.NET 6调用WCF服务在Alpine Linux环境下报Invalid URI异常求助

问题背景 #

基于.NET Core 3.1的应用调用WCF服务正常，升级到.NET 6并部署到Alpine Linux Pod后抛出UriFormatException，本地运行无问题，服务URL格式合法。

异常堆栈 #

Exception: System UriFormatException: Invalid URI: The format of the URI could not be determined.
at System.Uri. CreateThis(String uri, Boolean dontEscape. UriKind uriKind, UriCreationOptions& creationOptions)
at System. Uri..ctor(String uriString)
at System.Xml.xmlResolver.ResolveUri(Uri baseUri, String relativeUri)
at System.Xml.XmlTextReaderImpl.ConvertAbsoluteUnixPathToAbsoluteUri (Strings url, xmlResolver resolver)
at System.Xml.XmlTextReaderImpl..ctor(Stream stream, Byte[] bytes, Int32 byteCount, XmlReaderSettings settings, Uri baseUri, String baseUriStr, XmlParserContext context, Boolean closeInput)
at System.Xml.xmlReaderSettings. CreateReader (Stream input, Uri baseUri, String baseUriString, XmlParserContext inputContext)
at System.Xml.XmlReader.Create(Stream input, XmlReaderSettings settings, String baseUri)
at System.Security.Cryptography.xml.Utils.PreProcessStreamInput (Stream InputStream, XmlResolver xmlResolver, String baseUri)
at System.Security.Cryptography.Xml.ExcCanonicalxml..ctor(Stream inputStream, Boolean includeComments, String inclusiveNamespacesPrefixList, XmlResolver resolver, String strBaseUri)
at System.Security.Cryptography.Xml.XmlDsigExcC14NTransform.LoadInput(Object obj)
at System.Security.Cryptography.Xml.TransformChain. TransformToOctetStream(Object InputObject, Type inputType, XmlResolver resolver, String baseUri)
at System.Security.Cryptography.Xml.TransformChain. TransformToOctetStream(Stream Input, XmlResolver resolver, String baseUri)
at System.Security.Cryptography.Xml.Reference.CalculateHashValue(XmlDocument document, CanonicalXmlNodeList refList)
at System.Security.Cryptography.Xml.Reference.UpdateHashValue(XmlDocument document, CanonicalXmlNodeList refList)
at System.Security.Cryptography.Xml.SignedXml.BuildDigestedReferences()
at System.Security.Cryptography.Xml.SignedXml.ComputeSignature()
at System.ServiceModel.Security.WSSecurityOneDotZeroSendSecurityHeader.CompletePrimarySignatureCore (SendSecurityHeaderElement[] signatureconfirmations, SecurityToken[] signedEndorsingTokens, SecurityToken[] signedTokens, SendSecurityHeaderElement[] basicTokens, Boolean isPrimarySignature)
at System.ServiceModel.Security.WSSecurityOneDotZeroSendSecurityHeader.CreateSupportingSignature(SecurityToken token, SecurityKeyIdentifier identifier)
at System.ServiceModel.Security.SendSecurityHeader.SignwithSupportingToken(SecurityToken token, SecurityKeyIdentifierClause identifierClause)
at System.ServiceModel.Security.SendSecurityHeader.SignwithSupportingTokens()
at System.ServiceModel.Security.SendSecurityHeader.CompleteSecurityApplication()
at System.ServiceModel.Security.SecurityAppliedMessage.OnWriteMessage(XmlDictionaryWriter writer)
at System.ServiceModel.Channels.Message.WriteMessage(XmlDictionaryWriter writer)
at System.ServiceModel.Channels.BufferedMessagewriter.WriteMessage(Message message, BufferManager bufferManager, Int32 initialoffset, Int32 maxSizeQuota)
at System.ServiceModel.Channels.TextMessageEncoderFactory.TextMessageEncoder.WriteMessageAsync(Message message, Int32 maxMessageSize, BufferManager bufferManager, Int32 messageOffset)
at System.ServiceModel.Channels.TextMessageEncoderFactory.TextMessageEncoder.WriteMessage(Message message, Int32 maxMessageSize, BufferManager bufferManager, Int32 messageOffset)
at System.ServiceModel.Channels.MessageEncoder.WriteMessage(Message message, Int32 maxMessageSize, BufferManager bufferManager)
at System.ServiceModel.Channels.BufferedMessageContent.EnsureMessageEncoded()
at System.ServiceModel.Channels.BufferedMessageContent.TryComputeLength (Int64& length)
at System.Net.Http.HttpContent.GetComputedOrBufferLength()
at System.Net.Http.Headers.HttpContentHeaders.get_ContentLength()
at System.Net.Http.SocketsHttpHandler.ValidateAndNormalizeRequest(HttpRequestMessage request)
at System.Net.Http.SocketsHttpHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClientHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
....
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(MethodInfo targetMethod, Object[] args)
at generatedProxy_1.GetCustomerInfo(CustomerInfoRequest )
at CustomerService.CustomerServiceClient.GetCustomerInfo(CustomerInfoRequest customerInfoRequest) in D:\apps\jenkins\workspace\Jenkins-build281-902370858199\src\Connected Services\CustomerService\Reference.cs:line 4442

WCF客户端绑定代码 #

services.AddSingleton<ICustomerServiceClient, CustomerServiceClient>(s =>
{
    TextMessageEncodingBindingElement encoding= new TextMessageEncodingBindingElement(); 
    encoding.WriteEncoding = System.Text.Encoding.UTF8;

    var binding = new BasicHttpBinding(BasicHttpSecurityMode.TransportWithMessageCredential); 
    binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;

    var customBinding = new CustomBinding(binding);
    var sbe = customBinding.Elements.Find<TransportSecurityBindingElement>();
    var httpsTransport = new HttpsTransportBindingElement();
    httpsTransport.MaxBufferSize = 2000000000;
    httpsTransport.MaxReceivedMessageSize=2000000000;
    httpsTransport.MaxBufferPoolSize=2000000000;

    var dvsBinding = new CustomBinding(sbe, encoding, httpsTransport);
    dvsBinding.OpenTimeout = new TimeSpan (0, 10, 0); 
    dvsBinding.CloseTimeout = new TimeSpan (0, 10, 0);
    dvsBinding.SendTimeout = new TimeSpan (0, 10, 0);
    dvsBinding.ReceiveTimeout = new TimeSpan (0, 10, 0);

    EndpointAddress endpointAddress = new EndpointAddress(serviceConfig.CustomerSvcUrl);

    X509Certificate2 certificate = new X509Certificate2(serviceConfig.TrustStore, serviceConfig.CertPassword);

    var client = new CustomerServiceClient(dvsBinding, endpointAddress); 
    client.ClientCredentials.ClientCertificate.Certificate = certificate; 
    return client;
});

异常原因分析 #

签名操作对象与触发逻辑 #

异常发生在WCF消息签名阶段：当SignedXml.ComputeSignature()执行时，系统需要对WCF请求消息内容进行规范化（ExcC14N转换）和哈希计算，以此生成符合WS-Security标准的签名。此时流程会涉及到XML内容的解析与路径转换，最终因无效URI格式触发异常。

核心诱因 #

1. .NET 6路径解析逻辑变更：.NET 6中System.Xml.XmlTextReaderImpl.ConvertAbsoluteUnixPathToAbsoluteUri方法对Unix绝对路径的处理逻辑发生变化，当签名过程中加载证书或读取本地配置文件时，该方法尝试将Unix路径（如/app/cert.pfx）转换为URI，但未自动添加file://前缀，导致Uri构造失败。
2. Alpine环境特殊性：Alpine作为轻量发行版，缺少部分Windows/.NET全量环境下的默认路径兼容逻辑，进一步放大了.NET 6的路径解析差异问题。

解决方案 #

方案1：显式修正证书路径为合法URI #

修改证书加载代码，确保路径被识别为标准的file协议URI：

string certPath = serviceConfig.TrustStore;
// 为Unix路径添加file://前缀
if (!certPath.StartsWith("file://") && Path.IsPathRooted(certPath))
{
    certPath = $"file://{certPath}";
}
X509Certificate2 certificate = new X509Certificate2(certPath, serviceConfig.CertPassword);

方案2：启用.NET Legacy路径解析兼容 #

通过开关强制.NET 6使用旧版Unix路径解析逻辑，避免自动转换错误：

// 在应用启动初期（如Program.cs开头）添加
AppContext.SetSwitch("System.Xml.XmlResolver.LegacyUnixPathResolution", true);

或在Pod启动命令中添加环境变量：

export DOTNET_SYSTEM_XML_XMLRESOLVER_LEGACYUNIXPATHRESOLUTION=true

方案3：自定义XML解析器配置 #

调整绑定的XML读取设置，显式指定XmlResolver避免默认行为异常：

var encoding = new TextMessageEncodingBindingElement();
encoding.WriteEncoding = System.Text.Encoding.UTF8;
// 显式设置XmlResolver，覆盖默认路径解析逻辑
encoding.ReaderSettings.XmlResolver = new XmlUrlResolver();

验证建议 #

1. 在Alpine容器中直接测试证书路径的URI转换：执行new Uri(certPath)确认是否抛出异常，定位具体的无效路径。
2. 检查serviceConfig.TrustStore的路径格式，确保在容器中是正确的绝对路径，避免相对路径导致的解析问题。

内容的提问来源于stack exchange，提问作者Harry Hotspur