Fully configure TUN interface in FFI Android path

LeeSmet · LeeSmet · commit 703e7fd49432 · 2026-06-05T13:06:43.000+02:00
The FFI's create_tun_fd only ran TUNSETIFF, but the downstream
tun/android.rs assumes the fd is fully configured (matching the
mobile/VpnService contract). Result: the interface had no IP, was
administratively down, and could not carry traffic.

Extend create_tun_fd to assign the node's IPv6 with the global subnet's
prefix length (installs the on-link 400::/7 route), set MTU 1400 to match
tun/android.rs's LINK_MTU, and bring the interface up via SIOCSIFFLAGS.
diff --git a/mycelium/src/ffi/exports.rs b/mycelium/src/ffi/exports.rs
@@ -177,20 +177,33 @@ pub unsafe extern "C" fn mycelium_start(
 
     info!(peers = peers_strs.len(), "starting mycelium node");
 
+    let node_key = crypto::SecretKey::from(cfg.priv_key);
+
     #[cfg(target_os = "android")]
-    let tun_fd = match crate::node_handle::create_tun_fd(&tun_name) {
-        Ok(fd) => fd,
-        Err(e) => {
-            error!("Failed to create TUN fd: {e}");
-            error::set(format!("failed to create tun fd: {e}"));
-            return std::ptr::null_mut();
+    let tun_fd = {
+        // MTU matches `LINK_MTU` in `mycelium/src/tun/android.rs`; the prefix
+        // length matches what `tun/linux.rs` uses, so the kernel installs the
+        // on-link route for the global mycelium subnet.
+        let node_addr = crypto::PublicKey::from(&node_key).address();
+        match crate::node_handle::create_tun_fd(
+            &tun_name,
+            node_addr,
+            crate::GLOBAL_SUBNET_PREFIX_LEN,
+            1400,
+        ) {
+            Ok(fd) => fd,
+            Err(e) => {
+                error!("Failed to create TUN fd: {e}");
+                error::set(format!("failed to create tun fd: {e}"));
+                return std::ptr::null_mut();
+            }
         }
     };
     #[cfg(any(target_os = "ios", all(target_os = "macos", feature = "mactunfd")))]
     let tun_fd = cfg.tun_fd;
 
     let config = Config {
-        node_key: crypto::SecretKey::from(cfg.priv_key),
+        node_key,
         peers: endpoints,
         no_tun: false,
         #[cfg(any(
diff --git a/mycelium/src/node_handle.rs b/mycelium/src/node_handle.rs
@@ -38,15 +38,30 @@ impl std::error::Error for NodeError {}
 
 // ── TUN setup (Android only) ────────────────────────────────────────────────
 
-/// On Android the `tun` crate expects an already-opened file descriptor.
-/// This function opens `/dev/tun`, configures the interface with TUNSETIFF,
-/// and returns the raw fd. Requires `CAP_NET_ADMIN`.
+/// Open and fully configure a TUN file descriptor on Android.
+///
+/// The `tun/android.rs` data-plane code expects an already-configured fd
+/// (the same contract the `mobile/` crate satisfies via `VpnService.Builder`).
+/// For the FFI path there is no VpnService doing that work, so this function
+/// does it: opens `/dev/tun`, sets `IFF_TUN | IFF_NO_PI` via `TUNSETIFF`,
+/// assigns `node_addr` with `prefix_len` (`/7` causes the kernel to install
+/// the on-link route for the global mycelium subnet), sets the MTU, and
+/// brings the interface up.
+///
+/// Requires `CAP_NET_ADMIN`.
 #[cfg(target_os = "android")]
-pub fn create_tun_fd(tun_name: &str) -> Result<i32, std::io::Error> {
+pub fn create_tun_fd(
+    tun_name: &str,
+    node_addr: std::net::Ipv6Addr,
+    prefix_len: u8,
+    mtu: i32,
+) -> Result<i32, std::io::Error> {
     const TUNSETIFF: libc::c_ulong = 0x400454ca;
     const IFF_TUN: libc::c_short = 0x0001;
     const IFF_NO_PI: libc::c_short = 0x1000;
 
+    // SAFETY: the path is a static NUL-terminated byte string; `open` has no
+    // other preconditions.
     let fd = unsafe { libc::open(b"/dev/tun\0".as_ptr() as *const libc::c_char, libc::O_RDWR) };
     if fd < 0 {
         return Err(std::io::Error::last_os_error());
@@ -60,16 +75,117 @@ pub fn create_tun_fd(tun_name: &str) -> Result<i32, std::io::Error> {
     ifr[16] = (flags & 0xff) as u8;
     ifr[17] = ((flags >> 8) & 0xff) as u8;
 
+    // SAFETY: `fd` is a valid file descriptor that we just opened. `ifr` is a
+    // 40-byte buffer matching the kernel's `struct ifreq` layout, with name
+    // bytes (offset 0..15), a NUL terminator (offset 15, left at zero), and
+    // `ifr_flags` (offset 16..18) populated; remaining bytes are zero, which
+    // is what TUNSETIFF expects for unused union members.
     let ret = unsafe { libc::ioctl(fd, TUNSETIFF as i32, ifr.as_ptr()) };
     if ret < 0 {
         let err = std::io::Error::last_os_error();
+        // SAFETY: `fd` is the open fd from the `open` call above; nothing else
+        // can reference it because it has not escaped this function.
         unsafe { libc::close(fd) };
         return Err(err);
     }
 
+    if let Err(e) = configure_tun_interface(tun_name, node_addr, prefix_len, mtu) {
+        // SAFETY: `fd` is the open fd from the `open` call above; nothing else
+        // can reference it because it has not escaped this function.
+        unsafe { libc::close(fd) };
+        return Err(e);
+    }
+
     Ok(fd)
 }
 
+/// Assign address, set MTU and bring the named interface up via an
+/// `AF_INET6` control socket. `SIOCSIFADDR` for IPv6 requires `AF_INET6`.
+#[cfg(target_os = "android")]
+fn configure_tun_interface(
+    tun_name: &str,
+    node_addr: std::net::Ipv6Addr,
+    prefix_len: u8,
+    mtu: i32,
+) -> std::io::Result<()> {
+    // SAFETY: `socket(2)` has no preconditions; the arguments are valid
+    // constants exported by libc.
+    let sock = unsafe { libc::socket(libc::AF_INET6, libc::SOCK_DGRAM, 0) };
+    if sock < 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+
+    let result = (|| -> std::io::Result<()> {
+        // SAFETY: `libc::ifreq` is a `repr(C)` aggregate of POD types and a
+        // C union; the all-zero bit pattern is a valid value of every
+        // variant (the union members are all integers or fixed-size byte
+        // arrays), and the kernel ignores fields not consumed by the
+        // specific ioctl request.
+        let mut ifr: libc::ifreq = unsafe { std::mem::zeroed() };
+        let name_bytes = tun_name.as_bytes();
+        let copy_len = name_bytes.len().min(libc::IFNAMSIZ - 1);
+        for (dst, &src) in ifr.ifr_name[..copy_len].iter_mut().zip(name_bytes) {
+            *dst = src as libc::c_char;
+        }
+
+        // SAFETY: `sock` is a valid socket fd opened above; `ifr` is fully
+        // initialised with the interface name in `ifr_name` (NUL-terminated:
+        // we copied at most IFNAMSIZ-1 bytes into a zero-initialised buffer)
+        // — the layout expected by SIOCGIFINDEX.
+        if unsafe { libc::ioctl(sock, libc::SIOCGIFINDEX as _, &mut ifr) } < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+        // SAFETY: SIOCGIFINDEX populates the `ifru_ifindex` union variant on
+        // success; the ioctl returned >= 0 above.
+        let ifindex = unsafe { ifr.ifr_ifru.ifru_ifindex };
+
+        let ifr6 = libc::in6_ifreq {
+            ifr6_addr: libc::in6_addr {
+                s6_addr: node_addr.octets(),
+            },
+            ifr6_prefixlen: prefix_len as u32,
+            ifr6_ifindex: ifindex,
+        };
+        // SAFETY: `sock` is a valid AF_INET6 socket fd (required for IPv6
+        // SIOCSIFADDR); `ifr6` is a fully initialised `in6_ifreq` with the
+        // address, prefix length, and interface index expected by the ioctl.
+        if unsafe { libc::ioctl(sock, libc::SIOCSIFADDR as _, &ifr6) } < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        ifr.ifr_ifru.ifru_mtu = mtu;
+        // SAFETY: `sock` is a valid socket fd; `ifr` has the interface name
+        // set in `ifr_name` and the MTU written into the `ifru_mtu` union
+        // variant — the layout SIOCSIFMTU expects.
+        if unsafe { libc::ioctl(sock, libc::SIOCSIFMTU as _, &ifr) } < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        // SAFETY: `sock` is a valid socket fd; `ifr_name` is still set from
+        // the SIOCGIFINDEX call above (the kernel only writes the `ifr_ifru`
+        // union on success, leaving `ifr_name` intact).
+        if unsafe { libc::ioctl(sock, libc::SIOCGIFFLAGS as _, &mut ifr) } < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+        // SAFETY: SIOCGIFFLAGS populates the `ifru_flags` union variant on
+        // success; the ioctl returned >= 0 above.
+        ifr.ifr_ifru.ifru_flags = unsafe { ifr.ifr_ifru.ifru_flags } | libc::IFF_UP as libc::c_short;
+        // SAFETY: `sock` is a valid socket fd; `ifr` has the interface name
+        // set and the updated flags written into the `ifru_flags` union
+        // variant.
+        if unsafe { libc::ioctl(sock, libc::SIOCSIFFLAGS as _, &ifr) } < 0 {
+            return Err(std::io::Error::last_os_error());
+        }
+
+        Ok(())
+    })();
+
+    // SAFETY: `sock` is the fd from the `socket` call above; it has not
+    // escaped this function and is no longer used.
+    unsafe { libc::close(sock) };
+    result
+}
+
 // ── NodeHandle ──────────────────────────────────────────────────────────────
 
 /// Upper bound on how long node teardown waits for the background Tokio
