Initial commit: wireframe packet capture/analysis tool

Terminal packet capture and analysis tool built to learn the C++
memory model (byte layout, alignment, endianness, std::span over
unowned buffers) via a real capture pipeline.

- Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension
  header walking, TCP, UDP) over std::span, no struct-casting
- L7 dissector interface with DNS, HTTP, and TLS SNI implementations
- pcapng read/write for Wireshark-compatible capture files
- Bounded capture queue: drop-on-backpressure for live capture,
  blocking push for faithful file replay
- Kernel-level BPF filtering (-f) and a separate display-only search
  (-g / interactive) that doesn't touch what's captured
- Replay mode (-r) reads a saved pcapng file back through the same
  pipeline as live capture, no root or live device needed
- pcap_stats() surfaces kernel/interface drops invisible to the
  capture queue's own counter
- Three frontends sharing one CaptureSession setup path: CLI, TUI
  (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary)
- 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every
  hand-rolled parser; fuzzing found and fixed a real OOM in the
  pcapng reader (unbounded allocation from an untrusted length field)

1 files changed, 69 insertions, 0 deletions

diff --git a/tests/test_filter.cpp b/tests/test_filter.cpp
new file mode 100644
index 0000000..1dd9373
--- /dev/null
+++ b/tests/test_filter.cpp
@@ -0,0 +1,69 @@
+#include <doctest/doctest.h>
+#include <pcap.h>
+
+#include "wireframe/filter.hpp"
+
+namespace {
+
+// pcap_open_dead() creates a handle that isn't attached to any real
+// interface - exactly what pcap_compile() needs (linktype + snaplen)
+// without requiring root or a live device.
+struct DeadHandle {
+    pcap_t* handle;
+    explicit DeadHandle(int datalink) : handle(pcap_open_dead(datalink, 65535)) {}
+    ~DeadHandle() {
+        if (handle) pcap_close(handle);
+    }
+};
+
+}  // namespace
+
+TEST_CASE("compile_filter accepts a valid tcpdump-style expression") {
+    DeadHandle dead(DLT_EN10MB);
+    REQUIRE(dead.handle != nullptr);
+
+    bpf_program prog{};
+    auto err = wireframe::compile_filter(dead.handle, "tcp port 80", &prog);
+    CHECK_FALSE(err.has_value());
+    pcap_freecode(&prog);
+}
+
+TEST_CASE("compile_filter accepts a compound expression") {
+    DeadHandle dead(DLT_EN10MB);
+    REQUIRE(dead.handle != nullptr);
+
+    bpf_program prog{};
+    auto err = wireframe::compile_filter(dead.handle, "host 10.0.0.1 and not icmp", &prog);
+    CHECK_FALSE(err.has_value());
+    pcap_freecode(&prog);
+}
+
+TEST_CASE("compile_filter rejects invalid syntax with an error message") {
+    DeadHandle dead(DLT_EN10MB);
+    REQUIRE(dead.handle != nullptr);
+
+    bpf_program prog{};
+    auto err = wireframe::compile_filter(dead.handle, "this is not a valid filter !!", &prog);
+    REQUIRE(err.has_value());
+    CHECK_FALSE(err->empty());
+}
+
+TEST_CASE("compile_filter works against DLT_RAW, not just Ethernet") {
+    DeadHandle dead(DLT_RAW);
+    REQUIRE(dead.handle != nullptr);
+
+    bpf_program prog{};
+    auto err = wireframe::compile_filter(dead.handle, "udp", &prog);
+    CHECK_FALSE(err.has_value());
+    pcap_freecode(&prog);
+}
+
+TEST_CASE("compile_filter rejects an Ethernet-only expression against DLT_RAW") {
+    DeadHandle dead(DLT_RAW);
+    REQUIRE(dead.handle != nullptr);
+
+    bpf_program prog{};
+    // "ether" primitives are meaningless without a link-layer header.
+    auto err = wireframe::compile_filter(dead.handle, "ether host 00:11:22:33:44:55", &prog);
+    CHECK(err.has_value());
+}