Make regular linux tun code available on android

Previously android always used the same code which was an issue for
system services.

Signed-off-by: Lee Smet <lee.smet@hotmail.com>

Author: LeeSmet

mobile/Cargo.toml

@@ -19,6 +19,9 @@ once_cell = "1.21.1"
 serde_json = "1.0"
 
 [target.'cfg(target_os = "android")'.dependencies]
+# Android consumers (VpnService.Builder hands in a pre-configured fd) use the
+# fd-handoff TUN path. This feature enables that path in mycelium.
+mycelium = { path = "../mycelium", features = ["vendored-openssl", "androidtunfd"] }
 tracing-android = "0.2.0"
 
 [target.'cfg(target_os = "ios")'.dependencies]

mycelium-tun/Cargo.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2024"
 license-file = "../LICENSE"
 
-[target.'cfg(target_os = "linux")'.dependencies]
+[target.'cfg(any(target_os = "linux", target_os = "android"))'.dependencies]
 tokio = { version = "1.52.3", default-features = false, features = ["net"] }
 nix = { version = "0.31.3", features = ["ioctl", "net"] }
 libc = "0.2"

mycelium-tun/src/lib.rs

@@ -1,13 +1,15 @@
 //! Platform-specific TUN device implementations.
 //!
-//! Currently only Linux is supported. On other platforms this crate is empty.
+//! Linux and Android share the same implementation (Android is Linux + bionic
+//! and exposes the same `/dev/net/tun` uAPI). On other platforms this crate
+//! is empty.
 
-#[cfg(target_os = "linux")]
+#[cfg(any(target_os = "linux", target_os = "android"))]
 mod checksum;
-#[cfg(target_os = "linux")]
+#[cfg(any(target_os = "linux", target_os = "android"))]
 mod linux;
-#[cfg(target_os = "linux")]
+#[cfg(any(target_os = "linux", target_os = "android"))]
 mod offload;
 
-#[cfg(target_os = "linux")]
+#[cfg(any(target_os = "linux", target_os = "android"))]
 pub use linux::{ReadHalf, Tun, WriteHalf};

mycelium/Cargo.toml

@@ -12,6 +12,11 @@ vendored-openssl = ["openssl/vendored"]
 mactunfd = [
   "tun/appstore",
 ] #mactunfd is a flag to specify that macos should provide tun FD instead of tun name
+# androidtunfd is the Android equivalent of mactunfd: when enabled the caller
+# (typically an app using Android's VpnService) provides a pre-configured TUN
+# file descriptor. Default Android builds (e.g. a `cargo ndk` system-service
+# build) open and manage the TUN device themselves via the shared Linux path.
+androidtunfd = []
 # Build a C ABI surface (cdylib + staticlib + generated header) on top of the
 # core node. Used by external daemons that wrap libmycelium without depending
 # on Rust as a build dependency.
@@ -97,6 +102,8 @@ wintun = "0.5.1"
 [target.'cfg(target_os = "android")'.dependencies]
 tun = { git = "https://github.com/LeeSmet/rust-tun", features = ["async"] }
 libc = "0.2.186"
+nix = { version = "0.31.3", features = ["socket"] }
+mycelium-tun = { path = "../mycelium-tun" }
 
 [target.'cfg(target_os = "ios")'.dependencies]
 tun = { git = "https://github.com/LeeSmet/rust-tun", features = ["async"] }

mycelium/src/ffi/exports.rs

@@ -169,53 +169,40 @@ pub unsafe extern "C" fn mycelium_start(
         Err(_) => return std::ptr::null_mut(),
     };
 
-    #[cfg(not(any(target_os = "ios", all(target_os = "macos", feature = "mactunfd"))))]
+    #[cfg(not(any(
+        target_os = "ios",
+        all(target_os = "macos", feature = "mactunfd"),
+        all(target_os = "android", feature = "androidtunfd"),
+    )))]
     let tun_name = match cstr_to_str(cfg.tun_name, "tun_name") {
         Ok(s) => s.to_owned(),
         Err(_) => return std::ptr::null_mut(),
     };
 
     info!(peers = peers_strs.len(), "starting mycelium node");
 
-    let node_key = crypto::SecretKey::from(cfg.priv_key);
-
-    #[cfg(target_os = "android")]
-    let tun_fd = {
-        // MTU matches `LINK_MTU` in `mycelium/src/tun/android.rs`; the prefix
-        // length matches what `tun/linux.rs` uses, so the kernel installs the
-        // on-link route for the global mycelium subnet.
-        let node_addr = crypto::PublicKey::from(&node_key).address();
-        match crate::node_handle::create_tun_fd(
-            &tun_name,
-            node_addr,
-            crate::GLOBAL_SUBNET_PREFIX_LEN,
-            1400,
-        ) {
-            Ok(fd) => fd,
-            Err(e) => {
-                error!("Failed to create TUN fd: {e}");
-                error::set(format!("failed to create tun fd: {e}"));
-                return std::ptr::null_mut();
-            }
-        }
-    };
-    #[cfg(any(target_os = "ios", all(target_os = "macos", feature = "mactunfd")))]
+    #[cfg(any(
+        target_os = "ios",
+        all(target_os = "macos", feature = "mactunfd"),
+        all(target_os = "android", feature = "androidtunfd"),
+    ))]
     let tun_fd = cfg.tun_fd;
 
     let config = Config {
-        node_key,
+        node_key: crypto::SecretKey::from(cfg.priv_key),
         peers: endpoints,
         no_tun: false,
         #[cfg(any(
             target_os = "linux",
             all(target_os = "macos", not(feature = "mactunfd")),
-            target_os = "windows"
+            target_os = "windows",
+            all(target_os = "android", not(feature = "androidtunfd")),
         ))]
         tun_name,
         #[cfg(any(
-            target_os = "android",
             target_os = "ios",
             all(target_os = "macos", feature = "mactunfd"),
+            all(target_os = "android", feature = "androidtunfd"),
         ))]
         tun_fd: Some(tun_fd),
         tcp_listen_port: cfg.tcp_listen_port,

mycelium/src/lib.rs

@@ -84,7 +84,8 @@ pub struct Config<M> {
     #[cfg(any(
         target_os = "linux",
         all(target_os = "macos", not(feature = "mactunfd")),
-        target_os = "windows"
+        target_os = "windows",
+        all(target_os = "android", not(feature = "androidtunfd")),
     ))]
     pub tun_name: String,
 
@@ -97,14 +98,16 @@ pub struct Config<M> {
     /// Mark that's set on all packets that we send on the underlying network
     pub firewall_mark: Option<u32>,
 
-    // tun_fd is android, iOS, macos on appstore specific option
-    // We can't create TUN device from the Rust code in android, iOS, and macos on appstore.
-    // So, we create the TUN device on Kotlin(android) or Swift(iOS, macos) then pass
-    // the TUN's file descriptor to mycelium.
+    // tun_fd is the iOS / macos-appstore / android-VpnService option.
+    // We can't create the TUN device from Rust on iOS or macOS-appstore (the
+    // platform doesn't expose `/dev/net/tun` to the app). Android apps using
+    // `VpnService.Builder` are in the same situation — the framework hands
+    // back a ready fd. In these cases the TUN is created by Kotlin (android)
+    // or Swift (iOS, macOS) and the file descriptor is passed to mycelium.
     #[cfg(any(
-        target_os = "android",
         target_os = "ios",
         all(target_os = "macos", feature = "mactunfd"),
+        all(target_os = "android", feature = "androidtunfd"),
     ))]
     pub tun_fd: Option<i32>,
 
@@ -281,7 +284,8 @@ where
                 #[cfg(any(
                     target_os = "linux",
                     all(target_os = "macos", not(feature = "mactunfd")),
-                    target_os = "windows"
+                    target_os = "windows",
+                    all(target_os = "android", not(feature = "androidtunfd")),
                 ))]
                 let tun_config = TunConfig {
                     name: config.tun_name.clone(),
@@ -291,9 +295,9 @@ where
                         .expect("Static configured TUN route is valid; qed"),
                 };
                 #[cfg(any(
-                    target_os = "android",
                     target_os = "ios",
                     all(target_os = "macos", feature = "mactunfd"),
+                    all(target_os = "android", feature = "androidtunfd"),
                 ))]
                 let tun_config = TunConfig {
                     tun_fd: config.tun_fd.unwrap(),