From 0edf2a34c31ea8afb2f0d93a750b62042a65e20b Mon Sep 17 00:00:00 2001
From: anlicheng <244108715@qq.com>
Date: Tue, 26 May 2026 00:24:13 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0policy=E7=9A=84=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Tun/Configuration/SDLConfiguration.swift |  2 +-
 Tun/Context/SDLContextActor.swift        |  2 +-
 Tun/Policy/PolicyRuntime.swift           | 24 +++++++++++++++++++++++-
 Tun/Policy/PolicyService.swift           |  6 ++++--
 4 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/Tun/Configuration/SDLConfiguration.swift b/Tun/Configuration/SDLConfiguration.swift
index b7b0862..2df35c7 100644
--- a/Tun/Configuration/SDLConfiguration.swift
+++ b/Tun/Configuration/SDLConfiguration.swift
@@ -45,7 +45,7 @@ public class SDLConfiguration {
         let exitNodeIp: UInt32
     }
 
-    public struct ACL {
+    public struct ACL: Sendable {
         let tcpPorts: Set<UInt16>
         let udpPorts: Set<UInt16>
 
diff --git a/Tun/Context/SDLContextActor.swift b/Tun/Context/SDLContextActor.swift
index 683a7c3..3f9ea3c 100644
--- a/Tun/Context/SDLContextActor.swift
+++ b/Tun/Context/SDLContextActor.swift
@@ -103,7 +103,7 @@ actor SDLContextActor {
         let sessionManager = SessionManager()
         let arpResolver = ArpResolver()
         let flowTracer = SDLFlowTracer()
-        let policyService = PolicyService(identityId: config.identityId)
+        let policyService = PolicyService(identityId: config.identityId, acl: config.acl)
         let superServiceProxy = SDLSuperServiceProxy()
         let udpHoleServiceProxy = SDLUDPHoleServiceProxy()
         let tunNetworkManager = SDLTunNetworkManager(provider: provider)
diff --git a/Tun/Policy/PolicyRuntime.swift b/Tun/Policy/PolicyRuntime.swift
index 8034450..7765854 100644
--- a/Tun/Policy/PolicyRuntime.swift
+++ b/Tun/Policy/PolicyRuntime.swift
@@ -16,13 +16,20 @@ struct PolicyRuntime: @unchecked Sendable {
 
     private let policyRuleSnapshot: PolicyRuleSnapshot
     private let flowSessionTable: FlowSessionTable
+    private let acl: SDLConfiguration.ACL
 
-    init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionTable: FlowSessionTable) {
+    init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionTable: FlowSessionTable, acl: SDLConfiguration.ACL) {
         self.policyRuleSnapshot = policyRuleSnapshot
         self.flowSessionTable = flowSessionTable
+        self.acl = acl
     }
 
     func evaluateInbound(srcIdentityID: UInt32, ipPacket: IPPacketView) -> InboundDecision {
+        if self.isExposedService(ipPacket: ipPacket) {
+            SDLLogger.log("[PolicyRuntime] acl hit, src_identify_id: \(srcIdentityID), check rule: \(debugInfo(ipPacket: ipPacket))")
+            return self.evaluateByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
+        }
+
         if self.isAllowedBySession(ipPacket: ipPacket) {
             SDLLogger.log("[PolicyRuntime] session hit, src_identify_id: \(srcIdentityID), allow: \(debugInfo(ipPacket: ipPacket))")
             return .allow
@@ -33,6 +40,10 @@ struct PolicyRuntime: @unchecked Sendable {
             return .allow
         }
 
+        return self.evaluateByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
+    }
+
+    private func evaluateByRule(srcIdentityID: UInt32, ipPacket: IPPacketView) -> InboundDecision {
         guard let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID) else {
             return .missingPolicy
         }
@@ -43,6 +54,17 @@ struct PolicyRuntime: @unchecked Sendable {
         return isAllowed ? .allow : .deny
     }
 
+    private func isExposedService(ipPacket: IPPacketView) -> Bool {
+        switch ipPacket.transportPacket {
+        case .tcp(_, let dstPort, _):
+            return ipPacket.header.proto == TransportProtocol.tcp.rawValue && self.acl.tcpPorts.contains(dstPort)
+        case .udp(_, let dstPort, _):
+            return ipPacket.header.proto == TransportProtocol.udp.rawValue && self.acl.udpPorts.contains(dstPort)
+        default:
+            return false
+        }
+    }
+
     private func isAllowedByRule(ruleMap: PolicyRuleMap, ipPacket: IPPacketView) -> Bool {
         let proto = ipPacket.header.proto
 
diff --git a/Tun/Policy/PolicyService.swift b/Tun/Policy/PolicyService.swift
index 40501e0..a4065c4 100644
--- a/Tun/Policy/PolicyService.swift
+++ b/Tun/Policy/PolicyService.swift
@@ -16,9 +16,11 @@ actor PolicyService {
     
     // 当前节点的identityId值
     let identityId: UInt32
+    private let acl: SDLConfiguration.ACL
     
-    init(identityId: UInt32) {
+    init(identityId: UInt32, acl: SDLConfiguration.ACL) {
         self.identityId = identityId
+        self.acl = acl
         // 权限控制
         let snapshotPublisher = SnapshotPublisher(initial: PolicyRuleSnapshot.empty())
         self.policyRuleStore = PolicyRuleStore(publisher: snapshotPublisher)
@@ -26,7 +28,7 @@ actor PolicyService {
     }
     
     nonisolated func policyRuntime() -> PolicyRuntime {
-        return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionTable: self.flowSessionTable)
+        return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionTable: self.flowSessionTable, acl: self.acl)
     }
 
     nonisolated func recordOutboundFlow(ipPacket: IPPacketView) {