The Intercept
=============
This project consists of two parts. The software and the plan.

The Software
============
The Intercept (software) is an application providing various
TCP tunneling services known as proxies. Not only does the
intercept provide proxy services, it also logs the activity
quite extensivly. A session is tagged and bagged.

The Plan
========
The Intercept (plan) is ment to be used for monitoring botnet
activity. Some bots out there use free proxy lists for their
own goals of achieving world domination. The plan is to
get a couple of servers to run The Intercept (software) and
to map its users (the bots). When the activity of the bots
are mapped, the goal is to do a takeover by acting as a
MITM and altering their traffic.

Tekk spekk
==========
The main app is built like this:

start:
  load modules.txt
  for each module specified in modules.txt:
    load it to memory
    store information about it in a list
    call it's initation callback

  mainLoop:
      For each service we support:
        check for incoming tunneling requests
        got a request?
          yes:
            log it
            initiate the proxy routine
          no:
            continue
      goto mainLoop

So, this is pretty much the main app. The proxy service
handlers are loadable libraries loaded at application
startup (a static version should be available).
They're named in the file "modules.txt" in the following
format:
    <name of module>:<path to library>

Every service module has an initiation callback and
it looks like this:

   int initMod(char **err);

On an error, it sets err to the error message and returns
-1. It returns 0 on success.

Every service module has a "check for incoming request"
callback, preferably a non-blocking I/O request thingy.
This callback looks like this:

    int checkReq(int *data);

Data points to an integer variable used to pass data
from the callback to the caller.
The callback must return 1 if there's a request, 0 if
there's no request or -1 if there's a fatal error. If
there is a fatal error, the integer data points to is
given the address to a string that should be used for
user output.

Every module must also have a request handler callback
that looks like this:

    int handleReq(unsigned long long id, int data);

handleReq returns -1 on failure and 0 on success.
If handleReq returns -1, errStr supplies a user message.
The data is the variable passed from checkReq and the
id is a unique integer used for log lookups.

handleReq handles the actual logging of the traffic
while the main app handle the logging of the events.

Once everything is set up for the actual data transfer,
handleReq should delegate that to a child process or
a thread so that it doesn't block the whole app.

The Intercept is GNU/Linux specific and written for
little endian machines. Portability is not a priority.

Note that this spec doesn't contain any rules per se,
it should be treated as a list of guidelines.

log started: Sun Apr 12 22:57:28 2009
217.20.127.19:2693      209.63.57.4:80

host0 sent 9 bytes
00000000  04 01 00 50 D1 3F 39 04 00                       |...P.?9..|

host1 sent 9 bytes
00000000  04 5A 00 50 D1 3F 39 04 00                       |.Z.P.?9..|

host0 sent 536 bytes
00000000  47 45 54 20 2F 73 69 67 6E 75 70 5F 73 75 62 64  |GET /signup_subd|
00000010  6F 6D 61 69 6E 3F 75 73 65 72 6E 61 6D 65 3D 7A  |omain?username=z|
00000020  61 6D 64 70 75 68 26 30 63 3D 31 39 4E 47 53 43  |amdpuh&0c=19NGSC|
00000030  6E 37 75 65 61 4F 49 26 61 63 63 6F 75 6E 74 5F  |n7ueaOI&account_|
00000040  74 79 70 65 3D 66 72 65 65 20 48 54 54 50 2F 31  |type=free HTTP/1|
00000050  2E 31 0D 0A 48 6F 73 74 3A 20 73 69 67 6E 75 70  |.1..Host: signup|
00000060  2E 62 2D 77 2D 68 2E 63 6F 6D 0D 0A 41 63 63 65  |.b-w-h.com..Acce|
00000070  70 74 3A 20 69 6D 61 67 65 2F 67 69 66 2C 20 69  |pt: image/gif, i|
00000080  6D 61 67 65 2F 78 2D 78 62 69 74 6D 61 70 2C 20  |mage/x-xbitmap, |
00000090  69 6D 61 67 65 2F 6A 70 65 67 2C 20 69 6D 61 67  |image/jpeg, imag|
000000A0  65 2F 70 6A 70 65 67 2C 20 61 70 70 6C 69 63 61  |e/pjpeg, applica|
000000B0  74 69 6F 6E 2F 78 2D 73 68 6F 63 6B 77 61 76 65  |tion/x-shockwave|
000000C0  2D 66 6C 61 73 68 2C 20 61 70 70 6C 69 63 61 74  |-flash, applicat|
000000D0  69 6F 6E 2F 76 6E 64 2E 6D 73 2D 65 78 63 65 6C  |ion/vnd.ms-excel|
000000E0  2C 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 76 6E  |, application/vn|
000000F0  64 2E 6D 73 2D 70 6F 77 65 72 70 6F 69 6E 74 2C  |d.ms-powerpoint,|
00000100  20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6D 73 77  | application/msw|
00000110  6F 72 64 2C 20 2A 2F 2A 0D 0A 41 63 63 65 70 74  |ord, */*..Accept|
00000120  2D 43 68 61 72 73 65 74 3A 20 69 73 6F 2D 38 38  |-Charset: iso-88|
00000130  35 39 2D 31 2C 20 75 74 66 2D 38 2C 20 75 74 66  |59-1, utf-8, utf|
00000140  2D 31 36 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F  |-16..Accept-Enco|
00000150  64 69 6E 67 3A 20 69 64 65 6E 74 69 74 79 0D 0A  |ding: identity..|
00000160  41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A  |Accept-Language:|
00000170  20 65 6E 0D 0A 52 65 66 65 72 65 72 3A 20 68 74  | en..Referer: ht|
00000180  74 70 3A 2F 2F 73 69 67 6E 75 70 2E 62 2D 77 2D  |tp://signup.b-w-|
00000190  68 2E 63 6F 6D 2F 62 61 6E 6E 65 72 66 72 65 65  |h.com/bannerfree|
000001A0  3F 75 73 65 72 6E 61 6D 65 3D 7A 61 6D 64 70 75  |?username=zamdpu|
000001B0  68 26 30 63 3D 31 39 4E 47 53 43 6E 37 75 65 61  |h&0c=19NGSCn7uea|
000001C0  4F 49 26 61 63 63 6F 75 6E 74 5F 74 79 70 65 3D  |OI&account_type=|
000001D0  66 72 65 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74  |free..User-Agent|
000001E0  3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63  |: Mozilla/4.0 (c|
000001F0  6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20  |ompatible; MSIE |
00000200  36 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20  |6.0; Windows NT |
00000210  35 2E 31 29 0D 0A 0D 0A                          |5.1)....|

GET /signup_subd|
00000010  6F 6D 61 69 6E 3F 75 73 65 72 6E 61 6D 65 3D 7A  |omain?username=z|
00000020  61 6D 64 70 75 68 26 30 63 3D 31 39 4E 47 53 43  |amdpuh&0c=19NGSC|
00000030  6E 37 75 65 61 4F 49 26 61 63 63 6F 75 6E 74 5F  |n7ueaOI