anlicheng/punchnet-macos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix Policy Rule

Browse Source
This commit is contained in:
anlicheng 2026-05-21 12:31:41 +08:00
parent def15bd3c9
commit 8130b87444
4 changed files with 22 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Tun/Punchnet/Policy/PolicyRuleMap.swift
View File

@ -4,6 +4,7 @@
// //
// Created by 安礼成 on 2026/2/5. // Created by 安礼成 on 2026/2/5.
// //
import Foundation
struct PolicyRuleMap { struct PolicyRuleMap {
let version: UInt32 let version: UInt32

24
Tun/Punchnet/Policy/PolicyRuntime.swift
View File

@ -8,11 +8,11 @@
import Foundation import Foundation
struct PolicyRuntime: @unchecked Sendable { struct PolicyRuntime: @unchecked Sendable {
private let policySnapshot: PolicySnapshot private let policyRuleSnapshot: PolicyRuleSnapshot
private let flowSessionManager: SDLFlowSessionManager private let flowSessionManager: SDLFlowSessionManager
init(policySnapshot: PolicySnapshot, flowSessionManager: SDLFlowSessionManager) { init(policyRuleSnapshot: PolicyRuleSnapshot, flowSessionManager: SDLFlowSessionManager) {
self.policySnapshot = policySnapshot self.policyRuleSnapshot = policyRuleSnapshot
self.flowSessionManager = flowSessionManager self.flowSessionManager = flowSessionManager
} }
@ -23,6 +23,22 @@ struct PolicyRuntime: @unchecked Sendable {
return true return true
} }
return self.policySnapshot.allows(srcIdentityID: srcIdentityID, ipPacket: ipPacket) return self.allowsByRule(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
}
private func allowsByRule(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
let proto = ipPacket.header.proto
switch ipPacket.transportPacket {
case .tcp(let tcpPacket):
return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
case .udp(let udpPacket):
return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
case .icmp:
return true
default:
return false
}
} }
} }

3
Tun/Punchnet/Policy/PolicyService.swift
View File

@ -27,8 +27,7 @@ actor PolicyService {
} }
nonisolated func policyRuntime() -> PolicyRuntime { nonisolated func policyRuntime() -> PolicyRuntime {
let policySnapshot = PolicySnapshot(policyRuleSnapshot: self.snapshotPublisher.current()) return PolicyRuntime(policyRuleSnapshot: self.snapshotPublisher.current(), flowSessionManager: self.flowSessionManager)
return PolicyRuntime(policySnapshot: policySnapshot, flowSessionManager: self.flowSessionManager)
} }
nonisolated func recordOutboundFlow(ipPacket: IPPacket) { nonisolated func recordOutboundFlow(ipPacket: IPPacket) {

36
Tun/Punchnet/Policy/PolicySnapshot.swift
View File

@ -1,36 +0,0 @@
//
// PolicySnapshot.swift
// Tun
//
// Created by Codex on 2026/5/20.
//
import Foundation
final class PolicySnapshot: Snapshot {
private let policyRuleSnapshot: PolicyRuleSnapshot
init(policyRuleSnapshot: PolicyRuleSnapshot) {
self.policyRuleSnapshot = policyRuleSnapshot
}
func allows(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
let ruleMap = self.policyRuleSnapshot.lookup(srcIdentityID)
let proto = ipPacket.header.proto
switch ipPacket.transportPacket {
case .tcp(let tcpPacket):
return ruleMap?.isAllow(proto: proto, port: tcpPacket.header.dstPort) ?? false
case .udp(let udpPacket):
return ruleMap?.isAllow(proto: proto, port: udpPacket.dstPort) ?? false
case .icmp:
return true
default:
return false
}
}
static func empty() -> PolicySnapshot {
return PolicySnapshot(policyRuleSnapshot: .empty())
}
}