//go:build linux

package tailcore

import (
	wgtun "github.com/tailscale/wireguard-go/tun"
)

// makeTUN wraps the OS-provided VpnService fd as a wireguard-go device using the Android-safe entry
// point. The Linux CreateTUNFromFile would createNetlinkSocket() + setMTU() — both CAP_NET_ADMIN, which
// an unprivileged Android app is DENIED (fails as "tun from fd: permission denied"). Android's OS owns
// routes + MTU via VpnService.Builder, so the core must not touch them. CreateUnmonitoredTUNFromFD skips
// netlink + MTU and uses only the read-only TUNGETIFF ioctl, which a VpnService fd permits — the same
// path the official tailscale-android client takes.
func makeTUN(fd int32) (wgtun.Device, error) {
	dev, _, err := wgtun.CreateUnmonitoredTUNFromFD(int(fd))
	return dev, err
}