mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-18 06:31:35 +08:00
Marc Schier
4757db13a0
Build 14591 (logs/482) failed on net48 with 2 test errors after the
corpus expansion in eba7fc64 added a new ECC CSR seed (request-ecc.der):
Failed FuzzGoodTestcases(AflfuzzPkcs10CertificationRequest, request-ecc.der)
Failed FuzzGoodTestcases(LibfuzzPkcs10CertificationRequest, request-ecc.der)
System.NotSupportedException : ECDSA certificate signing request
verification is not supported on this platform. Please use .NET 6.0
or later.
at Opc.Ua.Security.Certificates.Pkcs10CertificationRequest.VerifyEcdsaSignature
at Opc.Ua.Security.Certificates.Pkcs10CertificationRequest.Verify
at Opc.Ua.Fuzzing.FuzzableCode.FuzzPkcs10CertificationRequestCore
Root cause: Pkcs10CertificationRequest.VerifyEcdsaSignature throws
NotSupportedException on net48 / .NET Standard 2.x because the
implementation requires ECDsa.ImportSubjectPublicKeyInfo which is only
available on .NET 6.0+. The production code is explicit about this:
// For .NET Framework 4.8 and .NET Standard 2.x, ECDSA CSR
// verification is not supported. This is acceptable as the GDS
// Server primarily uses RSA certificates.
throw new NotSupportedException(...);
And Pkcs10CertificationRequest.Verify() likewise explicitly rethrows
NotSupportedException with a comment "Unsupported algorithm - rethrow
to inform caller".
Fix: extend the existing catch list in FuzzPkcs10CertificationRequestCore
to also swallow NotSupportedException. The fuzz harness's purpose is to
find parser bugs in the binding; platform/algorithm gaps that production
code already documents as intentional are not findings. An inline
comment records the reasoning so this stays correct under future
refactors.
Scope: only FuzzableCode.Pkcs10.cs is touched. No other Fuzz target hit
NotSupportedException in the CI run, and Pkcs10CertificationRequest.Verify
is the only production caller that intentionally rethrows it through any
of these fuzz code paths.
Verified locally:
- Certificates.Fuzz.Tests net48: 460 / 0 failed (previously 2 failed)
- Certificates.Fuzz.Tests net10: 460 / 0 failed
- Encoders.Fuzz.Tests net48: 4131 / 0 failed
- Encoders.Fuzz.Tests net10: 4131 / 0 failed
- Network.Fuzz.Tests net10: 330 / 0 failed
- Network.Fuzz.Tests net48: N/A (project targets net8.0/net9.0/net10.0 only)
Total 5381 tests, 0 failures across the affected TFM matrix.