Initial commit: wireframe packet capture/analysis tool

Terminal packet capture and analysis tool built to learn the C++
memory model (byte layout, alignment, endianness, std::span over
unowned buffers) via a real capture pipeline.

- Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension
  header walking, TCP, UDP) over std::span, no struct-casting
- L7 dissector interface with DNS, HTTP, and TLS SNI implementations
- pcapng read/write for Wireshark-compatible capture files
- Bounded capture queue: drop-on-backpressure for live capture,
  blocking push for faithful file replay
- Kernel-level BPF filtering (-f) and a separate display-only search
  (-g / interactive) that doesn't touch what's captured
- Replay mode (-r) reads a saved pcapng file back through the same
  pipeline as live capture, no root or live device needed
- pcap_stats() surfaces kernel/interface drops invisible to the
  capture queue's own counter
- Three frontends sharing one CaptureSession setup path: CLI, TUI
  (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary)
- 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every
  hand-rolled parser; fuzzing found and fixed a real OOM in the
  pcapng reader (unbounded allocation from an untrusted length field)

1 files changed, 78 insertions, 0 deletions

diff --git a/tests/test_http.cpp b/tests/test_http.cpp
new file mode 100644
index 0000000..7ccc9ff
--- /dev/null
+++ b/tests/test_http.cpp
@@ -0,0 +1,78 @@
+#include <doctest/doctest.h>
+
+#include <vector>
+
+#include "wireframe/l7/http.hpp"
+
+using namespace wireframe::net;
+
+namespace {
+
+std::vector<unsigned char> to_bytes(std::string_view text) {
+    return std::vector<unsigned char>(text.begin(), text.end());
+}
+
+}  // namespace
+
+TEST_CASE("parse_http decodes a GET request with a Host header") {
+    auto bytes = to_bytes("GET /index.html HTTP/1.1\r\nHost: example.com\r\nUser-Agent: x\r\n\r\n");
+    auto msg = parse_http(bytes);
+    REQUIRE(msg.has_value());
+    CHECK(msg->is_request);
+    CHECK(msg->method_or_version == "GET");
+    CHECK(msg->target_or_status == "/index.html");
+    REQUIRE(msg->host.has_value());
+    CHECK(*msg->host == "example.com");
+}
+
+TEST_CASE("parse_http decodes a POST request without a Host header") {
+    auto bytes = to_bytes("POST /api/submit HTTP/1.1\r\nContent-Length: 0\r\n\r\n");
+    auto msg = parse_http(bytes);
+    REQUIRE(msg.has_value());
+    CHECK(msg->method_or_version == "POST");
+    CHECK(msg->target_or_status == "/api/submit");
+    CHECK_FALSE(msg->host.has_value());
+}
+
+TEST_CASE("parse_http decodes a status line as a response") {
+    auto bytes = to_bytes("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n");
+    auto msg = parse_http(bytes);
+    REQUIRE(msg.has_value());
+    CHECK_FALSE(msg->is_request);
+    CHECK(msg->method_or_version == "HTTP/1.1");
+    CHECK(msg->target_or_status == "404");
+}
+
+TEST_CASE("parse_http tolerates a bare LF request line") {
+    auto bytes = to_bytes("GET / HTTP/1.0\n\n");
+    auto msg = parse_http(bytes);
+    REQUIRE(msg.has_value());
+    CHECK(msg->target_or_status == "/");
+}
+
+TEST_CASE("parse_http rejects payloads that don't look like HTTP") {
+    auto bytes = to_bytes("this is not http traffic at all\r\n");
+    CHECK_FALSE(parse_http(bytes).has_value());
+}
+
+TEST_CASE("parse_http rejects an empty payload") {
+    std::vector<unsigned char> bytes;
+    CHECK_FALSE(parse_http(bytes).has_value());
+}
+
+TEST_CASE("parse_http rejects a request line with no target/version fields") {
+    auto bytes = to_bytes("GET\r\n\r\n");
+    CHECK_FALSE(parse_http(bytes).has_value());
+}
+
+TEST_CASE("HttpDissector claims port 80 and its summary matches parse_http") {
+    HttpDissector dissector;
+    CHECK(dissector.port() == kHttpPort);
+
+    auto bytes = to_bytes("GET /path HTTP/1.1\r\nHost: wireframe.test\r\n\r\n");
+    auto summary = dissector.summarize(bytes);
+    REQUIRE(summary.has_value());
+    CHECK(summary->substr(0, 4) == "HTTP");
+    CHECK(summary->find("GET /path") != std::string::npos);
+    CHECK(summary->find("wireframe.test") != std::string::npos);
+}