Fix tun file descriptor ownership

We accidentally borrowed the file descriptor when we should have moved
it. This commit adds more `OwnedFd` and friends to help handle
ownership correctly.

Signed-off-by: Joakim Hulthe <joakim.hulthe@mullvad.net>

3 files changed, 9 insertions, 13 deletions

diff --git a/talpid-wireguard/src/boringtun/mod.rs b/talpid-wireguard/src/boringtun/mod.rs
index 0c465cba49..44ba1eb1d8 100644
--- a/talpid-wireguard/src/boringtun/mod.rs
+++ b/talpid-wireguard/src/boringtun/mod.rs
@@ -90,9 +90,7 @@ pub async fn open_boringtun_tunnel(
         let mut config = tun07::Configuration::default();
         config.raw_fd(fd);
 
-        boringtun_config.on_bind = Some(Box::new(move |socket| {
-            tun.bypass(socket.as_raw_fd()).unwrap()
-        }));
+        boringtun_config.on_bind = Some(Box::new(move |socket| tun.bypass(socket).unwrap()));
 
         let device = tun07::Device::new(&config).unwrap();
         tun07::AsyncDevice::new(device).unwrap()
diff --git a/talpid-wireguard/src/obfuscation.rs b/talpid-wireguard/src/obfuscation.rs
index fafe8c8860..b214e89ae0 100644
--- a/talpid-wireguard/src/obfuscation.rs
+++ b/talpid-wireguard/src/obfuscation.rs
@@ -117,7 +117,7 @@ async fn bypass_vpn(
     // Exclude remote obfuscation socket or bridge
     log::debug!("Excluding remote socket fd from the tunnel");
     let _ = tokio::task::spawn_blocking(move || {
-        if let Err(error) = tun_provider.lock().unwrap().bypass(remote_socket_fd) {
+        if let Err(error) = tun_provider.lock().unwrap().bypass(&remote_socket_fd) {
             log::error!("Failed to exclude remote socket fd: {error}");
         }
     })
diff --git a/talpid-wireguard/src/wireguard_go/mod.rs b/talpid-wireguard/src/wireguard_go/mod.rs
index 5b172c4f47..bad0bf88cb 100644
--- a/talpid-wireguard/src/wireguard_go/mod.rs
+++ b/talpid-wireguard/src/wireguard_go/mod.rs
@@ -18,8 +18,6 @@ use std::borrow::Cow;
 #[cfg(daita)]
 use std::ffi::CString;
 #[cfg(unix)]
-use std::os::unix::io::AsRawFd;
-#[cfg(unix)]
 use std::sync::{Arc, Mutex};
 use std::{
     future::Future,
@@ -300,10 +298,10 @@ impl WgGoTunnelState {
             let socket_v6 = self.tunnel_handle.get_socket_v6();
             let mut provider = tun_provider.lock().unwrap();
             provider
-                .bypass(socket_v4)
+                .bypass(&socket_v4)
                 .map_err(super::TunnelError::BypassError)?;
             provider
-                .bypass(socket_v6)
+                .bypass(&socket_v6)
                 .map_err(super::TunnelError::BypassError)?;
         }
 
@@ -334,7 +332,7 @@ impl WgGoTunnel {
         let handle = wireguard_go_rs::Tunnel::turn_on(
             mtu,
             &wg_config_str,
-            tunnel_fd.as_raw_fd(),
+            tunnel_fd,
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
@@ -529,7 +527,7 @@ impl WgGoTunnel {
 
         let handle = wireguard_go_rs::Tunnel::turn_on(
             &wg_config_str,
-            tunnel_fd.as_raw_fd(),
+            tunnel_fd,
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
@@ -611,7 +609,7 @@ impl WgGoTunnel {
             &exit_config_str,
             &entry_config_str,
             &private_ip,
-            tunnel_fd.as_raw_fd(),
+            tunnel_fd,
             Some(logging::wg_go_logging_callback),
             logging_context.ordinal,
         )
@@ -658,8 +656,8 @@ impl WgGoTunnel {
         let socket_v4 = handle.get_socket_v4();
         let socket_v6 = handle.get_socket_v6();
 
-        tunnel_device.bypass(socket_v4)?;
-        tunnel_device.bypass(socket_v6)?;
+        tunnel_device.bypass(&socket_v4)?;
+        tunnel_device.bypass(&socket_v6)?;
 
         Ok(())
     }