Update nix to 0.30 everywhere

24 files changed, 105 insertions, 80 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 4af995fc7b..58f435756f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -735,7 +735,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
 dependencies = [
  "lazy_static",
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2901,7 +2901,7 @@ dependencies = [
  "mullvad-types",
  "mullvad-version",
  "natord",
- "nix 0.29.0",
+ "nix 0.30.1",
  "serde",
  "serde_json",
  "talpid-types",
@@ -2940,7 +2940,7 @@ dependencies = [
  "mullvad-types",
  "mullvad-update",
  "mullvad-version",
- "nix 0.23.2",
+ "nix 0.30.1",
  "notify 8.0.0",
  "objc2",
  "rand 0.8.5",
@@ -2984,7 +2984,7 @@ dependencies = [
 name = "mullvad-exclude"
 version = "0.0.0"
 dependencies = [
- "nix 0.23.2",
+ "nix 0.30.1",
  "talpid-types",
  "thiserror 2.0.9",
 ]
@@ -3039,7 +3039,6 @@ dependencies = [
  "mullvad-daemon",
  "mullvad-problem-report",
  "mullvad-types",
- "nix 0.23.2",
  "rand 0.8.5",
  "talpid-platform-metadata",
  "talpid-tunnel",
@@ -3057,7 +3056,7 @@ dependencies = [
  "env_logger 0.11.7",
  "futures",
  "log",
- "nix 0.29.0",
+ "nix 0.30.1",
  "pnet_packet 0.35.0",
  "reqwest",
  "serde",
@@ -3077,7 +3076,7 @@ dependencies = [
  "log",
  "mullvad-paths",
  "mullvad-types",
- "nix 0.23.2",
+ "nix 0.30.1",
  "parity-tokio-ipc",
  "prost 0.13.3",
  "prost-types 0.13.3",
@@ -3446,7 +3445,6 @@ dependencies = [
  "cfg-if",
  "cfg_aliases 0.1.1",
  "libc",
- "memoffset 0.9.1",
 ]
 
 [[package]]
@@ -3459,6 +3457,18 @@ dependencies = [
  "cfg-if",
  "cfg_aliases 0.2.1",
  "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.9.0",
+ "cfg-if",
+ "cfg_aliases 0.2.1",
+ "libc",
  "memoffset 0.9.1",
 ]
 
@@ -5328,8 +5338,7 @@ dependencies = [
  "memoffset 0.6.5",
  "mnl",
  "nftnl",
- "nix 0.23.2",
- "nix 0.28.0",
+ "nix 0.30.1",
  "once_cell",
  "parking_lot",
  "pcap",
@@ -5406,7 +5415,7 @@ version = "0.0.0"
 dependencies = [
  "libc",
  "log",
- "nix 0.29.0",
+ "nix 0.30.1",
  "socket2 0.5.8",
  "talpid-types",
  "thiserror 2.0.9",
@@ -5483,7 +5492,7 @@ dependencies = [
  "log",
  "netlink-packet-route",
  "netlink-sys",
- "nix 0.28.0",
+ "nix 0.30.1",
  "rtnetlink",
  "system-configuration",
  "talpid-types",
@@ -5498,7 +5507,7 @@ dependencies = [
 name = "talpid-time"
 version = "0.0.0"
 dependencies = [
- "nix 0.29.0",
+ "nix 0.30.1",
  "tokio",
 ]
 
@@ -5589,7 +5598,7 @@ dependencies = [
  "netlink-packet-route",
  "netlink-packet-utils",
  "netlink-proto",
- "nix 0.23.2",
+ "nix 0.30.1",
  "once_cell",
  "parking_lot",
  "proptest",
@@ -6124,7 +6133,7 @@ dependencies = [
  "async-trait",
  "log",
  "mullvad-masque-proxy",
- "nix 0.23.2",
+ "nix 0.30.1",
  "shadowsocks",
  "thiserror 2.0.9",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index 3d59907286..47359e3cf3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -94,6 +94,7 @@ once_cell = "1.16"
 serde = "1.0.204"
 serde_json = "1.0.122"
 windows-sys = "0.52.0"
+nix = "0.30.1"
 
 # Networking
 pnet_packet = "0.35.0"
diff --git a/mullvad-cli/Cargo.toml b/mullvad-cli/Cargo.toml
index 70e7a63e1a..f777e08ed7 100644
--- a/mullvad-cli/Cargo.toml
+++ b/mullvad-cli/Cargo.toml
@@ -34,7 +34,7 @@ serde_json = { workspace = true }
 
 [target.'cfg(all(unix, not(target_os = "android")))'.dependencies]
 clap_complete = { version = "4.4.8" }
-nix = { version = "0.29.0", features = ["signal"] }
+nix = { workspace = true, features = ["signal"] }
 
 [target.'cfg(windows)'.build-dependencies]
 winres = "0.1"
diff --git a/mullvad-daemon/Cargo.toml b/mullvad-daemon/Cargo.toml
index d2fd29acea..7921bf9c2c 100644
--- a/mullvad-daemon/Cargo.toml
+++ b/mullvad-daemon/Cargo.toml
@@ -64,7 +64,7 @@ android_logger = "0.8"
 hickory-resolver = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
-nix = "0.23"
+nix = { workspace = true, features = ["signal", "user"] }
 simple-signal = "1.1"
 
 [target.'cfg(target_os="linux")'.dependencies]
diff --git a/mullvad-exclude/Cargo.toml b/mullvad-exclude/Cargo.toml
index e758aae58e..1507e0cce7 100644
--- a/mullvad-exclude/Cargo.toml
+++ b/mullvad-exclude/Cargo.toml
@@ -11,6 +11,6 @@ rust-version.workspace = true
 workspace = true
 
 [target.'cfg(target_os = "linux")'.dependencies]
-nix = "0.23"
+nix = { workspace = true, features = ["process", "user"] }
 thiserror = { workspace = true }
 talpid-types = { path = "../talpid-types" }
diff --git a/mullvad-jni/Cargo.toml b/mullvad-jni/Cargo.toml
index 9de530c4d9..92e55f87e6 100644
--- a/mullvad-jni/Cargo.toml
+++ b/mullvad-jni/Cargo.toml
@@ -27,7 +27,6 @@ ipnetwork = { workspace = true }
 jnix = { version = "0.5.1", features = ["derive"] }
 log = { workspace = true }
 log-panics = "2"
-nix = "0.23"
 rand = "0.8.5"
 
 mullvad-api = { path = "../mullvad-api" }
diff --git a/mullvad-leak-checker/Cargo.toml b/mullvad-leak-checker/Cargo.toml
index b60fb59673..6e5a8af832 100644
--- a/mullvad-leak-checker/Cargo.toml
+++ b/mullvad-leak-checker/Cargo.toml
@@ -28,7 +28,7 @@ env_logger = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
 pnet_packet.workspace = true
-nix = { version = "0.29.0", features = ["net", "socket", "uio"] }
+nix = { workspace = true, features = ["net", "socket", "uio"] }
 
 [target.'cfg(windows)'.dependencies]
 windows-sys = { workspace = true, features = ["Win32_NetworkManagement_Ndis"] }
diff --git a/mullvad-leak-checker/src/traceroute/unix/linux.rs b/mullvad-leak-checker/src/traceroute/unix/linux.rs
index 15894e8eac..9713595482 100644
--- a/mullvad-leak-checker/src/traceroute/unix/linux.rs
+++ b/mullvad-leak-checker/src/traceroute/unix/linux.rs
@@ -313,7 +313,7 @@ impl<'a, S> RecvPacket<'a, S> {
 fn recvmsg_with_control_message<'a, S: SockaddrLike + Copy>(
     socket: RawFd,
     io_vec: &'a mut [IoSliceMut<'_>; 1],
-    control_buf: &mut Vec<u8>,
+    control_buf: &mut [u8],
 ) -> anyhow::Result<Option<RecvPacket<'a, S>>> {
     // MSG_ERRQUEUE asks linux to tell us if we get any ICMP error replies to
     // our Echo packets.
diff --git a/mullvad-management-interface/Cargo.toml b/mullvad-management-interface/Cargo.toml
index 54a3f496ce..e502ddeecf 100644
--- a/mullvad-management-interface/Cargo.toml
+++ b/mullvad-management-interface/Cargo.toml
@@ -28,7 +28,7 @@ tokio = { workspace = true, features =  ["rt"] }
 parity-tokio-ipc = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
-nix = "0.23"
+nix = { workspace = true, features = ["user", "fs"] }
 
 [build-dependencies]
 tonic-build = { workspace = true, default-features = false, features = ["transport", "prost"] }
diff --git a/talpid-core/Cargo.toml b/talpid-core/Cargo.toml
index 4a11e9125d..a0481cfa27 100644
--- a/talpid-core/Cargo.toml
+++ b/talpid-core/Cargo.toml
@@ -37,7 +37,7 @@ triggered = "0.1.1"
 jnix = { version = "0.5.1", features = ["derive"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-nix = "0.23"
+nix = { workspace = true, features = ["mount"] }
 inotify = "0.10"
 resolv-conf = "0.7"
 nftnl = { version = "0.7.0", features = ["nftnl-1-1-0"] }
@@ -57,7 +57,7 @@ talpid-platform-metadata = { path = "../talpid-platform-metadata" }
 pcap = { version = "2.1", features = ["capture-stream"] }
 pnet_packet = { workspace = true }
 tun = { workspace = true, features = ["async"] }
-nix = { version = "0.28", features = ["socket", "signal", "user"] }
+nix = { workspace = true, features = ["socket", "signal", "user"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 socket2 = { workspace = true }
diff --git a/talpid-net/Cargo.toml b/talpid-net/Cargo.toml
index 485eaa37d0..ec4f795b40 100644
--- a/talpid-net/Cargo.toml
+++ b/talpid-net/Cargo.toml
@@ -16,4 +16,4 @@ talpid-types = { path = "../talpid-types" }
 socket2 = { workspace = true, features = ["all"] }
 log = { workspace = true }
 thiserror = { workspace = true }
-nix = { version = "0.29", features = ["net"] }
+nix = { workspace = true, features = ["net"] }
diff --git a/talpid-routing/Cargo.toml b/talpid-routing/Cargo.toml
index b4d3e2a747..b46a925488 100644
--- a/talpid-routing/Cargo.toml
+++ b/talpid-routing/Cargo.toml
@@ -28,7 +28,7 @@ netlink-packet-route = { version = "0.13", features = ["rich_nlas"] }
 netlink-sys = "0.8.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
-nix = { version = "0.28", features = ["socket", "fs", "net"] }
+nix = { workspace = true, features = ["socket", "fs", "net"] }
 libc = "0.2"
 bitflags = "2"
 system-configuration = "0.5.1"
diff --git a/talpid-routing/src/unix/macos/routing_socket.rs b/talpid-routing/src/unix/macos/routing_socket.rs
index cfa0f0973f..aa2b6a957a 100644
--- a/talpid-routing/src/unix/macos/routing_socket.rs
+++ b/talpid-routing/src/unix/macos/routing_socket.rs
@@ -158,10 +158,7 @@ struct RoutingSocketInner {
 impl RoutingSocketInner {
     fn new() -> io::Result<Self> {
         let fd = socket(AddressFamily::Route, SockType::Raw, SockFlag::empty(), None)?;
-        let _ = fcntl::fcntl(
-            fd.as_raw_fd(),
-            fcntl::FcntlArg::F_SETFL(fcntl::OFlag::O_NONBLOCK),
-        )?;
+        let _ = fcntl::fcntl(&fd, fcntl::FcntlArg::F_SETFL(fcntl::OFlag::O_NONBLOCK))?;
         let socket = File::from(fd);
         Ok(Self {
             socket: AsyncFd::new(socket)?,
diff --git a/talpid-time/Cargo.toml b/talpid-time/Cargo.toml
index 48742abbf3..3b79e3f073 100644
--- a/talpid-time/Cargo.toml
+++ b/talpid-time/Cargo.toml
@@ -19,4 +19,4 @@ test = []
 tokio = { workspace = true, features = ["time"] }
 
 [target.'cfg(unix)'.dependencies]
-nix = { version = "0.29", features = ["time"] }
+nix = { workspace = true, features = ["time"] }
diff --git a/talpid-tunnel/src/tun_provider/android/mod.rs b/talpid-tunnel/src/tun_provider/android/mod.rs
index 92e7e73739..7eca3dbba2 100644
--- a/talpid-tunnel/src/tun_provider/android/mod.rs
+++ b/talpid-tunnel/src/tun_provider/android/mod.rs
@@ -13,7 +13,10 @@ use jnix::{
 };
 use std::{
     net::IpAddr,
-    os::unix::io::{AsRawFd, RawFd},
+    os::{
+        fd::{AsFd, BorrowedFd},
+        unix::io::{AsRawFd, RawFd},
+    },
     sync::Arc,
 };
 use talpid_routing::Route;
@@ -433,6 +436,16 @@ impl AsRawFd for VpnServiceTun {
     }
 }
 
+impl AsFd for VpnServiceTun {
+    fn as_fd(&self) -> BorrowedFd<'_> {
+        // TODO: ensure we uphold the safety requirements of BorrowedFd
+        #[allow(clippy::undocumented_unsafe_blocks)]
+        unsafe {
+            BorrowedFd::borrow_raw(self.as_raw_fd())
+        }
+    }
+}
+
 #[derive(FromJava)]
 #[jnix(package = "net.mullvad.talpid.model")]
 enum CreateTunResult {
diff --git a/talpid-tunnel/src/tun_provider/unix.rs b/talpid-tunnel/src/tun_provider/unix.rs
index 0cee5328c0..82b87fc666 100644
--- a/talpid-tunnel/src/tun_provider/unix.rs
+++ b/talpid-tunnel/src/tun_provider/unix.rs
@@ -7,7 +7,13 @@ mod tun05_imp {
     use std::{
         net::IpAddr,
         ops::Deref,
-        os::unix::io::{AsRawFd, RawFd},
+        os::{
+            fd::AsFd,
+            unix::{
+                io::{AsRawFd, RawFd},
+                prelude::BorrowedFd,
+            },
+        },
         process::Command,
     };
     use tun::{Configuration, Device};
@@ -99,6 +105,12 @@ mod tun05_imp {
         }
     }
 
+    impl AsFd for UnixTun {
+        fn as_fd(&self) -> BorrowedFd<'_> {
+            self.deref().as_fd()
+        }
+    }
+
     /// A tunnel device
     pub struct TunnelDevice {
         dev: tun::AsyncDevice,
@@ -140,6 +152,16 @@ mod tun05_imp {
         }
     }
 
+    impl AsFd for TunnelDevice {
+        fn as_fd(&self) -> BorrowedFd<'_> {
+            // TODO: make sure we uphold safety requirements of BorrowedFd
+            #[allow(clippy::undocumented_unsafe_blocks)]
+            unsafe {
+                BorrowedFd::borrow_raw(self.as_raw_fd())
+            }
+        }
+    }
+
     impl AsRawFd for TunnelDevice {
         fn as_raw_fd(&self) -> RawFd {
             self.dev.get_ref().as_raw_fd()
diff --git a/talpid-wireguard/Cargo.toml b/talpid-wireguard/Cargo.toml
index 5e7cbec526..8784837888 100644
--- a/talpid-wireguard/Cargo.toml
+++ b/talpid-wireguard/Cargo.toml
@@ -49,7 +49,7 @@ git = "https://github.com/mullvad/boringtun"
 rev = "c29681df54e1c10ba06d9ca7ff98722c9dcb5a81"
 
 [target.'cfg(unix)'.dependencies]
-nix = "0.23"
+nix = { workspace = true, features = ["fs"] }
 libc = "0.2.150"
 
 [target.'cfg(any(target_os = "linux", target_os = "macos"))'.dependencies]
diff --git a/talpid-wireguard/src/boringtun/mod.rs b/talpid-wireguard/src/boringtun/mod.rs
index 7482a26301..0c465cba49 100644
--- a/talpid-wireguard/src/boringtun/mod.rs
+++ b/talpid-wireguard/src/boringtun/mod.rs
@@ -299,8 +299,8 @@ pub fn get_tunnel_for_userspace(
             .open_tun()
             .map_err(TunnelError::SetupTunnelDevice)?;
 
-        match nix::unistd::dup(tunnel_device.as_raw_fd()) {
-            Ok(fd) => return Ok((tunnel_device, fd)),
+        match nix::unistd::dup(&tunnel_device) {
+            Ok(fd) => return Ok((tunnel_device, fd.as_raw_fd())),
             #[cfg(not(target_os = "macos"))]
             Err(error @ nix::errno::Errno::EBADFD) => last_error = Some(error),
             Err(error @ nix::errno::Errno::EBADF) => last_error = Some(error),
diff --git a/talpid-wireguard/src/mtu_detection.rs b/talpid-wireguard/src/mtu_detection.rs
index 11c6625f2c..1f270c66ca 100644
--- a/talpid-wireguard/src/mtu_detection.rs
+++ b/talpid-wireguard/src/mtu_detection.rs
@@ -112,10 +112,14 @@ async fn detect_mtu(
     #[cfg(target_os = "macos")]
     {
         use nix::sys::socket::{setsockopt, sockopt};
-        let fd = client.get_socket().get_native_sock();
+        use std::os::fd::BorrowedFd;
+
+        // SAFETY: `surge_ping` promises that the socket is open, and won't close as long as we
+        // hold on to `client`.
+        let fd = unsafe { BorrowedFd::borrow_raw(client.get_socket().get_native_sock()) };
         let buf_size = linspace.iter().map(|sz| usize::from(*sz)).sum();
-        setsockopt(fd, sockopt::SndBuf, &buf_size).map_err(Error::MtuSetBufferSize)?;
-        setsockopt(fd, sockopt::RcvBuf, &buf_size).map_err(Error::MtuSetBufferSize)?;
+        setsockopt(&fd, sockopt::SndBuf, &buf_size).map_err(Error::MtuSetBufferSize)?;
+        setsockopt(&fd, sockopt::RcvBuf, &buf_size).map_err(Error::MtuSetBufferSize)?;
     }
 
     // Shared buffer to reduce allocations
diff --git a/talpid-wireguard/src/wireguard_go/mod.rs b/talpid-wireguard/src/wireguard_go/mod.rs
index ced16ab9d3..5b172c4f47 100644
--- a/talpid-wireguard/src/wireguard_go/mod.rs
+++ b/talpid-wireguard/src/wireguard_go/mod.rs
@@ -18,7 +18,7 @@ use std::borrow::Cow;
 #[cfg(daita)]
 use std::ffi::CString;
 #[cfg(unix)]
-use std::os::unix::io::{AsRawFd, RawFd};
+use std::os::unix::io::AsRawFd;
 #[cfg(unix)]
 use std::sync::{Arc, Mutex};
 use std::{
@@ -334,7 +334,7 @@ impl WgGoTunnel {
         let handle = wireguard_go_rs::Tunnel::turn_on(
             mtu,
             &wg_config_str,
-            tunnel_fd,
+            tunnel_fd.as_raw_fd(),
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
@@ -447,7 +447,7 @@ impl WgGoTunnel {
         tun_provider: Arc<Mutex<TunProvider>>,
         config: &Config,
         #[cfg(not(target_os = "android"))] routes: impl Iterator<Item = IpNetwork>,
-    ) -> Result<(Tun, RawFd)> {
+    ) -> Result<(Tun, std::os::fd::OwnedFd)> {
         let mut last_error = None;
         let mut tun_provider = tun_provider.lock().unwrap();
 
@@ -486,7 +486,7 @@ impl WgGoTunnel {
                 .open_tun()
                 .map_err(TunnelError::SetupTunnelDevice)?;
 
-            match nix::unistd::dup(tunnel_device.as_raw_fd()) {
+            match nix::unistd::dup(&tunnel_device) {
                 Ok(fd) => return Ok((tunnel_device, fd)),
                 #[cfg(not(target_os = "macos"))]
                 Err(error @ nix::errno::Errno::EBADFD) => last_error = Some(error),
@@ -529,7 +529,7 @@ impl WgGoTunnel {
 
         let handle = wireguard_go_rs::Tunnel::turn_on(
             &wg_config_str,
-            tunnel_fd,
+            tunnel_fd.as_raw_fd(),
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
@@ -611,7 +611,7 @@ impl WgGoTunnel {
             &exit_config_str,
             &entry_config_str,
             &private_ip,
-            tunnel_fd,
+            tunnel_fd.as_raw_fd(),
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
diff --git a/test/Cargo.lock b/test/Cargo.lock
index dee10ed1cb..0c6560ef46 100644
--- a/test/Cargo.lock
+++ b/test/Cargo.lock
@@ -2009,15 +2009,6 @@ checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
 
 [[package]]
 name = "memoffset"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "memoffset"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
@@ -2152,7 +2143,7 @@ dependencies = [
  "log",
  "mullvad-paths",
  "mullvad-types",
- "nix 0.23.2",
+ "nix 0.30.1",
  "parity-tokio-ipc",
  "prost 0.13.3",
  "prost-types 0.13.3",
@@ -2245,19 +2236,6 @@ checksum = "defc4c55412d89136f966bbb339008b474350e5e6e78d2714439c386b3137a03"
 
 [[package]]
 name = "nix"
-version = "0.23.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
-dependencies = [
- "bitflags 1.3.2",
- "cc",
- "cfg-if",
- "libc",
- "memoffset 0.6.5",
-]
-
-[[package]]
-name = "nix"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
@@ -2271,9 +2249,9 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.29.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
  "bitflags 2.6.0",
  "cfg-if",
@@ -3653,7 +3631,7 @@ dependencies = [
 name = "talpid-time"
 version = "0.0.0"
 dependencies = [
- "nix 0.29.0",
+ "nix 0.30.1",
  "tokio",
 ]
 
@@ -3756,7 +3734,7 @@ dependencies = [
  "mullvad-relay-selector",
  "mullvad-types",
  "mullvad-version",
- "nix 0.29.0",
+ "nix 0.30.1",
  "pcap",
  "pnet_base",
  "pnet_packet",
@@ -3817,7 +3795,7 @@ dependencies = [
  "libc",
  "log",
  "mullvad-paths",
- "nix 0.29.0",
+ "nix 0.30.1",
  "parity-tokio-ipc",
  "plist",
  "rand 0.8.5",
diff --git a/test/Cargo.toml b/test/Cargo.toml
index a46acb7237..26e716df24 100644
--- a/test/Cargo.toml
+++ b/test/Cargo.toml
@@ -84,4 +84,4 @@ bytes = "1.3.0"
 async-trait = "0.1.58"
 socket2 = "0.5.7"
 surge-ping = "0.8"
-nix = { version = "0.29", features = ["ioctl", "socket", "net"] }
+nix = { version = "0.30.1", features = ["ioctl", "socket", "net"] }
diff --git a/tunnel-obfuscation/Cargo.toml b/tunnel-obfuscation/Cargo.toml
index 5ebd2c8d4e..1bee10199b 100644
--- a/tunnel-obfuscation/Cargo.toml
+++ b/tunnel-obfuscation/Cargo.toml
@@ -20,4 +20,4 @@ shadowsocks = { workspace = true }
 mullvad-masque-proxy = { path = "../mullvad-masque-proxy" }
 
 [target.'cfg(target_os="linux")'.dependencies]
-nix = "0.23"
+nix = { workspace = true }
diff --git a/tunnel-obfuscation/src/shadowsocks.rs b/tunnel-obfuscation/src/shadowsocks.rs
index f838f96e6e..4f3435184e 100644
--- a/tunnel-obfuscation/src/shadowsocks.rs
+++ b/tunnel-obfuscation/src/shadowsocks.rs
@@ -5,8 +5,6 @@
 
 use super::Obfuscator;
 use async_trait::async_trait;
-#[cfg(target_os = "linux")]
-use nix::sys::socket::{setsockopt, sockopt};
 use shadowsocks::{
     config::{ServerConfig, ServerType},
     context::Context,
@@ -17,11 +15,15 @@ use shadowsocks::{
     },
     ProxySocket,
 };
-#[cfg(any(target_os = "android", target_os = "linux"))]
-use std::os::fd::AsRawFd;
 use std::{io, net::SocketAddr, sync::Arc};
 use tokio::{net::UdpSocket, sync::oneshot};
 
+#[cfg(target_os = "linux")]
+use nix::sys::socket::{setsockopt, sockopt};
+
+#[cfg(target_os = "android")]
+use std::os::fd::AsRawFd;
+
 const SHADOWSOCKS_CIPHER: CipherKind = CipherKind::AES_256_GCM;
 const SHADOWSOCKS_PASSWORD: &str = "mullvad";
 
@@ -181,7 +183,7 @@ async fn create_shadowsocks_socket(
         .map_err(Error::BindRemoteUdp)?;
     #[cfg(target_os = "linux")]
     if let Some(fwmark) = fwmark {
-        setsockopt(socket.as_raw_fd(), sockopt::Mark, &fwmark).map_err(Error::SetFwmark)?;
+        setsockopt(&socket, sockopt::Mark, &fwmark).map_err(Error::SetFwmark)?;
     }
 
     Ok(socket)