fix Policy Runtime

Tun/Punchnet/Inbound/PacketInboundActor.swift

@@ -49,8 +49,7 @@ actor PacketInboundActor {
         let processor = PacketInboundProcessor(
             networkAddress: self.networkAddress,
             dataCipher: self.dataCipher,
-            policySnapshot: self.policyService.policySnapshot(),
-            flowSessionManager: self.policyService.flowSessionManager
+            policyRuntime: self.policyService.policyRuntime()
         )
 
         guard let plan = try? processor.makeProcessingPlan(data: data) else {
@@ -72,7 +71,7 @@ actor PacketInboundActor {
             SDLLogger.log("[PacketInboundActor] hole identity: \(identityID), allow, data count: \(packetData.count)", for: .trace)
         case .requestPolicy(let srcIdentityID):
             SDLLogger.log("[PacketInboundActor] not found identity: \(srcIdentityID) ruleMap", for: .debug)
-            if let queryData = await self.policyService.identifyStore.makePolicyRequest(srcIdentityId: srcIdentityID, dstIdentityId: self.identityId) {
+            if let queryData = await self.policyService.makePolicyRequest(srcIdentityID: srcIdentityID) {
                 await self.superServiceProxy.send(type: .policyRequest, data: queryData)
             }
         case .none:

Tun/Punchnet/Inbound/PacketInboundProcessor.swift

@@ -24,17 +24,14 @@ final class PacketInboundProcessor {
     
     private let networkAddress: SDLConfiguration.NetworkAddress
     private let dataCipher: CCDataCipher?
-    private let policySnapshot: PolicySnapshot
-    private let flowSessionManager: SDLFlowSessionManager
+    private let policyRuntime: PolicyRuntime
     
     init(networkAddress: SDLConfiguration.NetworkAddress,
          dataCipher: CCDataCipher?,
-         policySnapshot: PolicySnapshot,
-         flowSessionManager: SDLFlowSessionManager) {
+         policyRuntime: PolicyRuntime) {
         self.networkAddress = networkAddress
         self.dataCipher = dataCipher
-        self.policySnapshot = policySnapshot
-        self.flowSessionManager = flowSessionManager
+        self.policyRuntime = policyRuntime
     }
     
     func makeProcessingPlan(data: SDLData) throws -> ProcessingPlan? {
@@ -96,17 +93,7 @@ final class PacketInboundProcessor {
             return .init(inboundBytes: inboundBytes, action: .none)
         }
         
-        if let reverseFlowSession = ipPacket.flowSession()?.reverse(),
-           self.flowSessionManager.hasSession(reverseFlowSession) {
-            self.flowSessionManager.updateSession(reverseFlowSession)
-            return .init(
-                inboundBytes: inboundBytes,
-                action: .writeToTun(packetData: ipPacket.data, identityID: identityID)
-            )
-        }
-
-        // 检查权限逻辑
-        if self.policySnapshot.allows(srcIdentityID: identityID, ipPacket: ipPacket) {
+        if self.policyRuntime.allowsInbound(srcIdentityID: identityID, ipPacket: ipPacket) {
             return .init(
                 inboundBytes: inboundBytes,
                 action: .writeToTun(packetData: ipPacket.data, identityID: identityID)

Tun/Punchnet/Outbound/PacketOutboundActor.swift

@@ -121,8 +121,8 @@ actor PacketOutboundActor {
         let router = PacketOutboundRouter(networkAddress: self.networkAddress, exitNode: self.exitNode)
         let decision = router.route(packet: packet)
 
-        if decision.shouldTrackFlow, let flowSession = packet.flowSession() {
-            self.policyService.flowSessionManager.updateSession(flowSession)
+        if decision.shouldTrackFlow {
+            self.policyService.recordOutboundFlow(ipPacket: packet)
         }
 
         await self.handleTunRouteDecision(decision)

Tun/Punchnet/Policy/PolicyRuntime.swift

@@ -0,0 +1,28 @@
+//
+//  PolicyRuntime.swift
+//  Tun
+//
+//  Created by Codex on 2026/5/21.
+//
+
+import Foundation
+
+struct PolicyRuntime: @unchecked Sendable {
+    private let policySnapshot: PolicySnapshot
+    private let flowSessionManager: SDLFlowSessionManager
+
+    init(policySnapshot: PolicySnapshot, flowSessionManager: SDLFlowSessionManager) {
+        self.policySnapshot = policySnapshot
+        self.flowSessionManager = flowSessionManager
+    }
+
+    func allowsInbound(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
+        if let reverseFlowSession = ipPacket.flowSession()?.reverse(),
+           self.flowSessionManager.hasSession(reverseFlowSession) {
+            self.flowSessionManager.updateSession(reverseFlowSession)
+            return true
+        }
+
+        return self.policySnapshot.allows(srcIdentityID: srcIdentityID, ipPacket: ipPacket)
+    }
+}

Tun/Punchnet/Policy/PolicyService.swift

@@ -9,11 +9,11 @@ import Foundation
 
 actor PolicyService {
     // 处理权限控制
-    let identifyStore: IdentityStore
+    private let identifyStore: IdentityStore
     nonisolated private let snapshotPublisher: SnapshotPublisher<IdentitySnapshot>
     
     // Flow流会话管理， 过期时间为: 180秒
-    nonisolated let flowSessionManager = SDLFlowSessionManager(sessionTimeout: 180)
+    nonisolated private let flowSessionManager = SDLFlowSessionManager(sessionTimeout: 180)
     
     // 当前节点的identityId值
     let identityId: UInt32
@@ -26,40 +26,21 @@ actor PolicyService {
         self.snapshotPublisher = snapshotPublisher
     }
     
-    func checkPolicy(srcIdentityID: UInt32, ipPacket: IPPacket) -> Bool {
-        // 进来的数据反转一下，然后再处理
-        if let reverseFlowSession = ipPacket.flowSession()?.reverse(),
-           self.flowSessionManager.hasSession(reverseFlowSession) {
-            self.flowSessionManager.updateSession(reverseFlowSession)
-            return true
+    nonisolated func policyRuntime() -> PolicyRuntime {
+        let policySnapshot = PolicySnapshot(identitySnapshot: self.snapshotPublisher.current())
+        return PolicyRuntime(policySnapshot: policySnapshot, flowSessionManager: self.flowSessionManager)
     }
 
-        // 检查权限逻辑
-        let identitySnapshot = self.snapshotPublisher.current()
-        let ruleMap = identitySnapshot.lookup(srcIdentityID)
-        // 检查权限逻辑
-        let proto = ipPacket.header.proto
-        // 优先判断访问规则
-        switch ipPacket.transportPacket {
-        case .tcp(let tcpPacket):
-            if let ruleMap, ruleMap.isAllow(proto: proto, port: tcpPacket.header.dstPort) {
-                return true
-            }
-        case .udp(let udpPacket):
-            if let ruleMap, ruleMap.isAllow(proto: proto, port: udpPacket.dstPort) {
-                return true
-            }
-        case .icmp(_):
-            return true
-        default:
-            return false
+    nonisolated func recordOutboundFlow(ipPacket: IPPacket) {
+        guard let flowSession = ipPacket.flowSession() else {
+            return
         }
 
-        return false
+        self.flowSessionManager.updateSession(flowSession)
     }
 
-    nonisolated func policySnapshot() -> PolicySnapshot {
-        return PolicySnapshot(identitySnapshot: self.snapshotPublisher.current())
+    func makePolicyRequest(srcIdentityID: UInt32) async -> Data? {
+        return await self.identifyStore.makePolicyRequest(srcIdentityId: srcIdentityID, dstIdentityId: self.identityId)
     }
     
     func updatePolicy(superServiceProxy: SDLSuperServiceProxy) async {