diff --git a/trunk/doc/TODO b/trunk/doc/TODO
index 857e31b2ee..c48d78d29f 100644
--- a/trunk/doc/TODO
+++ b/trunk/doc/TODO
@@ -119,6 +119,8 @@ Short-term:
         o Remember address and port when beginning. 
         - Extend by nickname/hostname/something, not by IP.
         - Need a relay teardown cell, separate from one-way ends.
+        - Make it harder to circumvent bandwidth caps: look at number of bytes
+          sent across sockets, not number sent inside TLS stream.
 
 On-going
         . Better comments for functions!
diff --git a/trunk/src/common/tortls.c b/trunk/src/common/tortls.c
index 89009ea13e..e604247bb4 100644
--- a/trunk/src/common/tortls.c
+++ b/trunk/src/common/tortls.c
@@ -52,7 +52,6 @@ static int tls_library_is_initialized = 0;
 #define _TOR_TLS_SYSCALL    -6
 #define _TOR_TLS_ZERORETURN -5
 
-
 /* These functions are declared in crypto.c but not exported. */
 EVP_PKEY *_crypto_pk_env_get_evp_pkey(crypto_pk_env_t *env);
 crypto_pk_env_t *_crypto_new_pk_env_rsa(RSA *rsa);
@@ -571,3 +570,15 @@ tor_tls_get_pending_bytes(tor_tls *tls)
   assert(tls);
   return SSL_pending(tls->ssl);
 }
+
+/* Return the number of bytes read across the underlying socket. */
+unsigned long tor_tls_get_n_bytes_read(tor_tls *tls)
+{
+  assert(tls);
+  return BIO_number_read(SSL_get_rbio(tls->ssl));
+}
+unsigned long tor_tls_get_n_bytes_written(tor_tls *tls)
+{
+  assert(tls);
+  return BIO_number_written(SSL_get_wbio(tls->ssl));
+}
diff --git a/trunk/src/common/tortls.h b/trunk/src/common/tortls.h
index fdfa161920..14dd3dda4d 100644
--- a/trunk/src/common/tortls.h
+++ b/trunk/src/common/tortls.h
@@ -29,4 +29,7 @@ int tor_tls_handshake(tor_tls *tls);
 int tor_tls_shutdown(tor_tls *tls);
 int tor_tls_get_pending_bytes(tor_tls *tls);
 
+unsigned long tor_tls_get_n_bytes_read(tor_tls *tls);
+unsigned long tor_tls_get_n_bytes_written(tor_tls *tls);
+
 #endif