From 5b10f7de61217e1f564efee56c5d551cc0078c4f Mon Sep 17 00:00:00 2001
From: anlicheng <244108715@qq.com>
Date: Sun, 3 May 2026 20:43:44 +0800
Subject: [PATCH] change to tls

---
 Tun/PacketTunnelProvider.swift            | 10 ++++------
 Tun/Punchnet/Actors/SDLContextActor.swift |  5 +++--
 Tun/Punchnet/Actors/SDLQuicClient.swift   | 22 ++++++++++++++++------
 3 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/Tun/PacketTunnelProvider.swift b/Tun/PacketTunnelProvider.swift
index 3693ea3..7db99d7 100644
--- a/Tun/PacketTunnelProvider.swift
+++ b/Tun/PacketTunnelProvider.swift
@@ -15,8 +15,6 @@ enum TunnelError: Error {
 class PacketTunnelProvider: NEPacketTunnelProvider {
     private var runtimeEnv: SDLRuntimeEnvironment?
     
-    
-    
     override func startTunnel(options: [String: NSObject]?, completionHandler: @escaping (Error?) -> Void) {
         // 如果当前在运行状态，不允许重复请求
         guard self.runtimeEnv == nil else {
@@ -29,8 +27,6 @@ class PacketTunnelProvider: NEPacketTunnelProvider {
             return
         }
         
-        
-        
         self.runtimeEnv = SDLRuntimeEnvironment(options: options)
         Task {
             do {
@@ -78,11 +74,12 @@ class PacketTunnelProvider: NEPacketTunnelProvider {
     }
 
     override func wake() {
+        SDLLogger.log("[PacketTunnelProvider] wake up!!!!!!!")
         // 启动monitor
         let monitor = SDLPathMonitor()
         // 启动监视器，允许重入
         monitor.start()
-        SDLLogger.log("[SDLContext] monitor started")
+        SDLLogger.log("[PacketTunnelProvider] monitor started")
         
         // Add code here to wake up.
         Task {
@@ -93,7 +90,7 @@ class PacketTunnelProvider: NEPacketTunnelProvider {
             
             // 等待网络可达
             _ = await monitor.statusStream().first {$0 == .satisfied}
-            SDLLogger.log("[SDLContext] network is satisfied")
+            SDLLogger.log("[PacketTunnelProvider] network is satisfied")
             // 重新启动
             try await self.runtimeEnv?.start(provider: self)
         }
@@ -161,6 +158,7 @@ private class SDLRuntimeEnvironment {
     
     func stop() async {
         await self.contextActor?.stop()
+        self.contextActor = nil
     }
     
 }
diff --git a/Tun/Punchnet/Actors/SDLContextActor.swift b/Tun/Punchnet/Actors/SDLContextActor.swift
index df74924..7692d88 100644
--- a/Tun/Punchnet/Actors/SDLContextActor.swift
+++ b/Tun/Punchnet/Actors/SDLContextActor.swift
@@ -192,7 +192,7 @@ actor SDLContextActor {
         SDLLogger.log("[SDLContext] try start quicClient", for: .debug)
         
         // 启动monitor
-        let quicClient = SDLQUICClient(host: self.config.serverHost, port: 443)
+        let quicClient = SDLQUICClient(host: self.config.serverHost, port: 1443)
         self.quicClient = quicClient
         quicClient.start()
         
@@ -268,13 +268,14 @@ actor SDLContextActor {
                 do {
                     try await Task.sleep(for: .seconds(5))
                     try Task.checkCancellation()
-                    
+
                     // 关闭掉当前Tunnel
                     self.publishTunnelEvent(message: "校验失败")
                     // 报告错误并退出
                     let error = NSError(domain: "com.jihe.punchnet.tun", code: -3)
                     self.provider.cancelTunnelWithError(error)
                 } catch {
+                    SDLLogger.log("[SDLContext] registerTask: cancel")
                     return
                 }
             }
diff --git a/Tun/Punchnet/Actors/SDLQuicClient.swift b/Tun/Punchnet/Actors/SDLQuicClient.swift
index a942f3c..99bc7a0 100644
--- a/Tun/Punchnet/Actors/SDLQuicClient.swift
+++ b/Tun/Punchnet/Actors/SDLQuicClient.swift
@@ -46,7 +46,13 @@ final class SDLQUICClient {
     private let queue = DispatchQueue(label: "com.sdl.QUICClient.queue") // 专用队列保证线程安全
 
     init(host: String, port: UInt16, maxBufferSize: Int = 2 * 1024 * 1024) {
-        let options = NWProtocolQUIC.Options(alpn: ["punchnet/1.0"])
+        let options = NWProtocolTLS.Options()
+        
+        sec_protocol_options_add_tls_application_protocol(
+            options.securityProtocolOptions,
+            "punchnet/1.0"
+        )
+        
         self.frameParser = SDLQUICFrameParser(maxBufferSize: maxBufferSize)
         
         (self.eventStream, self.eventCont) = AsyncStream.makeStream(of: SDLQUICEvent.self)
@@ -57,12 +63,16 @@ final class SDLQUICClient {
             options.securityProtocolOptions,
             { metadata, trust, complete in
                 // 执行公钥校验
-                complete(QUICVerifier.verify(trust: trust, host: host))
+                complete(TLSVerifier.verify(trust: trust, host: host))
             },
             self.queue
         )
-
-        let params = NWParameters(quic: options)
+        SDLLogger.log("[SDLQUICClient] start with tls protocol", for: .debug)
+        
+        let params = NWParameters(tls: options)
+        // 关键：让 Network.framework 忽略系统代理
+        params.preferNoProxies = true
+        
         self.connection = NWConnection(host: .init(host), port: .init(rawValue: port)!, using: params)
     }
     
@@ -266,10 +276,10 @@ extension SDLQUICClient {
     }
 }
 
-// --MARK: quic验证
+// --MARK: tls验证
 extension SDLQUICClient {
 
-    enum QUICVerifier {
+    enum TLSVerifier {
         // 你的 Base64 公钥指纹
         static let pinnedPublicKeyHashes = [
             "Q41r6hbMWEVyxo6heNAH4Wx/TH5NNOWlNif9bewcJ3E="