Architectural details of Android VPN service : How tun0 gets created? I would like to know how android creates a VPN tun0 interface. After I call establish from VPNService, Builder, the ServiceManager takes up the process and create the tun0. For that it uses parcels to send to Binder, but I am kind of confused as to what it does after that. I want to understand in detail how an interface gets created.

I have tried using strace on the application to see what kind of system calls get executed, but I did not see any ioctl calls from the application pid, but saw them on the system_Server pid. I understand that system_Server is what creates the interface, but how does Binder talk to system_Server asking to create an interface. Kindly point to any source code . It would be really helpful .
This is more like a development related question but what I know is that binder is inter-process communication (IPC) mechanism (like sockets) which processes use by opening /dev/*binder character devices. Binder IPC is used by Android's Java framework (for JNI communication) as well as native processes (e.g. for communication with vendor's binary blobs).

tun is Ethernet-like virtual network interface created by kernel (provided that it's built with tuntap support) so that a program can directly read/write IP packets from/to this interface. Creating tun needs ioctl TUNSETIFF be sent to kernel over /dev/net/tun character device (it's /dev/tun on Android). Manually you can do:

~# ip tuntap add dev tun0 mode tun


Android's VPN service uses binder to call native code for tun creation.

RESOURCES:


Android Architecture
How AOSP created tun interface: 1, 2, 3, 4.