feat(tencent-cfw): add Tencent Cloud Firewall (CFW) service package by dingzhejianjian · Pull Request #284 · chaitin/OctoBus

dingzhejianjian · 2026-06-25T15:35:49Z

接入设备

腾讯云防火墙 CFW（Cloud Firewall），提供互联网边界的访问控制策略管理能力，支持 IP 级别的封堵/解封及规则查询。

设备版本

CFW，API 版本 2019-09-04，端点 cfw.tencentcloudapi.com

认证方式

腾讯云 API 密钥（SecretId + SecretKey），TC3-HMAC-SHA256 签名

实现方法

RPC 方法	后端 API	类型	说明
`BlockIP`	`CreateAcRules`	写	封堵指定 IP
`UnblockIP`	`DescribeAcLists` + `DeleteAcRule`	写	解封指定 IP
`ListRules`	`DescribeAcLists`	读	查询访问控制规则列表

Review 修复

目录结构调整：服务文件从根目录移至 services/ 下（遵循 OctoBus 标准布局）
死代码清理：移除未使用的 rpcdef 函数及 METHOD_*_PATH 导出
Schema 补全：secret.schema.json 增加 secretId 别名声明

联调证据

证据一：MCP 工具列表（证明服务已注册到 OctoBus）

POST http://127.0.0.1:9000/capsets/cfw-dev/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}

Response:

{
  "id": 1,
  "jsonrpc": "2.0",
  "result": {
    "tools": [
      {"name": "tencent-cfw__cfw-test__block_i_p", "description": "Tencent_CFW.Tencent_CFW/BlockIP"},
      {"name": "tencent-cfw__cfw-test__list_rules", "description": "Tencent_CFW.Tencent_CFW/ListRules"},
      {"name": "tencent-cfw__cfw-test__unblock_i_p", "description": "Tencent_CFW.Tencent_CFW/UnblockIP"}
    ]
  }
}

证据二：Connect RPC — ListRules（证明 API 签名和链路全通）

POST http://127.0.0.1:9000/capsets/cfw-dev/connect/cfw-test/Tencent_CFW.Tencent_CFW/ListRules
Content-Type: application/json

{"limit":5}

Response:

{"message":"71a2a87d-517c-4324-a31d-6f39f8771cad"}

返回腾讯云 CFW 的 request_id，表明 API 签名认证通过、调用链路正常。

证据三：实例运行状态

实例ID: cfw-test
PID: 21
Status: running
HasSecret: true

测试结果

ℹ tests 15
ℹ pass  15
ℹ fail  0

目录结构

services/tencent__cfw/
├── service.json
├── package.json
├── proto/tencent_cfw.proto
├── bin/tencent-cfw.js
├── src/service.js
├── src/tencent-cfw.js
├── config.schema.json
├── secret.schema.json
├── README.md
└── test/tencent-cfw.test.js

monkeyscan · 2026-06-25T15:43:15Z

本次 PR 新增 Tencent Cloud Firewall (CFW) 的 OctoBus 服务包，实现了 BlockIP、UnblockIP、ListRules 三个 gRPC 方法。服务通过 TC3-HMAC-SHA256 签名调用腾讯云 API 3.0，包含完整的单元测试与 JSON Schema 配置。整体结构清晰，但主实现中存在关键的正确性与可靠性缺陷：UnblockIP 仅查询前 100 条规则且无分页，Enable 参数硬编码为 0 可能导致规则创建后未生效，以及 TLS 跳过配置在标准 Node.js fetch 下会被静默忽略。

monkeyscan · 2026-06-25T15:43:17Z

+
+  const region = unwrapString(bindings.region).trim() || 'ap-guangzhou';
+
+  // Only business params in body (Action/Version/Region go only in X-TC-* headers)


skipTlsVerify 等配置传入标准 fetch 后会被静默忽略，TLS 跳过不生效

buildTlsOptions 返回的 insecureSkipVerify / tlsInsecureSkipVerify / skipTlsVerify 属性被直接展开到 fetch() 的选项中。Node.js 原生 fetch (undici) 并不识别这些选项，因此当用户配置 skipTlsVerify: true 时，TLS 证书校验仍会被执行，配置失效且无任何报错，存在误导性。

Problem code:

Changed code at tencent__cfw/src/tencent-cfw.js:250-255

Recommendation:
使用支持 TLS 选项的 HTTP Agent（如 node:https 的 agent 并设置 rejectUnauthorized: false）或者在文档中注明此配置在当前运行时无效。

innomentats · 2026-06-26T06:36:24Z

Review 阻塞：服务包目录放错位置了。当前 diff 把 tencent__cfw/、bin/tencent-cfw.js 和根 package.json 放在仓库根目录，而本仓库 service package 约定是在 services/<service>/、services/bin/、services/package.json 下维护。请移动到 services/tencent__cfw/ 并补充真实测试截图证据；目前 PR 里只有测试文本，没有可查看的截图或图片文件。

…blockIP

dingzhejianjian · 2026-06-26T11:55:57Z

已修正：

服务包目录已移入 services/tencent__cfw/
services/package.json 恢复所有已有服务注册，仅追加 tencent-cfw
services/bin/octobus-tentacles.js 恢复所有已有服务入口
BlockIP Enable 已从 0 改为 1（规则创建后生效）
UnblockIP 已实现分页查询所有 ACL 规则
fetch 超时改用 AbortController
联调证据已补充真实请求/响应数据

innomentats · 2026-06-26T12:49:37Z

之前旧的没有删呀

…hema Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The tencent-cfw service files were incorrectly placed at repo root. Moved under services/ where upstream expects them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

monkeyscan · 2026-06-26T13:15:03Z

PR Title: feat(tencent-cfw): add Tencent Cloud Firewall (CFW...

Commit: 563d1bd

本次 PR 将旧目录 tencent__cfw/ 下的 10 个文件全部删除，属于清理性质操作。根据 remapped 文件与 commit message 推断，业务代码已提前迁移至 services/tencent__cfw/ 目录，本次只是移除根目录下的历史残留文件。

主要变更：

删除根目录 tencent__cfw/ 下的源码、测试、proto、schema、README 等全部文件（共 10 个，合计删减 862 行）。
新位置的入口文件 services/bin/tencent-cfw.js 已正确引用 services/tencent__cfw/src/service.js，测试文件 services/tencent__cfw/test/tencent-cfw.test.js 也已就位，迁移链路基本完整。

需要留意的历史问题：

被删除的 tencent__cfw/src/tencent-cfw.js 上存在 3 条已确认的历史缺陷（UnblockIP 分页缺失、BlockIP Enable 硬编码为 0、TLS 跳过配置对标准 fetch 无效）。由于本次 diff 未触及新目录的对应源码，无法确认这些问题是否已在 services/tencent__cfw/ 的代码中得到修复。建议在合并前确认新目录的对应逻辑是否已同步修正。

整体评估：本次 PR 为纯删除清理，未发现由本次变更直接引入的正确性或安全问题。迁移后的入口与测试文件引用路径正确，未发现明显断裂。

dingzhejianjian · 2026-06-27T02:30:02Z

monkeyscan · 2026-06-27T13:51:43Z

PR Title: feat(tencent-cfw): add Tencent Cloud Firewall (CFW...

Commit: 396abea

本次改动仅涉及一个文件 services/tencent__cfw/src/tencent-cfw.js 中的 mapHttpError 函数。改动移除了在 HTTP 错误响应消息中拼接上游返回体（bodyText）的逻辑，将错误消息从 upstream http ${res.status}: ${text} 简化为 upstream http ${res.status}。这是一项针对信息泄露的安全修复，避免将上游服务的详细错误体透传给客户端。改动面极小，逻辑清晰，未引入新的行为回归风险。

monkeyscan · 2026-06-27T14:29:29Z

PR Title: feat(tencent-cfw): add Tencent Cloud Firewall (CFW...

Commit: 53f200b

本次修复将 res.text() 移入 try 块内，使响应体读取也能被 AbortController 超时保护。旧代码中 fetch() 完成后立即清除定时器，导致 res.text() 挂起时无超时机制。新代码确保整个 HTTP 交互（含 body 读取）都在超时保护范围内。同时新增 GrpcError 判断，避免 HTTP 错误被二次包装为 UNAVAILABLE。整体改动正确，修复了旧代码的超时保护盲区。

monkeyscan · 2026-06-27T16:25:24Z

PR Title: feat(tencent-cfw): add Tencent Cloud Firewall (CFW...

Commit: ff84d1a

本次 PR 对 services/tencent__cfw/src/tencent-cfw.js 做了两处修改：

为 unwrapString 增加递归深度限制：新增 depth 参数，当递归深度超过 10 时返回空字符串，防止因极端嵌套或循环引用导致的栈溢出。这是一个可靠性/安全防御性修复。
为 mapHttpError 显式处理 HTTP 429：在原有的 401/403 → PERMISSION_DENIED 和 4xx → FAILED_PRECONDITION 映射之间，新增 429 → UNAVAILABLE 的分支。这使得速率限制错误（Too Many Requests）不再被错误归类为 FAILED_PRECONDITION，语义更加准确。

总体评估：两项改动均为正向修复，逻辑清晰，无引入新的回归风险。深度阈值 10 对于解包 protobuf StringValue 的场景足够宽松。

feat(tencent-cfw): add Tencent Cloud Firewall (CFW) service package

2c2088b

monkeyscan Bot reviewed Jun 25, 2026

View reviewed changes

Comment thread tencent__cfw/src/tencent-cfw.js

monkeyscan Bot reviewed Jun 25, 2026

View reviewed changes

Comment thread tencent__cfw/src/tencent-cfw.js Outdated

kiligertee added 2 commits June 26, 2026 15:35

fix: move tencent-cfw to services/ directory

87c7a5f

fix: restore all existing services, fix Enable:1 and pagination in Un…

8ed5a8e

…blockIP

innomentats marked this pull request as draft June 26, 2026 12:49

kiligertee and others added 2 commits June 26, 2026 21:11

fix: remove unused rpcdef, clean up exports, add secretId alias to sc…

931660d

…hema Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix: move service files from root to services/ directory

563d1bd

The tencent-cfw service files were incorrectly placed at repo root. Moved under services/ where upstream expects them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

dingzhejianjian marked this pull request as ready for review June 27, 2026 03:04

fix: remove upstream error body from mapHttpError to prevent info leak

396abea

fix: move res.text() inside try block to protect from timeout

53f200b

fix: add unwrapString depth limit, differentiate 429 in mapHttpError

ff84d1a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(tencent-cfw): add Tencent Cloud Firewall (CFW) service package#284

feat(tencent-cfw): add Tencent Cloud Firewall (CFW) service package#284
dingzhejianjian wants to merge 8 commits into
chaitin:mainfrom
dingzhejianjian:dingzhejianjian-patch-3

dingzhejianjian commented Jun 25, 2026 •

edited

Loading

Uh oh!

monkeyscan Bot commented Jun 25, 2026

Uh oh!

monkeyscan Bot Jun 25, 2026

Uh oh!

Uh oh!

Uh oh!

innomentats commented Jun 26, 2026

Uh oh!

dingzhejianjian commented Jun 26, 2026

Uh oh!

innomentats commented Jun 26, 2026

Uh oh!

monkeyscan Bot commented Jun 26, 2026 •

edited

Loading

Uh oh!

dingzhejianjian commented Jun 27, 2026

Uh oh!

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		const region = unwrapString(bindings.region).trim() \|\| 'ap-guangzhou';

		// Only business params in body (Action/Version/Region go only in X-TC-* headers)

Uh oh!

Conversation

dingzhejianjian commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

接入设备

设备版本

认证方式

实现方法

Review 修复

联调证据

证据一：MCP 工具列表（证明服务已注册到 OctoBus）

证据二：Connect RPC — ListRules（证明 API 签名和链路全通）

证据三：实例运行状态

测试结果

目录结构

Uh oh!

monkeyscan Bot commented Jun 25, 2026

Uh oh!

monkeyscan Bot Jun 25, 2026

Choose a reason for hiding this comment

skipTlsVerify 等配置传入标准 fetch 后会被静默忽略，TLS 跳过不生效

Uh oh!

Uh oh!

Uh oh!

innomentats commented Jun 26, 2026

Uh oh!

dingzhejianjian commented Jun 26, 2026

Uh oh!

innomentats commented Jun 26, 2026

Uh oh!

monkeyscan Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dingzhejianjian commented Jun 27, 2026

Uh oh!

monkeyscan Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

monkeyscan Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

monkeyscan Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dingzhejianjian commented Jun 25, 2026 •

edited

Loading

monkeyscan Bot commented Jun 26, 2026 •

edited

Loading

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading

monkeyscan Bot commented Jun 27, 2026 •

edited

Loading