NETOBSERV 2859 Wire correlation + live TUI

[jpinsonneau]

Description

Follow-up to NETOBSERV-2858 (OpenSSL TLS plaintext → JSONL export). This PR (NETOBSERV-2859) adds wire↔plaintext correlation and a live TUI for TLS plaintext during on-demand netobserv packets captures. Everything is gated on --enable_openssl — GoTLS/kTLS are intentionally left out until the eBPF agent side lands.

The meaningful review scope is the final commit, "Wire correlation + live TUI"; earlier commits are the already-reviewed 2858 base.

What's new

• Correlation engine (packet_capture_wire_buffer.go) — buffers wire (PCA) packets and pending plaintext events, then matches them by a scored strategy: strict 5-tuple → remote-endpoint → loose-endpoint → capture-filter, with an agent/receive-time correlation window and a TCP-payload-vs-handshake bonus. Ambiguous matches (two candidates within a small margin) are refused rather than guessed. On a match, the wire packet's 5-tuple and FLP Kubernetes fields are overlaid onto the plaintext record.

• pcap EPB annotations + PcapAnnotated — when a plaintext event correlates to a real wire frame, its preview is written as an EPB comment on that packet (with the plaintext PacketID), and the exported record's PcapAnnotated flips to true. Uncorrelated events flush with PcapAnnotated=false. Replaces the previous NETOBSERV-2859 no-op stub.

• Capture filters (packet_capture_filters.go) — --port / --peer_ip / --peer_cidr are parsed into correlation hints and used both to enrich partial plaintext tuples and to score filter-based matches.

• Live TUI (flow_display.go, wire_payload.go, map_format.go, config.yaml) — packet capture with plaintext enabled keeps separate time-sorted wire/plaintext buffers; plaintext rows render green with Event/Type, Plaintext Dir, and Plaintext Preview columns. Selecting a row opens a detail panel showing decoded TLS plaintext (text or hex) or cleartext wire HTTP.

Scope note: plaintextCaptureEnabled() stays OpenSSL-only. The correlation code recognizes gotls/ktls TLSSource values in its pod-compatibility heuristics (pure Go, no eBPF dependency), but those capture paths are not wired.

Dependencies

Builds on the OpenSSL plaintext JSONL export from NETOBSERV-2858 (its commits are included here). No other PRs required.

Checklist

• Does the changes in PR need specific configuration or environment set up for testing?
  • Yes — run netobserv packets --enable_openssl --privileged against an HTTPS workload using libssl (e.g. the openssl-test-pod), ideally scoped with --peer_ip/--peer_cidr and --port. Requires a collector image built from this branch (NETOBSERV_COLLECTOR_IMAGE); the default :main image does not yet ship this code. See docs/tls-decryption-coverage.md.
• I have added thorough unit tests for the change.
  • Correlation scoring, bidirectional/loose/filter matching, one-annotation-per-frame, payload-over-handshake preference, tuple/K8s overlay, capture-filter parsing, wire-HTTP formatting, and TUI buffer/column/preview behavior.
• QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

🤖 Generated with Claude Code

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mffiedler for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 57.60793% with 599 lines in your changes missing coverage. Please review.
✅ Project coverage is 30.04%. Comparing base (fe9ba2f) to head (034b036).
⚠️ Report is 39 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/packet_capture_wire_buffer.go	70.17%	110 Missing and 43 partials ⚠️
cmd/plaintext_format.go	59.00%	111 Missing and 37 partials ⚠️
cmd/packet_capture.go	5.69%	116 Missing ⚠️
cmd/flow_display.go	44.38%	97 Missing and 7 partials ⚠️
cmd/packet_capture_filters.go	64.94%	25 Missing and 9 partials ⚠️
cmd/wire_payload.go	72.58%	9 Missing and 8 partials ⚠️
cmd/map_format.go	0.00%	16 Missing ⚠️
cmd/packet_capture_plaintext.go	76.19%	8 Missing and 2 partials ⚠️
cmd/root.go	91.66%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #582       +/-   ##
===========================================
+ Coverage   13.18%   30.04%   +16.86%     
===========================================
  Files          20       25        +5     
  Lines        2443     3764     +1321     
===========================================
+ Hits          322     1131      +809     
- Misses       2095     2503      +408     
- Partials       26      130      +104     

Flag	Coverage Δ
unittests	30.04% <57.60%> (+16.86%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/options.go	25.00% <ø> (ø)
cmd/root.go	35.23% <91.66%> (+7.57%)	⬆️
cmd/packet_capture_plaintext.go	76.19% <76.19%> (ø)
cmd/map_format.go	26.25% <0.00%> (+0.38%)	⬆️
cmd/wire_payload.go	72.58% <72.58%> (ø)
cmd/packet_capture_filters.go	64.94% <64.94%> (ø)
cmd/flow_display.go	29.43% <44.38%> (+5.74%)	⬆️
cmd/packet_capture.go	4.09% <5.69%> (+4.09%)	⬆️
cmd/plaintext_format.go	59.00% <59.00%> (ø)
cmd/packet_capture_wire_buffer.go	70.17% <70.17%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.