From 08332a4195956611db80a2cfe3710d760cbd6acf Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Tue, 14 May 2024 01:42:00 +0200
Subject: Initial commit: wireframe packet capture/analysis tool

Terminal packet capture and analysis tool built to learn the C++
memory model (byte layout, alignment, endianness, std::span over
unowned buffers) via a real capture pipeline.

- Hand-rolled L2-L4 decoders (Ethernet, IPv4, IPv6 with extension
  header walking, TCP, UDP) over std::span, no struct-casting
- L7 dissector interface with DNS, HTTP, and TLS SNI implementations
- pcapng read/write for Wireshark-compatible capture files
- Bounded capture queue: drop-on-backpressure for live capture,
  blocking push for faithful file replay
- Kernel-level BPF filtering (-f) and a separate display-only search
  (-g / interactive) that doesn't touch what's captured
- Replay mode (-r) reads a saved pcapng file back through the same
  pipeline as live capture, no root or live device needed
- pcap_stats() surfaces kernel/interface drops invisible to the
  capture queue's own counter
- Three frontends sharing one CaptureSession setup path: CLI, TUI
  (FTXUI, primary), GUI (Dear ImGui + SDL3, secondary)
- 89 unit tests (doctest) plus 9 libFuzzer harnesses covering every
  hand-rolled parser; fuzzing found and fixed a real OOM in the
  pcapng reader (unbounded allocation from an untrusted length field)
---
 include/wireframe/filter.hpp | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 include/wireframe/filter.hpp

(limited to 'include/wireframe/filter.hpp')

diff --git a/include/wireframe/filter.hpp b/include/wireframe/filter.hpp
new file mode 100644
index 0000000..49fa4ab
--- /dev/null
+++ b/include/wireframe/filter.hpp
@@ -0,0 +1,36 @@
+#pragma once
+
+#include <pcap.h>
+
+#include <optional>
+#include <string>
+
+// Thin wrapper around libpcap's BPF filter compiler. tcpdump-style
+// filter syntax ("tcp port 80", "host 10.0.0.1 and not icmp") already
+// has a correct, well-tested parser and compiler in libpcap itself --
+// hand-rolling a second one would be a large, separate project with no
+// bearing on this one's actual goal (the C++ memory model), so this
+// wraps the existing implementation instead of reinventing it.
+namespace wireframe {
+
+// Compiles `expression` against `handle`'s linktype/snaplen into
+// `out`. `handle` can be a real, already-open capture handle, or a
+// throwaway one from pcap_open_dead() - pcap_compile() only needs the
+// handle to know the linktype and to report errors via pcap_geterr(),
+// it doesn't require an active capture. That's what makes this
+// testable without root or a real interface.
+//
+// Returns nullopt on success (with `out` filled in and owned by the
+// caller - pcap_freecode(out) once it's no longer needed, including
+// after a successful pcap_setfilter()). Returns pcap's error message
+// on failure, and leaves `out` unmodified.
+inline std::optional<std::string> compile_filter(pcap_t* handle, const std::string& expression,
+                                                   bpf_program* out) {
+    if (pcap_compile(handle, out, expression.c_str(), /*optimize=*/1, PCAP_NETMASK_UNKNOWN) ==
+        -1) {
+        return std::string(pcap_geterr(handle));
+    }
+    return std::nullopt;
+}
+
+}  // namespace wireframe
-- 
cgit v1.2.3