Tun

Tun/ARPPacket.swift

@@ -0,0 +1,113 @@
+//
+//  ARPPacket.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/8/25.
+//
+import Foundation
+
+struct ARPPacket {
+    // ARP操作码
+    enum Opcode: UInt16 {
+        case request = 0x01
+        case response = 0x02
+        
+        func isRequest() -> Bool {
+            return self == .request
+        }
+        
+        func isResponse() -> Bool {
+            return self == .response
+        }
+    }
+     
+    var hardwareType: UInt16
+    var protocolType: UInt16
+    var hardwareSize: UInt8
+    var protocolSize: UInt8
+    var opcode: Opcode
+    var senderMAC: Data
+    var senderIP: UInt32
+    var targetMAC: Data
+    var targetIP: UInt32
+    
+    init(hardwareType: UInt16, protocolType: UInt16, hardwareSize: UInt8, protocolSize: UInt8, opcode: Opcode, 
+         senderMAC: Data, senderIP: UInt32, targetMAC: Data, targetIP: UInt32) {
+        
+        self.hardwareType = hardwareType
+        self.protocolType = protocolType
+        self.hardwareSize = hardwareSize
+        self.protocolSize = protocolSize
+        self.opcode = opcode
+        self.senderMAC = senderMAC
+        self.senderIP = senderIP
+        self.targetMAC = targetMAC
+        self.targetIP = targetIP
+    }
+
+    init?(data: Data) {
+        guard data.count >= 28 else {
+            NSLog("length < 28: len: \(data.count)")
+            return nil
+        }
+        
+        self.hardwareType = UInt16(data[0]) << 8 | UInt16(data[1])
+        self.protocolType = UInt16(data[2]) << 8 | UInt16(data[3])
+        self.hardwareSize = data[4]
+        self.protocolSize = data[5]
+        guard let opcode = Opcode(rawValue: UInt16(data[6]) << 8 | UInt16(data[7])) else {
+            NSLog("opcode error")
+            return nil
+        }
+        
+        self.opcode = opcode
+        self.senderMAC = Data(data[8..<14])
+        self.senderIP = UInt32(data: Data(data[14..<18]))
+        self.targetMAC = Data(data[18..<24])
+        self.targetIP = UInt32(data: Data(data[24..<28]))
+    }
+    
+    func marshal() -> Data {
+        var data = Data()
+        data.append(self.hardwareType.data())
+        data.append(self.protocolType.data())
+        data.append(self.hardwareSize)
+        data.append(self.protocolSize)
+        data.append(self.opcode.rawValue.data())
+        data.append(self.senderMAC)
+        data.append(Data(uint32: self.senderIP))
+        data.append(self.targetMAC)
+        data.append(Data(uint32: self.targetIP))
+        
+        return data
+    }
+    
+}
+
+extension ARPPacket {
+    
+    static func arpRequest(senderIP: UInt32, senderMAC: Data, targetIP: UInt32) -> ARPPacket {
+        return ARPPacket(hardwareType: 0x01,
+                         protocolType: 0x0800,
+                         hardwareSize: 0x06,
+                         protocolSize: 0x04,
+                         opcode: .request,
+                         senderMAC: senderMAC,
+                         senderIP: senderIP,
+                         targetMAC: Data([0x00, 0x00, 0x00, 0x00, 0x00, 0x00]),
+                         targetIP: targetIP)
+    }
+    
+    static func arpResponse(for arp: ARPPacket, mac: Data, ip: UInt32) -> ARPPacket {
+        return ARPPacket(hardwareType: arp.hardwareType,
+                         protocolType: arp.protocolType,
+                         hardwareSize: arp.hardwareSize,
+                         protocolSize: arp.protocolSize,
+                         opcode: .response,
+                         senderMAC: mac,
+                         senderIP: ip,
+                         targetMAC: arp.senderMAC,
+                         targetIP: arp.senderIP)
+    }
+        
+}

Tun/DataExtension.swift

@@ -0,0 +1,39 @@
+//
+//  DataExtension.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/2/29.
+//
+
+import Foundation
+
+extension Data {
+    
+    init(uint32: UInt32) {
+        var bytes: [UInt8] = [UInt8](repeating: 0, count: 4)
+        bytes[0] = (UInt8)(uint32 >> 24 & 0xFF)
+        bytes[1] = (UInt8)(uint32 >> 16 & 0xFF)
+        bytes[2] = (UInt8)(uint32 >> 8 & 0xFF)
+        bytes[3] = (UInt8)(uint32 & 0xFF)
+        
+        self.init(bytes)
+    }
+    
+    init(uint16: UInt16) {
+        var bytes: [UInt8] = [UInt8](repeating: 0, count: 2)
+        bytes[0] = (UInt8)(uint16 >> 8 & 0xFF)
+        bytes[1] = (UInt8)(uint16 & 0xFF)
+        
+        self.init(bytes)
+    }
+    
+    init(components: Data...) {
+        var data = Data()
+        for component in components {
+            data.append(component)
+        }
+        self = data
+    }
+    
+}
+

Tun/IPPacket.swift

@@ -0,0 +1,83 @@
+//
+//  IPPacket.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/18.
+//
+
+import Foundation
+
+struct IPHeader {
+    let version: UInt8
+    let headerLength: UInt8
+    let typeOfService: UInt8
+    let totalLength: UInt16
+    let id: UInt16
+    let offset: UInt16
+    let timeToLive: UInt8
+    let proto:UInt8
+    let checksum: UInt16
+    let source: UInt32
+    let destination: UInt32
+    
+    var source_ip: String {
+        return intToIp(source)
+    }
+    
+    var destination_ip: String {
+        return intToIp(destination)
+    }
+    
+    private func intToIp(_ num: UInt32) -> String {
+        let ip0 = (UInt8) (num >> 24 & 0xFF)
+        let ip1 = (UInt8) (num >> 16 & 0xFF)
+        let ip2 = (UInt8) (num >> 8 & 0xFF)
+        let ip3 = (UInt8) (num & 0xFF)
+        
+        return "\(ip0).\(ip1).\(ip2).\(ip3)"
+    }
+    
+    public var description: String {
+        """
+        IPHeader version: \(version), header length: \(headerLength), type of service: \(typeOfService), total length: \(totalLength),
+        id: \(id), offset: \(offset), time ot live: \(timeToLive), proto: \(proto), checksum: \(checksum), source ip: \(source_ip), destination ip:\(destination_ip)
+        """
+    }
+}
+
+enum IPVersion: UInt8 {
+    case ipv4 = 4
+    case ipv6 = 6
+}
+
+enum TransportProtocol: UInt8 {
+    case icmp = 1
+    case tcp = 6
+    case udp = 17
+    
+}
+
+struct IPPacket {
+    let header: IPHeader
+    let data: Data
+    
+    init?(_ data: Data) {
+        guard data.count >= 20 else {
+            return nil
+        }
+        
+        self.header = IPHeader(version: data[0] >> 4,
+                               headerLength: (data[0] & 0b1111) * 4,
+                               typeOfService: data[1],
+                               totalLength: UInt16(bytes: (data[2], data[3])),
+                               id: UInt16(bytes: (data[4], data[5])),
+                               offset: 1,
+                               timeToLive: data[8],
+                               proto: data[9],
+                               checksum: UInt16(bytes: (data[10], data[11])),
+                               source: UInt32(bytes: (data[12], data[13], data[14], data[15])),
+                               destination: UInt32(bytes: (data[16], data[17], data[18], data[19])))
+        self.data = data
+    }
+    
+}

Tun/LayerPacket.swift

@@ -0,0 +1,117 @@
+//
+//  LayerPacket.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/8/21.
+//
+
+import Foundation
+import zlib
+
+struct LayerPacket {
+    // 数据包类型
+    enum PacketType: UInt16 {
+        case arp = 0x0806
+        case ipv4 = 0x0800
+        case ipv6 = 0x86DD
+        case taggedFrame = 0x8100
+    }
+    
+    enum LayerPacketError: Error {
+        case invalidLength
+        case crcError
+        case invaldPacketType
+    }
+    
+    struct MacAddress {
+        let data: Data
+        
+        init(data: Data) {
+            self.data = data
+        }
+        
+        func isBroadcast() -> Bool {
+            return data.count == 6 && self.data.allSatisfy { $0 == 0xFF}
+        }
+        
+        func isMulticast() -> Bool {
+            return data.count == 6 && (data[0] == 0x01 && data[1] == 0x00 && data[2] == 0x5E)
+        }
+        
+        func format() -> String {
+            // 将mac地址转换成字符串
+            let bytes = [UInt8](data)
+            return bytes.map { String(format: "%02X", $0) }.joined(separator: ":").lowercased()
+        }
+        
+        static func description(data: Data) -> String {
+            // 将mac地址转换成字符串
+            let bytes = [UInt8](data)
+            return bytes.map { String(format: "%02X", $0) }.joined(separator: ":").lowercased()
+        }
+        
+    }
+    
+    let dstMac: Data
+    let srcMac: Data
+    let type: PacketType
+    let data: Data
+    
+    init(dstMac: Data, srcMac: Data, type: PacketType, data: Data) {
+        self.dstMac = dstMac
+        self.srcMac = srcMac
+        self.type = type
+        self.data = data
+    }
+    
+    init(layerData playload: Data) throws {
+        guard playload.count >= 14 else {
+            throw LayerPacketError.invalidLength
+        }
+        
+        /*
+        let idx = layerData.count - 4
+        let playload = layerData.subdata(in: 0..<idx)
+        let crc = layerData.subdata(in: idx..<layerData.count)
+        
+        guard Self.crc32(data: playload) == UInt32(data: crc) else {
+            
+            NSLog("play crc32: \(Self.crc32(data: playload)), get: \(UInt32(data: crc))")
+            
+            throw LayerPacketError.crcError
+        }
+         */
+        
+        self.dstMac = Data(playload[0..<6])
+        self.srcMac = Data(playload[6..<12])
+        guard let type = PacketType(rawValue: UInt16(bytes: (playload[12], playload[13]))) else {
+            throw LayerPacketError.invaldPacketType
+        }
+        
+        self.type = type
+        self.data = Data(playload[14...])
+    }
+    
+    func marshal() -> Data {
+        var packet = Data()
+        packet.append(dstMac)
+        packet.append(srcMac)
+        packet.append(self.type.rawValue.data())
+        packet.append(self.data)
+        
+        // 计算crc32的值
+        //let crc32 = data.crc32()
+        //packet.append(Data(uint32: Self.crc32(data: packet)))
+        
+        return packet
+    }
+    
+    private static func crc32(data: Data) -> UInt32 {
+        let crc = data.withUnsafeBytes { buffer in
+            return zlib.crc32(0, buffer.bindMemory(to: UInt8.self).baseAddress, uInt(buffer.count))
+        }
+        
+        return UInt32(crc)
+    }
+    
+}

Tun/NetworkInterface.swift

@@ -0,0 +1,66 @@
+//
+//  NetworkInterface.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/19.
+//
+
+import Foundation
+
+struct NetworkInterface {
+    let name: String
+    let ip: String
+    let netmask: String
+}
+
+struct NetworkInterfaceManager {
+    /**
+    获取网卡信息, (let name: String let ip: String let netmask: String)
+     */
+    public static func getInterfaces() -> [NetworkInterface] {
+        var interfaces: [NetworkInterface] = []
+        
+        // Get list of all interfaces on the local machine:
+        var ifaddr : UnsafeMutablePointer<ifaddrs>? = nil
+        if getifaddrs(&ifaddr) == 0 {
+            
+            // For each interface ...
+            var ptr = ifaddr
+            while( ptr != nil) {
+                
+                let flags = Int32(ptr!.pointee.ifa_flags)
+                var addr = ptr!.pointee.ifa_addr.pointee
+                
+                // Check for running IPv4, IPv6 interfaces. Skip the loopback interface.
+                if (flags & (IFF_UP|IFF_RUNNING|IFF_LOOPBACK)) == (IFF_UP|IFF_RUNNING) {
+                    if addr.sa_family == UInt8(AF_INET) || addr.sa_family == UInt8(AF_INET6) {
+                        
+                        var mask = ptr!.pointee.ifa_netmask.pointee
+                        
+                        // Convert interface address to a human readable string:
+                        let zero  = CChar(0)
+                        var hostname = [CChar](repeating: zero, count: Int(NI_MAXHOST))
+                        var netmask =  [CChar](repeating: zero, count: Int(NI_MAXHOST))
+                        if (getnameinfo(&addr, socklen_t(addr.sa_len), &hostname, socklen_t(hostname.count),
+                                        nil, socklen_t(0), NI_NUMERICHOST) == 0) {
+                            let address = String(cString: hostname)
+                            let name = ptr!.pointee.ifa_name!
+                            let ifname = String(cString: name)
+                            
+                            if (getnameinfo(&mask, socklen_t(mask.sa_len), &netmask, socklen_t(netmask.count), nil, socklen_t(0), NI_NUMERICHOST) == 0) {
+                                let netmaskIP = String(cString: netmask)
+                                
+                                interfaces.append(NetworkInterface(name: ifname, ip: address, netmask: netmaskIP))
+                            }
+                        }
+                    }
+                }
+                ptr = ptr!.pointee.ifa_next
+            }
+            freeifaddrs(ifaddr)
+        }
+        
+        return interfaces
+    }
+    
+}

Tun/PacketTunnelProvider.swift

@@ -2,15 +2,49 @@
 //  PacketTunnelProvider.swift
 //  Tun
 //
-//  Created by 安礼成 on 2025/5/12.
+//  Created by 安礼成 on 2024/1/17.
 //
 
 import NetworkExtension
 
 class PacketTunnelProvider: NEPacketTunnelProvider {
-
+    var context: SDLContext?
+    
     override func startTunnel(options: [String : NSObject]?, completionHandler: @escaping (Error?) -> Void) {
-        // Add code here to start the process of connecting the tunnel.
+        // host: "192.168.0.101", port: 1265
+        guard let options else {
+            return
+        }
+        
+        let token = options["token"] as! String
+        //let version = options["version"] as! Int
+        let installed_channel = options["installed_channel"] as! String
+        Task {
+            SDLLogger.logLevel = .debug
+            do {
+                self.context = try SDLContext(provider: self, config: .init(
+                    version: 1,
+                    installedChannel: installed_channel,
+                    superHost: "39.98.184.67",
+                    //superHost: "127.0.0.1",
+                    superPort: 18083,
+                    
+                    stunServers: [.init(host: "39.98.184.67", ports: [1265, 1266]), .init(host: "39.98.184.67", ports: [1265, 1266])],
+                    //stunServers: [.init(host: "127.0.0.1", ports: [1265, 1266]), .init(host: "127.0.0.1", ports: [1265, 1266])],
+                    
+                    clientId: SDLContext.getUUID(),
+                    token: ""
+                    //token: token
+                ))
+                
+                try await self.context?.start()
+                completionHandler(nil)
+            } catch let err {
+                NSLog("SDLContext start get error: \(err)")
+                
+                completionHandler(err)
+            }
+        }
     }
     
     override func stopTunnel(with reason: NEProviderStopReason, completionHandler: @escaping () -> Void) {
@@ -33,4 +67,16 @@ class PacketTunnelProvider: NEPacketTunnelProvider {
     override func wake() {
         // Add code here to wake up.
     }
+    
+}
+
+// 获取物理网卡ip地址
+extension PacketTunnelProvider {
+    
+    public static var viaInterface: NetworkInterface? = {
+        let interfaces = NetworkInterfaceManager.getInterfaces()
+        
+        return interfaces.first {$0.name == "en0"}
+    }()
+    
 }

Tun/SDLContext.swift

@@ -0,0 +1,833 @@
+//
+//  SDLContext.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/2/29.
+//
+
+import Foundation
+import NetworkExtension
+import NIOCore
+import Combine
+
+// 上下文环境变量，全局共享
+/*
+1. 处理rsa的加解密逻辑
+ */
+
+class SDLContext {
+    
+    // 路由信息
+    struct Route {
+        let dstAddress: String
+        let subnetMask: String
+        
+        var debugInfo: String {
+            return "\(dstAddress):\(subnetMask)"
+        }
+    }
+    
+    // 配置项目
+    final class Configuration {
+        
+        struct StunServer {
+            let host: String
+            let ports: [Int]
+        }
+        
+        // 当前的客户端版本
+        let version: UInt8
+        
+        // 安装渠道
+        let installedChannel: String
+        
+        let superHost: String
+        let superPort: Int
+        
+        let stunServers: [StunServer]
+        
+        lazy var stunSocketAddress: SocketAddress = {
+            let stunServer = stunServers[0]
+            return try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[0])
+        }()
+        
+        // 网络探测地址信息
+        lazy var stunProbeSocketAddressArray: [[SocketAddress]] = {
+            return stunServers.map { stunServer in
+                [
+                    try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[0]),
+                    try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[1])
+                ]
+            }
+        }()
+        
+        let clientId: String
+        let token: String
+        
+        init(version: UInt8, installedChannel: String, superHost: String, superPort: Int, stunServers: [StunServer], clientId: String, token: String) {
+            self.version = version
+            self.installedChannel = installedChannel
+            self.superHost = superHost
+            self.superPort = superPort
+            self.stunServers = stunServers
+            self.clientId = clientId
+            self.token = token
+        }
+       
+    }
+    
+    let config: Configuration
+
+    // tun网络地址信息
+    var devAddr: SDLDevAddr
+    
+    // nat映射的相关信息, 暂时没有用处
+    //var natAddress: SDLNatAddress?
+    // nat的网络类型
+    var natType: NatType = .blocked
+    
+    // AES加密，授权通过后，对象才会被创建
+    var aesCipher: AESCipher?
+    // rsa的相关配置, public_key是本地生成的
+    let rsaCipher: RSACipher
+    
+    // 依赖的变量
+    var udpHole: SDLUDPHole?
+    private var udpCancel: AnyCancellable?
+    
+    var superClient: SDLSuperClient?
+    private var superCancel: AnyCancellable?
+
+    // 数据包读取任务
+    private var readTask: Task<(), Never>?
+    
+    let provider: PacketTunnelProvider
+    
+    private var sessionManager: SessionManager
+    private var holerManager: HolerManager
+    private var arpServer: ArpServer
+    
+    // 记录最后发送的stunRequest的cookie
+    private var lastCookie: UInt32? = 0
+    
+    // 定时器
+    private var stunCancel: AnyCancellable?
+    
+    // 网络状态变化的健康
+    private var monitor = SDLNetworkMonitor()
+    private var monitorCancel: AnyCancellable?
+    
+    // 内部socket通讯
+    private var noticeClient: SDLNoticeClient
+    
+    // 流量统计
+    private var flowTracer = SDLFlowTracerActor()
+    private var flowTracerCancel: AnyCancellable?
+    
+    init(provider: PacketTunnelProvider, config: Configuration) throws {
+        self.config = config
+        self.rsaCipher = try RSACipher(keySize: 1024)
+        
+        // 生成mac地址
+        var devAddr = SDLDevAddr()
+        devAddr.mac = Self.getMacAddress()
+        self.devAddr = devAddr
+        
+        self.provider = provider
+        self.sessionManager = SessionManager()
+        self.holerManager = HolerManager()
+        self.arpServer = ArpServer(known_macs: [:])
+        self.noticeClient = SDLNoticeClient()
+    }
+    
+    func start() async throws {
+        try await self.startSuperClient()
+        try await self.startUDPHole()
+        self.noticeClient.start()
+        
+        // 启动网络监控
+        self.monitorCancel = self.monitor.eventFlow.sink { event in
+            switch event {
+            case .changed:
+                // 需要重新探测网络的nat类型
+                Task {
+                    self.natType = await self.getNatType()
+                    NSLog("didNetworkPathChanged, nat type is: \(self.natType)")
+                }
+            case .unreachable:
+                NSLog("didNetworkPathUnreachable")
+            }
+        }
+        self.monitor.start()
+    }
+    
+    private func startSuperClient() async throws {
+        self.superClient = SDLSuperClient(host: config.superHost, port: config.superPort)
+        // 建立super的绑定关系
+        self.superCancel?.cancel()
+        self.superCancel = self.superClient?.eventFlow.sink { event in
+            Task.detached {
+                await self.handleSuperEvent(event: event)
+            }
+        }
+        try await self.superClient?.start()
+    }
+    
+    private func handleSuperEvent(event: SDLSuperClient.SuperEvent) async {
+        switch event {
+        case .ready:
+            NSLog("[SDLContext] get registerSuper, mac address: \(Self.formatMacAddress(mac: self.devAddr.mac))")
+            guard let message = await self.superClient?.registerSuper(context: self) else {
+                return
+            }
+            
+            switch message.packet {
+            case .registerSuperAck(let registerSuperAck):
+                // 需要对数据通过rsa的私钥解码
+                let aesKey = try! self.rsaCipher.decode(data: Data(registerSuperAck.aesKey))
+                let upgradeType = SDLUpgradeType(rawValue: registerSuperAck.upgradeType)
+                
+                NSLog("[SDLContext] get registerSuperAck, aes_key len: \(aesKey.count)")
+                self.devAddr = registerSuperAck.devAddr
+                
+                if upgradeType == .force {
+                    let forceUpgrade = NoticeMessage.UpgradeMessage(prompt: registerSuperAck.upgradePrompt, address: registerSuperAck.upgradeAddress)
+                    self.noticeClient.send(data: forceUpgrade.binaryData)
+                    
+                    exit(-1)
+                }
+                
+                // 服务器分配的tun网卡信息
+                await self.didNetworkConfigChanged(devAddr: self.devAddr)
+                self.aesCipher = AESCipher(aesKey: aesKey)
+                if upgradeType == .normal {
+                    let normalUpgrade = NoticeMessage.UpgradeMessage(prompt: registerSuperAck.upgradePrompt, address: registerSuperAck.upgradeAddress)
+                    self.noticeClient.send(data: normalUpgrade.binaryData)
+                }
+                
+            case .registerSuperNak(let nakPacket):
+                let errorMessage = nakPacket.errorMessage
+                guard let errorCode = SDLNAKErrorCode(rawValue: UInt8(nakPacket.errorCode)) else {
+                    return
+                }
+                
+                switch errorCode {
+                case .invalidToken, .nodeDisabled:
+                    let alertNotice = NoticeMessage.AlertMessage(alert: errorMessage)
+                    self.noticeClient.send(data: alertNotice.binaryData)
+                    exit(-1)
+                case .noIpAddress, .networkFault, .internalFault:
+                    let alertNotice = NoticeMessage.AlertMessage(alert: errorMessage)
+                    self.noticeClient.send(data: alertNotice.binaryData)
+                }
+                SDLLogger.log("Get a SuperNak message exit", level: .error)
+            default:
+                ()
+            }
+            
+        case .closed:
+            SDLLogger.log("[SDLContext] super client closed", level: .debug)
+            await self.arpServer.clear()
+            DispatchQueue.global().asyncAfter(deadline: .now() + 5) {
+                Task {
+                    try await self.startSuperClient()
+                }
+            }
+        case .event(let evt):
+            switch evt {
+            case .natChanged(let natChangedEvent):
+                let dstMac = natChangedEvent.mac
+                NSLog("natChangedEvent, dstMac: \(dstMac)")
+                await sessionManager.removeSession(dstMac: dstMac)
+            case .sendRegister(let sendRegisterEvent):
+                NSLog("sendRegisterEvent, ip: \(sendRegisterEvent)")
+                let address = SDLUtil.int32ToIp(sendRegisterEvent.natIp)
+                if let remoteAddress = try? SocketAddress.makeAddressResolvingHost(address, port: Int(sendRegisterEvent.natPort)) {
+                    // 发送register包
+                    self.udpHole?.sendRegister(context: self, remoteAddress: remoteAddress, dst_mac: sendRegisterEvent.dstMac)
+                }
+                
+            case .networkShutdown(let shutdownEvent):
+                let alertNotice = NoticeMessage.AlertMessage(alert: shutdownEvent.message)
+                self.noticeClient.send(data: alertNotice.binaryData)
+                exit(-1)
+            }
+        case .command(let packetId, let command):
+            switch command {
+            case .changeNetwork(let changeNetworkCommand):
+                // 需要对数据通过rsa的私钥解码
+                let aesKey = try! self.rsaCipher.decode(data: Data(changeNetworkCommand.aesKey))
+                NSLog("[SDLContext] change network command get aes_key len: \(aesKey.count)")
+                self.devAddr = changeNetworkCommand.devAddr
+                
+                // 服务器分配的tun网卡信息
+                await self.didNetworkConfigChanged(devAddr: self.devAddr)
+                self.aesCipher = AESCipher(aesKey: aesKey)
+                
+                var commandAck = SDLCommandAck()
+                commandAck.status = true
+                
+                self.superClient?.commandAck(packetId: packetId, ack: commandAck)
+            }
+        }
+        
+    }
+
+    private func startUDPHole() async throws {
+        self.udpHole = SDLUDPHole()
+        
+        self.udpCancel?.cancel()
+        self.udpCancel = self.udpHole?.eventFlow.sink { event in
+            Task.detached {
+                await self.handleUDPEvent(event: event)
+            }
+        }
+        
+        try await self.udpHole?.start()
+    }
+    
+    private func handleUDPEvent(event: SDLUDPHole.UDPEvent) async {
+        switch event {
+        case .ready:
+            // 获取当前网络的类型
+            self.natType = await self.getNatType()
+            SDLLogger.log("[SDLContext] nat type is: \(self.natType)", level: .debug)
+            
+            let timer = Timer.publish(every: 5.0, on: .main, in: .common).autoconnect()
+            self.stunCancel = Just(Date()).merge(with: timer).sink { _ in
+                self.lastCookie = self.udpHole?.stunRequest(context: self)
+            }
+            
+        case .closed:
+            DispatchQueue.global().asyncAfter(deadline: .now() + 5) {
+                Task {
+                    try await self.startUDPHole()
+                }
+            }
+            
+        case .message(let remoteAddress, let message):
+            switch message {
+            case .register(let register):
+                NSLog("register packet: \(register), dev_addr: \(self.devAddr)")
+                // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
+                if register.dstMac == self.devAddr.mac && register.networkID == self.devAddr.networkID {
+                    // 回复ack包
+                    self.udpHole?.sendRegisterAck(context: self, remoteAddress: remoteAddress, dst_mac: register.srcMac)
+                    // 这里需要建立到来源的会话, 在复杂网络下，通过super-node查询到的nat地址不一定靠谱，需要通过udp包的来源地址作为nat地址
+                    let session = Session(dstMac: register.srcMac, natAddress: remoteAddress)
+                    await self.sessionManager.addSession(session: session)
+                } else {
+                    SDLLogger.log("SDLContext didReadRegister get a invalid packet, because dst_ip not matched: \(register.dstMac)", level: .warning)
+                }
+            case .registerAck(let registerAck):
+                // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
+                if registerAck.dstMac == self.devAddr.mac && registerAck.networkID == self.devAddr.networkID {
+                    let session = Session(dstMac: registerAck.srcMac, natAddress: remoteAddress)
+                    await self.sessionManager.addSession(session: session)
+                } else {
+                    SDLLogger.log("SDLContext didReadRegisterAck get a invalid packet, because dst_mac not matched: \(registerAck.dstMac)", level: .warning)
+                }
+            case .stunReply(let stunReply):
+                let cookie = stunReply.cookie
+                if cookie == self.lastCookie {
+                    // 记录下当前在nat上的映射信息，暂时没有用；后续会用来判断网络类型
+                    //self.natAddress = stunReply.natAddress
+                    SDLLogger.log("[SDLContext] get a stunReply: \(try! stunReply.jsonString())")
+                }
+            default:
+                ()
+            }
+            
+        case .data(let data):
+            let mac = LayerPacket.MacAddress(data: data.dstMac)
+            guard (data.dstMac == self.devAddr.mac || mac.isBroadcast() || mac.isMulticast()) else {
+                NSLog("[SDLContext] didReadData 1")
+                return
+            }
+            
+            guard let decyptedData = try? self.aesCipher?.decypt(data: Data(data.data)) else {
+                NSLog("[SDLContext] didReadData 2")
+                return
+            }
+            
+            do {
+                let layerPacket = try LayerPacket(layerData: decyptedData)
+                
+                await self.flowTracer.inc(num: decyptedData.count, type: .inbound)
+                // 处理arp请求
+                switch layerPacket.type {
+                case .arp:
+                    // 判断如果收到的是arp请求
+                    if let arpPacket = ARPPacket(data: layerPacket.data)  {
+                        if arpPacket.targetIP == self.devAddr.netAddr {
+                            switch arpPacket.opcode {
+                            case .request:
+                                NSLog("[SDLContext] get arp request packet")
+                                let response = ARPPacket.arpResponse(for: arpPacket, mac: self.devAddr.mac, ip: self.devAddr.netAddr)
+                                await self.routeLayerPacket(dstMac: arpPacket.senderMAC, type: .arp, data: response.marshal())
+                            case .response:
+                                NSLog("[SDLContext] get arp response packet")
+                                await self.arpServer.append(ip: arpPacket.senderIP, mac: arpPacket.senderMAC)
+                            }
+                        } else {
+                            NSLog("[SDLContext] get invalid arp packet, target_ip: \(arpPacket)")
+                        }
+                    } else {
+                        NSLog("[SDLContext] get invalid arp packet")
+                    }
+                case .ipv4:
+                    NSLog("[SDLContext] get ipv4 packet")
+                    guard let ipPacket = IPPacket(layerPacket.data), ipPacket.header.destination == self.devAddr.netAddr else {
+                        return
+                    }
+                    
+                    let packet = NEPacket(data: ipPacket.data, protocolFamily: 2)
+                    self.provider.packetFlow.writePacketObjects([packet])
+                default:
+                    NSLog("[SDLContext] get invalid packet")
+                }
+            } catch let err {
+                NSLog("[SDLContext] didReadData err: \(err)")
+            }
+        }
+        
+    }
+    
+    // 流量统计
+    func flowReportTask() {
+        Task {
+            // 每分钟汇报一次
+            self.flowTracerCancel = Timer.publish(every: 60.0, on: .main, in: .common).autoconnect()
+                .sink { _ in
+                    Task {
+                        let (forwardNum, p2pNum, inboundNum) = await self.flowTracer.reset()
+                        self.superClient?.flowReport(forwardNum: forwardNum, p2pNum: p2pNum, inboundNum: inboundNum)
+                    }
+                }
+        }
+    }
+    
+    // 网络改变时需要重新配置网络信息
+    private func didNetworkConfigChanged(devAddr: SDLDevAddr, dnsServers: [String]? = nil) async {
+        let netAddress = SDLNetAddress(ip: devAddr.netAddr, maskLen: UInt8(devAddr.netBitLen))
+        let routes = [Route(dstAddress: netAddress.networkAddress, subnetMask: netAddress.maskAddress)]
+        
+        // Add code here to start the process of connecting the tunnel.
+        let networkSettings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "8.8.8.8")
+        networkSettings.mtu = 1460
+        
+        // 设置网卡的DNS解析
+        if let dnsServers {
+            networkSettings.dnsSettings = NEDNSSettings(servers: dnsServers)
+        } else {
+            networkSettings.dnsSettings = NEDNSSettings(servers: ["8.8.8.8", "114.114.114.114"])
+        }
+        
+        let ipv4Settings = NEIPv4Settings(addresses: [netAddress.ipAddress], subnetMasks: [netAddress.maskAddress])
+        // 设置路由表
+        //NEIPv4Route.default()
+        ipv4Settings.includedRoutes = routes.map { route in
+            NEIPv4Route(destinationAddress: route.dstAddress, subnetMask: route.subnetMask)
+        }
+        networkSettings.ipv4Settings = ipv4Settings
+        // 网卡配置设置必须成功
+        do {
+            try await self.provider.setTunnelNetworkSettings(networkSettings)
+            
+            await self.holerManager.cleanup()
+            
+            self.startReader()
+        } catch let err {
+            SDLLogger.log("[SDLContext] setTunnelNetworkSettings get error: \(err)", level: .error)
+            exit(-1)
+        }
+    }
+    
+    // 开始读取数据, 用单独的线程处理packetFlow
+    private func startReader() {
+        //  停止之前的任务
+        self.readTask?.cancel()
+        
+        // 开启新的任务
+        self.readTask = Task(priority: .high) {
+            repeat {
+                if Task.isCancelled {
+                    break
+                }
+                
+                let (packets, numbers) = await self.provider.packetFlow.readPackets()
+                for (data, number) in zip(packets, numbers) where number == 2 {
+                    if let packet = IPPacket(data) {
+                        Task.detached {
+                            let dstIp = packet.header.destination
+                            // 本地通讯, 目标地址是本地服务器的ip地址
+                            if dstIp == self.devAddr.netAddr {
+                                let nePacket = NEPacket(data: packet.data, protocolFamily: 2)
+                                self.provider.packetFlow.writePacketObjects([nePacket])
+                                return
+                            }
+                            
+                            // 查找arp缓存中是否有目标mac地址
+                            if let dstMac = await self.arpServer.query(ip: dstIp) {
+                                await self.routeLayerPacket(dstMac: dstMac, type: .ipv4, data: packet.data)
+                            }
+                            else {
+                                // 构造arp请求
+                                let broadcastMac = Data([0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF])
+                                let arpReqeust: ARPPacket = ARPPacket.arpRequest(senderIP: self.devAddr.netAddr, senderMAC: self.devAddr.mac, targetIP: dstIp)
+                                await self.routeLayerPacket(dstMac: broadcastMac, type: .arp, data: arpReqeust.marshal())
+                                
+                                NSLog("[SDLContext] dstIp: \(dstIp) arp query not found")
+                            }
+                        }
+                    }
+                }
+                
+            } while true
+        }
+        
+    }
+    
+    private func routeLayerPacket(dstMac: Data, type: LayerPacket.PacketType, data: Data) async {
+        // 将数据封装层2层的数据包
+        let layerPacket = LayerPacket(dstMac: dstMac, srcMac: self.devAddr.mac, type: type, data: data)
+        guard let encodedPacket = try? self.aesCipher?.encrypt(data: layerPacket.marshal()) else {
+            return
+        }
+        
+        // 通过session发送到对端
+        if let session = await self.sessionManager.getSession(toAddress: dstMac) {
+            NSLog("[SDLContext] send packet by session: \(session)")
+            self.udpHole?.sendPacket(context: self, session: session, data: encodedPacket)
+            
+            await self.flowTracer.inc(num: data.count, type: .p2p)
+        } else {
+            // 通过super_node进行转发
+            self.udpHole?.forwardPacket(context: self, dst_mac: dstMac, data: encodedPacket)
+            // 流量统计
+            await self.flowTracer.inc(num: data.count, type: .forward)
+            
+            // 尝试打洞
+            await self.holerManager.addHoler(dstMac: dstMac) {
+                self.holerTask(dstMac: dstMac)
+            }
+        }
+    }
+    
+    deinit {
+        self.stunCancel?.cancel()
+        self.udpHole = nil
+        self.superClient = nil
+    }
+    
+}
+
+//--MARK: 处理RSA加密算法
+extension SDLContext {
+    
+    struct RSACipher {
+        let pubKey: String
+        let privateKeyDER: Data
+        
+        init(keySize: Int) throws {
+            let (privateKey, publicKey) = try Self.loadKeys(keySize: keySize)
+            let privKeyStr = SwKeyConvert.PrivateKey.derToPKCS1PEM(privateKey)
+            
+            self.pubKey = SwKeyConvert.PublicKey.derToPKCS8PEM(publicKey)
+            self.privateKeyDER = try SwKeyConvert.PrivateKey.pemToPKCS1DER(privKeyStr)
+        }
+        
+        public func decode(data: Data) throws -> Data {
+            let tag = Data()
+            let (decryptedData, _) = try CC.RSA.decrypt(data, derKey: self.privateKeyDER, tag: tag, padding: .pkcs1, digest: .none)
+            
+            return decryptedData
+        }
+        
+        private static func loadKeys(keySize: Int) throws -> (Data, Data) {
+            if let privateKey = UserDefaults.standard.data(forKey: "privateKey"),
+               let publicKey = UserDefaults.standard.data(forKey: "publicKey") {
+                
+                return (privateKey, publicKey)
+            } else {
+                let (privateKey, publicKey) = try CC.RSA.generateKeyPair(keySize)
+                UserDefaults.standard.setValue(privateKey, forKey: "privateKey")
+                UserDefaults.standard.setValue(publicKey, forKey: "publicKey")
+                
+                return (privateKey, publicKey)
+            }
+        }
+        
+    }
+}
+
+// --MARK: 处理AES加密, AES256
+extension SDLContext {
+    
+    struct AESCipher {
+        let aesKey: Data
+        let ivData: Data
+        
+        init(aesKey: Data) {
+            self.aesKey = aesKey
+            self.ivData = Data(aesKey.prefix(16))
+        }
+        
+        func decypt(data: Data) throws -> Data {
+            return try CC.crypt(.decrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: data, key: aesKey, iv: ivData)
+        }
+        
+        func encrypt(data: Data) throws -> Data {
+            return try CC.crypt(.encrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: data, key: aesKey, iv: ivData)
+        }
+    }
+    
+}
+
+// --MARK: session管理, session的有效时间为10s，没次使用后更新最后使用时间
+extension SDLContext {
+    
+    struct Session {
+        // 在内部的通讯的ip地址, 整数格式
+        let dstMac: Data
+        // 对端的主机在nat上映射的端口信息
+        let natAddress: SocketAddress
+        
+        // 最后使用时间
+        var lastTimestamp: Int32
+        
+        init(dstMac: Data, natAddress: SocketAddress) {
+            self.dstMac = dstMac
+            self.natAddress = natAddress
+            self.lastTimestamp = Int32(Date().timeIntervalSince1970)
+        }
+        
+        mutating func updateLastTimestamp(_ lastTimestamp: Int32) {
+            self.lastTimestamp = lastTimestamp
+        }
+    }
+    
+    actor SessionManager {
+        private var sessions: [Data:Session] = [:]
+        
+        // session的有效时间
+        private let ttl: Int32 = 10
+        
+        func getSession(toAddress: Data) -> Session? {
+            let timestamp = Int32(Date().timeIntervalSince1970)
+            if let session = self.sessions[toAddress] {
+                if session.lastTimestamp >= timestamp + ttl {
+                    self.sessions[toAddress]?.updateLastTimestamp(timestamp)
+                    return session
+                } else {
+                    self.sessions.removeValue(forKey: toAddress)
+                }
+            }
+            return nil
+        }
+        
+        func addSession(session: Session) {
+            self.sessions[session.dstMac] = session
+        }
+        
+        func removeSession(dstMac: Data) {
+            self.sessions.removeValue(forKey: dstMac)
+        }
+        
+    }
+    
+}
+
+// --MARK: known_ips管理
+extension SDLContext {
+    
+    actor ArpServer {
+        private var known_macs: [UInt32:Data] = [:]
+        
+        init(known_macs: [UInt32:Data]) {
+            self.known_macs = known_macs
+        }
+        
+        func query(ip: UInt32) -> Data? {
+            return self.known_macs[ip]
+        }
+        
+        func append(ip: UInt32, mac: Data) {
+            self.known_macs[ip] = mac
+        }
+        
+        func remove(ip: UInt32) {
+            self.known_macs.removeValue(forKey: ip)
+        }
+        
+        func clear() {
+            self.known_macs = [:]
+        }
+    }
+    
+}
+
+// --MARK: 打洞流程管理
+extension SDLContext {
+    
+    actor HolerManager {
+        private var holers: [Data:Task<(), Never>] = [:]
+        
+        func addHoler(dstMac: Data, creator: @escaping () -> Task<(), Never>) {
+            if let task = self.holers[dstMac] {
+                if task.isCancelled {
+                    self.holers[dstMac] = creator()
+                }
+            } else {
+                self.holers[dstMac] = creator()
+            }
+        }
+        
+        func cleanup() {
+            for holer in holers.values {
+                holer.cancel()
+            }
+            self.holers.removeAll()
+        }
+        
+    }
+    
+    func holerTask(dstMac: Data) -> Task<(), Never> {
+        return Task {
+            guard let message = try? await self.superClient?.queryInfo(context: self, dst_mac: dstMac) else {
+                return
+            }
+            
+            switch message.packet {
+            case .empty:
+                SDLLogger.log("[SDLContext] hole query_info get empty: \(message)", level: .debug)
+            case .peerInfo(let peerInfo):
+                if let remoteAddress = peerInfo.v4Info.socketAddress() {
+                    SDLLogger.log("[SDLContext] hole sock address: \(remoteAddress)", level: .warning)
+                    // 发送register包
+                    self.udpHole?.sendRegister(context: self, remoteAddress: remoteAddress, dst_mac: dstMac)
+                } else {
+                    SDLLogger.log("[SDLContext] hole sock address is invalid: \(peerInfo.v4Info)", level: .warning)
+                }
+            default:
+                SDLLogger.log("[SDLContext] hole query_info is packet: \(message)", level: .warning)
+            }
+        }
+    }
+    
+}
+
+//--MARK: 网络类型探测
+extension SDLContext {
+    
+    // 定义nat类型
+    enum NatType: UInt8, Encodable {
+        case blocked = 0
+        case noNat = 1
+        case fullCone = 2
+        case portRestricted = 3
+        case coneRestricted = 4
+        case symmetric = 5
+    }
+    
+    private func getNatAddress(remoteAddress: SocketAddress, attr: SDLProbeAttr) async -> SocketAddress? {
+        let stunProbeReply = await self.udpHole?.stunProbe(remoteAddress: remoteAddress, attr: attr, timeout: 5)
+        
+        return stunProbeReply?.socketAddress()
+    }
+    
+    // 获取当前所处的网络的nat类型
+    func getNatType() async -> NatType {
+        let addressArray = config.stunProbeSocketAddressArray
+        // step1: ip1:port1 <---- ip1:port1
+        guard let natAddress1 = await getNatAddress(remoteAddress: addressArray[0][0], attr: .none) else {
+            return .blocked
+        }
+        
+        // 网络没有在nat下
+        if natAddress1 == self.udpHole?.localAddress {
+            return .noNat
+        }
+        
+        // step2: ip2:port2 <---- ip2:port2
+        guard let natAddress2 = await getNatAddress(remoteAddress: addressArray[1][1], attr: .none) else {
+            return .blocked
+        }
+        
+        // 如果natAddress2 的IP地址与上次回来的IP是不一样的，它就是对称型NAT; 这次的包也一定能发成功并收到
+        // 如果ip地址变了，这说明{dstIp, dstPort, srcIp, srcPort}, 其中有一个变了；则用新的ip地址
+        NSLog("nat_address1: \(natAddress1), nat_address2: \(natAddress2)")
+        if let ipAddress1 = natAddress1.ipAddress, let ipAddress2 = natAddress2.ipAddress, ipAddress1 != ipAddress2 {
+            return .symmetric
+        }
+        
+        // step3: ip1:port1 <---- ip2:port2 (ip地址和port都变的情况)
+        // 如果能收到的，说明是完全锥形 说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
+        if let natAddress3 = await getNatAddress(remoteAddress: addressArray[0][0], attr: .peer) {
+            NSLog("nat_address1: \(natAddress1), nat_address2: \(natAddress2), nat_address3: \(natAddress3)")
+            return .fullCone
+        }
+        
+        // step3: ip1:port1 <---- ip1:port2 (port改变情况)
+        // 如果能收到的说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
+        if let natAddress4 = await getNatAddress(remoteAddress: addressArray[0][0], attr: .port) {
+            NSLog("nat_address1: \(natAddress1), nat_address2: \(natAddress2), nat_address4: \(natAddress4)")
+            return .coneRestricted
+        } else {
+            return .portRestricted
+        }
+    }
+        
+}
+
+
+//--MARK: 获取设备的UUID
+
+extension SDLContext {
+    
+    static func getUUID() -> String {
+        let userDefaults = UserDefaults.standard
+        if let uuid = userDefaults.value(forKey: "gClientId") as? String {
+            return uuid
+        } else {
+            let uuid = UUID().uuidString.replacingOccurrences(of: "-", with: "").lowercased()
+            userDefaults.setValue(uuid, forKey: "gClientId")
+           
+            return uuid
+        }
+    }
+    
+    // 获取mac地址
+    static func getMacAddress() -> Data {
+        let key = "gMacAddress2"
+        
+        let userDefaults = UserDefaults.standard
+        if let mac = userDefaults.value(forKey: key) as? Data {
+            return mac
+        }
+        else {
+            let mac = generateMacAddress()
+            userDefaults.setValue(mac, forKey: key)
+            
+            return mac
+        }
+    }
+    
+    // 随机生成mac地址
+    private static func generateMacAddress() -> Data {
+        var macAddress = [UInt8](repeating: 0, count: 6)
+        for i in 0..<6 {
+            macAddress[i] = UInt8.random(in: 0...255)
+        }
+        
+        return Data(macAddress)
+    }
+    
+    // 将mac地址转换成字符串
+    private static func formatMacAddress(mac: Data) -> String {
+        let bytes = [UInt8](mac)
+        
+        return bytes.map { String(format: "%02X", $0) }.joined(separator: ":").lowercased()
+    }
+    
+}

Tun/SDLFlowTracerActor.swift

@@ -0,0 +1,43 @@
+//
+//  SDLFlowTracer.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/5/27.
+//
+
+import Foundation
+
+// 流量统计器
+actor SDLFlowTracerActor {
+    enum FlowType {
+        case forward
+        case p2p
+        case inbound
+    }
+    
+    private var forwardFlowBytes: UInt32 = 0
+    private var p2pFlowBytes: UInt32 = 0
+    private var inFlowBytes: UInt32 = 0
+    
+    func inc(num: Int, type: FlowType) {
+        switch type {
+        case .inbound:
+            self.inFlowBytes += UInt32(num)
+        case .forward:
+            self.forwardFlowBytes += UInt32(num)
+        case .p2p:
+            self.p2pFlowBytes += UInt32(num)
+        }
+    }
+    
+    func reset() -> (UInt32, UInt32, UInt32) {
+        defer {
+            self.forwardFlowBytes = 0
+            self.inFlowBytes = 0
+            self.p2pFlowBytes = 0
+        }
+        
+        return (forwardFlowBytes, p2pFlowBytes, inFlowBytes)
+    }
+    
+}

Tun/SDLHoler.swift

@@ -0,0 +1,11 @@
+//
+//  SDLHoler.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/3/12.
+//
+
+import Foundation
+import Combine
+
+

Tun/SDLLogger.swift

@@ -0,0 +1,39 @@
+//
+//  SDLLogger.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/3/13.
+//
+
+import Foundation
+
+struct SDLLogger {
+    enum Level {
+        case debug
+        case info
+        case warning
+        case error
+    }
+    
+    static var logLevel: Level = .debug
+    
+    static func log(_ message: String, level: Level = .debug) {
+        switch logLevel {
+        case .debug:
+            NSLog(message)
+        case .info:
+            if level == .info || level == .warning || level == .error {
+                NSLog(message)
+            }
+        case .warning:
+            if level == .warning || level == .error {
+                NSLog(message)
+            }
+        case .error:
+            if level == .error {
+                NSLog(message)
+            }
+        }
+    }
+    
+}

Tun/SDLMessage.swift

@@ -0,0 +1,156 @@
+//
+//  SDLPacketType.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/4/10.
+//
+
+import Foundation
+import NIOCore
+
+// 消息类型定义
+enum SDLPacketType: UInt8 {
+    case empty = 0x00
+    
+    case registerSuper = 0x01
+    case registerSuperAck = 0x02
+    case registerSuperNak = 0x04
+    
+    case unregisterSuper = 0x05
+    
+    case queryInfo = 0x06
+    case peerInfo = 0x07
+    
+    case ping = 0x08
+    case pong = 0x09
+    
+    // 事件类型
+    case event = 0x10
+    
+    // 推送命令消息, 需要返回值
+    case command = 0x11
+    case commandAck = 0x12
+    
+    // 流量统计
+    case flowTracer = 0x15
+    
+    case register = 0x20
+    case registerAck = 0x21
+    
+    case stunRequest = 0x30
+    case stunReply = 0x31
+    
+    case stunProbe = 0x32
+    case stunProbeReply = 0x33
+    
+    case data = 0xFF
+}
+
+// 升级策略
+enum SDLUpgradeType: UInt32 {
+    case none = 0
+    case normal = 1
+    case force = 2
+}
+
+// Id生成器
+struct SDLIdGenerator {
+    // 消息体id
+    private var packetId: UInt32
+    
+    init(seed packetId: UInt32) {
+        self.packetId = packetId
+    }
+    
+    mutating func nextId() -> UInt32 {
+        let packetId = self.packetId
+        self.packetId = packetId + 1
+        return packetId
+    }
+}
+
+// 定义事件类型
+
+// 命令类型
+enum SDLEventType: UInt8 {
+    case natChanged = 0x03
+    case sendRegister = 0x04
+    case networkShutdown = 0xFF
+}
+
+enum SDLEvent {
+    case natChanged(SDLNatChangedEvent)
+    case sendRegister(SDLSendRegisterEvent)
+    case networkShutdown(SDLNetworkShutdownEvent)
+}
+
+// --MARK: 定义命令类型
+
+enum SDLCommandType: UInt8 {
+    case changeNetwork = 0x01
+}
+
+enum SDLCommand {
+    case changeNetwork(SDLChangeNetworkCommand)
+}
+
+// --MARK: 网络类型探测
+// 探测的Attr属性
+enum SDLProbeAttr: UInt8 {
+    case none = 0
+    case port = 1
+    case peer = 2
+}
+
+// Nak的错误类型，不同的错误客户端的处理逻辑不一样
+enum SDLNAKErrorCode: UInt8 {
+    case invalidToken = 1
+    case nodeDisabled = 2
+    case noIpAddress = 3
+    case networkFault = 4
+    case internalFault = 5
+}
+
+extension SDLV4Info {
+    func socketAddress() -> SocketAddress? {
+        let address = "\(v4[0]).\(v4[1]).\(v4[2]).\(v4[3])"
+        
+        return try? SocketAddress.makeAddressResolvingHost(address, port: Int(port))
+    }
+}
+
+extension SDLStunProbeReply {
+    func socketAddress() -> SocketAddress? {
+        let address = SDLUtil.int32ToIp(self.ip)
+        
+        return try? SocketAddress.makeAddressResolvingHost(address, port: Int(port))
+    }
+}
+
+// --MARK: 进来的消息, 这里需要采用代数类型来表示
+
+enum SDLHoleInboundMessage {
+    case stunReply(SDLStunReply)
+    case stunProbeReply(SDLStunProbeReply)
+    
+    case data(SDLData)
+    case register(SDLRegister)
+    case registerAck(SDLRegisterAck)
+}
+
+// --MARK: 定义消息类型
+
+struct SDLSuperInboundMessage {
+    let msgId: UInt32
+    let packet: InboundPacket
+    
+    enum InboundPacket {
+        case empty
+        case registerSuperAck(SDLRegisterSuperAck)
+        case registerSuperNak(SDLRegisterSuperNak)
+        case peerInfo(SDLPeerInfo)
+        case pong
+        case event(SDLEvent)
+        case command(SDLCommand)
+    }
+}

Tun/SDLNetAddress.swift

@@ -0,0 +1,49 @@
+//
+//  SDLIPAddress.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/3/4.
+//
+
+import Foundation
+
+struct SDLNetAddress {
+    let ip: UInt32
+    let maskLen: UInt8
+    
+    // ip地址
+    var ipAddress: String {
+        return intToIpAddress(self.ip)
+    }
+    
+    // 掩码
+    var maskAddress: String {
+        let len0 = 32 - maskLen
+        let num: UInt32 = (0xFFFFFFFF >> len0) << len0
+        
+        return intToIpAddress(num)
+    }
+    
+    // 网络地址
+    var networkAddress: String {
+        let len0 = 32 - maskLen
+        let mask: UInt32 = (0xFFFFFFFF >> len0) << len0
+        
+        return intToIpAddress(self.ip & mask)
+    }
+    
+    init(ip: UInt32, maskLen: UInt8) {
+        self.ip = ip
+        self.maskLen = maskLen
+    }
+    
+    private func intToIpAddress(_ num: UInt32) -> String {
+        let ip0 = (UInt8) (num >> 24 & 0xFF)
+        let ip1 = (UInt8) (num >> 16 & 0xFF)
+        let ip2 = (UInt8) (num >> 8 & 0xFF)
+        let ip3 = (UInt8) (num & 0xFF)
+        
+        return "\(ip0).\(ip1).\(ip2).\(ip3)"
+    }
+    
+}

Tun/SDLNetworkMonitor.swift

@@ -0,0 +1,62 @@
+//
+//  SDLNetworkMonitor.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/5/16.
+//
+
+import Foundation
+import Network
+import Combine
+
+// 监控网络的变化
+class SDLNetworkMonitor {
+    private var monitor: NWPathMonitor
+    private var interfaceType: NWInterface.InterfaceType?
+    private let publisher = PassthroughSubject<NWInterface.InterfaceType, Never>()
+    private var cancel: AnyCancellable?
+    private let queue = DispatchQueue(label: "networkMonitorQueue")
+    
+    public let eventFlow = PassthroughSubject<MonitorEvent, Never>()
+    
+    enum MonitorEvent {
+        case changed
+        case unreachable
+    }
+    
+    init() {
+        self.monitor = NWPathMonitor()
+    }
+    
+    func start() {
+        self.monitor.pathUpdateHandler = { path in
+            if path.status == .satisfied {
+                if path.usesInterfaceType(.wifi) {
+                    self.publisher.send(.wifi)
+                } else if path.usesInterfaceType(.cellular) {
+                    self.publisher.send(.cellular)
+                } else if path.usesInterfaceType(.wiredEthernet) {
+                    self.publisher.send(.wiredEthernet)
+                }
+            } else {
+                self.eventFlow.send(.unreachable)
+                self.interfaceType = nil
+            }
+        }
+        self.monitor.start(queue: self.queue)
+        
+        self.cancel = publisher.throttle(for: 5.0, scheduler: self.queue, latest: true)
+            .sink { type in
+                if self.interfaceType != nil && self.interfaceType != type {
+                    self.eventFlow.send(.changed)
+                }
+                self.interfaceType = type
+            }
+    }
+    
+    deinit {
+        self.monitor.cancel()
+        self.cancel?.cancel()
+    }
+    
+}

Tun/SDLNoticeClient.swift

@@ -0,0 +1,95 @@
+//
+//  SDLNoticeClient.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/5/20.
+//
+
+import Foundation
+
+//
+//  SDLanServer.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/31.
+//
+
+import Foundation
+import NIOCore
+import NIOPosix
+
+// 处理和sn-server服务器之间的通讯
+class SDLNoticeClient: ChannelInboundHandler {
+    public typealias InboundIn = AddressedEnvelope<ByteBuffer>
+    public typealias OutboundOut = AddressedEnvelope<ByteBuffer>
+    
+    private var thread: Thread?
+    var context: ChannelHandlerContext?
+    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    private let remoteAddress: SocketAddress
+    
+    init() {
+        self.remoteAddress = try! SocketAddress(ipAddress: "127.0.0.1", port: 50195)
+    }
+    
+    // 启动函数
+    func start() {
+        self.thread = Thread {
+            let bootstrap = DatagramBootstrap(group: self.group)
+                .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+                .channelInitializer { channel in
+                    // 接收缓冲区
+                    channel.pipeline.addHandler(self)
+                }
+            
+            let channel = try! bootstrap.bind(host: "0.0.0.0", port: 0).wait()
+            SDLLogger.log("[SDLNoticeClient] started and listening on: \(channel.localAddress!)", level: .debug)
+            
+            // This will never unblock as we don't close the channel
+            try! channel.closeFuture.wait()
+        }
+        self.thread?.start()
+    }
+    
+    // -- MARK: ChannelInboundHandler Methods
+    
+    public func channelActive(context: ChannelHandlerContext) {
+        self.context = context
+    }
+    
+    // 接收到的消息, 消息需要根据类型分流
+    public func channelRead(context: ChannelHandlerContext, data: NIOAny) {
+        context.fireChannelRead(data)
+    }
+    
+    public func errorCaught(context: ChannelHandlerContext, error: Error) {
+        // As we are not really interested getting notified on success or failure we just pass nil as promise to
+        // reduce allocations.
+        context.close(promise: nil)
+        self.context = nil
+    }
+    
+    public func channelInactive(context: ChannelHandlerContext) {
+        self.context = nil
+        context.close(promise: nil)
+    }
+    
+    // 处理写入逻辑
+    func send(data: Data) {
+        guard let context = self.context else {
+            return
+        }
+        
+        context.eventLoop.execute {
+            let buffer = context.channel.allocator.buffer(bytes: data)
+            
+            let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: self.remoteAddress, data: buffer)
+            context.writeAndFlush(self.wrapOutboundOut(envelope), promise: nil)
+        }
+    }
+    
+    deinit {
+        self.thread?.cancel()
+        try? self.group.syncShutdownGracefully()
+    }
+}

Tun/SDLProtoMessageExtension.swift

@@ -0,0 +1,16 @@
+//
+//  SDLProtoMessageExtension.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/10/24.
+//
+
+import Foundation
+
+extension SDLData {
+    
+    func format() -> String {
+        return "network_id: \(self.networkID), src_mac: \(LayerPacket.MacAddress.description(data: self.srcMac)), dst_mac: \(LayerPacket.MacAddress.description(data: self.dstMac)), data: \([UInt8](self.data))"
+    }
+    
+}

Tun/SDLQPSCounter.swift

@@ -0,0 +1,37 @@
+//
+//  SDLQPSCounter.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/4/16.
+//
+
+import Foundation
+
+// 计数器，用来统计qps
+class SDLQPSCounter {
+    private var count = 0
+    private let timer: DispatchSourceTimer
+    private let label: String
+    
+    init(label: String) {
+        self.label = label
+        timer = DispatchSource.makeTimerSource(queue: DispatchQueue(label: "com.yourapp.qps"))
+        timer.schedule(deadline: .now(), repeating: .seconds(1), leeway: .milliseconds(100))
+        timer.setEventHandler { [weak self] in
+            guard let self = self else { return }
+            NSLog("[\(self.label)] QPS: \(self.count)")
+            self.count = 0
+        }
+        timer.resume()
+    }
+    
+    func increment(num: Int = 1) {
+        DispatchQueue(label: "com.yourapp.qps").async {
+            self.count += num
+        }
+    }
+    
+    deinit {
+        timer.cancel()
+    }
+}

Tun/SDLSuperClient.swift

@@ -0,0 +1,372 @@
+//
+//  SDLWebsocketClient.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/3/28.
+//
+
+import Foundation
+import NIOCore
+import NIOPosix
+import Combine
+
+// --MARK: 和SuperNode的客户端
+class SDLSuperClient: ChannelInboundHandler {
+    public typealias InboundIn = ByteBuffer
+    public typealias OutboundOut = ByteBuffer
+    
+    public typealias CallbackFun = (SDLSuperInboundMessage?) -> Void
+    
+    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    private var channel: Channel?
+    
+    // id生成器
+    var idGenerator = SDLIdGenerator(seed: 1)
+    private let callbackManager = SuperCallbackManager()
+    
+    let host: String
+    let port: Int
+    
+    private var pingCancel: AnyCancellable?
+    
+    public var eventFlow = PassthroughSubject<SuperEvent, Never>()
+    
+    // 定义事件类型
+    enum SuperEvent {
+        case ready
+        case closed
+        case event(SDLEvent)
+        case command(UInt32, SDLCommand)
+    }
+    
+    init(host: String, port: Int) {
+        self.host = host
+        self.port = port
+    }
+    
+    func start() async throws {
+        let bootstrap = ClientBootstrap(group: self.group)
+            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+            .channelInitializer { channel in
+                return channel.pipeline.addHandlers([
+                    ByteToMessageHandler(FixedHeaderDelimiterCoder()),
+                    MessageToByteHandler(FixedHeaderDelimiterCoder()),
+                    self
+                ])
+            }
+        
+        do {
+            self.channel = try await bootstrap.connect(host: self.host, port: self.port).get()
+        } catch let err {
+            NSLog("super client get error: \(err)")
+            self.eventFlow.send(.closed)
+        }
+    }
+    
+    // -- MARK: apis
+    
+    func commandAck(packetId: UInt32, ack: SDLCommandAck) {
+        guard let data = try? ack.serializedData() else {
+            return
+        }
+        
+        self.send(type: .commandAck, packetId: packetId, data: data)
+    }
+    
+    func registerSuper(context ctx: SDLContext) async -> SDLSuperInboundMessage? {
+        return await withCheckedContinuation { c in
+            self.registerSuper(context: ctx) { message in
+                c.resume(returning: message)
+            }
+        }
+    }
+    
+    func registerSuper(context ctx: SDLContext, callback: @escaping CallbackFun) {
+        var registerSuper = SDLRegisterSuper()
+        registerSuper.version = UInt32(ctx.config.version)
+        registerSuper.clientID = ctx.config.clientId
+        registerSuper.devAddr = ctx.devAddr
+        registerSuper.pubKey = ctx.rsaCipher.pubKey
+        registerSuper.token = ctx.config.token
+        
+        let data = try! registerSuper.serializedData()
+        
+        self.write(type: .registerSuper, data: data, callback: callback)
+    }
+    
+    func queryInfo(context ctx: SDLContext, dst_mac: Data) async throws -> SDLSuperInboundMessage? {
+        return await withCheckedContinuation { c in
+            self.queryInfo(context: ctx, dst_mac: dst_mac) { message in
+                c.resume(returning: message)
+            }
+        }
+    }
+    
+    // 查询目标服务器的相关信息
+    func queryInfo(context ctx: SDLContext, dst_mac: Data, callback: @escaping CallbackFun) {
+        var queryInfo = SDLQueryInfo()
+        queryInfo.dstMac = dst_mac
+        
+        self.write(type: .queryInfo, data: try! queryInfo.serializedData(), callback: callback)
+    }
+    
+    func unregister(context ctx: SDLContext) throws {
+        self.send(type: .unregisterSuper, packetId: 0, data: Data())
+    }
+    
+    func ping() {
+        self.send(type: .ping, packetId: 0, data: Data())
+    }
+    
+    func flowReport(forwardNum: UInt32, p2pNum: UInt32, inboundNum: UInt32) {
+        var flow = SDLFlows()
+        flow.forwardNum = forwardNum
+        flow.p2PNum = p2pNum
+        flow.inboundNum = inboundNum
+        
+        self.send(type: .flowTracer, packetId: 0, data: try! flow.serializedData())
+    }
+    
+    // --MARK: ChannelInboundHandler
+    
+    public func channelActive(context: ChannelHandlerContext) {
+        self.startPingTicker()
+        self.eventFlow.send(.ready)
+    }
+    
+    public func channelRead(context: ChannelHandlerContext, data: NIOAny) {
+        var buffer = self.unwrapInboundIn(data)
+        if let message = decode(buffer: &buffer) {
+            SDLLogger.log("[SDLSuperTransport] read message: \(message)", level: .warning)
+            
+            switch message.packet {
+            case .event(let event):
+                self.eventFlow.send(.event(event))
+            case .command(let command):
+                self.eventFlow.send(.command(message.msgId, command))
+            default:
+                self.callbackManager.fireCallback(message: message)
+            }
+        }
+    }
+    
+    public func errorCaught(context: ChannelHandlerContext, error: Error) {
+        SDLLogger.log("[SDLSuperTransport] error: \(error)", level: .warning)
+        self.channel = nil
+        self.eventFlow.send(.closed)
+        context.close(promise: nil)
+    }
+    
+    public func channelInactive(context: ChannelHandlerContext) {
+        SDLLogger.log("[SDLSuperTransport] channelInactive", level: .warning)
+        self.channel = nil
+        context.close(promise: nil)
+    }
+    
+    func write(type: SDLPacketType, data: Data, callback: @escaping CallbackFun) {
+        guard let channel = self.channel else {
+            return
+        }
+        
+        SDLLogger.log("[SDLSuperTransport] will write data: \(data)", level: .debug)
+        
+        let packetId = idGenerator.nextId()
+        self.callbackManager.addCallback(id: packetId, callback: callback)
+        
+        channel.eventLoop.execute {
+            var buffer = channel.allocator.buffer(capacity: data.count + 5)
+            buffer.writeInteger(packetId, as: UInt32.self)
+            buffer.writeBytes([type.rawValue])
+            buffer.writeBytes(data)
+            
+            channel.writeAndFlush(self.wrapOutboundOut(buffer), promise: nil)
+        }
+    }
+    
+    func send(type: SDLPacketType, packetId: UInt32, data: Data) {
+        guard let channel = self.channel else {
+            return
+        }
+        
+        channel.eventLoop.execute {
+            var buffer = channel.allocator.buffer(capacity: data.count + 5)
+            buffer.writeInteger(packetId, as: UInt32.self)
+            buffer.writeBytes([type.rawValue])
+            buffer.writeBytes(data)
+            
+            channel.writeAndFlush(self.wrapOutboundOut(buffer), promise: nil)
+        }
+    }
+    
+    // --MARK: 心跳机制
+    
+    private func startPingTicker() {
+        self.pingCancel = Timer.publish(every: 5.0, on: .main, in: .common).autoconnect()
+            .sink { _ in
+                // 保持和super-node的心跳机制
+                self.ping()
+            }
+    }
+    
+    deinit {
+        self.pingCancel?.cancel()
+        try! group.syncShutdownGracefully()
+    }
+    
+}
+
+/// 基于2字节固定长度的分包协议
+extension SDLSuperClient {
+    private final class FixedHeaderDelimiterCoder: ByteToMessageDecoder, MessageToByteEncoder {
+        typealias InboundIn = ByteBuffer
+        typealias InboundOut = ByteBuffer
+        
+        func decode(context: ChannelHandlerContext, buffer: inout ByteBuffer) throws -> DecodingState {
+            guard let len = buffer.getInteger(at: buffer.readerIndex, endianness: .big, as: UInt16.self) else {
+                return .needMoreData
+            }
+            
+            if buffer.readableBytes >= len + 2 {
+                buffer.moveReaderIndex(forwardBy: 2)
+                if let bytes = buffer.readBytes(length: Int(len)) {
+                    context.fireChannelRead(self.wrapInboundOut(ByteBuffer(bytes: bytes)))
+                }
+                return .continue
+            } else {
+                return .needMoreData
+            }
+        }
+        
+        func encode(data: ByteBuffer, out: inout ByteBuffer) throws {
+            let len = data.readableBytes
+            out.writeInteger(UInt16(len))
+            out.writeBytes(data.readableBytesView)
+        }
+    }
+}
+
+// 回调函数管理器
+extension SDLSuperClient {
+    private final class SuperCallbackManager {
+        // 对应请求体和相应的关系
+        private var callbacks: [UInt32:CallbackFun] = [:]
+        private let locker = NSLock()
+        
+        func addCallback(id: UInt32, callback: @escaping CallbackFun) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            self.callbacks[id] = callback
+        }
+        
+        func fireCallback(message: SDLSuperInboundMessage) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            if let callback = self.callbacks[message.msgId] {
+                callback(message)
+                self.callbacks.removeValue(forKey: message.msgId)
+            }
+        }
+        
+        func fireAllCallbacks(message: SDLSuperInboundMessage) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            for (_, callback) in self.callbacks {
+                callback(nil)
+            }
+            self.callbacks.removeAll()
+        }
+    }
+}
+
+// --MARK: 编解码器
+extension SDLSuperClient {
+    // 消息格式为: <<MsgId:32, Type:8, Body/binary>>
+    func decode(buffer: inout ByteBuffer) -> SDLSuperInboundMessage? {
+        guard let msgId = buffer.readInteger(as: UInt32.self),
+              let type = buffer.readInteger(as: UInt8.self),
+              let messageType = SDLPacketType(rawValue: type) else {
+            return nil
+        }
+        
+        switch messageType {
+        case .empty:
+            return .init(msgId: msgId, packet: .empty)
+        case .registerSuperAck:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                  let registerSuperAck = try? SDLRegisterSuperAck(serializedData: Data(bytes)) else {
+                return nil
+            }
+            return .init(msgId: msgId, packet: .registerSuperAck(registerSuperAck))
+            
+        case .registerSuperNak:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                  let registerSuperNak = try? SDLRegisterSuperNak(serializedData: Data(bytes)) else {
+                return nil
+            }
+            return .init(msgId: msgId, packet: .registerSuperNak(registerSuperNak))
+            
+        case .peerInfo:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                  let peerInfo = try? SDLPeerInfo(serializedData: Data(bytes)) else {
+                return nil
+            }
+            
+            return .init(msgId: msgId, packet: .peerInfo(peerInfo))
+        case .pong:
+            return .init(msgId: msgId, packet: .pong)
+            
+        case .command:
+            guard let commandVal = buffer.readInteger(as: UInt8.self),
+                  let command = SDLCommandType(rawValue: commandVal),
+                  let bytes = buffer.readBytes(length: buffer.readableBytes) else {
+                return nil
+            }
+            
+            switch command {
+            case .changeNetwork:
+                guard let changeNetworkCommand = try? SDLChangeNetworkCommand(serializedData: Data(bytes)) else {
+                    return nil
+                }
+                
+                return .init(msgId: msgId, packet: .command(.changeNetwork(changeNetworkCommand)))
+            }
+            
+        case .event:
+            guard let eventVal = buffer.readInteger(as: UInt8.self),
+                  let event = SDLEventType(rawValue: eventVal),
+                  let bytes = buffer.readBytes(length: buffer.readableBytes) else {
+                return nil
+            }
+            
+            switch event {
+            case .natChanged:
+                guard let natChangedEvent = try? SDLNatChangedEvent(serializedData: Data(bytes)) else {
+                    return nil
+                }
+                return .init(msgId: msgId, packet: .event(.natChanged(natChangedEvent)))
+            case .sendRegister:
+                guard let sendRegisterEvent = try? SDLSendRegisterEvent(serializedData: Data(bytes)) else {
+                    return nil
+                }
+                return .init(msgId: msgId, packet: .event(.sendRegister(sendRegisterEvent)))
+            case .networkShutdown:
+                guard let networkShutdownEvent = try? SDLNetworkShutdownEvent(serializedData: Data(bytes)) else {
+                    return nil
+                }
+                return .init(msgId: msgId, packet: .event(.networkShutdown(networkShutdownEvent)))
+            }
+            
+        default:
+            return nil
+        }
+    }
+    
+}

Tun/SDLThrottler.swift

@@ -0,0 +1,45 @@
+//
+//  SDLThrottler.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/6/3.
+//
+
+import Foundation
+import Combine
+
+// 限流器
+actor SDLThrottler {
+    private var limit: Int
+    private var token: Int
+    private var cancel: AnyCancellable?
+    
+    init(limit: Int) {
+        self.limit = limit
+        self.token = limit
+    }
+    
+    func start() {
+        self.cancel?.cancel()
+        self.cancel = Timer.publish(every: 1.0, on: .main, in: .common).autoconnect()
+            .sink { _ in
+                Task {
+                    self.token = self.limit
+                }
+            }
+    }
+    
+    func setRateLimit(limit: Int) {
+        self.limit = limit
+    }
+    
+    func getToken(num: Int) -> Bool {
+        if token > 0 {
+            self.token = self.token - num
+            return true
+        } else {
+            return false
+        }
+    }
+    
+}

Tun/SDLUDPHole.swift

@@ -0,0 +1,337 @@
+//
+//  SDLanServer.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/31.
+//
+
+import Foundation
+import NIOCore
+import NIOPosix
+import Combine
+
+// 处理和sn-server服务器之间的通讯
+class SDLUDPHole: ChannelInboundHandler {
+    public typealias InboundIn = AddressedEnvelope<ByteBuffer>
+    public typealias OutboundOut = AddressedEnvelope<ByteBuffer>
+    
+    // 回调函数
+    public typealias CallbackFun = (SDLStunProbeReply?) -> Void
+    
+    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    
+    private var cookieGenerator = SDLIdGenerator(seed: 1)
+    private let callbackManager = HoleCallbackManager()
+    
+    public var localAddress: SocketAddress?
+    public var channel: Channel?
+    
+    public var eventFlow = PassthroughSubject<UDPEvent, Never>()
+    
+    // 定义事件类型
+    enum UDPEvent {
+        case ready
+        case closed
+        case message(SocketAddress, SDLHoleInboundMessage)
+        case data(SDLData)
+    }
+    
+    init() {
+        
+    }
+    
+    // MARK: super_node apis
+    
+    func stunRequest(context ctx: SDLContext) -> UInt32 {
+        let cookie = self.cookieGenerator.nextId()
+        let remoteAddress = ctx.config.stunSocketAddress
+        
+        var stunRequest = SDLStunRequest()
+        stunRequest.cookie = cookie
+        stunRequest.clientID = ctx.config.clientId
+        stunRequest.networkID = ctx.devAddr.networkID
+        stunRequest.ip = ctx.devAddr.netAddr
+        stunRequest.mac = ctx.devAddr.mac
+        stunRequest.natType = UInt32(ctx.natType.rawValue)
+        
+        SDLLogger.log("[SDLUDPHole] stunRequest: \(remoteAddress), host: \(ctx.config.stunServers[0].host):\(ctx.config.stunServers[0].ports[0])", level: .warning)
+        
+        self.send(remoteAddress: remoteAddress, type: .stunRequest, data: try! stunRequest.serializedData())
+        
+        return cookie
+    }
+    
+    // 探测tun信息
+    func stunProbe(remoteAddress: SocketAddress, attr: SDLProbeAttr = .none, timeout: Int = 5) async -> SDLStunProbeReply? {
+        return await withCheckedContinuation { continuation in
+            self.stunProbe(remoteAddress: remoteAddress, attr: attr, timeout: timeout) { probeReply in
+                continuation.resume(returning: probeReply)
+            }
+        }
+    }
+    
+    private func stunProbe(remoteAddress: SocketAddress, attr: SDLProbeAttr = .none, timeout: Int, callback: @escaping CallbackFun) {
+        let cookie = self.cookieGenerator.nextId()
+        
+        var stunProbe = SDLStunProbe()
+        stunProbe.cookie = cookie
+        stunProbe.attr = UInt32(attr.rawValue)
+        
+        self.send(remoteAddress: remoteAddress, type: .stunProbe, data: try! stunProbe.serializedData())
+        
+        SDLLogger.log("[SDLUDPHole] stunProbe: \(remoteAddress)", level: .warning)
+        
+        self.callbackManager.addCallback(id: cookie, timeout: timeout, callback: callback)
+    }
+    
+    // MARK: client-client apis
+    
+    // 发送数据包到其他session
+    func sendPacket(context ctx: SDLContext, session: SDLContext.Session, data: Data) {
+        let remoteAddress = session.natAddress
+        
+        var dataPacket = SDLData()
+        dataPacket.networkID = ctx.devAddr.networkID
+        dataPacket.srcMac = ctx.devAddr.mac
+        dataPacket.dstMac = session.dstMac
+        dataPacket.ttl = 255
+        dataPacket.data = data
+        let packet = try! dataPacket.serializedData()
+        
+        SDLLogger.log("[SDLUDPHole] sendPacket: \(remoteAddress), count: \(packet.count)", level: .debug)
+        
+        self.send(remoteAddress: remoteAddress, type: .data, data: packet)
+    }
+    
+    // 通过sn服务器转发数据包, data已经是加密过后的数据
+    func forwardPacket(context ctx: SDLContext, dst_mac: Data, data: Data) {
+        let remoteAddress = ctx.config.stunSocketAddress
+        
+        var dataPacket = SDLData()
+        dataPacket.networkID = ctx.devAddr.networkID
+        dataPacket.srcMac = ctx.devAddr.mac
+        dataPacket.dstMac = dst_mac
+        dataPacket.ttl = 255
+        dataPacket.data = data
+        
+        let packet = try! dataPacket.serializedData()
+        
+        NSLog("[SDLContext] forward packet, remoteAddress: \(remoteAddress), data size: \(packet.count)")
+        
+        self.send(remoteAddress: remoteAddress, type: .data, data: packet)
+    }
+    
+    // 发送register包
+    func sendRegister(context ctx: SDLContext, remoteAddress: SocketAddress, dst_mac: Data) {
+        var register = SDLRegister()
+        register.networkID = ctx.devAddr.networkID
+        register.srcMac = ctx.devAddr.mac
+        register.dstMac = dst_mac
+        
+        SDLLogger.log("[SDLUDPHole] SendRegister: \(remoteAddress), src_mac: \(LayerPacket.MacAddress.description(data: ctx.devAddr.mac)), dst_mac: \(LayerPacket.MacAddress.description(data: dst_mac))", level: .debug)
+        
+        self.send(remoteAddress: remoteAddress, type: .register, data: try! register.serializedData())
+    }
+    
+    // 回复registerAck
+    func sendRegisterAck(context ctx: SDLContext, remoteAddress: SocketAddress, dst_mac: Data) {
+        var registerAck = SDLRegisterAck()
+        registerAck.networkID = ctx.devAddr.networkID
+        registerAck.srcMac = ctx.devAddr.mac
+        registerAck.dstMac = dst_mac
+        
+        SDLLogger.log("[SDLUDPHole] SendRegisterAck: \(remoteAddress), \(registerAck)", level: .debug)
+        
+        self.send(remoteAddress: remoteAddress, type: .registerAck, data: try! registerAck.serializedData())
+    }
+    
+    // 启动函数
+    func start() async throws {
+        let bootstrap = DatagramBootstrap(group: self.group)
+            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+            .channelInitializer { channel in
+                // 接收缓冲区
+                return channel.setOption(ChannelOptions.socketOption(.so_rcvbuf), value: 5 * 1024  * 1024)
+                    .flatMap {
+                        channel.setOption(ChannelOptions.socket(SocketOptionLevel(SOL_SOCKET), SO_SNDBUF), value: 5 * 1024  * 1024)
+                    }.flatMap {
+                        channel.pipeline.addHandler(self)
+                    }
+            }
+        
+        let channel = try await bootstrap.bind(host: "0.0.0.0", port: 0).get()
+        
+        SDLLogger.log("[UDPHole] started and listening on: \(channel.localAddress!)", level: .debug)
+        self.localAddress = channel.localAddress
+        self.channel = channel
+    }
+    
+    // -- MARK: ChannelInboundHandler Methods
+    
+    public func channelActive(context: ChannelHandlerContext) {
+        self.eventFlow.send(.ready)
+    }
+    
+    // 接收到的消息, 消息需要根据类型分流
+    public func channelRead(context: ChannelHandlerContext, data: NIOAny) {
+        let envelope = self.unwrapInboundIn(data)
+        var buffer = envelope.data
+        let remoteAddress = envelope.remoteAddress
+        
+        do {
+            if let message = try decode(buffer: &buffer) {
+                Task {
+                    switch message {
+                    case .data(let data):
+                        SDLLogger.log("[SDLUDPHole] read data: \(data.format()), from: \(remoteAddress)", level: .debug)
+                        self.eventFlow.send(.data(data))
+                    case .stunProbeReply(let probeReply):
+                        self.callbackManager.fireCallback(message: probeReply)
+                    default:
+                        self.eventFlow.send(.message(remoteAddress, message))
+                    }
+                }
+            } else {
+                SDLLogger.log("[SDLUDPHole] decode message, get null", level: .warning)
+            }
+        } catch let err {
+            SDLLogger.log("[SDLUDPHole] decode message, get error: \(err)", level: .debug)
+        }
+    }
+    
+    public func errorCaught(context: ChannelHandlerContext, error: Error) {
+        SDLLogger.log("[SDLUDPHole] get error: \(error)", level: .error)
+        // As we are not really interested getting notified on success or failure we just pass nil as promise to
+        // reduce allocations.
+        context.close(promise: nil)
+        self.channel = nil
+        self.eventFlow.send(.closed)
+    }
+    
+    public func channelInactive(context: ChannelHandlerContext) {
+        self.channel = nil
+        context.close(promise: nil)
+    }
+    
+    // 处理写入逻辑
+    func send(remoteAddress: SocketAddress, type: SDLPacketType, data: Data) {
+        guard let channel = self.channel else {
+            return
+        }
+        
+        // 在Eventloop中时直接写入数据避免线程切换
+        if channel.eventLoop.inEventLoop {
+            var buffer = channel.allocator.buffer(capacity: data.count + 1)
+            buffer.writeBytes([type.rawValue])
+            buffer.writeBytes(data)
+            
+            let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: remoteAddress, data: buffer)
+            channel.writeAndFlush(self.wrapOutboundOut(envelope), promise: nil)
+        } else {
+            channel.eventLoop.execute {
+                var buffer = channel.allocator.buffer(capacity: data.count + 1)
+                buffer.writeBytes([type.rawValue])
+                buffer.writeBytes(data)
+                
+                let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: remoteAddress, data: buffer)
+                channel.writeAndFlush(self.wrapOutboundOut(envelope), promise: nil)
+            }
+        }
+    }
+    
+    deinit {
+        try? self.group.syncShutdownGracefully()
+    }
+}
+
+//--MARK: 编解码器
+extension SDLUDPHole {
+    
+    func decode(buffer: inout ByteBuffer) throws -> SDLHoleInboundMessage? {
+        guard let type = buffer.readInteger(as: UInt8.self),
+              let packetType = SDLPacketType(rawValue: type),
+              let bytes = buffer.readBytes(length: buffer.readableBytes) else {
+            SDLLogger.log("[SDLUDPHole] decode error", level: .error)
+            return nil
+        }
+        
+        switch packetType {
+        case .data:
+            let dataPacket = try SDLData(serializedData: Data(bytes))
+            return .data(dataPacket)
+        case .register:
+            let registerPacket = try SDLRegister(serializedData: Data(bytes))
+            return .register(registerPacket)
+        case .registerAck:
+            let registerAck = try SDLRegisterAck(serializedData: Data(bytes))
+            return .registerAck(registerAck)
+        case .stunReply:
+            let stunReply = try SDLStunReply(serializedData: Data(bytes))
+            return .stunReply(stunReply)
+        case .stunProbeReply:
+            let stunProbeReply = try SDLStunProbeReply(serializedData: Data(bytes))
+            return .stunProbeReply(stunProbeReply)
+        default:
+            return nil
+        }
+    }
+}
+
+// --MARK: 回调函数管理器
+extension SDLUDPHole {
+    private final class HoleCallbackManager {
+        // 对应请求体和相应的关系
+        private var callbacks: [UInt32:CallbackFun] = [:]
+        private let locker = NSLock()
+        
+        func addCallback(id: UInt32, timeout: Int, callback: @escaping CallbackFun) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            DispatchQueue.global().asyncAfter(deadline: .now() + Double(timeout)) {
+                self.fireCallback(cookie: id)
+            }
+            
+            self.callbacks[id] = callback
+        }
+        
+        func fireCallback(message: SDLStunProbeReply) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            if let callback = self.callbacks[message.cookie] {
+                callback(message)
+                self.callbacks.removeValue(forKey: message.cookie)
+            }
+        }
+        
+        func fireAllCallbacks(message: SDLSuperInboundMessage) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            for (_, callback) in self.callbacks {
+                callback(nil)
+            }
+            self.callbacks.removeAll()
+        }
+        
+        private func fireCallback(cookie: UInt32) {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            if let callback = self.callbacks[cookie] {
+                callback(nil)
+                self.callbacks.removeValue(forKey: cookie)
+            }
+        }
+
+    }
+}

Tun/SDLUtil.swift

@@ -0,0 +1,46 @@
+//
+//  Util.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/19.
+//
+
+import Foundation
+
+struct SDLUtil {
+    
+    public static func int32ToIp(_ num: UInt32) -> String {
+        let ip0 = (UInt8) (num >> 24 & 0xFF)
+        let ip1 = (UInt8) (num >> 16 & 0xFF)
+        let ip2 = (UInt8) (num >> 8 & 0xFF)
+        let ip3 = (UInt8) (num & 0xFF)
+        
+        return "\(ip0).\(ip1).\(ip2).\(ip3)"
+    }
+    
+    public static func netMaskIp(maskLen: UInt8) -> String {
+        let len0 = 32 - maskLen
+        let num: UInt32 = (0xFFFFFFFF >> len0) << len0
+        
+        let ip0 = (UInt8) (num >> 24 & 0xFF)
+        let ip1 = (UInt8) (num >> 16 & 0xFF)
+        let ip2 = (UInt8) (num >> 8 & 0xFF)
+        let ip3 = (UInt8) (num & 0xFF)
+        
+        return "\(ip0).\(ip1).\(ip2).\(ip3)"
+    }
+    
+    // 判断ip地址是否在同一个网络
+    public static func inSameNetwork(ip: UInt32, compareIp: UInt32, maskLen: UInt8) -> Bool {
+        if ip == compareIp {
+            return true
+        }
+        
+        let len0 = 32 - maskLen
+        // 掩码值
+        let mask: UInt32 = (0xFFFFFFFF >> len0) << len0
+            
+        return ip & mask == compareIp & mask
+    }
+
+}

Tun/Tun.entitlements

@@ -5,8 +5,6 @@
 	<key>com.apple.developer.networking.networkextension</key>
 	<array>
 		<string>packet-tunnel-provider</string>
-		<string>app-proxy-provider</string>
-		<string>content-filter-provider</string>
 	</array>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>

Tun/UIntExtension.swift

@@ -0,0 +1,37 @@
+//
+//  UIntExtension.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/5/30.
+//
+
+import Foundation
+
+extension UInt16 {
+    init(bytes: (UInt8, UInt8)) {
+        self = UInt16(bytes.0) << 8 + UInt16(bytes.1)
+    }
+    
+    init(data: Data) {
+        self = UInt16(data[0]) << 8 + UInt16(data[1])
+    }
+    
+    func data() -> Data {
+        var data = Data()
+        
+        data.append(contentsOf:  [UInt8(self >> 8), UInt8(self & 0x00FF)])
+        
+        return data
+    }
+}
+
+extension UInt32 {
+    init(bytes: (UInt8, UInt8, UInt8, UInt8)) {
+        self = UInt32(bytes.0) << 24 + UInt32(bytes.1) << 16 + UInt32(bytes.2) << 8 + UInt32(bytes.3)
+    }
+    
+    init(data: Data) {
+        self = UInt32(data[0]) << 24 | UInt32(data[1]) << 16 | UInt32(data[2]) << 8 | UInt32(data[3])
+    }
+    
+}