/*
 *
 * Copyright (c) 2011-2016 The University of Waikato, Hamilton, New Zealand.
 * All rights reserved.
 *
 * This file is part of libprotoident.
 *
 * This code has been developed by the University of Waikato WAND
 * research group. For further information please see http://www.wand.net.nz/
 *
 * libprotoident is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * libprotoident is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 *
 */

#include <string.h>

#ifdef __APPLE__
#include <libkern/OSByteOrder.h>
#define bswap32 OSSwapInt32
#endif

#ifdef __FreeBSD__
#include <sys/endian.h>
#endif

#ifdef __linux__
#include <byteswap.h>
#define bswap32 __bswap_32
#endif

#include "libprotoident.h"
#include "proto_common.h"

bool match_str_either(lpi_data_t *data, const char *string) {

        if (MATCHSTR(data->payload[0], string))
                return true;
        if (MATCHSTR(data->payload[1], string))
                return true;
        return false;
}

bool match_str_both(lpi_data_t *data, const char *string1,
        const char *string2) {

        if (MATCHSTR(data->payload[0], string1) &&
                MATCHSTR(data->payload[1], string2))
                return true;
        if (MATCHSTR(data->payload[1], string1) &&
                MATCHSTR(data->payload[0], string2))
                return true;
        return false;
}

bool match_chars_either(lpi_data_t *data, char a, char b, char c,
        char d) {

        if (MATCH(data->payload[0], a, b, c, d))
                return true;
        if (MATCH(data->payload[1], a, b, c, d))
                return true;
        return false;
}

bool match_payload_length(uint32_t payload, uint32_t payload_len) {

        uint32_t header = 0;

        header = ntohl(payload);

        /* See if the length in the (presumed) header matches the
         * length of the rest of the packet minus the header itself (4 bytes).
         *
         * Watch out for the case of a 4 byte packet containing just 
         * 00 00 00 00! */
        if (payload_len > 4 && header == payload_len - 4)
                return true;

        return false;
}

bool match_ip_address_both(lpi_data_t *data) {

	uint8_t matches = 0;

	if (data->ips[0] == 0 || data->ips[1] == 0)
		return false;
	
	if (data->payload_len[0] == 0)
		matches += 1;
	else if (data->payload[0] == data->ips[0])
		matches += 1;
	else if (data->payload[0] == data->ips[1])
		matches += 1;
		
	if (data->payload_len[1] == 0)
		matches += 1;
	else if (data->payload[1] == data->ips[0])
		matches += 1;
	else if (data->payload[1] == data->ips[1])
		matches += 1;
	 
	if (matches == 2)
		return true;
	else
		return false;
	
}

/* Multiple protocols use HTTP-style requests */
bool match_http_request(uint32_t payload, uint32_t len) {

        /* HTTP requests - some of these are MS-specific extensions */
        if (len == 0)
                return true;

        if (MATCHSTR(payload, "GET ")) return true;
        if (len == 1 && MATCH(payload, 'G', 0x00, 0x00, 0x00))
                return true;
        if (len == 2 && MATCH(payload, 'G', 'E', 0x00, 0x00))
                return true;
        if (len == 3 && MATCH(payload, 'G', 'E', 'T', 0x00))
                return true;

        if (MATCHSTR(payload, "POST")) return true;
        if (MATCHSTR(payload, "HEAD")) return true;
        if (MATCHSTR(payload, "PUT ")) return true;
        if (MATCHSTR(payload, "DELE")) return true;
        if (MATCHSTR(payload, "auth")) return true;

        /* SVN? */
        if (MATCHSTR(payload, "REPO")) return true;

        /* Webdav */
        if (MATCHSTR(payload, "LOCK")) return true;
        if (MATCHSTR(payload, "UNLO")) return true;
        if (MATCHSTR(payload, "OPTI")) return true;
        if (MATCHSTR(payload, "PROP")) return true;
        if (MATCHSTR(payload, "MKCO")) return true;
        if (MATCHSTR(payload, "POLL")) return true;
        if (MATCHSTR(payload, "SEAR")) return true;

        /* Ntrip - some differential GPS system using modified HTTP */
        if (MATCHSTR(payload, "SOUR")) return true;


        return false;

}

/* File headers are not specific to any particular protocol */
bool match_file_header(uint32_t payload) {

        /* RIFF is a meta-format for storing AVI and WAV files */
        if (MATCHSTR(payload, "RIFF"))
                return true;

        /* MZ is a .exe file */
        if (MATCH(payload, 'M', 'Z', ANY, 0x00))
                return true;

        /* Ogg files */
        if (MATCHSTR(payload, "OggS"))
                return true;

        /* ZIP files */
        if (MATCH(payload, 'P', 'K', 0x03, 0x04))
                return true;

        /* MPEG files */
        if (MATCH(payload, 0x00, 0x00, 0x01, 0xba))
                return true;

        /* RAR files */
        if (MATCHSTR(payload, "Rar!"))
                return true;

        /* EBML */
        if (MATCH(payload, 0x1a, 0x45, 0xdf, 0xa3))
                return true;

        /* JPG */
        if (MATCH(payload, 0xff, 0xd8, ANY, ANY))
                return true;

        /* GIF */
        if (MATCHSTR(payload, "GIF8"))
                return true;

        /* I'm also going to include PHP scripts in here */
        if (MATCH(payload, 0x3c, 0x3f, 0x70, 0x68))
                return true;

        /* Unix scripts */
        if (MATCH(payload, 0x23, 0x21, 0x2f, 0x62))
                return true;

        /* PDFs */
        if (MATCHSTR(payload, "%PDF"))
                return true;

        /* PNG */
        if (MATCH(payload, 0x89, 'P', 'N', 'G'))
                return true;

        /* HTML */
        if (MATCHSTR(payload, "<htm"))
                return true;
        if (MATCH(payload, 0x0a, '<', '!', 'D'))
                return true;

        /* 7zip */
        if (MATCH(payload, 0x37, 0x7a, 0xbc, 0xaf))
                return true;

        /* gzip  - may need to replace last two bytes with ANY */
        if (MATCH(payload, 0x1f, 0x8b, 0x08, ANY))
                return true;

        /* XML */
        if (MATCHSTR(payload, "<!DO"))
                return true;

        /* FLAC */
        if (MATCHSTR(payload, "fLaC"))
                return true;

        /* MP3 */
        if (MATCH(payload, 'I', 'D', '3', 0x03))
                return true;
	if (MATCHSTR(payload, "\xff\xfb\x90\xc0"))
		return true;

        /* RPM */
        if (MATCH(payload, 0xed, 0xab, 0xee, 0xdb))
                return true;

        /* Wz Patch */
        if (MATCHSTR(payload, "WzPa"))
                return true;

        /* Flash Video */
        if (MATCH(payload, 'F', 'L', 'V', 0x01))
                return true;

        /* .BKF (Microsoft Tape Format) */
        if (MATCHSTR(payload, "TAPE"))
                return true;

        /* MS Office Doc file - this is unpleasantly geeky */
        if (MATCH(payload, 0xd0, 0xcf, 0x11, 0xe0))
                return true;

        /* ASP */
        if (MATCH(payload, 0x3c, 0x25, 0x40, 0x20))
                return true;

        /* WMS file */
        if (MATCH(payload, 0x3c, 0x21, 0x2d, 0x2d))
                return true;

	/* ar archive, typically .deb files */
	if (MATCHSTR(payload, "!<ar"))
		return true;

	/* Raw XML */
	if (MATCHSTR(payload, "<?xm"))
		return true;
	if (MATCHSTR(payload, "<iq "))
		return true;

	/* SPF */
	if (MATCHSTR(payload, "SPFI"))
		return true;

	/* ABIF - Applied Biosystems */
	if (MATCHSTR(payload, "ABIF"))
		return true;

	/* bzip2 - other digits are also possible instead of 9 */
	if (MATCH(payload, 'B', 'Z', 'h', '9'))
		return true;

        /* xz compression format */
        if (MATCH(payload, 0xfd, '7', 'z', 'X'))
                return true;

        /* Microsoft Cabinet Files */
        if (MATCH(payload, 'M', 'S', 'C', 'F'))
                return true;

        /* M4A -- be wary of false positives? */
        if (MATCH(payload, 0x00, 0x00, 0x00, 0x20))
                return true;

        /* TIFF */
        if (MATCH(payload, 0x49, 0x49, 0x2a, 0x00))
                return true;

        /* LZMA */
        if (MATCH(payload, 0x5d, 0x00, 0x00, 0x80))
                return true;

        /* Source engine BSP file */
        if (MATCH(payload, 'V', 'B', 'S', 'P'))
                return true;

        /* TTF */
        if (MATCH(payload, 0x00, 0x01, 0x00, 0x00))
                return true;
        if (MATCH(payload, 'O', 'T', 'T', 'O'))
                return true;

        /* WOF2 TTCF */
        if (MATCH(payload, 't', 't', 'c', 'f'))
                return true;

        /* RIR delegation files... */
        if (MATCH(payload, '2', '.', '3', '|'))
                return true;

        /* REBASE -- restriction enzyme database
         * A bit niche, but might be fairly common at universities? */
        if (MATCH(payload, 0x20, 0x0a, 'R', 'E'))
                return true;

        /* Old coralreef trace files! */
        if (MATCHSTR(payload, "\xff\xff\x44\x00"))
                return true;

        /* I'm pretty sure the following are files of some type or another.
         * They crop up pretty often in our test data sets, so I'm going to
         * put them in here.
         *
         * Hopefully one day we will find out what they really are */

        if (MATCH(payload, '<', 'c', 'f', ANY))
                return true;
        if (MATCH(payload, '<', 'C', 'F', ANY))
                return true;
        if (MATCHSTR(payload, ".tem"))
                return true;
        if (MATCHSTR(payload, ".ite"))
                return true;
        if (MATCHSTR(payload, ".lef"))
                return true;

        return false;

}

bool valid_http_port(lpi_data_t *data) {
        /* Must be on a known HTTP port - designed to filter 
         * out P2P protos that use HTTP.
         *
         * XXX If this doesn't work well, get rid of it!
        */
        if (data->server_port == 80 || data->client_port == 80)
                return true;
        if (data->server_port == 8080 || data->client_port == 8080)
                return true;
        if (data->server_port == 8081 || data->client_port == 8081)
                return true;

        /* If port 443 responds, we want it to be counted as genuine
         * HTTP, rather than a bad port scenario */
        if (data->server_port == 443 || data->client_port == 443) {
                if (data->payload_len[0] > 0 && data->payload_len[1] > 0)
                        return true;
        }

        return false;

}

/* 16 03 00 X is an SSLv3 handshake */
static inline bool match_ssl3_handshake(uint32_t payload, uint32_t len) {

        if (len == 0)
                return true;
        if (len == 1 && MATCH(payload, 0x16, 0x00, 0x00, 0x00))
                return true;
        if (MATCH(payload, 0x16, 0x03, 0x00, ANY))
                return true;
        return false;
}

/* 16 03 01 X is an TLS handshake */
static inline bool match_tls_handshake(uint32_t payload, uint32_t len) {

        if (len == 0)
                return true;
        if (len == 1 && MATCH(payload, 0x16, 0x00, 0x00, 0x00))
                return true;
        if (MATCH(payload, 0x16, 0x03, 0x01, ANY))
                return true;
        if (MATCH(payload, 0x16, 0x03, 0x02, ANY))
                return true;
        if (MATCH(payload, 0x16, 0x03, 0x03, ANY))
                return true;
        return false;
}

/* SSLv2 handshake - the ANY byte in the 0x80 payload is actually the length 
 * of the payload - 2. 
 *
 * XXX This isn't always true - consecutive packets may be merged it seems :(
 */
static inline bool match_ssl2_handshake(uint32_t payload, uint32_t len) {

        if (MATCH(payload, 0x80, ANY, 0x01, 0x03))
                return true;
        if (MATCH(payload, 0x81, ANY, 0x01, 0x03))
                return true;

        return false;
}

static inline bool match_tls_alert(uint32_t payload, uint32_t len) {
        if (MATCH(payload, 0x15, 0x03, 0x01, ANY))
                return true;
        if (MATCH(payload, 0x15, 0x03, 0x02, ANY))
                return true;
        if (MATCH(payload, 0x15, 0x03, 0x03, ANY))
                return true;

	/* Alerts are also possible under SSL 3.0 */
        if (MATCH(payload, 0x15, 0x03, 0x00, ANY))
                return true;
        return false;
}

static inline bool match_tls_change(uint32_t payload, uint32_t len) {
        if (MATCH(payload, 0x14, 0x03, 0x01, ANY))
                return true;
        if (MATCH(payload, 0x14, 0x03, 0x02, ANY))
                return true;
        if (MATCH(payload, 0x14, 0x03, 0x03, ANY))
                return true;
        return false;

}

static inline bool match_tls_content(uint32_t payload, uint32_t len) {
        if (MATCH(payload, 0x17, 0x03, 0x01, ANY))
                return true;
        if (MATCH(payload, 0x17, 0x03, 0x02, ANY))
                return true;
        if (MATCH(payload, 0x17, 0x03, 0x03, ANY))
                return true;
        return false;
}

bool match_ssl(lpi_data_t *data) {


        if (match_ssl3_handshake(data->payload[0], data->payload_len[0]) &&
                        match_ssl3_handshake(data->payload[1], data->payload_len[1]))
                return true;

        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_handshake(data->payload[1], data->payload_len[1]))
                return true;

        if (match_ssl3_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_handshake(data->payload[1], data->payload_len[1]))
                return true;

        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        match_ssl3_handshake(data->payload[1], data->payload_len[1]))
                return true;
        /* Seems we can sometimes skip the full handshake and start on the data
         * right away (as indicated by 0x17) - for now, I've only done this for TLS */
        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_content(data->payload[1], data->payload_len[1]))
                return true;
        if (match_tls_handshake(data->payload[1], data->payload_len[1]) &&
                        match_tls_content(data->payload[0], data->payload_len[0]))
                return true;
        /* Need to check for TLS alerts (errors) too */
        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_alert(data->payload[1], data->payload_len[1]))
                return true;
        if (match_tls_handshake(data->payload[1], data->payload_len[1]) &&
                        match_tls_alert(data->payload[0], data->payload_len[0]))
                return true;
        if (match_ssl3_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_alert(data->payload[1], data->payload_len[1]))
                return true;
        if (match_ssl3_handshake(data->payload[1], data->payload_len[1]) &&
                        match_tls_alert(data->payload[0], data->payload_len[0]))
                return true;

        /* Need to check for cipher changes too */
        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        match_tls_change(data->payload[1], data->payload_len[1]))
                return true;
        if (match_tls_handshake(data->payload[1], data->payload_len[1]) &&
                        match_tls_change(data->payload[0], data->payload_len[0]))
                return true;


        /* Some HTTPS servers respond with unencrypted content, presumably
         * when somebody invalid attempts a connection */
        if (match_tls_handshake(data->payload[0], data->payload_len[0]) &&
                        MATCHSTR(data->payload[1], "<!DO") &&
			data->payload_len[0] != 0)
                return true;
        if (match_tls_handshake(data->payload[1], data->payload_len[1]) &&
                        MATCHSTR(data->payload[0], "<!DO") &&
			data->payload_len[1] != 0)
                return true;


        /* Allow TLS content in both directions -- could be multi-path TCP?
         * Or some form of picking up where a previous connection left off?
         */
        if (match_tls_content(data->payload[0], data->payload_len[0]) &&
                        match_tls_content(data->payload[1], data->payload_len[1]))
                return true;
        if (match_tls_content(data->payload[1], data->payload_len[1]) &&
                        match_tls_content(data->payload[0], data->payload_len[0]))
                return true;
        

        if ((match_tls_handshake(data->payload[0], data->payload_len[0]) ||
                        match_ssl3_handshake(data->payload[0], data->payload_len[0])) &&
                        match_ssl2_handshake(data->payload[1], data->payload_len[1]))
                return true;

        if ((match_tls_handshake(data->payload[1], data->payload_len[1]) ||
                        match_ssl3_handshake(data->payload[1], data->payload_len[1])) &&
                        match_ssl2_handshake(data->payload[0], data->payload_len[0]))
                return true;

        if (data->payload_len[0] == 0 && match_ssl2_handshake(data->payload[1], data->payload_len[1]))
                return true;
        if (data->payload_len[1] == 0 && match_ssl2_handshake(data->payload[0], data->payload_len[0]))
                return true;

        return false;
}

static bool dns_req(uint32_t payload) {

        /* The flags / rcode on requests are usually all zero.
         *
         * Exceptions: CD and RD may be set 
         *
         * Remember BYTE ORDER!
         */

	payload = htonl(payload);

	if ((payload & 0x0000ffff) == 0x00000000)
		return true;
	/* Check for CD */
	if ((payload & 0x0000ffff) == 0x00000010)
		return true;
	/* Check for RD */
	if ((payload & 0x0000ffff) == 0x00000100)
		return true;


        return false;

}

static bool dns_backscatter(uint32_t payload) {

	/* Let's see if we can identify unsolicited DNS responses */

	/* Last byte seems to be always 0x00 - third is either 0x84 or 0x85 */

	payload = htonl(payload);

	if ((payload & 0x0000ffff) == 0x00008500)
		return true;
	if ((payload & 0x0000ffff) == 0x00008580)
		return true;
	if ((payload & 0x0000ffff) == 0x00008400)
		return true;
	if ((payload & 0x0000ffff) == 0x00008480)
		return true;
	if ((payload & 0x0000ffff) == 0x00008483)
		return true;
	if ((payload & 0x0000ffff) == 0x00008403)
		return true;
	if ((payload & 0x0000ffff) == 0x00008000)
		return true;

	return false;
}

bool match_dns(lpi_data_t *data) {

        if (data->payload_len[0] == 0 || data->payload_len[1] == 0) {

                /* No response, so we have a bit of a hard time - however,
                 * most requests have a pretty standard set of flags.
                 *
                 * We'll also use the port here to help out */
                if (data->server_port != 53 && data->client_port != 53)
                        return false;
                if (data->payload_len[0] > 12 && dns_req(data->payload[0]))
                        return true;
                if (data->payload_len[1] > 12 && dns_req(data->payload[1]))
                        return true;
                if (data->payload_len[0] > 12 && 
				dns_backscatter(data->payload[0]))
                        return true;
                if (data->payload_len[1] > 12 && 
				dns_backscatter(data->payload[1]))
                        return true;

                return false;
        }

        if (((htonl(data->payload[0])) & 0xffff7800) != 
			((htonl(data->payload[1])) & 0xffff7800))
                return false;

        if ((htonl(data->payload[0]) & 0x00008000) == 
		(htonl(data->payload[1]) & 0x00008000))
                return false;

        return true;

}

bool match_tds_request(uint32_t payload, uint32_t len) {

        uint32_t stated_len = 0;

        stated_len = (ntohl(payload) & 0xffff);
        if (stated_len != len)
                return false;

        if (MATCH(payload, 0x12, 0x01, ANY, ANY))
                return true;
        if (MATCH(payload, 0x10, 0x01, ANY, ANY))
                return true;

        return false;

}


bool match_8000_payload(uint32_t payload, uint32_t len) {

        if (len == 0)
                return true;

        if (MATCH(payload, 0x3b, 0x00, 0x00, 0x00)) {
                return true;
        }
        if (MATCH(payload, 0x3c, 0x00, 0x00, 0x00)) {
                return true;
        }
        if (MATCH(payload, 0x3d, 0x00, 0x00, 0x00)) {
                return true;
        }
        if (MATCH(payload, 0x3e, 0x00, 0x00, 0x00)) {
                return true;
        }

        return false;
}

bool match_emule(lpi_data_t *data) {

        /* Check that payload begins with e3 or c5 in both directions before 
         * classifying as eMule */
        /* (I noticed that most emule(probably) flows began with "e3 xx 00 00" 
         * or "c5 xx 00 00", perhaps is worth looking into... Although I 
         * couldn't find anything about emule packets) */

        if (data->payload_len[0] < 4 && data->payload_len[1] < 4)
                return false;

        if (MATCH(data->payload[0], 0xe3, ANY, 0x00, 0x00) &&
            MATCH(data->payload[1], 0xe3, ANY, 0x00, 0x00))
                return true;

        if (MATCH(data->payload[0], 0xe3, ANY, 0x00, 0x00) &&
            MATCH(data->payload[1], 0xc5, ANY, 0x00, 0x00))
                return true;

        /* XXX I haven't seen any obviously legit emule that starts with c5
         * in both directions */
        /*
        if (MATCH(data->payload[0], 0xc5, ANY, ANY, ANY) &&
            MATCH(data->payload[1], 0xc5, ANY, ANY, ANY))
                return true;
        */

        if (MATCH(data->payload[0], 0xc5, ANY, 0x00, 0x00) &&
            MATCH(data->payload[1], 0xe3, ANY, 0x00, 0x00))
                return true;

        if (MATCH(data->payload[0], 0xe3, ANY, 0x00, 0x00) &&
                data->payload_len[1] == 0)
                return true;

        if (MATCH(data->payload[1], 0xe3, ANY, 0x00, 0x00) &&
                data->payload_len[0] == 0)
                return true;



        return false;
}

static inline bool match_kaspersky_ke(uint32_t payload, uint32_t len) {
        if (len == 0)
                return true;
        if (MATCH(payload, 'K', 'E', 0x00, 0x00))
                return true;
        if (MATCH(payload, 'K', 'E', 0x00, 0x02))
                return true;
        if (MATCH(payload, 'K', 'E', 0x00, 0x07))
                return true;
        return false;
}

static inline bool match_kaspersky_ks(uint32_t payload, uint32_t len) {
        if (len == 0)
                return true;
        if (MATCH(payload, 'K', 'S', 0x00, 0x00))
                return true;
        return false;
}

bool match_kaspersky(lpi_data_t *data) {

	/* Traffic is either on TCP port 443 or UDP port 2001.
	 *
	 * One of the endpoints is always in either a Kaspersky range or
	 * an old PSInet range */

	if (match_str_both(data, "PI\x00\x00", "PI\x00\x00")) {
		if (data->payload_len[0] == 2 && data->payload_len[1] == 2)
			return true;
	}
        if (match_kaspersky_ke(data->payload[0], data->payload_len[0])) {
                if (match_kaspersky_ke(data->payload[1], data->payload_len[1]))
                        return true;
        }
        if (match_kaspersky_ks(data->payload[0], data->payload_len[0])) {
                if (match_kaspersky_ks(data->payload[1], data->payload_len[1]))
                        return true;
        }
	return false;
}

bool match_youku_payload(uint32_t pload, uint32_t len) {

	if (len == 0)
                return true;
        if (MATCH(pload, 0x4b, 0x55, 0x00, 0x01))
                return true;
        if (MATCH(pload, 0x4b, 0x55, 0x00, 0x02))
                return true;
        if (MATCH(pload, 0x4b, 0x55, 0x00, 0x03))
                return true;
        if (MATCH(pload, 0x4b, 0x55, 0x00, 0x04))
                return true;
        return false;

}

bool match_tpkt(uint32_t payload, uint32_t len) {
        uint32_t stated_len = 0;

        /*
         * TPKT header is 03 00 + 2 bytes of length (including the TPKT header)
         */

        if (!MATCH(payload, 0x03, 0x00, ANY, ANY))
                return false;

        stated_len = ntohl(payload) & 0xffff;
        if (stated_len != len)
                return false;
        return true;
}

bool match_qqlive_payload(uint32_t payload, uint32_t len) {

        uint32_t swap;

        /* This appears to have a 3 byte header. First byte is always 0xfe.
         * Second and third bytes are the length (minus the 3 byte header).
         */

        if (len == 0)
                return true;

        swap = htonl(payload);
        swap = (swap & 0xffff00) >> 8;

        if (ntohs(swap) != len - 3)
                return false;

	/* Interestingly, the third and fourth byte always match */
        swap = htonl(payload);
        if ((swap & 0xff) != ((swap & 0xff00) >> 8))
                return false;

        if (MATCH(payload, 0xfe, ANY, ANY, ANY))
                return true;
        return false;

}

bool match_yy_payload(uint32_t payload, uint32_t len) {

        /* The first four bytes are a length field, but using the
         * wrong byte order...
         */

        if (!MATCH(payload, ANY, ANY, 0x00, 0x00))
                return false;

#if BYTE_ORDER == BIG_ENDIAN
        if (bswap32(payload) == len)
                return true;
#else
        if (payload == len)
                return true;
#endif
        return false;
}


/* Byte swapping functions for various inttypes */
uint64_t byteswap64(uint64_t num)
{
        return (byteswap32((num&0xFFFFFFFF00000000ULL)>>32))
              |((uint64_t)byteswap32(num&0x00000000FFFFFFFFULL)<<32);
}

uint32_t byteswap32(uint32_t num)
{
        return ((num&0x000000FFU)<<24)
                | ((num&0x0000FF00U)<<8)
                | ((num&0x00FF0000U)>>8)
                | ((num&0xFF000000U)>>24);
}

uint16_t byteswap16(uint16_t num)
{
        return ((num<<8)&0xFF00)|((num>>8)&0x00FF);
}