p2p/dnsdisc, cmd/devp2p: keep invalid and unreachable nodes out of DNS trees - #35312
Merged
Merged
Conversation
…S trees MakeTree rejects records whose port entries do not decode as uint16, so geth never signs a tree containing a record with an out-of-range port (enr.Record keeps such pairs as raw RLP, letting a crawled foreign record round-trip into a signed tree). Adds a nodeset filter -dialable that keeps only nodes advertising a usable RLPx port.
fjl
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The DNS discovery crawler (ethereum/discv4-crawl) builds signed enrtree lists by crawling the network and running the collected records through
devp2p nodeset filteranddevp2p dns sign. Those records come from external nodes, andenr.Recordkeeps entries it can't decode as raw RLP, so a self-signed record with an out-of-range port (EIP-778 defines ports only as "big endian integer", notuint16) can round-trip verbatim into a signed tree. Consumers that decode ports strictly then fail to decode that record.Two publish-side checks:
MakeTreerejects a record if a present port entry (tcp/tcp6/udp/udp6/quic/quic6) does not decode as auint16. This is an invariant at the signing boundary: geth won't sign a tree containing a record with an undecodable port, regardless of how the node list was produced. Absent and zero ports are unaffected.devp2p nodeset filter -dialablekeeps only nodes advertising a usable RLPx port (non-zerotcp/tcp6/quic/quic6), letting the crawler drop discovery-only and unreachable nodes so consumers aren't handed peers they can't connect to.The two are deliberately separate: the
MakeTreecheck is a correctness guard that always applies, while-dialableis an opt-in selection filter for the crawler pipeline. A follow-up will add-dialableto discv4-crawl'sfilter_list.