Add traffic stats callback to FFI (iOS + Android)

Wire cumulative upload/download byte counters through the TUN server.
TCP bytes are counted after copy_bidirectional completes; UDP bytes are
counted per-message in destination tasks. A 1-second timer in the TUN
event loop invokes the platform callback with current totals.

iOS: shoes_start now takes a ShoesTrafficCallback parameter.
Android: ShoesNative.start now takes a TrafficListener parameter.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: AYastrebov

android/src/main/java/com/shoesproxy/ShoesNative.kt

@@ -25,7 +25,9 @@ package com.shoesproxy
  *               device_fd: $tunFd
  *         """.trimIndent()
  *
- *         shoesHandle = ShoesNative.start(config) { fd -> protect(fd) }
+ *         shoesHandle = ShoesNative.start(config, { fd -> protect(fd) }) { up, down ->
+ *             Log.d("VPN", "Traffic: up=$up down=$down")
+ *         }
  *         return START_STICKY
  *     }
  *
@@ -59,6 +61,22 @@ object ShoesNative {
         fun protect(fd: Int): Boolean
     }
 
+    /**
+     * Functional interface for receiving traffic statistics.
+     *
+     * Called periodically (~1 second) from the native engine with cumulative
+     * byte counts since the last [start] call.
+     */
+    fun interface TrafficListener {
+        /**
+         * Called with updated traffic statistics.
+         *
+         * @param uploadBytes   Total bytes sent from device to proxy since start.
+         * @param downloadBytes Total bytes received from proxy to device since start.
+         */
+        fun onTrafficUpdate(uploadBytes: Long, downloadBytes: Long)
+    }
+
     /**
      * Initialize the shoes library.
      *
@@ -95,9 +113,14 @@ object ShoesNative {
      * @param configYaml YAML configuration string.
      * @param protectCallback Called by the engine to exempt outbound sockets
      *                        from VPN routing (pass `this::protect` from your VpnService).
+     * @param trafficCallback Called periodically with cumulative traffic byte counts.
      * @return A positive handle on success, -1 on error.
      */
-    external fun start(configYaml: String, protectCallback: SocketProtector): Long
+    external fun start(
+        configYaml: String,
+        protectCallback: SocketProtector,
+        trafficCallback: TrafficListener,
+    ): Long
 
     /**
      * Stop the VPN service.

include/shoes.h

@@ -19,6 +19,15 @@
  */
 typedef bool (*ProtectSocketCallback)(int fd);
 
+/**
+ * Traffic statistics callback type.
+ * Called periodically (every ~1 second) with cumulative byte counts.
+ *
+ * @param upload_bytes   Total bytes sent from device to proxy since start.
+ * @param download_bytes Total bytes received from proxy to device since start.
+ */
+typedef void (*ShoesTrafficCallback)(uint64_t upload_bytes, uint64_t download_bytes);
+
 /**
  * Initialize the shoes library.
  *
@@ -40,6 +49,7 @@ int shoes_init(const char *log_level);
  * # Arguments
  * * `config_yaml` - YAML configuration string (must include device_fd in TUN config)
  * * `protect_callback` - Callback function to protect sockets from VPN routing
+ * * `traffic_callback` - Callback function for periodic traffic statistics
  *
  * # Returns
  * * Handle (> 0) on success
@@ -48,7 +58,9 @@ int shoes_init(const char *log_level);
  * # Safety
  * `config_yaml` must be a valid null-terminated C string.
  */
-long shoes_start(const char *config_yaml, ProtectSocketCallback protect_callback);
+long shoes_start(const char *config_yaml,
+                 ProtectSocketCallback protect_callback,
+                 ShoesTrafficCallback traffic_callback);
 
 /**
  * Stop the shoes VPN service.

src/ffi/android.rs

@@ -179,21 +179,28 @@ pub extern "system" fn Java_com_shoesproxy_ShoesNative_start<'local>(
     _class: JClass<'local>,
     config_yaml: JString<'local>,
     protect_callback: JObject<'local>,
+    traffic_callback: JObject<'local>,
 ) -> jlong {
     info!("Starting shoes service");
 
     let result = unowned
         .with_env(
-            |env| -> jni::errors::Result<(String, Global<JObject<'static>>, jni::JavaVM)> {
+            |env| -> jni::errors::Result<(
+                String,
+                Global<JObject<'static>>,
+                Global<JObject<'static>>,
+                jni::JavaVM,
+            )> {
                 let config_str: String = env.get_string(&config_yaml).map(|s| s.to_string())?;
-                let callback_ref = env.new_global_ref(protect_callback)?;
+                let protect_ref = env.new_global_ref(protect_callback)?;
+                let traffic_ref = env.new_global_ref(traffic_callback)?;
                 let jvm = env.get_java_vm()?;
-                Ok((config_str, callback_ref, jvm))
+                Ok((config_str, protect_ref, traffic_ref, jvm))
             },
         )
         .into_outcome();
 
-    let (config_str, callback_ref, jvm) = match result {
+    let (config_str, protect_ref, traffic_ref, jvm) = match result {
         Outcome::Ok(v) => v,
         Outcome::Err(e) => {
             error!("Failed to extract JNI values for start: {}", e);
@@ -204,15 +211,15 @@ pub extern "system" fn Java_com_shoesproxy_ShoesNative_start<'local>(
     let jvm: Arc<jni::JavaVM> = Arc::new(jvm);
 
     // Socket protector calls VpnService.protect() to exempt sockets from VPN routing
-    let callback_ref: Arc<Global<JObject<'static>>> = Arc::new(callback_ref);
+    let protect_ref: Arc<Global<JObject<'static>>> = Arc::new(protect_ref);
     let jvm_clone = jvm.clone();
-    let callback_clone = callback_ref.clone();
+    let protect_clone = protect_ref.clone();
 
     let protector = FnSocketProtector::new(move |fd: i32| {
         let protect_ok = jvm_clone
             .attach_current_thread(|env: &mut jni::Env| -> jni::errors::Result<bool> {
                 let v = env.call_method(
-                    &*callback_clone,
+                    &*protect_clone,
                     jni::jni_str!("protect"),
                     jni::jni_sig!("(I)Z"),
                     &[JValue::Int(fd)],
@@ -233,6 +240,23 @@ pub extern "system" fn Java_com_shoesproxy_ShoesNative_start<'local>(
 
     set_global_socket_protector(Arc::new(protector));
 
+    // Traffic callback calls TrafficListener.onTrafficUpdate(long, long)
+    let traffic_ref: Arc<Global<JObject<'static>>> = Arc::new(traffic_ref);
+    let jvm_traffic = jvm.clone();
+    crate::tun::traffic::reset_traffic_counters();
+    crate::tun::traffic::set_traffic_callback(Arc::new(move |upload: u64, download: u64| {
+        let _ =
+            jvm_traffic.attach_current_thread(|env: &mut jni::Env| -> jni::errors::Result<()> {
+                env.call_method(
+                    &*traffic_ref,
+                    jni::jni_str!("onTrafficUpdate"),
+                    jni::jni_sig!("(JJ)V"),
+                    &[JValue::Long(upload as i64), JValue::Long(download as i64)],
+                )?;
+                Ok(())
+            });
+    }));
+
     let runtime = match Runtime::new() {
         Ok(rt) => rt,
         Err(e) => {
@@ -282,6 +306,7 @@ pub extern "system" fn Java_com_shoesproxy_ShoesNative_stop(
     _handle: jlong,
 ) {
     common::stop_service();
+    crate::tun::traffic::clear_traffic_callback();
 }
 
 /// Check if the TUN service is running.

src/ffi/ios.rs

@@ -39,6 +39,10 @@ use super::common::{
 /// The callback receives a file descriptor and should return true if protected successfully.
 pub type ProtectSocketCallback = extern "C" fn(fd: c_int) -> bool;
 
+/// Traffic statistics callback type.
+/// Called periodically with cumulative upload and download byte counts.
+pub type ShoesTrafficCallback = extern "C" fn(upload_bytes: u64, download_bytes: u64);
+
 /// Global socket protector callback.
 static PROTECT_CALLBACK: OnceLock<Mutex<Option<ProtectSocketCallback>>> = OnceLock::new();
 
@@ -127,6 +131,7 @@ pub unsafe extern "C" fn shoes_init(log_level: *const c_char) -> c_int {
 pub unsafe extern "C" fn shoes_start(
     config_yaml: *const c_char,
     protect_callback: ProtectSocketCallback,
+    traffic_callback: ShoesTrafficCallback,
 ) -> c_long {
     if config_yaml.is_null() {
         error!("shoes_start: config_yaml is null");
@@ -148,6 +153,12 @@ pub unsafe extern "C" fn shoes_start(
         *callback_guard = Some(protect_callback);
     }
 
+    // Store traffic callback and reset counters
+    crate::tun::traffic::reset_traffic_counters();
+    crate::tun::traffic::set_traffic_callback(Arc::new(move |upload, download| {
+        traffic_callback(upload, download);
+    }));
+
     crate::tun::set_global_socket_protector(Arc::new(IosSocketProtector));
 
     let runtime = match tokio::runtime::Builder::new_multi_thread()
@@ -193,6 +204,7 @@ pub unsafe extern "C" fn shoes_start(
 #[unsafe(no_mangle)]
 pub extern "C" fn shoes_stop(_handle: c_long) {
     common::stop_service();
+    crate::tun::traffic::clear_traffic_callback();
 
     if let Some(callback) = PROTECT_CALLBACK.get() {
         let mut guard = callback.lock();

src/tun/mod.rs

@@ -30,6 +30,7 @@
 
 mod tcp_conn;
 mod tcp_stack_direct;
+pub mod traffic;
 mod tun_server;
 mod udp_handler;
 mod udp_manager;
@@ -155,6 +156,16 @@ pub async fn run_tun_server(
 
     info!("TUN server started successfully");
 
+    // Periodic traffic stats reporting (every 1 second)
+    let traffic_task = tokio::spawn(async {
+        let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(1));
+        interval.tick().await; // skip immediate first tick
+        loop {
+            interval.tick().await;
+            traffic::report_traffic();
+        }
+    });
+
     // Wait for shutdown signal or stack thread exit
     tokio::select! {
         _ = &mut shutdown_rx => {
@@ -170,6 +181,8 @@ pub async fn run_tun_server(
         }
     }
 
+    traffic_task.abort();
+
     if let Some(t) = tcp_task {
         t.abort();
     }
@@ -226,6 +239,8 @@ async fn handle_tcp_connection(
 
                     match result {
                         Ok((client_to_remote, remote_to_client)) => {
+                            traffic::add_upload_bytes(client_to_remote);
+                            traffic::add_download_bytes(remote_to_client);
                             debug!(
                                 "TCP connection to {} completed: {} bytes sent, {} bytes received",
                                 remote_location.location(),