From 8130b8744422f35faf3b6499373e746cbd2df849 Mon Sep 17 00:00:00 2001
From: anlicheng <244108715@qq.com>
Date: Thu, 21 May 2026 12:31:41 +0800
Subject: [PATCH] fix Policy Rule

---
 Tun/Punchnet/Policy/PolicyRuleMap.swift  |  1 +
 Tun/Punchnet/Policy/PolicyRuntime.swift  | 24 +++++++++++++---
 Tun/Punchnet/Policy/PolicyService.swift  |  3 +-
 Tun/Punchnet/Policy/PolicySnapshot.swift | 36 ------------------------
 4 files changed, 22 insertions(+), 42 deletions(-)
 delete mode 100644 Tun/Punchnet/Policy/PolicySnapshot.swift

diff --git a/Tun/Punchnet/Policy/PolicyRuleMap.swift b/Tun/Punchnet/Policy/PolicyRuleMap.swift
index 0c3c99e..8685dbc 100644
--- a/Tun/Punchnet/Policy/PolicyRuleMap.swift
+++ b/Tun/Punchnet/Policy/PolicyRuleMap.swift
@@ -4,6 +4,7 @@
 //
 //  Created by 安礼成 on 2026/2/5.
 //
+import Foundation
 
 struct PolicyRuleMap {
     let version: UInt32
diff --git a/Tun/Punchnet/Policy/PolicyRuntime.swift b/Tun/Punchnet/Policy/PolicyRuntime.swift
index a662278..f7a5322 100644
--- a/Tun/Punchnet/Policy/PolicyRuntime.swift
+++ b/Tun/Punchnet/Policy/PolicyRuntime.swift
@@ -8,11 +8,11 @@
 import Foundation
 
 struct PolicyRuntime: @unchecked Sendable {
-    private let policySnapshot: PolicySnapshot
+    private let policyRuleSnapshot: PolicyRuleSnapshot
     private let flowSessionManager: SDLFlowSessionManager
 
-    init(policySnapshot: PolicySnapshot, flowSessionManager: SDLFlowSessionManager) {
-        self.policySnapshot = policySnapshot
+    init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionManager: SDLFlowSessionManager) {
+        self.policyRuleSnapshot = policyRuleSnapshot
         self.flowSessionManager = flowSessionManager
     }
 
@@ -23,6 +23,22 @@ struct PolicyRuntime: @unchecked Sendable {
             return true
         }
 
-        return self.policySnapshot.allows(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
+        return self.allowsByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
+    }
+
+    private func allowsByRule(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
+        let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
+        let proto = ipPacket.header.proto
+
+        switch ipPacket.transportPacket {
+        case .tcp(let tcpPacket):
+            return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
+        case .udp(let udpPacket):
+            return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
+        case .icmp:
+            return true
+        default:
+            return false
+        }
     }
 }
diff --git a/Tun/Punchnet/Policy/PolicyService.swift b/Tun/Punchnet/Policy/PolicyService.swift
index 07c3b18..e82fe22 100644
--- a/Tun/Punchnet/Policy/PolicyService.swift
+++ b/Tun/Punchnet/Policy/PolicyService.swift
@@ -27,8 +27,7 @@ actor PolicyService {
     }
     
     nonisolated func policyRuntime() -> PolicyRuntime {
-        let policySnapshot = PolicySnapshot(policyRuleSnapshot: self.snapshotPublisher.current())
-        return PolicyRuntime(policySnapshot: policySnapshot, flowSessionManager: self.flowSessionManager)
+        return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionManager: self.flowSessionManager)
     }
 
     nonisolated func recordOutboundFlow(ipPacket: IPPacket) {
diff --git a/Tun/Punchnet/Policy/PolicySnapshot.swift b/Tun/Punchnet/Policy/PolicySnapshot.swift
deleted file mode 100644
index 48ec8a4..0000000
--- a/Tun/Punchnet/Policy/PolicySnapshot.swift
+++ /dev/null
@@ -1,36 +0,0 @@
-//
-//  PolicySnapshot.swift
-//  Tun
-//
-//  Created by Codex on 2026/5/20.
-//
-
-import Foundation
-
-final class PolicySnapshot: Snapshot {
-    private let policyRuleSnapshot: PolicyRuleSnapshot
-
-    init(policyRuleSnapshot: PolicyRuleSnapshot) {
-        self.policyRuleSnapshot = policyRuleSnapshot
-    }
-
-    func allows(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
-        let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
-        let proto = ipPacket.header.proto
-
-        switch ipPacket.transportPacket {
-        case .tcp(let tcpPacket):
-            return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
-        case .udp(let udpPacket):
-            return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
-        case .icmp:
-            return true
-        default:
-            return false
-        }
-    }
-
-    static func empty() -> PolicySnapshot {
-        return PolicySnapshot(policyRuleSnapshot: .empty())
-    }
-}