Add privilege dropping, AF_PACKET demo, ICMP, checksum validation, --help, and TCP reassembly

Rounds out the build order in PLAN.md with six incremental additions:
drop root privileges immediately after opening the capture handle;
a standalone AF_PACKET/mmap ring-buffer demo (kept separate from
CaptureSession, see its header comment for why); ICMPv4/ICMPv6 type
and code decoding; opt-in IPv4/TCP/UDP checksum validation (-c);
CLI --help; and opt-in, in-order-only TCP stream reassembly (-a) so
HTTP requests/responses split across segments can be seen whole.
Each addition is unit-tested and, where it touches live traffic
behavior, verified against real captured packets - see PLAN.md's
Decisions section for the verification notes on each.

1 files changed, 85 insertions, 0 deletions

diff --git a/tests/test_icmp.cpp b/tests/test_icmp.cpp
new file mode 100644
index 0000000..3dd713e
--- /dev/null
+++ b/tests/test_icmp.cpp
@@ -0,0 +1,85 @@
+#include <doctest/doctest.h>
+
+#include <vector>
+
+#include "wireframe/net/icmp.hpp"
+
+using namespace wireframe::net;
+
+TEST_CASE("parse_icmpv4 decodes an echo request with identifier/sequence") {
+    std::vector<unsigned char> bytes = {8, 0, 0x00, 0x00, 0x1c, 0x05, 0x00, 0x01};
+    auto icmp = parse_icmpv4(bytes);
+    REQUIRE(icmp.has_value());
+    CHECK(icmp->type == 8);
+    CHECK(icmp->code == 0);
+    REQUIRE(icmp->identifier.has_value());
+    CHECK(*icmp->identifier == 0x1c05);
+    REQUIRE(icmp->sequence.has_value());
+    CHECK(*icmp->sequence == 1);
+}
+
+TEST_CASE("parse_icmpv4 decodes an echo reply the same way as a request") {
+    std::vector<unsigned char> bytes = {0, 0, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02};
+    auto icmp = parse_icmpv4(bytes);
+    REQUIRE(icmp.has_value());
+    CHECK(icmp->type == 0);
+    REQUIRE(icmp->identifier.has_value());
+    CHECK(*icmp->identifier == 1);
+}
+
+TEST_CASE("parse_icmpv4 decodes a non-echo type without an identifier/sequence") {
+    std::vector<unsigned char> bytes = {3, 1, 0x00, 0x00};  // dest unreachable, host unreachable
+    auto icmp = parse_icmpv4(bytes);
+    REQUIRE(icmp.has_value());
+    CHECK(icmp->type == 3);
+    CHECK(icmp->code == 1);
+    CHECK_FALSE(icmp->identifier.has_value());
+}
+
+TEST_CASE("parse_icmpv4 rejects a buffer shorter than the fixed header") {
+    std::vector<unsigned char> bytes(3, 0);
+    CHECK_FALSE(parse_icmpv4(bytes).has_value());
+}
+
+TEST_CASE("icmpv4_type_name covers known types and falls back for unknown ones") {
+    CHECK(icmpv4_type_name(8) == "Echo Request");
+    CHECK(icmpv4_type_name(0) == "Echo Reply");
+    CHECK(icmpv4_type_name(3) == "Destination Unreachable");
+    CHECK(icmpv4_type_name(200) == "type=200");
+}
+
+TEST_CASE("parse_icmpv6 decodes an echo request with identifier/sequence") {
+    std::vector<unsigned char> bytes = {128, 0, 0x00, 0x00, 0x1c, 0x05, 0x00, 0x01};
+    auto icmp = parse_icmpv6(bytes);
+    REQUIRE(icmp.has_value());
+    CHECK(icmp->type == 128);
+    REQUIRE(icmp->identifier.has_value());
+    CHECK(*icmp->identifier == 0x1c05);
+}
+
+TEST_CASE("parse_icmpv6 decodes a non-echo type (e.g. Neighbor Solicitation) without id/seq") {
+    std::vector<unsigned char> bytes = {135, 0, 0x00, 0x00};
+    auto icmp = parse_icmpv6(bytes);
+    REQUIRE(icmp.has_value());
+    CHECK(icmp->type == 135);
+    CHECK_FALSE(icmp->identifier.has_value());
+}
+
+TEST_CASE("icmpv6_type_name covers known types and falls back for unknown ones") {
+    CHECK(icmpv6_type_name(128) == "Echo Request");
+    CHECK(icmpv6_type_name(135) == "Neighbor Solicitation");
+    CHECK(icmpv6_type_name(134) == "Router Advertisement");
+    CHECK(icmpv6_type_name(250) == "type=250");
+}
+
+TEST_CASE("the same type number means something different in each protocol's table") {
+    // The whole reason these are two separate tables, not one shared by
+    // number: ICMPv4's echo request is type 8, but ICMPv6's type 8
+    // isn't in its table at all (echo request is 128 there instead).
+    CHECK(icmpv4_type_name(8) == "Echo Request");
+    CHECK(icmpv6_type_name(8) == "type=8");
+    // And type 4 means "Parameter Problem" in ICMPv6 but is unmapped
+    // (falls back) in the ICMPv4 table.
+    CHECK(icmpv6_type_name(4) == "Parameter Problem");
+    CHECK(icmpv4_type_name(4) == "Source Quench");
+}