From a772b67205fca6b5e1a1c5ce2ad837ce06623497 Mon Sep 17 00:00:00 2001 From: anlicheng <244108715@qq.com> Date: Thu, 21 May 2026 12:03:17 +0800 Subject: [PATCH] fix Policy Runtime --- Tun/Punchnet/Inbound/PacketInboundActor.swift | 5 +- .../Inbound/PacketInboundProcessor.swift | 21 ++------ .../Outbound/PacketOutboundActor.swift | 4 +- Tun/Punchnet/Policy/PolicyRuntime.swift | 28 +++++++++++ Tun/Punchnet/Policy/PolicyService.swift | 49 ++++++------------- 5 files changed, 51 insertions(+), 56 deletions(-) create mode 100644 Tun/Punchnet/Policy/PolicyRuntime.swift diff --git a/Tun/Punchnet/Inbound/PacketInboundActor.swift b/Tun/Punchnet/Inbound/PacketInboundActor.swift index 3467b63..e061a30 100644 --- a/Tun/Punchnet/Inbound/PacketInboundActor.swift +++ b/Tun/Punchnet/Inbound/PacketInboundActor.swift @@ -49,8 +49,7 @@ actor PacketInboundActor { let processor = PacketInboundProcessor( networkAddress: self.networkAddress, dataCipher: self.dataCipher, - policySnapshot: self.policyService.policySnapshot(), - flowSessionManager: self.policyService.flowSessionManager + policyRuntime: self.policyService.policyRuntime() ) guard let plan = try? processor.makeProcessingPlan(data: data) else { @@ -72,7 +71,7 @@ actor PacketInboundActor { SDLLogger.log("[PacketInboundActor] hole identity: \(identityID), allow, data count: \(packetData.count)", for: .trace) case .requestPolicy(let srcIdentityID): SDLLogger.log("[PacketInboundActor] not found identity: \(srcIdentityID) ruleMap", for: .debug) - if let queryData = await self.policyService.identifyStore.makePolicyRequest(srcIdentityId: srcIdentityID, dstIdentityId: self.identityId) { + if let queryData = await self.policyService.makePolicyRequest(srcIdentityID: srcIdentityID) { await self.superServiceProxy.send(type: .policyRequest, data: queryData) } case .none: diff --git a/Tun/Punchnet/Inbound/PacketInboundProcessor.swift b/Tun/Punchnet/Inbound/PacketInboundProcessor.swift index 30d5065..a9072a9 100644 --- a/Tun/Punchnet/Inbound/PacketInboundProcessor.swift +++ b/Tun/Punchnet/Inbound/PacketInboundProcessor.swift @@ -24,17 +24,14 @@ final class PacketInboundProcessor { private let networkAddress: SDLConfiguration.NetworkAddress private let dataCipher: CCDataCipher? - private let policySnapshot: PolicySnapshot - private let flowSessionManager: SDLFlowSessionManager + private let policyRuntime: PolicyRuntime init(networkAddress: SDLConfiguration.NetworkAddress, dataCipher: CCDataCipher?, - policySnapshot: PolicySnapshot, - flowSessionManager: SDLFlowSessionManager) { + policyRuntime: PolicyRuntime) { self.networkAddress = networkAddress self.dataCipher = dataCipher - self.policySnapshot = policySnapshot - self.flowSessionManager = flowSessionManager + self.policyRuntime = policyRuntime } func makeProcessingPlan(data: SDLData) throws -> ProcessingPlan? { @@ -96,17 +93,7 @@ final class PacketInboundProcessor { return .init(inboundBytes: inboundBytes, action: .none) } - if let reverseFlowSession = ipPacket.flowSession()?.reverse(), - self.flowSessionManager.hasSession(reverseFlowSession) { - self.flowSessionManager.updateSession(reverseFlowSession) - return .init( - inboundBytes: inboundBytes, - action: .writeToTun(packetData: ipPacket.data, identityID: identityID) - ) - } - - // 检查权限逻辑 - if self.policySnapshot.allows(srcIdentityID: identityID, ipPacket: ipPacket) { + if self.policyRuntime.allowsInbound(srcIdentityID: identityID, ipPacket: ipPacket) { return .init( inboundBytes: inboundBytes, action: .writeToTun(packetData: ipPacket.data, identityID: identityID) diff --git a/Tun/Punchnet/Outbound/PacketOutboundActor.swift b/Tun/Punchnet/Outbound/PacketOutboundActor.swift index 2b1b6a0..72d012b 100644 --- a/Tun/Punchnet/Outbound/PacketOutboundActor.swift +++ b/Tun/Punchnet/Outbound/PacketOutboundActor.swift @@ -121,8 +121,8 @@ actor PacketOutboundActor { let router = PacketOutboundRouter(networkAddress: self.networkAddress, exitNode: self.exitNode) let decision = router.route(packet: packet) - if decision.shouldTrackFlow, let flowSession = packet.flowSession() { - self.policyService.flowSessionManager.updateSession(flowSession) + if decision.shouldTrackFlow { + self.policyService.recordOutboundFlow(ipPacket: packet) } await self.handleTunRouteDecision(decision) diff --git a/Tun/Punchnet/Policy/PolicyRuntime.swift b/Tun/Punchnet/Policy/PolicyRuntime.swift new file mode 100644 index 0000000..a662278 --- /dev/null +++ b/Tun/Punchnet/Policy/PolicyRuntime.swift @@ -0,0 +1,28 @@ +// +// PolicyRuntime.swift +// Tun +// +// Created by Codex on 2026/5/21. +// + +import Foundation + +struct PolicyRuntime: @unchecked Sendable { + private let policySnapshot: PolicySnapshot + private let flowSessionManager: SDLFlowSessionManager + + init(policySnapshot: PolicySnapshot, flowSessionManager: SDLFlowSessionManager) { + self.policySnapshot = policySnapshot + self.flowSessionManager = flowSessionManager + } + + func allowsInbound(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool { + if let reverseFlowSession = ipPacket.flowSession()?.reverse(), + self.flowSessionManager.hasSession(reverseFlowSession) { + self.flowSessionManager.updateSession(reverseFlowSession) + return true + } + + return self.policySnapshot.allows(srcIdentityID: srcIdentityID, ipPacket: ipPacket) + } +} diff --git a/Tun/Punchnet/Policy/PolicyService.swift b/Tun/Punchnet/Policy/PolicyService.swift index 1477f73..79faf26 100644 --- a/Tun/Punchnet/Policy/PolicyService.swift +++ b/Tun/Punchnet/Policy/PolicyService.swift @@ -9,11 +9,11 @@ import Foundation actor PolicyService { // 处理权限控制 - let identifyStore: IdentityStore + private let identifyStore: IdentityStore nonisolated private let snapshotPublisher: SnapshotPublisher // Flow流会话管理， 过期时间为: 180秒 - nonisolated let flowSessionManager = SDLFlowSessionManager(sessionTimeout: 180) + nonisolated private let flowSessionManager = SDLFlowSessionManager(sessionTimeout: 180) // 当前节点的identityId值 let identityId: UInt32 @@ -26,40 +26,21 @@ actor PolicyService { self.snapshotPublisher = snapshotPublisher } - func checkPolicy(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool { - // 进来的数据反转一下，然后再处理 - if let reverseFlowSession = ipPacket.flowSession()?.reverse(), - self.flowSessionManager.hasSession(reverseFlowSession) { - self.flowSessionManager.updateSession(reverseFlowSession) - return true - } - - // 检查权限逻辑 - let identitySnapshot = self.snapshotPublisher.current() - let ruleMap = identitySnapshot.lookup(srcIdentityID) - // 检查权限逻辑 - let proto = ipPacket.header.proto - // 优先判断访问规则 - switch ipPacket.transportPacket { - case .tcp(let tcpPacket): - if let ruleMap, ruleMap.isAllow(proto: proto, port: tcpPacket.header.dstPort) { - return true - } - case .udp(let udpPacket): - if let ruleMap, ruleMap.isAllow(proto: proto, port: udpPacket.dstPort) { - return true - } - case .icmp(_): - return true - default: - return false - } - - return false + nonisolated func policyRuntime() -> PolicyRuntime { + let policySnapshot = PolicySnapshot(identitySnapshot: self.snapshotPublisher.current()) + return PolicyRuntime(policySnapshot: policySnapshot, flowSessionManager: self.flowSessionManager) } - nonisolated func policySnapshot() -> PolicySnapshot { - return PolicySnapshot(identitySnapshot: self.snapshotPublisher.current()) + nonisolated func recordOutboundFlow(ipPacket: IPPacket) { + guard let flowSession = ipPacket.flowSession() else { + return + } + + self.flowSessionManager.updateSession(flowSession) + } + + func makePolicyRequest(srcIdentityID: UInt32) async -> Data? { + return await self.identifyStore.makePolicyRequest(srcIdentityId: srcIdentityID, dstIdentityId: self.identityId) } func updatePolicy(superServiceProxy: SDLSuperServiceProxy) async {