Add FTP, SMTP, TFTP, and IGMP; fix an IGMPv3 group-address misparse

FTP and SMTP share HTTP's line-based response-code-or-command shape
but keep their own command vocabularies in separate files rather than
sharing a parser. FTP passwords are shown as-is, not redacted - FTP
sends them in the clear regardless, matching Wireshark's own behavior.
TFTP is a small binary opcode protocol (RFC 1350) instead. IGMP sits
directly on IP like ICMP, so it's dispatched by protocol number rather
than through the port-keyed L7Registry the other three use.

Live-verified: FTP/SMTP against minimal real TCP servers written for
this (nothing installed locally), a full command/response exchange
decoded correctly in both directions. TFTP against a real atftpd
server and atftp client - the RRQ decoded correctly even though the
transfer itself didn't complete (an atftpd sandbox issue, not this
code). IGMP against real multicast traffic on wlp1s0, including a
genuine query from the actual router.

That live IGMP traffic caught a real bug before it shipped further:
parse_igmp() read bytes[4:8] as a group address for every message
type, but IGMPv3 reports use those bytes for Reserved+RecordCount
instead - a real V3 report showed "group=0.0.0.1" (0 reserved, 1
record, misread as an IP). Fixed by only populating group for the
types where it's genuinely an address; re-verified against the same
live traffic, and a regression test locks in the exact pattern.

1 files changed, 4 insertions, 0 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0f313c9..bcf68b1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -98,12 +98,16 @@ add_executable(packeteer_tests
   tests/test_byteio.cpp
   tests/test_net.cpp
   tests/test_arp.cpp
+  tests/test_igmp.cpp
   tests/test_ipv6.cpp
   tests/test_dns.cpp
   tests/test_mdns.cpp
   tests/test_ssh.cpp
   tests/test_ntp.cpp
   tests/test_dhcp.cpp
+  tests/test_ftp.cpp
+  tests/test_smtp.cpp
+  tests/test_tftp.cpp
   tests/test_http.cpp
   tests/test_tls.cpp
   tests/test_pcapng.cpp