anlicheng/punchnet-macos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

增加policy的校验

Browse Source
This commit is contained in:
anlicheng 2026-05-26 00:24:13 +08:00
parent 50dbe9ecae
commit 0edf2a34c3
4 changed files with 29 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Tun/Configuration/SDLConfiguration.swift
View File

@ -45,7 +45,7 @@ public class SDLConfiguration {
let exitNodeIp: UInt32 let exitNodeIp: UInt32
} }
public struct ACL { public struct ACL: Sendable {
let tcpPorts: Set<UInt16> let tcpPorts: Set<UInt16>
let udpPorts: Set<UInt16> let udpPorts: Set<UInt16>

2
Tun/Context/SDLContextActor.swift
View File

@ -103,7 +103,7 @@ actor SDLContextActor {
let sessionManager = SessionManager() let sessionManager = SessionManager()
let arpResolver = ArpResolver() let arpResolver = ArpResolver()
let flowTracer = SDLFlowTracer() let flowTracer = SDLFlowTracer()
let policyService = PolicyService(identityId: config.identityId) let policyService = PolicyService(identityId: config.identityId, acl: config.acl)
let superServiceProxy = SDLSuperServiceProxy() let superServiceProxy = SDLSuperServiceProxy()
let udpHoleServiceProxy = SDLUDPHoleServiceProxy() let udpHoleServiceProxy = SDLUDPHoleServiceProxy()
let tunNetworkManager = SDLTunNetworkManager(provider: provider) let tunNetworkManager = SDLTunNetworkManager(provider: provider)

24
Tun/Policy/PolicyRuntime.swift
View File

@ -16,13 +16,20 @@ struct PolicyRuntime: @unchecked Sendable {
private let policyRuleSnapshot: PolicyRuleSnapshot private let policyRuleSnapshot: PolicyRuleSnapshot
private let flowSessionTable: FlowSessionTable private let flowSessionTable: FlowSessionTable
private let acl: SDLConfiguration.ACL
init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionTable: FlowSessionTable) { init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionTable: FlowSessionTable, acl: SDLConfiguration.ACL) {
self.policyRuleSnapshot = policyRuleSnapshot self.policyRuleSnapshot = policyRuleSnapshot
self.flowSessionTable = flowSessionTable self.flowSessionTable = flowSessionTable
self.acl = acl
} }
func evaluateInbound(srcIdentityID: UInt32, ipPacket: IPPacketView) -> InboundDecision { func evaluateInbound(srcIdentityID: UInt32, ipPacket: IPPacketView) -> InboundDecision {
if self.isExposedService(ipPacket: ipPacket) {
SDLLogger.log("[PolicyRuntime] acl hit, src_identify_id: \(srcIdentityID), check rule: \(debugInfo(ipPacket: ipPacket))")
return self.evaluateByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
}
if self.isAllowedBySession(ipPacket: ipPacket) { if self.isAllowedBySession(ipPacket: ipPacket) {
SDLLogger.log("[PolicyRuntime] session hit, src_identify_id: \(srcIdentityID), allow: \(debugInfo(ipPacket: ipPacket))") SDLLogger.log("[PolicyRuntime] session hit, src_identify_id: \(srcIdentityID), allow: \(debugInfo(ipPacket: ipPacket))")
return .allow return .allow
@ -33,6 +40,10 @@ struct PolicyRuntime: @unchecked Sendable {
return .allow return .allow
} }
return self.evaluateByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
}
private func evaluateByRule(srcIdentityID: UInt32, ipPacket: IPPacketView) -> InboundDecision {
guard let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID) else { guard let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID) else {
return .missingPolicy return .missingPolicy
} }
@ -43,6 +54,17 @@ struct PolicyRuntime: @unchecked Sendable {
return isAllowed ? .allow : .deny return isAllowed ? .allow : .deny
} }
private func isExposedService(ipPacket: IPPacketView) -> Bool {
switch ipPacket.transportPacket {
case .tcp(_, let dstPort, _):
return ipPacket.header.proto == TransportProtocol.tcp.rawValue && self.acl.tcpPorts.contains(dstPort)
case .udp(_, let dstPort, _):
return ipPacket.header.proto == TransportProtocol.udp.rawValue && self.acl.udpPorts.contains(dstPort)
default:
return false
}
}
private func isAllowedByRule(ruleMap: PolicyRuleMap, ipPacket: IPPacketView) -> Bool { private func isAllowedByRule(ruleMap: PolicyRuleMap, ipPacket: IPPacketView) -> Bool {
let proto = ipPacket.header.proto let proto = ipPacket.header.proto

6
Tun/Policy/PolicyService.swift
View File

@ -16,9 +16,11 @@ actor PolicyService {
// 当前节点的identityId值 // 当前节点的identityId值
let identityId: UInt32 let identityId: UInt32
private let acl: SDLConfiguration.ACL
init(identityId: UInt32) { init(identityId: UInt32, acl: SDLConfiguration.ACL) {
self.identityId = identityId self.identityId = identityId
self.acl = acl
// 权限控制 // 权限控制
let snapshotPublisher = SnapshotPublisher(initial: PolicyRuleSnapshot.empty()) let snapshotPublisher = SnapshotPublisher(initial: PolicyRuleSnapshot.empty())
self.policyRuleStore = PolicyRuleStore(publisher: snapshotPublisher) self.policyRuleStore = PolicyRuleStore(publisher: snapshotPublisher)
@ -26,7 +28,7 @@ actor PolicyService {
} }
nonisolated func policyRuntime() -> PolicyRuntime { nonisolated func policyRuntime() -> PolicyRuntime {
return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionTable: self.flowSessionTable) return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionTable: self.flowSessionTable, acl: self.acl)
} }
nonisolated func recordOutboundFlow(ipPacket: IPPacketView) { nonisolated func recordOutboundFlow(ipPacket: IPPacketView) {