feat(huawei-waf): add Huawei Cloud WAF IP blacklist management service package - #314
feat(huawei-waf): add Huawei Cloud WAF IP blacklist management service package#314dingzhejianjian wants to merge 4 commits into
Conversation
|
本次 PR 新增 Huawei WAF（华为云 Web 应用防火墙）IP 黑白名单管理服务包，核心变更包括：
经代码审查，发现以下高优先级问题：
|
![monkeyscan[bot]](https://avatars.githubusercontent.com/u/231811742?s=60&v=4){kind=small}
23f5e10 to
23129fc
Compare
|
已修正：
|
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 主要修复了三个问题：1) 恢复了 services/package.json 中被误删的大量服务 bin 入口与 files 声明；2) 修复了华为 WAF 模块的签名 canonicalURI 与请求路径不一致的问题（移除强制尾部斜杠）、修正了 content-type charset 拼写错误，并增加了 bindings.ak/sk 的别名兼容；3) 使用 AbortController 重写了 fetchJson 的超时机制。在审查中发现 fetchJson 函数的超时保护范围存在关键缺陷：AbortController 的 timer 仅在 try...finally 块内有效，fetch 成功返回后 res.text() 的调用不受超时保护，存在 response body 读取阶段无限挂起的可靠性风险。建议将 res.text() 及后续处理移入 try 块内部以确保超时覆盖完整请求生命周期。 |
|
|
MonkeyScan 已经开始评审，完成后会更新到本评论中，请稍后刷新查看。 |
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 将 整体评估：
|
dingzhejianjian
left a comment
dingzhejianjian
left a comment
There was a problem hiding this comment.
✅ 已完成手动验证。5 个工具已注册，ListPolicies 返回 2 个策略。
|
Reviewer note: this PR currently has merge conflicts with the target branch, so it cannot be merged or reviewed safely in its current state. Please rebase or merge the latest base branch, resolve the conflicts, and make sure GitHub Actions pass again. I am marking/keeping this PR as draft until the conflicts are resolved. |
|
MonkeyScan 已经开始评审，完成后会更新到本评论中，请稍后刷新查看。 |
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 仅修改 |
cf103df to
034aa86
Compare
手动验证结果 ✅
结论：2/2 通过，可进入 review。 |
手动验证结果（完整）① tools/list命令： 返回： {
"id": 1,
"jsonrpc": "2.0",
"result": {
"tools": [
{
"description": "Huawei_WAF.Huawei_WAF/BlockIP",
"inputSchema": {
"properties": {
"comment": {
"description": "Wrapper message for `string`.",
"type": [
"string",
"null"
]
},
"ip": {
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "huawei-waf__waf-test__block_i_p"
},
{
"description": "Huawei_WAF.Huawei_WAF/ListInstances",
"inputSchema": {
"properties": {
"limit": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
},
"offset": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
}
},
"required": [],
"type": "object"
},
"name": "huawei-waf__waf-test__list_instances"
},
{
"description": "Huawei_WAF.Huawei_WAF/ListPolicies",
"inputSchema": {
"properties": {
"limit": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
},
"offset": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
}
},
"required": [],
"type": "object"
},
"name": "huawei-waf__waf-test__list_policies"
},
{
"description": "Huawei_WAF.Huawei_WAF/ListRules",
"inputSchema": {
"properties": {
"limit": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
},
"offset": {
"description": "Wrapper message for `int64`.",
"type": [
"string",
"null"
]
}
},
"required": [],
"type": "object"
},
"name": "huawei-waf__waf-test__list_rules"
},
{
"description": "Huawei_WAF.Huawei_WAF/UnblockIP",
"inputSchema": {
"properties": {
"rule_id": {
"type": "string"
}
},
"required": [],
"type": "object"
},
"name": "huawei-waf__waf-test__unblock_i_p"
}
]
}
}② ListPolicies命令： 返回： {
"message": "ok",
"data": [
{
"id": "53a25172ef844857a4b48a9cc5e2f5a3",
"name": "1",
"level": 2,
"actionMode": "log",
"createTime": "1782465052951"
},
{
"id": "b8b26a105c604e9097b33b8ac61f0a48",
"name": "octobus-policy",
"level": 2,
"actionMode": "log",
"createTime": "1782461725534"
}
],
"total": 2
}✅ 结论：2/2 全部通过，可进入 review。 |
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 对 huawei-waf 服务进行了多项修复与重构：
整体评估：改动方向合理，修复了递归安全和信息泄露问题。但存在两处值得关注的行为/可靠性风险：401 状态码语义映射发生回归；skipTlsVerify 场景下每次请求新建 undici Agent，可能导致连接池失效。 |
手动验证结果（完整）① tools/list命令： 返回： {
"id": 1,
"jsonrpc": "2.0",
"result": {
"tools": [
{"description": "Huawei_WAF.Huawei_WAF/BlockIP", "name": "huawei-waf__waf-test__block_i_p"},
{"description": "Huawei_WAF.Huawei_WAF/ListInstances", "name": "huawei-waf__waf-test__list_instances"},
{"description": "Huawei_WAF.Huawei_WAF/ListPolicies", "name": "huawei-waf__waf-test__list_policies"},
{"description": "Huawei_WAF.Huawei_WAF/ListRules", "name": "huawei-waf__waf-test__list_rules"},
{"description": "Huawei_WAF.Huawei_WAF/UnblockIP", "name": "huawei-waf__waf-test__unblock_i_p"}
]
}
}② ListPolicies命令： 返回： {
"message": "ok",
"data": [
{"id": "53a25172ef844857a4b48a9cc5e2f5a3", "name": "1", "level": 2, "actionMode": "log"},
{"id": "b8b26a105c604e9097b33b8ac61f0a48", "name": "octobus-policy", "level": 2, "actionMode": "log"}
],
"total": 2
}✅ 结论：2/2 通过。 |
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 仅修改了 |
58d8a9c to
795b973
Compare
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 新增了大量 OctoBus 服务包（如 huawei-waf、sangfor-xdr、volcengine-cloud-firewall、chaitin-cloudatlas 等）并对 SDK 进行了升级，主要包括：
整体评估：代码结构清晰，大多数服务在 TLS 控制和超时处理上遵循了统一模式。但 |
- mapHttpError now handles 401 alongside 403 as PERMISSION_DENIED - Added 401 test case to HTTP transport errors - Fixes regression where 401 was incorrectly mapped to FAILED_PRECONDITION
|
PR Title: feat(huawei-waf): add Huawei Cloud WAF IP blacklis... Commit: 本次 PR 是对 Huawei WAF 服务的一个行为修复：将上游返回的 HTTP 401 状态码重新映射为 |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ct residue Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3 participants
接入设备
华为云 Web 应用防火墙（WAF），提供 IP 黑白名单管理、防护域名查询、防护策略管理等安全能力。
设备版本
WAF，API 版本 v1，端点
waf.{region}.myhuaweicloud.com认证方式
华为云 AK/SK，SDK-HMAC-SHA256 签名
实现方法
BlockIPPOST /v1/{project_id}/waf/policy/{policy_id}/whiteblackipUnblockIPDELETE /v1/{project_id}/waf/policy/{policy_id}/whiteblackip/{rule_id}ListRulesGET /v1/{project_id}/waf/policy/{policy_id}/whiteblackipListInstancesGET /v1/{project_id}/waf/instanceListPoliciesGET /v1/{project_id}/waf/policy联调证据
证据一：MCP 工具列表（证明服务已注册到 OctoBus）
Request
证据二：BlockIP — 封堵测试 IP
Request
证据三：ListRules — 查询规则确认封堵生效
Request
Response HTTP/1.1 200 OK
{ "message":"ok", "data":[{"id":"2589ae798c29496da46b065ffdc58431","ip":"10.0.0.222","name":"octo-block-10-0-0-222","action":0,"description":"OctoBus block test","createTime":"1782465509899"}], "total":1 }证据四：ListPolicies — 查询防护策略
Request
Response HTTP/1.1 200 OK
{ "message":"ok", "data":[ {"id":"******","name":"1","level":2,"actionMode":"log","createTime":"1782465052951"}, {"id":"******","name":"octobus-policy","level":2,"actionMode":"log","createTime":"1782461725534"} ], "total":2 }证据五：UnblockIP — 解封
Request
Response HTTP/1.1 200 OK
{"message":"ok"}测试结果
目录结构