Skip to content

Invalid ENR node being transmitted in DNS for mainnet #11

@lu-pinto

Description

@lu-pinto

I spotted this DNS TXT record with Besu on mainnet which was actually crashing our DNS client and quite possibly affecting our peering discovery through DNS:

{"@timestamp":"2025-05-23T02:26:27,631","level":"ERROR","thread":"vert.x-virtual-thread-3681","class":"DNSResolver","message":"Failed to parse record: enr:-Lu4QMFaKrYJyYO06WxKfW8njcWATSuGJZV72zCIv6dTsihJJ4QM48Sxpi1xN--CI3MX4MTy-qhknkn9ESZF3_AOvhuGAZS-S2T2g2V0aMrJhPxk7ASDEYwwgmlkgnY0gmlwhLkcZFKDaXA2kCABFegBEChSAAAAAAAAAAGJc2VjcDI1NmsxoQM9Tj7Od8vEHMK8qCD8T0RHeN_LeLbbETpKFlfhx4UVzIRzbmFwwIN0Y3CCdl-DdWRwg","throwable":""}

The ENR value is not a valid Base64 value since it has 1 bit less from what's possible to encode in Base64. I tried multiple Base64 decoders and they all complain, see below for python decoder:

>>> s = '-Lu4QMFaKrYJyYO06WxKfW8njcWATSuGJZV72zCIv6dTsihJJ4QM48Sxpi1xN--CI3MX4MTy-qhknkn9ESZF3_AOvhuGAZS-S2T2g2V0aMrJhPxk7ASDEYwwgmlkgnY0gmlwhLkcZFKDaXA2kCAB\
FegBEChSAAAAAAAAAAGJc2VjcDI1NmsxoQM9Tj7Od8vEHMK8qCD8T0RHeN_LeLbbETpKFlfhx4UVzIRzbmFwwIN0Y3CCdl-DdWRwg'
>>> import base64
>>> base64.urlsafe_b64decode(s)
Traceback (most recent call last):
  File "<python-input-3>", line 1, in <module>
    base64.urlsafe_b64decode(s)
    ~~~~~~~~~~~~~~~~~~~~~~~~^^^
  File ".../python3.13/base64.py", line 134, in urlsafe_b64decode
    return b64decode(s)
  File ".../python3.13/base64.py", line 88, in b64decode
    return binascii.a2b_base64(s, strict_mode=validate)
           ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
binascii.Error: Invalid base64-encoded string: number of data characters (249) cannot be 1 more than a multiple of 4

We have since chosen not to crash our DNS client, which is the wisest choice but I want to check with you if you don't want to fix it. PR on the Besu side: besu-eth/besu#8690

In particular there's this hardcoded record: https://github.com/ethereum/discv4-dns-lists/blob/master/all.mainnet.ethdisco.net/nodes.json#L20954-L20961 which is almost identical. The limit is pretty close to the 255 byte limit from RFC-6763. Maybe it got truncated by the DNS TXT limit?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions