{"record":{"id":"c533655b1db3c214","repo":"cilium/cilium","slug":"failed-to-decode-base64-encoded-nlri-w","errorCode":null,"errorMessage":"failed to decode base64-encoded NLRI: %w","messagePattern":"failed to decode base64-encoded NLRI: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bgp/api/conversions.go","lineNumber":130,"sourceCode":"\t\t\tBase64: base64.StdEncoding.EncodeToString(bin),\n\t\t})\n\t}\n\n\treturn ret, nil\n}\n\nfunc ToAgentPath(m *models.BgpPath) (*types.Path, error) {\n\tp := &types.Path{}\n\n\tif m.AgeNanoseconds > 0 {\n\t\tp.CreatedAt = time.Now().Add(-time.Duration(m.AgeNanoseconds))\n\t}\n\tp.Best = m.Best\n\n\t// Decode serialized NLRI to bytes\n\tbin, err := base64.StdEncoding.DecodeString(m.Nlri.Base64)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode base64-encoded NLRI: %w\", err)\n\t}\n\n\t// Decode NLRI from bytes\n\tafi := types.ParseAfi(m.Family.Afi)\n\tsafi := types.ParseSafi(m.Family.Safi)\n\tnlri, err := bgp.NLRIFromSlice(bgp.NewFamily(uint16(afi), uint8(safi)), bin)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode NLRI: %w\", err)\n\t}\n\n\tp.NLRI = nlri\n\tp.Family = types.Family{Afi: afi, Safi: safi}\n\n\t// Decode path attributes\n\tfor _, pattr := range m.PathAttributes {\n\t\tbin, err := base64.StdEncoding.DecodeString(pattr.Base64)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to decode base64-encoded Path Attribute: %w\", err)","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/bgp/api/conversions.go#L112-L148","documentation":"ToAgentPath converts an API BgpPath model back into an internal table.Path. The NLRI arrives as a base64 string, and this error means base64.StdEncoding.DecodeString failed — the string is not valid standard base64 (bad characters, wrong padding, or it was produced by a different encoder such as URL-safe base64). No BGP parsing has happened yet.","triggerScenarios":"Calling ToAgentPath/ToAgentPaths with a models.BgpPath whose Nlri.Base64 was hand-written, truncated, contains whitespace/newlines, or was encoded with base64.URLEncoding or RawStdEncoding instead of StdEncoding.","commonSituations":"Copy-pasting NLRI strings from logs where line-wrapping inserted characters; storing paths in a text store that mangled padding '='; a client (e.g. from another language) using URL-safe base64.","solutions":["Re-obtain the base64 string directly from the GoBGP API (e.g. via ToAPIPath output or gRPC response) instead of manual copying","Strip whitespace/newlines and restore '=' padding before decoding","If the string came from a non-Go encoder, re-encode with standard base64 (StdEncoding)","Sanitize with strings.NewReplacer and pad to a multiple of 4 in a preprocessing step"],"exampleFix":"// before\nm.Nlri.Base64 = \"EAAKAgCjAAEA\" + \"\\n\" // newline from log copy\np, err := api.ToAgentPath(m) // fails\n// after\nm.Nlri.Base64 = strings.TrimSpace(\"EAAKAgCjAAEA\")\np, err := api.ToAgentPath(m)","handlingStrategy":"validation","validationCode":"func validBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(s)\n    return err == nil && s != \"\"\n}\n// if !validBase64(m.Nlri.Base64) { regenerate or reject }","typeGuard":"func hasDecodableNLRI(m *models.BgpPath) bool {\n    return m.Nlri != nil && validBase64(m.Nlri.Base64)\n}","tryCatchPattern":"p, err := api.ToAgentPath(m)\nif err != nil {\n    return nil, fmt.Errorf(\"nlri base64 invalid (len=%d): %w\", len(m.Nlri.Base64), err)\n}","preventionTips":["Never hand-edit base64 blobs in stored route data","Use base64.StdEncoding consistently end-to-end","Strip whitespace before decoding external input","Round-trip test: ToAPIPath then ToAgentPath must succeed"],"tags":["go","bgp","base64","decoding"],"backgroundTag":"invalid-base64-input","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}