anlicheng/punchnet-macos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix Policy Rule

Browse Source
This commit is contained in:
anlicheng 2026-05-21 12:31:41 +08:00
parent def15bd3c9
commit 8130b87444
4 changed files with 22 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tun/Punchnet/Policy/PolicyRuleMap.swift
View File

@ -4,6 +4,7 @@
//
// Created by 安礼成 on 2026/2/5.
//
import Foundation
struct PolicyRuleMap {
let version: UInt32

24
Tun/Punchnet/Policy/PolicyRuntime.swift
View File

@ -8,11 +8,11 @@
import Foundation
struct PolicyRuntime: @unchecked Sendable {
private let policySnapshot: PolicySnapshot
private let policyRuleSnapshot: PolicyRuleSnapshot
private let flowSessionManager: SDLFlowSessionManager
init(policySnapshot: PolicySnapshot, flowSessionManager: SDLFlowSessionManager) {
self.policySnapshot = policySnapshot
init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionManager: SDLFlowSessionManager) {
self.policyRuleSnapshot = policyRuleSnapshot
self.flowSessionManager = flowSessionManager
}
@ -23,6 +23,22 @@ struct PolicyRuntime: @unchecked Sendable {
return true
}
return self.policySnapshot.allows(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
return self.allowsByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
}
private func allowsByRule(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
let proto = ipPacket.header.proto
switch ipPacket.transportPacket {
case .tcp(let tcpPacket):
return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
case .udp(let udpPacket):
return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
case .icmp:
return true
default:
return false
}
}
}

3
Tun/Punchnet/Policy/PolicyService.swift
View File

@ -27,8 +27,7 @@ actor PolicyService {
}
nonisolated func policyRuntime() -> PolicyRuntime {
let policySnapshot = PolicySnapshot(policyRuleSnapshot: self.snapshotPublisher.current())
return PolicyRuntime(policySnapshot: policySnapshot, flowSessionManager: self.flowSessionManager)
return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionManager: self.flowSessionManager)
}
nonisolated func recordOutboundFlow(ipPacket: IPPacket) {

36
Tun/Punchnet/Policy/PolicySnapshot.swift
View File

@ -1,36 +0,0 @@
//
// PolicySnapshot.swift
// Tun
//
// Created by Codex on 2026/5/20.
//
import Foundation
final class PolicySnapshot: Snapshot {
private let policyRuleSnapshot: PolicyRuleSnapshot
init(policyRuleSnapshot: PolicyRuleSnapshot) {
self.policyRuleSnapshot = policyRuleSnapshot
}
func allows(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
let proto = ipPacket.header.proto
switch ipPacket.transportPacket {
case .tcp(let tcpPacket):
return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
case .udp(let udpPacket):
return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
case .icmp:
return true
default:
return false
}
}
static func empty() -> PolicySnapshot {
return PolicySnapshot(policyRuleSnapshot: .empty())
}
}