Initial commit: wireframe packet capture/analysis tool

Terminal packet capture and analysis tool built to learn the C++
memory model (byte layout, alignment, endianness, std::span over
unowned buffers) via a real capture pipeline.

- Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension
  header walking, TCP, UDP) over std::span, no struct-casting
- L7 dissector interface with DNS, HTTP, and TLS SNI implementations
- pcapng read/write for Wireshark-compatible capture files
- Bounded capture queue: drop-on-backpressure for live capture,
  blocking push for faithful file replay
- Kernel-level BPF filtering (-f) and a separate display-only search
  (-g / interactive) that doesn't touch what's captured
- Replay mode (-r) reads a saved pcapng file back through the same
  pipeline as live capture, no root or live device needed
- pcap_stats() surfaces kernel/interface drops invisible to the
  capture queue's own counter
- Three frontends sharing one CaptureSession setup path: CLI, TUI
  (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary)
- 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every
  hand-rolled parser; fuzzing found and fixed a real OOM in the
  pcapng reader (unbounded allocation from an untrusted length field)

1 files changed, 24 insertions, 0 deletions

diff --git a/fuzz/fuzz_ipv6.cpp b/fuzz/fuzz_ipv6.cpp
new file mode 100644
index 0000000..1cae072
--- /dev/null
+++ b/fuzz/fuzz_ipv6.cpp
@@ -0,0 +1,24 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/ipv6.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    auto packet = wireframe::net::parse_ipv6({data, size});
+    if (packet) {
+        // Also exercise the RFC 5952 address formatter - it does its
+        // own byte manipulation (zero-run detection) independent of
+        // parse_ipv6, worth fuzzing on whatever bytes made it through.
+        wireframe::net::ipv6_to_string(packet->header.src);
+        wireframe::net::ipv6_to_string(packet->header.dst);
+
+        // Extension-header walking: a loop that repeatedly trusts an
+        // attacker-controlled length field to advance through the
+        // buffer, over up to 8 iterations - exactly the shape of bug
+        // most worth fuzzing. header.next_header seeds which branch of
+        // the walker runs first; the walker's own logic picks whatever
+        // comes after based on each header's own next_header byte.
+        wireframe::net::walk_ipv6_extension_headers(packet->header.next_header, packet->payload);
+    }
+    return 0;
+}