fix(daemon): tear the tunnel down when it amplifies traffic instead of carrying it

THE OWNER'S MACHINE SENT 3.38 Tb. A live tunnel ran for ~40 minutes at up to
1.34 Gbps OUT with 0 Kbps IN (322 Kb received in total) until he noticed, killed
urnetworkd and took his internet back by hand. That is not a leak or a
misroute — it is an amplifying loop.

THE CAUSE IS IN THE LOG, one line above "tunnel up":

  [tun] egress split verified: unmarked -> urnet0, daemon (mark 0x55524e57) -> enp129s0
  [tun] egress mark applied to 2 packet(s), 160 byte(s)

TWO packets matched the daemon's own egress-exclusion rule in forty minutes. So
R4 self-exclusion was not in force: the daemon's SDK traffic fell into the tun,
the IoLoop read it back out, sent it again, and it was captured again. Each pass
multiplies. The routing probe passed because it tests the ROUTING DECISION for a
marked vs unmarked packet; nothing tested whether the daemon's actual sockets
ever get marked, and they did not. Root cause of the match failure is still open
and is the next piece of work.

WHAT THIS COMMIT ADDS IS THE THING THAT SHOULD HAVE EXISTED FIRST: a guard that
makes this class of bug survivable. On the reaper tick the daemon samples the
tun's own kernel counters, and after three consecutive strikes of ">64 MiB out
and <1 MiB back" it stops the tunnel, publishes kCodeTunnelStorm and says
plainly that the connection was looping rather than carrying. Deliberately dumb
and slow to fire: a genuinely upload-heavy session still draws ACKs, which move
rx_bytes, so a backup or a large upload cannot trip it. Counters that cannot be
read are treated as no evidence, never as a reason to tear a tunnel down.

A VPN that can saturate a user's uplink for forty minutes without noticing is
missing a safety valve, independently of whichever bug does the saturating.

Verified: both builds clean, 86/86, jammy 2/2, tarball rebuilt. The guard has NOT
been exercised against a real storm — doing that deliberately on the owner's
machine is not a test I am willing to run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011zv2X6ZPH8h6uBudVCGvG7

Author: Ryanmello07

app/src/ControlProtocol.hpp

@@ -696,6 +696,12 @@ inline constexpr const char* kCodeTunPermissionDenied = "tun_permission_denied";
 inline constexpr const char* kCodeTunBusy = "tun_busy";
 // open()/TUNSETIFF failed for some other reason (message carries strerror).
 inline constexpr const char* kCodeTunOpenFailed = "tun_open_failed";
+// The tunnel was torn down because it was AMPLIFYING: the tun's transmit
+// counter ran away while nothing came back, which is what an egress-exclusion
+// failure looks like from the outside (the daemon's own packets get captured
+// into the tunnel, re-sent, re-captured). Measured once on a real machine at
+// 1.34 Gbps out / 0 in, 3.38 Tb sent before a human noticed and killed it.
+inline constexpr const char* kCodeTunnelStorm = "tunnel_storm";
 // The device handed back an address/mtu/prefix that is not usable.
 inline constexpr const char* kCodeTunConfigInvalid = "tun_config_invalid";
 // `ip`, `nft` or `resolvectl` is not installed.

app/src/daemon/TunnelHost.cpp

@@ -957,10 +957,78 @@ void TunnelHost::MaintainFilterLocked() {
              ToString(filter_.state()));
 }
 
+namespace {
+
+// Read one of the tun's kernel byte counters. Absent/unreadable -> 0, which the
+// guard treats as "no evidence", never as a reason to tear a tunnel down.
+uint64_t ReadIfaceCounter(const std::string& iface, const char* which) {
+  const std::string path = "/sys/class/net/" + iface + "/statistics/" + which;
+  std::ifstream in(path);
+  uint64_t v = 0;
+  if (in >> v) return v;
+  return 0;
+}
+
+}  // namespace
+
+// A tunnel that transmits megabytes while receiving essentially nothing is not
+// carrying traffic — it is AMPLIFYING it. That is what an egress-exclusion
+// failure looks like from outside the SDK: the daemon's own packets fall into
+// the tun, are read back out, re-sent, and captured again. Measured once on a
+// real machine: 1.34 Gbps out, 0 in, 3.38 Tb sent before a human killed it.
+//
+// The guard is deliberately dumb and slow to fire — three consecutive strikes,
+// each needing a large TX delta AND a negligible RX delta — so a genuinely
+// upload-heavy session (a backup, a big send) cannot trip it: real uploads still
+// draw ACKs, which move rx_bytes.
+bool TunnelHost::CheckTunnelStormLocked() {
+  if (!tunnel_) { stormStrikes_ = 0; stormLastTx_ = stormLastRx_ = 0; return false; }
+  const std::string iface = tunnel_->name();
+  if (iface.empty()) return false;
+
+  const uint64_t tx = ReadIfaceCounter(iface, "tx_bytes");
+  const uint64_t rx = ReadIfaceCounter(iface, "rx_bytes");
+  if (tx == 0 && rx == 0) return false;  // counters unreadable: no evidence
+
+  const uint64_t dtx = tx > stormLastTx_ ? tx - stormLastTx_ : 0;
+  const uint64_t drx = rx > stormLastRx_ ? rx - stormLastRx_ : 0;
+  stormLastTx_ = tx;
+  stormLastRx_ = rx;
+
+  // Per tick: >64 MiB out with <1 MiB back. At the reaper's cadence that is an
+  // order of magnitude above any plausible real session.
+  constexpr uint64_t kStormTxDelta = 64ull * 1024 * 1024;
+  constexpr uint64_t kStormRxCeiling = 1ull * 1024 * 1024;
+  if (dtx >= kStormTxDelta && drx < kStormRxCeiling) {
+    ++stormStrikes_;
+    std::fprintf(stderr,
+                 "[tunnel] runaway: %llu MiB out and %llu KiB back since the last tick "
+                 "(strike %d of 3)\n",
+                 static_cast<unsigned long long>(dtx / (1024 * 1024)),
+                 static_cast<unsigned long long>(drx / 1024), stormStrikes_);
+  } else {
+    stormStrikes_ = 0;
+  }
+  if (stormStrikes_ < 3) return false;
+
+  std::fprintf(stderr,
+               "[tunnel] STOPPING: the tunnel is amplifying traffic rather than carrying it. "
+               "This is what a failed egress exclusion looks like -- the daemon's own packets "
+               "are being captured into the tunnel. Tearing it down to protect the network.\n");
+  PublishError(
+      "The connection was stopped because it was sending traffic in a loop instead of "
+      "carrying it. This is a bug; please report it.",
+      ctl::kCodeTunnelStorm);
+  stormStrikes_ = 0;
+  StopInternalLocked("tunnel_storm");
+  return true;
+}
+
 void TunnelHost::Reap() {
   {
     std::scoped_lock lock(opMutex_);
     ReapRetiredLoopsLocked();
+    if (CheckTunnelStormLocked()) return;  // the tunnel is gone; nothing else to reap
   }
   if (busy_.load()) return;  // a bring-up owns the session AND the filter
 

app/src/daemon/TunnelHost.hpp

@@ -167,6 +167,13 @@ class TunnelHost {
   // Requires opMutex_.
   void StopInternalLocked(const std::string& reason);
   void ReapRetiredLoopsLocked();
+  // RUNAWAY GUARD. Samples the tun's own byte counters and tears the tunnel
+  // down if it is transmitting hard while receiving nothing — the signature of
+  // a capture loop. Returns true when it stopped the tunnel.
+  bool CheckTunnelStormLocked();
+  uint64_t stormLastTx_ = 0;
+  uint64_t stormLastRx_ = 0;
+  int stormStrikes_ = 0;
 
   // ---- the nftables floor: ONE decision site --------------------------------
   //