Add FTP, SMTP, TFTP, and IGMP; fix an IGMPv3 group-address misparse

FTP and SMTP share HTTP's line-based response-code-or-command shape
but keep their own command vocabularies in separate files rather than
sharing a parser. FTP passwords are shown as-is, not redacted - FTP
sends them in the clear regardless, matching Wireshark's own behavior.
TFTP is a small binary opcode protocol (RFC 1350) instead. IGMP sits
directly on IP like ICMP, so it's dispatched by protocol number rather
than through the port-keyed L7Registry the other three use.

Live-verified: FTP/SMTP against minimal real TCP servers written for
this (nothing installed locally), a full command/response exchange
decoded correctly in both directions. TFTP against a real atftpd
server and atftp client - the RRQ decoded correctly even though the
transfer itself didn't complete (an atftpd sandbox issue, not this
code). IGMP against real multicast traffic on wlp1s0, including a
genuine query from the actual router.

That live IGMP traffic caught a real bug before it shipped further:
parse_igmp() read bytes[4:8] as a group address for every message
type, but IGMPv3 reports use those bytes for Reserved+RecordCount
instead - a real V3 report showed "group=0.0.0.1" (0 reserved, 1
record, misread as an IP). Fixed by only populating group for the
types where it's genuinely an address; re-verified against the same
live traffic, and a regression test locks in the exact pattern.

1 files changed, 22 insertions, 0 deletions

diff --git a/tests/test_summarize.cpp b/tests/test_summarize.cpp
index d7b223a..9eef454 100644
--- a/tests/test_summarize.cpp
+++ b/tests/test_summarize.cpp
@@ -186,6 +186,28 @@ TEST_CASE("summarize_packet decodes an ARP request end to end") {
           "ARP who-has 10.0.0.2 tell 10.0.0.1 (aa:bb:cc:dd:ee:ff)");
 }
 
+TEST_CASE("summarize_packet decodes IGMP directly on IP (not through a TCP/UDP port)") {
+    std::vector<unsigned char> igmp = {0x16, 0x00, 0x00, 0x00, 239, 255, 255, 250};  // v2 report
+
+    std::vector<unsigned char> ip(20, 0);
+    ip[0] = 0x45;
+    ip[8] = 1;
+    ip[9] = packeteer::net::kProtoIgmp;
+    ip[12] = 10; ip[13] = 0; ip[14] = 0; ip[15] = 1;
+    ip[16] = 239; ip[17] = 255; ip[18] = 255; ip[19] = 250;
+
+    std::vector<unsigned char> eth = {
+        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x08, 0x00,
+    };
+
+    std::vector<unsigned char> frame = eth;
+    frame.insert(frame.end(), ip.begin(), ip.end());
+    frame.insert(frame.end(), igmp.begin(), igmp.end());
+
+    auto line = packeteer::summarize_packet(frame, DLT_EN10MB);
+    CHECK(line.find("IGMP V2 Membership Report group=239.255.255.250") != std::string::npos);
+}
+
 TEST_CASE("summarize_packet unwraps a VLAN tag to reach the real ARP payload underneath") {
     std::vector<unsigned char> bytes = {
         0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF,