add proj

.gitignore

@@ -1 +0,0 @@
-punchnet.xcodeproj/*

Tun/NetworkInterface.swift

@@ -14,6 +14,7 @@
 //
 
 import Foundation
+import Network
 
 public struct NetworkInterface {
     public let name: String
@@ -72,4 +73,68 @@ public struct NetworkInterfaceManager {
         return interfaces
     }
 
+    // 获取本地网卡中的公网IPv6地址
+    public static func getPublicIPv6Address() -> String? {
+        return self.getPublicIPv6Interface()?.ip
+    }
+    
+    // 获取本地网卡中的公网IPv6网卡
+    public static func getPublicIPv6Interface() -> NetworkInterface? {
+        let interfaces = self.getInterfaces()
+
+        return interfaces.first { interface in
+            !interface.name.hasPrefix("utun")
+            && self.isPublicIPv6(interface.ip)
+        }
+    }
+
+    /// 判断一个 IPv6 字符串是否是公网 IPv6
+    public static func isPublicIPv6(_ ipString: String) -> Bool {
+        let normalizedIp = String(ipString.split(separator: "%", maxSplits: 1, omittingEmptySubsequences: false).first ?? "")
+        guard let ipv6 = IPv6Address(normalizedIp) else {
+            return false
+        }
+        return self.isPublicIPv6(ipv6.rawValue)
+    }
+
+    /// 判断 16 字节 IPv6 地址是否是公网 IPv6
+    public static func isPublicIPv6(_ raw: Data) -> Bool {
+        guard raw.count == 16 else {
+            return false
+        }
+
+        let bytes = [UInt8](raw)
+
+        // 1. 排除 unspecified ::
+        if bytes.allSatisfy({ $0 == 0 }) {
+            return false
+        }
+
+        // 2. 排除 loopback ::1
+        if bytes.dropLast().allSatisfy({ $0 == 0 }) && bytes[15] == 1 {
+            return false
+        }
+
+        // 3. 排除 multicast ff00::/8
+        if bytes[0] == 0xFF {
+            return false
+        }
+
+        // 4. 排除 link-local fe80::/10
+        // 即首字节 0xFE，第二字节前两位是 10（二进制）
+        if bytes[0] == 0xFE && (bytes[1] & 0xC0) == 0x80 {
+            return false
+        }
+
+        // 5. 排除 ULA fc00::/7
+        // 即首字节前 7 位是 1111110
+        if (bytes[0] & 0xFE) == 0xFC {
+            return false
+        }
+
+        // 6. 判断是否属于 2000::/3
+        // 即首字节前 3 位是 001
+        return (bytes[0] & 0xE0) == 0x20
+    }
+
 }

Tun/PacketTunnelProvider.swift

@@ -5,174 +5,114 @@
 //  Created by 安礼成 on 2025/8/3.
 //
 
-
+import Foundation
-//
-//  PacketTunnelProvider.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/1/17.
-//
-
 import NetworkExtension
 
+enum TunnelError: Error {
+    case invalidConfiguration
+    case invalidContext
+}
+
 class PacketTunnelProvider: NEPacketTunnelProvider {
-    var context: SDLContext?
+    private var runtimeEnv: SDLRuntimeEnvironment?
-    private var rootTask: Task<Void, Error>?
     
     override func startTunnel(options: [String: NSObject]?, completionHandler: @escaping (Error?) -> Void) {
-        // host: "192.168.0.101", port: 1265
-        guard let options else {
-            return
-        }
-        
         // 如果当前在运行状态，不允许重复请求
-        guard self.context == nil else {
+        guard self.runtimeEnv == nil else {
+            completionHandler(TunnelError.invalidContext)
             return
         }
         
-        // let token = options["token"] as! String
+        guard let options, let config = SDLConfiguration.parse(options: options) else {
-        let installed_channel = options["installed_channel"] as! String
+            completionHandler(TunnelError.invalidConfiguration)
-        let superIp = options["super_ip"] as! String
-        let superPort = options["super_port"] as! Int
-        let stunServersStr = options["stun_servers"] as! String
-        let noticePort = options["notice_port"] as! Int
-        let token = options["token"] as! String
-        let networkCode = options["network_code"] as! String
-        let clientId = options["client_id"] as! String
-        let remoteDnsServer = options["remote_dns_server"] as! String
-        let hostname = options["hostname"] as! String
-
-        let stunServers = stunServersStr.split(separator: ";").compactMap { server -> SDLConfiguration.StunServer? in
-            let parts = server.split(separator: ":", maxSplits: 2)
-            guard parts.count == 2 else {
-                return nil
-            }
-            
-            let ports = parts[1].split(separator: ",", maxSplits: 2)
-            guard ports.count == 2, let port1 = Int(String(ports[0])), let port2 = Int(String(ports[1])) else {
-                return nil
-            }
-            
-            return .init(host: String(parts[0]), ports: [port1, port2])
-        }
-        
-        guard stunServers.count >= 2 else {
-            NSLog("stunServers配置错误")
             return
         }
         
-        NSLog("[PacketTunnelProvider] client_id: \(clientId), token: \(token), network_code: \(networkCode)")
+        if self.runtimeEnv == nil {
-
-        let config = SDLConfiguration(version: 1,
-                                      installedChannel: installed_channel,
-                                      superHost: superIp,
-                                      superPort: superPort,
-                                      stunServers: stunServers,
-                                      clientId: clientId,
-                                      noticePort: noticePort,
-                                      token: token,
-                                      networkCode: networkCode,
-                                      remoteDnsServer: remoteDnsServer,
-                                      hostname: hostname)
-        // 加密算法
             let rsaCipher = try! CCRSACipher(keySize: 1024)
-        let aesChiper = CCAESChiper()
+            self.runtimeEnv = SDLRuntimeEnvironment(config: config, rsaCipher: rsaCipher, provider: self)
+            self.runtimeEnv?.run()
+        }
         
-        self.rootTask = Task {
+        self.runtimeEnv?.submitCommand(command: .start(completion: { err in
-            do {
+            completionHandler(err)
-                self.context = SDLContext(provider: self, config: config, rsaCipher: rsaCipher, aesCipher: aesChiper, logger: SDLLogger(level: .debug))
+        }))
-                try await self.context?.start()
-            } catch let err {
-                NSLog("[PacketTunnelProvider] exit with error: \(err)")
-                exit(-1)
-            }
-        }
-        completionHandler(nil)
     }
 
     override func stopTunnel(with reason: NEProviderStopReason, completionHandler: @escaping () -> Void) {
         // Add code here to start the process of stopping the tunnel.
-        self.rootTask?.cancel()
+        self.runtimeEnv?.submitCommand(command: .stop(completion: {
-        Task {
-            await self.context?.stop()
-        }
-        self.context = nil
-        self.rootTask = nil
-        
             completionHandler()
+        }))
     }
 
     override func handleAppMessage(_ messageData: Data, completionHandler: ((Data?) -> Void)?) {
         // Add code here to handle the message.
-        if let handler = completionHandler {
+        Task {
-            handler(messageData)
+            do {
+                let message = try AppRequest(serializedBytes: messageData)
+                let replyData = try await self.handleAppRequest(message: message)
+                completionHandler?(replyData)
+            } catch let err {
+                var reply = TunnelResponse()
+                reply.code = 1
+                reply.message = err.localizedDescription
+
+                let errorReplyData = try? reply.serializedData()
+                completionHandler?(errorReplyData)
+            }
         }
     }
 
     override func sleep(completionHandler: @escaping () -> Void) {
         // Add code here to get ready to sleep.
+        guard let runtimeEnv else {
             completionHandler()
+            return
+        }
+
+        runtimeEnv.submitCommand(command: .stop(completion: {
+            SDLLogger.log("[PacketTunnelProvider] sleep")
+            completionHandler()
+        }))
     }
 
     override func wake() {
+        SDLLogger.log("[PacketTunnelProvider] wake up!!!!!!!")
         // Add code here to wake up.
+        // 重新启动
+        self.runtimeEnv?.submitCommand(command: .start(completion: { err in
+            SDLLogger.log("[PacketTunnelProvider] wakeup and try start")
+        }))
     }
 
+    private func handleAppRequest(message: AppRequest) async throws -> Data? {
+        guard let contextActor = self.runtimeEnv?.getContextActor() else {
+            throw TunnelError.invalidContext
         }
         
-// 获取物理网卡ip地址
+        switch message.command {
-extension PacketTunnelProvider {
+        case .changeExitNode(let changeExitNode):
+            let exitNodeIp = changeExitNode.ip
+            do {
+                try await contextActor.updateExitNode(exitNodeIp: exitNodeIp)
+                var reply = TunnelResponse()
+                reply.code = 0
+                reply.message = "操作成功"
+                return try reply.serializedData()
                 
-    public static var viaInterface: NetworkInterface? = {
+            } catch let err {
-        let interfaces = NetworkInterfaceManager.getInterfaces()
+                var reply = TunnelResponse()
+                reply.code = 1
+                reply.message = err.localizedDescription
                 
-        return interfaces.first {$0.name == "en0"}
+                return try reply.serializedData()
-    }()
-    
-    struct CCRSACipher: RSACipher {
-        var pubKey: String
-        let privateKeyDER: Data
-        
-        init(keySize: Int) throws {
-            let (privateKey, publicKey) = try Self.loadKeys(keySize: keySize)
-            let privKeyStr = SwKeyConvert.PrivateKey.derToPKCS1PEM(privateKey)
-            
-            self.pubKey = SwKeyConvert.PublicKey.derToPKCS8PEM(publicKey)
-            self.privateKeyDER = try SwKeyConvert.PrivateKey.pemToPKCS1DER(privKeyStr)
             }
-        
+        case .none:
-        public func decode(data: Data) throws -> Data {
+            var reply = TunnelResponse()
-            let tag = Data()
+            reply.code = 1
-            let (decryptedData, _) = try CC.RSA.decrypt(data, derKey: self.privateKeyDER, tag: tag, padding: .pkcs1, digest: .none)
+            reply.message = "无效请求"
-            
+            return try reply.serializedData()
-            return decryptedData
-        }
-        
-        private static func loadKeys(keySize: Int) throws -> (Data, Data) {
-            if let privateKey = UserDefaults.standard.data(forKey: "privateKey"),
-               let publicKey = UserDefaults.standard.data(forKey: "publicKey") {
-                
-                return (privateKey, publicKey)
-            } else {
-                let (privateKey, publicKey) = try CC.RSA.generateKeyPair(keySize)
-                UserDefaults.standard.setValue(privateKey, forKey: "privateKey")
-                UserDefaults.standard.setValue(publicKey, forKey: "publicKey")
-                
-                return (privateKey, publicKey)
-            }
-        }
-    }
-    
-    struct CCAESChiper: AESCipher {
-        func decypt(aesKey: Data, data: Data) throws -> Data {
-            let ivData = Data(aesKey.prefix(16))
-            return try CC.crypt(.decrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: data, key: aesKey, iv: ivData)
-        }
-        
-        func encrypt(aesKey: Data, data: Data) throws -> Data {
-            let ivData = Data(aesKey.prefix(16))
-            
-            return try CC.crypt(.encrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: data, key: aesKey, iv: ivData)
         }
     }
 

Tun/Punchnet/AESCipher.swift

@@ -1,13 +0,0 @@
-//
-//  AESCipher.swift
-//  sdlan
-//
-//  Created by 安礼成 on 2025/7/14.
-//
-import Foundation
-
-public protocol AESCipher {
-    func decypt(aesKey: Data, data: Data) throws -> Data
-    
-    func encrypt(aesKey: Data, data: Data) throws -> Data
-}

Tun/Punchnet/Actors/ArpServer.swift

@@ -0,0 +1,110 @@
+//
+//  ArpServer.swift
+//  sdlan
+//  1. 通过ip地址查找mac地址
+//  2. 要限制单位时间内，同一个ip的查询
+//  Created by 安礼成 on 2025/7/14.
+//
+import Foundation
+import Darwin
+
+actor ArpServer {
+    // 增加缓存时间逻辑
+    struct ArpEntry {
+        var mac: Data
+        var expireTime: TimeInterval
+    }
+    
+    private var coolingDown: [UInt32: Date] = [:]
+    
+    private var known_macs: [UInt32: ArpEntry] = [:]
+    private let arpTTL: TimeInterval
+    
+    private var cleanupTask: Task<Void, Never>?
+    
+    init(arpTTL: TimeInterval = 300) {
+        self.arpTTL = arpTTL
+    }
+    
+    func start() {
+        guard self.cleanupTask == nil else {
+            return
+        }
+        
+        self.cleanupTask = Task { [weak self] in
+            while !Task.isCancelled {
+                try? await Task.sleep(for: .seconds(1))
+                await self?.cleanup()
+            }
+        }
+    }
+    
+    func query(ip: UInt32) -> Data? {
+        guard let entry = known_macs[ip] else {
+            return nil
+        }
+        
+        if entry.expireTime < Date().timeIntervalSince1970 {
+            known_macs.removeValue(forKey: ip)
+            return nil
+        }
+        
+        return entry.mac
+    }
+    
+    func append(ip: UInt32, mac: Data) {
+        let expireAt = Date().timeIntervalSince1970 + arpTTL
+        self.known_macs[ip] = ArpEntry(mac: mac, expireTime: expireAt)
+    }
+    
+    func remove(ip: UInt32) {
+        self.known_macs.removeValue(forKey: ip)
+    }
+    
+    func dropMacs(macs: [Data]) {
+        self.known_macs = self.known_macs.filter { !macs.contains($0.value.mac) }
+    }
+    
+    func clear() {
+        self.known_macs = [:]
+        self.coolingDown = [:]
+    }
+
+    func stop() {
+        self.cleanupTask?.cancel()
+        self.cleanupTask = nil
+        self.clear()
+    }
+
+    func makeArpRequest(targetIp: UInt32) throws -> Data? {
+        guard self.coolingDown[targetIp] == nil else {
+            return nil
+        }
+
+        self.coolingDown[targetIp] = Date().addingTimeInterval(3)
+
+        var arpRequest = SDLArpRequest()
+        arpRequest.targetIp = targetIp
+
+        return try arpRequest.serializedData()
+    }
+    
+    func handleArpResponse(arpResponse: SDLArpResponse) {
+        let targetIp = arpResponse.targetIp
+        let targetMac = arpResponse.targetMac
+        if !targetMac.isEmpty {
+            let expireAt = Date().timeIntervalSince1970 + arpTTL
+            self.known_macs[targetIp] = ArpEntry(mac: targetMac, expireTime: expireAt)
+        }
+    }
+    
+    private func cleanup() {
+        let now = Date()
+        self.coolingDown = self.coolingDown.filter { $0.value > now }
+    }
+    
+    deinit {
+        self.cleanupTask?.cancel()
+    }
+    
+}

Tun/Punchnet/Actors/SDLDNSClientActor.swift

@@ -1,117 +0,0 @@
-//
-//  DNSClient.swift
-//  Tun
-//
-//  Created by 安礼成 on 2025/12/10.
-//
-
-import Foundation
-import NIOCore
-import NIOPosix
-
-// 处理和sn-server服务器之间的通讯
-@available(macOS 14, *)
-actor SDLDNSClientActor {
-    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    private let asyncChannel: NIOAsyncChannel<AddressedEnvelope<ByteBuffer>, AddressedEnvelope<ByteBuffer>>
-    private let (writeStream, writeContinuation) = AsyncStream.makeStream(of: Data.self, bufferingPolicy: .unbounded)
-    
-    private let logger: SDLLogger
-    private let dnsServerAddress: SocketAddress
-    
-    public let packetFlow: AsyncStream<Data>
-    private let packetContinuation: AsyncStream<Data>.Continuation
-
-    // 启动函数
-    init(dnsServerAddress: SocketAddress, logger: SDLLogger) async throws {
-        self.dnsServerAddress = dnsServerAddress
-        self.logger = logger
-        
-        (self.packetFlow, self.packetContinuation) = AsyncStream.makeStream(of: Data.self, bufferingPolicy: .unbounded)
-        
-        let bootstrap = DatagramBootstrap(group: group)
-            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
-        
-        self.asyncChannel = try await bootstrap.bind(host: "0.0.0.0", port: 0)
-            .flatMapThrowing { channel in
-                return try NIOAsyncChannel(wrappingChannelSynchronously: channel, configuration: .init(
-                    inboundType: AddressedEnvelope<ByteBuffer>.self,
-                    outboundType: AddressedEnvelope<ByteBuffer>.self
-                ))
-            }
-            .get()
-    }
-    
-    func start() async throws {
-        try await withTaskCancellationHandler {
-            try await self.asyncChannel.executeThenClose {inbound, outbound in
-                try await withThrowingTaskGroup(of: Void.self) { group in
-                    group.addTask {
-                        defer {
-                            self.logger.log("[DNSClient] inbound closed", level: .warning)
-                        }
-                        
-                        for try await envelope in inbound {
-                            try Task.checkCancellation()
-                            var buffer = envelope.data
-                            let remoteAddress = envelope.remoteAddress
-                            self.logger.log("[DNSClient] read data: \(buffer), from: \(remoteAddress)", level: .debug)
-                            
-                            let len = buffer.readableBytes
-                            if let bytes = buffer.readBytes(length: len) {
-                                self.packetContinuation.yield(Data(bytes))
-                            }
-                        }
-                    }
-                    
-                    group.addTask {
-                        defer {
-                            self.logger.log("[DNSClient] outbound closed", level: .warning)
-                        }
-                        
-                        for await message in self.writeStream {
-                            try Task.checkCancellation()
-                            
-                            let buffer = self.asyncChannel.channel.allocator.buffer(bytes: message)
-                            let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: self.dnsServerAddress, data: buffer)
-                            try await outbound.write(envelope)
-                        }
-                    }
-                    
-                    if let _ = try await group.next() {
-                        group.cancelAll()
-                    }
-                }
-            }
-        } onCancel: {
-            self.writeContinuation.finish()
-            self.packetContinuation.finish()
-            self.logger.log("[DNSClient] withTaskCancellationHandler cancel")
-        }
-    }
-    
-    func forward(ipPacket: IPPacket) {
-        self.writeContinuation.yield(ipPacket.data)
-    }
-    
-    deinit {
-        try? self.group.syncShutdownGracefully()
-        self.writeContinuation.finish()
-    }
-    
-}
-
-extension SDLDNSClientActor {
-    
-    struct Helper {
-        static let dnsServer: String = "100.100.100.100"
-        // dns请求包的目标地址
-        static let dnsDestIpAddr: UInt32 = 1684300900
-        
-        // 判断是否是dns请求的数据包
-        static func isDnsRequestPacket(ipPacket: IPPacket) -> Bool {
-            return ipPacket.header.destination == dnsDestIpAddr
-        }
-    }
-    
-}

Tun/Punchnet/Actors/SDLNATProberActor.swift

@@ -0,0 +1,202 @@
+//
+//  SDLNATProberActor.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/28.
+//
+import Foundation
+import NIOCore
+
+actor SDLNATProberActor {
+
+    // MARK: - NAT Type
+
+    enum NatType: UInt8, Encodable {
+        case blocked = 0
+        case noNat = 1
+        case fullCone = 2
+        case portRestricted = 3
+        case coneRestricted = 4
+        case symmetric = 5
+    }
+
+    // MARK: - Internal State
+    
+    class ProbeSession {
+        var cookieId: UInt32
+        // 建立step -> SDLStunProbeReply的映射关系
+        var replies: [UInt32: SDLStunProbeReply]
+        var timeoutTask: Task<Void, Never>?
+        var sendTask: Task<Void, Never>?
+        var continuation: CheckedContinuation<NatType, Never>
+        
+        private var isFinished: Bool = false
+        
+        init(cookieId: UInt32, timeoutTask: Task<Void, Never>? = nil, continuation: CheckedContinuation<NatType, Never>) {
+            self.cookieId = cookieId
+            self.replies = [:]
+            self.timeoutTask = timeoutTask
+            self.continuation = continuation
+        }
+        
+        func finished(with type: NatType) {
+            guard !isFinished else {
+                return
+            }
+            
+            self.continuation.resume(returning: type)
+            // 取消定时器
+            self.timeoutTask?.cancel()
+            self.sendTask?.cancel()
+            self.isFinished = true
+        }
+    }
+
+    // MARK: - Dependencies
+
+    nonisolated private let addressArray: [[SocketAddress]]
+
+    // MARK: - Completion
+    private var cookieId: UInt32 = 1
+    
+    private var sessions: [UInt32: ProbeSession] = [:]
+    
+    // MARK: - Init
+
+    init(addressArray: [[SocketAddress]]) {
+        self.addressArray = addressArray
+    }
+
+    // MARK: - Public API
+    
+    func probeNatType(using udpHole: SDLUDPHole) async -> NatType {
+        if Task.isCancelled {
+            return .blocked
+        }
+
+        let cookieId = self.cookieId
+        self.cookieId &+= 1
+        
+        return await withCheckedContinuation { continuation in
+            let timeoutTask = Task {
+                try? await Task.sleep(nanoseconds: 5_000_000_000)
+                await self.handleTimeout(cookie: cookieId)
+            }
+            
+            let session = ProbeSession(
+                cookieId: cookieId,
+                timeoutTask: timeoutTask,
+                continuation: continuation
+            )
+            self.sessions[cookieId] = session
+            session.sendTask = Task {
+                await self.sendProbe(using: udpHole, cookie: cookieId)
+            }
+        }
+    }
+    
+    /// UDP 层收到 STUN 响应后调用
+    func handleProbeReply(localAddress: SocketAddress?, reply: SDLStunProbeReply) async {
+        guard let session = self.sessions[reply.cookie] else {
+            return
+        }
+        
+        session.replies[reply.step] = reply
+        
+        // 提前退出的情况，没有nat映射
+        if session.replies[1] != nil {
+            if await reply.socketAddress() == localAddress {
+                finish(cookie: session.cookieId, .noNat)
+                return
+            }
+        }
+        
+        if let step1 = session.replies[1], let step2 = session.replies[2] {
+            // 如果natAddress2 的IP地址与上次回来的IP是不一样的，它就是对称型NAT; 这次的包也一定能发成功并收到
+            // 如果ip地址变了，这说明{dstIp, dstPort, srcIp, srcPort}, 其中有一个变了；则用新的ip地址
+            if let addr1 = await step1.socketAddress(), let addr2 = await step2.socketAddress(), addr1 != addr2 {
+                finish(cookie: session.cookieId, .symmetric)
+                return
+            }
+        }
+        
+        // 收到了所有的响应, 优先判断
+        if session.replies[1] != nil && session.replies[2] != nil && session.replies[3] != nil && session.replies[4] != nil {
+            // step3: ip2:port2 <---- ip1:port1 (ip地址和port都变的情况)
+            // 如果能收到的，说明是完全锥形 说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
+            if session.replies[3] != nil {
+                finish(cookie: session.cookieId, .fullCone)
+                return
+            }
+            
+            // step3: ip1:port1 <---- ip1:port2 (port改变情况)
+            // 如果能收到的说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
+            if session.replies[4] != nil {
+                finish(cookie: session.cookieId, .coneRestricted)
+                return
+            }
+        }
+    }
+
+    func cancelAll() {
+        let sessions = self.sessions
+        self.sessions.removeAll()
+        sessions.values.forEach { session in
+            session.finished(with: .blocked)
+        }
+    }
+    
+    /// 超时事件（由外部 Timer / Task 驱动）
+    private func handleTimeout(cookie: UInt32) async {
+        guard let session = self.sessions[cookie] else {
+            return
+        }
+        
+        if session.replies[1] == nil {
+            finish(cookie: cookie, .blocked)
+        } else if session.replies[3] != nil {
+            finish(cookie: cookie, .fullCone)
+        } else if session.replies[4] != nil {
+            finish(cookie: cookie, .coneRestricted)
+        } else {
+            finish(cookie: cookie, .portRestricted)
+        }
+    }
+    
+    private func finish(cookie: UInt32, _ type: NatType) {
+        if let session = self.sessions.removeValue(forKey: cookie) {
+            session.finished(with: type)
+        }
+    }
+
+    // MARK: - Internal helpers
+
+    private func sendProbe(using udpHole: SDLUDPHole, cookie: UInt32) async {
+        guard !Task.isCancelled else {
+            return
+        }
+        await udpHole.send(type: .stunProbe, data: makeProbePacket(cookieId: cookie, step: 1, attr: .none), remoteAddress: addressArray[0][0])
+        guard !Task.isCancelled else {
+            return
+        }
+        await udpHole.send(type: .stunProbe, data: makeProbePacket(cookieId: cookie, step: 2, attr: .none), remoteAddress: addressArray[1][1])
+        guard !Task.isCancelled else {
+            return
+        }
+        await udpHole.send(type: .stunProbe, data: makeProbePacket(cookieId: cookie, step: 3, attr: .peer), remoteAddress: addressArray[0][0])
+        guard !Task.isCancelled else {
+            return
+        }
+        await udpHole.send(type: .stunProbe, data: makeProbePacket(cookieId: cookie, step: 4, attr: .port), remoteAddress: addressArray[0][0])
+    }
+    
+    private func makeProbePacket(cookieId: UInt32, step: UInt32, attr: SDLProbeAttr) -> Data {
+        var stunProbe = SDLStunProbe()
+        stunProbe.cookie = cookieId
+        stunProbe.step = step
+        stunProbe.attr = UInt32(attr.rawValue)
+        
+        return try! stunProbe.serializedData()
+    }
+    
+}

Tun/Punchnet/Actors/SDLPuncherActor.swift

@@ -6,17 +6,13 @@
 //
 
 import Foundation
+import NIOCore
 
 actor SDLPuncherActor {
-    // dstMac
+    // 10秒内只需要提交一次查询
-    private var coolingDown: Set<Data> = []
+    nonisolated private let cooldownInterval: TimeInterval = 10
-    private let cooldown: Duration = .seconds(5)
+    // 等待peerInfo返回的超时时间
-    
+    nonisolated private let peerInfoTimeout: TimeInterval = 3
-    private var superClientActor: SDLSuperClientActor?
-    private var udpHoleActor: SDLUDPHoleActor?
-    
-    // 处理holer
-    private var logger: SDLLogger
 
     struct RegisterRequest {
         let srcMac: Data
@@ -24,66 +20,120 @@ actor SDLPuncherActor {
         let networkId: UInt32
     }
     
-    init(logger: SDLLogger) {
+    private enum RequestPhase {
-        self.logger = logger
+        case waitingPeerInfo(deadline: Date)
+        case coolingDown
     }
     
-    func setSuperClientActor(superClientActor: SDLSuperClientActor?) {
+    private struct RequestEntry {
-        self.superClientActor = superClientActor
+        let request: RegisterRequest
+        let cooldownUntil: Date
+        var phase: RequestPhase
+        
+        func canSubmit(at now: Date) -> Bool {
+            return cooldownUntil <= now
         }
         
-    func setUDPHoleActor(udpHoleActor: SDLUDPHoleActor?) {
+        func isWaitingPeerInfo(at now: Date) -> Bool {
-        self.udpHoleActor = udpHoleActor
+            guard case .waitingPeerInfo(let deadline) = self.phase else {
+                return false
             }
             
-    func submitRegisterRequest(request: RegisterRequest) {
+            return deadline > now
-        let dstMac = request.dstMac
+        }
         
-        guard !coolingDown.contains(dstMac) else {
+        mutating func markCoolingDown() {
+            self.phase = .coolingDown
+        }
+    }
+    
+    // dstMac
+    private var requestEntries: [Data: RequestEntry] = [:]
+    private var cleanupTask: Task<Void, Never>?
+    
+    func start() {
+        guard self.cleanupTask == nil else {
             return
         }
         
-        // 触发一次打洞
+        self.cleanupTask = Task { [weak self] in
-        coolingDown.insert(dstMac)
+            while !Task.isCancelled {
-        
+                try? await Task.sleep(for: .seconds(1))
-        Task {
+                await self?.cleanupExpiredEntries()
-            await self.tryHole(request: request)
+            }
-            // 启动冷却期
-            try? await Task.sleep(for: .seconds(5))
-            self.endCooldown(for: dstMac)
         }
     }
     
-    private func endCooldown(for key: Data) {
+    func makeQueryInfoRequest(request: RegisterRequest) async -> Data? {
-        self.coolingDown.remove(key)
+        let now = Date()
+        self.cleanupExpiredEntries(now: now)
+
+        if let entry = self.requestEntries[request.dstMac], !entry.canSubmit(at: now) {
+            return nil
         }
 
-    private func tryHole(request: RegisterRequest) async {
         var queryInfo = SDLQueryInfo()
         queryInfo.dstMac = request.dstMac
-        guard let message = try? await self.superClientActor?.request(type: .queryInfo, data: try queryInfo.serializedData()) else {
+
-            return
+        guard let queryData = try? queryInfo.serializedData() else {
+            SDLLogger.log("[SDLPuncherActor] failed to encode queryInfo", for: .debug)
+            return nil
         }
 
-        switch message.packet {
+        self.requestEntries[request.dstMac] = RequestEntry(
-        case .empty:
+            request: request,
-            self.logger.log("[SDLContext] hole query_info get empty: \(message)", level: .debug)
+            cooldownUntil: now.addingTimeInterval(self.cooldownInterval),
-        case .peerInfo(let peerInfo):
+            phase: .waitingPeerInfo(deadline: now.addingTimeInterval(self.peerInfoTimeout))
-            if let remoteAddress = peerInfo.v4Info.socketAddress() {
+        )
-                self.logger.log("[SDLContext] hole sock address: \(remoteAddress)", level: .debug)
+
-                // 发送register包
+        return queryData
+    }
+
+    func makeRegisterPackets(peerInfo: SDLPeerInfo) async -> [(data: Data, remoteAddress: SocketAddress)] {
+        let now = Date()
+        self.cleanupExpiredEntries(now: now)
+
+        guard var entry = self.requestEntries[peerInfo.dstMac], entry.isWaitingPeerInfo(at: now) else {
+            return []
+        }
+
+        entry.markCoolingDown()
+        self.requestEntries[peerInfo.dstMac] = entry
+
         var register = SDLRegister()
-                register.networkID = request.networkId
+        register.networkID = entry.request.networkId
-                register.srcMac = request.srcMac
+        register.srcMac = entry.request.srcMac
-                register.dstMac = request.dstMac
+        register.dstMac = entry.request.dstMac
 
-                await self.udpHoleActor?.send(type: .register, data: try! register.serializedData(), remoteAddress: remoteAddress)
+        guard let registerData = try? register.serializedData() else {
-            } else {
+            SDLLogger.log("[SDLPuncherActor] failed to encode register", for: .debug)
-                self.logger.log("[SDLContext] hole sock address is invalid: \(peerInfo.v4Info)", level: .warning)
+            return []
         }
-        default:
+
-            self.logger.log("[SDLContext] hole query_info is packet: \(message)", level: .warning)
+        var packets: [(data: Data, remoteAddress: SocketAddress)] = []
+        if peerInfo.hasV4Info, let remoteAddress = try? await peerInfo.v4Info.socketAddress() {
+            packets.append((data: registerData, remoteAddress: remoteAddress))
+        }
+        if peerInfo.hasV6Info, let remoteAddress = try? await peerInfo.v6Info.socketAddress() {
+            packets.append((data: registerData, remoteAddress: remoteAddress))
+        }
+
+        return packets
+    }
+    
+    func stop() {
+        self.cleanupTask?.cancel()
+        self.cleanupTask = nil
+        self.requestEntries.removeAll()
+    }
+    
+    private func cleanupExpiredEntries(now: Date = Date()) {
+        self.requestEntries = self.requestEntries.filter { _, entry in
+            !entry.canSubmit(at: now)
         }
     }
     
+    deinit {
+        self.cleanupTask?.cancel()
+    }
 }

Tun/Punchnet/Actors/SDLSuperClientActor.swift

@@ -1,312 +0,0 @@
-//
-//  SDLWebsocketClient.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/3/28.
-//
-
-import Foundation
-import NIOCore
-import NIOPosix
-
-// --MARK: 和SuperNode的客户端
-actor SDLSuperClientActor {
-    // 发送的消息格式
-    private typealias TcpMessage = (packetId: UInt32, type: SDLPacketType, data: Data)
-    
-    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    private let asyncChannel: NIOAsyncChannel<ByteBuffer,ByteBuffer>
-    private let (writeStream, writeContinuation) = AsyncStream.makeStream(of: TcpMessage.self, bufferingPolicy: .unbounded)
-    private var continuations: [UInt32:CheckedContinuation<SDLSuperInboundMessage, Error>] = [:]
-
-    public let eventFlow: AsyncStream<SuperEvent>
-    private let inboundContinuation: AsyncStream<SuperEvent>.Continuation
-    
-    // id生成器
-    var idGenerator = SDLIdGenerator(seed: 1)
-    
-    private let logger: SDLLogger
-    
-    // 定义事件类型
-    enum SuperEvent {
-        case ready
-        case event(SDLEvent)
-        case command(UInt32, SDLCommand)
-    }
-    
-    enum SuperClientError: Error {
-        case timeout
-        case connectionClosed
-        case cancelled
-    }
-    
-    init(host: String, port: Int, logger: SDLLogger) async throws {
-        self.logger = logger
-        
-        (self.eventFlow, self.inboundContinuation) = AsyncStream.makeStream(of: SuperEvent.self, bufferingPolicy: .unbounded)
-        let bootstrap = ClientBootstrap(group: self.group)
-            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
-            .channelInitializer { channel in
-                return channel.pipeline.addHandlers([
-                    ByteToMessageHandler(FixedHeaderDecoder()),
-                    MessageToByteHandler(FixedHeaderEncoder())
-                ])
-            }
-        
-        self.asyncChannel = try await bootstrap.connect(host: host, port: port)
-            .flatMapThrowing { channel in
-                return try NIOAsyncChannel(wrappingChannelSynchronously: channel, configuration: .init(
-                    inboundType: ByteBuffer.self,
-                    outboundType: ByteBuffer.self
-                ))
-            }
-            .get()
-    }
-    
-    func start() async throws {
-        try await withTaskCancellationHandler {
-            try await self.asyncChannel.executeThenClose { inbound, outbound in
-                self.inboundContinuation.yield(.ready)
-                
-                try await withThrowingTaskGroup(of: Void.self) { group in
-                    group.addTask {
-                        defer {
-                            self.logger.log("[SDLSuperClient] inbound closed", level: .warning)
-                        }
-                        
-                        for try await var packet in inbound {
-                            try Task.checkCancellation()
-                            
-                            if let message = SDLSuperClientDecoder.decode(buffer: &packet) {
-                                if !message.isPong() {
-                                    self.logger.log("[SDLSuperClient] read message: \(message)", level: .debug)
-                                }
-                                
-                                switch message.packet {
-                                case .event(let event):
-                                    self.inboundContinuation.yield(.event(event))
-                                case .command(let command):
-                                    self.inboundContinuation.yield(.command(message.msgId, command))
-                                default:
-                                    await self.fireCallback(message: message)
-                                }
-                            }
-                        }
-                    }
-                    
-                    group.addTask {
-                        defer {
-                            self.logger.log("[SDLSuperClient] outbound closed", level: .warning)
-                        }
-                        
-                        for await (packetId, type, data) in self.writeStream {
-                            try Task.checkCancellation()
-                            
-                            var buffer = self.asyncChannel.channel.allocator.buffer(capacity: data.count + 5)
-                            buffer.writeInteger(packetId, as: UInt32.self)
-                            buffer.writeBytes([type.rawValue])
-                            buffer.writeBytes(data)
-                            try await outbound.write(buffer)
-                        }
-                    }
-                    
-                    // --MARK: 心跳机制
-                    group.addTask {
-                        defer {
-                            self.logger.log("[SDLSuperClient] ping task closed", level: .warning)
-                        }
-                        
-                        while true {
-                            try Task.checkCancellation()
-                            await self.ping()
-                            try await Task.sleep(nanoseconds: 5 * 1_000_000_000)
-                        }
-                    }
-                    
-                    // 迭代等待所有任务的退出, 第一个异常会被抛出
-                    if let _ = try await group.next() {
-                        group.cancelAll()
-                    }
-                }
-            }
-        } onCancel: {
-            self.inboundContinuation.finish()
-            self.writeContinuation.finish()
-            self.logger.log("[SDLSuperClient] withTaskCancellationHandler cancel")
-            Task {
-                await self.failAllContinuations(SuperClientError.cancelled)
-            }
-        }
-    }
-    
-    // -- MARK: apis
-    func unregister() throws {
-        self.send(type: .unregisterSuper, packetId: 0, data: Data())
-    }
-    
-    private func ping() {
-        self.send(type: .ping, packetId: 0, data: Data())
-    }
-    
-    func request(type: SDLPacketType, data: Data, timeout: Duration = .seconds(5)) async throws -> SDLSuperInboundMessage {
-        let packetId = idGenerator.nextId()
-        
-        return try await withCheckedThrowingContinuation { cont in
-            self.continuations[packetId] = cont
-            self.writeContinuation.yield(TcpMessage(packetId: packetId, type: type, data: data))
-            Task {
-                try? await Task.sleep(for: timeout)
-                self.timeout(packetId: packetId)
-            }
-        }
-    }
-    
-    func send(type: SDLPacketType, packetId: UInt32, data: Data) {
-        self.writeContinuation.yield(TcpMessage(packetId: packetId, type: type, data: data))
-    }
-    
-    // 处理回调函数
-    private func fireCallback(message: SDLSuperInboundMessage) {
-        guard let cont = self.continuations.removeValue(forKey: message.msgId) else {
-            return
-        }
-        cont.resume(returning: message)
-    }
-    
-    private func failAllContinuations(_ error: Error) {
-        let all = continuations
-        continuations.removeAll()
-
-        for (_, cont) in all {
-            cont.resume(throwing: error)
-        }
-    }
-    
-    private func timeout(packetId: UInt32) {
-        guard let cont = self.continuations.removeValue(forKey: packetId) else {
-            return
-        }
-        cont.resume(throwing: SuperClientError.timeout)
-    }
-    
-    deinit {
-        try! group.syncShutdownGracefully()
-    }
-    
-}
-
-// --MARK: 编解码器
-private struct SDLSuperClientDecoder {
-    // 消息格式为: <<MsgId:32, Type:8, Body/binary>>
-    static func decode(buffer: inout ByteBuffer) -> SDLSuperInboundMessage? {
-        guard let msgId = buffer.readInteger(as: UInt32.self),
-              let type = buffer.readInteger(as: UInt8.self),
-              let messageType = SDLPacketType(rawValue: type) else {
-            return nil
-        }
-        
-        switch messageType {
-        case .empty:
-            return .init(msgId: msgId, packet: .empty)
-        case .registerSuperAck:
-            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
-                  let registerSuperAck = try? SDLRegisterSuperAck(serializedBytes: bytes) else {
-                return nil
-            }
-            return .init(msgId: msgId, packet: .registerSuperAck(registerSuperAck))
-            
-        case .registerSuperNak:
-            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
-                  let registerSuperNak = try? SDLRegisterSuperNak(serializedBytes: bytes) else {
-                return nil
-            }
-            return .init(msgId: msgId, packet: .registerSuperNak(registerSuperNak))
-            
-        case .peerInfo:
-            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
-                  let peerInfo = try? SDLPeerInfo(serializedBytes: bytes) else {
-                return nil
-            }
-            
-            return .init(msgId: msgId, packet: .peerInfo(peerInfo))
-        case .pong:
-            return .init(msgId: msgId, packet: .pong)
-            
-        case .command:
-            guard let commandVal = buffer.readInteger(as: UInt8.self),
-                  let command = SDLCommandType(rawValue: commandVal),
-                  let bytes = buffer.readBytes(length: buffer.readableBytes) else {
-                return nil
-            }
-            
-            switch command {
-            case .changeNetwork:
-                guard let changeNetworkCommand = try? SDLChangeNetworkCommand(serializedBytes: bytes) else {
-                    return nil
-                }
-                
-                return .init(msgId: msgId, packet: .command(.changeNetwork(changeNetworkCommand)))
-            }
-            
-        case .event:
-            guard let eventVal = buffer.readInteger(as: UInt8.self),
-                  let event = SDLEventType(rawValue: eventVal),
-                  let bytes = buffer.readBytes(length: buffer.readableBytes) else {
-                return nil
-            }
-            
-            switch event {
-            case .natChanged:
-                guard let natChangedEvent = try? SDLNatChangedEvent(serializedBytes: bytes) else {
-                    return nil
-                }
-                return .init(msgId: msgId, packet: .event(.natChanged(natChangedEvent)))
-            case .sendRegister:
-                guard let sendRegisterEvent = try? SDLSendRegisterEvent(serializedBytes: bytes) else {
-                    return nil
-                }
-                return .init(msgId: msgId, packet: .event(.sendRegister(sendRegisterEvent)))
-            case .networkShutdown:
-                guard let networkShutdownEvent = try? SDLNetworkShutdownEvent(serializedBytes: bytes) else {
-                    return nil
-                }
-                return .init(msgId: msgId, packet: .event(.networkShutdown(networkShutdownEvent)))
-            }
-            
-        default:
-            return nil
-        }
-    }
-}
-
-private final class FixedHeaderEncoder: MessageToByteEncoder, @unchecked Sendable {
-    typealias InboundIn = ByteBuffer
-    typealias InboundOut = ByteBuffer
-    
-    func encode(data: ByteBuffer, out: inout ByteBuffer) throws {
-        let len = data.readableBytes
-        out.writeInteger(UInt16(len))
-        out.writeBytes(data.readableBytesView)
-    }
-}
-
-private final class FixedHeaderDecoder: ByteToMessageDecoder, @unchecked Sendable {
-    typealias InboundIn = ByteBuffer
-    typealias InboundOut = ByteBuffer
-    
-    func decode(context: ChannelHandlerContext, buffer: inout ByteBuffer) throws -> DecodingState {
-        guard let len = buffer.getInteger(at: buffer.readerIndex, endianness: .big, as: UInt16.self) else {
-            return .needMoreData
-        }
-        
-        if buffer.readableBytes >= len + 2 {
-            buffer.moveReaderIndex(forwardBy: 2)
-            if let bytes = buffer.readBytes(length: Int(len)) {
-                context.fireChannelRead(self.wrapInboundOut(ByteBuffer(bytes: bytes)))
-            }
-            return .continue
-        } else {
-            return .needMoreData
-        }
-    }
-}

Tun/Punchnet/Actors/SDLTunnelProviderActor.swift

@@ -1,89 +0,0 @@
-//
-//  SDLContext.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/2/29.
-//
-
-import Foundation
-import NetworkExtension
-import NIOCore
-import Combine
-
-// 上下文环境变量，全局共享
-/*
-1. 处理rsa的加解密逻辑
- */
-
-actor SDLTunnelProviderActor {
-    
-    // 路由信息
-    struct Route {
-        let dstAddress: String
-        let subnetMask: String
-        
-        var debugInfo: String {
-            return "\(dstAddress):\(subnetMask)"
-        }
-    }
-    
-    // 数据包读取任务
-    private var readTask: Task<(), Never>?
-    
-    let provider: NEPacketTunnelProvider
-    let logger: SDLLogger
-    
-    public init(provider: NEPacketTunnelProvider, logger: SDLLogger) {
-        self.logger = logger
-        self.provider = provider
-    }
-    
-    func writePackets(packets: [NEPacket]) {
-        //let packet = NEPacket(data: ipPacket.data, protocolFamily: 2)
-        self.provider.packetFlow.writePacketObjects(packets)
-    }
-    
-    // 网络改变时需要重新配置网络信息
-    func setNetworkSettings(devAddr: SDLDevAddr, dnsServer: String) async throws -> String {
-        let netAddress = SDLNetAddress(ip: devAddr.netAddr, maskLen: UInt8(devAddr.netBitLen))
-        let routes = [
-            Route(dstAddress: netAddress.networkAddress, subnetMask: netAddress.maskAddress),
-            Route(dstAddress: dnsServer, subnetMask: "255.255.255.255")
-        ]
-        
-        // Add code here to start the process of connecting the tunnel.
-        let networkSettings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "8.8.8.8")
-        networkSettings.mtu = 1460
-        
-        // 设置网卡的DNS解析
-        
-        let networkDomain = devAddr.networkDomain
-        let dnsSettings = NEDNSSettings(servers: [dnsServer])
-        dnsSettings.searchDomains = [networkDomain]
-        dnsSettings.matchDomains = [networkDomain]
-        dnsSettings.matchDomainsNoSearch = false
-        networkSettings.dnsSettings = dnsSettings
-        self.logger.log("[SDLContext] Tun started at network ip: \(netAddress.ipAddress), mask: \(netAddress.maskAddress)", level: .info)
-        
-        let ipv4Settings = NEIPv4Settings(addresses: [netAddress.ipAddress], subnetMasks: [netAddress.maskAddress])
-        // 设置路由表
-        //NEIPv4Route.default()
-        ipv4Settings.includedRoutes = routes.map { route in
-            NEIPv4Route(destinationAddress: route.dstAddress, subnetMask: route.subnetMask)
-        }
-        networkSettings.ipv4Settings = ipv4Settings
-        // 网卡配置设置必须成功
-        try await self.provider.setTunnelNetworkSettings(networkSettings)
-        
-        return netAddress.ipAddress
-    }
-    
-    // 开始读取数据, 用单独的线程处理packetFlow
-    func readPackets() async -> [Data] {
-        let (packets, numbers) = await self.provider.packetFlow.readPackets()
-        return zip(packets, numbers).compactMap { (data, number) in
-            return number == 2 ? data : nil
-        }
-    }
-    
-}

Tun/Punchnet/Actors/SDLUDPHoleActor.swift

@@ -1,210 +0,0 @@
-//
-//  SDLanServer.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/1/31.
-//
-
-import Foundation
-import NIOCore
-import NIOPosix
-
-// 处理和sn-server服务器之间的通讯
-actor SDLUDPHoleActor {
-    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    private let asyncChannel: NIOAsyncChannel<AddressedEnvelope<ByteBuffer>, AddressedEnvelope<ByteBuffer>>
-    private let (writeStream, writeContinuation) = AsyncStream.makeStream(of: UDPMessage.self, bufferingPolicy: .unbounded)
-    
-    private var cookieGenerator = SDLIdGenerator(seed: 1)
-    private var promises: [UInt32:EventLoopPromise<SDLStunProbeReply>] = [:]
-    public var localAddress: SocketAddress?
-    
-    public let eventFlow: AsyncStream<UDPEvent>
-    private let eventContinuation: AsyncStream<UDPEvent>.Continuation
-    
-    private let logger: SDLLogger
-    
-    // 依赖的外表能力
-    struct Capabilities {
-        let logger: @Sendable (String) async -> Void
-        
-    }
-    
-    struct UDPMessage {
-        let remoteAddress: SocketAddress
-        let type: SDLPacketType
-        let data: Data
-    }
-
-    // 定义事件类型
-    enum UDPEvent {
-        case ready
-        case message(SocketAddress, SDLHoleInboundMessage)
-        case data(SDLData)
-    }
-    
-    // 启动函数
-    init(logger: SDLLogger) async throws {
-        self.logger = logger
-        
-        (self.eventFlow, self.eventContinuation) = AsyncStream.makeStream(of: UDPEvent.self, bufferingPolicy: .unbounded)
-        
-        let bootstrap = DatagramBootstrap(group: group)
-            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
-        
-        self.asyncChannel = try await bootstrap.bind(host: "0.0.0.0", port: 0)
-            .flatMapThrowing { channel in
-                return try NIOAsyncChannel(wrappingChannelSynchronously: channel, configuration: .init(
-                    inboundType: AddressedEnvelope<ByteBuffer>.self,
-                    outboundType: AddressedEnvelope<ByteBuffer>.self
-                ))
-            }
-            .get()
-        
-        self.localAddress = self.asyncChannel.channel.localAddress
-        self.logger.log("[UDPHole] started and listening on: \(self.localAddress!)", level: .debug)
-    }
-    
-    func start() async throws {
-        try await withTaskCancellationHandler {
-            try await self.asyncChannel.executeThenClose {inbound, outbound in
-                self.eventContinuation.yield(.ready)
-                try await withThrowingTaskGroup(of: Void.self) { group in
-                    group.addTask {
-                        defer {
-                            self.logger.log("[SDLUDPHole] inbound closed", level: .warning)
-                        }
-                        
-                        for try await envelope in inbound {
-                            try Task.checkCancellation()
-                            
-                            var buffer = envelope.data
-                            let remoteAddress = envelope.remoteAddress
-                            do {
-                                if let message = try Self.decode(buffer: &buffer) {
-                                    switch message {
-                                    case .data(let data):
-                                        self.logger.log("[SDLUDPHole] read data: \(data.format()), from: \(remoteAddress)", level: .debug)
-                                        self.eventContinuation.yield(.data(data))
-                                    case .stunProbeReply(let probeReply):
-                                        // 执行并移除回调
-                                        await self.trigger(probeReply: probeReply)
-                                    default:
-                                        self.eventContinuation.yield(.message(remoteAddress, message))
-                                    }
-                                } else {
-                                    self.logger.log("[SDLUDPHole] decode message, get null", level: .warning)
-                                }
-                            } catch let err {
-                                self.logger.log("[SDLUDPHole] decode message, get error: \(err)", level: .warning)
-                                throw err
-                            }
-                        }
-                    }
-                    
-                    group.addTask {
-                        defer {
-                            self.logger.log("[SDLUDPHole] outbound closed", level: .warning)
-                        }
-                        
-                        for await message in self.writeStream {
-                            try Task.checkCancellation()
-                            
-                            var buffer = self.asyncChannel.channel.allocator.buffer(capacity: message.data.count + 1)
-                            buffer.writeBytes([message.type.rawValue])
-                            buffer.writeBytes(message.data)
-                            
-                            let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: message.remoteAddress, data: buffer)
-                            try await outbound.write(envelope)
-                        }
-                    }
-                    
-                    if let _ = try await group.next() {
-                        group.cancelAll()
-                    }
-                }
-            }
-        } onCancel: {
-            self.writeContinuation.finish()
-            self.eventContinuation.finish()
-            self.logger.log("[SDLUDPHole] withTaskCancellationHandler cancel")
-        }
-    }
-    
-    func getCookieId() -> UInt32 {
-        return self.cookieGenerator.nextId()
-    }
-    
-    // 探测tun信息
-    func stunProbe(remoteAddress: SocketAddress, attr: SDLProbeAttr = .none, timeout: Int = 5) async throws -> SDLStunProbeReply {
-        return try await self._stunProbe(remoteAddress: remoteAddress, attr: attr, timeout: timeout).get()
-    }
-    
-    private func _stunProbe(remoteAddress: SocketAddress, attr: SDLProbeAttr = .none, timeout: Int) -> EventLoopFuture<SDLStunProbeReply> {
-        let cookie = self.cookieGenerator.nextId()
-        var stunProbe = SDLStunProbe()
-        stunProbe.cookie = cookie
-        stunProbe.attr = UInt32(attr.rawValue)
-        self.send( type: .stunProbe, data: try! stunProbe.serializedData(), remoteAddress: remoteAddress)
-        self.logger.log("[SDLUDPHole] stunProbe: \(remoteAddress)", level: .debug)
-        
-        let promise = self.asyncChannel.channel.eventLoop.makePromise(of: SDLStunProbeReply.self)
-        self.promises[cookie] = promise
-        
-        return promise.futureResult
-    }
-    
-    private func trigger(probeReply: SDLStunProbeReply) {
-        let id = probeReply.cookie
-        // 执行并移除回调
-        if let promise = self.promises[id] {
-            self.asyncChannel.channel.eventLoop.execute {
-                promise.succeed(probeReply)
-            }
-            self.promises.removeValue(forKey: id)
-        }
-    }
-    
-    // MARK: client-client apis
-    // 处理写入逻辑
-    func send(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) {
-        let message = UDPMessage(remoteAddress: remoteAddress, type: type, data: data)
-        self.writeContinuation.yield(message)
-    }
-    
-    //--MARK: 编解码器
-    private static func decode(buffer: inout ByteBuffer) throws -> SDLHoleInboundMessage? {
-        guard let type = buffer.readInteger(as: UInt8.self),
-              let packetType = SDLPacketType(rawValue: type),
-              let bytes = buffer.readBytes(length: buffer.readableBytes) else {
-            return nil
-        }
-        
-        switch packetType {
-        case .data:
-            let dataPacket = try SDLData(serializedBytes: bytes)
-            return .data(dataPacket)
-        case .register:
-            let registerPacket = try SDLRegister(serializedBytes: bytes)
-            return .register(registerPacket)
-        case .registerAck:
-            let registerAck = try SDLRegisterAck(serializedBytes: bytes)
-            return .registerAck(registerAck)
-        case .stunReply:
-            let stunReply = try SDLStunReply(serializedBytes: bytes)
-            return .stunReply(stunReply)
-        case .stunProbeReply:
-            let stunProbeReply = try SDLStunProbeReply(serializedBytes: bytes)
-            return .stunProbeReply(stunProbeReply)
-        default:
-            return nil
-        }
-    }
-    
-    deinit {
-        try? self.group.syncShutdownGracefully()
-        self.writeContinuation.finish()
-        self.eventContinuation.finish()
-    }
-    
-}

Tun/Punchnet/ArpServer.swift

@@ -1,31 +0,0 @@
-//
-//  ArpServer.swift
-//  sdlan
-//
-//  Created by 安礼成 on 2025/7/14.
-//
-import Foundation
-
-actor ArpServer {
-    private var known_macs: [UInt32:Data] = [:]
-    
-    init(known_macs: [UInt32:Data]) {
-        self.known_macs = known_macs
-    }
-    
-    func query(ip: UInt32) -> Data? {
-        return self.known_macs[ip]
-    }
-    
-    func append(ip: UInt32, mac: Data) {
-        self.known_macs[ip] = mac
-    }
-    
-    func remove(ip: UInt32) {
-        self.known_macs.removeValue(forKey: ip)
-    }
-    
-    func clear() {
-        self.known_macs = [:]
-    }
-}

Tun/Punchnet/AsyncOneShot.swift

@@ -0,0 +1,109 @@
+//
+//  AsyncOneShot.swift
+//  Tun
+//
+//  Created by Codex on 2026/4/28.
+//
+
+import Foundation
+
+enum AsyncOneShotError: Error {
+    case timeout
+}
+
+actor AsyncOneShot<Value: Sendable> {
+    private struct Waiter {
+        let continuation: CheckedContinuation<Value, Error>
+        let timeoutTask: Task<Void, Never>?
+    }
+
+    private var result: Result<Value, Error>?
+    private var waiters: [UUID: Waiter] = [:]
+
+    func wait() async throws -> Value {
+        try await self.waitInternal(timeout: nil, timeoutError: AsyncOneShotError.timeout)
+    }
+
+    func wait(timeout: Duration, timeoutError: Error = AsyncOneShotError.timeout) async throws -> Value {
+        try await self.waitInternal(timeout: timeout, timeoutError: timeoutError)
+    }
+
+    func succeed(_ value: Value) {
+        self.complete(.success(value))
+    }
+
+    func fail(_ error: Error) {
+        self.complete(.failure(error))
+    }
+
+    private func waitInternal(timeout: Duration?, timeoutError: Error) async throws -> Value {
+        let id = UUID()
+
+        return try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { continuation in
+                self.addWaiter(
+                    id: id,
+                    continuation: continuation,
+                    timeout: timeout,
+                    timeoutError: timeoutError
+                )
+            }
+        } onCancel: {
+            Task {
+                await self.cancelWaiter(id: id, throwing: CancellationError())
+            }
+        }
+    }
+
+    private func addWaiter(
+        id: UUID,
+        continuation: CheckedContinuation<Value, Error>,
+        timeout: Duration?,
+        timeoutError: Error
+    ) {
+        if let result {
+            continuation.resume(with: result)
+            return
+        }
+
+        let timeoutTask = timeout.map { timeout in
+            Task {
+                do {
+                    try await Task.sleep(for: timeout)
+                    if !Task.isCancelled {
+                        self.cancelWaiter(id: id, throwing: timeoutError)
+                    }
+                } catch {
+                    return
+                }
+            }
+        }
+
+        self.waiters[id] = Waiter(continuation: continuation, timeoutTask: timeoutTask)
+    }
+
+    private func complete(_ result: Result<Value, Error>) {
+        guard self.result == nil else {
+            return
+        }
+
+        self.result = result
+
+        let waiters = self.waiters
+        self.waiters.removeAll()
+
+        for waiter in waiters.values {
+            waiter.timeoutTask?.cancel()
+            waiter.continuation.resume(with: result)
+        }
+    }
+
+    private func cancelWaiter(id: UUID, throwing error: Error) {
+        guard let waiter = self.waiters.removeValue(forKey: id) else {
+            return
+        }
+
+        waiter.timeoutTask?.cancel()
+        waiter.continuation.resume(throwing: error)
+    }
+}

Tun/Punchnet/Cipher/CCAESChiper.swift

@@ -0,0 +1,27 @@
+//
+//  CCAESChiper.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/17.
+//
+import Foundation
+
+struct CCAESChiper: CCDataCipher {
+    private let aesKey: Data
+    
+    init(key: Data) {
+        self.aesKey = key
+    }
+    
+    func decrypt(cipherText: Data) throws -> Data {
+        let ivData = Data(aesKey.prefix(16))
+        return try CC.crypt(.decrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: cipherText, key: aesKey, iv: ivData)
+    }
+    
+    func encrypt(plainText: Data) throws -> Data {
+        let ivData = Data(aesKey.prefix(16))
+        
+        return try CC.crypt(.encrypt, blockMode: .cbc, algorithm: .aes, padding: .pkcs7Padding, data: plainText, key: aesKey, iv: ivData)
+    }
+    
+}

Tun/Punchnet/Cipher/CCChaCha20Cipher.swift

@@ -0,0 +1,77 @@
+//
+//  NonceGenerator.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/17.
+//
+import Foundation
+import CryptoKit
+
+/// ChaCha20-Poly1305 加解密示例
+struct CCChaCha20Cipher: CCDataCipher {
+    private let key: SymmetricKey
+    private let nonceGenerator: NonceGenerator
+    
+    init(regionId: UInt32, keyData: Data) {
+        self.key = SymmetricKey(data: keyData)
+        self.nonceGenerator = NonceGenerator(regionId: regionId)
+    }
+    
+    /// 加密
+    func encrypt(plainText: Data) throws -> Data {
+        let nonce = nonceGenerator.nextNonceData()
+        let sealedBox = try ChaChaPoly.seal(plainText, using: key, nonce: .init(data: nonce))
+        
+        return sealedBox.combined
+    }
+    
+    /// 解密
+    func decrypt(cipherText: Data) throws -> Data {
+        let sealedBox = try ChaChaPoly.SealedBox(combined: cipherText)
+        return try ChaChaPoly.open(sealedBox, using: key)
+    }
+    
+}
+
+extension CCChaCha20Cipher {
+    
+    /// Nonce生成器（基于ServerRange + 毫秒时间低位 + 本地自增counter）
+    final class NonceGenerator {
+        private let locker = NSLock()
+        
+        private let regionId: UInt32          // 32-bit 全局前缀
+        private var counter: UInt64 = 0          // 自增counter
+        
+        init(regionId: UInt32) {
+            self.regionId = regionId
+        }
+        
+        /// 生成64-bit Nonce
+        func nextNonceData() -> Data  {
+            locker.lock()
+            defer {
+                locker.unlock()
+            }
+            
+            let nowMillis = UInt64(Date().timeIntervalSince1970 * 1000)
+            // 时间占用40个bit位, 自增id占用24位
+            let timeMask: UInt64 = (1 << 40) - 1
+            let timeLow = nowMillis & timeMask
+            
+            // 生成 Nonce
+            let counterMask: UInt64 = (1 << 24) - 1
+            let nonce = (timeLow << 24) | (counter & counterMask)
+            // 自增counter
+            self.counter = (self.counter + 1) & counterMask // 超过最大值回到0
+            
+            var data = Data()
+            // region: UInt32 -> 4字节大端
+            data.append(contentsOf: withUnsafeBytes(of: regionId.bigEndian, Array.init))
+            // nonce: UInt64 -> 8字节大端
+            data.append(contentsOf: withUnsafeBytes(of: nonce.bigEndian, Array.init))
+            
+            return data
+        }
+    }
+    
+}

Tun/Punchnet/Cipher/CCDataCipher.swift

@@ -0,0 +1,13 @@
+//
+//  AESCipher.swift
+//  sdlan
+//
+//  Created by 安礼成 on 2025/7/14.
+//
+import Foundation
+
+public protocol CCDataCipher {
+    func decrypt(cipherText: Data) throws -> Data
+    
+    func encrypt(plainText: Data) throws -> Data
+}

Tun/Punchnet/Cipher/CCRSACipher.swift

@@ -0,0 +1,41 @@
+//
+//  CCRSACipher.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/17.
+//
+import Foundation
+
+struct CCRSACipher: RSACipher {
+    var pubKey: String
+    let privateKeyDER: Data
+    
+    init(keySize: Int) throws {
+        let (privateKey, publicKey) = try Self.loadKeys(keySize: keySize)
+        let privKeyStr = SwKeyConvert.PrivateKey.derToPKCS1PEM(privateKey)
+        
+        self.pubKey = SwKeyConvert.PublicKey.derToPKCS8PEM(publicKey)
+        self.privateKeyDER = try SwKeyConvert.PrivateKey.pemToPKCS1DER(privKeyStr)
+    }
+    
+    public func decode(data: Data) throws -> Data {
+        let tag = Data()
+        let (decryptedData, _) = try CC.RSA.decrypt(data, derKey: self.privateKeyDER, tag: tag, padding: .pkcs1, digest: .none)
+        
+        return decryptedData
+    }
+    
+    private static func loadKeys(keySize: Int) throws -> (Data, Data) {
+        if let privateKey = UserDefaults.standard.data(forKey: "privateKey"),
+           let publicKey = UserDefaults.standard.data(forKey: "publicKey") {
+            
+            return (privateKey, publicKey)
+        } else {
+            let (privateKey, publicKey) = try CC.RSA.generateKeyPair(keySize)
+            UserDefaults.standard.setValue(privateKey, forKey: "privateKey")
+            UserDefaults.standard.setValue(publicKey, forKey: "publicKey")
+            
+            return (privateKey, publicKey)
+        }
+    }
+}

Tun/Punchnet/Context/SDLContextActor.swift

@@ -0,0 +1,782 @@
+//
+//  SDLContext.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/2/29.
+//
+
+import Foundation
+import NetworkExtension
+import NIOCore
+
+// 上下文环境变量，全局共享
+/*
+1. 处理rsa的加解密逻辑
+ */
+
+func startMonitorTask(name: String, _ body: @escaping () async throws -> Void, retryDelay: Duration = .seconds(5)) -> Task<Void, Never> {
+    return Task(name: name) {
+        while true {
+            do {
+                try Task.checkCancellation()
+                try await body()
+            } catch is CancellationError {
+                SDLLogger.log("[SDLContext] worker \(name) cancelled", for: .debug)
+                break
+            } catch let err {
+                SDLLogger.log("[SDLContext] worker \(name) crashed: \(err.localizedDescription), will restart", for: .debug)
+                do {
+                    try await Task.sleep(for: retryDelay)
+                } catch is CancellationError {
+                    break
+                } catch {
+                    break
+                }
+            }
+        }
+    }
+}
+
+// 转换成ip地址
+private func asIpAddress(_ ipNum: UInt32) -> String {
+    return SDLUtil.int32ToIp(ipNum)
+}
+
+enum SDLContextError: Error {
+    case udpHoleClosed
+    
+    case dnsLocalClientClosed
+    case dnsLocalClientCancelled
+    
+    case dnsClientClosed
+    case dnsClientCancelled
+}
+
+actor SDLContextActor {
+
+    private var config: SDLConfiguration
+    // nat的网络类型
+    var natType: SDLNATProberActor.NatType = .blocked
+    
+    // AES加密，授权通过后，对象才会被创建
+    private var dataCipher: CCDataCipher?
+    
+    // session token
+    private var sessionToken: Data?
+    
+    // rsa的相关配置, public_key是本地生成的
+    // 加密算法相关
+    nonisolated let rsaCipher: RSACipher
+    
+    private var udpHoleService: SDLUDPHoleService?
+    private var dnsService: SDLDNSService?
+    private var superService: SDLSuperService?
+    private var packetReaderService: SDLPacketReaderService?
+
+    private let publicDnsServers = ["223.5.5.5", "119.29.29.29"]
+
+    nonisolated private let puncherActor: SDLPuncherActor
+    // 网络探测对象
+    nonisolated private let proberActor: SDLNATProberActor
+    
+    // 本地ipv6地址信息探测
+    private var ipv6AssistClient: SDLIPV6AssistClient?
+
+    private let sessionManager = SessionManager()
+    nonisolated private let arpServer: ArpServer
+    
+    // 内部socket通讯
+    // 改为基于 App Group + Darwin Notification 的通知
+    
+    // 流量统计
+    nonisolated private let flowTracer = SDLFlowTracer()
+    
+    nonisolated private let provider: NEPacketTunnelProvider
+    
+    // 处理权限控制
+    private let identifyStore: IdentityStore
+    private var updatePolicyTask: Task<Void, Never>?
+    private let snapshotPublisher: SnapshotPublisher<IdentitySnapshot>
+    
+    // Flow流会话管理， 过期时间为: 180秒
+    private let flowSessionManager = SDLFlowSessionManager(sessionTimeout: 180)
+    
+    // stunRequest任务
+    private var stunRequestTask: Task<Void, Never>?
+
+    public init(provider: NEPacketTunnelProvider, config: SDLConfiguration, rsaCipher: RSACipher) {
+        self.provider = provider
+        self.config = config
+        self.rsaCipher = rsaCipher
+        
+        self.puncherActor = SDLPuncherActor()
+        self.proberActor = SDLNATProberActor(addressArray: config.stunProbeSocketAddressArray)
+
+        self.arpServer = ArpServer()
+
+        // 权限控制
+        let snapshotPublisher = SnapshotPublisher(initial: IdentitySnapshot.empty())
+        self.identifyStore = IdentityStore(publisher: snapshotPublisher)
+        self.snapshotPublisher = snapshotPublisher
+    }
+    
+    public func start() async {
+        self.prepareTunnelNotifier()
+        
+        // 启动arp的定时清理任务
+        await self.puncherActor.start()
+        await self.arpServer.start()
+        
+        let dnsService = SDLDNSService(serverHost: self.config.serverHost, publicDnsServers: self.publicDnsServers) { [weak self] event in
+            await self?.handleDNSEvent(event)
+        }
+        self.dnsService = dnsService
+        await dnsService.start()
+
+        let udpHoleService = SDLUDPHoleService(proberActor: self.proberActor) { [weak self] event in
+            await self?.handleUDPHoleEvent(event)
+        }
+        self.udpHoleService = udpHoleService
+        await udpHoleService.start(includeV6: false)
+
+        let superService = SDLSuperService(host: self.config.serverHost) { [weak self] message in
+            await self?.handleSuperMessage(message: message)
+        }
+        self.superService = superService
+        await superService.start()
+    }
+
+    // 处理context的停止问题
+    public func stop() async {
+        await self.puncherActor.stop()
+        await self.arpServer.stop()
+        await self.sessionManager.clear()
+
+        self.flowSessionManager.clear()
+
+        self.stunRequestTask?.cancel()
+        self.stunRequestTask = nil
+
+        self.updatePolicyTask?.cancel()
+        self.updatePolicyTask = nil
+        
+        let packetReaderService = self.packetReaderService
+        self.packetReaderService = nil
+        await packetReaderService?.stop()
+
+        let udpHoleService = self.udpHoleService
+        self.udpHoleService = nil
+        await udpHoleService?.stop()
+
+        let dnsService = self.dnsService
+        self.dnsService = nil
+        await dnsService?.stop()
+
+        let superService = self.superService
+        self.superService = nil
+        await superService?.stop()
+        
+        self.sessionToken = nil
+        self.dataCipher = nil
+        self.natType = .blocked
+        
+        await self.ipv6AssistClient?.stop()
+        self.ipv6AssistClient = nil
+    }
+
+    deinit {
+        SDLLogger.log("[SDLContext] deinit", for: .debug)
+    }
+    
+}
+
+// MARK: probe网络类型
+extension SDLContextActor {
+    
+    private func setNatType(natType: SDLNATProberActor.NatType) {
+        self.natType = natType
+    }
+}
+
+// MARK: Notifier通知机制
+extension SDLContextActor {
+    
+    private func prepareTunnelNotifier() {
+        // 启动noticeClient
+        // 旧的 UDP NoticeClient 已移除，改为初始化基于 App Group 的通知通道。
+        SDLTunnelAppNotifier.shared.clear()
+        
+        SDLLogger.log("[SDLContext] tunnelAppNotifier ready")
+    }
+    
+    private func publishTunnelEvent(code: Int? = nil, message: String) {
+        SDLTunnelAppNotifier.shared.publish(code: code, message: message)
+    }
+}
+
+// MARK: 数据发送
+extension SDLContextActor {
+    
+    // 发送给super/stun节点的数据
+    private func sendSuperPacket(type: SDLPacketType, data: Data) async {
+        await self.sendPacket(type: type, data: data, remoteAddress: self.config.stunSocketAddress)
+    }
+    
+    // 发送给peer的数据
+    private func sendPeerPacket(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) async {
+        await self.sendPacket(type: type, data: data, remoteAddress: remoteAddress)
+    }
+    
+    private func sendPacket(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) async {
+        await self.udpHoleService?.send(type: type, data: data, remoteAddress: remoteAddress)
+    }
+}
+
+// MARK: 处理和Super之间的通讯
+extension SDLContextActor {
+    
+    private func handleSuperMessage(message: SDLQUICInboundMessage) async {
+        switch message {
+        case .welcome(let welcome):
+            SDLLogger.log("[SDLContext] quic welcome: \(welcome)")
+            
+            await self.ipv6AssistClient?.stop()
+            self.ipv6AssistClient = nil
+            // 尝试创建v6地址的辅助探测器
+            if welcome.hasIpv6Assist {
+                self.ipv6AssistClient = SDLIPV6AssistClient(assistServerInfo: welcome.ipv6Assist)
+                await self.ipv6AssistClient?.start()
+            }
+            
+            // 注册
+            await self.doRegisterSuper()
+            SDLLogger.log("[SDLContext] quic doRegisterSuper")
+        case .pong:
+            //SDLLogger.shared.log("[SDLContext] quic pong")
+            ()
+        case .registerSuperAck(let registerSuperAck):
+            await self.handleRegisterSuperAck(registerSuperAck: registerSuperAck)
+        case .registerSuperNak(let registerSuperNak):
+            self.handleRegisterSuperNak(nakPacket: registerSuperNak)
+        case .peerInfo(let peerInfo):
+            SDLLogger.log("[SDLContext] peer message: \(peerInfo)")
+            let packets = await self.puncherActor.makeRegisterPackets(peerInfo: peerInfo)
+            for packet in packets {
+                await self.udpHoleService?.send(type: .register, data: packet.data, remoteAddress: packet.remoteAddress)
+            }
+        case .event(let event):
+            await self.handleEvent(event: event)
+        case .policyReponse(let policyResponse):
+            // 处理权限的请求问题
+            await self.identifyStore.applyPolicyResponse(policyResponse)
+        case .arpResponse(let arpResponse):
+            SDLLogger.log("[SDLContext] get arp response: \(arpResponse)")
+            await self.arpServer.handleArpResponse(arpResponse: arpResponse)
+        }
+    }
+    
+    private func makeSuperEventProcessor() -> SDLSuperEventProcessor {
+        return .init(networkAddress: self.config.networkAddress)
+    }
+    
+    private func handleRegisterSuperAck(registerSuperAck: SDLRegisterSuperAck) async {
+        // 需要对数据通过rsa的私钥解码
+        guard let key = try? self.rsaCipher.decode(data: Data(registerSuperAck.key)) else {
+            SDLLogger.log("[SDLContext] registerSuperAck invalid key")
+            let error = SDLError.invalidKey
+            self.provider.cancelTunnelWithError(error)
+            return
+        }
+        
+        let algorithm = registerSuperAck.algorithm.lowercased()
+        let regionId = registerSuperAck.regionID
+        self.sessionToken = registerSuperAck.sessionToken
+        
+        switch algorithm {
+        case "aes":
+            self.dataCipher = CCAESChiper(key: key)
+        case "chacha20":
+            self.dataCipher = CCChaCha20Cipher(regionId: regionId, keyData: key)
+        default:
+            SDLLogger.log("[SDLContext] registerSuperAck invalid algorithm \(algorithm)")
+            let error = SDLError.unsupportedAlgorithm(algorithm: algorithm)
+            self.provider.cancelTunnelWithError(error)
+            return
+        }
+        
+        SDLLogger.log("[SDLContext] registerSuperAck, use algorithm \(algorithm), key len: \(key.count)")
+        // 服务器分配的tun网卡信息
+        do {
+            try await self.setNetworkSettings(config: self.config, dnsServer: DNSHelper.dnsServer)
+            SDLLogger.log("[SDLContext] setNetworkSettings successed")
+            await self.startPacketReader()
+            // 开启权限的定时更新
+            await self.whenRegistedSuper()
+        } catch let err {
+            SDLLogger.log("[SDLContext] setTunnelNetworkSettings get error: \(err)")
+            self.provider.cancelTunnelWithError(err)
+        }
+    }
+    
+    // 注册成功super的回调函数
+    private func whenRegistedSuper() async {
+        self.updatePolicyTask?.cancel()
+        
+        self.updatePolicyTask = Task {
+            do {
+                while true {
+                    try await Task.sleep(for: .seconds(300))
+                    SDLLogger.log("[SDLContext] updatePolicyTask execute")
+                    let requests = await self.identifyStore.makeBatchPolicyRequests(dstIdentityID: self.config.identityId)
+                    for request in requests {
+                        await self.superService?.send(type: .policyRequest, data: request)
+                    }
+                }
+            } catch let err {
+                SDLLogger.log("[SDLContext] updatePolicyTask stop with err: \(err)")
+            }
+        }
+        
+        // 启动stun任务
+        await self.startStunRequestTask()
+    }
+    
+    private func handleRegisterSuperNak(nakPacket: SDLRegisterSuperNak) {
+        let errorMessage = nakPacket.errorMessage
+        guard let errorCode = SDLNAKErrorCode(rawValue: UInt8(nakPacket.errorCode)) else {
+            return
+        }
+        
+        switch errorCode {
+        case .invalidToken, .nodeDisabled:
+            self.publishTunnelEvent(code: Int(errorCode.rawValue), message: errorMessage)
+            // 报告错误并退出
+            let error = NSError(domain: "com.jihe.punchnet.tun", code: -1)
+            self.provider.cancelTunnelWithError(error)
+            
+        case .noIpAddress, .networkFault, .internalFault:
+            self.publishTunnelEvent(code: Int(errorCode.rawValue), message: errorMessage)
+        }
+        SDLLogger.log("[SDLContext] Get a SuperNak message exit")
+    }
+    
+    private func handleEvent(event: SDLEvent) async {
+        let processor = self.makeSuperEventProcessor()
+        let plan = await processor.makeProcessingPlan(event: event)
+        if let logMessage = plan.logMessage {
+            SDLLogger.log(logMessage)
+        }
+        
+        switch plan.action {
+        case .removeSession(let dstMac):
+            await self.sessionManager.removeSession(dstMac: dstMac)
+        case .sendRegister(let registerData, let remoteAddresses):
+            for remoteAddress in remoteAddresses {
+                await self.sendPeerPacket(type: .register, data: registerData, remoteAddress: remoteAddress)
+            }
+        case .shutdown(let message):
+            self.publishTunnelEvent(message: message)
+            
+            // 报告错误并退出
+            let error = NSError(domain: "com.jihe.punchnet.tun", code: -2)
+            self.provider.cancelTunnelWithError(error)
+        case .none:
+            ()
+        }
+    }
+    
+    private func doRegisterSuper() async {
+        // 注册
+        var registerSuper = SDLRegisterSuper()
+        registerSuper.clientID = self.config.clientId
+        registerSuper.networkID = self.config.networkAddress.networkId
+        registerSuper.mac = self.config.networkAddress.mac
+        registerSuper.ip = self.config.networkAddress.ip
+        registerSuper.maskLen = UInt32(self.config.networkAddress.maskLen)
+        registerSuper.hostname = self.config.hostname
+        registerSuper.pubKey = self.rsaCipher.pubKey
+        registerSuper.accessToken = self.config.accessToken
+        
+        if let registerSuperData = try? registerSuper.serializedData() {
+            SDLLogger.log("[SDLContext] will send register super")
+            await self.superService?.send(type: .registerSuper, data: registerSuperData)
+        }
+    }
+    
+}
+
+// MARK: DNS service events
+extension SDLContextActor {
+    private func handleDNSEvent(_ event: SDLDNSService.Event) async {
+        switch event {
+        case .packet(let packet):
+            let nePacket = NEPacket(data: packet, protocolFamily: 2)
+            self.provider.packetFlow.writePacketObjects([nePacket])
+        }
+    }
+}
+
+// MARK: 处理从Hole收到的数据
+extension SDLContextActor {
+    private func handleUDPHoleEvent(_ event: SDLUDPHoleService.Event) async {
+        switch event {
+        case .ready(let localAddress):
+            SDLLogger.log("[SDLContext] udpHole ready: \(localAddress)")
+        case .natType(let natType):
+            self.setNatType(natType: natType)
+            SDLLogger.log("[SDLContext] nat_type is: \(natType)")
+        case .packet(let remoteAddress, let message, let source):
+            await self.handleUDPHolePacket(remoteAddress: remoteAddress, message: message, source: source)
+        case .closed(let error):
+            SDLLogger.log("[SDLContext] udpHole closed: \(error)", for: .debug)
+        }
+    }
+
+    private func handleUDPHolePacket(remoteAddress: SocketAddress, message: SDLHoleMessage, source: SDLUDPHoleKind) async {
+        switch message.inboundMessage {
+        case .control(let message):
+            switch message {
+            case .stunReply(_), .stunProbeReply(_):
+                SDLLogger.log("[SDLContext] get a stun reply", for: .debug)
+            case .register(let register):
+                try? await self.handleRegister(remoteAddress: remoteAddress, register: register, source: source)
+            case .registerAck(let registerAck):
+                await self.handleRegisterAck(remoteAddress: remoteAddress, registerAck: registerAck, source: source)
+            }
+        case .data(let data):
+            try? await self.handleHoleData(data: data)
+        }
+    }
+    
+    private func handleRegister(remoteAddress: SocketAddress, register: SDLRegister, source: SDLUDPHoleKind) async throws {
+        let networkAddr = config.networkAddress
+        SDLLogger.log("[SDLContext] register packet: \(register), network_address: \(networkAddr)")
+        
+        // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
+        if register.dstMac == networkAddr.mac && register.networkID == networkAddr.networkId {
+            // 回复ack包
+            var registerAck = SDLRegisterAck()
+            registerAck.networkID = networkAddr.networkId
+            registerAck.srcMac = networkAddr.mac
+            registerAck.dstMac = register.srcMac
+            
+            await self.sendPeerPacket(type: .registerAck, data: try registerAck.serializedData(), remoteAddress: remoteAddress)
+            // 这里需要建立到来源的会话, 在复杂网络下，通过super-node查询到的nat地址不一定靠谱，需要通过udp包的来源地址作为nat地址
+            if let session = Session(dstMac: register.srcMac, natAddress: remoteAddress, addressType: source.convertAddressType()) {
+                await self.sessionManager.addSession(session: session)
+            } else {
+                SDLLogger.log("[SDLContext] didReadRegister get unsupported remoteAddress: \(remoteAddress)", for: .debug)
+            }
+        } else {
+            SDLLogger.log("[SDLContext] didReadRegister get a invalid packet, because dst_ip not matched: \(register.dstMac)")
+        }
+    }
+    
+    private func handleRegisterAck(remoteAddress: SocketAddress, registerAck: SDLRegisterAck, source: SDLUDPHoleKind) async {
+        // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
+        let networkAddr = config.networkAddress
+        if registerAck.dstMac == networkAddr.mac && registerAck.networkID == networkAddr.networkId {
+            if let session = Session(dstMac: registerAck.srcMac, natAddress: remoteAddress, addressType: source.convertAddressType()) {
+                await self.sessionManager.addSession(session: session)
+            } else {
+                SDLLogger.log("[SDLContext] didReadRegisterAck get unsupported remoteAddress: \(remoteAddress)", for: .debug)
+            }
+        } else {
+            SDLLogger.log("[SDLContext] didReadRegisterAck get a invalid packet, because dst_mac not matched: \(registerAck.dstMac)")
+        }
+    }
+    
+    private func makeHoleDataProcessor() -> SDLHoleDataProcessor {
+        return .init(
+            networkAddress: self.config.networkAddress,
+            dataCipher: self.dataCipher,
+            snapshotPublisher: self.snapshotPublisher,
+            flowSessionManager: self.flowSessionManager
+        )
+    }
+    
+    private func handleHoleData(data: SDLData) async throws {
+        let processor = self.makeHoleDataProcessor()
+        guard let plan = try processor.makeProcessingPlan(data: data) else {
+            return
+        }
+        
+        self.flowTracer.inc(num: plan.inboundBytes, type: .inbound)
+        
+        switch plan.action {
+        case .sendARPReply(let dstMac, let responseData):
+            SDLLogger.log("[SDLContext] get arp request packet")
+            await self.routeLayerPacket(dstMac: dstMac, type: .arp, data: responseData)
+        case .appendARP(let ip, let mac):
+            SDLLogger.log("[SDLContext] get arp response packet")
+            await self.arpServer.append(ip: ip, mac: mac)
+        case .writeToTun(let packetData, let identityID):
+            let packet = NEPacket(data: packetData, protocolFamily: 2)
+            self.provider.packetFlow.writePacketObjects([packet])
+            SDLLogger.log("[SDLContext] hole identity: \(identityID), allow, data count: \(packetData.count)", for: .trace)
+        case .requestPolicy(let srcIdentityID):
+            SDLLogger.log("[SDLContext] not found identity: \(srcIdentityID) ruleMap", for: .debug)
+            if let queryData = await self.identifyStore.makePolicyRequest(srcIdentityId: srcIdentityID, dstIdentityId: self.config.identityId) {
+                await self.superService?.send(type: .policyRequest, data: queryData)
+            }
+        case .none:
+            ()
+        }
+    }
+    
+}
+
+// MARK: 和Stun相关的心跳机制
+extension SDLContextActor {
+    
+    // MARK: -- StunRequestTask
+    private func startStunRequestTask() async {
+        self.stunRequestTask?.cancel()
+        self.stunRequestTask = nil
+
+        // 处理心跳逻辑
+        self.stunRequestTask = Task { [weak self] in
+            let timerStream = SDLAsyncTimerStream()
+            timerStream.start(interval: .seconds(8))
+            
+            for await _ in timerStream.stream {
+                if Task.isCancelled {
+                    break
+                }
+                
+                let probeReply = try? await self?.ipv6AssistClient?.probe(requestTimeout: .seconds(3))
+                if Task.isCancelled {
+                    break
+                }
+
+                if let v6Info = probeReply?.v6Info, let v6Address = SDLUtil.ipv6DataToString(v6Info.v6) {
+                    SDLLogger.log("[SDLContext] probe ipv6 address: \(v6Address)")
+                } else {
+                    SDLLogger.log("[SDLContext] probe ipv6 address: empty")
+                }
+
+                if Task.isCancelled {
+                    break
+                }
+
+                await self?.sendStunRequest(v6Info: probeReply?.v6Info)
+            }
+            
+            SDLLogger.log("[SDLContext] udp stunRequestTask cancel")
+        }
+    }
+    
+    private func sendStunRequest(v6Info: SDLV6Info?) async {
+        guard let sessionToken = self.sessionToken else {
+            return
+        }
+        
+        var stunRequest = SDLStunRequest()
+        stunRequest.clientID = self.config.clientId
+        stunRequest.networkID = self.config.networkAddress.networkId
+        stunRequest.ip = self.config.networkAddress.ip
+        stunRequest.mac = self.config.networkAddress.mac
+        stunRequest.natType = UInt32(self.natType.rawValue)
+        stunRequest.sessionToken = sessionToken
+        
+        if let v6Info {
+            stunRequest.v6Info = v6Info
+        }
+        
+        if let stunData = try? stunRequest.serializedData() {
+            await self.sendSuperPacket(type: .stunRequest, data: stunData)
+        }
+    }
+}
+
+// MARK: NEPacketTunnelProvider相关的逻辑
+extension SDLContextActor {
+    
+    // 开始读取数据, 用单独的线程处理packetFlow
+    private func startPacketReader() async {
+        if self.packetReaderService == nil {
+            self.packetReaderService = SDLPacketReaderService(provider: self.provider) { [weak self] event in
+                await self?.handlePacketReaderEvent(event)
+            }
+        }
+        await self.packetReaderService?.start()
+    }
+
+    private func handlePacketReaderEvent(_ event: SDLPacketReaderService.Event) async {
+        switch event {
+        case .packet(let packet):
+            await self.dealTunPacket(packet: packet)
+        }
+    }
+    
+    // 取消出口节点的时候，ip地址为: 0.0.0.0
+    public func updateExitNode(exitNodeIp: String) async throws {
+        if let ip = SDLUtil.ipv4StrToInt32(exitNodeIp), ip > 0 {
+            self.config.exitNode = .init(exitNodeIp: ip)
+        } else {
+            self.config.exitNode = nil
+        }
+        try await self.setNetworkSettings(config: config, dnsServer: DNSHelper.dnsServer)
+    }
+    
+    // MARK: 网络改变时需要重新配置网络信息
+    private func setNetworkSettings(config: SDLConfiguration, dnsServer: String) async throws {
+        let networkAddress = config.networkAddress
+        
+        // 配置路由规则
+        var routes: [NEIPv4Route] = [
+            NEIPv4Route(destinationAddress: networkAddress.netAddress, subnetMask: networkAddress.maskAddress),
+            NEIPv4Route(destinationAddress: dnsServer, subnetMask: "255.255.255.255"),
+        ]
+        
+        // 如果存在出口节点配置，则接管系统默认留有
+        if config.exitNode != nil {
+            routes.append(.default())
+        }
+        
+        // Add code here to start the process of connecting the tunnel.
+        let networkSettings = NEPacketTunnelNetworkSettings(tunnelRemoteAddress: "8.8.8.8")
+        networkSettings.mtu = 1250
+        
+        // 设置网卡的DNS解析
+        let networkDomain = networkAddress.networkDomain
+        let dnsSettings = NEDNSSettings(servers: [dnsServer])
+
+        dnsSettings.searchDomains = [networkDomain]
+        dnsSettings.matchDomains = [networkDomain, ""]
+        // 设置为 false 允许系统在补全 Search Domain 时也能匹配到此设置
+        dnsSettings.matchDomainsNoSearch = false
+        
+        networkSettings.dnsSettings = dnsSettings
+        
+        let ipv4Settings = NEIPv4Settings(addresses: [networkAddress.ipAddress], subnetMasks: [networkAddress.maskAddress])
+        // 设置路由表
+        ipv4Settings.includedRoutes = routes
+        
+        // 配置要排除的路由
+        ipv4Settings.excludedRoutes = self.getIpv4ExcludeRoutes()
+        
+        networkSettings.ipv4Settings = ipv4Settings
+        // 网卡配置设置必须成功
+        try await self.provider.setTunnelNetworkSettings(networkSettings)
+    }
+    
+    private func getIpv4ExcludeRoutes() -> [NEIPv4Route] {
+        // 要排除的路由表
+        let dnsServers = SDLUtil.getMacOSSystemDnsServers()
+        var ipv4DnsServers = dnsServers.filter {!$0.contains(":")}
+        
+        // 增加常见的dns服务
+        let commonDnsServers = [
+            "8.8.8.8",
+            "8.8.4.4",
+            "223.5.5.5",
+            "223.6.6.6",
+            "114.114.114.114"
+        ]
+        for ip in commonDnsServers {
+            if !ipv4DnsServers.contains(ip) {
+                ipv4DnsServers.append(ip)
+            }
+        }
+        
+        return ipv4DnsServers.map { NEIPv4Route(destinationAddress: $0, subnetMask: "255.255.255.255") }
+    }
+    
+    // 处理读取的每个数据包, Tun收到的包的一级路由
+    private func dealTunPacket(packet: IPPacket) async {
+        let router = SDLTunPacketRouter(networkAddress: self.config.networkAddress, exitNode: self.config.exitNode)
+        
+        let decision = router.route(packet: packet)
+        
+        // 外部出去的数据，需要建立FlowSession
+        // 外部数据进来的时候需要查找
+        if decision.shouldTrackFlow, let flowSession = packet.flowSession() {
+            self.flowSessionManager.updateSession(flowSession)
+            //SDLLogger.shared.log("[SDLContext] flow_session: \(flowSession)", level: .debug)
+        }
+        
+        await self.handleTunRouteDecision(decision)
+    }
+    
+    private func handleTunRouteDecision(_ decision: SDLTunPacketRouter.RouteDecision) async {
+        switch decision {
+        case .loopback(let ipPacketData):
+            let nePacket = NEPacket(data: ipPacketData, protocolFamily: 2)
+            self.provider.packetFlow.writePacketObjects([nePacket])
+        case .cloudDNS(let name, let ipPacketData):
+            SDLLogger.log("[SDLContext] get cloud dns request: \(name)")
+            await self.dnsService?.forward(ipPacketData: ipPacketData)
+        case .localDNS(let name, let payload, let tracker):
+            SDLLogger.log("[SDLContext] get local dns request: \(name)")
+            await self.dnsService?.queryLocal(tracker: tracker, dnsPayload: payload)
+        case .forwardToNextHop(let ip, let type, let data, let kind):
+            await self.forwardPacketToNextHop(ip: ip, type: type, data: data, kind: kind)
+        case .drop(let reason):
+            SDLLogger.log("[SDLContext] drop tun packet, reason: \(reason.rawValue)", for: .trace)
+        }
+    }
+    
+    private func forwardPacketToNextHop(ip: UInt32, type: LayerPacket.PacketType, data: Data, kind: SDLTunPacketRouter.ForwardKind) async {
+        switch kind {
+        case .sameNetwork:
+            SDLLogger.log("[SDLContext] dstIp: \(asIpAddress(ip)) same network", for: .trace)
+        case .exitNode, .dnsExitNode:
+            SDLLogger.log("[SDLContext] use exit_node: \(asIpAddress(ip))", for: .trace)
+        }
+        
+        // 查找arp缓存中是否有目标mac地址
+        if let dstMac = await self.arpServer.query(ip: ip) {
+            SDLLogger.log("[SDLContext] dstIp: \(asIpAddress(ip)), dst_mac is: \(SDLUtil.formatMacAddress(mac: dstMac))", for: .trace)
+            await self.routeLayerPacket(dstMac: dstMac, type: type, data: data)
+        }
+        else {
+            SDLLogger.log("[SDLContext] dstIp: \(asIpAddress(ip)) arp query not found, broadcast", for: .trace)
+            if let arpRequest = try? await self.arpServer.makeArpRequest(targetIp: ip) {
+                await self.superService?.send(type: .arpRequest, data: arpRequest)
+            }
+        }
+    }
+    
+    private func makeLayerPacketForwarder() -> SDLLayerPacketForwarder {
+        return .init(
+            networkAddress: self.config.networkAddress,
+            identityID: self.config.identityId,
+            dataCipher: self.dataCipher,
+            sessionManager: self.sessionManager
+        )
+    }
+    
+    private func routeLayerPacket(dstMac: Data, type: LayerPacket.PacketType, data: Data) async {
+        // 将数据封装层2层的数据包
+        // 构造数据包
+        let forwarder = self.makeLayerPacketForwarder()
+        guard let plan = try? await forwarder.makeDeliveryPlan(dstMac: dstMac, type: type, data: data) else {
+            return
+        }
+        
+        // 广播地址不要去尝试打洞
+        switch plan {
+        case .superNode(let payload):
+            // 通过super_node进行转发
+            await self.sendSuperPacket(type: .data, data: payload)
+        case .peer(let payload, let session):
+            // 通过session发送到对端
+            SDLLogger.log("[SDLContext] step 5 send packet by session: \(session)", for: .trace)
+            await self.sendPeerPacket(type: .data, data: payload, remoteAddress: session.natAddress)
+            self.flowTracer.inc(num: payload.count, type: .p2p)
+        case .superNodeAndPunch(let payload, let request):
+            // 通过super_node进行转发
+            await self.sendSuperPacket(type: .data, data: payload)
+            SDLLogger.log("[SDLContext] step 5 send packet by super: \(self.config.stunSocketAddress)", for: .trace)
+            // 流量统计
+            self.flowTracer.inc(num: payload.count, type: .forward)
+            
+            // 尝试打洞
+            if let queryData = await self.puncherActor.makeQueryInfoRequest(request: request) {
+                await self.superService?.send(type: .queryInfo, data: queryData)
+            }
+        }
+    }
+    
+}

Tun/Punchnet/Context/SDLHoleDataProcessor.swift

@@ -0,0 +1,143 @@
+//
+//  SDLHoleDataProcessor.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/14.
+//
+
+import Foundation
+
+final class SDLHoleDataProcessor {
+    enum ProcessingAction {
+        case sendARPReply(dstMac: Data, data: Data)
+        case appendARP(ip: UInt32, mac: Data)
+        case writeToTun(packetData: Data, identityID: UInt32)
+        case requestPolicy(srcIdentityID: UInt32)
+        case none
+    }
+    
+    struct ProcessingPlan {
+        let inboundBytes: Int
+        let action: ProcessingAction
+    }
+    
+    private let networkAddress: SDLConfiguration.NetworkAddress
+    private let dataCipher: CCDataCipher?
+    private let snapshotPublisher: SnapshotPublisher<IdentitySnapshot>
+    private let flowSessionManager: SDLFlowSessionManager
+    
+    init(networkAddress: SDLConfiguration.NetworkAddress,
+         dataCipher: CCDataCipher?,
+         snapshotPublisher: SnapshotPublisher<IdentitySnapshot>,
+         flowSessionManager: SDLFlowSessionManager) {
+        self.networkAddress = networkAddress
+        self.dataCipher = dataCipher
+        self.snapshotPublisher = snapshotPublisher
+        self.flowSessionManager = flowSessionManager
+    }
+    
+    func makeProcessingPlan(data: SDLData) throws -> ProcessingPlan? {
+        guard let dataCipher = self.dataCipher else {
+            return nil
+        }
+        
+        let mac = LayerPacket.MacAddress(data: data.dstMac)
+        guard (data.dstMac == self.networkAddress.mac || mac.isBroadcast() || mac.isMulticast()) else {
+            return nil
+        }
+        
+        let decryptedData = try dataCipher.decrypt(cipherText: Data(data.data))
+        let layerPacket = try LayerPacket(layerData: decryptedData)
+        let inboundBytes = decryptedData.count
+        
+        // 处理arp请求
+        switch layerPacket.type {
+        case .arp:
+            return self.makeARPPlan(layerData: layerPacket.data, inboundBytes: inboundBytes)
+        case .ipv4:
+            return self.makeIPv4Plan(layerData: layerPacket.data, identityID: data.identityID, inboundBytes: inboundBytes)
+        default:
+            SDLLogger.log("[SDLContext] get invalid packet", for: .debug)
+            return .init(inboundBytes: inboundBytes, action: .none)
+        }
+    }
+    
+    private func makeARPPlan(layerData: Data, inboundBytes: Int) -> ProcessingPlan {
+        // 判断如果收到的是arp请求
+        if let arpPacket = ARPPacket(data: layerData) {
+            if arpPacket.targetIP == self.networkAddress.ip {
+                switch arpPacket.opcode {
+                case .request:
+                    let response = ARPPacket.arpResponse(for: arpPacket, mac: self.networkAddress.mac, ip: self.networkAddress.ip)
+                    return .init(
+                        inboundBytes: inboundBytes,
+                        action: .sendARPReply(dstMac: arpPacket.senderMAC, data: response.marshal())
+                    )
+                case .response:
+                    return .init(
+                        inboundBytes: inboundBytes,
+                        action: .appendARP(ip: arpPacket.senderIP, mac: arpPacket.senderMAC)
+                    )
+                }
+            } else {
+                SDLLogger.log("[SDLContext] get invalid arp packet: \(arpPacket), target_ip: \(SDLUtil.int32ToIp(arpPacket.targetIP)), net ip: \(SDLUtil.int32ToIp(self.networkAddress.ip))")
+            }
+        } else {
+            SDLLogger.log("[SDLContext] get invalid arp packet")
+        }
+        
+        return .init(inboundBytes: inboundBytes, action: .none)
+    }
+    
+    private func makeIPv4Plan(layerData: Data, identityID: UInt32, inboundBytes: Int) -> ProcessingPlan {
+        // 有数据是通过出口网关转发的，所有只判断是合法的ip包
+        guard let ipPacket = IPPacket(layerData) else {
+            return .init(inboundBytes: inboundBytes, action: .none)
+        }
+        
+        // 检查权限逻辑
+        let identitySnapshot = self.snapshotPublisher.current()
+        let ruleMap = identitySnapshot.lookup(identityID)
+        
+        if true || self.checkPolicy(ipPacket: ipPacket, ruleMap: ruleMap) {
+            return .init(
+                inboundBytes: inboundBytes,
+                action: .writeToTun(packetData: ipPacket.data, identityID: identityID)
+            )
+        }
+        
+        return .init(
+            inboundBytes: inboundBytes,
+            action: .requestPolicy(srcIdentityID: identityID)
+        )
+    }
+    
+    private func checkPolicy(ipPacket: IPPacket, ruleMap: IdentityRuleMap?) -> Bool {
+        // 进来的数据反转一下，然后再处理
+        if let reverseFlowSession = ipPacket.flowSession()?.reverse(),
+           self.flowSessionManager.hasSession(reverseFlowSession) {
+            self.flowSessionManager.updateSession(reverseFlowSession)
+            return true
+        }
+        
+        // 检查权限逻辑
+        let proto = ipPacket.header.proto
+        // 优先判断访问规则
+        switch ipPacket.transportPacket {
+        case .tcp(let tcpPacket):
+            if let ruleMap, ruleMap.isAllow(proto: proto, port: tcpPacket.header.dstPort) {
+                return true
+            }
+        case .udp(let udpPacket):
+            if let ruleMap, ruleMap.isAllow(proto: proto, port: udpPacket.dstPort) {
+                return true
+            }
+        case .icmp(_):
+            return true
+        default:
+            return false
+        }
+        
+        return false
+    }
+}

Tun/Punchnet/Context/SDLLayerPacketForwarder.swift

@@ -0,0 +1,67 @@
+//
+//  SDLLayerPacketForwarder.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/14.
+//
+
+import Foundation
+
+struct SDLLayerPacketForwarder {
+    
+    enum DeliveryPlan {
+        case superNode(payload: Data)
+        case peer(payload: Data, session: Session)
+        case superNodeAndPunch(payload: Data, request: SDLPuncherActor.RegisterRequest)
+    }
+    
+    let networkAddress: SDLConfiguration.NetworkAddress
+    let identityID: UInt32
+    let dataCipher: CCDataCipher?
+    let sessionManager: SessionManager
+    
+    func makeDeliveryPlan(dstMac: Data, type: LayerPacket.PacketType, data: Data) async throws -> DeliveryPlan? {
+        guard let payload = try self.makePayload(dstMac: dstMac, type: type, data: data) else {
+            return nil
+        }
+        
+        if ARPPacket.isBroadcastMac(dstMac) {
+            return .superNode(payload: payload)
+        }
+        
+        if let session = await self.sessionManager.getSession(toAddress: dstMac) {
+            return .peer(payload: payload, session: session)
+        }
+        
+        return .superNodeAndPunch(
+            payload: payload,
+            request: .init(
+                srcMac: self.networkAddress.mac,
+                dstMac: dstMac,
+                networkId: self.networkAddress.networkId
+            )
+        )
+    }
+    
+    private func makePayload(dstMac: Data, type: LayerPacket.PacketType, data: Data) throws -> Data? {
+        // 将数据封装层2层的数据包
+        let layerPacket = LayerPacket(dstMac: dstMac, srcMac: self.networkAddress.mac, type: type, data: data)
+        guard let dataCipher = self.dataCipher else {
+            return nil
+        }
+        
+        let encodedPacket = try dataCipher.encrypt(plainText: layerPacket.marshal())
+        
+        // 构造数据包
+        var dataPacket = SDLData()
+        dataPacket.networkID = self.networkAddress.networkId
+        dataPacket.srcMac = self.networkAddress.mac
+        dataPacket.dstMac = dstMac
+        dataPacket.ttl = 255
+        dataPacket.identityID = self.identityID
+        dataPacket.isP2P = true
+        dataPacket.data = encodedPacket
+        
+        return try dataPacket.serializedData()
+    }
+}

Tun/Punchnet/Context/SDLPacketReaderService.swift

@@ -0,0 +1,98 @@
+import Foundation
+import NetworkExtension
+
+actor SDLPacketReaderService {
+    enum Event {
+        case packet(IPPacket)
+    }
+
+    typealias EventHandler = @Sendable (Event) async -> Void
+    private typealias PacketReadResult = (packets: [Data], protocols: [NSNumber])?
+
+    private final class CancellationToken: @unchecked Sendable {
+        private let lock = NSLock()
+        private var cancelled: Bool = false
+
+        var isCancelled: Bool {
+            lock.lock()
+            defer {
+                lock.unlock()
+            }
+            return cancelled
+        }
+
+        func cancel() {
+            lock.lock()
+            cancelled = true
+            lock.unlock()
+        }
+    }
+
+    private let provider: NEPacketTunnelProvider
+    private let onEvent: EventHandler
+    private var readTask: Task<Void, Never>?
+    private var readToken: CancellationToken?
+
+    init(provider: NEPacketTunnelProvider, onEvent: @escaping EventHandler) {
+        self.provider = provider
+        self.onEvent = onEvent
+    }
+
+    func start() {
+        guard self.readTask == nil else {
+            return
+        }
+
+        let provider = self.provider
+        let onEvent = self.onEvent
+        let readToken = CancellationToken()
+        self.readToken = readToken
+
+        self.readTask = Task(priority: .high) {
+            while !Task.isCancelled && !readToken.isCancelled {
+                guard let batch = await Self.readPackets(from: provider) else {
+                    break
+                }
+
+                if Task.isCancelled || readToken.isCancelled {
+                    break
+                }
+
+                for (data, number) in zip(batch.packets, batch.protocols) where number.int32Value == 2 {
+                    if Task.isCancelled || readToken.isCancelled {
+                        break
+                    }
+
+                    if let packet = IPPacket(data) {
+                        await onEvent(.packet(packet))
+                    }
+                }
+            }
+            SDLLogger.log("[SDLPacketReaderService] readTask finished")
+        }
+    }
+
+    func stop() {
+        let readTask = self.readTask
+        self.readTask = nil
+        let readToken = self.readToken
+        self.readToken = nil
+        readToken?.cancel()
+        readTask?.cancel()
+    }
+
+    private static func readPackets(from provider: NEPacketTunnelProvider) async -> PacketReadResult {
+        let readContinuation = OnceContinuation<PacketReadResult, Never>()
+
+        return await withTaskCancellationHandler {
+            await withCheckedContinuation { continuation in
+                readContinuation.set(continuation)
+                provider.packetFlow.readPackets { packets, protocols in
+                    readContinuation.resume(returning: (packets: packets, protocols: protocols))
+                }
+            }
+        } onCancel: {
+            readContinuation.resume(returning: nil)
+        }
+    }
+}

Tun/Punchnet/Context/SDLSuperEventProcessor.swift

@@ -0,0 +1,72 @@
+//
+//  SDLSuperEventProcessor.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/15.
+//
+
+import Foundation
+import NIOCore
+
+final class SDLSuperEventProcessor {
+    enum ProcessingAction {
+        case removeSession(dstMac: Data)
+        case sendRegister(data: Data, remoteAddresses: [SocketAddress])
+        case shutdown(message: String)
+        case none
+    }
+    
+    struct ProcessingPlan {
+        let logMessage: String?
+        let action: ProcessingAction
+    }
+    
+    private let networkAddress: SDLConfiguration.NetworkAddress
+    
+    init(networkAddress: SDLConfiguration.NetworkAddress) {
+        self.networkAddress = networkAddress
+    }
+    
+    func makeProcessingPlan(event: SDLEvent) async -> ProcessingPlan {
+        switch event.event {
+        case .natChanged(let natChangedEvent):
+            let dstMac = natChangedEvent.mac
+            return .init(
+                logMessage: "[SDLContext] natChangedEvent, dstMac: \(dstMac)",
+                action: .removeSession(dstMac: dstMac)
+            )
+        case .sendRegister(let sendRegisterEvent):
+            return await self.makeSendRegisterPlan(sendRegisterEvent)
+        case .shutdown(let shutdownEvent):
+            return .init(logMessage: nil, action: .shutdown(message: shutdownEvent.message))
+        case .none:
+            return .init(logMessage: nil, action: .none)
+        }
+    }
+    
+    private func makeSendRegisterPlan(_ event: SDLEvent.SendRegister) async -> ProcessingPlan {
+        // 发送register包
+        var register = SDLRegister()
+        register.networkID = self.networkAddress.networkId
+        register.srcMac = self.networkAddress.mac
+        register.dstMac = event.dstMac
+        let registerData = try! register.serializedData()
+        
+        var remoteAddresses: [SocketAddress] = []
+        if event.natIp > 0 && event.natPort > 0 {
+            let address = SDLUtil.int32ToIp(event.natIp)
+            if let remoteAddress = try? SocketAddress.makeAddressResolvingHost(address, port: Int(event.natPort)) {
+                remoteAddresses.append(remoteAddress)
+            }
+        }
+        
+        if event.hasV6Info, let remoteAddress = try? await event.v6Info.socketAddress() {
+            remoteAddresses.append(remoteAddress)
+        }
+        
+        return .init(
+            logMessage: "[SDLContext] sendRegisterEvent, ip: \(event)",
+            action: .sendRegister(data: registerData, remoteAddresses: remoteAddresses)
+        )
+    }
+}

Tun/Punchnet/Context/SDLTunPacketRouter.swift

@@ -0,0 +1,114 @@
+//
+//  SDLTunPacketRouter.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/14.
+//
+
+import Foundation
+
+struct SDLTunPacketRouter {
+    enum DropReason: String {
+        case invalidDNSRequest
+        case noRoute
+    }
+    
+    enum ForwardKind {
+        case sameNetwork
+        case exitNode
+        case dnsExitNode
+    }
+    
+    enum RouteDecision {
+        case loopback(ipPacketData: Data)
+        case cloudDNS(name: String, ipPacketData: Data)
+        case localDNS(name: String, payload: Data, tracker: DNSLocalClient.DNSTracker)
+        case forwardToNextHop(ip: UInt32, type: LayerPacket.PacketType, data: Data, kind: ForwardKind)
+        case drop(reason: DropReason)
+    }
+    
+    let networkAddress: SDLConfiguration.NetworkAddress
+    let exitNode: SDLConfiguration.ExitNode?
+    
+    func route(packet: IPPacket, now: Date = Date()) -> RouteDecision {
+        let dstIp = packet.header.destination
+        
+        // 本地通讯, 目标地址是本地服务器的ip地址
+        if dstIp == self.networkAddress.ip {
+            return .loopback(ipPacketData: packet.data)
+        }
+        
+        // 处理dns的解析
+        if let dnsDecision = self.routeDNS(packet: packet, now: now) {
+            return dnsDecision
+        }
+        
+        // 判断目标地址是否和当前的网络地址是否在同一个网段
+        // 只有在同一个网段的ip数据才直接发送
+        if SDLUtil.inSameNetwork(ip: dstIp, compareIp: self.networkAddress.ip, maskLen: self.networkAddress.maskLen) {
+            return .forwardToNextHop(ip: dstIp, type: .ipv4, data: packet.data, kind: .sameNetwork)
+        }
+        
+        // 不在同一个网段的数据，看是否配置了网络出口, 如果配置了，转发数据个网络出口，否则丢弃
+        if let exitNode = self.exitNode {
+            return .forwardToNextHop(ip: exitNode.exitNodeIp, type: .ipv4, data: packet.data, kind: .exitNode)
+        }
+        
+        return .drop(reason: .noRoute)
+    }
+    
+    private func routeDNS(packet: IPPacket, now: Date) -> RouteDecision? {
+        guard DNSHelper.isDnsRequestPacket(ipPacket: packet) else {
+            return nil
+        }
+        
+        guard case .udp(let udpPacket) = packet.transportPacket else {
+            return .drop(reason: .invalidDNSRequest)
+        }
+        
+        // 数据是通过offset解析的, dns查询必然是udp包
+        let payloadOffset = udpPacket.payloadOffset
+        let dnsParser = DNSParser(data: packet.data, offset: payloadOffset)
+        guard let dnsMessage = dnsParser.parse(), let name = dnsMessage.questions.first?.name else {
+            return .drop(reason: .invalidDNSRequest)
+        }
+        
+        // 如果是内部域名，则转发整个ip包的内容到云端服务器
+        if name.contains(self.networkAddress.networkDomain) {
+            return .cloudDNS(name: name, ipPacketData: packet.data)
+        }
+        
+        // 如果开启了出口节点，则转发给出口节点
+        if let exitNode = self.exitNode {
+            return .forwardToNextHop(ip: exitNode.exitNodeIp, type: .ipv4, data: packet.data, kind: .dnsExitNode)
+        }
+        
+        // 通过本地的dns解析，发送的是udp的payload部分
+        let dnsPayload = Data(packet.data[payloadOffset..<packet.data.count])
+        let tracker = DNSLocalClient.DNSTracker(
+            transactionID: dnsMessage.transactionID,
+            clientIP: packet.header.source,
+            clientPort: udpPacket.srcPort,
+            createdAt: now
+        )
+        return .localDNS(name: name, payload: dnsPayload, tracker: tracker)
+    }
+}
+
+extension SDLTunPacketRouter.RouteDecision {
+    
+    var shouldTrackFlow: Bool {
+        switch self {
+        case .forwardToNextHop(_, _, _, let kind):
+            switch kind {
+            case .sameNetwork, .exitNode:
+                return true
+            case .dnsExitNode:
+                return false
+            }
+        default:
+            return false
+        }
+    }
+    
+}

Tun/Punchnet/DNS/DNSCloudClient.swift

@@ -0,0 +1,165 @@
+//
+//  SDLDNSClient 2.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/9.
+//
+import Foundation
+import Network
+
+final class DNSCloudClient {
+    
+    enum DNSCloudError: Error {
+        case failed(Error)
+        case cancelled
+        case sendFailed(Error)
+    }
+    
+    private enum State {
+        case idle
+        case running
+        case stopped
+    }
+    
+    private var state: State = .idle
+    
+    private var connection: NWConnection?
+    private var receiveTask: Task<Void, Never>?
+    private let dnsServerAddress: NWEndpoint
+    
+    // 用于对外输出收到的 DNS 响应包
+    public let packetFlow: AsyncThrowingStream<Data, Error>
+    private let packetContinuation: AsyncThrowingStream<Data, Error>.Continuation
+    private var isPacketContinuationFinished: Bool = false
+    
+    /// - Parameter host: 你的 sn-server 地址 (如 "8.8.8.8")
+    /// - Parameter port: 端口 (如 53)
+    init(host: String, port: UInt16) {
+        self.dnsServerAddress = .hostPort(host: NWEndpoint.Host(host), port: NWEndpoint.Port(integerLiteral: port))
+        
+        let packetPair = AsyncThrowingStream.makeStream(of: Data.self)
+        self.packetFlow = packetPair.stream
+        self.packetContinuation = packetPair.continuation
+    }
+    
+    func start() {
+        // 1. 配置参数：这是解决环路的关键
+        let parameters = NWParameters.udp
+        // 禁止此连接走 TUN 网卡（在 NE 中 TUN 通常被归类为 .other）
+        parameters.prohibitedInterfaceTypes = [.other]
+        // 2. 增强健壮性：启用多路径切换（替代 pathSelectionOptions 的意图）
+        parameters.multipathServiceType = .handover
+        
+        // 2. 创建连接
+        let connection = NWConnection(to: self.dnsServerAddress, using: parameters)
+        connection.stateUpdateHandler = { [weak self] state in
+            self?.handleConnectionStateUpdate(state, for: connection)
+        }
+        // 启动连接队列
+        connection.start(queue: .global())
+        
+        self.connection = connection
+    }
+    
+    /// 发送 DNS 查询包（由 TUN 拦截到的原始 IP 包数据）
+    func forward(ipPacketData: Data) {
+        guard let connection = self.connection, connection.state == .ready else {
+            return
+        }
+        
+        connection.send(content: ipPacketData, completion: .contentProcessed { error in
+            if let error = error {
+                self.finishPacketContinuationIfNeed(throwing: .sendFailed(error))
+            }
+        })
+    }
+    
+    func stop() {
+        guard self.state != .stopped else {
+            return
+        }
+        
+        self.state = .stopped
+        
+        self.receiveTask?.cancel()
+        self.receiveTask = nil
+        
+        self.connection?.cancel()
+        self.connection = nil
+        
+        self.finishPacketContinuationIfNeed(throwing: nil)
+        
+        SDLLogger.log("[SDLCloudClient] stopped")
+    }
+    
+    private func handleConnectionStateUpdate(_ state: NWConnection.State, for connection: NWConnection) {
+        switch state {
+        case .ready:
+            SDLLogger.log("[DNSClient] Connection ready", for: .debug)
+            self.startReceiveTask(for: connection)
+            self.state = .running
+        case .failed(let error):
+            self.finishPacketContinuationIfNeed(throwing: .failed(error))
+        case .cancelled:
+            self.finishPacketContinuationIfNeed(throwing: .cancelled)
+        default:
+            break
+        }
+    }
+    
+    private func startReceiveTask(for connection: NWConnection) {
+        guard self.receiveTask == nil else {
+            return
+        }
+        
+        let stream = Self.makeReceiveStream(for: connection)
+        self.receiveTask = Task { [weak self] in
+            for await data in stream {
+                if Task.isCancelled {
+                    break
+                }
+                self?.packetContinuation.yield(data)
+            }
+        }
+    }
+    
+    private func finishPacketContinuationIfNeed(throwing error: DNSCloudError?) {
+        guard !self.isPacketContinuationFinished else {
+            return
+        }
+        
+        self.isPacketContinuationFinished = true
+        if let error {
+            self.packetContinuation.finish(throwing: error)
+        } else {
+            self.packetContinuation.finish()
+        }
+    }
+    
+    /// 接收数据的递归循环
+    private static func makeReceiveStream(for connection: NWConnection) -> AsyncStream<Data> {
+        return AsyncStream(bufferingPolicy: .bufferingNewest(256)) { continuation in
+            func receiveNext() {
+                connection.receiveMessage { content, _, _, error in
+                    if let data = content, !data.isEmpty {
+                        // 将收到的 DNS 响应写回 AsyncStream
+                        continuation.yield(data)
+                    }
+                    
+                    if error == nil && connection.state == .ready {
+                        receiveNext() // 继续监听下一个包
+                    } else {
+                        continuation.finish()
+                    }
+                }
+            }
+            
+            receiveNext()
+        }
+    }
+    
+    deinit {
+        SDLLogger.log("[DNSCloudClient] deinit", for: .debug)
+    }
+    
+}

Tun/Punchnet/DNS/DNSHelper.swift

@@ -0,0 +1,19 @@
+//
+//  Helper.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/10.
+//
+import Foundation
+
+struct DNSHelper {
+    static let dnsServer: String = "100.100.100.100"
+    // dns请求包的目标地址
+    static let dnsDestIpAddr: UInt32 = 1684300900
+    
+    // 判断是否是dns请求的数据包
+    static func isDnsRequestPacket(ipPacket: IPPacket) -> Bool {
+        return ipPacket.header.destination == dnsDestIpAddr
+    }
+    
+}

Tun/Punchnet/DNS/DNSLocalClient.swift

@@ -0,0 +1,361 @@
+import Foundation
+import Network
+
+actor DNSLocalClient {
+    
+    struct DNSTracker {
+        let transactionID: UInt16
+        let clientIP: UInt32
+        let clientPort: UInt16
+        let createdAt: Date
+    }
+    
+    private struct PendingRequest {
+        let tracker: DNSTracker
+    }
+    
+    private enum State {
+        case idle
+        case starting
+        case running
+        case stopped
+    }
+    
+    enum DNSLocalError: Error {
+        case failed(Error)
+        case cancelled
+        case sendFailed(Error)
+    }
+    
+    private var state: State = .idle
+    
+    private let dnsServerEndpoint: NWEndpoint
+    private var connection: NWConnection?
+    private var receiveTask: Task<Void, Never>?
+    
+    private var cleanupTask: Task<Void, Never>?
+    private let timeoutInterval: TimeInterval = 3.0
+    
+    nonisolated let packetFlow: AsyncThrowingStream<Data, Error>
+    private let packetContinuation: AsyncThrowingStream<Data, Error>.Continuation
+    private var isPacketContinuationFinished: Bool = false
+    
+    private var pendingRequests: [UInt16: PendingRequest] = [:]
+    private var nextTransactionID: UInt16 = 1
+    
+    init(host: String) {
+        self.dnsServerEndpoint = .hostPort(host: NWEndpoint.Host(host), port: 53)
+        
+        let (stream, continuation) = AsyncThrowingStream.makeStream(of: Data.self, bufferingPolicy: .bufferingNewest(256))
+        self.packetFlow = stream
+        self.packetContinuation = continuation
+        
+        self.packetContinuation.onTermination = { termination in
+            SDLLogger.log("[DNSLocalClient] packetFlow terminated: \(termination)")
+        }
+    }
+    
+    func start() {
+        guard self.state == .idle else {
+            return
+        }
+        self.state = .starting
+
+        let parameters = NWParameters.udp
+        parameters.prohibitedInterfaceTypes = [.other]
+        // 2. 增强健壮性：启用多路径切换（替代 pathSelectionOptions 的意图）
+        parameters.multipathServiceType = .handover
+        
+        let connection = NWConnection(to: self.dnsServerEndpoint, using: parameters)
+        connection.stateUpdateHandler = { [weak self] state in
+            Task {
+                await self?.handleConnectionStateUpdate(state, for: connection)
+            }
+        }
+
+        let cleanupTask = Task { [weak self] in
+            while !Task.isCancelled {
+                try? await Task.sleep(nanoseconds: 3 * 1_000_000_000)
+                await self?.performCleanup()
+            }
+        }
+
+        self.connection = connection
+        self.cleanupTask = cleanupTask
+        
+        connection.start(queue: .global())
+    }
+    
+    func query(tracker: DNSTracker, dnsPayload: Data) {
+        guard self.state != .stopped,
+              let connection = self.connection, connection.state == .ready, dnsPayload.count >= 2 else {
+            return
+        }
+        
+        guard let allocatedTransactionID = self.allocateTransactionID() else {
+            SDLLogger.log("[DNSLocalClient] no available transaction id", for: .debug)
+            return
+        }
+        
+        let transactionID = allocatedTransactionID
+        self.pendingRequests[transactionID] = PendingRequest(tracker: tracker)
+        let rewrittenPayload = Self.rewriteTransactionID(in: dnsPayload, to: transactionID)
+        
+        connection.send(content: rewrittenPayload, completion: .contentProcessed { [weak self] error in
+            if let error {
+                Task {
+                    await self?.handleSendFailure(transactionID: transactionID, error: error)
+                }
+            }
+        })
+    }
+    
+    func stop() {
+        guard self.state != .stopped else {
+            return
+        }
+        
+        self.state = .stopped
+        
+        let receiveTask = self.receiveTask
+        self.receiveTask = nil
+        
+        let connection = self.connection
+        self.connection = nil
+        
+        let cleanupTask = self.cleanupTask
+        self.cleanupTask = nil
+        
+        self.pendingRequests.removeAll()
+        self.nextTransactionID = 1
+
+        receiveTask?.cancel()
+        connection?.cancel()
+        cleanupTask?.cancel()
+        self.finishPacketContinuationIfNeed(throwing: nil)
+        
+        SDLLogger.log("[SDLLocalClient] stopped")
+    }
+    
+    private func handleConnectionStateUpdate(_ state: NWConnection.State, for conn: NWConnection) {
+        switch state {
+        case .ready:
+            if self.markConnectionReady(conn) {
+                self.startReceiveTask(for: conn)
+            }
+        case .failed(let error):
+            SDLLogger.log("[DNSLocalClient] failed with error: \(error.localizedDescription)", for: .debug)
+            self.finishPacketContinuationIfNeed(throwing: .failed(error))
+        case .cancelled:
+            self.finishPacketContinuationIfNeed(throwing: .cancelled)
+        default:
+            ()
+        }
+    }
+    
+    private func startReceiveTask(for conn: NWConnection) {
+        let stream = Self.makeReceiveStream(for: conn)
+        
+        let task = Task { [weak self] in
+            for await data in stream {
+                guard let self else {
+                    break
+                }
+                await self.handleResponse(data: data)
+            }
+        }
+
+        let shouldKeepTask = self.state != .stopped && self.isCurrentConnection(conn)
+        if shouldKeepTask {
+            self.receiveTask?.cancel()
+            self.receiveTask = task
+        }
+
+        if !shouldKeepTask {
+            task.cancel()
+        }
+    }
+    
+    private func finishPacketContinuationIfNeed(throwing error: DNSLocalError?) {
+        guard !self.isPacketContinuationFinished else {
+            return
+        }
+        
+        self.isPacketContinuationFinished = true
+
+        if let error {
+            self.packetContinuation.finish(throwing: error)
+        } else {
+            self.packetContinuation.finish()
+        }
+    }
+    
+    private func handleResponse(data: Data) {
+        guard let rewrittenTransactionID = Self.readTransactionID(from: data),
+              let pendingRequest = self.pendingRequests.removeValue(forKey: rewrittenTransactionID) else {
+            return
+        }
+        
+        let restoredPayload = Self.rewriteTransactionID(in: data, to: pendingRequest.tracker.transactionID)
+        
+        let packet = Self.createDNSResponse(
+            payload: restoredPayload,
+            srcIP: DNSHelper.dnsDestIpAddr,
+            srcPort: 53,
+            destIP: pendingRequest.tracker.clientIP,
+            destPort: pendingRequest.tracker.clientPort
+        )
+        self.packetContinuation.yield(packet)
+    }
+
+    private func markConnectionReady(_ conn: NWConnection) -> Bool {
+        guard self.state != .stopped, self.isCurrentConnection(conn) else {
+            return false
+        }
+
+        self.state = .running
+        return true
+    }
+
+    private func isCurrentConnection(_ conn: NWConnection) -> Bool {
+        guard let currentConnection = self.connection else {
+            return false
+        }
+
+        return currentConnection === conn
+    }
+
+    private func handleSendFailure(transactionID: UInt16, error: NWError) {
+        self.pendingRequests.removeValue(forKey: transactionID)
+        self.finishPacketContinuationIfNeed(throwing: .sendFailed(error))
+    }
+    
+    private func performCleanup() {
+        let now = Date()
+        self.pendingRequests = self.pendingRequests.filter { _, request in
+            now.timeIntervalSince(request.tracker.createdAt) < self.timeoutInterval
+        }
+    }
+    
+    private func allocateTransactionID() -> UInt16? {
+        var candidate = self.nextTransactionID == 0 ? 1 : self.nextTransactionID
+        let start = candidate
+        
+        repeat {
+            if self.pendingRequests[candidate] == nil {
+                self.nextTransactionID = Self.nextTransactionID(after: candidate)
+                return candidate
+            }
+            
+            candidate = Self.nextTransactionID(after: candidate)
+        } while candidate != start
+        
+        return nil
+    }
+    
+    private static func nextTransactionID(after id: UInt16) -> UInt16 {
+        return id == UInt16.max ? 1 : id &+ 1
+    }
+    
+    private static func readTransactionID(from payload: Data) -> UInt16? {
+        guard payload.count >= 2 else {
+            return nil
+        }
+        
+        return UInt16(payload[0]) << 8 | UInt16(payload[1])
+    }
+    
+    private static func rewriteTransactionID(in payload: Data, to transactionID: UInt16) -> Data {
+        guard payload.count >= 2 else {
+            return payload
+        }
+        
+        var rewrittenPayload = payload
+        rewrittenPayload[0] = UInt8((transactionID >> 8) & 0xFF)
+        rewrittenPayload[1] = UInt8(transactionID & 0xFF)
+        return rewrittenPayload
+    }
+    
+    private static func makeReceiveStream(for conn: NWConnection) -> AsyncStream<Data> {
+        return AsyncStream(bufferingPolicy: .bufferingNewest(256)) { continuation in
+            func receiveNext() {
+                conn.receiveMessage { content, _, _, error in
+                    if let data = content, !data.isEmpty {
+                        continuation.yield(data)
+                    }
+                    
+                    if error == nil && conn.state == .ready {
+                        receiveNext()
+                    } else {
+                        continuation.finish()
+                    }
+                }
+            }
+            
+            receiveNext()
+        }
+    }
+    
+    deinit {
+        SDLLogger.log("[DNSLocalClient] deinit", for: .debug)
+    }
+}
+
+extension DNSLocalClient {
+    static func createDNSResponse(payload: Data, srcIP: UInt32, srcPort: UInt16, destIP: UInt32, destPort: UInt16) -> Data {
+        let udpLen = 8 + payload.count
+        let ipLen = 20 + udpLen
+        
+        var ipHeader = Data(count: 20)
+        ipHeader[0] = 0x45
+        ipHeader[2...3] = withUnsafeBytes(of: UInt16(ipLen).bigEndian) { Data($0) }
+        ipHeader[8] = 64
+        ipHeader[9] = 17
+        
+        ipHeader[12...15] = withUnsafeBytes(of: srcIP.bigEndian) { Data($0) }
+        ipHeader[16...19] = withUnsafeBytes(of: destIP.bigEndian) { Data($0) }
+        
+        let ipChecksum = calculateChecksum(data: ipHeader)
+        ipHeader[10...11] = withUnsafeBytes(of: ipChecksum.bigEndian) { Data($0) }
+        
+        var udpHeader = Data(count: 8)
+        udpHeader[0...1] = withUnsafeBytes(of: srcPort.bigEndian) { Data($0) }
+        udpHeader[2...3] = withUnsafeBytes(of: destPort.bigEndian) { Data($0) }
+        udpHeader[4...5] = withUnsafeBytes(of: UInt16(udpLen).bigEndian) { Data($0) }
+        udpHeader[6...7] = Data([0, 0])
+        
+        var packet = Data(capacity: ipLen)
+        packet.append(ipHeader)
+        packet.append(udpHeader)
+        packet.append(payload)
+        
+        return packet
+    }
+    
+    static func calculateChecksum(data: Data) -> UInt16 {
+        var sum: UInt32 = 0
+        let count = data.count
+        
+        data.withUnsafeBytes { (ptr: UnsafeRawBufferPointer) in
+            guard let baseAddress = ptr.baseAddress else { return }
+            
+            let wordCount = count / 2
+            let words = baseAddress.bindMemory(to: UInt16.self, capacity: wordCount)
+            
+            for i in 0..<wordCount {
+                sum += UInt32(UInt16(bigEndian: words[i]))
+            }
+            
+            if count % 2 != 0 {
+                let lastByte = ptr[count - 1]
+                sum += UInt32(lastByte) << 8
+            }
+        }
+        
+        while (sum >> 16) != 0 {
+            sum = (sum & 0xffff) + (sum >> 16)
+        }
+        
+        return UInt16(~sum & 0xffff)
+    }
+}

Tun/Punchnet/DNS/DNSParser.swift

@@ -0,0 +1,137 @@
+//
+//  DNSQuestion.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/10.
+//
+import Foundation
+import Network
+
+// MARK: - DNS 協議模型
+struct DNSQuestion {
+    let name: String
+    let type: UInt16
+    let qclass: UInt16
+}
+
+struct DNSResourceRecord {
+    let name: String
+    let type: UInt16
+    let rclass: UInt16
+    let ttl: UInt32
+    let rdLength: UInt16
+    let rdata: Data
+}
+
+struct DNSMessage {
+    var transactionID: UInt16
+    var flags: UInt16
+    var questions: [DNSQuestion] = []
+    var answers: [DNSResourceRecord] = []
+    
+    var isResponse: Bool {
+        (flags & 0x8000) != 0
+    }
+}
+
+// MARK: - DNS 完整解析器
+final class DNSParser {
+    private let data: Data
+    private var offset: Int = 0
+
+    init(data: Data, offset: Int) {
+        self.data = data
+        self.offset = offset
+    }
+
+    func parse() -> DNSMessage? {
+        guard data.count >= 12 + self.offset else {
+            return nil
+        }
+        
+        let id = readUInt16()
+        let flags = readUInt16()
+        let qdCount = readUInt16()
+        let anCount = readUInt16()
+        let _ = readUInt16() // NSCount
+        let _ = readUInt16() // ARCount
+        
+        var message = DNSMessage(transactionID: id, flags: flags)
+        
+        for _ in 0..<qdCount {
+            if let q = parseQuestion() {
+                message.questions.append(q)
+            }
+        }
+        
+        for _ in 0..<anCount {
+            if let rr = parseRR() {
+                message.answers.append(rr)
+            }
+        }
+        
+        return message
+    }
+
+    private func parseName() -> String {
+        var parts: [String] = []
+        var jumped = false
+        var nextOffset = 0
+        var currentOffset = self.offset
+
+        while currentOffset < data.count {
+            let length = Int(data[currentOffset])
+            if length == 0 {
+                currentOffset += 1
+                break
+            }
+            if (length & 0xC0) == 0xC0 {
+                let pointer = Int(UInt16(data[currentOffset] & 0x3F) << 8 | UInt16(data[currentOffset + 1]))
+                if !jumped {
+                    nextOffset = currentOffset + 2
+                    jumped = true
+                }
+                currentOffset = pointer
+            } else {
+                currentOffset += 1
+                if let label = String(data: data.subdata(in: currentOffset..<currentOffset+length), encoding: .ascii) {
+                    parts.append(label)
+                }
+                currentOffset += length
+            }
+        }
+        self.offset = jumped ? nextOffset : currentOffset
+        return parts.joined(separator: ".")
+    }
+
+    private func parseQuestion() -> DNSQuestion? {
+        let name = parseName()
+        return DNSQuestion(name: name, type: readUInt16(), qclass: readUInt16())
+    }
+
+    private func parseRR() -> DNSResourceRecord? {
+        let name = parseName()
+        let type = readUInt16()
+        let rclass = readUInt16()
+        let ttl = readUInt32()
+        let rdLength = readUInt16()
+        guard offset + Int(rdLength) <= data.count else { return nil }
+        let rdata = data.subdata(in: offset..<offset + Int(rdLength))
+        offset += Int(rdLength)
+        return DNSResourceRecord(name: name, type: type, rclass: rclass, ttl: ttl, rdLength: rdLength, rdata: rdata)
+    }
+
+    private func readUInt16() -> UInt16 {
+        guard offset + 2 <= data.count else { return 0 }
+        let val = UInt16(data[offset]) << 8 | UInt16(data[offset + 1])
+        offset += 2
+        return val
+    }
+
+    private func readUInt32() -> UInt32 {
+        guard offset + 4 <= data.count else { return 0 }
+        let val = UInt32(data[offset]) << 24 | UInt32(data[offset+1]) << 16 | UInt32(data[offset+2]) << 8 | UInt32(data[offset+3])
+        offset += 4
+        return val
+    }
+}

Tun/Punchnet/DNS/SDLDNSService.swift

@@ -0,0 +1,144 @@
+import Foundation
+import NetworkExtension
+
+actor SDLDNSService {
+    enum Event {
+        case packet(Data)
+    }
+
+    typealias EventHandler = @Sendable (Event) async -> Void
+
+    private let serverHost: String
+    private let publicDnsServers: [String]
+    private let onEvent: EventHandler
+
+    private var dnsClient: DNSCloudClient?
+    private var dnsMonitorTask: Task<Void, Never>?
+
+    private var dnsLocalClient: DNSLocalClient?
+    private var dnsLocalMonitorTask: Task<Void, Never>?
+
+    init(serverHost: String, publicDnsServers: [String], onEvent: @escaping EventHandler) {
+        self.serverHost = serverHost
+        self.publicDnsServers = publicDnsServers
+        self.onEvent = onEvent
+    }
+
+    func start() {
+        self.startCloud()
+        self.startLocal()
+    }
+
+    func stop() async {
+        let dnsClient = self.dnsClient
+        self.dnsClient = nil
+        let dnsMonitorTask = self.dnsMonitorTask
+        self.dnsMonitorTask = nil
+
+        let dnsLocalClient = self.dnsLocalClient
+        self.dnsLocalClient = nil
+        let dnsLocalMonitorTask = self.dnsLocalMonitorTask
+        self.dnsLocalMonitorTask = nil
+
+        dnsMonitorTask?.cancel()
+        dnsClient?.stop()
+        if let dnsMonitorTask {
+            await dnsMonitorTask.value
+        }
+
+        dnsLocalMonitorTask?.cancel()
+        await dnsLocalClient?.stop()
+        if let dnsLocalMonitorTask {
+            await dnsLocalMonitorTask.value
+        }
+    }
+
+    func forward(ipPacketData: Data) {
+        self.dnsClient?.forward(ipPacketData: ipPacketData)
+    }
+
+    func queryLocal(tracker: DNSLocalClient.DNSTracker, dnsPayload: Data) async {
+        await self.dnsLocalClient?.query(tracker: tracker, dnsPayload: dnsPayload)
+    }
+
+    private func startCloud() {
+        guard self.dnsMonitorTask == nil else {
+            return
+        }
+
+        self.dnsMonitorTask = startMonitorTask(name: "dnsServiceCloudMonitor") { [weak self] in
+            guard let self else {
+                throw CancellationError()
+            }
+            try await self.runCloud()
+        }
+    }
+
+    private func startLocal() {
+        guard self.dnsLocalMonitorTask == nil else {
+            return
+        }
+
+        self.dnsLocalMonitorTask = startMonitorTask(name: "dnsServiceLocalMonitor") { [weak self] in
+            guard let self else {
+                throw CancellationError()
+            }
+            try await self.runLocal()
+        }
+    }
+
+    private func runCloud() async throws {
+        let dnsClient = DNSCloudClient(host: self.serverHost, port: 15353)
+        self.dnsClient = dnsClient
+        dnsClient.start()
+
+        defer {
+            dnsClient.stop()
+            if self.dnsClient === dnsClient {
+                self.dnsClient = nil
+            }
+        }
+
+        let onEvent = self.onEvent
+        try await withTaskCancellationHandler {
+            for try await packet in dnsClient.packetFlow {
+                try Task.checkCancellation()
+                await onEvent(.packet(packet))
+            }
+        } onCancel: {
+            dnsClient.stop()
+        }
+    }
+
+    private func runLocal() async throws {
+        let dnsServer = self.publicDnsServers.randomElement() ?? "223.5.5.5"
+        let dnsLocalClient = DNSLocalClient(host: dnsServer)
+        await dnsLocalClient.start()
+        self.dnsLocalClient = dnsLocalClient
+        SDLLogger.log("[SDLDNSService] dnsLocalClient started")
+
+        defer {
+            if self.dnsLocalClient === dnsLocalClient {
+                self.dnsLocalClient = nil
+            }
+        }
+
+        let onEvent = self.onEvent
+        do {
+            try await withTaskCancellationHandler {
+                for try await packet in dnsLocalClient.packetFlow {
+                    try Task.checkCancellation()
+                    await onEvent(.packet(packet))
+                }
+            } onCancel: {
+                Task {
+                    await dnsLocalClient.stop()
+                }
+            }
+            await dnsLocalClient.stop()
+        } catch {
+            await dnsLocalClient.stop()
+            throw error
+        }
+    }
+}

Tun/Punchnet/IPPacket.swift

@@ -1,86 +0,0 @@
-//
-//  IPPacket.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/1/18.
-//
-
-import Foundation
-
-struct IPHeader {
-    let version: UInt8
-    let headerLength: UInt8
-    let typeOfService: UInt8
-    let totalLength: UInt16
-    let id: UInt16
-    let offset: UInt16
-    let timeToLive: UInt8
-    let proto:UInt8
-    let checksum: UInt16
-    let source: UInt32
-    let destination: UInt32
-    
-    var source_ip: String {
-        return intToIp(source)
-    }
-    
-    var destination_ip: String {
-        return intToIp(destination)
-    }
-    
-    private func intToIp(_ num: UInt32) -> String {
-        let ip0 = (UInt8) (num >> 24 & 0xFF)
-        let ip1 = (UInt8) (num >> 16 & 0xFF)
-        let ip2 = (UInt8) (num >> 8 & 0xFF)
-        let ip3 = (UInt8) (num & 0xFF)
-        
-        return "\(ip0).\(ip1).\(ip2).\(ip3)"
-    }
-    
-    public var description: String {
-        """
-        IPHeader version: \(version), header length: \(headerLength), type of service: \(typeOfService), total length: \(totalLength),
-        id: \(id), offset: \(offset), time ot live: \(timeToLive), proto: \(proto), checksum: \(checksum), source ip: \(source_ip), destination ip:\(destination_ip)
-        """
-    }
-}
-
-enum IPVersion: UInt8 {
-    case ipv4 = 4
-    case ipv6 = 6
-}
-
-enum TransportProtocol: UInt8 {
-    case icmp = 1
-    case tcp = 6
-    case udp = 17
-}
-
-struct IPPacket {
-    let header: IPHeader
-    let data: Data
-    
-    init?(_ data: Data) {
-        guard data.count >= 20 else {
-            return nil
-        }
-        
-        self.header = IPHeader(version: data[0] >> 4,
-                               headerLength: (data[0] & 0b1111) * 4,
-                               typeOfService: data[1],
-                               totalLength: UInt16(bytes: (data[2], data[3])),
-                               id: UInt16(bytes: (data[4], data[5])),
-                               offset: 1,
-                               timeToLive: data[8],
-                               proto: data[9],
-                               checksum: UInt16(bytes: (data[10], data[11])),
-                               source: UInt32(bytes: (data[12], data[13], data[14], data[15])),
-                               destination: UInt32(bytes: (data[16], data[17], data[18], data[19])))
-        self.data = data
-    }
-    
-    // 获取负载部分
-    func getPayload() -> Data {
-        return data.subdata(in: 20..<data.count)
-    }
-}

Tun/Punchnet/NWPath/SDLPathDebounceActor.swift

@@ -0,0 +1,54 @@
+//
+//  SDLPathDebounceActor.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/29.
+//
+
+import Foundation
+import Network
+
+actor SDLPathDebounceActor {
+    private var lastSnapshot: SDLPathSnapshot?
+    private var debounceTask: Task<Void, Never>?
+    
+    private let delay: Duration
+    
+    public let statusStream: AsyncStream<NWPath.Status>
+    private let statusCont: AsyncStream<NWPath.Status>.Continuation
+
+    init(delay: Duration = .seconds(2)) {
+        self.delay = delay
+        let (stream, cont) = AsyncStream.makeStream(of: NWPath.Status.self)
+        self.statusStream = stream
+        self.statusCont = cont
+    }
+    
+    func submit(_ snapshot: SDLPathSnapshot) {
+        guard snapshot != lastSnapshot else {
+            return
+        }
+        
+        self.lastSnapshot = snapshot
+        
+        self.debounceTask?.cancel()
+        self.debounceTask = Task { [delay] in
+            try? await Task.sleep(for: delay)
+            
+            guard !Task.isCancelled else {
+                return
+            }
+            await self.handleStableSnapshot(snapshot)
+        }
+    }
+    
+    private func handleStableSnapshot(_ snapshot: SDLPathSnapshot) async {
+        self.statusCont.yield(snapshot.status)
+    }
+
+    func stop() {
+        debounceTask?.cancel()
+        debounceTask = nil
+    }
+    
+}

Tun/Punchnet/NWPath/SDLPathMonitor.swift

@@ -0,0 +1,45 @@
+//
+//  SDLPathMonitor.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/29.
+//
+import Foundation
+import Network
+
+final class SDLPathMonitor {
+    private let monitor = NWPathMonitor()
+    private let queue = DispatchQueue(label: "com.sdlan.path-monitor")
+    private let debouncer = SDLPathDebounceActor(delay: .seconds(2))
+    
+    private var isStarted: Bool = false
+    
+    func start() {
+        guard !isStarted else {
+            return
+        }
+        
+        self.isStarted = true
+        monitor.pathUpdateHandler = { path in
+            let snapshot = SDLPathSnapshot(path)
+            
+            Task {
+                await self.debouncer.submit(snapshot)
+            }
+        }
+        
+        monitor.start(queue: queue)
+    }
+    
+    func statusStream() -> AsyncStream<NWPath.Status> {
+        return self.debouncer.statusStream
+    }
+    
+    func stop() {
+        Task {
+            await debouncer.stop()
+        }
+        monitor.cancel()
+    }
+    
+}

Tun/Punchnet/NWPath/SDLPathSnapshot.swift

@@ -0,0 +1,32 @@
+//
+//  PathSnapshot.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/29.
+//
+import Foundation
+import Network
+
+struct SDLPathSnapshot: Equatable, Sendable {
+    let status: NWPath.Status
+    let isExpensive: Bool
+    let isConstrained: Bool
+    let supportsIPv4: Bool
+    let supportsIPv6: Bool
+    let supportsDNS: Bool
+    let usesWiFi: Bool
+    let usesWired: Bool
+    let usesCellular: Bool
+
+    init(_ path: NWPath) {
+        self.status = path.status
+        self.isExpensive = path.isExpensive
+        self.isConstrained = path.isConstrained
+        self.supportsIPv4 = path.supportsIPv4
+        self.supportsIPv6 = path.supportsIPv6
+        self.supportsDNS = path.supportsDNS
+        self.usesWiFi = path.usesInterfaceType(.wifi)
+        self.usesWired = path.usesInterfaceType(.wiredEthernet)
+        self.usesCellular = path.usesInterfaceType(.cellular)
+    }
+}

Tun/Punchnet/NetworkStack/IPPacket.swift

@@ -0,0 +1,237 @@
+//
+//  IPPacket.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/18.
+//
+
+import Foundation
+
+enum IPVersion: UInt8 {
+    case ipv4 = 4
+    case ipv6 = 6
+}
+
+enum TransportProtocol: UInt8 {
+    case icmp = 1
+    case tcp  = 6
+    case udp  = 17
+}
+
+// MARK: - IP Header
+
+struct IPHeader {
+    let version: UInt8
+    let headerLength: UInt8
+    let typeOfService: UInt8
+    let totalLength: UInt16
+    let id: UInt16
+    let offset: UInt16
+    let ttl: UInt8
+    let proto: UInt8
+    let checksum: UInt16
+    let source: UInt32
+    let destination: UInt32
+
+    var headerBytes: Int {
+        Int(headerLength)
+    }
+}
+
+// MARK: - IP Packet
+
+struct IPPacket {
+    let header: IPHeader
+    let data: Data
+    let transportPacket: TransportPacket
+    
+    enum TransportPacket {
+        case tcp(TCPPacket)
+        case udp(UDPPacket)
+        case icmp(ICMPPacket)
+        case unsupported(UInt8)
+        case malformed
+    }
+    
+    init?(_ data: Data) {
+        guard data.count >= 20 else {
+            return nil
+        }
+
+        let version = data[0] >> 4
+        let headerLen = (data[0] & 0x0F) * 4
+
+        guard data.count >= headerLen else {
+            return nil
+        }
+
+        self.header = IPHeader(
+            version: version,
+            headerLength: headerLen,
+            typeOfService: data[1],
+            totalLength: UInt16(bytes: (data[2], data[3])),
+            id: UInt16(bytes: (data[4], data[5])),
+            offset: UInt16(bytes: (data[6], data[7])),
+            ttl: data[8],
+            proto: data[9],
+            checksum: UInt16(bytes: (data[10], data[11])),
+            source: UInt32(bytes: (data[12], data[13], data[14], data[15])),
+            destination: UInt32(bytes: (data[16], data[17], data[18], data[19]))
+        )
+
+        self.data = data
+        self.transportPacket = Self.parseTransportPacket(proto: data[9], offset: Int(headerLen), data: data)
+    }
+
+    private static func parseTransportPacket(proto: UInt8, offset: Int, data: Data) -> TransportPacket {
+        guard let proto = TransportProtocol(rawValue: proto) else {
+            return .unsupported(proto)
+        }
+        
+        switch proto {
+        case .tcp:
+            guard let tcp = TCPPacket(data, offset: offset) else {
+                return .malformed
+            }
+            return .tcp(tcp)
+            
+        case .udp:
+            guard let udp = UDPPacket(data, offset: offset) else {
+                return .malformed
+            }
+            return .udp(udp)
+            
+        case .icmp:
+            guard let icmp = ICMPPacket(data, offset: offset) else {
+                return .malformed
+            }
+            return .icmp(icmp)
+        }
+    }
+    
+}
+
+// MARK: - TCP Flags
+
+struct TCPFlags: OptionSet {
+    let rawValue: UInt16
+
+    static let fin = TCPFlags(rawValue: 1 << 0)
+    static let syn = TCPFlags(rawValue: 1 << 1)
+    static let rst = TCPFlags(rawValue: 1 << 2)
+    static let psh = TCPFlags(rawValue: 1 << 3)
+    static let ack = TCPFlags(rawValue: 1 << 4)
+    static let urg = TCPFlags(rawValue: 1 << 5)
+    static let ece = TCPFlags(rawValue: 1 << 6)
+    static let cwr = TCPFlags(rawValue: 1 << 7)
+}
+
+// MARK: - TCP Header
+
+struct TCPHeader {
+    let srcPort: UInt16
+    let dstPort: UInt16
+
+    let seq: UInt32
+    let ack: UInt32
+
+    let dataOffset: UInt8
+    let flags: TCPFlags
+
+    let window: UInt16
+    let checksum: UInt16
+    let urgentPointer: UInt16
+
+    var headerLength: Int {
+        Int(dataOffset) * 4
+    }
+}
+
+// MARK: - TCP Packet
+
+struct TCPPacket {
+    let header: TCPHeader
+
+    init?(_ data: Data, offset: Int) {
+        guard data.count >= offset + 20 else {
+            return nil
+        }
+
+        let srcPort = UInt16(bytes: (data[offset], data[offset + 1]))
+        let dstPort = UInt16(bytes: (data[offset + 2], data[offset + 3]))
+
+        let seq = UInt32(bytes: (data[offset + 4], data[offset + 5], data[offset + 6], data[offset + 7]))
+        let ack = UInt32(bytes: (data[offset + 8], data[offset + 9], data[offset + 10], data[offset + 11]))
+
+        let offsetAndFlags = UInt16(bytes: (data[offset + 12], data[offset + 13]))
+
+        let dataOffset = UInt8(offsetAndFlags >> 12)
+        let flags = TCPFlags(rawValue: offsetAndFlags & 0x01FF)
+
+        let window = UInt16(bytes: (data[offset + 14], data[offset + 15]))
+        let checksum = UInt16(bytes: (data[offset + 16], data[offset + 17]))
+        let urgent = UInt16(bytes: (data[offset + 18], data[offset + 19]))
+
+        let header = TCPHeader(
+            srcPort: srcPort,
+            dstPort: dstPort,
+            seq: seq,
+            ack: ack,
+            dataOffset: dataOffset,
+            flags: flags,
+            window: window,
+            checksum: checksum,
+            urgentPointer: urgent
+        )
+
+        let headerLen = header.headerLength
+        guard data.count >= offset + headerLen else {
+            return nil
+        }
+        
+        self.header = header
+    }
+    
+}
+
+// MARK: - UDP Packet
+
+struct UDPPacket {
+    let srcPort: UInt16
+    let dstPort: UInt16
+    let length: UInt16
+    let checksum: UInt16
+    let payloadOffset: Int
+    
+    init?(_ data: Data, offset: Int) {
+        guard data.count >= offset + 8 else {
+            return nil
+        }
+        
+        self.srcPort = UInt16(bytes: (data[offset], data[offset + 1]))
+        self.dstPort = UInt16(bytes: (data[offset + 2], data[offset + 3]))
+        self.length  = UInt16(bytes: (data[offset + 4], data[offset + 5]))
+        self.checksum = UInt16(bytes: (data[offset + 6], data[offset + 7]))
+        self.payloadOffset = offset + 8
+    }
+    
+}
+
+// MARK: - ICMP Packet
+
+struct ICMPPacket {
+    let type: UInt8
+    let code: UInt8
+    let checksum: UInt16
+
+    init?(_ data: Data, offset: Int) {
+        guard data.count >= offset + 4 else {
+            return nil
+        }
+
+        self.type = data[offset]
+        self.code = data[offset + 1]
+        self.checksum = UInt16(bytes: (data[offset + 2], data[offset + 3]))
+    }
+    
+}

Tun/Punchnet/NetworkStack/SDLAddressResolver.swift

@@ -0,0 +1,41 @@
+//
+//  SDLAddressResolverPool.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/2/3.
+//
+
+import Foundation
+import NIOCore
+import NIOPosix
+
+actor SDLAddressResolver {
+    static let shared = SDLAddressResolver(threads: System.coreCount)
+    
+    private let pool: NIOThreadPool
+    private var cache: [String: SocketAddress] = [:]
+    
+    private init(threads: Int = 2) {
+        self.pool = NIOThreadPool(numberOfThreads: threads)
+        self.pool.start()
+    }
+    
+    func resolve(host: String, port: Int) async throws -> SocketAddress {
+        let key = "\(host):\(port)"
+        if let cached = cache[key] {
+            return cached
+        }
+        
+        let address = try await pool.runIfActive {
+            try SocketAddress.makeAddressResolvingHost(host, port: port)
+        }
+        cache[key] = address
+        
+        return address
+    }
+    
+    deinit {
+        pool.shutdownGracefully { _ in }
+    }
+    
+}

Tun/Punchnet/OnceContinuation.swift

@@ -0,0 +1,56 @@
+//
+//  OnceContinuation.swift
+//  Tun
+//
+//  Created by Codex on 2026/5/7.
+//
+
+import Foundation
+
+final class OnceContinuation<Value, Failure: Error>: @unchecked Sendable {
+    private let lock = NSLock()
+    private var continuation: CheckedContinuation<Value, Failure>?
+    private var result: Result<Value, Failure>?
+
+    func set(_ continuation: CheckedContinuation<Value, Failure>) {
+        lock.lock()
+        if let result {
+            lock.unlock()
+            continuation.resume(with: result)
+            return
+        }
+
+        let hasPendingContinuation = self.continuation != nil
+        if !hasPendingContinuation {
+            self.continuation = continuation
+        }
+        lock.unlock()
+
+        if hasPendingContinuation {
+            preconditionFailure("OnceContinuation can only store one pending continuation")
+        }
+    }
+
+    func resume(returning value: Value) {
+        resume(with: .success(value))
+    }
+
+    func resume(throwing error: Failure) {
+        resume(with: .failure(error))
+    }
+
+    func resume(with result: Result<Value, Failure>) {
+        lock.lock()
+        guard self.result == nil else {
+            lock.unlock()
+            return
+        }
+
+        self.result = result
+        let continuation = self.continuation
+        self.continuation = nil
+        lock.unlock()
+
+        continuation?.resume(with: result)
+    }
+}

Tun/Punchnet/Policy/IdentityRuleMap.swift

@@ -0,0 +1,27 @@
+//
+//  RuleMap.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/2/5.
+//
+
+struct IdentityRuleMap {
+    let version: UInt32
+    // map[proto][port]
+    let ruleMap: [UInt8: [UInt16: Bool]]
+    
+    init(version: UInt32, ruleMap: [UInt8: [UInt16: Bool]]) {
+        self.version = version
+        self.ruleMap = ruleMap
+    }
+    
+    func isAllow(proto: UInt8, port: UInt16) -> Bool {
+        if let portMap = self.ruleMap[proto],
+           let allowed = portMap[port] {
+            return allowed
+        } else {
+            return false
+        }
+    }
+    
+}

Tun/Punchnet/Policy/IdentitySnapshot.swift

@@ -0,0 +1,25 @@
+//
+//  IdentitySnapshot.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/2/5.
+//
+
+final class IdentitySnapshot {
+    typealias IdentityID = UInt32
+    
+    private let identityMap: [IdentityID: IdentityRuleMap]
+    
+    init(identityMap: [IdentityID : IdentityRuleMap]) {
+        self.identityMap = identityMap
+    }
+    
+    func lookup(_ id: IdentityID) -> IdentityRuleMap? {
+        return self.identityMap[id]
+    }
+    
+    static func empty() -> IdentitySnapshot {
+        return IdentitySnapshot(identityMap: [:])
+    }
+    
+}

Tun/Punchnet/Policy/IdentityStore.swift

@@ -0,0 +1,99 @@
+//
+//  IdentityStore.swift
+//  punchnet
+//  1. 需要增加规则基于轮训更新的逻辑
+//  Created by 安礼成 on 2026/2/5.
+//
+import Foundation
+import NIO
+
+actor IdentityStore {
+    
+    // 处理权限的请求问题
+    nonisolated private let cooldown: Duration = .seconds(5)
+    // identityId
+    private var coolingDown: Set<UInt32> = []
+    // 处理各个请求的版本问题, map[identityId] = version
+    private var versions: [UInt32: UInt32] = [:]
+    
+    nonisolated private let alloctor = ByteBufferAllocator()
+    
+    private let publisher: SnapshotPublisher<IdentitySnapshot>
+    private var identityMap: [UInt32: IdentityRuleMap] = [:]
+    
+    init(publisher: SnapshotPublisher<IdentitySnapshot>) {
+        self.publisher = publisher
+    }
+
+    func makeBatchPolicyRequests(dstIdentityID: UInt32) -> [Data] {
+        return self.identityMap.keys.compactMap { identityId in
+            var policyRequest = SDLPolicyRequest()
+            policyRequest.srcIdentityID = identityId
+            policyRequest.dstIdentityID = dstIdentityID
+            policyRequest.version = self.nextVersion(identityId: identityId)
+            return try? policyRequest.serializedData()
+        }
+    }
+
+    func makePolicyRequest(srcIdentityId: UInt32, dstIdentityId: UInt32) -> Data? {
+        guard !coolingDown.contains(srcIdentityId) else {
+            return nil
+        }
+
+        var policyRequest = SDLPolicyRequest()
+        policyRequest.srcIdentityID = srcIdentityId
+        policyRequest.dstIdentityID = dstIdentityId
+        policyRequest.version = self.nextVersion(identityId: srcIdentityId)
+
+        coolingDown.insert(srcIdentityId)
+
+        Task { [weak self] in
+            try? await Task.sleep(for: .seconds(5))
+            await self?.endCooldown(for: srcIdentityId)
+        }
+
+        return try? policyRequest.serializedData()
+    }
+    
+    // 处理权限的响应
+    func applyPolicyResponse(_ policyResponse: SDLPolicyResponse) {
+        let id = policyResponse.srcIdentityID
+        let version = policyResponse.version
+        
+        guard self.identityMap[id] == nil || ((self.identityMap[id]?.version ?? 0) < version) else {
+            return
+        }
+        
+        // 判断一下是否接受完成
+        var buffer = alloctor.buffer(bytes: policyResponse.rules)
+        var ruleMap: [UInt8: [UInt16: Bool]] = [:]
+        while true {
+            guard let proto = buffer.readInteger(endianness: .big, as: UInt8.self),
+                  let port = buffer.readInteger(endianness: .big, as: UInt16.self) else {
+                break
+            }
+            ruleMap[proto, default: [:]][port] = true
+        }
+        self.identityMap[id] = IdentityRuleMap(version: version, ruleMap: ruleMap)
+        
+        // 发布新的快照信息
+        let snapshot = compileSnapshot()
+        publisher.publish(snapshot)
+    }
+    
+    private func compileSnapshot() -> IdentitySnapshot {
+        return IdentitySnapshot(identityMap: identityMap)
+    }
+
+    private func endCooldown(for key: UInt32) {
+        self.coolingDown.remove(key)
+    }
+    
+    private func nextVersion(identityId: UInt32) -> UInt32 {
+        let version = self.versions[identityId, default: 1]
+        // 更新请求的版本问题
+        self.versions[identityId] = version + 1
+        
+        return version
+    }
+}

Tun/Punchnet/Policy/SnapshotPublisher.swift

@@ -0,0 +1,32 @@
+//
+//  SnapshotPublisher.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/2/5.
+//
+import Atomics
+
+final class SnapshotPublisher<IdentitySnapshot: AnyObject> {
+    private let atomic: ManagedAtomic<Unmanaged<IdentitySnapshot>>
+    
+    init(initial snapshot: IdentitySnapshot) {
+        self.atomic = ManagedAtomic(.passRetained(snapshot))
+    }
+
+    func publish(_ snapshot: IdentitySnapshot) {
+        let newRef = Unmanaged.passRetained(snapshot)
+        let oldRef = atomic.exchange(newRef, ordering: .acquiring)
+        oldRef.release()
+    }
+
+    @inline(__always)
+    func current() -> IdentitySnapshot {
+        atomic.load(ordering: .relaxed).takeUnretainedValue()
+    }
+    
+    deinit {
+        let ref = atomic.load(ordering: .relaxed)
+        ref.release()
+    }
+    
+}

Tun/Punchnet/Protobuf/SDLMessage.swift

@@ -21,19 +21,13 @@ enum SDLPacketType: UInt8 {
     case queryInfo = 0x06
     case peerInfo = 0x07
     
+    // 心跳机制
     case ping = 0x08
     case pong = 0x09
     
     // 事件类型
     case event = 0x10
     
-    // 推送命令消息, 需要返回值
-    case command = 0x11
-    case commandAck = 0x12
-    
-    // 流量统计
-    case flowTracer = 0x15
-    
     case register = 0x20
     case registerAck = 0x21
     
@@ -43,14 +37,18 @@ enum SDLPacketType: UInt8 {
     case stunProbe = 0x32
     case stunProbeReply = 0x33
     
-    case data = 0xFF
+    // arp查询
-}
+    case arpRequest = 0x50
+    case arpResponse = 0x51
     
-// 升级策略
+    // 权限控制
-enum SDLUpgradeType: UInt32 {
+    case policyRequest = 0xb0
-    case none = 0
+    case policyResponse = 0xb1
-    case normal = 1
+    
-    case force = 2
+    // 获取欢迎消息
+    case welcome = 0x4F
+    
+    case data = 0xFF
 }
 
 // Id生成器
@@ -71,29 +69,6 @@ struct SDLIdGenerator: Sendable {
 
 // 定义事件类型
 
-// 命令类型
-enum SDLEventType: UInt8 {
-    case natChanged = 0x03
-    case sendRegister = 0x04
-    case networkShutdown = 0xFF
-}
-
-enum SDLEvent {
-    case natChanged(SDLNatChangedEvent)
-    case sendRegister(SDLSendRegisterEvent)
-    case networkShutdown(SDLNetworkShutdownEvent)
-}
-
-// --MARK: 定义命令类型
-
-enum SDLCommandType: UInt8 {
-    case changeNetwork = 0x01
-}
-
-enum SDLCommand {
-    case changeNetwork(SDLChangeNetworkCommand)
-}
-
 // --MARK: 网络类型探测
 // 探测的Attr属性
 enum SDLProbeAttr: UInt8 {
@@ -112,55 +87,63 @@ enum SDLNAKErrorCode: UInt8 {
 }
 
 extension SDLV4Info {
-    func socketAddress() -> SocketAddress? {
+    func socketAddress() async throws -> SocketAddress? {
-        let address = "\(v4[0]).\(v4[1]).\(v4[2]).\(v4[3])"
+        guard self.v4.count == 4 else {
-        
+            return nil
-        return try? SocketAddress.makeAddressResolvingHost(address, port: Int(port))
         }
+        
+        let address = "\(v4[0]).\(v4[1]).\(v4[2]).\(v4[3])"
+        return try await SDLAddressResolver.shared.resolve(host: address, port: Int(port))
+    }
+}
+
+extension SDLV6Info {
+    func socketAddress() async throws -> SocketAddress? {
+        guard let address = SDLUtil.ipv6DataToString(self.v6) else {
+            return nil
+        }
+        
+        return try await SDLAddressResolver.shared.resolve(host: address, port: Int(port))
+    }
+}
+
+extension SDLData {
+    
+    func format() -> String {
+        return "network_id: \(self.networkID), src_mac: \(LayerPacket.MacAddress.description(data: self.srcMac)), dst_mac: \(LayerPacket.MacAddress.description(data: self.dstMac)), data: \([UInt8](self.data))"
+    }
+    
 }
 
 extension SDLStunProbeReply {
-    func socketAddress() -> SocketAddress? {
+    func socketAddress() async -> SocketAddress? {
         let address = SDLUtil.int32ToIp(self.ip)
         
-        return try? SocketAddress.makeAddressResolvingHost(address, port: Int(port))
+        return try? await SDLAddressResolver.shared.resolve(host: address, port: Int(port))
     }
 }
 
-// --MARK: 进来的消息, 这里需要采用代数类型来表示
 
-enum SDLHoleInboundMessage {
+enum SDLQUICInboundMessage {
-    case stunReply(SDLStunReply)
+    // 欢迎消息
-    case stunProbeReply(SDLStunProbeReply)
+    case welcome(SDLWelcome)
     
-    case data(SDLData)
+    case pong
-    case register(SDLRegister)
-    case registerAck(SDLRegisterAck)
-}
     
-// --MARK: 定义消息类型
+    // 注册相关
-
-struct SDLSuperInboundMessage {
-    let msgId: UInt32
-    let packet: InboundPacket
-    
-    enum InboundPacket {
-        case empty
     case registerSuperAck(SDLRegisterSuperAck)
     case registerSuperNak(SDLRegisterSuperNak)
+    
     case peerInfo(SDLPeerInfo)
-        case pong
     case event(SDLEvent)
-        case command(SDLCommand)
+    case policyReponse(SDLPolicyResponse)
-    }
+    
-    
+    case arpResponse(SDLArpResponse)
-    func isPong() -> Bool {
-        switch self.packet {
-        case .pong:
-            return true
-        default:
-            return false
-        }
 }
 
+// 命令类型
+enum SDLEventType: UInt8 {
+    case natChanged = 0x03
+    case sendRegister = 0x04
+    case networkShutdown = 0xFF
 }

Tun/Punchnet/Protobuf/TunMessage.pb.swift

@@ -0,0 +1,262 @@
+// DO NOT EDIT.
+// swift-format-ignore-file
+// swiftlint:disable all
+//
+// Generated by the Swift generator plugin for the protocol buffer compiler.
+// Source: tun.proto
+//
+// For information on using the generated types, please see the documentation:
+//   https://github.com/apple/swift-protobuf/
+
+import SwiftProtobuf
+
+// If the compiler emits an error on this type, it is because this file
+// was generated by a version of the `protoc` Swift plug-in that is
+// incompatible with the version of SwiftProtobuf to which you are linking.
+// Please ensure that you are building against the same version of the API
+// that was used to generate this file.
+fileprivate struct _GeneratedWithProtocGenSwiftVersion: SwiftProtobuf.ProtobufAPIVersionCheck {
+  struct _2: SwiftProtobuf.ProtobufAPIVersion_2 {}
+  typealias Version = _2
+}
+
+/// 定义App发送给NE的事件
+struct AppRequest: Sendable {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  var command: AppRequest.OneOf_Command? = nil
+
+  var changeExitNode: AppRequest.ChangeExitNodeRequest {
+    get {
+      if case .changeExitNode(let v)? = command {return v}
+      return AppRequest.ChangeExitNodeRequest()
+    }
+    set {command = .changeExitNode(newValue)}
+  }
+
+  var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  enum OneOf_Command: Equatable, Sendable {
+    case changeExitNode(AppRequest.ChangeExitNodeRequest)
+
+  }
+
+  struct ChangeExitNodeRequest: Sendable {
+    // SwiftProtobuf.Message conformance is added in an extension below. See the
+    // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+    // methods supported on all messages.
+
+    /// 空字符串表示清除出口节点
+    var ip: String = String()
+
+    var unknownFields = SwiftProtobuf.UnknownStorage()
+
+    init() {}
+  }
+
+  init() {}
+}
+
+struct TunnelResponse: Sendable {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  var code: Int32 = 0
+
+  var message: String = String()
+
+  var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  init() {}
+}
+
+struct TunnelEvent: Sendable {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  var id: String = String()
+
+  var timestampMs: UInt64 = 0
+
+  var code: Int32 = 0
+
+  var message: String = String()
+
+  var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  init() {}
+}
+
+// MARK: - Code below here is support for the SwiftProtobuf runtime.
+
+extension AppRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  static let protoMessageName: String = "AppRequest"
+  static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
+    1: .standard(proto: "change_exit_node"),
+  ]
+
+  mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let fieldNumber = try decoder.nextFieldNumber() {
+      // The use of inline closures is to circumvent an issue where the compiler
+      // allocates stack space for every case branch when no optimizations are
+      // enabled. https://github.com/apple/swift-protobuf/issues/1034
+      switch fieldNumber {
+      case 1: try {
+        var v: AppRequest.ChangeExitNodeRequest?
+        var hadOneofValue = false
+        if let current = self.command {
+          hadOneofValue = true
+          if case .changeExitNode(let m) = current {v = m}
+        }
+        try decoder.decodeSingularMessageField(value: &v)
+        if let v = v {
+          if hadOneofValue {try decoder.handleConflictingOneOf()}
+          self.command = .changeExitNode(v)
+        }
+      }()
+      default: break
+      }
+    }
+  }
+
+  func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    // The use of inline closures is to circumvent an issue where the compiler
+    // allocates stack space for every if/case branch local when no optimizations
+    // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and
+    // https://github.com/apple/swift-protobuf/issues/1182
+    try { if case .changeExitNode(let v)? = self.command {
+      try visitor.visitSingularMessageField(value: v, fieldNumber: 1)
+    } }()
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  static func ==(lhs: AppRequest, rhs: AppRequest) -> Bool {
+    if lhs.command != rhs.command {return false}
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
+extension AppRequest.ChangeExitNodeRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  static let protoMessageName: String = AppRequest.protoMessageName + ".ChangeExitNodeRequest"
+  static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
+    1: .same(proto: "ip"),
+  ]
+
+  mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let fieldNumber = try decoder.nextFieldNumber() {
+      // The use of inline closures is to circumvent an issue where the compiler
+      // allocates stack space for every case branch when no optimizations are
+      // enabled. https://github.com/apple/swift-protobuf/issues/1034
+      switch fieldNumber {
+      case 1: try { try decoder.decodeSingularStringField(value: &self.ip) }()
+      default: break
+      }
+    }
+  }
+
+  func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    if !self.ip.isEmpty {
+      try visitor.visitSingularStringField(value: self.ip, fieldNumber: 1)
+    }
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  static func ==(lhs: AppRequest.ChangeExitNodeRequest, rhs: AppRequest.ChangeExitNodeRequest) -> Bool {
+    if lhs.ip != rhs.ip {return false}
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
+extension TunnelResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  static let protoMessageName: String = "TunnelResponse"
+  static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
+    1: .same(proto: "code"),
+    2: .same(proto: "message"),
+  ]
+
+  mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let fieldNumber = try decoder.nextFieldNumber() {
+      // The use of inline closures is to circumvent an issue where the compiler
+      // allocates stack space for every case branch when no optimizations are
+      // enabled. https://github.com/apple/swift-protobuf/issues/1034
+      switch fieldNumber {
+      case 1: try { try decoder.decodeSingularInt32Field(value: &self.code) }()
+      case 2: try { try decoder.decodeSingularStringField(value: &self.message) }()
+      default: break
+      }
+    }
+  }
+
+  func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    if self.code != 0 {
+      try visitor.visitSingularInt32Field(value: self.code, fieldNumber: 1)
+    }
+    if !self.message.isEmpty {
+      try visitor.visitSingularStringField(value: self.message, fieldNumber: 2)
+    }
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  static func ==(lhs: TunnelResponse, rhs: TunnelResponse) -> Bool {
+    if lhs.code != rhs.code {return false}
+    if lhs.message != rhs.message {return false}
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
+extension TunnelEvent: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  static let protoMessageName: String = "TunnelEvent"
+  static let _protobuf_nameMap: SwiftProtobuf._NameMap = [
+    1: .same(proto: "id"),
+    2: .standard(proto: "timestamp_ms"),
+    3: .same(proto: "code"),
+    4: .same(proto: "message"),
+  ]
+
+  mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let fieldNumber = try decoder.nextFieldNumber() {
+      // The use of inline closures is to circumvent an issue where the compiler
+      // allocates stack space for every case branch when no optimizations are
+      // enabled. https://github.com/apple/swift-protobuf/issues/1034
+      switch fieldNumber {
+      case 1: try { try decoder.decodeSingularStringField(value: &self.id) }()
+      case 2: try { try decoder.decodeSingularUInt64Field(value: &self.timestampMs) }()
+      case 3: try { try decoder.decodeSingularInt32Field(value: &self.code) }()
+      case 4: try { try decoder.decodeSingularStringField(value: &self.message) }()
+      default: break
+      }
+    }
+  }
+
+  func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    if !self.id.isEmpty {
+      try visitor.visitSingularStringField(value: self.id, fieldNumber: 1)
+    }
+    if self.timestampMs != 0 {
+      try visitor.visitSingularUInt64Field(value: self.timestampMs, fieldNumber: 2)
+    }
+    if self.code != 0 {
+      try visitor.visitSingularInt32Field(value: self.code, fieldNumber: 3)
+    }
+    if !self.message.isEmpty {
+      try visitor.visitSingularStringField(value: self.message, fieldNumber: 4)
+    }
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  static func ==(lhs: TunnelEvent, rhs: TunnelEvent) -> Bool {
+    if lhs.id != rhs.id {return false}
+    if lhs.timestampMs != rhs.timestampMs {return false}
+    if lhs.code != rhs.code {return false}
+    if lhs.message != rhs.message {return false}
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}

Tun/Punchnet/SDLAsyncTimerStream.swift

@@ -0,0 +1,33 @@
+//
+//  SDLAsyncTimerStream.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/2/3.
+//
+
+import Foundation
+
+class SDLAsyncTimerStream {
+    let timer: DispatchSourceTimer
+    let stream: AsyncStream<Void>
+    private let cont: AsyncStream<Void>.Continuation
+    
+    init() {
+        self.timer = DispatchSource.makeTimerSource(queue: .global())
+        (stream, cont) = AsyncStream.makeStream(of: Void.self)
+    }
+    
+    func start(interval: DispatchTimeInterval) {
+        timer.schedule(deadline: .now(), repeating: interval)
+        timer.setEventHandler { [weak self] in
+            self?.cont.yield()
+        }
+        timer.resume()
+    }
+    
+    deinit {
+        self.cont.finish()
+        self.timer.cancel()
+    }
+    
+}

Tun/Punchnet/SDLConfiguration.swift

@@ -10,63 +10,139 @@ import NIOCore
 // 配置项目
 public class SDLConfiguration {
     
-    public struct StunServer {
+    // 网络地址信息
-        public let host: String
+    public struct NetworkAddress {
-        public let ports: [Int]
+        public let networkId: UInt32
+        public let ip: UInt32
+        public let maskLen: UInt8
+        public let mac: Data
+        public let networkDomain: String
         
-        public init(host: String, ports: [Int]) {
+        // ip地址
-            self.host = host
+        var ipAddress: String {
-            self.ports = ports
+            return SDLUtil.int32ToIp(self.ip)
         }
+        
+        // 掩码
+        var maskAddress: String {
+            let len0 = 32 - maskLen
+            let num: UInt32 = (0xFFFFFFFF >> len0) << len0
+            
+            return SDLUtil.int32ToIp(num)
+        }
+        
+        // 网络地址
+        var netAddress: String {
+            let len0 = 32 - maskLen
+            let mask: UInt32 = (0xFFFFFFFF >> len0) << len0
+            
+            return SDLUtil.int32ToIp(self.ip & mask)
+        }
+    }
+    
+    // 网络出口
+    public struct ExitNode {
+        let exitNodeIp: UInt32
     }
     
     // 当前的客户端版本
-    let version: UInt8
+    let version: Int
     
-    // 安装渠道
+    let serverHost: String
-    let installedChannel: String
+    let stunServers: [String]
-    
-    let superHost: String
-    let superPort: Int
-    
-    let stunServers: [StunServer]
-    
-    let remoteDnsServer: String
-    let hostname: String
-    
-    let noticePort: Int
     
     lazy var stunSocketAddress: SocketAddress = {
         let stunServer = stunServers[0]
-        return try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[0])
+        return try! SocketAddress.makeAddressResolvingHost(stunServer, port: 1365)
     }()
     
     // 网络探测地址信息
     lazy var stunProbeSocketAddressArray: [[SocketAddress]] = {
         return stunServers.map { stunServer in
             [
-                try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[0]),
+                try! SocketAddress.makeAddressResolvingHost(stunServer, port: 1365),
-                try! SocketAddress.makeAddressResolvingHost(stunServer.host, port: stunServer.ports[1])
+                try! SocketAddress.makeAddressResolvingHost(stunServer, port: 1366)
             ]
         }
     }()
     
     let clientId: String
-    let token: String
+    let networkAddress: NetworkAddress
-    let networkCode: String
+    let hostname: String
+    let accessToken: String
+    let identityId: UInt32
     
-    public init(version: UInt8, installedChannel: String, superHost: String, superPort: Int, stunServers: [StunServer], clientId: String, noticePort: Int, token: String, networkCode: String, remoteDnsServer: String, hostname: String) {
+    var exitNode: ExitNode?
+    
+    public init(version: Int,
+                serverHost: String,
+                stunServers: [String],
+                clientId: String,
+                networkAddress: NetworkAddress,
+                hostname: String,
+                accessToken: String,
+                identityId: UInt32,
+                exitNode: ExitNode?) {
         self.version = version
-        self.installedChannel = installedChannel
+        self.serverHost = serverHost
-        self.superHost = superHost
-        self.superPort = superPort
         self.stunServers = stunServers
         self.clientId = clientId
-        self.noticePort = noticePort
+        self.networkAddress = networkAddress
-        self.token = token
+        self.accessToken = accessToken
-        self.networkCode = networkCode
+        self.identityId = identityId
-        self.remoteDnsServer = remoteDnsServer
         self.hostname = hostname
+        self.exitNode = exitNode
+    }
+    
+}
+
+// 解析配置文件
+extension SDLConfiguration {
+    
+    static func parse(options: [String: NSObject]) -> SDLConfiguration? {
+        guard let version = options["version"] as? Int,
+              let serverHost = options["server_host"] as? String,
+              let stunAssistHost = options["stun_assist_host"] as? String,
+              let accessToken = options["access_token"] as? String,
+              let identityId = options["identity_id"] as? UInt32,
+              let clientId = options["client_id"] as? String,
+              let hostname = options["hostname"] as? String,
+              let networkAddressDict = options["network_address"] as? [String: NSObject] else {
+            return nil
+        }
+        
+        guard let networkAddress = parseNetworkAddress(networkAddressDict) else {
+            return nil
+        }
+        
+        // 网络出口配置是可选的
+        var exitNode: ExitNode? = nil
+        if let exitNodeIpStr = options["exit_node_ip"] as? String, let exitNodeIp = SDLUtil.ipv4StrToInt32(exitNodeIpStr) {
+            exitNode = .init(exitNodeIp: exitNodeIp)
+        }
+        
+        return SDLConfiguration(version: version,
+                                serverHost: serverHost,
+                                stunServers: [serverHost, stunAssistHost],
+                                clientId: clientId,
+                                networkAddress: networkAddress,
+                                hostname: hostname,
+                                accessToken: accessToken,
+                                identityId: identityId,
+                                exitNode: exitNode)
+    }
+    
+    private static func parseNetworkAddress(_ config: [String: NSObject]) -> SDLConfiguration.NetworkAddress? {
+        guard let networkId = config["network_id"] as? UInt32,
+              let ipStr = config["ip"] as? String,
+              let ip = SDLUtil.ipv4StrToInt32(ipStr),
+              let maskLen = config["mask_len"] as? UInt8,
+              let mac = config["mac"] as? Data,
+              let networkDomain = config["network_domain"] as? String else {
+            return nil
+        }
+        
+        return .init(networkId: networkId, ip: ip, maskLen: maskLen, mac: mac, networkDomain: networkDomain)
     }
     
 }

Tun/Punchnet/SDLContext.swift

@@ -1,715 +0,0 @@
-//
-//  SDLContext.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/2/29.
-//
-
-import Foundation
-import NetworkExtension
-import NIOCore
-import Combine
-
-// 上下文环境变量，全局共享
-/*
-1. 处理rsa的加解密逻辑
- */
-
-@available(macOS 14, *)
-public class SDLContext {
-    
-    // 路由信息
-    struct Route {
-        let dstAddress: String
-        let subnetMask: String
-        
-        var debugInfo: String {
-            return "\(dstAddress):\(subnetMask)"
-        }
-    }
-    
-    let config: SDLConfiguration
-
-    // tun网络地址信息
-    var devAddr: SDLDevAddr
-    
-    // nat映射的相关信息, 暂时没有用处
-    //var natAddress: SDLNatAddress?
-    // nat的网络类型
-    var natType: NatType = .blocked
-    
-    // AES加密，授权通过后，对象才会被创建
-    var aesCipher: AESCipher
-    
-    // aes
-    var aesKey: Data = Data()
-    
-    // rsa的相关配置, public_key是本地生成的
-    let rsaCipher: RSACipher
-    
-    // 依赖的变量
-    var udpHoleActor: SDLUDPHoleActor?
-    var superClientActor: SDLSuperClientActor?
-    var providerActor: SDLTunnelProviderActor
-    var puncherActor: SDLPuncherActor
-    // dns的client对象
-    var dnsClientActor: SDLDNSClientActor?
-    
-    // 数据包读取任务
-    private var readTask: Task<(), Never>?
-    
-    private var sessionManager: SessionManager
-    private var arpServer: ArpServer
-    
-    // 记录最后发送的stunRequest的cookie
-    private var lastCookie: UInt32? = 0
-    
-    // 网络状态变化的健康
-    private var monitor: SDLNetworkMonitor?
-    
-    // 内部socket通讯
-    private var noticeClient: SDLNoticeClient?
-    
-    // 流量统计
-    private var flowTracer = SDLFlowTracerActor()
-    private var flowTracerCancel: AnyCancellable?
-    
-    private let logger: SDLLogger
-    private var rootTask: Task<Void, Error>?
-    
-    public init(provider: NEPacketTunnelProvider, config: SDLConfiguration, rsaCipher: RSACipher, aesCipher: AESCipher, logger: SDLLogger) {
-        self.logger = logger
-        
-        self.config = config
-        self.rsaCipher = rsaCipher
-        self.aesCipher = aesCipher
-        
-        // 生成mac地址
-        var devAddr = SDLDevAddr()
-        devAddr.mac = Self.getMacAddress()
-        self.devAddr = devAddr
-        
-        self.sessionManager = SessionManager()
-        self.arpServer = ArpServer(known_macs: [:])
-        self.providerActor = SDLTunnelProviderActor(provider: provider, logger: logger)
-        self.puncherActor = SDLPuncherActor(logger: logger)
-    }
-    
-    public func start() async throws {
-        self.rootTask = Task {
-            try await withThrowingTaskGroup(of: Void.self) { group in
-                group.addTask {
-                    while !Task.isCancelled {
-                        do {
-                            try await self.startDnsClient()
-                        } catch let err {
-                            self.logger.log("[SDLContext] UDPHole get err: \(err)", level: .warning)
-                            try await Task.sleep(for: .seconds(2))
-                        }
-                    }
-                }
-                
-                group.addTask {
-                    while !Task.isCancelled {
-                        do {
-                            try await self.startUDPHole()
-                        } catch let err {
-                            self.logger.log("[SDLContext] UDPHole get err: \(err)", level: .warning)
-                            try await Task.sleep(for: .seconds(2))
-                        }
-                    }
-                }
-                
-                group.addTask {
-                    while !Task.isCancelled {
-                        do {
-                            try await self.startSuperClient()
-                        } catch let err {
-                            self.logger.log("[SDLContext] SuperClient get error: \(err), will restart", level: .warning)
-                            await self.arpServer.clear()
-                            try await Task.sleep(for: .seconds(2))
-                        }
-                    }
-                }
-                
-                group.addTask {
-                    await self.startMonitor()
-                }
-                
-                group.addTask {
-                    while !Task.isCancelled {
-                        do {
-                            try await self.startNoticeClient()
-                        } catch let err {
-                            self.logger.log("[SDLContext] noticeClient get err: \(err)", level: .warning)
-                            try await Task.sleep(for: .seconds(2))
-                        }
-                    }
-                }
-                
-                try await group.waitForAll()
-            }
-        }
-        
-        try await self.rootTask?.value
-    }
-    
-    public func stop() async {
-        self.rootTask?.cancel()
-        self.superClientActor = nil
-        self.udpHoleActor = nil
-        self.noticeClient = nil
-
-        self.readTask?.cancel()
-    }
-    
-    private func startNoticeClient() async throws {
-        self.noticeClient = try await SDLNoticeClient(noticePort: self.config.noticePort, logger: self.logger)
-        try await self.noticeClient?.start()
-        self.logger.log("[SDLContext] notice_client task cancel", level: .warning)
-    }
-    
-    private func startUDPHole() async throws {
-        self.udpHoleActor = try await SDLUDPHoleActor(logger: self.logger)
-        try await withThrowingTaskGroup(of: Void.self) { group in
-            group.addTask {
-                try await self.udpHoleActor?.start()
-            }
-            
-            group.addTask {
-                while !Task.isCancelled {
-                    try Task.checkCancellation()
-                    try await Task.sleep(nanoseconds: 5 * 1_000_000_000)
-                    try Task.checkCancellation()
-
-                    if let udpHoleActor = self.udpHoleActor {
-                        let cookie = await udpHoleActor.getCookieId()
-                        var stunRequest = SDLStunRequest()
-                        stunRequest.cookie = cookie
-                        stunRequest.clientID = self.config.clientId
-                        stunRequest.networkID = self.devAddr.networkID
-                        stunRequest.ip = self.devAddr.netAddr
-                        stunRequest.mac = self.devAddr.mac
-                        stunRequest.natType = UInt32(self.natType.rawValue)
-                        
-                        let remoteAddress = self.config.stunSocketAddress
-                        await udpHoleActor.send(type: .stunRequest, data: try stunRequest.serializedData(), remoteAddress: remoteAddress)
-                        self.lastCookie = cookie
-                    }
-                }
-            }
-            
-            group.addTask {
-                if let eventFlow = self.udpHoleActor?.eventFlow {
-                    for try await event in eventFlow {
-                        try Task.checkCancellation()
-                        try await self.handleUDPEvent(event: event)
-                    }
-                }
-            }
-            
-            if let _ = try await group.next() {
-                group.cancelAll()
-            }
-        }
-        
-    }
-    
-    private func startSuperClient() async throws {
-        self.superClientActor = try await SDLSuperClientActor(host: self.config.superHost, port: self.config.superPort, logger: self.logger)
-        try await withThrowingTaskGroup(of: Void.self) { group in
-            defer {
-                self.logger.log("[SDLContext] super client task cancel", level: .warning)
-            }
-            
-            group.addTask {
-                try await self.superClientActor?.start()
-            }
-            
-            group.addTask {
-                if let eventFlow = self.superClientActor?.eventFlow {
-                    for try await event in eventFlow {
-                        try await self.handleSuperEvent(event: event)
-                    }
-                }
-            }
-            
-            if let _ = try await group.next() {
-                group.cancelAll()
-            }
-        }
-    }
-    
-    private func startMonitor() async {
-        self.monitor = SDLNetworkMonitor()
-        for await event in self.monitor!.eventStream {
-            switch event {
-            case .changed:
-                // 需要重新探测网络的nat类型
-                self.natType = await self.getNatType()
-                self.logger.log("didNetworkPathChanged, nat type is: \(self.natType)", level: .info)
-            case .unreachable:
-                self.logger.log("didNetworkPathUnreachable", level: .warning)
-            }
-        }
-    }
-    
-    private func startDnsClient() async throws {
-        let remoteDnsServer = config.remoteDnsServer
-        let dnsSocketAddress = try SocketAddress.makeAddressResolvingHost(remoteDnsServer, port: 15353)
-        self.dnsClientActor = try await SDLDNSClientActor(dnsServerAddress: dnsSocketAddress, logger: self.logger)
-        
-        try await withThrowingTaskGroup(of: Void.self) { group in
-            defer {
-                self.logger.log("[SDLContext] dns client task cancel", level: .warning)
-            }
-            
-            group.addTask {
-                try await self.dnsClientActor?.start()
-            }
-            
-            group.addTask {
-                if let packetFlow = self.dnsClientActor?.packetFlow {
-                    for await packet in packetFlow {
-                        let nePacket = NEPacket(data: packet, protocolFamily: 2)
-                        await self.providerActor.writePackets(packets: [nePacket])
-                    }
-                }
-                
-            }
-            
-            if let _ = try await group.next() {
-                group.cancelAll()
-            }
-        }
-    }
-    
-    private func handleSuperEvent(event: SDLSuperClientActor.SuperEvent) async throws {
-        switch event {
-        case .ready:
-            await self.puncherActor.setSuperClientActor(superClientActor: self.superClientActor)
-            
-            self.logger.log("[SDLContext] get registerSuper, mac address: \(SDLUtil.formatMacAddress(mac: self.devAddr.mac))", level: .debug)
-            var registerSuper = SDLRegisterSuper()
-            registerSuper.version = UInt32(self.config.version)
-            registerSuper.clientID = self.config.clientId
-            registerSuper.devAddr = self.devAddr
-            registerSuper.pubKey = self.rsaCipher.pubKey
-            registerSuper.token = self.config.token
-            registerSuper.networkCode = self.config.networkCode
-            registerSuper.hostname = self.config.hostname
-            guard let message = try await self.superClientActor?.request(type: .registerSuper, data: try registerSuper.serializedData()) else {
-                return
-            }
-            
-            switch message.packet {
-            case .registerSuperAck(let registerSuperAck):
-                // 需要对数据通过rsa的私钥解码
-                let aesKey = try! self.rsaCipher.decode(data: Data(registerSuperAck.aesKey))
-                let upgradeType = SDLUpgradeType(rawValue: registerSuperAck.upgradeType)
-                
-                self.logger.log("[SDLContext] get registerSuperAck, aes_key len: \(aesKey.count), network_id:\(registerSuperAck.devAddr.networkID)", level: .info)
-                self.devAddr = registerSuperAck.devAddr
-                
-                if upgradeType == .force {
-                    let forceUpgrade = NoticeMessage.upgrade(prompt: registerSuperAck.upgradePrompt, address: registerSuperAck.upgradeAddress)
-                    await self.noticeClient?.send(data: forceUpgrade)
-                    exit(-1)
-                }
-                
-                // 服务器分配的tun网卡信息
-                do {
-                    let ipAddress = try await self.providerActor.setNetworkSettings(devAddr: self.devAddr, dnsServer: SDLDNSClientActor.Helper.dnsServer)
-                    await self.noticeClient?.send(data: NoticeMessage.ipAdress(ip: ipAddress))
-                    
-                    self.startReader()
-                } catch let err {
-                    self.logger.log("[SDLContext] setTunnelNetworkSettings get error: \(err)", level: .error)
-                    exit(-1)
-                }
-                
-                self.aesKey = aesKey
-                if upgradeType == .normal {
-                    let normalUpgrade = NoticeMessage.upgrade(prompt: registerSuperAck.upgradePrompt, address: registerSuperAck.upgradeAddress)
-                    await self.noticeClient?.send(data: normalUpgrade)
-                }
-                
-            case .registerSuperNak(let nakPacket):
-                let errorMessage = nakPacket.errorMessage
-                guard let errorCode = SDLNAKErrorCode(rawValue: UInt8(nakPacket.errorCode)) else {
-                    return
-                }
-                
-                switch errorCode {
-                case .invalidToken, .nodeDisabled:
-                    let alertNotice = NoticeMessage.alert(alert: errorMessage)
-                    await self.noticeClient?.send(data: alertNotice)
-                    exit(-1)
-                case .noIpAddress, .networkFault, .internalFault:
-                    let alertNotice = NoticeMessage.alert(alert: errorMessage)
-                    await self.noticeClient?.send(data: alertNotice)
-                }
-                self.logger.log("[SDLContext] Get a SuperNak message exit", level: .warning)
-            default:
-                ()
-            }
-            
-        case .event(let evt):
-            switch evt {
-            case .natChanged(let natChangedEvent):
-                let dstMac = natChangedEvent.mac
-                self.logger.log("[SDLContext] natChangedEvent, dstMac: \(dstMac)", level: .info)
-                await sessionManager.removeSession(dstMac: dstMac)
-            case .sendRegister(let sendRegisterEvent):
-                self.logger.log("[SDLContext] sendRegisterEvent, ip: \(sendRegisterEvent)", level: .debug)
-                let address = SDLUtil.int32ToIp(sendRegisterEvent.natIp)
-                if let remoteAddress = try? SocketAddress.makeAddressResolvingHost(address, port: Int(sendRegisterEvent.natPort)) {
-                    // 发送register包
-                    var register = SDLRegister()
-                    register.networkID = self.devAddr.networkID
-                    register.srcMac = self.devAddr.mac
-                    register.dstMac = sendRegisterEvent.dstMac
-                    await self.udpHoleActor?.send(type: .register, data: try register.serializedData(), remoteAddress: remoteAddress)
-                }
-                
-            case .networkShutdown(let shutdownEvent):
-                let alertNotice = NoticeMessage.alert(alert: shutdownEvent.message)
-                await self.noticeClient?.send(data: alertNotice)
-                exit(-1)
-            }
-        case .command(let packetId, let command):
-            switch command {
-            case .changeNetwork(let changeNetworkCommand):
-                // 需要对数据通过rsa的私钥解码
-                let aesKey = try! self.rsaCipher.decode(data: Data(changeNetworkCommand.aesKey))
-                self.logger.log("[SDLContext] change network command get aes_key len: \(aesKey.count)", level: .info)
-                self.devAddr = changeNetworkCommand.devAddr
-                
-                // 服务器分配的tun网卡信息
-                do {
-                    let ipAddress = try await self.providerActor.setNetworkSettings(devAddr: self.devAddr, dnsServer: SDLDNSClientActor.Helper.dnsServer)
-                    await self.noticeClient?.send(data: NoticeMessage.ipAdress(ip: ipAddress))
-                    
-                    self.startReader()
-                } catch let err {
-                    self.logger.log("[SDLContext] setTunnelNetworkSettings get error: \(err)", level: .error)
-                    exit(-1)
-                }
-                
-                self.aesKey = aesKey
-                
-                var commandAck = SDLCommandAck()
-                commandAck.status = true
-                await self.superClientActor?.send(type: .commandAck, packetId: packetId, data: try commandAck.serializedData())
-            }
-        }
-        
-    }
-
-    private func handleUDPEvent(event: SDLUDPHoleActor.UDPEvent) async throws {
-        switch event {
-        case .ready:
-            await self.puncherActor.setUDPHoleActor(udpHoleActor: self.udpHoleActor)
-            // 获取当前网络的类型
-            self.natType = await getNatType()
-            self.logger.log("[SDLContext] broadcast is: \(self.natType)", level: .debug)
-            
-        case .message(let remoteAddress, let message):
-            switch message {
-            case .register(let register):
-                self.logger.log("register packet: \(register), dev_addr: \(self.devAddr)", level: .debug)
-                // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
-                if register.dstMac == self.devAddr.mac && register.networkID == self.devAddr.networkID {
-                    // 回复ack包
-                    var registerAck = SDLRegisterAck()
-                    registerAck.networkID = self.devAddr.networkID
-                    registerAck.srcMac = self.devAddr.mac
-                    registerAck.dstMac = register.srcMac
-                    
-                    await self.udpHoleActor?.send(type: .registerAck, data: try registerAck.serializedData(), remoteAddress: remoteAddress)
-                    // 这里需要建立到来源的会话, 在复杂网络下，通过super-node查询到的nat地址不一定靠谱，需要通过udp包的来源地址作为nat地址
-                    let session = Session(dstMac: register.srcMac, natAddress: remoteAddress)
-                    await self.sessionManager.addSession(session: session)
-                } else {
-                    self.logger.log("SDLContext didReadRegister get a invalid packet, because dst_ip not matched: \(register.dstMac)", level: .warning)
-                }
-            case .registerAck(let registerAck):
-                // 判断目标地址是否是tun的网卡地址, 并且是在同一个网络下
-                if registerAck.dstMac == self.devAddr.mac && registerAck.networkID == self.devAddr.networkID {
-                    let session = Session(dstMac: registerAck.srcMac, natAddress: remoteAddress)
-                    await self.sessionManager.addSession(session: session)
-                } else {
-                    self.logger.log("SDLContext didReadRegisterAck get a invalid packet, because dst_mac not matched: \(registerAck.dstMac)", level: .warning)
-                }
-            case .stunReply(let stunReply):
-                let cookie = stunReply.cookie
-                if cookie == self.lastCookie {
-                    // 记录下当前在nat上的映射信息，暂时没有用；后续会用来判断网络类型
-                    //self.natAddress = stunReply.natAddress
-                    self.logger.log("[SDLContext] get a stunReply: \(try! stunReply.jsonString())", level: .debug)
-                }
-            default:
-                ()
-            }
-            
-        case .data(let data):
-            let mac = LayerPacket.MacAddress(data: data.dstMac)
-            guard (data.dstMac == self.devAddr.mac || mac.isBroadcast() || mac.isMulticast()) else {
-                return
-            }
-            
-            guard let decyptedData = try? self.aesCipher.decypt(aesKey: self.aesKey, data: Data(data.data)) else {
-                return
-            }
-            
-            do {
-                let layerPacket = try LayerPacket(layerData: decyptedData)
-                
-                await self.flowTracer.inc(num: decyptedData.count, type: .inbound)
-                // 处理arp请求
-                switch layerPacket.type {
-                case .arp:
-                    // 判断如果收到的是arp请求
-                    if let arpPacket = ARPPacket(data: layerPacket.data)  {
-                        if arpPacket.targetIP == self.devAddr.netAddr {
-                            switch arpPacket.opcode {
-                            case .request:
-                                self.logger.log("[SDLContext] get arp request packet", level: .debug)
-                                let response = ARPPacket.arpResponse(for: arpPacket, mac: self.devAddr.mac, ip: self.devAddr.netAddr)
-                                await self.routeLayerPacket(dstMac: arpPacket.senderMAC, type: .arp, data: response.marshal())
-                            case .response:
-                                self.logger.log("[SDLContext] get arp response packet", level: .debug)
-                                await self.arpServer.append(ip: arpPacket.senderIP, mac: arpPacket.senderMAC)
-                            }
-                        } else {
-                            self.logger.log("[SDLContext] get invalid arp packet: \(arpPacket), target_ip: \(SDLUtil.int32ToIp(arpPacket.targetIP)), net ip: \(SDLUtil.int32ToIp(self.devAddr.netAddr))", level: .debug)
-                        }
-                    } else {
-                        self.logger.log("[SDLContext] get invalid arp packet", level: .debug)
-                    }
-                case .ipv4:
-                    guard let ipPacket = IPPacket(layerPacket.data), ipPacket.header.destination == self.devAddr.netAddr else {
-                        return
-                    }
-                    let packet = NEPacket(data: ipPacket.data, protocolFamily: 2)
-                    await self.providerActor.writePackets(packets: [packet])
-                default:
-                    self.logger.log("[SDLContext] get invalid packet", level: .debug)
-                }
-            } catch let err {
-                self.logger.log("[SDLContext] didReadData err: \(err)", level: .warning)
-            }
-        }
-        
-    }
-    
-    // 流量统计
-//    public func flowReportTask() {
-//        Task {
-//            // 每分钟汇报一次
-//            self.flowTracerCancel = Timer.publish(every: 60.0, on: .main, in: .common).autoconnect()
-//                .sink { _ in
-//                    Task {
-//                        let (forwardNum, p2pNum, inboundNum) = await self.flowTracer.reset()
-//                        await self.superClient?.flowReport(forwardNum: forwardNum, p2pNum: p2pNum, inboundNum: inboundNum)
-//                    }
-//                }
-//        }
-//    }
-    
-    // 开始读取数据, 用单独的线程处理packetFlow
-    private func startReader() {
-        //  停止之前的任务
-        self.readTask?.cancel()
-        
-        // 开启新的任务
-        self.readTask = Task(priority: .high) {
-            repeat {
-                let packets = await self.providerActor.readPackets()
-                for packet in packets {
-                    await self.dealPacket(data: packet)
-                }
-            } while true
-        }
-    }
-    
-    // 处理读取的每个数据包
-    private func dealPacket(data: Data) async {
-        guard let packet = IPPacket(data) else {
-            return
-        }
-        
-        if SDLDNSClientActor.Helper.isDnsRequestPacket(ipPacket: packet) {
-            let destIp = packet.header.destination_ip
-            self.logger.log("[DNSQuery] destIp: \(destIp), int: \(packet.header.destination.asIpAddress())", level: .debug)
-            await self.dnsClientActor?.forward(ipPacket: packet)
-        }
-        else {
-            Task.detached {
-                let dstIp = packet.header.destination
-                // 本地通讯, 目标地址是本地服务器的ip地址
-                if dstIp == self.devAddr.netAddr {
-                    let nePacket = NEPacket(data: packet.data, protocolFamily: 2)
-                    await self.providerActor.writePackets(packets: [nePacket])
-                    return
-                }
-                
-                // 查找arp缓存中是否有目标mac地址
-                if let dstMac = await self.arpServer.query(ip: dstIp) {
-                    await self.routeLayerPacket(dstMac: dstMac, type: .ipv4, data: packet.data)
-                }
-                else {
-                    self.logger.log("[SDLContext] dstIp: \(dstIp.asIpAddress()) arp query not found, broadcast", level: .debug)
-                    // 构造arp广播
-                    let arpReqeust = ARPPacket.arpRequest(senderIP: self.devAddr.netAddr, senderMAC: self.devAddr.mac, targetIP: dstIp)
-                    await self.routeLayerPacket(dstMac: ARPPacket.broadcastMac , type: .arp, data: arpReqeust.marshal())
-                }
-            }
-        }
-    }
-    
-    private func routeLayerPacket(dstMac: Data, type: LayerPacket.PacketType, data: Data) async {
-        // 将数据封装层2层的数据包
-        let layerPacket = LayerPacket(dstMac: dstMac, srcMac: self.devAddr.mac, type: type, data: data)
-        guard let encodedPacket = try? self.aesCipher.encrypt(aesKey: self.aesKey, data: layerPacket.marshal()) else {
-            return
-        }
-        
-        // 构造数据包
-        var dataPacket = SDLData()
-        dataPacket.networkID = self.devAddr.networkID
-        dataPacket.srcMac = self.devAddr.mac
-        dataPacket.dstMac = dstMac
-        dataPacket.ttl = 255
-        dataPacket.data = encodedPacket
-        
-        let data = try! dataPacket.serializedData()
-        // 广播地址不要去尝试打洞
-        if ARPPacket.isBroadcastMac(dstMac) {
-            // 通过super_node进行转发
-            await self.udpHoleActor?.send(type: .data, data: data, remoteAddress: self.config.stunSocketAddress)
-        }
-        else {
-            // 通过session发送到对端
-            if let session = await self.sessionManager.getSession(toAddress: dstMac) {
-                self.logger.log("[SDLContext] send packet by session: \(session)", level: .debug)
-                await self.udpHoleActor?.send(type: .data, data: data, remoteAddress: session.natAddress)
-                await self.flowTracer.inc(num: data.count, type: .p2p)
-            }
-            else {
-                // 通过super_node进行转发
-                await self.udpHoleActor?.send(type: .data, data: data, remoteAddress: self.config.stunSocketAddress)
-                // 流量统计
-                await self.flowTracer.inc(num: data.count, type: .forward)
-                // 尝试打洞
-                await self.puncherActor.submitRegisterRequest(request: .init(srcMac: self.devAddr.mac, dstMac: dstMac, networkId: self.devAddr.networkID))
-            }
-        }
-    }
-    
-    deinit {
-        self.rootTask?.cancel()
-        self.udpHoleActor = nil
-        self.superClientActor = nil
-        self.dnsClientActor = nil
-    }
-    
-    // 获取mac地址
-    public static func getMacAddress() -> Data {
-        let key = "gMacAddress2"
-        
-        let userDefaults = UserDefaults.standard
-        if let mac = userDefaults.value(forKey: key) as? Data {
-            return mac
-        }
-        else {
-            let mac = generateMacAddress()
-            userDefaults.setValue(mac, forKey: key)
-            
-            return mac
-        }
-    }
-    
-    // 随机生成mac地址
-    private static func generateMacAddress() -> Data {
-        var macAddress = [UInt8](repeating: 0, count: 6)
-        for i in 0..<6 {
-            macAddress[i] = UInt8.random(in: 0...255)
-        }
-        
-        return Data(macAddress)
-    }
-    
-}
-
-// 网络类型探测
-extension SDLContext {
-    // 定义nat类型
-    enum NatType: UInt8, Encodable {
-        case blocked = 0
-        case noNat = 1
-        case fullCone = 2
-        case portRestricted = 3
-        case coneRestricted = 4
-        case symmetric = 5
-    }
-    
-    // 获取当前所处的网络的nat类型
-    func getNatType() async -> NatType {
-        guard let udpHole = self.udpHoleActor else {
-            return .blocked
-        }
-        
-        let addressArray = config.stunProbeSocketAddressArray
-        // step1: ip1:port1 <---- ip1:port1
-        guard let natAddress1 = await getNatAddress(udpHole, remoteAddress: addressArray[0][0], attr: .none) else {
-            return .blocked
-        }
-        
-        // 网络没有在nat下
-        if await natAddress1 == udpHole.localAddress {
-            return .noNat
-        }
-        
-        // step2: ip2:port2 <---- ip2:port2
-        guard let natAddress2 = await getNatAddress(udpHole, remoteAddress: addressArray[1][1], attr: .none) else {
-            return .blocked
-        }
-        
-        // 如果natAddress2 的IP地址与上次回来的IP是不一样的，它就是对称型NAT; 这次的包也一定能发成功并收到
-        // 如果ip地址变了，这说明{dstIp, dstPort, srcIp, srcPort}, 其中有一个变了；则用新的ip地址
-        logger.log("[SDLNatProber] nat_address1: \(natAddress1), nat_address2: \(natAddress2)", level: .debug)
-        if let ipAddress1 = natAddress1.ipAddress, let ipAddress2 = natAddress2.ipAddress, ipAddress1 != ipAddress2 {
-            return .symmetric
-        }
-        
-        // step3: ip1:port1 <---- ip2:port2 (ip地址和port都变的情况)
-        // 如果能收到的，说明是完全锥形 说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
-        if let natAddress3 = await getNatAddress(udpHole, remoteAddress: addressArray[0][0], attr: .peer) {
-            logger.log("[SDLNatProber] nat_address1: \(natAddress1), nat_address2: \(natAddress2), nat_address3: \(natAddress3)", level: .debug)
-            return .fullCone
-        }
-        
-        // step3: ip1:port1 <---- ip1:port2 (port改变情况)
-        // 如果能收到的说明是IP地址限制锥型NAT，如果不能收到说明是端口限制锥型。
-        if let natAddress4 = await getNatAddress(udpHole, remoteAddress: addressArray[0][0], attr: .port) {
-            logger.log("[SDLNatProber] nat_address1: \(natAddress1), nat_address2: \(natAddress2), nat_address4: \(natAddress4)", level: .debug)
-            return .coneRestricted
-        } else {
-            return .portRestricted
-        }
-    }
-    
-    private func getNatAddress(_ udpHole: SDLUDPHoleActor, remoteAddress: SocketAddress, attr: SDLProbeAttr) async -> SocketAddress? {
-        let stunProbeReply = try? await udpHole.stunProbe(remoteAddress: remoteAddress, attr: attr, timeout: 5)
-        return stunProbeReply?.socketAddress()
-    }
-   
-}
-
-private extension UInt32 {
-    // 转换成ip地址
-    func asIpAddress() -> String {
-        return SDLUtil.int32ToIp(self)
-    }
-}

Tun/Punchnet/SDLError.swift

@@ -8,4 +8,7 @@
 enum SDLError: Error {
     case socketClosed
     case socketError
+    
+    case invalidKey
+    case unsupportedAlgorithm(algorithm: String)
 }

Tun/Punchnet/SDLFlowSessionManager.swift

@@ -0,0 +1,135 @@
+//
+//  FiveTuple.swift
+//  punchnet
+//  tcp/udp Flow流管理
+//  Created by 安礼成 on 2026/3/10.
+//
+import Foundation
+
+// MARK: - 五元组 key
+struct FlowSession: Hashable {
+    let srcIP: UInt32
+    let dstIP: UInt32
+    let srcPort: UInt16
+    let dstPort: UInt16
+    let proto: UInt8
+
+    func hash(into hasher: inout Hasher) {
+        // 高效组合 hash
+        hasher.combine(srcIP)
+        hasher.combine(dstIP)
+        hasher.combine(UInt32(srcPort) << 16 | UInt32(dstPort))
+        hasher.combine(proto)
+    }
+
+    static func ==(lhs: Self, rhs: Self) -> Bool {
+        return lhs.srcIP == rhs.srcIP &&
+               lhs.dstIP == rhs.dstIP &&
+               lhs.srcPort == rhs.srcPort &&
+               lhs.dstPort == rhs.dstPort &&
+               lhs.proto == rhs.proto
+    }
+
+    func reverse() -> FlowSession {
+        return FlowSession(
+            srcIP: dstIP,
+            dstIP: srcIP,
+            srcPort: dstPort,
+            dstPort: srcPort,
+            proto: proto
+        )
+    }
+
+}
+
+// MARK: - 会话管理器
+final class SDLFlowSessionManager {
+    private var sessions: [FlowSession: TimeInterval] = [:]
+    private let lock = NSLock()
+    private let sessionTimeout: TimeInterval
+
+    /// - Parameter sessionTimeout: 会话闲置多久（秒）被清理
+    init(sessionTimeout: TimeInterval = 300) {
+        self.sessionTimeout = sessionTimeout
+    }
+
+    // 插入或更新会话
+    func updateSession(_ key: FlowSession) {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        sessions[key] = Date().timeIntervalSince1970 + sessionTimeout
+    }
+    
+    // 查找会话
+    func hasSession(_ key: FlowSession) -> Bool {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+
+        if let expireTs = sessions[key] {
+            if expireTs >= Date().timeIntervalSince1970 {
+                return true
+            }
+            self.sessions.removeValue(forKey: key)
+        }
+
+        return false
+    }
+
+    // 删除会话
+    func removeSession(_ key: FlowSession) {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        
+        sessions.removeValue(forKey: key)
+    }
+
+    func clear() {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+
+        sessions.removeAll()
+    }
+
+    // 清理过期会话
+    func cleanupExpiredSessions() {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        
+        let now = Date().timeIntervalSince1970
+        self.sessions = self.sessions.filter { $0.value >= now }
+    }
+
+    // 返回当前会话数（调试/统计用）
+    var count: Int {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        return sessions.count
+    }
+    
+}
+
+extension IPPacket {
+    
+    func flowSession() -> FlowSession? {
+        switch self.transportPacket {
+        case .tcp(let tcpPacket):
+            return FlowSession(srcIP: header.source, dstIP: header.destination, srcPort: tcpPacket.header.srcPort, dstPort: tcpPacket.header.dstPort, proto: header.proto)
+        case .udp(let udpPacket):
+            return FlowSession(srcIP: header.source, dstIP: header.destination, srcPort: udpPacket.srcPort, dstPort: udpPacket.dstPort, proto: header.proto)
+        default:
+            return nil
+        }
+    }
+}

Tun/Punchnet/SDLFlowTracer.swift

@@ -6,9 +6,10 @@
 //
 
 import Foundation
+import Darwin
 
 // 流量统计器
-actor SDLFlowTracerActor {
+final class SDLFlowTracer {
     enum FlowType {
         case forward
         case p2p
@@ -19,7 +20,14 @@ actor SDLFlowTracerActor {
     private var p2pFlowBytes: UInt32 = 0
     private var inFlowBytes: UInt32 = 0
     
+    private let lock = NSLock()
+    
     func inc(num: Int, type: FlowType) {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        
         switch type {
         case .inbound:
             self.inFlowBytes += UInt32(num)
@@ -31,13 +39,14 @@ actor SDLFlowTracerActor {
     }
     
     func reset() -> (UInt32, UInt32, UInt32) {
+        lock.lock()
         defer {
             self.forwardFlowBytes = 0
             self.inFlowBytes = 0
             self.p2pFlowBytes = 0
+            lock.unlock()
         }
         
         return (forwardFlowBytes, p2pFlowBytes, inFlowBytes)
     }
-    
 }

Tun/Punchnet/SDLIPV6AssistClient.swift

@@ -0,0 +1,246 @@
+//
+//  SDLDNSClient 2.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/9.
+//
+import Foundation
+import Network
+
+enum SDLIPV6AssistError: Error {
+    case lostConnection
+    case requestTimeout
+}
+
+actor SDLIPV6AssistClient {
+    private struct PendingRequest {
+        let continuation: CheckedContinuation<SDLV6AssistProbeReply, Error>
+        let timeoutTask: Task<Void, Never>
+    }
+    
+    private enum State {
+        case idle
+        case running
+        case stopped
+    }
+    
+    private var state: State = .idle
+    private var connection: NWConnection?
+    private var receiveTask: Task<Void, Never>?
+    private let assistServerAddress: NWEndpoint
+    
+    private var packetId: UInt32 = 1
+    private var pendingRequests: [UInt32: PendingRequest] = [:]
+
+    init?(assistServerInfo: SDLV6Info) {
+        guard assistServerInfo.port <= UInt32(UInt16.max), let host = SDLUtil.ipv6DataToString(assistServerInfo.v6) else {
+            return nil
+        }
+        self.assistServerAddress = .hostPort(host: NWEndpoint.Host(host), port: NWEndpoint.Port(integerLiteral: UInt16(assistServerInfo.port)))
+    }
+    
+    func start() {
+        guard case .idle = self.state else {
+            return
+        }
+        
+        self.state = .running
+        
+        // 1. 配置参数：这是解决环路的关键
+        let parameters = NWParameters.udp
+        
+        // 禁止此连接走 TUN 网卡（在 NE 中 TUN 通常被归类为 .other）
+        parameters.prohibitedInterfaceTypes = [.other]
+        // 2. 增强健壮性：启用多路径切换（替代 pathSelectionOptions 的意图）
+        parameters.multipathServiceType = .handover
+        
+        // 只允许走 IPv6，避免在 assist 通道上退回到 IPv4 或双栈协商。
+        if let ipOptions = parameters.defaultProtocolStack.internetProtocol as? NWProtocolIP.Options {
+            ipOptions.version = .v6
+        }
+        
+        // 2. 创建连接
+        let connection = NWConnection(to: self.assistServerAddress, using: parameters)
+        self.connection = connection
+        
+        connection.stateUpdateHandler = { [weak self] state in
+            Task {
+                await self?.handleConnectionStateUpdate(state, for: connection)
+            }
+        }
+        
+        // 启动连接队列
+        connection.start(queue: .global())
+    }
+    
+    /// 接收数据的递归循环
+    private static func makeReceiveStream(for connection: NWConnection) -> AsyncStream<Data> {
+        return AsyncStream(bufferingPolicy: .bufferingNewest(256)) { continuation in
+            func receiveNext() {
+                connection.receiveMessage { content, _, _, error in
+                    if let data = content, !data.isEmpty {
+                        // 将收到的 DNS 响应写回 AsyncStream
+                        continuation.yield(data)
+                    }
+                    
+                    if error == nil && connection.state == .ready {
+                        receiveNext() // 继续监听下一个包
+                    } else {
+                        continuation.finish()
+                    }
+                }
+            }
+            
+            receiveNext()
+        }
+    }
+    
+    func probe(requestTimeout: Duration = .seconds(5)) async throws -> SDLV6AssistProbeReply {
+        guard case .running = self.state, let connection = self.connection, connection.state == .ready else {
+            throw SDLIPV6AssistError.lostConnection
+        }
+        
+        let pktId = self.nextPacketId()
+        var assistProbe = SDLV6AssistProbe()
+        assistProbe.pktID = pktId
+        let data = try assistProbe.serializedData()
+        
+        return try await withCheckedThrowingContinuation { cont in
+            let timeoutTask = Task { [weak self] in
+                try? await Task.sleep(for: requestTimeout)
+                await self?.handleRequestTimeout(packetId: pktId)
+            }
+            
+            self.pendingRequests[pktId] = .init(continuation: cont, timeoutTask: timeoutTask)
+            connection.send(content: data, completion: .contentProcessed { error in
+                if let error {
+                    Task {
+                        await self.handleProcessError(packetId: pktId, error: error)
+                    }
+                }
+            })
+        }
+        
+    }
+    
+    private func handleProcessError(packetId: UInt32, error: NWError) {
+        if let request = self.takePendingRequest(packetId: packetId) {
+            request.continuation.resume(throwing: error)
+        }
+    }
+    
+    private func handleRequestTimeout(packetId: UInt32) {
+        if let request = self.takePendingRequest(packetId: packetId) {
+            request.continuation.resume(throwing: SDLIPV6AssistError.requestTimeout)
+        }
+    }
+    
+    func stop() {
+        self.stop(pendingError: SDLIPV6AssistError.lostConnection)
+    }
+    
+    private func stop(pendingError: any Error) {
+        guard self.state != .stopped else {
+            return
+        }
+        
+        self.state = .stopped
+        self.receiveTask?.cancel()
+        self.receiveTask = nil
+        self.connection?.cancel()
+        self.connection = nil
+        self.failAllPendingRequests(error: pendingError)
+    }
+    
+    private func handleConnectionStateUpdate(_ state: NWConnection.State, for connection: NWConnection) {
+        guard case .running = self.state else {
+            return
+        }
+        
+        switch state {
+        case .ready:
+            SDLLogger.log("[SDLIPV6AssistClient] Connection ready", for: .debug)
+            self.startReceiveTask(for: connection)
+        case .failed(let error):
+            SDLLogger.log("[SDLIPV6AssistClient] Connection failed: \(error)", for: .debug)
+            self.stop(pendingError: error)
+        case .cancelled:
+            self.stop()
+        default:
+            break
+        }
+    }
+    
+    private func startReceiveTask(for connection: NWConnection) {
+        guard self.receiveTask == nil else {
+            return
+        }
+        
+        let stream = Self.makeReceiveStream(for: connection)
+        self.receiveTask = Task { [weak self] in
+            for await data in stream {
+                guard let self else {
+                    break
+                }
+                await self.handleReceivedPacket(data)
+            }
+            
+            await self?.didFinishReceiving(for: connection)
+        }
+    }
+    
+    private func handleReceivedPacket(_ data: Data) {
+        do {
+            let packet = try SDLV6AssistProbeReply(serializedBytes: data)
+            let pktId = packet.pktID
+            if let request = self.takePendingRequest(packetId: pktId) {
+                request.continuation.resume(returning: packet)
+            }
+        } catch {
+            SDLLogger.log("[SDLIPV6AssistClient] Receive error: \(error)", for: .debug)
+        }
+    }
+    
+    private func didFinishReceiving(for connection: NWConnection) {
+        guard case .running = self.state else {
+            return
+        }
+        
+        if self.connection === connection, connection.state != .ready {
+            self.stop()
+        } else {
+            self.receiveTask = nil
+        }
+    }
+    
+    private func nextPacketId() -> UInt32 {
+        let packetId = self.packetId
+        self.packetId &+= 1
+        
+        return packetId
+    }
+    
+    private func takePendingRequest(packetId: UInt32) -> PendingRequest? {
+        guard let request = self.pendingRequests.removeValue(forKey: packetId) else {
+            return nil
+        }
+        
+        request.timeoutTask.cancel()
+        return request
+    }
+    
+    private func failAllPendingRequests(error: any Error) {
+        let pendingRequests = self.pendingRequests
+        self.pendingRequests.removeAll()
+        
+        pendingRequests.values.forEach { request in
+            request.timeoutTask.cancel()
+            request.continuation.resume(throwing: error)
+        }
+    }
+    
+    deinit {
+        self.connection?.cancel()
+    }
+    
+}

Tun/Punchnet/SDLLogger.swift

@@ -5,42 +5,36 @@
 //  Created by 安礼成 on 2024/3/13.
 //
 import Foundation
-import os.log
+import os
 
 public class SDLLogger: @unchecked Sendable {
-    public enum Level: Int8, CustomStringConvertible {
-        case debug = 0
-        case info = 1
-        case warning = 2
-        case error = 3
     
-        public var description: String {
+    public enum Subsystem: String, CaseIterable {
-            switch self {
+        case debug = "com.jihe.punchnet.debug"
-            case .debug:
+        case trace = "com.jihe.punchnet.trace"
-                return "Debug"
-            case .info:
-                return "Info"
-            case .warning:
-                return "Warning"
-            case .error:
-                return "Error"
-            }
-        }
     }
     
-    private let level: Level
+    private static var loggers: [String: SDLLogger] {
-    private let log: OSLog
+        var loggers: [String: SDLLogger] = [:]
-    
+        for sub in Subsystem.allCases {
-    public init(level: Level) {
+            loggers[sub.rawValue] = .init(subsystem: sub)
-        self.level = level
+        }
-        self.log = OSLog(subsystem: "com.jihe.punchnet", category: "punchnet")
+        return loggers
     }
     
-    public func log(_ message: String, level: Level = .debug) {
+    private let log: Logger
-        if self.level.rawValue <= level.rawValue {
+    
-            //os_log("%{public}@: %{public}@", log: self.log, type: .debug, level.description, message)
+    private init(subsystem: Subsystem) {
-            NSLog("\(level.description): \(message)")
+        self.log = Logger(subsystem: subsystem.rawValue, category: "punchnet")
-        }
     }
     
+    public func _log(_ message: String) {
+        self.log.info("\(message, privacy: .public)")
+    }
+    
+    public static func log(_ message: String, for system: Subsystem = .debug) {
+        if let logger = loggers[system.rawValue] {
+            logger._log(message)
+        }
+    }
 }

Tun/Punchnet/SDLNetAddress.swift

@@ -1,49 +0,0 @@
-//
-//  SDLIPAddress.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/3/4.
-//
-
-import Foundation
-
-struct SDLNetAddress {
-    let ip: UInt32
-    let maskLen: UInt8
-    
-    // ip地址
-    var ipAddress: String {
-        return intToIpAddress(self.ip)
-    }
-    
-    // 掩码
-    var maskAddress: String {
-        let len0 = 32 - maskLen
-        let num: UInt32 = (0xFFFFFFFF >> len0) << len0
-        
-        return intToIpAddress(num)
-    }
-    
-    // 网络地址
-    var networkAddress: String {
-        let len0 = 32 - maskLen
-        let mask: UInt32 = (0xFFFFFFFF >> len0) << len0
-        
-        return intToIpAddress(self.ip & mask)
-    }
-    
-    init(ip: UInt32, maskLen: UInt8) {
-        self.ip = ip
-        self.maskLen = maskLen
-    }
-    
-    private func intToIpAddress(_ num: UInt32) -> String {
-        let ip0 = (UInt8) (num >> 24 & 0xFF)
-        let ip1 = (UInt8) (num >> 16 & 0xFF)
-        let ip2 = (UInt8) (num >> 8 & 0xFF)
-        let ip3 = (UInt8) (num & 0xFF)
-        
-        return "\(ip0).\(ip1).\(ip2).\(ip3)"
-    }
-    
-}

Tun/Punchnet/SDLNetworkMonitor.swift

@@ -15,6 +15,7 @@ class SDLNetworkMonitor: @unchecked Sendable {
     private var interfaceType: NWInterface.InterfaceType?
     private let publisher = PassthroughSubject<NWInterface.InterfaceType, Never>()
     private var cancel: AnyCancellable?
+    private var isStopped = false
     
     public let eventStream: AsyncStream<MonitorEvent>
     private let eventContinuation: AsyncStream<MonitorEvent>.Continuation
@@ -55,10 +56,19 @@ class SDLNetworkMonitor: @unchecked Sendable {
             }
     }
     
-    deinit {
+    func stop() {
+        guard !self.isStopped else {
+            return
+        }
+        
+        self.isStopped = true
         self.monitor.cancel()
         self.cancel?.cancel()
         self.eventContinuation.finish()
     }
     
+    deinit {
+        self.stop()
+    }
+    
 }

Tun/Punchnet/SDLNoticeClient.swift

@@ -1,88 +0,0 @@
-//
-//  SDLNoticeClient.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/5/20.
-//
-
-import Foundation
-
-//
-//  SDLanServer.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/1/31.
-//
-
-import Foundation
-import NIOCore
-import NIOPosix
-
-// 处理和sn-server服务器之间的通讯
-actor SDLNoticeClient {
-    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    private let asyncChannel: NIOAsyncChannel<AddressedEnvelope<ByteBuffer>, AddressedEnvelope<ByteBuffer>>
-    private let remoteAddress: SocketAddress
-    private let (writeStream, writeContinuation) = AsyncStream.makeStream(of: Data.self, bufferingPolicy: .unbounded)
-    
-    private let logger: SDLLogger
-    
-    // 启动函数
-    init(noticePort: Int, logger: SDLLogger) async throws {
-        self.logger = logger
-        
-        self.remoteAddress = try! SocketAddress(ipAddress: "127.0.0.1", port: noticePort)
-        
-        let bootstrap = DatagramBootstrap(group: self.group)
-            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
-        
-        self.asyncChannel = try await bootstrap.bind(host: "0.0.0.0", port: 0)
-            .flatMapThrowing {channel in
-                return try NIOAsyncChannel(wrappingChannelSynchronously: channel, configuration: .init(
-                    inboundType: AddressedEnvelope<ByteBuffer>.self,
-                    outboundType: AddressedEnvelope<ByteBuffer>.self
-                ))
-            }
-            .get()
-        
-        self.logger.log("[SDLNoticeClient] started and listening on: \(self.asyncChannel.channel.localAddress!)", level: .debug)
-    }
-    
-    func start() async throws {
-        try await self.asyncChannel.executeThenClose { inbound, outbound in
-            try await withThrowingTaskGroup(of: Void.self) { group in
-                group.addTask {
-                    try await self.asyncChannel.channel.closeFuture.get()
-                    throw SDLError.socketClosed
-                }
-                
-                group.addTask {
-                    defer {
-                        self.writeContinuation.finish()
-                    }
-                    
-                    for try await message in self.writeStream {
-                        let buf = self.asyncChannel.channel.allocator.buffer(bytes: message)
-                        let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: self.remoteAddress, data: buf)
-                        
-                        try await outbound.write(envelope)
-                    }
-                }
-                
-                for try await _ in group {
-                    
-                }
-            }
-        }
-    }
-    
-    // 处理写入逻辑
-    func send(data: Data) {
-        self.writeContinuation.yield(data)
-    }
-    
-    deinit {
-        try? self.group.syncShutdownGracefully()
-        self.writeContinuation.finish()
-    }
-}

Tun/Punchnet/SDLProtoMessageExtension.swift

@@ -1,16 +0,0 @@
-//
-//  SDLProtoMessageExtension.swift
-//  Tun
-//
-//  Created by 安礼成 on 2024/10/24.
-//
-
-import Foundation
-
-extension SDLData {
-    
-    func format() -> String {
-        return "network_id: \(self.networkID), src_mac: \(LayerPacket.MacAddress.description(data: self.srcMac)), dst_mac: \(LayerPacket.MacAddress.description(data: self.dstMac)), data: \([UInt8](self.data))"
-    }
-    
-}

Tun/Punchnet/SDLTunnelAppNotifier.swift

@@ -0,0 +1,51 @@
+//
+//  SDLTunnelAppNotifier.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/15.
+//
+
+import Foundation
+
+final class SDLTunnelAppNotifier {
+    static let shared = SDLTunnelAppNotifier()
+    
+    private let suiteName: String
+    private let eventKey: String
+    
+    init(suiteName: String = SDLNotificationCenter.Configuration.appGroupSuiteName,
+         eventKey: String = SDLNotificationCenter.Configuration.latestEventKey) {
+        self.suiteName = suiteName
+        self.eventKey = eventKey
+    }
+    
+    func publish(code: Int? = nil, message: String) {
+        var event = TunnelEvent()
+        event.id = UUID().uuidString
+        event.timestampMs = UInt64(Date().timeIntervalSince1970 * 1000)
+        event.code = Int32(clamping: code ?? 0)
+        event.message = message
+        self.publish(event)
+    }
+    
+    func publish(_ event: TunnelEvent) {
+        guard let shared = UserDefaults(suiteName: self.suiteName),
+              let data = try? event.serializedData() else {
+            return
+        }
+        
+        shared.set(data, forKey: self.eventKey)
+        shared.synchronize()
+        SDLNotificationCenter.shared.post(.tunnelEventChanged)
+    }
+    
+    func clear() {
+        guard let shared = UserDefaults(suiteName: self.suiteName) else {
+            return
+        }
+        
+        shared.removeObject(forKey: self.eventKey)
+        shared.synchronize()
+        SDLNotificationCenter.shared.post(.tunnelEventChanged)
+    }
+}

Tun/Punchnet/SDLUtil.swift

@@ -6,6 +6,9 @@
 //
 
 import Foundation
+import SystemConfiguration
+import Network
+import Darwin
 
 struct SDLUtil {
     
@@ -30,6 +33,54 @@ struct SDLUtil {
         return "\(ip0).\(ip1).\(ip2).\(ip3)"
     }
     
+    public static func ipv4StrToInt32(_ ip: String) -> UInt32? {
+        let parts = ip.split(separator: ".")
+        guard parts.count == 4 else {
+            return nil
+        }
+        
+        var result: UInt32 = 0
+        for part in parts {
+            guard let byte = UInt8(part) else { return nil }
+            result = (result << 8) | UInt32(byte)
+        }
+        
+        return result
+    }
+
+    public static func ipv6DataToString(_ data: Data) -> String? {
+        guard data.count == 16 else {
+            return nil
+        }
+        
+        return data.withUnsafeBytes { rawBuffer in
+            guard let baseAddress = rawBuffer.baseAddress else {
+                return nil
+            }
+            
+            var hostBuffer = [CChar](repeating: 0, count: Int(INET6_ADDRSTRLEN))
+            guard inet_ntop(AF_INET6, baseAddress, &hostBuffer, socklen_t(INET6_ADDRSTRLEN)) != nil else {
+                return nil
+            }
+            
+            return String(cString: hostBuffer)
+        }
+    }
+
+    public static func ipv6StrToData(_ ip: String) -> Data? {
+        let normalizedIp = String(ip.split(separator: "%", maxSplits: 1, omittingEmptySubsequences: false).first ?? "")
+        guard !normalizedIp.isEmpty else {
+            return nil
+        }
+        
+        var address = in6_addr()
+        guard inet_pton(AF_INET6, normalizedIp, &address) == 1 else {
+            return nil
+        }
+        
+        return withUnsafeBytes(of: &address) { Data($0) }
+    }
+    
     // 判断ip地址是否在同一个网络
     public static func inSameNetwork(ip: UInt32, compareIp: UInt32, maskLen: UInt8) -> Bool {
         if ip == compareIp {
@@ -49,4 +100,42 @@ struct SDLUtil {
         return bytes.map { String(format: "%02X", $0) }.joined(separator: ":").lowercased()
     }
     
+    public static func getMacOSSystemDnsServers() -> [String] {
+        var results = [String]()
+        
+        // 获取全局 DNS 配置
+        if let dict = SCDynamicStoreCopyValue(nil, "State:/Network/Global/DNS" as CFString) as? [String: Any] {
+            if let servers = dict["ServerAddresses"] as? [String] {
+                results = servers
+            }
+        }
+        return results
+    }
+    
+    // 域名解析
+    static func resolveHostname(host: String) async -> String? {
+        let endpoint = NWEndpoint.hostPort(host: NWEndpoint.Host(host), port: 53)
+        let parameters = NWParameters.udp
+        // 即使还没正式开始，也加上这个，确保不会被残留的旧 utun 路由卡死
+        parameters.prohibitedInterfaceTypes = [.other]
+        
+        let connection = NWConnection(to: endpoint, using: parameters)
+        
+        return await withCheckedContinuation { continuation in
+            connection.stateUpdateHandler = { state in
+                if case .ready = state {
+                    if let path = connection.currentPath,
+                       case .hostPort(let resolvedHost, _) = path.remoteEndpoint {
+                        let ip = String(describing: resolvedHost)
+                        continuation.resume(returning: ip)
+                        connection.cancel()
+                    }
+                } else if case .failed = state {
+                    continuation.resume(returning: nil)
+                }
+            }
+            connection.start(queue: .global())
+        }
+    }
+
 }

Tun/Punchnet/SessionManager.swift

@@ -1,24 +1,33 @@
 //
 //  Session.swift
 //  sdlan
-//
+//  Session是增加了有效时间的
 //  Created by 安礼成 on 2025/7/14.
 //
 import Foundation
 import NIOCore
+import Darwin
 
 struct Session {
+    enum AddressType: String, Hashable {
+        case v4
+        case v6
+    }
+
     // 在内部的通讯的ip地址, 整数格式
     let dstMac: Data
     // 对端的主机在nat上映射的端口信息
     let natAddress: SocketAddress
+    // 当前会话对应的外层地址族
+    let addressType: AddressType
     
     // 最后使用时间
     var lastTimestamp: Int32
     
-    init(dstMac: Data, natAddress: SocketAddress) {
+    init?(dstMac: Data, natAddress: SocketAddress, addressType: AddressType) {
         self.dstMac = dstMac
         self.natAddress = natAddress
+        self.addressType = addressType
         self.lastTimestamp = Int32(Date().timeIntervalSince1970)
     }
 
@@ -28,30 +37,59 @@ struct Session {
 }
 
 actor SessionManager {
-    private var sessions: [Data:Session] = [:]
+    private var sessions: [Data: [Session.AddressType: Session]] = [:]
     
     // session的有效时间
     private let ttl: Int32 = 10
     
     func getSession(toAddress: Data) -> Session? {
         let timestamp = Int32(Date().timeIntervalSince1970)
-        if let session = self.sessions[toAddress] {
+        
-            if session.lastTimestamp >= timestamp + ttl {
+        guard var peerSessions = self.sessions[toAddress] else {
-                self.sessions[toAddress]?.updateLastTimestamp(timestamp)
-                return session
-            } else {
-                self.sessions.removeValue(forKey: toAddress)
-            }
-        }
             return nil
         }
         
+        peerSessions = peerSessions.filter { $0.value.lastTimestamp + ttl >= timestamp }
+        guard !peerSessions.isEmpty else {
+            self.sessions.removeValue(forKey: toAddress)
+            return nil
+        }
+        
+        guard var session = self.selectSession(in: peerSessions) else {
+            self.sessions[toAddress] = peerSessions
+            return nil
+        }
+        
+        session.updateLastTimestamp(timestamp)
+        peerSessions[session.addressType] = session
+        
+        self.sessions[toAddress] = peerSessions
+        
+        return session
+    }
+
     func addSession(session: Session) {
-        self.sessions[session.dstMac] = session
+        let timestamp = Int32(Date().timeIntervalSince1970)
+        
+        var sessions = self.sessions[session.dstMac, default: [:]]
+        sessions = sessions.filter {
+            $0.value.lastTimestamp + ttl >= timestamp && $0.key != session.addressType
+        }
+        sessions[session.addressType] = session
+        
+        self.sessions[session.dstMac] = sessions
     }
     
     func removeSession(dstMac: Data) {
         self.sessions.removeValue(forKey: dstMac)
     }
     
+    func clear() {
+        self.sessions.removeAll()
+    }
+
+    private func selectSession(in sessions: [Session.AddressType: Session]) -> Session? {
+        return sessions.values.max(by: { $0.lastTimestamp < $1.lastTimestamp })
+    }
+    
 }

Tun/Punchnet/Super/SDLSuperClient.swift

@@ -0,0 +1,391 @@
+//
+//  SDLSuperClient.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/2/13.
+//
+
+import Foundation
+import NIOCore
+import Network
+import CryptoKit
+import Security
+
+// 定义错误类型，便于上层处理
+enum SDLQUICError: Error {
+    case connectionFailed(Error)
+    case connectionCancelled
+    case writeFailed(Error)
+    
+    case internalError(Error)
+    
+    case timeout
+    case decodeError(String)
+    case packetTooLarge
+    case dataStreamClosed
+}
+
+actor SDLSuperClient {
+    enum State {
+        case idle
+        case running
+        case stopped
+    }
+    
+    private var state: State = .idle
+    
+    private let frameParser: SDLQUICFrameParser
+    
+    // 数据流
+    public var messageStream: AsyncThrowingStream<SDLQUICInboundMessage, Error>
+    private let messageCont: AsyncThrowingStream<SDLQUICInboundMessage, Error>.Continuation
+    private var isMessageContinuationFinished: Bool = false
+    
+    private var readTask: Task<Void, Never>?
+
+    private var connection: NWConnection?
+    
+    private let host: String
+    private let port: UInt16
+    
+    init(host: String, port: UInt16, maxBufferSize: Int = 2 * 1024 * 1024) {
+        self.host = host
+        self.port = port
+        
+        self.frameParser = SDLQUICFrameParser(maxBufferSize: maxBufferSize)
+        (self.messageStream, self.messageCont) = AsyncThrowingStream.makeStream(of: SDLQUICInboundMessage.self)
+    }
+    
+    func start() {
+        let host = self.host
+        let queue = DispatchQueue(label: "com.sdl.SuperClient.queue") // 专用队列保证线程安全
+
+        let options = NWProtocolTLS.Options()
+        sec_protocol_options_add_tls_application_protocol(
+            options.securityProtocolOptions,
+            "punchnet/1.0"
+        )
+        
+        // 这里设置证书的校验逻辑
+        sec_protocol_options_set_verify_block(
+            options.securityProtocolOptions,
+            { _, trust, complete in
+                // 执行公钥校验
+                complete(TLSVerifier.verify(trust: trust, host: host))
+            },
+            queue
+        )
+        SDLLogger.log("[SDLSuperClient] start with tls protocol", for: .debug)
+        
+        let params = NWParameters(tls: options)
+        // 关键：让 Network.framework 忽略系统代理
+        params.preferNoProxies = true
+        
+        let connection = NWConnection(host: .init(host), port: .init(rawValue: port)!, using: params)
+        
+        connection.stateUpdateHandler = { [weak self] state in
+            SDLLogger.log("[SDLSuperClient] new state: \(state)", for: .debug)
+            Task {
+                await self?.handleConnectionState(state: state)
+            }
+        }
+        connection.start(queue: queue)
+        
+        self.connection = connection
+    }
+    
+    private func handleConnectionState(state: NWConnection.State) {
+        switch state {
+        case .ready:
+            self.startReadTask()
+            self.state = .running
+        case .failed(let error):
+            self.finishMessageContinuationIfNeed(throwing: .connectionFailed(error))
+        case .cancelled:
+            self.finishMessageContinuationIfNeed(throwing: .connectionCancelled)
+        default:
+            ()
+        }
+    }
+    
+    private func finishMessageContinuationIfNeed(throwing error: SDLQUICError?) {
+        guard !self.isMessageContinuationFinished else {
+            return
+        }
+        
+        self.isMessageContinuationFinished = true
+        if let error {
+            self.messageCont.finish(throwing: error)
+        } else {
+            self.messageCont.finish()
+        }
+    }
+    
+    private func startReadTask() {
+        self.readTask?.cancel()
+        self.readTask = Task {
+            do {
+                while true {
+                    try Task.checkCancellation()
+                    let data = try await self.readOnce()
+                    let frames = try self.frameParser.parseFrames(data: data)
+                    for frame in frames {
+                        if let message = SDLQUICCodec.decode(frame: frame) {
+                            self.messageCont.yield(message)
+                        } else {
+                            self.finishMessageContinuationIfNeed(throwing: .decodeError("invalid message"))
+                        }
+                    }
+                }
+            } catch let err {
+                self.finishMessageContinuationIfNeed(throwing: .internalError(err))
+            }
+        }
+    }
+    
+    func send(type: SDLPacketType, data: Data) {
+        guard case .running = state, let connection = self.connection, connection.state == .ready else {
+            return
+        }
+        
+        var len = UInt16(data.count + 1).bigEndian
+        var packet = Data(Data(bytes: &len, count: 2))
+        packet.append(type.rawValue)
+        packet.append(data)
+        
+        connection.send(content: packet, completion: .contentProcessed { [weak self] error in
+            if let error {
+                Task {
+                    SDLLogger.log("[SDLSuperClient] send data get error: \(error)", for: .debug)
+                    await self?.finishMessageContinuationIfNeed(throwing: .writeFailed(error))
+                }
+            }
+        })
+    }
+    
+    private func readOnce() async throws -> Data {
+        guard let connection = self.connection else {
+            throw SDLQUICError.connectionCancelled
+        }
+        
+        return try await withCheckedThrowingContinuation { cont in
+            connection.receive(minimumIncompleteLength: 1, maximumLength: 64 * 1024) { data, _, isComplete, error in
+                if let error {
+                    cont.resume(throwing: error)
+                    return
+                }
+                
+                if isComplete {
+                    cont.resume(throwing: SDLQUICError.dataStreamClosed)
+                } else {
+                    cont.resume(returning: data ?? Data())
+                }
+            }
+        }
+    }
+    
+    func stop() {
+        guard self.state != .stopped else {
+            return
+        }
+        
+        self.state = .stopped
+        
+        self.readTask?.cancel()
+        self.readTask = nil
+
+        let connection = self.connection
+        self.connection = nil
+        connection?.stateUpdateHandler = nil
+        connection?.cancel()
+
+        self.finishMessageContinuationIfNeed(throwing: nil)
+        
+        SDLLogger.log("[SDLSuperClient] stopped")
+    }
+    
+    deinit {
+        SDLLogger.log("[SDLSuperClient] deinit")
+    }
+    
+}
+
+// --MARK: 数据累加器
+extension SDLSuperClient {
+    
+    class SDLQUICFrameParser {
+        private let allocator = ByteBufferAllocator()
+        // 最大缓冲区区为2M
+        private let maxPacketSize: Int = 64 * 1024
+        private let maxBufferSize: Int
+        private var buffer: ByteBuffer
+        
+        init(maxBufferSize: Int) {
+            self.buffer = allocator.buffer(capacity: maxBufferSize)
+            self.maxBufferSize = maxBufferSize
+        }
+        
+        // 尝试解析数据
+        public func parseFrames(data: Data) throws -> [ByteBuffer] {
+            self.buffer.writeBytes(data)
+            
+            guard buffer.readableBytes >= 2 else {
+                return []
+            }
+            
+            var frames: [ByteBuffer] = []
+            while true {
+                guard let len = buffer.getInteger(at: buffer.readerIndex, endianness: .big, as: UInt16.self) else {
+                    break
+                }
+                
+                if len > self.maxPacketSize {
+                    throw SDLQUICError.packetTooLarge
+                }
+                
+                guard buffer.readableBytes >= len + 2 else {
+                    break
+                }
+                
+                buffer.moveReaderIndex(forwardBy: 2)
+                if let buf = buffer.readSlice(length: Int(len)) {
+                    frames.append(buf)
+                }
+            }
+            
+            let threshold = maxBufferSize / 10 * 6
+            if buffer.readerIndex > threshold {
+                buffer.discardReadBytes()
+            }
+            
+            return frames
+        }
+        
+    }
+    
+}
+
+// --MARK: 编解码器
+extension SDLSuperClient {
+    
+    enum SDLQUICCodec {
+        public static func decode(frame: ByteBuffer) -> SDLQUICInboundMessage? {
+            var buffer = frame
+            guard let type = buffer.readInteger(as: UInt8.self),
+                  let packetType = SDLPacketType(rawValue: type) else {
+                return nil
+            }
+            
+            switch packetType {
+            case .welcome:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let welcome = try? SDLWelcome(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .welcome(welcome)
+                
+            case .registerSuperAck:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let registerSuperAck = try? SDLRegisterSuperAck(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .registerSuperAck(registerSuperAck)
+            case .registerSuperNak:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let registerSuperNak = try? SDLRegisterSuperNak(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .registerSuperNak(registerSuperNak)
+            case .peerInfo:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let peerInfo = try? SDLPeerInfo(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .peerInfo(peerInfo)
+            case .policyResponse:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let policyResponse = try? SDLPolicyResponse(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .policyReponse(policyResponse)
+            case .arpResponse:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let arpResponse = try? SDLArpResponse(serializedBytes: bytes) else {
+                    return nil
+                }
+                return .arpResponse(arpResponse)
+            case .event:
+                guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                      let event = try? SDLEvent(serializedBytes: bytes) else {
+                    SDLLogger.log("SDLSuperClient decode Event Error", for: .debug)
+                    return nil
+                }
+                return .event(event)
+            case .pong:
+                return .pong
+            default:
+                SDLLogger.log("SDLSuperClient decode miss type: \(type)", for: .debug)
+                
+                return nil
+            }
+        }
+    }
+}
+
+// --MARK: tls验证
+extension SDLSuperClient {
+
+    enum TLSVerifier {
+        // 你的 Base64 公钥指纹
+        static let pinnedPublicKeyHashes = [
+            "Q41r6hbMWEVyxo6heNAH4Wx/TH5NNOWlNif9bewcJ3E="
+        ]
+
+        static func verify(trust: sec_trust_t, host: String) -> Bool {
+            let secTrust = sec_trust_copy_ref(trust).takeRetainedValue()
+
+            // --- Step 1: 系统验证 ---
+            var error: CFError?
+            guard SecTrustEvaluateWithError(secTrust, &error) else {
+                SDLLogger.log("❌ 系统证书验证失败: \(error?.localizedDescription ?? "未知错误")", for: .debug)
+                return false
+            }
+
+            // --- Step 2: 主机名验证 ---
+            let policy = SecPolicyCreateSSL(true, host as CFString)
+            SecTrustSetPolicies(secTrust, policy)
+
+            guard SecTrustEvaluateWithError(secTrust, &error) else {
+                SDLLogger.log("❌ 主机名校验失败: \(error?.localizedDescription ?? "未知错误")", for: .debug)
+                return false
+            }
+
+            // --- Step 3: 获取叶子证书 ---
+            guard let chain = SecTrustCopyCertificateChain(secTrust) as? [SecCertificate],
+                  let leafCertificate = chain.first else {
+                SDLLogger.log("❌ 无法获取证书链或叶子证书", for: .debug)
+                return false
+            }
+
+            // --- Step 4: 提取公钥 ---
+            guard let publicKey = SecCertificateCopyKey(leafCertificate),
+                  let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? else {
+                SDLLogger.log("❌ 无法提取公钥", for: .debug)
+                return false
+            }
+
+            // --- Step 5: SHA256 校验 ---
+            let hash = SHA256.hash(data: publicKeyData)
+            let hashBase64 = Data(hash).base64EncodedString()
+
+            if pinnedPublicKeyHashes.contains(hashBase64) {
+                SDLLogger.log("✅ 公钥校验通过", for: .debug)
+                return true
+            } else {
+                SDLLogger.log("⚠️ 公钥不匹配! 收到: \(hashBase64)", for: .debug)
+                return false
+            }
+        }
+
+    }
+}

Tun/Punchnet/Super/SDLSuperService.swift

@@ -0,0 +1,111 @@
+import Foundation
+
+actor SDLSuperService {
+    typealias MessageHandler = @Sendable (SDLQUICInboundMessage) async -> Void
+
+    private let host: String
+    private let port: UInt16
+    private let onMessage: MessageHandler
+
+    private var superClient: SDLSuperClient?
+    private var monitorTask: Task<Void, Never>?
+
+    init(host: String, port: UInt16 = 1443, onMessage: @escaping MessageHandler) {
+        self.host = host
+        self.port = port
+        self.onMessage = onMessage
+    }
+
+    func start() {
+        guard self.monitorTask == nil else {
+            return
+        }
+
+        self.monitorTask = startMonitorTask(name: "superServiceMonitor") { [weak self] in
+            guard let self else {
+                throw CancellationError()
+            }
+            try await self.runOnce()
+        }
+    }
+
+    func stop() async {
+        let monitorTask = self.monitorTask
+        self.monitorTask = nil
+
+        let superClient = self.superClient
+        self.superClient = nil
+
+        monitorTask?.cancel()
+        await superClient?.stop()
+
+        if let monitorTask {
+            await monitorTask.value
+        }
+    }
+
+    func send(type: SDLPacketType, data: Data) async {
+        await self.superClient?.send(type: type, data: data)
+    }
+
+    private func runOnce() async throws {
+        let superClient = SDLSuperClient(host: self.host, port: self.port)
+        self.superClient = superClient
+        await superClient.start()
+
+        do {
+            try await withTaskCancellationHandler {
+                try await self.run(superClient)
+            } onCancel: {
+                Task {
+                    await superClient.stop()
+                }
+            }
+            await self.cleanup(superClient)
+        } catch {
+            await self.cleanup(superClient)
+            throw error
+        }
+    }
+
+    private func run(_ superClient: SDLSuperClient) async throws {
+        try await Task.sleep(for: .seconds(0.5))
+        try Task.checkCancellation()
+
+        SDLLogger.log("[SDLSuperService] start super client: \(self.host)")
+
+        try await withThrowingTaskGroup(of: Void.self) { group in
+            defer {
+                group.cancelAll()
+            }
+
+            let onMessage = self.onMessage
+            group.addTask {
+                for try await message in await superClient.messageStream {
+                    try Task.checkCancellation()
+                    await onMessage(message)
+                }
+            }
+
+            group.addTask {
+                while true {
+                    try await Task.sleep(for: .seconds(5))
+                    try Task.checkCancellation()
+                    await superClient.send(type: .ping, data: Data())
+                }
+            }
+
+            _ = try await group.next()
+        }
+    }
+
+    private func cleanup(_ superClient: SDLSuperClient) async {
+        await superClient.stop()
+
+        if self.superClient === superClient {
+            self.superClient = nil
+        }
+
+        SDLLogger.log("[SDLSuperService] cleanup")
+    }
+}

Tun/Punchnet/UDPHole/SDLHoleMessage.swift

@@ -0,0 +1,96 @@
+//
+//  SDLHoleMessageDecoder.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/15.
+//
+import Foundation
+import NIOCore
+import NIOPosix
+import SwiftProtobuf
+
+// --MARK: 进来的消息, 这里需要采用代数类型来表示
+enum SDLHoleMessage {
+    case data(SDLData)
+    case register(SDLRegister)
+    case registerAck(SDLRegisterAck)
+    case stunProbeReply(SDLStunProbeReply)
+    case stunReply(SDLStunReply)
+}
+
+enum SDLHoleControlMessage {
+    case register(SDLRegister)
+    case registerAck(SDLRegisterAck)
+    case stunProbeReply(SDLStunProbeReply)
+    case stunReply(SDLStunReply)
+}
+
+enum SDLHoleInboundMessage {
+    case control(SDLHoleControlMessage)
+    case data(SDLData)
+}
+
+extension SDLHoleMessage {
+    var inboundMessage: SDLHoleInboundMessage {
+        switch self {
+        case .data(let data):
+            return .data(data)
+        case .register(let register):
+            return .control(.register(register))
+        case .registerAck(let registerAck):
+            return .control(.registerAck(registerAck))
+        case .stunProbeReply(let stunProbeReply):
+            return .control(.stunProbeReply(stunProbeReply))
+        case .stunReply(let stunReply):
+            return .control(.stunReply(stunReply))
+        }
+    }
+}
+
+extension SDLHoleMessage {
+    
+    static func decode(buffer: inout ByteBuffer) throws -> SDLHoleMessage? {
+        guard let type = buffer.readInteger(as: UInt8.self),
+              let packetType = SDLPacketType(rawValue: type) else {
+            return nil
+        }
+        
+        switch packetType {
+        case .data:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+                  let dataPacket = try? SDLData(serializedBytes: bytes) else {
+                return nil
+            }
+            return .data(dataPacket)
+        case .register:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+               let registerPacket = try? SDLRegister(serializedBytes: bytes) else {
+                return nil
+            }
+            return .register(registerPacket)
+        case .registerAck:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+               let registerAck = try? SDLRegisterAck(serializedBytes: bytes) else {
+                return nil
+            }
+            return .registerAck(registerAck)
+        case .stunProbeReply:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+               let stunProbeReply = try? SDLStunProbeReply(serializedBytes: bytes) else {
+                return nil
+            }
+            return .stunProbeReply(stunProbeReply)
+        case .stunReply:
+            guard let bytes = buffer.readBytes(length: buffer.readableBytes),
+               let stunReply = try? SDLStunReply(serializedBytes: bytes) else {
+                return nil
+            }
+            return .stunReply(stunReply)
+        default:
+            SDLLogger.log("[SDLUDPHole] decode miss type: \(type)", for: .debug)
+            
+            return nil
+        }
+    }
+    
+}

Tun/Punchnet/UDPHole/SDLUDPHole.swift

@@ -0,0 +1,184 @@
+//
+//  SDLanServer.swift
+//  Tun
+//
+//  Created by 安礼成 on 2024/1/31.
+//
+import Foundation
+import NIOCore
+import NIOPosix
+import SwiftProtobuf
+
+enum SDLUDPHoleError: Error {
+    case invalidLocalAddress
+    case closed
+    case errorCaught
+    case sendFaied(Error)
+}
+
+actor SDLUDPHole {
+    enum State {
+        case idle
+        case running
+        case stopped
+    }
+    
+    private var state: State = .idle
+    private let udpHoleHandler: SDLUDPHoleHandler
+    
+    init() throws {
+        self.udpHoleHandler = try SDLUDPHoleHandler()
+    }
+    
+    func start() async throws -> SocketAddress {
+        let localAddress = try self.udpHoleHandler.start()
+        self.state = .running
+        
+        return localAddress
+    }
+    
+    func messageStream() -> AsyncThrowingStream<(SocketAddress, SDLHoleMessage), Error> {
+        return self.udpHoleHandler.messageStream
+    }
+    
+    func send(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) {
+        guard self.state == .running else {
+            return
+        }
+        
+        self.udpHoleHandler.send(type: type, data: data, remoteAddress: remoteAddress)
+    }
+    
+    func stop() async {
+        guard self.state != .stopped else {
+            return
+        }
+        
+        self.state = .stopped
+        self.udpHoleHandler.stop()
+    }
+    
+    deinit {
+        SDLLogger.log("[SDLUDPHoleActor] deinit", for: .debug)
+    }
+}
+
+// 处理和sn-server服务器之间的通讯
+private final class SDLUDPHoleHandler: ChannelInboundHandler {
+    typealias InboundIn = AddressedEnvelope<ByteBuffer>
+    
+    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    private var channel: Channel?
+    
+    private let locker = NSLock()
+    
+    public let messageStream: AsyncThrowingStream<(SocketAddress, SDLHoleMessage), Error>
+    private let messageContinuation: AsyncThrowingStream<(SocketAddress, SDLHoleMessage), Error>.Continuation
+    private var isMessageContinuationFinished: Bool = false
+    
+    // 启动函数
+    init() throws {
+        let (stream, continuation) = AsyncThrowingStream.makeStream(of: (SocketAddress, SDLHoleMessage).self, bufferingPolicy: .bufferingNewest(2048))
+        self.messageStream = stream
+        self.messageContinuation = continuation
+    }
+    
+    func start() throws -> SocketAddress {
+        let bootstrap = DatagramBootstrap(group: group)
+            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+            .channelInitializer { channel in
+                channel.pipeline.addHandler(self)
+            }
+        
+        // 绑定到IPv4通配地址，只处理IPv4流量
+        let channel = try bootstrap.bind(host: "0.0.0.0", port: 0).wait()
+        guard let localAddress = channel.localAddress else {
+            throw SDLUDPHoleError.invalidLocalAddress
+        }
+        
+        self.channel = channel
+        
+        return localAddress
+    }
+    
+    // --MARK: ChannelInboundHandler delegate
+    
+    func channelRead(context: ChannelHandlerContext, data: NIOAny) {
+        let envelope = unwrapInboundIn(data)
+        var buffer = envelope.data
+        let remoteAddress = envelope.remoteAddress
+        
+        let bytesCount = buffer.readableBytes
+        SDLLogger.log("[SDLUDPHole] read data: \(bytesCount), from: \(remoteAddress.description)", for: .debug)
+
+        do {
+            if let message = try SDLHoleMessage.decode(buffer: &buffer) {
+                self.messageContinuation.yield((remoteAddress, message))
+            } else {
+                SDLLogger.log("[SDLUDPHole] decode message, get null", for: .debug)
+            }
+        } catch let err {
+            SDLLogger.log("[SDLUDPHole] decode message, get error: \(err)", for: .debug)
+        }
+    }
+    
+    func channelInactive(context: ChannelHandlerContext) {
+        self.finishMessageContinuationIfNeed(throwing: .closed)
+    }
+    
+    func errorCaught(context: ChannelHandlerContext, error: any Error) {
+        context.close(promise: nil)
+        self.finishMessageContinuationIfNeed(throwing: .errorCaught)
+    }
+    
+    // MARK: 处理写入逻辑
+    func send(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) {
+        guard let channel = self.channel else {
+            return
+        }
+        
+        var buffer = channel.allocator.buffer(capacity: data.count + 1)
+        buffer.writeBytes([type.rawValue])
+        buffer.writeBytes(data)
+        
+        let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: remoteAddress, data: buffer)
+        
+        let promise = channel.eventLoop.makePromise(of: Void.self)
+        channel.eventLoop.execute {
+            channel.writeAndFlush(envelope, promise: promise)
+        }
+        
+        promise.futureResult.whenFailure { [weak self] err in
+            self?.finishMessageContinuationIfNeed(throwing: .sendFaied(err))
+        }
+    }
+        
+    func stop() {
+        self.finishMessageContinuationIfNeed(throwing: nil)
+        let channel = self.channel
+        self.channel = nil
+        try? channel?.close().wait()
+        try? self.group.syncShutdownGracefully()
+        
+        SDLLogger.log("[SDLUDPHole] stopped", for: .debug)
+    }
+    
+    private func finishMessageContinuationIfNeed(throwing error: SDLUDPHoleError?) {
+        locker.lock()
+        defer {
+            locker.unlock()
+        }
+        
+        guard !self.isMessageContinuationFinished else {
+            return
+        }
+        
+        self.isMessageContinuationFinished = true
+        self.messageContinuation.finish(throwing: error)
+    }
+    
+    deinit {
+        SDLLogger.log("[SDLUDPHole] deinit", for: .debug)
+    }
+    
+}

Tun/Punchnet/UDPHole/SDLUDPHoleService.swift

@@ -0,0 +1,240 @@
+import Foundation
+import NIOCore
+
+enum SDLUDPHoleKind: Equatable {
+    case v4
+    case v6
+
+    func convertAddressType() -> Session.AddressType {
+        switch self {
+        case .v4:
+            return .v4
+        case .v6:
+            return .v6
+        }
+    }
+}
+
+actor SDLUDPHoleService {
+    enum Event {
+        case ready(SocketAddress)
+        case natType(SDLNATProberActor.NatType)
+        case packet(SocketAddress, SDLHoleMessage, source: SDLUDPHoleKind)
+        case closed(Error)
+    }
+
+    typealias EventHandler = @Sendable (Event) async -> Void
+
+    private let proberActor: SDLNATProberActor
+    private let onEvent: EventHandler
+
+    private var udpHole: SDLUDPHole?
+    private var udpHoleMonitorTask: Task<Void, Never>?
+    private var natProbeTask: Task<Void, Never>?
+    private var localAddress: SocketAddress?
+
+    private var udpHoleV6: SDLUDPHoleV6?
+    private var udpHoleV6MonitorTask: Task<Void, Never>?
+
+    init(proberActor: SDLNATProberActor, onEvent: @escaping EventHandler) {
+        self.proberActor = proberActor
+        self.onEvent = onEvent
+    }
+
+    func start(includeV6: Bool = false) {
+        self.startV4()
+        if includeV6 {
+            self.startV6()
+        }
+    }
+
+    func stop() async {
+        let udpHole = self.udpHole
+        self.udpHole = nil
+        self.localAddress = nil
+
+        let udpHoleMonitorTask = self.udpHoleMonitorTask
+        self.udpHoleMonitorTask = nil
+
+        let natProbeTask = self.natProbeTask
+        self.natProbeTask = nil
+
+        udpHoleMonitorTask?.cancel()
+        natProbeTask?.cancel()
+        await self.proberActor.cancelAll()
+        await udpHole?.stop()
+
+        if let natProbeTask {
+            await natProbeTask.value
+        }
+        if let udpHoleMonitorTask {
+            await udpHoleMonitorTask.value
+        }
+
+        let udpHoleV6 = self.udpHoleV6
+        self.udpHoleV6 = nil
+        let udpHoleV6MonitorTask = self.udpHoleV6MonitorTask
+        self.udpHoleV6MonitorTask = nil
+        udpHoleV6MonitorTask?.cancel()
+        udpHoleV6?.stop()
+        if let udpHoleV6MonitorTask {
+            await udpHoleV6MonitorTask.value
+        }
+    }
+
+    func send(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) async {
+        switch remoteAddress {
+        case .v4:
+            guard let udpHole else {
+                SDLLogger.log("[SDLUDPHoleService] udpHole is nil for remoteAddress: \(remoteAddress)", for: .debug)
+                return
+            }
+            await udpHole.send(type: type, data: data, remoteAddress: remoteAddress)
+        case .v6:
+            guard let udpHoleV6 else {
+                SDLLogger.log("[SDLUDPHoleService] udpHoleV6 is nil for remoteAddress: \(remoteAddress)", for: .debug)
+                return
+            }
+            udpHoleV6.send(type: type, data: data, remoteAddress: remoteAddress)
+        default:
+            SDLLogger.log("[SDLUDPHoleService] unsupported socket family: \(remoteAddress)", for: .debug)
+        }
+    }
+
+    private func startV4() {
+        guard self.udpHoleMonitorTask == nil else {
+            return
+        }
+
+        self.udpHoleMonitorTask = startMonitorTask(name: "udpHoleServiceV4Monitor") { [weak self] in
+            guard let self else {
+                throw CancellationError()
+            }
+            try await self.runV4()
+        }
+    }
+
+    private func runV4() async throws {
+        let udpHole = try SDLUDPHole()
+        let localAddress = try await udpHole.start()
+        self.udpHole = udpHole
+        self.localAddress = localAddress
+        SDLLogger.log("[SDLUDPHoleService] udpHole started, on address: \(localAddress)")
+
+        await self.onEvent(.ready(localAddress))
+        self.startNatProbe(using: udpHole)
+
+        defer {
+            if self.udpHole === udpHole {
+                self.udpHole = nil
+                self.localAddress = nil
+            }
+        }
+
+        do {
+            try await withTaskCancellationHandler {
+                for try await (remoteAddress, message) in await udpHole.messageStream() {
+                    try Task.checkCancellation()
+                    try await self.handleV4Message(remoteAddress: remoteAddress, message: message)
+                }
+            } onCancel: {
+                Task {
+                    await udpHole.stop()
+                }
+            }
+        } catch {
+            await udpHole.stop()
+            throw error
+        }
+    }
+
+    private func startNatProbe(using udpHole: SDLUDPHole) {
+        self.natProbeTask?.cancel()
+        let proberActor = self.proberActor
+        let onEvent = self.onEvent
+        self.natProbeTask = Task {
+            if Task.isCancelled {
+                return
+            }
+            let natType = await proberActor.probeNatType(using: udpHole)
+            if Task.isCancelled {
+                return
+            }
+            await onEvent(.natType(natType))
+        }
+    }
+
+    private func handleV4Message(remoteAddress: SocketAddress, message: SDLHoleMessage) async throws {
+        switch message.inboundMessage {
+        case .control(let control):
+            switch control {
+            case .stunProbeReply(let probeReply):
+                await self.proberActor.handleProbeReply(localAddress: self.localAddress, reply: probeReply)
+            default:
+                await self.onEvent(.packet(remoteAddress, message, source: .v4))
+            }
+        case .data:
+            await self.onEvent(.packet(remoteAddress, message, source: .v4))
+        }
+    }
+
+    private func startV6() {
+        guard self.udpHoleV6MonitorTask == nil else {
+            return
+        }
+
+        self.udpHoleV6MonitorTask = startMonitorTask(name: "udpHoleServiceV6Monitor") { [weak self] in
+            guard let self else {
+                throw CancellationError()
+            }
+            try await self.runV6()
+        }
+    }
+
+    private func runV6() async throws {
+        let udpHoleV6 = try SDLUDPHoleV6()
+        let localAddress = try udpHoleV6.start()
+        self.udpHoleV6 = udpHoleV6
+
+        if let localAddress {
+            SDLLogger.log("[SDLUDPHoleService] udpHoleV6 started, on address: \(localAddress)")
+        } else {
+            SDLLogger.log("[SDLUDPHoleService] udpHoleV6 started, no local address")
+        }
+
+        defer {
+            if self.udpHoleV6 === udpHoleV6 {
+                udpHoleV6.stop()
+                self.udpHoleV6 = nil
+            }
+        }
+
+        try await withThrowingTaskGroup(of: Void.self) { group in
+            defer {
+                group.cancelAll()
+            }
+
+            let onEvent = self.onEvent
+            group.addTask {
+                for await (remoteAddress, message) in udpHoleV6.messageStream {
+                    try Task.checkCancellation()
+                    await onEvent(.packet(remoteAddress, message, source: .v6))
+                }
+            }
+
+            group.addTask {
+                for await event in udpHoleV6.eventStream {
+                    try Task.checkCancellation()
+                    switch event {
+                    case .ready:
+                        SDLLogger.log("[SDLUDPHoleService] udpHoleV6 ready")
+                    case .closed, .errorCaught:
+                        throw SDLContextError.udpHoleClosed
+                    }
+                }
+            }
+
+            _ = try await group.next()
+        }
+    }
+}

Tun/Punchnet/UDPHole/SDLUDPHoleV6.swift

@@ -0,0 +1,133 @@
+//
+//  SDLUDPHoleV6.swift
+//  Tun
+//
+//  Created by 安礼成 on 2026/4/15.
+//
+
+import Foundation
+import NIOCore
+import NIOPosix
+import SwiftProtobuf
+
+// 处理和sn-server服务器之间的通讯
+final class SDLUDPHoleV6: ChannelInboundHandler {
+    typealias InboundIn = AddressedEnvelope<ByteBuffer>
+    
+    // 事件
+    enum HoleEvent {
+        case ready
+        case closed
+        case errorCaught
+    }
+    
+    private var isStopped: Bool = false
+    
+    private let group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
+    private var channel: Channel?
+    
+    public let messageStream: AsyncStream<(SocketAddress, SDLHoleMessage)>
+    private let messageContinuation: AsyncStream<(SocketAddress, SDLHoleMessage)>.Continuation
+    
+    // 事件相关逻辑
+    public let eventStream: AsyncStream<HoleEvent>
+    private let eventContinuation: AsyncStream<HoleEvent>.Continuation
+    
+    // 启动函数
+    init() throws {
+        let (stream, continuation) = AsyncStream.makeStream(of: (SocketAddress, SDLHoleMessage).self, bufferingPolicy: .bufferingNewest(2048))
+        self.messageStream = stream
+        self.messageContinuation = continuation
+        
+        let eventPair = AsyncStream.makeStream(of: HoleEvent.self)
+        self.eventStream = eventPair.stream
+        self.eventContinuation = eventPair.continuation
+    }
+    
+    func start() throws -> SocketAddress? {
+        let bootstrap = DatagramBootstrap(group: group)
+            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+            .channelInitializer { channel in
+                channel.pipeline.addHandler(self)
+            }
+        
+        // 绑定到IPv6通配地址，只处理IPv6流量
+        let channel = try bootstrap.bind(host: "::", port: 0).wait()
+        self.channel = channel
+        
+        return channel.localAddress
+    }
+    
+    // --MARK: ChannelInboundHandler delegate
+
+    func channelRead(context: ChannelHandlerContext, data: NIOAny) {
+        let envelope = unwrapInboundIn(data)
+        
+        var buffer = envelope.data
+        let remoteAddress = envelope.remoteAddress
+        
+        if let rawBytes = buffer.getBytes(at: buffer.readerIndex, length: buffer.readableBytes) {
+            SDLLogger.log("[SDLUDPHoleV6] get raw bytes: \(rawBytes.count), from: \(remoteAddress)", for: .debug)
+        }
+        
+        do {
+            if let message = try SDLHoleMessage.decode(buffer: &buffer) {
+                self.messageContinuation.yield((remoteAddress, message))
+            } else {
+                SDLLogger.log("[SDLUDPHoleV6] decode message, get null", for: .debug)
+            }
+        } catch let err {
+            SDLLogger.log("[SDLUDPHoleV6] decode message, get error: \(err)", for: .debug)
+        }
+    }
+    
+    func channelInactive(context: ChannelHandlerContext) {
+        SDLLogger.log("[SDLUDPHoleV6] channelInactive", for: .debug)
+        self.eventContinuation.yield(.closed)
+    }
+    
+    func errorCaught(context: ChannelHandlerContext, error: any Error) {
+        SDLLogger.log("[SDLUDPHoleV6] channel error: \(error)", for: .debug)
+        context.close(promise: nil)
+        self.eventContinuation.yield(.errorCaught)
+    }
+    
+    // MARK: 处理写入逻辑
+    func send(type: SDLPacketType, data: Data, remoteAddress: SocketAddress) {
+        guard let channel = self.channel else {
+            return
+        }
+        
+        var buffer = channel.allocator.buffer(capacity: data.count + 1)
+        buffer.writeBytes([type.rawValue])
+        buffer.writeBytes(data)
+        
+        let envelope = AddressedEnvelope<ByteBuffer>(remoteAddress: remoteAddress, data: buffer)
+        _ = channel.eventLoop.submit {
+            channel.writeAndFlush(envelope, promise: nil)
+        }
+    }
+    
+    func stop() {
+        guard !self.isStopped else {
+            return
+        }
+        
+        self.isStopped = true
+        SDLLogger.log("[SDLUDPHoleV6] stop", for: .debug)
+        
+        self.messageContinuation.finish()
+        self.eventContinuation.finish()
+
+        let channel = self.channel
+        self.channel = nil
+        try? channel?.close().wait()
+        
+        try? self.group.syncShutdownGracefully()
+    }
+
+    deinit {
+        SDLLogger.log("[SDLUDPHoleV6] deinit", for: .debug)
+    }
+    
+}

Tun/Punchnet/UDPPacket.swift

@@ -1,38 +0,0 @@
-//
-//  UDPPacket.swift
-//  Tun
-//
-//  Created by 安礼成 on 2025/12/13.
-//
-
-import Foundation
-
-struct UDPHeader {
-    let sourcePort: UInt16
-    let destinationPort: UInt16
-    let length: UInt16
-    let checksum: UInt16
-}
-
-struct UDPPacket {
-    let header: UDPHeader
-    let payload: Data
-    
-    init?(_ data: Data) {
-        // UDP header 至少 8 字节
-        guard data.count >= 8 else {
-            return nil
-        }
-        
-        let header = UDPHeader(sourcePort: UInt16(bytes: (data[0], data[1])),
-                               destinationPort: UInt16(bytes: (data[2], data[3])),
-                               length: UInt16(bytes: (data[4], data[5])),
-                               checksum: UInt16(bytes: (data[6], data[7]))
-        )
-        // UDP payload = length - 8
-        let payloadLength = Int(header.length) - 8
-        
-        self.header = header
-        self.payload = data.subdata(in: 8..<(8 + payloadLength))
-    }
-}

Tun/SDLRuntimeEnvironment.swift

@@ -0,0 +1,112 @@
+import Foundation
+
+enum SDLRuntimeEnvironmentCommand {
+    case start(completion: @Sendable (Error?) -> Void)
+    case stop(completion: @Sendable () -> Void)
+}
+
+final class SDLRuntimeEnvironment {
+    private enum State {
+        case idle
+        case running
+    }
+    
+    private var state: State = .idle
+    private var contextActor: SDLContextActor?
+
+    private var config: SDLConfiguration
+    private let rsaCipher: CCRSACipher
+    private let provider: PacketTunnelProvider
+
+    private let commandStream: AsyncStream<SDLRuntimeEnvironmentCommand>
+    private let commandCont: AsyncStream<SDLRuntimeEnvironmentCommand>.Continuation
+
+    private var commandTask: Task<Void, Never>?
+
+    init(config: SDLConfiguration, rsaCipher: CCRSACipher, provider: PacketTunnelProvider) {
+        self.config = config
+        self.rsaCipher = rsaCipher
+        self.provider = provider
+
+        let pair = AsyncStream.makeStream(of: SDLRuntimeEnvironmentCommand.self)
+        self.commandStream = pair.stream
+        self.commandCont = pair.continuation
+    }
+
+    func submitCommand(command: SDLRuntimeEnvironmentCommand) {
+        self.commandCont.yield(command)
+    }
+
+    func getContextActor() -> SDLContextActor? {
+        self.contextActor
+    }
+
+    func run() {
+        let stream = self.commandStream
+
+        self.commandTask = Task { [weak self] in
+            for await command in stream {
+                guard let self else {
+                    break
+                }
+
+                await self.handle(command)
+            }
+        }
+    }
+
+    private func handle(_ command: SDLRuntimeEnvironmentCommand) async {
+        switch command {
+        case .start(let handler):
+            do {
+                try await self.startCommand()
+                handler(nil)
+            } catch {
+                handler(error)
+            }
+
+        case .stop(let handler):
+            await self.stopCommand()
+            handler()
+        }
+    }
+
+    private func startCommand() async throws {
+        switch self.state {
+        case .idle:
+            SDLTunnelAppNotifier.shared.clear()
+
+            let contextActor = SDLContextActor(
+                provider: provider,
+                config: config,
+                rsaCipher: self.rsaCipher
+            )
+
+            self.contextActor = contextActor
+            await contextActor.start()
+            self.state = .running
+        case .running:
+            SDLLogger.log("[SDLRuntimeEnvironment] is running, ignore start command")
+        }
+    }
+
+    private func stopCommand() async {
+        switch self.state {
+        case .idle:
+            SDLLogger.log("[SDLRuntimeEnvironment] is idle, ignore stop command")
+
+        case .running:
+            let contextActor = self.contextActor
+            self.contextActor = nil
+            self.state = .idle
+
+            await contextActor?.stop()
+        }
+    }
+
+    deinit {
+        self.commandCont.finish()
+        self.commandTask?.cancel()
+        self.commandTask = nil
+    }
+}

Tun/Tun.entitlements

@@ -10,7 +10,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>$(TeamIdentifierPrefix)</string>
+		<string>group.com.jihe.punchnetmac</string>
 	</array>
 	<key>com.apple.security.network.client</key>
 	<true/>

dmg.sh

@@ -1,3 +1,3 @@
 #! /bin/sh
 
-create-dmg --volname "punchnet" --window-pos 200 120 --window-size 800 400 --icon "punchnet.app" 200 190 --hide-extension "punchnet.app" --app-drop-link 600 185 ~/Desktop/punchnet.dmg  /Users/anlicheng/Desktop/punchnet_macos_v1
+create-dmg --volname "punchnet" --window-pos 200 120 --window-size 800 400 --icon "punchnet.app" 200 190 --hide-extension "punchnet.app" --app-drop-link 600 185 ~/Desktop/punchnet.dmg  /Users/anlicheng/Desktop/punchnetv10

punchnet.xcodeproj/project.pbxproj

@@ -0,0 +1,914 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 77;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		C89D410D2F874CC5001A17CF /* SwiftProtobuf in Frameworks */ = {isa = PBXBuildFile; productRef = C89D410C2F874CC5001A17CF /* SwiftProtobuf */; };
+		C8A77F2A2DD1E77B00195617 /* NetworkExtension.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C8A77F292DD1E77B00195617 /* NetworkExtension.framework */; };
+		C8A77F322DD1E77B00195617 /* Tun.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C8A77F272DD1E77B00195617 /* Tun.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		C8A77F792DD1E93900195617 /* NIO in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F782DD1E93900195617 /* NIO */; };
+		C8A77F7B2DD1E93900195617 /* NIOConcurrencyHelpers in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F7A2DD1E93900195617 /* NIOConcurrencyHelpers */; };
+		C8A77F7D2DD1E93900195617 /* NIOCore in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F7C2DD1E93900195617 /* NIOCore */; };
+		C8A77F7F2DD1E93900195617 /* NIOEmbedded in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F7E2DD1E93900195617 /* NIOEmbedded */; };
+		C8A77F812DD1E93900195617 /* NIOFoundationCompat in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F802DD1E93900195617 /* NIOFoundationCompat */; };
+		C8A77F882DD1EA0200195617 /* SwiftProtobuf in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F872DD1EA0200195617 /* SwiftProtobuf */; };
+		C8A77F8A2DD1EA0200195617 /* SwiftProtobufPluginLibrary in Frameworks */ = {isa = PBXBuildFile; productRef = C8A77F892DD1EA0200195617 /* SwiftProtobufPluginLibrary */; };
+		C8AA72BB2E5C49E000E4C4E9 /* SwiftProtobuf in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72BA2E5C49E000E4C4E9 /* SwiftProtobuf */; };
+		C8AA72BD2E5C49E000E4C4E9 /* SwiftProtobufPluginLibrary in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72BC2E5C49E000E4C4E9 /* SwiftProtobufPluginLibrary */; };
+		C8AA72C02E5C4A3100E4C4E9 /* NIO in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72BF2E5C4A3100E4C4E9 /* NIO */; };
+		C8AA72C22E5C4A3100E4C4E9 /* NIOConcurrencyHelpers in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72C12E5C4A3100E4C4E9 /* NIOConcurrencyHelpers */; };
+		C8AA72C42E5C4A3100E4C4E9 /* NIOCore in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72C32E5C4A3100E4C4E9 /* NIOCore */; };
+		C8AA72C62E5C4A3100E4C4E9 /* NIOEmbedded in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72C52E5C4A3100E4C4E9 /* NIOEmbedded */; };
+		C8AA72C82E5C4A3100E4C4E9 /* NIOFoundationCompat in Frameworks */ = {isa = PBXBuildFile; productRef = C8AA72C72E5C4A3100E4C4E9 /* NIOFoundationCompat */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		C8A77F072DD1E6D100195617 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = C8A77EEB2DD1E6D000195617 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = C8A77EF22DD1E6D000195617;
+			remoteInfo = punchnet;
+		};
+		C8A77F112DD1E6D100195617 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = C8A77EEB2DD1E6D000195617 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = C8A77EF22DD1E6D000195617;
+			remoteInfo = punchnet;
+		};
+		C8A77F302DD1E77B00195617 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = C8A77EEB2DD1E6D000195617 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = C8A77F262DD1E77B00195617;
+			remoteInfo = Tun;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXCopyFilesBuildPhase section */
+		C8A77F372DD1E77B00195617 /* Embed Foundation Extensions */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 13;
+			files = (
+				C8A77F322DD1E77B00195617 /* Tun.appex in Embed Foundation Extensions */,
+			);
+			name = "Embed Foundation Extensions";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXCopyFilesBuildPhase section */
+
+/* Begin PBXFileReference section */
+		C8A77EF32DD1E6D000195617 /* punchnet.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = punchnet.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		C8A77F062DD1E6D100195617 /* punchnetTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = punchnetTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		C8A77F102DD1E6D100195617 /* punchnetUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = punchnetUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		C8A77F272DD1E77B00195617 /* Tun.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = Tun.appex; sourceTree = BUILT_PRODUCTS_DIR; };
+		C8A77F292DD1E77B00195617 /* NetworkExtension.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = NetworkExtension.framework; path = System/Library/Frameworks/NetworkExtension.framework; sourceTree = SDKROOT; };
+/* End PBXFileReference section */
+
+/* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
+		C89D42E62F8F39B7001A17CF /* Exceptions for "Tun" folder in "punchnet" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Punchnet/Protobuf/TunMessage.pb.swift,
+			);
+			target = C8A77EF22DD1E6D000195617 /* punchnet */;
+		};
+		C8A77F332DD1E77B00195617 /* Exceptions for "Tun" folder in "Tun" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+			);
+			target = C8A77F262DD1E77B00195617 /* Tun */;
+		};
+		C8A77F8C2DD1EA7900195617 /* Exceptions for "punchnet" folder in "Tun" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				AppEventCenter/SDLNotificationCenter.swift,
+			);
+			target = C8A77F262DD1E77B00195617 /* Tun */;
+		};
+/* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
+
+/* Begin PBXFileSystemSynchronizedRootGroup section */
+		C8A77EF52DD1E6D000195617 /* punchnet */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				C8A77F8C2DD1EA7900195617 /* Exceptions for "punchnet" folder in "Tun" target */,
+			);
+			path = punchnet;
+			sourceTree = "<group>";
+		};
+		C8A77F092DD1E6D100195617 /* punchnetTests */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			path = punchnetTests;
+			sourceTree = "<group>";
+		};
+		C8A77F132DD1E6D100195617 /* punchnetUITests */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			path = punchnetUITests;
+			sourceTree = "<group>";
+		};
+		C8A77F2B2DD1E77B00195617 /* Tun */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				C89D42E62F8F39B7001A17CF /* Exceptions for "Tun" folder in "punchnet" target */,
+				C8A77F332DD1E77B00195617 /* Exceptions for "Tun" folder in "Tun" target */,
+			);
+			path = Tun;
+			sourceTree = "<group>";
+		};
+/* End PBXFileSystemSynchronizedRootGroup section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		C8A77EF02DD1E6D000195617 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				C8A77F7D2DD1E93900195617 /* NIOCore in Frameworks */,
+				C8A77F812DD1E93900195617 /* NIOFoundationCompat in Frameworks */,
+				C8A77F792DD1E93900195617 /* NIO in Frameworks */,
+				C8A77F7B2DD1E93900195617 /* NIOConcurrencyHelpers in Frameworks */,
+				C8A77F7F2DD1E93900195617 /* NIOEmbedded in Frameworks */,
+				C89D410D2F874CC5001A17CF /* SwiftProtobuf in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F032DD1E6D100195617 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F0D2DD1E6D100195617 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F242DD1E77B00195617 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				C8A77F2A2DD1E77B00195617 /* NetworkExtension.framework in Frameworks */,
+				C8A77F8A2DD1EA0200195617 /* SwiftProtobufPluginLibrary in Frameworks */,
+				C8AA72BD2E5C49E000E4C4E9 /* SwiftProtobufPluginLibrary in Frameworks */,
+				C8AA72C62E5C4A3100E4C4E9 /* NIOEmbedded in Frameworks */,
+				C8AA72C02E5C4A3100E4C4E9 /* NIO in Frameworks */,
+				C8AA72C22E5C4A3100E4C4E9 /* NIOConcurrencyHelpers in Frameworks */,
+				C8AA72C82E5C4A3100E4C4E9 /* NIOFoundationCompat in Frameworks */,
+				C8A77F882DD1EA0200195617 /* SwiftProtobuf in Frameworks */,
+				C8AA72C42E5C4A3100E4C4E9 /* NIOCore in Frameworks */,
+				C8AA72BB2E5C49E000E4C4E9 /* SwiftProtobuf in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		C8A77EEA2DD1E6D000195617 = {
+			isa = PBXGroup;
+			children = (
+				C8A77EF52DD1E6D000195617 /* punchnet */,
+				C8A77F092DD1E6D100195617 /* punchnetTests */,
+				C8A77F132DD1E6D100195617 /* punchnetUITests */,
+				C8A77F2B2DD1E77B00195617 /* Tun */,
+				C8A77F282DD1E77B00195617 /* Frameworks */,
+				C8A77EF42DD1E6D000195617 /* Products */,
+			);
+			sourceTree = "<group>";
+		};
+		C8A77EF42DD1E6D000195617 /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				C8A77EF32DD1E6D000195617 /* punchnet.app */,
+				C8A77F062DD1E6D100195617 /* punchnetTests.xctest */,
+				C8A77F102DD1E6D100195617 /* punchnetUITests.xctest */,
+				C8A77F272DD1E77B00195617 /* Tun.appex */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+		C8A77F282DD1E77B00195617 /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+				C8A77F292DD1E77B00195617 /* NetworkExtension.framework */,
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+		C8A77EF22DD1E6D000195617 /* punchnet */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C8A77F1A2DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnet" */;
+			buildPhases = (
+				C8A77EEF2DD1E6D000195617 /* Sources */,
+				C8A77EF02DD1E6D000195617 /* Frameworks */,
+				C8A77EF12DD1E6D000195617 /* Resources */,
+				C8A77F372DD1E77B00195617 /* Embed Foundation Extensions */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				C8A77F312DD1E77B00195617 /* PBXTargetDependency */,
+			);
+			fileSystemSynchronizedGroups = (
+				C8A77EF52DD1E6D000195617 /* punchnet */,
+			);
+			name = punchnet;
+			packageProductDependencies = (
+				C8A77F782DD1E93900195617 /* NIO */,
+				C8A77F7A2DD1E93900195617 /* NIOConcurrencyHelpers */,
+				C8A77F7C2DD1E93900195617 /* NIOCore */,
+				C8A77F7E2DD1E93900195617 /* NIOEmbedded */,
+				C8A77F802DD1E93900195617 /* NIOFoundationCompat */,
+				C89D410C2F874CC5001A17CF /* SwiftProtobuf */,
+			);
+			productName = punchnet;
+			productReference = C8A77EF32DD1E6D000195617 /* punchnet.app */;
+			productType = "com.apple.product-type.application";
+		};
+		C8A77F052DD1E6D100195617 /* punchnetTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C8A77F1D2DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnetTests" */;
+			buildPhases = (
+				C8A77F022DD1E6D100195617 /* Sources */,
+				C8A77F032DD1E6D100195617 /* Frameworks */,
+				C8A77F042DD1E6D100195617 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				C8A77F082DD1E6D100195617 /* PBXTargetDependency */,
+			);
+			fileSystemSynchronizedGroups = (
+				C8A77F092DD1E6D100195617 /* punchnetTests */,
+			);
+			name = punchnetTests;
+			packageProductDependencies = (
+			);
+			productName = punchnetTests;
+			productReference = C8A77F062DD1E6D100195617 /* punchnetTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
+		C8A77F0F2DD1E6D100195617 /* punchnetUITests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C8A77F202DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnetUITests" */;
+			buildPhases = (
+				C8A77F0C2DD1E6D100195617 /* Sources */,
+				C8A77F0D2DD1E6D100195617 /* Frameworks */,
+				C8A77F0E2DD1E6D100195617 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				C8A77F122DD1E6D100195617 /* PBXTargetDependency */,
+			);
+			fileSystemSynchronizedGroups = (
+				C8A77F132DD1E6D100195617 /* punchnetUITests */,
+			);
+			name = punchnetUITests;
+			packageProductDependencies = (
+			);
+			productName = punchnetUITests;
+			productReference = C8A77F102DD1E6D100195617 /* punchnetUITests.xctest */;
+			productType = "com.apple.product-type.bundle.ui-testing";
+		};
+		C8A77F262DD1E77B00195617 /* Tun */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C8A77F342DD1E77B00195617 /* Build configuration list for PBXNativeTarget "Tun" */;
+			buildPhases = (
+				C8A77F232DD1E77B00195617 /* Sources */,
+				C8A77F242DD1E77B00195617 /* Frameworks */,
+				C8A77F252DD1E77B00195617 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			fileSystemSynchronizedGroups = (
+				C8A77F2B2DD1E77B00195617 /* Tun */,
+			);
+			name = Tun;
+			packageProductDependencies = (
+				C8A77F872DD1EA0200195617 /* SwiftProtobuf */,
+				C8A77F892DD1EA0200195617 /* SwiftProtobufPluginLibrary */,
+				C8AA72BA2E5C49E000E4C4E9 /* SwiftProtobuf */,
+				C8AA72BC2E5C49E000E4C4E9 /* SwiftProtobufPluginLibrary */,
+				C8AA72BF2E5C4A3100E4C4E9 /* NIO */,
+				C8AA72C12E5C4A3100E4C4E9 /* NIOConcurrencyHelpers */,
+				C8AA72C32E5C4A3100E4C4E9 /* NIOCore */,
+				C8AA72C52E5C4A3100E4C4E9 /* NIOEmbedded */,
+				C8AA72C72E5C4A3100E4C4E9 /* NIOFoundationCompat */,
+			);
+			productName = Tun;
+			productReference = C8A77F272DD1E77B00195617 /* Tun.appex */;
+			productType = "com.apple.product-type.app-extension";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		C8A77EEB2DD1E6D000195617 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = 1;
+				LastSwiftUpdateCheck = 1620;
+				LastUpgradeCheck = 1620;
+				TargetAttributes = {
+					C8A77EF22DD1E6D000195617 = {
+						CreatedOnToolsVersion = 16.2;
+					};
+					C8A77F052DD1E6D100195617 = {
+						CreatedOnToolsVersion = 16.2;
+						TestTargetID = C8A77EF22DD1E6D000195617;
+					};
+					C8A77F0F2DD1E6D100195617 = {
+						CreatedOnToolsVersion = 16.2;
+						TestTargetID = C8A77EF22DD1E6D000195617;
+					};
+					C8A77F262DD1E77B00195617 = {
+						CreatedOnToolsVersion = 16.2;
+					};
+				};
+			};
+			buildConfigurationList = C8A77EEE2DD1E6D000195617 /* Build configuration list for PBXProject "punchnet" */;
+			developmentRegion = en;
+			hasScannedForEncodings = 0;
+			knownRegions = (
+				en,
+				Base,
+			);
+			mainGroup = C8A77EEA2DD1E6D000195617;
+			minimizedProjectReferenceProxies = 1;
+			packageReferences = (
+				C8AA72B92E5C49E000E4C4E9 /* XCRemoteSwiftPackageReference "swift-protobuf" */,
+				C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */,
+			);
+			preferredProjectObjectVersion = 77;
+			productRefGroup = C8A77EF42DD1E6D000195617 /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				C8A77EF22DD1E6D000195617 /* punchnet */,
+				C8A77F052DD1E6D100195617 /* punchnetTests */,
+				C8A77F0F2DD1E6D100195617 /* punchnetUITests */,
+				C8A77F262DD1E77B00195617 /* Tun */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		C8A77EF12DD1E6D000195617 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F042DD1E6D100195617 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F0E2DD1E6D100195617 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F252DD1E77B00195617 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		C8A77EEF2DD1E6D000195617 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F022DD1E6D100195617 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F0C2DD1E6D100195617 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C8A77F232DD1E77B00195617 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		C8A77F082DD1E6D100195617 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = C8A77EF22DD1E6D000195617 /* punchnet */;
+			targetProxy = C8A77F072DD1E6D100195617 /* PBXContainerItemProxy */;
+		};
+		C8A77F122DD1E6D100195617 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = C8A77EF22DD1E6D000195617 /* punchnet */;
+			targetProxy = C8A77F112DD1E6D100195617 /* PBXContainerItemProxy */;
+		};
+		C8A77F312DD1E77B00195617 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = C8A77F262DD1E77B00195617 /* Tun */;
+			targetProxy = C8A77F302DD1E77B00195617 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		C8A77F182DD1E6D100195617 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_TESTABILITY = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_OPTIMIZATION_LEVEL = 0;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
+				MTL_FAST_MATH = YES;
+				ONLY_ACTIVE_ARCH = YES;
+				SDKROOT = macosx;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+			};
+			name = Debug;
+		};
+		C8A77F192DD1E6D100195617 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MTL_ENABLE_DEBUG_INFO = NO;
+				MTL_FAST_MATH = YES;
+				SDKROOT = macosx;
+				SWIFT_COMPILATION_MODE = wholemodule;
+			};
+			name = Release;
+		};
+		C8A77F1B2DD1E6D100195617 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_ENTITLEMENTS = punchnet/punchnet.entitlements;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_ASSET_PATHS = "\"punchnet/Preview Content\"";
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = PF3QG837XS;
+				ENABLE_HARDENED_RUNTIME = YES;
+				ENABLE_PREVIEWS = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_KEY_LSUIElement = YES;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetmac;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				"PROVISIONING_PROFILE_SPECIFIER[sdk=macosx*]" = MacPunchnetTest;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		C8A77F1C2DD1E6D100195617 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_ENTITLEMENTS = punchnet/punchnet.entitlements;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_ASSET_PATHS = "\"punchnet/Preview Content\"";
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = PF3QG837XS;
+				ENABLE_HARDENED_RUNTIME = YES;
+				ENABLE_PREVIEWS = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_KEY_LSUIElement = YES;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetmac;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				"PROVISIONING_PROFILE_SPECIFIER[sdk=macosx*]" = MacPunchnetTest;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		C8A77F1E2DD1E6D100195617 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = 4CAML48Y7B;
+				GENERATE_INFOPLIST_FILE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/punchnet.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/punchnet";
+			};
+			name = Debug;
+		};
+		C8A77F1F2DD1E6D100195617 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = 4CAML48Y7B;
+				GENERATE_INFOPLIST_FILE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/punchnet.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/punchnet";
+			};
+			name = Release;
+		};
+		C8A77F212DD1E6D100195617 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = 4CAML48Y7B;
+				GENERATE_INFOPLIST_FILE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetUITests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_VERSION = 5.0;
+				TEST_TARGET_NAME = punchnet;
+			};
+			name = Debug;
+		};
+		C8A77F222DD1E6D100195617 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = 4CAML48Y7B;
+				GENERATE_INFOPLIST_FILE = YES;
+				MACOSX_DEPLOYMENT_TARGET = 14.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetUITests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_VERSION = 5.0;
+				TEST_TARGET_NAME = punchnet;
+			};
+			name = Release;
+		};
+		C8A77F352DD1E77B00195617 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = Tun/Tun.entitlements;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_STYLE = Manual;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = PF3QG837XS;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = Tun/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = Tun;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@executable_path/../../../../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetmac.tun;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				"PROVISIONING_PROFILE_SPECIFIER[sdk=macosx*]" = MacPunchnetTunTest;
+				SKIP_INSTALL = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		C8A77F362DD1E77B00195617 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_ENTITLEMENTS = Tun/Tun.entitlements;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Mac Developer";
+				CODE_SIGN_STYLE = Manual;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = "";
+				"DEVELOPMENT_TEAM[sdk=macosx*]" = PF3QG837XS;
+				ENABLE_HARDENED_RUNTIME = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = Tun/Info.plist;
+				INFOPLIST_KEY_CFBundleDisplayName = Tun;
+				INFOPLIST_KEY_NSHumanReadableCopyright = "";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@executable_path/../../../../Frameworks",
+				);
+				MACOSX_DEPLOYMENT_TARGET = 15.6;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = com.jihe.punchnetmac.tun;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				"PROVISIONING_PROFILE_SPECIFIER[sdk=macosx*]" = MacPunchnetTunTest;
+				SKIP_INSTALL = YES;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		C8A77EEE2DD1E6D000195617 /* Build configuration list for PBXProject "punchnet" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C8A77F182DD1E6D100195617 /* Debug */,
+				C8A77F192DD1E6D100195617 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		C8A77F1A2DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnet" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C8A77F1B2DD1E6D100195617 /* Debug */,
+				C8A77F1C2DD1E6D100195617 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		C8A77F1D2DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnetTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C8A77F1E2DD1E6D100195617 /* Debug */,
+				C8A77F1F2DD1E6D100195617 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		C8A77F202DD1E6D100195617 /* Build configuration list for PBXNativeTarget "punchnetUITests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C8A77F212DD1E6D100195617 /* Debug */,
+				C8A77F222DD1E6D100195617 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		C8A77F342DD1E77B00195617 /* Build configuration list for PBXNativeTarget "Tun" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C8A77F352DD1E77B00195617 /* Debug */,
+				C8A77F362DD1E77B00195617 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+/* End XCConfigurationList section */
+
+/* Begin XCRemoteSwiftPackageReference section */
+		C8AA72B92E5C49E000E4C4E9 /* XCRemoteSwiftPackageReference "swift-protobuf" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/apple/swift-protobuf.git";
+			requirement = {
+				kind = exactVersion;
+				version = 1.30.0;
+			};
+		};
+		C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/apple/swift-nio.git";
+			requirement = {
+				kind = exactVersion;
+				version = 2.85.0;
+			};
+		};
+/* End XCRemoteSwiftPackageReference section */
+
+/* Begin XCSwiftPackageProductDependency section */
+		C89D410C2F874CC5001A17CF /* SwiftProtobuf */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72B92E5C49E000E4C4E9 /* XCRemoteSwiftPackageReference "swift-protobuf" */;
+			productName = SwiftProtobuf;
+		};
+		C8A77F782DD1E93900195617 /* NIO */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = NIO;
+		};
+		C8A77F7A2DD1E93900195617 /* NIOConcurrencyHelpers */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = NIOConcurrencyHelpers;
+		};
+		C8A77F7C2DD1E93900195617 /* NIOCore */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = NIOCore;
+		};
+		C8A77F7E2DD1E93900195617 /* NIOEmbedded */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = NIOEmbedded;
+		};
+		C8A77F802DD1E93900195617 /* NIOFoundationCompat */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = NIOFoundationCompat;
+		};
+		C8A77F872DD1EA0200195617 /* SwiftProtobuf */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = SwiftProtobuf;
+		};
+		C8A77F892DD1EA0200195617 /* SwiftProtobufPluginLibrary */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = SwiftProtobufPluginLibrary;
+		};
+		C8AA72BA2E5C49E000E4C4E9 /* SwiftProtobuf */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72B92E5C49E000E4C4E9 /* XCRemoteSwiftPackageReference "swift-protobuf" */;
+			productName = SwiftProtobuf;
+		};
+		C8AA72BC2E5C49E000E4C4E9 /* SwiftProtobufPluginLibrary */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72B92E5C49E000E4C4E9 /* XCRemoteSwiftPackageReference "swift-protobuf" */;
+			productName = SwiftProtobufPluginLibrary;
+		};
+		C8AA72BF2E5C4A3100E4C4E9 /* NIO */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */;
+			productName = NIO;
+		};
+		C8AA72C12E5C4A3100E4C4E9 /* NIOConcurrencyHelpers */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */;
+			productName = NIOConcurrencyHelpers;
+		};
+		C8AA72C32E5C4A3100E4C4E9 /* NIOCore */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */;
+			productName = NIOCore;
+		};
+		C8AA72C52E5C4A3100E4C4E9 /* NIOEmbedded */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */;
+			productName = NIOEmbedded;
+		};
+		C8AA72C72E5C4A3100E4C4E9 /* NIOFoundationCompat */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = C8AA72BE2E5C4A3100E4C4E9 /* XCRemoteSwiftPackageReference "swift-nio" */;
+			productName = NIOFoundationCompat;
+		};
+/* End XCSwiftPackageProductDependency section */
+	};
+	rootObject = C8A77EEB2DD1E6D000195617 /* Project object */;
+}

punchnet.xcodeproj/project.xcworkspace/contents.xcworkspacedata

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "self:">
+   </FileRef>
+</Workspace>

punchnet.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -0,0 +1,51 @@
+{
+  "originHash" : "03bf3695750ad5eb9d4372b7d6478fa6d8494d0400ef6f58755e25a26a9f4d8d",
+  "pins" : [
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7",
+        "version" : "1.3.0"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "8c0c0a8b49e080e54e5e328cc552821ff07cd341",
+        "version" : "1.2.1"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "a5fea865badcb1c993c85b0f0e8d05a4bd2270fb",
+        "version" : "2.85.0"
+      }
+    },
+    {
+      "identity" : "swift-protobuf",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-protobuf.git",
+      "state" : {
+        "revision" : "102a647b573f60f73afdce5613a51d71349fe507",
+        "version" : "1.30.0"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "b63d24d465e237966c3f59f47dcac6c70fb0bca3",
+        "version" : "1.6.1"
+      }
+    }
+  ],
+  "version" : 3
+}

punchnet.xcodeproj/xcshareddata/xcschemes/Tun.xcscheme

@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "2600"
+   wasCreatedForAppExtension = "YES"
+   version = "2.0">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C8A77F262DD1E77B00195617"
+               BuildableName = "Tun.appex"
+               BlueprintName = "Tun"
+               ReferencedContainer = "container:punchnet.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+               BuildableName = "punchnet.app"
+               BlueprintName = "punchnet"
+               ReferencedContainer = "container:punchnet.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = ""
+      selectedLauncherIdentifier = "Xcode.IDEFoundation.Launcher.PosixSpawn"
+      launchStyle = "0"
+      askForAppToLaunch = "Yes"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+            BuildableName = "punchnet.app"
+            BlueprintName = "punchnet"
+            ReferencedContainer = "container:punchnet.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES"
+      askForAppToLaunch = "Yes"
+      launchAutomaticallySubstyle = "2">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+            BuildableName = "punchnet.app"
+            BlueprintName = "punchnet"
+            ReferencedContainer = "container:punchnet.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

punchnet.xcodeproj/xcshareddata/xcschemes/punchnet.xcscheme

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1620"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+               BuildableName = "punchnet.app"
+               BlueprintName = "punchnet"
+               ReferencedContainer = "container:punchnet.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+            BuildableName = "punchnet.app"
+            BlueprintName = "punchnet"
+            ReferencedContainer = "container:punchnet.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "C8A77EF22DD1E6D000195617"
+            BuildableName = "punchnet.app"
+            BlueprintName = "punchnet"
+            ReferencedContainer = "container:punchnet.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

punchnet.xcodeproj/xcshareddata/xcschemes/punchnetTests.xcscheme

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1620"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      buildArchitectures = "Automatic">
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      shouldAutocreateTestPlan = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO"
+            parallelizable = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "C8A77F052DD1E6D100195617"
+               BuildableName = "punchnetTests.xctest"
+               BlueprintName = "punchnetTests"
+               ReferencedContainer = "container:punchnet.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

punchnet.xcodeproj/xcuserdata/anlicheng.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Bucket
+   uuid = "0C80D254-5F0A-4902-B8F2-4CE5F0514250"
+   type = "1"
+   version = "2.0">
+</Bucket>

punchnet.xcodeproj/xcuserdata/anlicheng.xcuserdatad/xcschemes/xcschememanagement.plist

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>SchemeUserState</key>
+	<dict>
+		<key>Tun.xcscheme_^#shared#^_</key>
+		<dict>
+			<key>orderHint</key>
+			<integer>2</integer>
+		</dict>
+		<key>punchnet.xcscheme_^#shared#^_</key>
+		<dict>
+			<key>orderHint</key>
+			<integer>1</integer>
+		</dict>
+		<key>punchnetTests.xcscheme_^#shared#^_</key>
+		<dict>
+			<key>orderHint</key>
+			<integer>0</integer>
+		</dict>
+		<key>punchnetUITests.xcscheme_^#shared#^_</key>
+		<dict>
+			<key>orderHint</key>
+			<integer>0</integer>
+		</dict>
+	</dict>
+	<key>SuppressBuildableAutocreation</key>
+	<dict>
+		<key>C8A77EF22DD1E6D000195617</key>
+		<dict>
+			<key>primary</key>
+			<true/>
+		</dict>
+		<key>C8A77F052DD1E6D100195617</key>
+		<dict>
+			<key>primary</key>
+			<true/>
+		</dict>
+		<key>C8A77F262DD1E77B00195617</key>
+		<dict>
+			<key>primary</key>
+			<true/>
+		</dict>
+	</dict>
+</dict>
+</plist>

punchnet/App/AppContext.swift

@@ -0,0 +1,377 @@
+//
+//  LoginState.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/16.
+//
+
+import Foundation
+import Observation
+
+struct AppContextError: Error {
+    let message: String
+}
+
+struct TokenHistoryItem: Codable, Hashable {
+    let token: String
+    let networkName: String?
+}
+
+@Observable
+class AppContext {
+    private let cachedTokenAccount = "token"
+    private let cachedTokenHistoryAccount = "tokenHistory"
+    private let maxCachedTokenCount = 10
+
+    private var vpnManager = VPNManager.shared
+
+    // 调用 "/connect" 之后的网络信息
+    var networkContext: NetworkContext? = nil
+    
+    // 当前选择的出口节点 IP，为 nil 表示不设置出口节点
+    var selectedExitNodeIp: String? = nil
+
+    // 在menu里面需要使用
+    var vpnOptions: [String: NSObject]? = nil
+
+    // 当前app所处的场景
+    var appScene: AppScene = .login(username: nil)
+
+    // 当前的场景
+    enum AppScene: Equatable {
+        case login(username: String?)
+        case logined
+        case register
+        case resetPassword
+    }
+
+    // 登陆凭证
+    var loginCredit: Credit?
+
+    // 判断用户是否登陆
+    var isLogined: Bool {
+        return loginCredit != nil
+    }
+
+    enum Credit {
+        case token(token: String, session: NetworkSession)
+        case accountAndPasword(account: String, password: String, session: NetworkSession)
+    }
+
+    @ObservationIgnored
+    var networkSession: NetworkSession? {
+        guard let loginCredit = self.loginCredit else {
+            return nil
+        }
+
+        switch loginCredit {
+        case .token(_, let session):
+            return session
+        case .accountAndPasword(_, _, let session):
+            return session
+        }
+    }
+
+    var tunnelEvent: SDLTunnelAppEventStore.Event? = nil
+
+    @ObservationIgnored
+    private var lastTunnelEventID: String?
+
+    init() {
+        self.observeTunnelEvent()
+        self.consumeLatestTunnelEvent()
+    }
+
+    func loginWith(token: String) async throws {
+        let networkSession = try await AuthService.loginWithToken(token: token)
+        self.loginCredit = .token(token: token, session: networkSession)
+        self.selectedExitNodeIp = self.loadExitNodeIp(networkId: networkSession.networkId)
+        try self.saveCacheToken(token, networkName: networkSession.networkName)
+    }
+
+    func loginWith(username: String, password: String) async throws {
+        let networkSession = try await AuthService.loginWithAccountAndPassword(username: username, password: password)
+        self.loginCredit = .accountAndPasword(account: username, password: password, session: networkSession)
+        self.selectedExitNodeIp = self.loadExitNodeIp(networkId: networkSession.networkId)
+        // 将数据缓存到keychain
+        if let data = "\(username):\(password)".data(using: .utf8) {
+            try KeychainStore.shared.save(data, account: "accountAndPasword")
+        }
+    }
+
+    // 连接到对应的网络
+    func connectNetwork() async throws {
+        guard let session = self.networkSession else {
+            throw AppContextError(message: "未登陆")
+        }
+
+        // 避免重复连接
+        guard !vpnManager.isConnected else {
+            throw AppContextError(message: "网络已经连接")
+        }
+
+        self.networkContext = try await NetworkService.connectNetwork(accesToken: session.accessToken)
+    }
+
+    func changeExitNodeIp(exitNodeIp: String) async throws -> Data {
+        // 避免重复连接
+        guard vpnManager.isConnected else {
+            throw AppContextError(message: "网络未连接")
+        }
+
+        var changeExitNode = AppRequest.ChangeExitNodeRequest()
+        changeExitNode.ip = exitNodeIp
+
+        var appRequest = AppRequest()
+        appRequest.command = .changeExitNode(changeExitNode)
+
+        let message = try appRequest.serializedData()
+
+        return try await self.vpnManager.sendMessage(message)
+    }
+
+    // 启动tun
+    func startTun() async throws {
+        guard let session = self.networkSession, let context = self.networkContext else {
+            return
+        }
+
+        let options = SystemConfig.getOptions(
+            networkId: UInt32(session.networkId),
+            networkDomain: session.networkDomain,
+            ip: context.ip,
+            maskLen: context.maskLen,
+            accessToken: session.accessToken,
+            identityId: context.identityId,
+            hostname: context.hostname,
+            exitNodeIp: self.selectedExitNodeIp
+        )
+        try await self.vpnManager.enableVpn(options: options)
+    }
+
+    // 断开网络连接
+    func stopTun() async throws {
+        try await self.vpnManager.disableVpn()
+        self.networkContext = nil
+    }
+
+    // 退出登陆
+    func logout() async throws {
+        try await self.vpnManager.disableVpn()
+        self.networkContext = nil
+        self.selectedExitNodeIp = nil
+        self.loginCredit = nil
+    }
+
+    func loadCacheToken() -> String? {
+        if let item = self.loadCacheTokenHistory().first {
+            return item.token
+        }
+
+        return nil
+    }
+
+    func loadCacheTokenHistory() -> [TokenHistoryItem] {
+        if let data = try? KeychainStore.shared.load(account: cachedTokenHistoryAccount),
+           let items = try? JSONDecoder().decode([TokenHistoryItem].self, from: data) {
+            let normalizedItems = self.normalizedTokenHistory(items)
+            if !normalizedItems.isEmpty {
+                return normalizedItems
+            }
+        }
+
+        if let data = try? KeychainStore.shared.load(account: cachedTokenHistoryAccount),
+           let tokens = try? JSONDecoder().decode([String].self, from: data) {
+            let normalizedItems = self.normalizedTokenHistory(tokens.map {
+                TokenHistoryItem(token: $0, networkName: nil)
+            })
+
+            if !normalizedItems.isEmpty {
+                return normalizedItems
+            }
+        }
+
+        if let data = try? KeychainStore.shared.load(account: cachedTokenAccount),
+           let token = String(data: data, encoding: .utf8) {
+            return self.normalizedTokenHistory([
+                TokenHistoryItem(token: token, networkName: nil)
+            ])
+        }
+
+        return []
+    }
+
+    func deleteCacheToken(_ token: String) throws {
+        let normalizedToken = token.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !normalizedToken.isEmpty else {
+            return
+        }
+
+        var items = self.loadCacheTokenHistory()
+        items.removeAll { $0.token == normalizedToken }
+        items = Array(items.prefix(maxCachedTokenCount))
+
+        let historyData = try JSONEncoder().encode(items)
+        try KeychainStore.shared.save(historyData, account: cachedTokenHistoryAccount)
+
+        if let firstToken = items.first?.token,
+           let data = firstToken.data(using: .utf8) {
+            try KeychainStore.shared.save(data, account: cachedTokenAccount)
+        } else {
+            try KeychainStore.shared.delete(account: cachedTokenAccount)
+        }
+    }
+
+    private func saveCacheToken(_ token: String, networkName: String) throws {
+        let normalizedToken = token.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !normalizedToken.isEmpty else {
+            return
+        }
+
+        let normalizedNetworkName = networkName.trimmingCharacters(in: .whitespacesAndNewlines)
+        var items = self.loadCacheTokenHistory()
+        items.removeAll { $0.token == normalizedToken }
+        items.insert(
+            TokenHistoryItem(
+                token: normalizedToken,
+                networkName: normalizedNetworkName.isEmpty ? nil : normalizedNetworkName
+            ),
+            at: 0
+        )
+        items = Array(items.prefix(maxCachedTokenCount))
+
+        let historyData = try JSONEncoder().encode(items)
+        try KeychainStore.shared.save(historyData, account: cachedTokenHistoryAccount)
+
+        if let data = normalizedToken.data(using: .utf8) {
+            try KeychainStore.shared.save(data, account: cachedTokenAccount)
+        }
+    }
+
+    private func normalizedTokenHistory(_ items: [TokenHistoryItem]) -> [TokenHistoryItem] {
+        var seen = Set<String>()
+
+        return items.compactMap { item in
+            let normalizedToken = item.token.trimmingCharacters(in: .whitespacesAndNewlines)
+            guard !normalizedToken.isEmpty, !seen.contains(normalizedToken) else {
+                return nil
+            }
+
+            seen.insert(normalizedToken)
+            let normalizedNetworkName = item.networkName?.trimmingCharacters(in: .whitespacesAndNewlines)
+            return TokenHistoryItem(
+                token: normalizedToken,
+                networkName: normalizedNetworkName?.isEmpty == true ? nil : normalizedNetworkName
+            )
+        }
+    }
+
+    func loadCacheUsernameAndPassword() -> (String, String)? {
+        if let data = try? KeychainStore.shared.load(account: "accountAndPasword"),
+            let str = String(data: data, encoding: .utf8) {
+            let parts = str.split(separator: ":")
+            if parts.count == 2 {
+                return (String(parts[0]), String(parts[1]))
+            }
+        }
+        return nil
+    }
+    
+    // MARK: TunEvent
+    
+    func dismissTunnelEvent() {
+        self.tunnelEvent = nil
+    }
+
+    private func observeTunnelEvent() {
+        SDLNotificationCenter.shared.addObserver(for: .tunnelEventChanged) { [weak self] _ in
+            self?.consumeLatestTunnelEvent()
+        }
+    }
+
+    private func consumeLatestTunnelEvent() {
+        guard let event = SDLTunnelAppEventStore.loadLatestEvent(),
+              self.lastTunnelEventID != event.id else {
+            return
+        }
+
+        self.lastTunnelEventID = event.id
+        self.tunnelEvent = event
+        SDLTunnelAppEventStore.clearLatestEvent()
+    }
+
+    deinit {
+        SDLNotificationCenter.shared.removeObserver(for: .tunnelEventChanged)
+    }
+    
+}
+
+// 处理网络出口数据
+extension AppContext {
+    
+    private func exitNodeStorageAccount(networkId: Int?) -> String {
+        if let networkId {
+            return "exitNodeIp_\(networkId)"
+        }
+        
+        return "exitNodeIp"
+    }
+
+    func loadExitNodeIp(networkId: Int? = nil) -> String? {
+        let account = self.exitNodeStorageAccount(networkId: networkId)
+        
+        if let data = try? KeychainStore.shared.load(account: account) {
+            return String(data: data, encoding: .utf8)
+        }
+        
+        if networkId != nil,
+           let data = try? KeychainStore.shared.load(account: self.exitNodeStorageAccount(networkId: nil)) {
+            return String(data: data, encoding: .utf8)
+        }
+        
+        return nil
+    }
+
+    func saveExitNodeIp(exitNodeIp: String, networkId: Int? = nil) async throws {
+        let account = self.exitNodeStorageAccount(networkId: networkId)
+        
+        // 将数据缓存到keychain
+        if let data = exitNodeIp.data(using: .utf8) {
+            try KeychainStore.shared.save(data, account: account)
+        }
+    }
+    
+    func clearExitNodeIp(networkId: Int? = nil) throws {
+        try KeychainStore.shared.delete(account: self.exitNodeStorageAccount(networkId: networkId))
+    }
+    
+    func updateExitNodeIp(exitNodeIp: String?) async throws {
+        let normalizedExitNodeIp = exitNodeIp?.trimmingCharacters(in: .whitespacesAndNewlines)
+        let finalExitNodeIp = normalizedExitNodeIp?.isEmpty == true ? nil : normalizedExitNodeIp
+        let networkId = self.networkSession?.networkId
+        
+        if vpnManager.isConnected {
+            let result = try await self.changeExitNodeIp(exitNodeIp: finalExitNodeIp ?? "0.0.0.0")
+            let reply = try TunnelResponse(serializedBytes: result)
+            
+            guard reply.code == 0 else {
+                throw AppContextError(message: reply.message)
+            }
+        }
+        
+        if let finalExitNodeIp {
+            try await self.saveExitNodeIp(exitNodeIp: finalExitNodeIp, networkId: networkId)
+        } else {
+            try self.clearExitNodeIp(networkId: networkId)
+        }
+        
+        if networkId != nil {
+            try? self.clearExitNodeIp(networkId: nil)
+        }
+        
+        self.selectedExitNodeIp = finalExitNodeIp
+    }
+
+    
+
+}

punchnet/App/AppRootView.swift

@@ -0,0 +1,98 @@
+//
+//  RootView.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/19.
+//
+
+import SwiftUI
+
+struct AppRootView: View {
+    @Environment(AppContext.self) var appContext: AppContext
+    @State private var updateManager = AppUpdateManager.shared
+
+    var body: some View {
+        ZStack {
+            // 1. 主要界面容器
+            // 使用 ZStack 代替 Group，因为它在处理内容对齐和转场重叠时更稳定
+            ZStack(alignment: .center) {
+                switch appContext.appScene {
+                case .login(username: let username):
+                    LoginView(username: username)
+                        .id("scene_login") // 显式 ID 确保转场触发
+                case .logined:
+                    NetworkView()
+                        .id("scene_logined")
+                case .register:
+                    RegisterRootView()
+                        .id("scene_register")
+                case .resetPassword:
+                    ResetPasswordRootView()
+                        .id("scene_reset")
+                }
+            }
+            .transition(.asymmetric(
+                insertion: .move(edge: .trailing).combined(with: .opacity),
+                removal: .move(edge: .leading).combined(with: .opacity) // 修改为 leading 更有“流转”感
+            ))
+
+            // 自动更新遮罩层级
+            if updateManager.showUpdateOverlay, let info = updateManager.updateInfo {
+                updateOverlay(info: info)
+            }
+        }
+        // 4. 统一处理 Scene 切换的动画
+        .animation(.spring(duration: 0.5), value: appContext.appScene)
+        .animation(.spring(duration: 0.4), value: updateManager.showUpdateOverlay)
+        // 关键：macOS 标准毛玻璃背景
+        .background(VisualEffectView(material: .hudWindow, blendingMode: .behindWindow))
+        .alert("提示", isPresented: tunnelEventPresented, presenting: appContext.tunnelEvent) { _ in
+            Button("确定", role: .cancel) {
+                appContext.dismissTunnelEvent()
+            }
+        } message: { event in
+            Text(event.message)
+        }
+        .task {
+            let checkUpdateResult = await updateManager.checkUpdate(isManual: false)
+            NSLog("[RootView] checkUpdateResult: \(checkUpdateResult)")
+        }
+    }
+
+    // 将遮罩抽离，保持 body 清爽
+    @ViewBuilder
+    private func updateOverlay(info: AppUpgradeInfo) -> some View {
+        ZStack {
+            Color.black.opacity(0.4)
+                .ignoresSafeArea()
+                .onTapGesture {
+                    if !info.forceUpdate {
+                        updateManager.showUpdateOverlay = false
+                    }
+                }
+
+            AppUpdateView(info: info) {
+                updateManager.showUpdateOverlay = false
+            }
+            .clipShape(RoundedRectangle(cornerRadius: 16))
+            .shadow(color: .black.opacity(0.3), radius: 20)
+        }
+        .transition(.asymmetric(
+            insertion: .scale(scale: 0.9).combined(with: .opacity),
+            removal: .opacity
+        ))
+        .zIndex(100) // 确保更新遮罩永远在最上层
+    }
+
+    private var tunnelEventPresented: Binding<Bool> {
+        Binding(
+            get: { self.appContext.tunnelEvent != nil },
+            set: { isPresented in
+                if !isPresented {
+                    self.appContext.dismissTunnelEvent()
+                }
+            }
+        )
+    }
+
+}

punchnet/App/punchnetApp.swift

@@ -0,0 +1,115 @@
+//
+//  punchnetApp.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2025/5/12.
+//
+
+import SwiftUI
+import AppKit
+import SwiftData
+import Combine
+//import SystemConfiguration
+
+@main
+struct punchnetApp: App {
+    /*
+    var sharedModelContainer: ModelContainer = {
+        let schema = Schema([
+            Item.self,
+        ])
+        let modelConfiguration = ModelConfiguration(schema: schema, isStoredInMemoryOnly: false)
+
+        do {
+            return try ModelContainer(for: schema, configurations: [modelConfiguration])
+        } catch {
+            fatalError("Could not create ModelContainer: \(error)")
+        }
+    }()
+     */
+    
+    @NSApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
+    
+    @State private var appContext: AppContext
+    @AppStorage("hasAcceptedPrivacy") var hasAcceptedPrivacy: Bool = false
+    // UI 控制状态：是否显示弹窗
+    @State private var showPrivacy: Bool = false
+    
+    @State private var vpnManager = VPNManager.shared
+    
+    init() {
+        self.appContext = AppContext()
+    }
+    
+    var body: some Scene {
+        Window("Punchnet", id: "main") {
+            AppRootView()
+                .navigationTitle("")
+                .environment(self.appContext)
+                .frame(
+                    width: self.appContext.isLogined ? 900 : 380,
+                    height: self.appContext.isLogined ? 600 : 500
+                )
+                // 增加动画：当状态改变时，窗口会像微信那样丝滑地变大/变小
+                .animation(.spring(response: 0.4, dampingFraction: 0.8), value: self.appContext.isLogined)
+                .onAppear {
+                    self.showPrivacy = !hasAcceptedPrivacy
+                }
+                .sheet(isPresented: $showPrivacy) {
+                    PrivacyDetailView(showPrivacy: $showPrivacy)
+                        .interactiveDismissDisabled() // 强制阅读
+                }
+        }
+        .windowToolbarStyle(.unified)
+        .windowResizability(.contentSize)
+        .defaultPosition(.center)
+        .windowStyle(.hiddenTitleBar)
+        
+        Window("settings", id: "settings") {
+            SettingsView()
+                .environment(self.appContext)
+                .frame(width: 750, height: 450)
+        }
+        .windowResizability(.contentSize)
+        .defaultPosition(.center)
+        .windowStyle(.hiddenTitleBar)
+
+        MenuBarExtra("Punchnet", image: "logo_32") {
+            MainMenuBar()
+                .environment(appContext)
+        }
+        .menuBarExtraStyle(.menu)
+    }
+    
+}
+
+// 处理APP的生命周期
+class AppDelegate: NSObject, NSApplicationDelegate {
+    
+    func applicationWillFinishLaunching(_ notification: Notification) {
+//        let settings = SCDynamicStoreCopyProxies(nil)
+//        let proxies = settings as? [String: Any] ?? [:]
+//        for (key, value) in proxies {
+//            print("\(key): \(value)")
+//        }
+    }
+    
+    func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
+        print("call me applicationShouldTerminate")
+        Task {
+            do {
+                try await VPNManager.shared.disableVpn()
+                NSLog("vpn disabled")
+            } catch let err {
+                NSLog("退出时关闭 VPN 失败: \(err)")
+            }
+            
+            await MainActor.run {
+                sender.reply(toApplicationShouldTerminate: true)
+            }
+        }
+        
+        return .terminateLater
+    }
+    
+}

punchnet/AppEventCenter/SDLNotificationCenter.swift

@@ -0,0 +1,119 @@
+//
+//  DarwinNotificationName.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/3.
+//
+import Foundation
+
+// MARK: - Darwin Notification Name
+public struct DarwinNotificationName: RawRepresentable, Hashable {
+    public let rawValue: String
+    
+    public init(rawValue: String) {
+        self.rawValue = rawValue
+    }
+}
+
+// 预定义名称
+extension DarwinNotificationName {
+    static let tunnelEventChanged = DarwinNotificationName(rawValue: "com.jihe.punchnetmac.tunnelEventChanged")
+}
+
+extension SDLNotificationCenter {
+    enum Configuration {
+        static let appGroupSuiteName = "group.com.jihe.punchnetmac"
+        static let latestEventKey = "tunnel.latestEvent"
+    }
+}
+
+
+// MARK: - Manager
+public final class SDLNotificationCenter {
+    public static let shared = SDLNotificationCenter()
+    
+    private let center = CFNotificationCenterGetDarwinNotifyCenter()
+    
+    private var observers: [DarwinNotificationName: (DarwinNotificationName) -> Void] = [:]
+    private let lock = NSLock()
+    
+    private init() {}
+    
+    // MARK: - Add Observer
+    public func addObserver(for name: DarwinNotificationName, queue: DispatchQueue = .main, using block: @escaping (DarwinNotificationName) -> Void ) {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        
+        if observers[name] == nil {
+            // 首次注册到 Darwin Center
+            CFNotificationCenterAddObserver(
+                center,
+                UnsafeMutableRawPointer(Unmanaged.passUnretained(self).toOpaque()),
+                { (_, observer, cfName, _, _) in
+                    guard let observer, let cfName else {
+                        return
+                    }
+                    
+                    let instance = Unmanaged<SDLNotificationCenter>
+                        .fromOpaque(observer)
+                        .takeUnretainedValue()
+                    
+                    let name = DarwinNotificationName(rawValue: cfName.rawValue as String)
+                    instance.handle(name: name)
+                },
+                name.rawValue as CFString,
+                nil,
+                .deliverImmediately
+            )
+            
+            observers[name] = { n in
+                queue.async {
+                    block(n)
+                }
+            }
+        }
+        
+    }
+    
+    // MARK: - Remove Observer
+    public func removeObserver(for name: DarwinNotificationName) {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+        
+        if observers[name] != nil {
+            CFNotificationCenterRemoveObserver(
+                center,
+                UnsafeMutableRawPointer(Unmanaged.passUnretained(self).toOpaque()),
+                CFNotificationName(name.rawValue as CFString),
+                nil
+            )
+        }
+        observers.removeValue(forKey: name)
+        
+    }
+    
+    // MARK: - Post
+    public func post(_ name: DarwinNotificationName) {
+        CFNotificationCenterPostNotification(
+            center,
+            CFNotificationName(name.rawValue as CFString),
+            nil,
+            nil,
+            true
+        )
+    }
+    
+    // MARK: - Handle
+    private func handle(name: DarwinNotificationName) {
+        lock.lock()
+        let block = observers[name]
+        lock.unlock()
+        
+        block?(name)
+    }
+    
+}

punchnet/AppEventCenter/SDLTunnelAppEventStore.swift

@@ -0,0 +1,31 @@
+//
+//  SDLTunnelAppEventStore.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/15.
+//
+
+import Foundation
+
+struct SDLTunnelAppEventStore {
+    typealias Event = TunnelEvent
+    
+    static func loadLatestEvent() -> Event? {
+        guard let shared = UserDefaults(suiteName: SDLNotificationCenter.Configuration.appGroupSuiteName),
+              let data = shared.data(forKey: SDLNotificationCenter.Configuration.latestEventKey),
+              let event = try? Event(serializedBytes: data) else {
+            return nil
+        }
+        
+        return event
+    }
+    
+    static func clearLatestEvent() {
+        guard let shared = UserDefaults(suiteName: SDLNotificationCenter.Configuration.appGroupSuiteName) else {
+            return
+        }
+        
+        shared.removeObject(forKey: SDLNotificationCenter.Configuration.latestEventKey)
+        shared.synchronize()
+    }
+}

punchnet/Core/KeychainStore.swift

@@ -0,0 +1,77 @@
+//
+//  KeychainStore.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/19.
+//
+
+import Foundation
+import Security
+
+enum KeychainError: Error {
+    case unexpectedStatus(OSStatus)
+}
+
+final class KeychainStore {
+    
+    public static var shared: KeychainStore = .init(service: Bundle.main.bundleIdentifier!)
+
+    private let service: String
+
+    private init(service: String) {
+        self.service = service
+    }
+
+    func save(_ data: Data, account: String) throws {
+        let query: [CFString: Any] = [
+            kSecClass: kSecClassGenericPassword,
+            kSecAttrService: service,
+            kSecAttrAccount: account,
+            kSecValueData: data
+        ]
+
+        // 先删再加，避免重复
+        SecItemDelete(query as CFDictionary)
+
+        let status = SecItemAdd(query as CFDictionary, nil)
+        guard status == errSecSuccess else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+    }
+
+    func load(account: String) throws -> Data? {
+        let query: [CFString: Any] = [
+            kSecClass: kSecClassGenericPassword,
+            kSecAttrService: service,
+            kSecAttrAccount: account,
+            kSecReturnData: true,
+            kSecMatchLimit: kSecMatchLimitOne
+        ]
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+
+        if status == errSecItemNotFound {
+            return nil
+        }
+
+        guard status == errSecSuccess else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+
+        return result as? Data
+    }
+
+    func delete(account: String) throws {
+        let query: [CFString: Any] = [
+            kSecClass: kSecClassGenericPassword,
+            kSecAttrService: service,
+            kSecAttrAccount: account
+        ]
+
+        let status = SecItemDelete(query as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+    }
+}

punchnet/Core/LaunchManager.swift

@@ -0,0 +1,38 @@
+//
+//  LaunchManager.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/23.
+//
+import ServiceManagement
+import Observation
+
+@Observable
+class LaunchManager {
+    // 获取当前主 App 的服务实例
+    private let service = SMAppService.mainApp
+    
+    // 检查当前是否已开启自启动
+    var launchAtLogin: Bool
+    
+    init() {
+        self.launchAtLogin = (service.status == .enabled)
+    }
+    
+    func toggleLaunchAtLogin(enabled: Bool) throws {
+        if enabled {
+            try service.register()
+        } else {
+            try service.unregister()
+        }
+        
+        // 3. 重点：操作完成后，手动更新存储属性以触发 View 刷新
+        self.launchAtLogin = (service.status == .enabled)
+    }
+    
+    // 4. 提供一个手动同步方法（用于应对用户在系统设置中修改的情况）
+    func refreshLaunchStatus() {
+        self.launchAtLogin = (service.status == .enabled)
+    }
+    
+}

punchnet/Core/NoticeMessage.swift

@@ -1,90 +0,0 @@
-//
-//  NoticeMessage.swift
-//  sdlan
-//
-//  Created by 安礼成 on 2024/6/3.
-//
-
-import Foundation
-import NIOCore
-
-struct NoticeMessage {
-    enum InboundMessage {
-        case none
-        case upgradeMessage(prompt: String, address: String)
-        case alertMessage(alert: String)
-        case ip(ip: String)
-    }
-    
-    static func decodeMessage(buffer: inout ByteBuffer) -> InboundMessage {
-        guard let type = buffer.readInteger(as: UInt8.self) else {
-            return .none
-        }
-        
-        switch type {
-        case 0x01:
-            if let len0 = buffer.readInteger(as: UInt16.self),
-               let prompt = buffer.readString(length: Int(len0)),
-               let len1 = buffer.readInteger(as: UInt16.self),
-               let address = buffer.readString(length: Int(len1)) {
-                return .upgradeMessage(prompt: prompt, address: address)
-            }
-        case 0x02:
-            if let len0 = buffer.readInteger(as: UInt16.self),
-               let alert = buffer.readString(length: Int(len0)) {
-                return .alertMessage(alert: alert)
-            }
-            
-        case 0x03:
-            if let len0 = buffer.readInteger(as: UInt16.self),
-               let ipAddress = buffer.readString(length: Int(len0)) {
-                return .ip(ip: ipAddress)
-            }
-        default:
-            return .none
-        }
-        
-        return .none
-    }
-    
-    static func upgrade(prompt: String, address: String) -> Data {
-        var data = Data()
-        data.append(contentsOf: [0x01])
-        
-        data.append(contentsOf: lenBytes(UInt16(prompt.count)))
-        data.append(prompt.data(using: .utf8)!)
-        
-        data.append(contentsOf: lenBytes(UInt16(address.count)))
-        data.append(address.data(using: .utf8)!)
-        
-        return data
-    }
-    
-    static func alert(alert: String) -> Data {
-        var data = Data()
-        data.append(contentsOf: [0x02])
-        
-        data.append(contentsOf: lenBytes(UInt16(alert.count)))
-        data.append(alert.data(using: .utf8)!)
-        
-        return data
-    }
-    
-    static func ipAdress(ip: String) -> Data {
-        var data = Data()
-        data.append(contentsOf: [0x03])
-        
-        data.append(contentsOf: lenBytes(UInt16(ip.count)))
-        data.append(ip.data(using: .utf8)!)
-        
-        return data
-    }
-    
-    private static func lenBytes(_ value: UInt16) -> [UInt8] {
-        let byte1 = UInt8((value >> 8) & 0xFF)
-        let bytes2 = UInt8(value & 0xFF)
-        
-        return [byte1, bytes2]
-    }
-    
-}

punchnet/Core/SDLAPI.swift

@@ -1,74 +0,0 @@
-//
-//  SDLApi.swift
-//  sdlan
-//
-//  Created by 安礼成 on 2024/6/5.
-//
-
-import Foundation
-
-struct JSONRPCResponse<T: Decodable>: Decodable {
-    let result: T?
-    let error: JSONRPCError?
-}
-
-struct JSONRPCError: Decodable {
-    let code: Int
-    let message: String
-    let data: String?
-}
-
-struct SDLAPI {
-    
-    static let baseUrl: String = "https://punchnet.s5s8.com/api"
-    static let testBaseUrl: String = "http://127.0.0.1:19082/test"
-
-    struct Upgrade: Decodable {
-        let upgrade_type: Int
-        let upgrade_prompt: String
-        let upgrade_address: String
-    }
-    
-    struct NetworkProfile: Decodable {
-        struct NetworkItem: Decodable {
-            let name: String
-            let code: String
-        }
-        let network: [NetworkItem]
-    }
-    
-    static func checkVersion(clientId: String, version: Int, channel: String) async throws -> JSONRPCResponse<Upgrade> {
-        let params: [String:Any] = [
-            "client_id": clientId,
-            "version": version,
-            "channel": channel
-        ]
-        
-        let postData = try! JSONSerialization.data(withJSONObject: params)
-        var request = URLRequest(url: URL(string: baseUrl + "/upgrade")!)
-        request.httpMethod = "POST"
-        request.addValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.httpBody = postData
-        
-        let (data, _) = try await URLSession.shared.data(for: request)
-        
-        return try JSONDecoder().decode(JSONRPCResponse<Upgrade>.self, from: data)
-    }
-    
-    static func getUserNetworks(clientId: String) async throws -> JSONRPCResponse<NetworkProfile> {
-        let params: [String:Any] = [
-            "client_id": clientId
-        ]
-        
-        let postData = try! JSONSerialization.data(withJSONObject: params)
-        var request = URLRequest(url: URL(string: baseUrl + "/get_user_network")!)
-        request.httpMethod = "POST"
-        request.addValue("application/json", forHTTPHeaderField: "Content-Type")
-        request.httpBody = postData
-        
-        let (data, _) = try await URLSession.shared.data(for: request)
-        
-        return try JSONDecoder().decode(JSONRPCResponse<NetworkProfile>.self, from: data)
-    }
-    
-}

punchnet/Core/SDLUtil.swift

@@ -0,0 +1,64 @@
+//
+//  SDLUtil.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/9.
+//
+import Foundation
+import CommonCrypto
+
+struct SDLUtil {
+    enum ContactType {
+        case phone
+        case email
+        case invalid
+    }
+    
+    static func hmacMD5(key: String, data: String) -> String {
+        let keyData = key.data(using: .utf8)!
+        let dataData = data.data(using: .utf8)!
+
+        var digest = [UInt8](repeating: 0, count: Int(CC_MD5_DIGEST_LENGTH))
+        
+        keyData.withUnsafeBytes { keyBytes in
+            dataData.withUnsafeBytes { dataBytes in
+                CCHmac(
+                    CCHmacAlgorithm(kCCHmacAlgMD5),
+                    keyBytes.baseAddress!,
+                    keyBytes.count,
+                    dataBytes.baseAddress!,
+                    dataBytes.count,
+                    &digest
+                )
+            }
+        }
+
+        return digest.map { String(format: "%02x", $0) }.joined()
+        
+    }
+    
+    static func isValidIdentifyContact(_ input: String) -> Bool {
+        switch identifyContact(input) {
+        case .email, .phone:
+            true
+        default:
+            false
+        }
+    }
+
+    static func identifyContact(_ input: String) -> ContactType {
+        let trimmed = input.trimmingCharacters(in: .whitespacesAndNewlines)
+        // 手机号正则（中国手机号为例，以 1 开头，11 位数字）
+        let phoneRegex = /^1[3-9][0-9]{9}$/
+        // 邮箱正则
+        let emailRegex = /^[A-Z0-9a-z._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,64}$/
+        if trimmed.wholeMatch(of: phoneRegex) != nil {
+            return .phone
+        } else if trimmed.wholeMatch(of: emailRegex) != nil {
+            return .email
+        } else {
+            return .invalid
+        }
+    }
+    
+}

punchnet/Core/SystemConfig.swift

@@ -9,42 +9,63 @@ import Foundation
 
 struct SystemConfig {
     // 版本设置
-    static let version = 1
+    static let version: Int = 1
     
     static let version_name = "1.1"
     
-    // 安装渠道
+    static let build: Int = 123
-    static let installedChannel = "MacAppStore"
     
-    // super 节点
+    // 渠道相关
-    //static let superHost = "118.178.229.213"
+    static let channel = "appstore"
     
-    static let superHost = "punchnet.s5s8.com"
+    static let serverHost = "root.punchsky.com"
-    static let superPort = 18083
     
-    // stun探测服务
+    // stun探测辅助服务器ip
-    static let stunServers = "118.178.229.213:1265,1266;118.178.229.213:1265,1266"
+    static let stunAssistHost = "root.punchsky.com"
-    //static let stunServers = "127.0.0.1:1265,1266;127.0.0.1:1265,1266"
     
-    static func getOptions(networkCode: String, token: String, clientId: String, hostname: String, noticePort: Int) -> [String:NSObject]? {
+    // 获取系统信息
-        guard let superIp = DNSResolver.resolveAddrInfos(superHost).first else {
+    static let systemInfo: String = {
-            return nil
+        let version = ProcessInfo.processInfo.operatingSystemVersion
-        }
+        return "macOS \(version.majorVersion).\(version.minorVersion)"
+    }()
     
-        let options =  [
+    static func getOptions(networkId: UInt32,
-            "version:": version as NSObject,
+                           networkDomain: String,
-            "installed_channel": installedChannel as NSObject,
+                           ip: String,
+                           maskLen: UInt8,
+                           accessToken: String,
+                           identityId: UInt32,
+                           hostname: String,
+                           exitNodeIp: String?) -> [String: NSObject] {
+//        guard let serverIp = DNSResolver.resolveAddrInfos(serverHost).first,
+//              let stunAssistIp = DNSResolver.resolveAddrInfos(stunAssistHost).first else {
+//            return nil
+//        }
+        
+        let clientId = getClientId()
+        let mac = getMacAddress()
+        
+        var options = [
+            "version": version as NSObject,
             "client_id": clientId as NSObject,
-            "network_code": networkCode as NSObject,
+            "access_token": accessToken as NSObject,
-            "token": token as NSObject,
+            "identity_id": identityId as NSObject,
-            "super_ip": superIp as NSObject,
+            "server_host": serverHost as NSObject,
-            "super_port": superPort as NSObject,
+            "stun_assist_host": stunAssistHost as NSObject,
-            "stun_servers": stunServers as NSObject,
-            "remote_dns_server": superIp as NSObject,
             "hostname": hostname as NSObject,
-            "notice_port": noticePort as NSObject
+            "network_address": [
+                "network_id": networkId as NSObject,
+                "ip": ip as NSObject,
+                "mask_len": maskLen as NSObject,
+                "mac": mac as NSObject,
+                "network_domain": networkDomain as NSObject
+            ] as NSObject
         ]
         
+        if let exitNodeIp {
+            options["exit_node_ip"] = exitNodeIp as NSObject
+        }
+        
         return options
     }
     
@@ -60,4 +81,35 @@ struct SystemConfig {
         }
     }
     
+    // 获取mac地址
+    public static func getMacAddress() -> Data {
+        let key = "gMacAddress2"
+        
+        let userDefaults = UserDefaults.standard
+        if let mac = userDefaults.value(forKey: key) as? Data {
+            return mac
+        }
+        else {
+            let mac = generateMacAddress()
+            userDefaults.setValue(mac, forKey: key)
+            
+            return mac
+        }
+    }
+    
+    public static func macAddressString(mac: Data, separator: String = ":") -> String {
+        return mac.map { String(format: "%02X", $0) }
+            .joined(separator: separator)
+    }
+    
+    // 随机生成mac地址
+    private static func generateMacAddress() -> Data {
+        var macAddress = [UInt8](repeating: 0, count: 6)
+        for i in 0..<6 {
+            macAddress[i] = UInt8.random(in: 0...255)
+        }
+        
+        return Data(macAddress)
+    }
+    
 }

punchnet/Core/UDPNoticeCenterServer.swift

@@ -1,60 +0,0 @@
-//
-//  UDPMessageCenterServer.swift
-//  sdlan
-//
-//  Created by 安礼成 on 2024/5/20.
-//
-
-import Foundation
-import NIOCore
-import NIOPosix
-import Combine
-
-final class UDPNoticeCenterServer: ChannelInboundHandler {
-    public typealias InboundIn = AddressedEnvelope<ByteBuffer>
-    public typealias OutboundOut = AddressedEnvelope<ByteBuffer>
-    
-    private var group: MultiThreadedEventLoopGroup?
-    private var channel: Channel?
-    
-    var messageFlow = PassthroughSubject<NoticeMessage.InboundMessage, Never>()
-    public var port: Int = 0
-    
-    func start() {
-        self.group = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-        let bootstrap = DatagramBootstrap(group: self.group!)
-            .channelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
-            .channelInitializer { channel in
-                channel.pipeline.addHandler(self)
-            }
-        self.channel = try! bootstrap.bind(host: "127.0.0.1", port: 0).wait()
-        self.port = self.channel?.localAddress?.port ?? 0
-    }
-    
-    func stop() {
-        try? self.group?.syncShutdownGracefully()
-    }
-    
-    // --MARK: ChannelInboundHandler
-    
-    public func channelRead(context: ChannelHandlerContext, data: NIOAny) {
-        let envelope = self.unwrapInboundIn(data)
-        var buffer = envelope.data
-        
-        let notice = NoticeMessage.decodeMessage(buffer: &buffer)
-        self.messageFlow.send(notice)
-    }
-    
-    public func channelReadComplete(context: ChannelHandlerContext) {
-        // As we are not really interested getting notified on success or failure we just pass nil as promise to
-        // reduce allocations.
-        context.flush()
-    }
-    
-    public func errorCaught(context: ChannelHandlerContext, error: Error) {
-        // As we are not really interested getting notified on success or failure we just pass nil as promise to
-        // reduce allocations.
-        context.close(promise: nil)
-    }
-    
-}

punchnet/Core/VPNManager.swift

@@ -8,22 +8,35 @@
 import Foundation
 import NetworkExtension
 import SwiftUI
+import Observation
+
+enum VPNManagerError: Error {
+    case disconnected
+}
 
 // vpn管理类
-class VPNManager: ObservableObject {
+@Observable
+class VPNManager {
     static let shared = VPNManager()
     
-    @Published var vpnStatus: VPNStatus = .disconnected
+    private var manager: NETunnelProviderManager?
-    @Published var title: String = "启动"
+    private var statusObserver: NSObjectProtocol?
-    @Published var color: Color = .white
+    
+    var vpnStatus: VPNStatus = .disconnected
+    var isConnected: Bool = false
+    
+    var vpnStatusStream: AsyncStream<VPNStatus>
+    private var vpnStatusCont: AsyncStream<VPNStatus>.Continuation
     
     enum VPNStatus {
+        case connecting
         case connected
+        case disconnecting
         case disconnected
     }
     
     private init() {
-        
+        (self.vpnStatusStream, self.vpnStatusCont) = AsyncStream.makeStream(of: VPNStatus.self)
     }
     
     // 开启vpn
@@ -32,37 +45,76 @@ class VPNManager: ObservableObject {
         let manager = try await loadAndCreateProviderManager()
         try await manager.loadFromPreferences()
         self.addVPNStatusObserver(manager)
-        
         try manager.connection.startVPNTunnel(options: options)
+        
+        self.manager = manager
     }
     
     // 关闭vpn
     func disableVpn() async throws {
-        let managers = try await NETunnelProviderManager.loadAllFromPreferences()
+        guard let manager = self.manager else {
-        managers.first?.connection.stopVPNTunnel()
+            return
+        }
+        
+        try await manager.loadFromPreferences()
+        manager.connection.stopVPNTunnel()
+        self.manager = nil
+    }
+    
+    func sendMessage(_ message: Data) async throws -> Data {
+        guard let session = self.manager?.connection as? NETunnelProviderSession else {
+            throw VPNManagerError.disconnected
+        }
+        
+        guard session.status == .connected || session.status == .connecting else {
+            throw VPNManagerError.disconnected
+        }
+        
+        return try await withCheckedThrowingContinuation { continuation in
+            do {
+                try session.sendProviderMessage(message) { responseData in
+                    // 收到响应，恢复异步挂起点
+                    continuation.resume(returning: responseData ?? Data())
+                }
+            } catch {
+                // 发送失败，抛出错误
+                continuation.resume(throwing: error)
+            }
+        }
     }
     
     // MARK: - Private Methods
     
     // 监控系统VPN的状态的变化
     private func addVPNStatusObserver(_ manager: NETunnelProviderManager) {
-        NotificationCenter.default.removeObserver(self)
+        if let statusObserver {
+            NotificationCenter.default.removeObserver(statusObserver)
+            self.statusObserver = nil
+        }
         
-        NotificationCenter.default.addObserver(forName: .NEVPNStatusDidChange, object: manager.connection, queue: .main) { [unowned self] (notification) -> Void in
+        self.statusObserver = NotificationCenter.default.addObserver(forName: .NEVPNStatusDidChange, object: manager.connection, queue: .main) {[weak self] _ in
-            // 更新vpn的状态
+            NSLog("status channge: \(manager.connection.status)")
             switch manager.connection.status {
-            case .invalid, .disconnected, .disconnecting:
+            case .invalid, .disconnected:
-                self.vpnStatus = .disconnected
+                self?.vpnStatusCont.yield(.disconnected)
-                self.title = "启动"
+                self?.vpnStatus = .disconnected
-                self.color = .white
+                self?.isConnected = false
-            case .connecting, .connected, .reasserting:
+            case .disconnecting:
-                self.vpnStatus = .connected
+                self?.vpnStatusCont.yield(.disconnecting)
-                self.title = "停止"
+                self?.vpnStatus = .disconnecting
-                self.color = .red
+                self?.isConnected = false
+            case .connecting, .reasserting:
+                self?.vpnStatusCont.yield(.connecting)
+                self?.vpnStatus = .connecting
+                self?.isConnected = true
+            case .connected:
+                self?.vpnStatusCont.yield(.connected)
+                self?.vpnStatus = .connected
+                self?.isConnected = true
             @unknown default:
-                self.vpnStatus = .disconnected
+                self?.vpnStatusCont.yield(.disconnected)
-                self.title = "启动"
+                self?.vpnStatus = .disconnected
-                self.color = .red
+                self?.isConnected = false
             }
         }
     }
@@ -92,9 +144,10 @@ class VPNManager: ObservableObject {
         return manager
     }
     
-    
     deinit {
-        NotificationCenter.default.removeObserver(self)
+        if let statusObserver {
+            NotificationCenter.default.removeObserver(statusObserver)
+        }
     }
     
 }

punchnet/Features/Auth/AuthService.swift

@@ -0,0 +1,119 @@
+//
+//  NetworkSession.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/23.
+//
+import Foundation
+
+struct AuthService {
+    private static let baseParams: [String: Any] = [
+        "client_id": SystemConfig.getClientId(),
+        "mac": SystemConfig.macAddressString(mac: SystemConfig.getMacAddress())
+    ]
+    
+    // 注册会话信息
+    struct RegisterSession: Codable {
+        let sessionId: Int
+        
+        enum CodingKeys: String, CodingKey {
+            case sessionId = "session_id"
+        }
+    }
+    
+    // 重置会话信息
+    struct ResetPasswordSession: Codable {
+        let sessionId: Int
+        
+        enum CodingKeys: String, CodingKey {
+            case sessionId = "session_id"
+        }
+    }
+    
+    static func loginWithAccountAndPassword(username: String, password: String) async throws -> NetworkSession {
+        var params: [String: Any] = [
+            "username": username,
+            "password": password,
+            "hostname": Host.current().name ?? "",
+            "system": SystemConfig.systemInfo,
+            "version": SystemConfig.version_name
+        ]
+        params.merge(baseParams) {$1}
+        
+        
+        return try await SDLAPIClient.doPost(path: "/auth/login", params: params, as: NetworkSession.self)
+    }
+    
+    static func loginWithToken(token: String) async throws -> NetworkSession {
+        var params: [String: Any] = [
+            "token": token,
+            "hostname": Host.current().name ?? "",
+            "system": SystemConfig.systemInfo,
+            "version": SystemConfig.version_name
+        ]
+        params.merge(baseParams) {$1}
+        
+        NSLog("login params: \(params)")
+
+        return try await SDLAPIClient.doPost(path: "/auth/token", params: params, as: NetworkSession.self)
+    }
+    
+    static func requestRegisterVerifyCode(phoneNumber: String) async throws -> RegisterSession {
+        var params: [String: Any] = [
+            "username": phoneNumber
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/register/sendVerfiyCode", params: params, as: RegisterSession.self)
+    }
+    
+    static func submitRegisterVerifyCode(sessionId: Int, verifyCode: String) async throws -> String {
+        var params: [String: Any] = [
+            "session_id": sessionId,
+            "code": verifyCode,
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/register/verfiyCode", params: params, as: String.self)
+    }
+    
+    static func register(sessionId: Int, password: String) async throws -> String {
+        var params: [String: Any] = [
+            "session_id": sessionId,
+            "password": password
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/register/submit", params: params, as: String.self)
+    }
+    
+    static func requestResetPasswordVerifyCode(phoneNumber: String) async throws -> ResetPasswordSession {
+        var params: [String: Any] = [
+            "username": phoneNumber
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/password/sendVerfiyCode", params: params, as: ResetPasswordSession.self)
+    }
+    
+    static func submitResetPasswordVerifyCode(sessionId: Int, verifyCode: String) async throws -> String {
+        var params: [String: Any] = [
+            "session_id": sessionId,
+            "code": verifyCode,
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/password/verfiyCode", params: params, as: String.self)
+    }
+    
+    static func resetPassword(sessionId: Int, newPassword: String) async throws -> String {
+        var params: [String: Any] = [
+            "session_id": sessionId,
+            "new_password": newPassword,
+        ]
+        params.merge(baseParams) {$1}
+        
+        return try await SDLAPIClient.doPost(path: "/password/reset", params: params, as: String.self)
+    }
+    
+}

punchnet/Features/Auth/ViewModels/RegisterModel.swift

@@ -0,0 +1,41 @@
+//
+//  LoginState.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/16.
+//
+
+import Foundation
+import Observation
+import SwiftUI
+
+@Observable
+class RegisterModel {
+    
+    enum Stage: Equatable {
+        case requestVerifyCode
+        case submitVerifyCode
+        case setPassword
+        case success
+    }
+    
+    // 保存临时变量
+    var phoneNumber: String = ""
+    var sessionId: Int = 0
+    
+    var stage: Stage = .requestVerifyCode
+    var transitionEdge: Edge = .trailing // 默认从右进入
+
+    func requestVerifyCode(phoneNumber: String) async throws -> AuthService.RegisterSession {
+        return try await AuthService.requestRegisterVerifyCode(phoneNumber: phoneNumber)
+    }
+    
+    func submitVerifyCode(sessionId: Int, verifyCode: String) async throws -> String {
+        return try await AuthService.submitRegisterVerifyCode(sessionId: sessionId, verifyCode: verifyCode)
+    }
+    
+    func register(sessionId: Int, password: String) async throws -> String {
+        return try await AuthService.register(sessionId: sessionId, password: password)
+    }
+    
+}

punchnet/Features/Auth/ViewModels/ResetPasswordModel.swift

@@ -0,0 +1,41 @@
+//
+//  LoginState.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/16.
+//
+
+import Foundation
+import Observation
+import SwiftUI
+
+@Observable
+class ResetPasswordModel {
+    
+    enum Stage: Equatable {
+        case requestVerifyCode
+        case submitVerifyCode
+        case resetPassword
+        case success
+    }
+     
+    var stage: Stage = .requestVerifyCode
+    var transitionEdge: Edge = .trailing // 默认从右进入
+    
+    // 保存内部状态
+    var phoneNumber: String = ""
+    var sessionId: Int = 0
+    
+    func requestVerifyCode(phoneNumber: String) async throws -> AuthService.ResetPasswordSession {
+        return try await AuthService.requestResetPasswordVerifyCode(phoneNumber: phoneNumber)
+    }
+    
+    func submitVerifyCode(sessionId: Int, verifyCode: String) async throws -> String {
+        return try await AuthService.submitResetPasswordVerifyCode(sessionId: sessionId, verifyCode: verifyCode)
+    }
+    
+    func resetPassword(sessionId: Int, newPassword: String) async throws -> String {
+        return try await AuthService.resetPassword(sessionId: sessionId, newPassword: newPassword)
+    }
+    
+}

punchnet/Features/Auth/Views/LoginView.swift

@@ -0,0 +1,449 @@
+//
+//  LoginView.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/1/15.
+//
+import SwiftUI
+import Observation
+
+// MARK: - 主容器视图
+struct LoginView: View {
+    @State private var authMethod: AuthMethod = .account
+    
+    var username: String?
+    
+    enum AuthMethod: String, CaseIterable {
+        case account = "账户登录"
+        case token = "密钥认证"
+    }
+    
+    var body: some View {
+        ZStack {
+            Color.clear
+            
+            VStack(spacing: 0) {
+                // 顶部 Logo 区域
+                VStack(spacing: 12) {
+                    ZStack {
+                        Circle()
+                            .fill(Color.accentColor.opacity(0.1))
+                            .frame(width: 80, height: 80)
+                        
+                        Image(systemName: "network") // 建议使用 SF Symbol 保持精致感
+                            .font(.system(size: 38, weight: .semibold))
+                            .foregroundColor(.accentColor)
+                    }
+                    
+                    Text("PunchNet")
+                        .font(.system(size: 24, weight: .bold, design: .rounded))
+                        .tracking(1)
+                }
+                .padding(.top, 40)
+                .padding(.bottom, 30)
+                
+                // 原生分段切换器
+                Picker("", selection: $authMethod) {
+                    ForEach(AuthMethod.allCases, id: \.self) { method in
+                        Text(method.rawValue).tag(method)
+                    }
+                }
+                .pickerStyle(.segmented)
+                .frame(width: 220)
+                .padding(.bottom, 30)
+                
+                // 动态内容区
+                ZStack {
+                    switch authMethod {
+                    case .account:
+                        LoginAccountView(username: self.username ?? "")
+                            .transition(.move(edge: .leading).combined(with: .opacity))
+                    case .token:
+                        LoginTokenView()
+                            .transition(.move(edge: .trailing).combined(with: .opacity))
+                    }
+                }
+                .animation(.spring(response: 0.3, dampingFraction: 0.8), value: authMethod)
+                .frame(height: 180)
+                
+                Spacer()
+                
+                // 底部页脚
+                HStack(spacing: 4) {
+                    Circle()
+                        .fill(Color.green)
+                        .frame(width: 8, height: 8)
+                    
+                    Text("服务状态正常")
+                        .font(.system(size: 11))
+                        .foregroundColor(.secondary)
+                }
+                .padding(.bottom, 20)
+            }
+        }
+    }
+    
+}
+
+// MARK: - 账户登录组件
+struct LoginAccountView: View {
+    @Environment(AppContext.self) var appContext: AppContext
+    
+    @State var username: String = ""
+    @State private var password: String = ""
+    @State private var isLoading = false
+    
+    // 错误提示
+    @State private var showAlert: Bool = false
+    @State private var errorMessage: String = ""
+    
+    var body: some View {
+        VStack(spacing: 16) {
+            VStack(alignment: .leading, spacing: 12) {
+                // 标准圆角输入框
+                CustomTextField(title: "手机号/邮箱", text: $username, icon: "person.fill")
+                
+                VStack(alignment: .trailing, spacing: 4) {
+                    CustomSecureField(title: "密码", text: $password, icon: "lock.fill")
+                    
+                    HStack {
+                        Button("注册") {
+                            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                                self.appContext.appScene = .register
+                            }
+                        }
+                        .buttonStyle(.link)
+                        .font(.system(size: 11))
+                        .foregroundColor(.secondary)
+                        
+                        Button("忘记密码？") {
+                            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                                self.appContext.appScene = .resetPassword
+                            }
+                        }
+                        .buttonStyle(.link)
+                        .font(.system(size: 11))
+                        .foregroundColor(.secondary)
+                    }
+                }
+            }
+            .frame(width: 280)
+            
+            // 蓝色主按钮
+            Button(action: {
+                Task { @MainActor in
+                   await self.login()
+                }
+            }) {
+                HStack {
+                    if isLoading {
+                        ProgressView()
+                            .controlSize(.small)
+                            .padding(.trailing, 4)
+                    }
+                    
+                    Text("登录网络")
+                        .fontWeight(.medium)
+                }
+                .frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .keyboardShortcut(.defaultAction) // 绑定回车键
+            .disabled(username.isEmpty || password.isEmpty || isLoading)
+        }
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+        .onAppear {
+            if let (cacheUsername, cachePassword) = self.appContext.loadCacheUsernameAndPassword() {
+                self.username = cacheUsername
+                self.password = cachePassword
+            }
+        }
+    }
+    
+    private func login() async {
+        self.isLoading = true
+        defer {
+            self.isLoading = false
+        }
+        
+        do {
+            _ = try await appContext.loginWith(username: username, password: password)
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.appContext.appScene = .logined
+            }
+            
+        } catch let err as SDLAPIError {
+            self.showAlert = true
+            self.errorMessage = err.message
+        } catch let err {
+            self.showAlert = true
+            self.errorMessage = err.localizedDescription
+        }
+    }
+}
+
+// MARK: - 密钥登录组件
+struct LoginTokenView: View {
+    @Environment(AppContext.self) var appContext: AppContext
+
+    @State private var token = ""
+    @State private var tokenHistory: [TokenHistoryItem] = []
+    @State private var wantsTokenHistory = false
+    @State private var showTokenHistory = false
+    @State private var isLoading = false
+    @FocusState private var isTokenFocused: Bool
+    
+    // 错误提示
+    @State private var showAlert: Bool = false
+    @State private var errorMessage: String = ""
+
+    private var normalizedToken: String {
+        token.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    private var visibleTokenHistory: [TokenHistoryItem] {
+        guard !normalizedToken.isEmpty else {
+            return tokenHistory
+        }
+
+        let matchedItems = tokenHistory.filter {
+            $0.token.localizedCaseInsensitiveContains(normalizedToken)
+                || ($0.networkName?.localizedCaseInsensitiveContains(normalizedToken) == true)
+        }
+
+        return matchedItems
+    }
+
+    private var tokenHistoryPopoverBinding: Binding<Bool> {
+        Binding(
+            get: {
+                showTokenHistory
+            },
+            set: { isPresented in
+                showTokenHistory = isPresented
+                if !isPresented {
+                    wantsTokenHistory = false
+                }
+            }
+        )
+    }
+
+    var body: some View {
+        VStack(spacing: 20) {
+            tokenInputField
+            
+            Button(action: {
+                Task { @MainActor in
+                    await self.login()
+                }
+            }) {
+                Text("验证并连接")
+                    .fontWeight(.medium)
+                    .frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .disabled(normalizedToken.isEmpty || isLoading)
+        }
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+        .onAppear {
+            self.tokenHistory = self.appContext.loadCacheTokenHistory()
+            if let cacheToken = self.appContext.loadCacheToken() {
+                self.token = cacheToken
+            }
+        }
+    }
+
+    private var tokenInputField: some View {
+        HStack {
+            Image(systemName: "key.fill")
+                .foregroundColor(.secondary)
+                .frame(width: 20)
+
+            TextField("请输入认证密钥 (Token)", text: $token)
+                .textFieldStyle(.plain)
+                .focused($isTokenFocused)
+        }
+        .padding(8)
+        .frame(width: 280)
+        .background(Color(NSColor.controlBackgroundColor).opacity(0.5))
+        .cornerRadius(6)
+        .overlay(RoundedRectangle(cornerRadius: 6).stroke(Color.secondary.opacity(0.2), lineWidth: 1))
+        .onTapGesture {
+            self.presentTokenHistory()
+        }
+        .onChange(of: isTokenFocused) {
+            if isTokenFocused {
+                self.presentTokenHistory()
+            } else if !showTokenHistory {
+                self.wantsTokenHistory = false
+            }
+        }
+        .onChange(of: token) {
+            if wantsTokenHistory {
+                self.refreshTokenHistoryPopover()
+            }
+        }
+        .popover(isPresented: tokenHistoryPopoverBinding, arrowEdge: .bottom) {
+            tokenHistoryPopover
+        }
+    }
+
+    private var tokenHistoryPopover: some View {
+        VStack(alignment: .leading, spacing: 0) {
+            ForEach(visibleTokenHistory, id: \.token) { item in
+                HStack(spacing: 4) {
+                    Button(action: {
+                        self.token = item.token
+                        self.dismissTokenHistory()
+                    }) {
+                        HStack(spacing: 8) {
+                            Image(systemName: item.token == normalizedToken ? "checkmark" : "key.fill")
+                                .foregroundColor(.secondary)
+                                .frame(width: 14)
+
+                            Text(tokenHistoryTitle(item))
+                                .font(.system(size: 12))
+                                .lineLimit(1)
+                                .truncationMode(.middle)
+
+                            Spacer(minLength: 0)
+                        }
+                        .contentShape(Rectangle())
+                        .padding(.leading, 10)
+                        .padding(.vertical, 6)
+                    }
+                    .buttonStyle(.plain)
+
+                    Button(action: {
+                        self.deleteTokenHistoryItem(item)
+                    }) {
+                        Image(systemName: "trash")
+                            .font(.system(size: 11, weight: .medium))
+                            .foregroundColor(.secondary)
+                            .frame(width: 24, height: 24)
+                    }
+                    .buttonStyle(.plain)
+                }
+                .padding(.trailing, 6)
+            }
+        }
+        .frame(width: 280)
+        .padding(.bottom, 6)
+    }
+
+    private func presentTokenHistory() {
+        self.wantsTokenHistory = true
+        self.refreshTokenHistoryPopover()
+    }
+
+    private func dismissTokenHistory() {
+        self.wantsTokenHistory = false
+        self.showTokenHistory = false
+    }
+
+    private func refreshTokenHistoryPopover() {
+        self.tokenHistory = self.appContext.loadCacheTokenHistory()
+        self.showTokenHistory = wantsTokenHistory && !visibleTokenHistory.isEmpty
+    }
+
+    private func deleteTokenHistoryItem(_ item: TokenHistoryItem) {
+        do {
+            try self.appContext.deleteCacheToken(item.token)
+            self.tokenHistory = self.appContext.loadCacheTokenHistory()
+            self.showTokenHistory = wantsTokenHistory && !visibleTokenHistory.isEmpty
+        } catch {
+            self.showAlert = true
+            self.errorMessage = error.localizedDescription
+        }
+    }
+
+    private func tokenHistoryTitle(_ item: TokenHistoryItem) -> String {
+        guard let networkName = item.networkName, !networkName.isEmpty else {
+            return item.token
+        }
+
+        return "\(item.token) (\(networkName))"
+    }
+    
+    private func login() async {
+        let finalToken = self.normalizedToken
+        guard !finalToken.isEmpty else {
+            return
+        }
+
+        self.isLoading = true
+        self.dismissTokenHistory()
+        defer {
+            self.isLoading = false
+        }
+        
+        do {
+            _ = try await appContext.loginWith(token: finalToken)
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.appContext.appScene = .logined
+            }
+        } catch let err as SDLAPIError {
+            self.showAlert = true
+            self.errorMessage = err.message
+        } catch let err {
+            self.showAlert = true
+            self.errorMessage = err.localizedDescription
+        }
+    }
+    
+}
+
+// MARK: - 辅助 UI 组件
+struct CustomTextField: View {
+    let title: String
+    @Binding var text: String
+    let icon: String
+    
+    var body: some View {
+        HStack {
+            Image(systemName: icon)
+                .foregroundColor(.secondary)
+                .frame(width: 20)
+            
+            TextField(title, text: $text)
+                .textFieldStyle(.plain)
+        }
+        .padding(8)
+        .background(Color(NSColor.controlBackgroundColor).opacity(0.5))
+        .cornerRadius(6)
+        .overlay(RoundedRectangle(cornerRadius: 6).stroke(Color.secondary.opacity(0.2), lineWidth: 1))
+    }
+}
+
+struct CustomSecureField: View {
+    let title: String
+    @Binding var text: String
+    let icon: String
+    
+    var body: some View {
+        HStack {
+            Image(systemName: icon)
+                .foregroundColor(.secondary)
+                .frame(width: 20)
+            SecureField(title, text: $text)
+                .textFieldStyle(.plain)
+        }
+        .padding(8)
+        .background(Color(NSColor.controlBackgroundColor).opacity(0.5))
+        .cornerRadius(6)
+        .overlay(RoundedRectangle(cornerRadius: 6).stroke(Color.secondary.opacity(0.2), lineWidth: 1))
+    }
+}
+
+#Preview {
+    LoginView()
+        .environment(AppContext())
+}

punchnet/Features/Auth/Views/RegisterView.swift

@@ -0,0 +1,498 @@
+//
+//  ResetPasswordView.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/9.
+//
+import SwiftUI
+import Observation
+
+// MARK: - 注册根视图
+struct RegisterRootView: View {
+    @State private var registerModel = RegisterModel()
+    @Environment(AppContext.self) private var appContext: AppContext
+    
+    var body: some View {
+        ZStack(alignment: .center) {
+            Color.clear
+            
+            ZStack(alignment: .center) {
+                switch registerModel.stage {
+                case .requestVerifyCode:
+                    RegisterRequestVerifyCodeView()
+                case .submitVerifyCode:
+                    RegisterSubmitVerifyCodeView()
+                case .setPassword:
+                    RegisterSetPasswordView()
+                case .success:
+                    RegisterSuccessView()
+                }
+            }
+            .transition(.asymmetric(
+                insertion: .move(edge: registerModel.transitionEdge).combined(with: .opacity),
+                removal: .move(edge: registerModel.transitionEdge == .trailing ? .leading : .trailing).combined(with: .opacity)
+            ))
+        }
+        .environment(registerModel)
+        // --- 核心改动：使用 overlay ---
+        .overlay(alignment: .topLeading) {
+            // 仅在非成功页面显示返回按钮
+            switch registerModel.stage {
+            case .success:
+                EmptyView()
+            default:
+                Button(action: {
+                    // 执行返回逻辑，例如重置到登录
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.appContext.appScene = .login(username: nil)
+                    }
+                }) {
+                    HStack {
+                        Image(systemName: "chevron.left")
+                            .font(.system(size: 16, weight: .semibold))
+                            .padding(5)
+                        
+                        Text("首页")
+                            .font(.system(size: 16, weight: .regular))
+                    }
+                    .contentShape(Rectangle()) // 扩大点击热区
+                }
+                .buttonStyle(.plain)
+                .padding([.top, .leading], 16) // 控制距离窗口边缘的边距
+                .transition(.opacity) // 按钮出现的动画
+            }
+        }
+    }
+}
+
+// MARK: - 封装的输入框组件
+struct PunchTextField: View {
+    let icon: String
+    let placeholder: String
+    @Binding var text: String
+    var isSecure: Bool = false
+    var isDisabled: Bool = false
+
+    var body: some View {
+        HStack(spacing: 12) {
+            Image(systemName: icon)
+                .foregroundColor(.secondary)
+                .frame(width: 20)
+            
+            if isSecure {
+                SecureField(placeholder, text: $text)
+                    .textFieldStyle(.plain)
+            } else {
+                TextField(placeholder, text: $text)
+                    .textFieldStyle(.plain)
+                    .disabled(isDisabled)
+            }
+        }
+        .padding(10)
+        .background(Color.primary.opacity(isDisabled ? 0.02 : 0.05))
+        .cornerRadius(8)
+        .overlay(
+            RoundedRectangle(cornerRadius: 8)
+                .stroke(Color.primary.opacity(0.1), lineWidth: 1)
+        )
+    }
+}
+
+// MARK: - 第一步：获取验证码
+struct RegisterRequestVerifyCodeView: View {
+    @Environment(RegisterModel.self) var registerModel: RegisterModel
+    @State private var isProcessing = false
+    
+    // 错误提示
+    @State private var showAlert: Bool = false
+    @State private var errorMessage: String = ""
+
+    var body: some View {
+        @Bindable var model = registerModel
+        
+        VStack(spacing: 24) {
+            headerSection(title: "创建个人网络", subtitle: "输入手机号开始注册")
+
+            VStack(spacing: 16) {
+                PunchTextField(icon: "phone.fill", placeholder: "手机号", text: $model.phoneNumber)
+            }
+            .frame(width: 280)
+
+            Button(action: {
+                Task { @MainActor in
+                    await self.requestVerifyCode(phoneNumber: model.phoneNumber)
+                }
+            }) {
+                Text("获取验证码")
+                    .fontWeight(.medium)
+                    .frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .disabled(SDLUtil.identifyContact(model.phoneNumber) != .phone || isProcessing)
+        }
+        .padding(40)
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+    }
+
+    private func requestVerifyCode(phoneNumber: String) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        
+        if phoneNumber.isEmpty {
+            self.showAlert = true
+            self.errorMessage = "手机号为空"
+            return
+        }
+        
+        switch SDLUtil.identifyContact(phoneNumber) {
+        case .phone:
+            do {
+                let registerSession = try await self.registerModel.requestVerifyCode(phoneNumber: phoneNumber)
+                withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                    self.registerModel.stage = .submitVerifyCode
+                    self.registerModel.phoneNumber = phoneNumber
+                    self.registerModel.sessionId = registerSession.sessionId
+                    
+                    self.registerModel.transitionEdge = .trailing
+                }
+            } catch let err as SDLAPIError {
+                self.showAlert = true
+                self.errorMessage = err.message
+            } catch let err {
+                self.showAlert = true
+                self.errorMessage = err.localizedDescription
+            }
+        default:
+            self.showAlert = true
+            self.errorMessage = "手机号格式错误"
+        }
+    }
+    
+}
+
+// MARK: - 第二步：验证
+struct RegisterSubmitVerifyCodeView: View {
+    @Environment(RegisterModel.self) var registerModel: RegisterModel
+    
+    @State private var code: String = ""
+    @State private var isProcessing = false
+    
+    // 错误提示
+    @State private var showAlert: Bool = false
+    @State private var errorMessage: String = ""
+    
+    // 重新发送是否可以使用
+    @State private var isEnabled: Bool = false
+    @State private var remainingSeconds = 60
+    @State private var timer: Timer? = nil
+    
+    // 判断验证码是否正确
+    var validInputCode: Bool {
+        return !self.code.isEmpty && self.code.count == 6 && self.code.allSatisfy {$0.isNumber}
+    }
+
+    var body: some View {
+        VStack(spacing: 24) {
+            headerSection(title: "身份验证", subtitle: "验证码已发送至 \(registerModel.phoneNumber)")
+
+            VStack(alignment: .trailing, spacing: 16) {
+                PunchTextField(icon: "envelope.badge", placeholder: "输入 6 位验证码", text: $code)
+                
+                Button {
+                    Task { @MainActor in
+                        await self.resendVerifyCodeAction(phoneNumber: registerModel.phoneNumber)
+                    }
+                } label: {
+                    if isEnabled {
+                        Text("没有收到？重新获取")
+                    } else {
+                        Text("重新获取 (\(remainingSeconds)s)")
+                    }
+                }
+                .buttonStyle(.link)
+                .font(.caption)
+                .disabled(!isEnabled) // 倒计时期间禁用按钮
+            }
+            .frame(width: 280)
+
+            VStack(spacing: 12) {
+                Button(action: {
+                    Task { @MainActor in
+                        await self.submitVerifyCode(sessionId: registerModel.sessionId)
+                    }
+                }) {
+                    Text("验证并设置密码")
+                        .fontWeight(.medium)
+                        .frame(maxWidth: .infinity)
+                }
+                .buttonStyle(.borderedProminent)
+                .controlSize(.large)
+                .disabled(!self.validInputCode)
+                
+                Button("返回上一步") {
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.registerModel.stage = .requestVerifyCode
+                        
+                        self.registerModel.transitionEdge = .leading
+                    }
+                }
+                .buttonStyle(.plain)
+                .foregroundColor(.secondary)
+            }
+            .frame(width: 280)
+        }
+        .padding(40)
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(errorMessage))
+        }
+        .task {
+            await self.startCountdown()
+        }
+    }
+    
+    // 重新发送验证码
+    private func resendVerifyCodeAction(phoneNumber: String) async {
+        do {
+            let result = try await self.registerModel.requestVerifyCode(phoneNumber: phoneNumber)
+            print("send verify code result: \(result)")
+        } catch let err {
+            print("resend verify get error: \(err)")
+        }
+        // 重新计时
+        await self.startCountdown()
+    }
+    
+    // 重新倒计时
+    private func startCountdown() async {
+        self.isEnabled = false
+        self.remainingSeconds = 60
+        for sec in (1...self.remainingSeconds).reversed() {
+            self.remainingSeconds = sec
+            try? await Task.sleep(nanoseconds: 1_000_000_000)
+        }
+        self.isEnabled = true
+    }
+
+    // 提交验证码
+    private func submitVerifyCode(sessionId: Int) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        do {
+            _ = try await self.registerModel.submitVerifyCode(sessionId: sessionId, verifyCode: self.code)
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.registerModel.stage = .setPassword
+                self.registerModel.transitionEdge = .trailing
+            }
+        } catch let err as SDLAPIError {
+            self.showAlert = true
+            self.errorMessage = err.message
+        } catch let err {
+            self.showAlert = true
+            self.errorMessage = err.localizedDescription
+        }
+    }
+}
+
+// MARK: - 第三步：设置密码
+struct RegisterSetPasswordView: View {
+    @Environment(RegisterModel.self) var registerModel: RegisterModel
+    
+    @State private var password = ""
+    @State private var confirm = ""
+    @State private var isProcessing = false
+    
+    // 错误提示
+    @State private var showAlert: Bool = false
+    @State private var errorMessage: String = ""
+
+    // 提示错误信息
+    var passwordError: String? {
+        if password.isEmpty || confirm.isEmpty {
+            return nil
+        }
+        
+        if password != confirm {
+            return "两次输入的密码不一致"
+        }
+        if password.count < 8 {
+            return "密码至少需要 8 位"
+        }
+        return nil
+    }
+
+    var body: some View {
+        VStack(spacing: 24) {
+            headerSection(title: "设置安全密码", subtitle: "最后一步，请确保密码足够强大")
+
+            VStack(spacing: 12) {
+                PunchTextField(icon: "lock.shield", placeholder: "新密码", text: $password, isSecure: true)
+                PunchTextField(icon: "lock.shield", placeholder: "确认密码", text: $confirm, isSecure: true)
+                if let error = passwordError {
+                    Text(error)
+                        .font(.caption)
+                        .foregroundColor(.red)
+                        .frame(width: 280, alignment: .leading)
+                }
+            }
+            .frame(width: 280)
+
+            Button(action: {
+                Task { @MainActor in
+                    await self.handleRegister(sessionId: registerModel.sessionId)
+                }
+            }) {
+                if isProcessing {
+                    ProgressView()
+                        .controlSize(.small)
+                } else {
+                    Text("完成注册")
+                        .fontWeight(.medium)
+                        .frame(maxWidth: .infinity)
+                }
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .disabled(passwordError != nil)
+        }
+        .padding(40)
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+    }
+
+    private func handleRegister(sessionId: Int) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        do {
+            _ = try await self.registerModel.register(sessionId: sessionId, password: self.password)
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.registerModel.stage = .success
+                self.registerModel.transitionEdge = .trailing
+            }
+        } catch let err as SDLAPIError {
+            self.showAlert = true
+            self.errorMessage = err.message
+        } catch {
+            self.showAlert = true
+            self.errorMessage = "注册失败，重稍后重试"
+        }
+    }
+    
+}
+
+// MARK: 第四步 注册成功
+struct RegisterSuccessView: View {
+    @Environment(AppContext.self) private var appContext: AppContext
+    @Environment(RegisterModel.self) private var registerModel: RegisterModel
+
+    // MARK: - 动画状态
+    @State private var animateIcon: Bool = false // 用于呼吸灯效果
+    @State private var animateText: Bool = false // 用于文本延迟浮现
+
+    var body: some View {
+        VStack(spacing: 32) {
+            Spacer()
+            
+            // MARK: - 成功动画图标 (带呼吸灯效果)
+            ZStack {
+                // 外层呼吸圈
+                Circle()
+                    .fill(Color.green.opacity(0.1))
+                    .frame(width: 100, height: 100)
+                    // 呼吸逻辑：缩放和透明度变化
+                    .scaleEffect(animateIcon ? 1.1 : 0.95)
+                    .opacity(animateIcon ? 0.8 : 1.0)
+                
+                // 内层 Checkmark
+                Image(systemName: "checkmark.seal.fill")
+                    .font(.system(size: 56))
+                    .foregroundStyle(.green.gradient)
+                    // Checkmark 本身做轻微缩放
+                    .scaleEffect(animateIcon ? 1.05 : 1.0)
+            }
+            // 整个图标组的弹出动画
+            .transition(.move(edge: .bottom).combined(with: .opacity))
+            
+            // MARK: - 文本和按钮
+            VStack(spacing: 32) {
+                VStack(spacing: 12) {
+                    Text("注册成功")
+                        .font(.title.bold())
+                    
+                    Text("您的 PunchNet 账号已就绪。\n现在可以登录并开始构建您的私有网络了。")
+                        .font(.subheadline)
+                        .foregroundColor(.secondary)
+                        .multilineTextAlignment(.center)
+                }
+                
+                Button(action: {
+                    // 关闭当前注册窗口
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.appContext.appScene = .login(username: registerModel.phoneNumber)
+                    }
+                }) {
+                    Text("立即开始使用")
+                        .fontWeight(.bold)
+                        .frame(width: 200)
+                }
+                .buttonStyle(.borderedProminent)
+                .controlSize(.large)
+                .tint(.green)
+            }
+            // 文本和按钮比图标晚一点出现，形成层次感
+            .opacity(animateText ? 1.0 : 0.0)
+            .offset(y: animateText ? 0 : 20)
+        }
+        .padding(40)
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .background(Color(NSColor.windowBackgroundColor)) // 确保背景干净
+        .onAppear {
+            self.startAnimations()
+        }
+    }
+
+    // MARK: - 动画逻辑
+    private func startAnimations() {
+        // 1. 图标呼吸灯：无限循环，缓入缓出
+        withAnimation(.easeInOut(duration: 1.5).repeatForever(autoreverses: true)) {
+            animateIcon = true
+        }
+        
+        // 2. 文本延迟弹出：延迟 0.4 秒，使用弹簧效果
+        withAnimation(.spring(duration: 0.6, bounce: 0.3).delay(0.4)) {
+            animateText = true
+        }
+    }
+}
+
+// MARK: - 辅助视图
+extension View {
+    
+    func headerSection(title: String, subtitle: String) -> some View {
+        VStack(spacing: 8) {
+            Image(systemName: "shield.lefthalf.filled")
+                .font(.system(size: 42))
+                .foregroundStyle(.blue.gradient)
+            
+            Text(title)
+                .font(.title2.bold())
+            
+            Text(subtitle)
+                .font(.subheadline)
+                .foregroundColor(.secondary)
+                .multilineTextAlignment(.center)
+        }
+    }
+    
+}

punchnet/Features/Auth/Views/ResetPasswordView.swift

@@ -0,0 +1,391 @@
+//
+//  ResetPasswordView.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/9.
+//
+import SwiftUI
+import Observation
+
+// MARK: - 1. 根视图
+struct ResetPasswordRootView: View {
+    @State private var resetPasswordModel = ResetPasswordModel()
+    @Environment(AppContext.self) private var appContext: AppContext
+    
+    var body: some View {
+        ZStack(alignment: .center) {
+            Color.clear
+            
+            ZStack(alignment: .center) {
+                switch resetPasswordModel.stage {
+                case .requestVerifyCode:
+                    GetVerifyCodeView()
+                case .submitVerifyCode:
+                    SubmitVerifyCodeView()
+                case .resetPassword:
+                    ResetPasswordView()
+                case .success:
+                    ResetPasswordSuccessView()
+                }
+            }
+            .transition(.asymmetric(
+                insertion: .move(edge: resetPasswordModel.transitionEdge).combined(with: .opacity),
+                removal: .move(edge: resetPasswordModel.transitionEdge == .trailing ? .leading : .trailing).combined(with: .opacity)
+            ))
+        }
+        .environment(resetPasswordModel)
+        .overlay(alignment: .topLeading) {
+            // 仅在非成功页面显示返回按钮
+            if resetPasswordModel.stage != .success {
+                Button(action: {
+                    // 执行返回逻辑，例如重置到登录
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.appContext.appScene = .login(username: nil)
+                    }
+                }) {
+                    HStack {
+                        Image(systemName: "chevron.left")
+                            .font(.system(size: 16, weight: .semibold))
+                            .padding(5)
+                        
+                        Text("首页")
+                            .font(.system(size: 16, weight: .regular))
+                    }
+                    .contentShape(Rectangle()) // 扩大点击热区
+                }
+                .buttonStyle(.plain)
+                .padding([.top, .leading], 16) // 控制距离窗口边缘的边距
+                .transition(.opacity) // 按钮出现的动画
+            }
+        }
+    }
+}
+
+// MARK: - 2. 第一步：获取验证码
+struct GetVerifyCodeView: View {
+    @Environment(ResetPasswordModel.self) var resetPasswordModel
+    @State private var isProcessing = false
+    @State private var showAlert = false
+    @State private var errorMessage = ""
+
+    var body: some View {
+        @Bindable var model = resetPasswordModel
+        
+        VStack(spacing: 24) {
+            headerSection(title: "重置密码", subtitle: "请输入关联的手机号来验证身份")
+
+            PunchTextField(icon: "phone.fill", placeholder: "手机号", text: $model.phoneNumber)
+                .frame(width: 280)
+
+            Button {
+                Task { @MainActor in
+                    await self.sendVerifyCode(phoneNumber: model.phoneNumber)
+                }
+            } label: {
+                Text("获取验证码")
+                    .fontWeight(.medium)
+                    .frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .disabled(SDLUtil.identifyContact(model.phoneNumber) != .phone || isProcessing)
+        }
+        .padding(40)
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(errorMessage))
+        }
+    }
+
+    // 发送验证码
+    private func sendVerifyCode(phoneNumber: String) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        
+        do {
+            let resetSession = try await resetPasswordModel.requestVerifyCode(phoneNumber: phoneNumber)
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.resetPasswordModel.stage = .submitVerifyCode
+                self.resetPasswordModel.phoneNumber = phoneNumber
+                self.resetPasswordModel.sessionId = resetSession.sessionId
+                
+                self.resetPasswordModel.transitionEdge = .trailing
+            }
+        } catch {
+            self.errorMessage = error.localizedDescription
+            self.showAlert = true
+        }
+    }
+    
+}
+
+// MARK: - 3. 第二步：验证验证码
+struct SubmitVerifyCodeView: View {
+    @Environment(ResetPasswordModel.self) var resetPasswordModel: ResetPasswordModel
+    
+    @State private var code: String = ""
+    @State private var isProcessing = false
+    
+    // 重发逻辑
+    @State private var remainingSeconds = 60
+    @State private var isResendEnabled = false
+    
+    // 错误逻辑处理
+    @State private var showAlert = false
+    @State private var errorMessage = ""
+    
+    var validInputCode: Bool {
+        return !self.code.isEmpty && self.code.count == 6 && self.code.allSatisfy {$0.isNumber}
+    }
+
+    var body: some View {
+        VStack(spacing: 24) {
+            headerSection(title: "身份验证", subtitle: "验证码已发送至 \(self.resetPasswordModel.phoneNumber)")
+
+            VStack(alignment: .trailing, spacing: 16) {
+                PunchTextField(icon: "envelope.badge", placeholder: "输入 6 位验证码", text: $code)
+                
+                Button(isResendEnabled ? "重新获取" : "重新获取 (\(remainingSeconds)s)") {
+                    Task { @MainActor in
+                        await self.resendAction(phoneNumber: self.resetPasswordModel.phoneNumber)
+                    }
+                }
+                .buttonStyle(.link)
+                .font(.caption)
+                .disabled(!isResendEnabled)
+            }
+            .frame(width: 280)
+
+            VStack(spacing: 12) {
+                Button {
+                    Task { @MainActor in
+                        await self.submitAction(sessionId: self.resetPasswordModel.sessionId)
+                    }
+                } label: {
+                    Text("验证并继续")
+                        .fontWeight(.medium)
+                        .frame(maxWidth: .infinity)
+                }
+                .buttonStyle(.borderedProminent)
+                .controlSize(.large)
+                .disabled(!validInputCode)
+                
+                Button("返回上一步") {
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.resetPasswordModel.stage = .requestVerifyCode
+                        self.resetPasswordModel.transitionEdge = .leading
+                    }
+                }
+                .buttonStyle(.plain)
+                .foregroundColor(.secondary)
+            }
+            .frame(width: 280)
+        }
+        .padding(40)
+        .task {
+            await startCountdown()
+        }
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+    }
+
+    private func resendAction(phoneNumber: String) async {
+        _ = try? await resetPasswordModel.requestVerifyCode(phoneNumber: phoneNumber)
+        await startCountdown()
+    }
+
+    private func startCountdown() async {
+        self.isResendEnabled = false
+        self.remainingSeconds = 60
+        while remainingSeconds > 0 {
+            try? await Task.sleep(nanoseconds: 1_000_000_000)
+            self.remainingSeconds -= 1
+        }
+        self.isResendEnabled = true
+    }
+
+    private func submitAction(sessionId: Int) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        
+        do {
+            let result = try await resetPasswordModel.submitVerifyCode(sessionId: sessionId, verifyCode: code)
+            NSLog("reset password submit verify code result: \(result)")
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.resetPasswordModel.stage = .resetPassword
+                self.resetPasswordModel.transitionEdge = .trailing
+            }
+        } catch let err as SDLAPIError {
+            self.showAlert = true
+            self.errorMessage = err.message
+        } catch let err {
+            self.showAlert = true
+            self.errorMessage = err.localizedDescription
+        }
+    }
+    
+}
+
+// MARK: - 4. 第三步：重置密码
+struct ResetPasswordView: View {
+    @Environment(ResetPasswordModel.self) var resetPasswordModel: ResetPasswordModel
+    
+    @State private var password = ""
+    @State private var confirm = ""
+    @State private var isProcessing = false
+    
+    // 错误逻辑处理
+    @State private var showAlert = false
+    @State private var errorMessage = ""
+    
+    // 判断输入是否合法
+    var isInputValid: Bool {
+        !password.isEmpty && password == confirm && password.count >= 8
+    }
+    
+    // 提示错误信息
+    var passwordError: String? {
+        if password.isEmpty || confirm.isEmpty {
+            return nil
+        }
+        
+        if password != confirm {
+            return "两次输入的密码不一致"
+        }
+        
+        if password.count < 8 {
+            return "密码至少需要 8 位"
+        }
+        
+        return nil
+    }
+
+    var body: some View {
+        VStack(spacing: 24) {
+            headerSection(title: "设置新密码", subtitle: "请为手机号 \(self.resetPasswordModel.phoneNumber) 设置一个强密码")
+
+            VStack(spacing: 12) {
+                PunchTextField(icon: "lock.shield", placeholder: "新密码 (至少8位)", text: $password, isSecure: true)
+                PunchTextField(icon: "lock.shield", placeholder: "确认新密码", text: $confirm, isSecure: true)
+                
+                if let passwordError = self.passwordError {
+                    Text(passwordError)
+                        .font(.caption)
+                        .foregroundColor(.red)
+                        .frame(width: 280, alignment: .leading)
+                }
+            }
+            .frame(width: 280)
+            
+            Button {
+                Task { @MainActor in
+                    await self.handleReset(sessionId: self.resetPasswordModel.sessionId)
+                }
+            } label: {
+                Text("重置密码并登录")
+                    .fontWeight(.medium)
+                    .frame(maxWidth: .infinity)
+            }
+            .buttonStyle(.borderedProminent)
+            .controlSize(.large)
+            .frame(width: 280)
+            .disabled(!isInputValid || isProcessing)
+        }
+        .padding(40)
+        .alert(isPresented: $showAlert) {
+            Alert(title: Text("提示"), message: Text(self.errorMessage))
+        }
+    }
+
+    private func handleReset(sessionId: Int) async {
+        self.isProcessing = true
+        defer {
+            self.isProcessing = false
+        }
+        
+        do {
+            let result = try await resetPasswordModel.resetPassword(sessionId: sessionId, newPassword: password)
+            print("密码重置成功: \(result)")
+            withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                self.resetPasswordModel.stage = .success
+                self.resetPasswordModel.transitionEdge = .trailing
+            }
+        } catch {
+            self.showAlert = true
+            self.errorMessage = "重置失败, 请稍后重试"
+        }
+    }
+    
+}
+
+struct ResetPasswordSuccessView: View {
+    @Environment(AppContext.self) var appContext: AppContext
+    @Environment(ResetPasswordModel.self) var resetPasswordModel: ResetPasswordModel
+
+    // 动画状态
+    @State private var animateIcon = false
+    @State private var animateText = false
+
+    var body: some View {
+        VStack(spacing: 32) {
+            Spacer()
+            
+            // 成功图标 (使用蓝紫色调区别于注册的绿色)
+            ZStack {
+                Circle()
+                    .fill(Color.blue.opacity(0.1))
+                    .frame(width: 100, height: 100)
+                    .scaleEffect(animateIcon ? 1.1 : 0.95)
+                    .opacity(animateIcon ? 0.8 : 1.0)
+                
+                Image(systemName: "lock.circle.fill")
+                    .font(.system(size: 56))
+                    .foregroundStyle(.blue.gradient)
+                    .scaleEffect(animateIcon ? 1.05 : 1.0)
+            }
+            .transition(.move(edge: .bottom).combined(with: .opacity))
+            
+            VStack(spacing: 32) {
+                VStack(spacing: 12) {
+                    Text("密码重置成功")
+                        .font(.title2.bold())
+                    
+                    Text("您的新密码已生效。\n为了安全，建议您立即尝试使用新密码登录。")
+                        .font(.subheadline)
+                        .foregroundColor(.secondary)
+                        .multilineTextAlignment(.center)
+                }
+                
+                Button(action: {
+                    withAnimation(.spring(duration: 0.6, bounce: 0.2)) {
+                        self.appContext.appScene = .login(username: self.resetPasswordModel.phoneNumber)
+                    }
+                }) {
+                    Text("返回登录")
+                        .fontWeight(.bold)
+                        .frame(width: 200)
+                }
+                .buttonStyle(.borderedProminent)
+                .controlSize(.large)
+                .tint(.blue)
+            }
+            .opacity(animateText ? 1.0 : 0.0)
+            .offset(y: animateText ? 0 : 20)
+        }
+        .padding(40)
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .onAppear {
+            withAnimation(.easeInOut(duration: 1.5).repeatForever(autoreverses: true)) {
+                animateIcon = true
+            }
+            withAnimation(.spring(duration: 0.6, bounce: 0.3).delay(0.4)) {
+                animateText = true
+            }
+        }
+    }
+}

punchnet/Features/MenuBar/Views/MainMenuBar.swift

@@ -0,0 +1,80 @@
+//
+//  MainMenuBar.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/24.
+//
+
+import SwiftUI
+
+struct MainMenuBar: View {
+    @State private var vpnManager = VPNManager.shared
+    @Environment(AppContext.self) private var appContext: AppContext
+    @Environment(\.openWindow) private var openWindow
+
+    var body: some View {
+        VStack {
+            switch self.vpnManager.vpnStatus {
+            case .connected:
+                Button(action: {
+                    Task { @MainActor in
+                        try await appContext.stopTun()
+                    }
+                }, label: {
+                    Text("停止")
+                })
+            case .connecting:
+                Button(action: {
+                }, label: {
+                    Text("连接中...")
+                })
+                .disabled(true)
+            case .disconnecting:
+                Button(action: {
+                }, label: {
+                    Text("断开中...")
+                })
+                .disabled(true)
+            case .disconnected:
+                Button(action: {
+                    Task { @MainActor in
+                        await self.startVPN()
+                    }
+                }, label: {
+                    Text("启动")
+                })
+            }
+            
+            Divider()
+            
+            Button("打开控制面板") {
+                openWindow(id: "main")
+                NSApp.activate(ignoringOtherApps: true)
+            }
+            
+            SettingsLink {
+                Text("设置")
+            }
+            .buttonStyle(.plain)
+            
+            Divider()
+            
+            Button("退出应用") {
+                NSApplication.shared.terminate(nil)
+            }
+            
+        }
+    }
+    
+    private func startVPN() async {
+        do {
+            if appContext.networkContext == nil {
+                try await appContext.connectNetwork()
+            }
+            try await appContext.startTun()
+        } catch {
+            NSLog("menu start vpn failed: \(error)")
+        }
+    }
+    
+}

punchnet/Features/Network/NetworkService.swift

@@ -0,0 +1,34 @@
+//
+//  SDLAPIClient+Network.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/3/24.
+//
+import Foundation
+
+struct NetworkService {
+    
+    static func connectNetwork(accesToken: String) async throws -> NetworkContext {
+        let params: [String: Any] = [
+            "client_id": SystemConfig.getClientId(),
+            "access_token": accesToken
+        ]
+        
+        return try await SDLAPIClient.doPost(path: "/connect", params: params, as: NetworkContext.self)
+    }
+    
+    static func loadNodeResources(accesToken: String, id: Int) async -> [NetworkContext.Resource] {
+        let params: [String: Any] = [
+            "client_id": SystemConfig.getClientId(),
+            "access_token": accesToken,
+            "id": id
+        ]
+        
+        if let detail = try? await SDLAPIClient.doPost(path: "/get_node_resources", params: params, as: NetworkContext.NodeDetail.self) {
+            return detail.resourceList
+        }
+        
+        return []
+    }
+    
+}

punchnet/Features/Network/ViewModels/NetworkModel.swift

@@ -0,0 +1,393 @@
+//
+//  NetworkModel.swift
+//  punchnet
+//
+//  Created by 安礼成 on 2026/4/17.
+//
+import Foundation
+import Observation
+
+@MainActor
+@Observable
+final class NetworkModel {
+    @ObservationIgnored
+    private weak var appContext: AppContext?
+    
+    @ObservationIgnored
+    private let vpnManager = VPNManager.shared
+    
+    @ObservationIgnored
+    private var vpnStatusTask: Task<Void, Never>?
+    
+    var showMode: NetworkShowMode = .resource
+    var phase: NetworkConnectionPhase = .disconnected
+    
+    var networkSession: NetworkSession?
+    var networkContext: NetworkContext?
+    var selectedExitNodeIp: String?
+    var selectedNodeId: Int?
+    
+    private(set) var nodeResourcesById: [Int: [NetworkContext.Resource]] = [:]
+    private(set) var loadingNodeIDs: Set<Int> = []
+    private(set) var isUpdatingExitNode: Bool = false
+    private(set) var errorMessage: String?
+    
+    deinit {
+        self.vpnStatusTask?.cancel()
+    }
+    
+    var isBusy: Bool {
+        switch self.phase {
+        case .connecting, .disconnecting:
+            return true
+        case .connected, .disconnected:
+            return self.isUpdatingExitNode
+        }
+    }
+    
+    var isTunnelEnabled: Bool {
+        switch self.phase {
+        case .connecting, .connected:
+            return true
+        case .disconnecting, .disconnected:
+            return false
+        }
+    }
+    
+    var shouldShowModePicker: Bool {
+        self.phase == .connected
+    }
+    
+    var resourceList: [NetworkContext.Resource] {
+        self.networkContext?.resourceList ?? []
+    }
+    
+    var nodeList: [NetworkContext.Node] {
+        self.networkContext?.nodeList ?? []
+    }
+    
+    var selectedNode: NetworkContext.Node? {
+        self.networkContext?.getNode(id: self.selectedNodeId)
+    }
+    
+    var canSelectExitNode: Bool {
+        guard self.networkSession != nil else {
+            return false
+        }
+        
+        guard !self.isUpdatingExitNode else {
+            return false
+        }
+        
+        switch self.phase {
+        case .connected:
+            return self.networkContext != nil || self.selectedExitNodeIp != nil
+        case .disconnected:
+            return self.selectedExitNodeIp != nil
+        case .connecting, .disconnecting:
+            return false
+        }
+    }
+    
+    var exitNodeOptions: [ExitNodeOption] {
+        guard let networkContext = self.networkContext else {
+            return []
+        }
+        
+        return networkContext.exitNodeList.compactMap { exitNode in
+            guard let node = networkContext.getNode(id: exitNode.nnid) else {
+                return nil
+            }
+            
+            return ExitNodeOption(
+                id: exitNode.nnid,
+                nodeName: exitNode.nodeName,
+                ip: node.ip
+            )
+        }
+    }
+    
+    var selectedExitNode: ExitNodeOption? {
+        guard let selectedExitNodeIp = self.selectedExitNodeIp else {
+            return nil
+        }
+        
+        return self.exitNodeOptions.first(where: { $0.ip == selectedExitNodeIp })
+            ?? ExitNodeOption(
+                id: -1,
+                nodeName: "已保存出口节点",
+                ip: selectedExitNodeIp
+            )
+    }
+    
+    var exitNodeHelpText: String {
+        if self.isUpdatingExitNode {
+            return "正在更新出口节点"
+        }
+        
+        if self.networkContext == nil {
+            return "建立连接后可选择当前网络的出口节点"
+        }
+        
+        return "切换当前网络流量的出口节点，也可以保持未设置"
+    }
+    
+    func activate(appContext: AppContext) async {
+        if self.appContext !== appContext {
+            self.appContext = appContext
+        }
+        
+        self.startObservingVPNStatusIfNeeded()
+        await self.handleVPNStatusChange(self.vpnManager.vpnStatus)
+    }
+    
+    func clearError() {
+        self.errorMessage = nil
+    }
+    
+    func setConnectionEnabled(_ enabled: Bool) async {
+        if enabled {
+            await self.connect()
+        } else {
+            await self.disconnect()
+        }
+    }
+    
+    func connect() async {
+        guard let appContext = self.appContext else {
+            return
+        }
+        
+        guard !self.isBusy else {
+            return
+        }
+        
+        self.errorMessage = nil
+        self.phase = .connecting
+        
+        do {
+            if appContext.networkContext == nil {
+                try await appContext.connectNetwork()
+            }
+            
+            self.syncSharedStateFromAppContext()
+            await self.applyNetworkContext(appContext.networkContext)
+            try await appContext.startTun()
+            
+            if self.vpnManager.vpnStatus == .connected {
+                self.phase = .connected
+            }
+        } catch let err as SDLAPIError {
+            self.errorMessage = err.message
+            self.handleDisconnectedState(syncAppContext: true)
+        } catch let err as AppContextError {
+            self.errorMessage = err.message
+            self.handleDisconnectedState(syncAppContext: true)
+        } catch {
+            self.errorMessage = error.localizedDescription
+            self.handleDisconnectedState(syncAppContext: true)
+        }
+    }
+    
+    func disconnect() async {
+        guard let appContext = self.appContext else {
+            return
+        }
+        
+        guard !self.isBusy else {
+            return
+        }
+        
+        self.errorMessage = nil
+        self.phase = .disconnecting
+        
+        do {
+            try await appContext.stopTun()
+            self.handleDisconnectedState(syncAppContext: false)
+        } catch let err as AppContextError {
+            self.errorMessage = err.message
+            await self.handleVPNStatusChange(self.vpnManager.vpnStatus)
+        } catch {
+            self.errorMessage = error.localizedDescription
+            await self.handleVPNStatusChange(self.vpnManager.vpnStatus)
+        }
+    }
+    
+    func selectNode(id: Int?) {
+        self.selectedNodeId = id
+        
+        guard let id else {
+            return
+        }
+        
+        Task { @MainActor in
+            await self.loadResourcesIfNeeded(for: id)
+        }
+    }
+    
+    func resources(for nodeId: Int) -> [NetworkContext.Resource] {
+        self.nodeResourcesById[nodeId] ?? []
+    }
+    
+    func isLoadingResources(for nodeId: Int) -> Bool {
+        self.loadingNodeIDs.contains(nodeId)
+    }
+    
+    func loadResourcesIfNeeded(for nodeId: Int) async {
+        guard let session = self.networkSession else {
+            return
+        }
+        
+        guard self.nodeResourcesById[nodeId] == nil else {
+            return
+        }
+        
+        guard !self.loadingNodeIDs.contains(nodeId) else {
+            return
+        }
+        
+        let currentContextIdentity = self.contextIdentity(self.networkContext)
+        
+        self.loadingNodeIDs.insert(nodeId)
+        defer {
+            self.loadingNodeIDs.remove(nodeId)
+        }
+        
+        let resources = await NetworkService.loadNodeResources(accesToken: session.accessToken, id: nodeId)
+        
+        guard currentContextIdentity == self.contextIdentity(self.networkContext) else {
+            return
+        }
+        
+        self.nodeResourcesById[nodeId] = resources
+    }
+    
+    func updateExitNodeSelection(_ ip: String?) async {
+        guard let appContext = self.appContext else {
+            return
+        }
+        
+        guard !self.isUpdatingExitNode else {
+            return
+        }
+        
+        self.errorMessage = nil
+        self.isUpdatingExitNode = true
+        defer {
+            self.isUpdatingExitNode = false
+        }
+        
+        do {
+            try await appContext.updateExitNodeIp(exitNodeIp: ip)
+            self.syncSharedStateFromAppContext()
+        } catch let err as AppContextError {
+            self.errorMessage = err.message
+        } catch {
+            self.errorMessage = error.localizedDescription
+        }
+    }
+    
+    private func startObservingVPNStatusIfNeeded() {
+        guard self.vpnStatusTask == nil else {
+            return
+        }
+        
+        let vpnStatusStream = self.vpnManager.vpnStatusStream
+        
+        self.vpnStatusTask = Task { [weak self, vpnStatusStream] in
+            guard let self else {
+                return
+            }
+            
+            for await status in vpnStatusStream {
+                if Task.isCancelled {
+                    return
+                }
+                
+                await self.handleVPNStatusChange(status)
+            }
+        }
+    }
+    
+    private func syncSharedStateFromAppContext() {
+        self.networkSession = self.appContext?.networkSession
+        self.selectedExitNodeIp = self.appContext?.selectedExitNodeIp
+    }
+    
+    private func handleVPNStatusChange(_ status: VPNManager.VPNStatus) async {
+        self.syncSharedStateFromAppContext()
+        
+        switch status {
+        case .connecting:
+            self.phase = .connecting
+            await self.applyNetworkContext(self.appContext?.networkContext)
+        case .connected:
+            self.phase = .connected
+            await self.applyNetworkContext(self.appContext?.networkContext)
+        case .disconnecting:
+            self.phase = .disconnecting
+        case .disconnected:
+            self.handleDisconnectedState(syncAppContext: true)
+        }
+    }
+    
+    private func handleDisconnectedState(syncAppContext: Bool) {
+        if syncAppContext {
+            self.appContext?.networkContext = nil
+        }
+        
+        self.phase = .disconnected
+        self.networkContext = nil
+        self.selectedNodeId = nil
+        self.nodeResourcesById.removeAll()
+        self.loadingNodeIDs.removeAll()
+        self.showMode = .resource
+        self.syncSharedStateFromAppContext()
+    }
+    
+    private func applyNetworkContext(_ newContext: NetworkContext?) async {
+        let contextChanged = self.contextIdentity(self.networkContext) != self.contextIdentity(newContext)
+        
+        self.networkContext = newContext
+        
+        if contextChanged {
+            self.nodeResourcesById.removeAll()
+            self.loadingNodeIDs.removeAll()
+            self.selectedNodeId = nil
+        }
+        
+        guard let newContext else {
+            self.selectedNodeId = nil
+            return
+        }
+        
+        if let selectedNodeId = self.selectedNodeId,
+           newContext.getNode(id: selectedNodeId) != nil {
+            await self.loadResourcesIfNeeded(for: selectedNodeId)
+            return
+        }
+        
+        self.selectedNodeId = newContext.firstNodeId()
+        
+        if let selectedNodeId = self.selectedNodeId {
+            await self.loadResourcesIfNeeded(for: selectedNodeId)
+        }
+    }
+    
+    private func contextIdentity(_ context: NetworkContext?) -> String? {
+        guard let context else {
+            return nil
+        }
+        
+        return "\(context.identityId)-\(context.ip)"
+    }
+}
+
+extension NetworkModel {
+    struct ExitNodeOption: Identifiable, Equatable {
+        let id: Int
+        let nodeName: String
+        let ip: String
+    }
+
+}