Add RTP/RTCP as a labeled heuristic fallback for unmatched UDP traffic

Architecturally different from every other protocol added so far: RTP
has no fixed well-known port at all - it's negotiated per call via
SDP/SIP/WebRTC signaling this project doesn't parse - so L7Registry's
port-keyed dispatch doesn't apply. Handled instead as a fallback tried
only when a UDP packet's normal port-based lookup finds nothing, with
every match labeled "?" (e.g. "RTCP? SR") to mark it as inferred from
packet shape rather than certain - the same honesty Wireshark itself
applies to heuristic dissection, which is off by default there for
exactly this reason.

The two heuristics aren't equally trusted, and the code says so: RTCP
checks a narrow packet-type range (200-204) plus an exact self-declared
length, both unlikely to occur by chance; RTP leans mostly on the 2-bit
version field, since its other structural checks are trivially
satisfied whenever those bits happen to be zero, the common case even
for unrelated traffic. Shipped anyway - a labeled guess on real
RTP/RTCP traffic is more useful than silence - but this is the first
place in the project where a match doesn't mean certainty.

Live-verified against genuine media traffic: ffmpeg streaming a real
RTP video test pattern to loopback, correctly decoded with incrementing
sequence numbers and a consistent SSRC across the stream, plus a real
RTCP Sender Report ffmpeg sent alongside it.

1 files changed, 92 insertions, 0 deletions

diff --git a/tests/test_rtp.cpp b/tests/test_rtp.cpp
new file mode 100644
index 0000000..860f267
--- /dev/null
+++ b/tests/test_rtp.cpp
@@ -0,0 +1,92 @@
+#include <doctest/doctest.h>
+
+#include <vector>
+
+#include "packeteer/net/rtp.hpp"
+
+using namespace packeteer::net;
+
+namespace {
+
+std::vector<unsigned char> rtp_packet(std::uint8_t payload_type, std::uint16_t seq,
+                                        std::uint32_t timestamp, std::uint32_t ssrc,
+                                        std::size_t extra_payload = 0) {
+    std::vector<unsigned char> bytes(12 + extra_payload, 0);
+    bytes[0] = 0x80;  // version 2, no padding, no extension, CC=0
+    bytes[1] = payload_type & 0x7F;
+    bytes[2] = static_cast<unsigned char>(seq >> 8);
+    bytes[3] = static_cast<unsigned char>(seq & 0xFF);
+    bytes[4] = static_cast<unsigned char>(timestamp >> 24);
+    bytes[5] = static_cast<unsigned char>(timestamp >> 16);
+    bytes[6] = static_cast<unsigned char>(timestamp >> 8);
+    bytes[7] = static_cast<unsigned char>(timestamp);
+    bytes[8] = static_cast<unsigned char>(ssrc >> 24);
+    bytes[9] = static_cast<unsigned char>(ssrc >> 16);
+    bytes[10] = static_cast<unsigned char>(ssrc >> 8);
+    bytes[11] = static_cast<unsigned char>(ssrc);
+    return bytes;
+}
+
+}  // namespace
+
+TEST_CASE("parse_rtp_heuristic decodes a plain fixed-header packet") {
+    auto bytes = rtp_packet(0, 1000, 160000, 0xDEADBEEF, 160);
+    auto rtp = parse_rtp_heuristic(bytes);
+    REQUIRE(rtp.has_value());
+    CHECK(rtp->version == 2);
+    CHECK(rtp->payload_type == 0);
+    CHECK(rtp->sequence_number == 1000);
+    CHECK(rtp->timestamp == 160000);
+    CHECK(rtp->ssrc == 0xDEADBEEF);
+    CHECK_FALSE(rtp->padding);
+    CHECK_FALSE(rtp->extension);
+    CHECK(rtp->csrc_count == 0);
+}
+
+TEST_CASE("parse_rtp_heuristic rejects version other than 2") {
+    std::vector<unsigned char> bytes(12, 0);
+    bytes[0] = 0x00;
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());
+}
+
+TEST_CASE("parse_rtp_heuristic rejects payload types reserved to avoid an RTCP clash") {
+    auto bytes = rtp_packet(74, 1, 1, 1);
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());
+}
+
+TEST_CASE("parse_rtp_heuristic accounts for CSRC count when checking buffer length") {
+    std::vector<unsigned char> bytes(12, 0);
+    bytes[0] = 0x82;  // version 2, CC=2: needs 12 + 2*4 = 20 bytes minimum
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());  // buffer too short for claimed CSRCs
+
+    bytes.resize(20, 0);
+    bytes[0] = 0x82;
+    CHECK(parse_rtp_heuristic(bytes).has_value());
+}
+
+TEST_CASE("parse_rtp_heuristic validates the extension header fits when the X bit is set") {
+    std::vector<unsigned char> bytes(12, 0);
+    bytes[0] = 0x90;  // version 2, extension bit set, CC=0
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());  // no room for even the 4-byte ext header
+
+    bytes.resize(16, 0);
+    bytes[0] = 0x90;
+    bytes[14] = 0x00;
+    bytes[15] = 0x00;  // extension length = 0 words
+    CHECK(parse_rtp_heuristic(bytes).has_value());
+}
+
+TEST_CASE("parse_rtp_heuristic validates the padding count when the P bit is set") {
+    std::vector<unsigned char> bytes(16, 0);
+    bytes[0] = 0xA0;  // version 2, padding bit set, CC=0
+    bytes[15] = 0;    // a padding count of 0 is invalid (RFC 3550 5.1)
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());
+
+    bytes[15] = 4;  // a plausible padding count
+    CHECK(parse_rtp_heuristic(bytes).has_value());
+}
+
+TEST_CASE("parse_rtp_heuristic rejects a buffer shorter than the fixed 12-byte header") {
+    std::vector<unsigned char> bytes(8, 0x80);
+    CHECK_FALSE(parse_rtp_heuristic(bytes).has_value());
+}