENR value is not a valid Base64 value since it has 1 bit less from what's possible to encode in Base64. I tried multiple Base64 decoders and they all complain, see below for python decoder:

>>> s = '-Lu4QMFaKrYJyYO06WxKfW8njcWATSuGJZV72zCIv6dTsihJJ4QM48Sxpi1xN--CI3MX4MTy-qhknkn9ESZF3_AOvhuGAZS-S2T2g2V0aMrJhPxk7ASDEYwwgmlkgnY0gmlwhLkcZFKDaXA2kCAB\
FegBEChSAAAAAAAAAAGJc2VjcDI1NmsxoQM9Tj7Od8vEHMK8qCD8T0RHeN_LeLbbETpKFlfhx4UVzIRzbmFwwIN0Y3CCdl-DdWRwg'
>>> import base64
>>> base64.urlsafe_b64decode(s)
Traceback (most recent call last):
  File "<python-input-3>", line 1, in <module>
    base64.urlsafe_b64decode(s)
    ~~~~~~~~~~~~~~~~~~~~~~~~^^^
  File ".../python3.13/base64.py", line 134, in urlsafe_b64decode
    return b64decode(s)
  File ".../python3.13/base64.py", line 88, in b64decode
    return binascii.a2b_base64(s, strict_mode=validate)
           ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
binascii.Error: Invalid base64-encoded string: number of data characters (249) cannot be 1 more than a multiple of 4

We have since chosen not to crash our DNS client, which is the wisest choice but I want to check with you if you don't want to fix it. PR on the Besu side: hyperledger/besu#8690

In particular there's this hardcoded record: https://github.com/ethereum/discv4-dns-lists/blob/master/all.mainnet.ethdisco.net/nodes.json#L20954-L20961 which is almost identical. The limit is pretty close to the 255 byte limit from RFC-6763. Maybe it got truncated by the DNS TXT limit?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions