[PATCH 0/4] Wireshark SocketCAN updates

[PATCH 0/4] Wireshark SocketCAN updates

[Oliver Hartkopp]

This patchset simplifies the CAN packet type detection as it focusses
on the rules to distiguish the different CAN CC/FD/XL frames from the
Linux kernel API.

Additionally some more content is shown in the dissector and the
CAN CiA 611-1 definitions have been cleaned up and extended by CiA.

Oliver Hartkopp (4):
  socketcan: simplify CAN packet type detection
  socketcan: display CANFD_FDF and CANXL_XLF flag content
  socketcan: display len8dlc content for Classical CAN
  socketcan: update CAN CiA 611-1 definitions

 epan/dissectors/packet-socketcan.c | 86 ++++++++++--------------------
 epan/dissectors/packet-socketcan.h | 17 +++---
 2 files changed, 39 insertions(+), 64 deletions(-)

-- 
2.43.0

[PATCH 1/4] socketcan: simplify CAN packet type detection

[Oliver Hartkopp]

The different CAN frame types are defined by Linux SLL_P types in the
sll_protocol field and the length of the frame.

LINUX_SLL_P_CANXL:
The frame length for CAN XL can be 12 + 1 to 12 + 2048 (13 .. 2060) byte.
Additionally the CANXL_XLF flag has to be set.

LINUX_SLL_P_CAN and LINUX_SLL_P_CANFD:
The frame length for CAN CC is 16 byte and for CAN FD it is 72 byte.
Additionally the CANXL_XLF flag is cleared in CAN CC/FD frames.

Simplify the CAN packet type detection by checking exactly the above
rules without checking the CANFD_FDF flag which is not guarantied
over all Linux kernel versions.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 epan/dissectors/packet-socketcan.c | 56 +++++-------------------------
 1 file changed, 8 insertions(+), 48 deletions(-)

diff --git a/epan/dissectors/packet-socketcan.c b/epan/dissectors/packet-socketcan.c
index e441c44ade..e9fcdb2dd8 100644
--- a/epan/dissectors/packet-socketcan.c
+++ b/epan/dissectors/packet-socketcan.c
@@ -110,10 +110,11 @@ static heur_dtbl_entry_t *heur_dtbl_entry;
 #define CANFD_FLAG_OFFSET  5
 
 #define CANFD_BRS 0x01 /* bit rate switch (second bitrate for payload data) */
 #define CANFD_ESI 0x02 /* error state indicator of the transmitting node */
 
+#define CANXL_FLAGS_OFFSET CAN_LEN_OFFSET
 #define CANXL_LEN_OFFSET   6
 #define CANXL_DATA_OFFSET  12
 
 static dissector_table_t can_id_dissector_table = NULL;
 static dissector_table_t can_extended_id_dissector_table = NULL;
@@ -589,69 +590,28 @@ dissect_socketcan_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu
     static int * const canxl_flag_fields[] = {
         &hf_canxl_secflag,
         NULL,
     };
 
-    /*
-     * If we weren't told the type of this frame, check
-     * whether the CANFD_FDF flag is set in the FD flags
-     * field of the header; if so, it's a CAN FD frame.
-     * otherwise, it's a CAN frame.
-     *
-     * However, trust the CANFD_FDF flag only if the only
-     * bits set in the FD flags field are the known bits,
-     * and the two bytes following that field are both
-     * zero.  This is because some older LINKTYPE_CAN_SOCKETCAN
-     * frames had uninitialized junk in the FD flags field,
-     * so we treat a frame with what appears to be uninitialized
-     * junk as being CAN rather than CAN FD, under the assumption
-     * that the CANFD_FDF bit is set because the field is
-     * uninitialized, not because it was explicitly set because
-     * it's a CAN FD frame.  At least some newer code that sets
-     * that flag also makes sure that the fields in question are
-     * initialized, so we assume that if they're not initialized
-     * the code is older code that didn't support CAN FD.
-     */
+    /* determine CAN packet type */
     if (can_packet_type == PACKET_TYPE_UNKNOWN) {
-        guint8 frame_length;
-        guint8 fd_flags;
+        guint8 canxl_flags;
 
         /*
          * Check whether the frame has the CANXL_XLF flag set in what
          * is in the location of the frame length field of a CAN classic
          * or CAN FD frame; if so, then it's a CAN XL frame (and that
          * field is the flags field of that frame).
          */
-        frame_length = tvb_get_guint8(tvb, CAN_LEN_OFFSET);
-        if (frame_length & CANXL_XLF) {
+        canxl_flags = tvb_get_guint8(tvb, CANXL_FLAGS_OFFSET);
+        if ((tvb_reported_length(tvb) > 12) && (canxl_flags & CANXL_XLF)) {
             can_packet_type = PACKET_TYPE_CAN_XL;
         } else {
-            /*
-             * This is a CAN classic or CAN FD frame.
-             * Check whether the flags field has the CANFD_FDF
-             * flag set, has no unknown flag bits set, and has
-             * no bits set in the two reserved fields.  If so,
-             * it's a CAN FD frame; otherwise, it's either a
-             * CAN classic frame, or a frame where the CANFD_FDF
-             * flag is set but where that might just be because
-             * that field contains uninitialized junk rather
-             * than because it's a CAN FD frame, so we treat it
-             * as a CAN classic frame.
-             */
-            fd_flags = tvb_get_guint8(tvb, CANFD_FLAG_OFFSET);
-
-            if ((fd_flags & CANFD_FDF) &&
-                    ((fd_flags & ~(CANFD_BRS | CANFD_ESI | CANFD_FDF)) == 0) &&
-                    tvb_get_guint8(tvb, CANFD_FLAG_OFFSET + 1) == 0 &&
-                    tvb_get_guint8(tvb, CANFD_FLAG_OFFSET + 2) == 0) {
+            if (tvb_reported_length(tvb) == 72)
                 can_packet_type = PACKET_TYPE_CAN_FD;
-            } else {
-                if (tvb_reported_length(tvb) == 72)
-                    can_packet_type = PACKET_TYPE_CAN_FD;
-                else
-                    can_packet_type = PACKET_TYPE_CAN;
-            }
+            else if  (tvb_reported_length(tvb) == 16)
+                can_packet_type = PACKET_TYPE_CAN;
         }
     }
 
     can_info.bus_id = get_bus_id(pinfo);
 
-- 
2.43.0

[PATCH 2/4] socketcan: display CANFD_FDF and CANXL_XLF flag content

[Oliver Hartkopp]

Display the officially defined bits for CAN XL and CAN FD.
While CANXL_XLF is a mandatory set bit value for CAN XL frames
the CANFD_FDF bit might be set based on the used Linux kernel
version. So both bits present valuable content for the user.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 epan/dissectors/packet-socketcan.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/epan/dissectors/packet-socketcan.c b/epan/dissectors/packet-socketcan.c
index e9fcdb2dd8..2e29484085 100644
--- a/epan/dissectors/packet-socketcan.c
+++ b/epan/dissectors/packet-socketcan.c
@@ -75,18 +75,20 @@ static int hf_can_err_trx_canl;
 static int hf_can_err_ctrl_specific;
 
 static int hf_canxl_priority;
 static int hf_canxl_vcid;
 static int hf_canxl_secflag;
+static int hf_canxl_xlflag;
 static int hf_canxl_sdu_type;
 static int hf_canxl_len;
 static int hf_canxl_acceptance_field;
 
 static expert_field ei_can_err_dlc_mismatch;
 
 static int hf_canfd_brsflag;
 static int hf_canfd_esiflag;
+static int hf_canfd_fdflag;
 
 static gint ett_can;
 static gint ett_can_fd;
 static gint ett_can_xl;
 
@@ -107,13 +109,10 @@ static heur_dtbl_entry_t *heur_dtbl_entry;
 #define CAN_LEN_OFFSET     4
 #define CAN_DATA_OFFSET    8
 
 #define CANFD_FLAG_OFFSET  5
 
-#define CANFD_BRS 0x01 /* bit rate switch (second bitrate for payload data) */
-#define CANFD_ESI 0x02 /* error state indicator of the transmitting node */
-
 #define CANXL_FLAGS_OFFSET CAN_LEN_OFFSET
 #define CANXL_LEN_OFFSET   6
 #define CANXL_DATA_OFFSET  12
 
 static dissector_table_t can_id_dissector_table = NULL;
@@ -564,10 +563,11 @@ dissect_socketcan_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu
         NULL,
     };
     static int * const canfd_flag_fields[] = {
         &hf_canfd_brsflag,
         &hf_canfd_esiflag,
+        &hf_canfd_fdflag,
         NULL,
     };
     static int * const can_err_flags[] = {
         &hf_can_errflag,
         &hf_can_err_tx_timeout,
@@ -587,10 +587,11 @@ dissect_socketcan_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu
         &hf_canxl_vcid,
         NULL,
     };
     static int * const canxl_flag_fields[] = {
         &hf_canxl_secflag,
+        &hf_canxl_xlflag,
         NULL,
     };
 
     /* determine CAN packet type */
     if (can_packet_type == PACKET_TYPE_UNKNOWN) {
@@ -860,10 +861,12 @@ proto_register_socketcan(void) {
             "Padding", "can.padding", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
         { &hf_canfd_brsflag, {
             "Bit Rate Setting", "canfd.flags.brs", FT_BOOLEAN, 8, NULL, CANFD_BRS, NULL, HFILL } },
         { &hf_canfd_esiflag, {
             "Error State Indicator", "canfd.flags.esi", FT_BOOLEAN, 8, NULL, CANFD_ESI, NULL, HFILL } },
+        { &hf_canfd_fdflag, {
+            "FD Frame", "canfd.flags.fdf", FT_BOOLEAN, 8, NULL, CANFD_FDF, NULL, HFILL } },
         { &hf_can_err_tx_timeout, {
             "Transmit timeout", "can.err.tx_timeout", FT_BOOLEAN, 32, NULL, CAN_ERR_TX_TIMEOUT, NULL, HFILL } },
         { &hf_can_err_lostarb, {
             "Lost arbitration", "can.err.lostarb", FT_BOOLEAN, 32, NULL, CAN_ERR_LOSTARB, NULL, HFILL } },
         { &hf_can_err_ctrl, {
@@ -926,10 +929,12 @@ proto_register_socketcan(void) {
             "Priority", "canxl.priority", FT_UINT32, BASE_DEC, NULL, 0x0000FFFF, NULL, HFILL } },
         { &hf_canxl_vcid, {
             "VCID", "canxl.vcid", FT_UINT32, BASE_DEC, NULL, 0x00FF0000, NULL, HFILL } },
         { &hf_canxl_secflag, {
             "Simple Extended Context", "canxl.flags.sec", FT_BOOLEAN, 8, NULL, CANXL_SEC, NULL, HFILL } },
+        { &hf_canxl_xlflag, {
+            "XL Frame", "canxl.flags.xl", FT_BOOLEAN, 8, NULL, CANXL_XLF, NULL, HFILL } },
         { &hf_canxl_sdu_type, {
             "SDU type", "canxl.sdu_type", FT_UINT8, BASE_HEX, VALS(canxl_sdu_type_vals), 0, NULL, HFILL } },
         { &hf_canxl_len, {
             "Frame-Length", "canxl.len", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
         { &hf_canxl_acceptance_field, {
-- 
2.43.0

[PATCH 3/4] socketcan: display len8dlc content for Classical CAN

[Oliver Hartkopp]

While the Classical CAN frame can transport only 8 byte of data the
4 bit data length code (DLC) has the ability to have a value range
from 0 to 15. To be able to send and receive DLC values from 9 to 15
the struct can_frame contains an additional len8dlc element which
can have values from 9 to 15 when the data length value is 8.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 epan/dissectors/packet-socketcan.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/epan/dissectors/packet-socketcan.c b/epan/dissectors/packet-socketcan.c
index 2e29484085..4ca0479f79 100644
--- a/epan/dissectors/packet-socketcan.c
+++ b/epan/dissectors/packet-socketcan.c
@@ -33,10 +33,11 @@ static int hf_can_infoent_ext;
 static int hf_can_infoent_std;
 static int hf_can_extflag;
 static int hf_can_rtrflag;
 static int hf_can_errflag;
 static int hf_can_reserved;
+static int hf_can_len8dlc;
 static int hf_can_padding;
 
 static int hf_can_err_tx_timeout;
 static int hf_can_err_lostarb;
 static int hf_can_err_ctrl;
@@ -720,11 +721,12 @@ dissect_socketcan_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gu
 
         if (can_packet_type == PACKET_TYPE_CAN_FD) {
             proto_tree_add_bitmask_list(can_tree, tvb, CANFD_FLAG_OFFSET, 1, canfd_flag_fields, ENC_NA);
             proto_tree_add_item(can_tree, hf_can_reserved, tvb, CANFD_FLAG_OFFSET+1, 2, ENC_NA);
         } else {
-            proto_tree_add_item(can_tree, hf_can_reserved, tvb, CANFD_FLAG_OFFSET, 3, ENC_NA);
+            proto_tree_add_item(can_tree, hf_can_reserved, tvb, CANFD_FLAG_OFFSET, 2, ENC_NA);
+            proto_tree_add_item(can_tree, hf_can_len8dlc, tvb, CANFD_FLAG_OFFSET+2, 1, ENC_NA);
         }
 
         if (frame_type == LINUX_CAN_ERR) {
             int * const *flag;
             const char *sepa = ": ";
@@ -853,10 +855,12 @@ proto_register_socketcan(void) {
             "Remote Transmission Request Flag", "can.flags.rtr", FT_BOOLEAN, 32, NULL, CAN_RTR_FLAG, NULL, HFILL } },
         { &hf_can_errflag, {
             "Error Message Flag", "can.flags.err", FT_BOOLEAN, 32, NULL, CAN_ERR_FLAG, NULL, HFILL } },
         { &hf_can_len, {
             "Frame-Length", "can.len", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
+        { &hf_can_len8dlc, {
+            "Len 8 DLC", "can.len8dlc", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
         { &hf_can_reserved, {
             "Reserved", "can.reserved", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
         { &hf_can_padding, {
             "Padding", "can.padding", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
         { &hf_canfd_brsflag, {
-- 
2.43.0

[PATCH 4/4] socketcan: update CAN CiA 611-1 definitions

[Oliver Hartkopp]

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 epan/dissectors/packet-socketcan.c | 13 ++++++++-----
 epan/dissectors/packet-socketcan.h | 17 ++++++++++-------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/epan/dissectors/packet-socketcan.c b/epan/dissectors/packet-socketcan.c
index 4ca0479f79..09b5f687fc 100644
--- a/epan/dissectors/packet-socketcan.c
+++ b/epan/dissectors/packet-socketcan.c
@@ -171,15 +171,18 @@ static const value_string can_err_trx_canl_vals[] = {
 
 static const value_string canxl_sdu_type_vals[] = {
     { 0x00, "Reserved" },
     { CANXL_SDU_TYPE_CONTENT_BASED_ADDRESSING, "Content-based Addressing" },
     { 0x02, "Reserved for future use" },
-    { CANXL_SDU_TYPE_CLASSICAL_CAN_AND_CAN_FD_MAPPED_TUNNELING, "Classical CAN/CAN FD mapped tunneling" },
-    { CANXL_SDU_TYPE_IEEE_802_3_MAC_FRAME_TUNNELLING, "IEEE 802.3 (MAC frame) tunneling" },
-    { CANXL_SDU_TYPE_IEEE_802_3_MAC_FRAME_MAPPED_TUNNELING, "IEEE 802.3 (MAC frame) mapped tunneling" },
-    { CANXL_SDU_TYPE_CLASSICAL_CAN_MAPPED_TUNNELING, "Classical CAN mapped tunneling" },
-    { CANXL_SDU_TYPE_CAN_FD_MAPPED_TUNNELING, "CAN FD mapped tunneling" },
+    { CANXL_SDU_TYPE_CAN_CC_CAN_FD, "CAN CC/CAN FD" },
+    { CANXL_SDU_TYPE_IEEE_802_3, "IEEE 802.3 (MAC frame)" },
+    { CANXL_SDU_TYPE_IEEE_802_3_EXTENDED, "IEEE 802.3 (MAC frame) extended" },
+    { CANXL_SDU_TYPE_CAN_CC, "CAN CC" },
+    { CANXL_SDU_TYPE_CAN_FD, "CAN FD" },
+    { CANXL_SDU_TYPE_CIA_611_2, "CiA 611-2 (Multi-PDU)" },
+    { CANXL_SDU_TYPE_AUTOSAR_MPDU, "AUTOSAR Multi-PDU" },
+    { CANXL_SDU_TYPE_CIA_613_2, "CiA 613-2 (CANsec key agreement protocol" },
     { 0xFF, "Reserved" },
     { 0, NULL }
 };
 
 /********* UATs *********/
diff --git a/epan/dissectors/packet-socketcan.h b/epan/dissectors/packet-socketcan.h
index f82fa5e20b..87f51b2328 100644
--- a/epan/dissectors/packet-socketcan.h
+++ b/epan/dissectors/packet-socketcan.h
@@ -123,18 +123,21 @@ typedef struct can_info {
 
 gboolean socketcan_call_subdissectors(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, struct can_info *can_info, const gboolean use_heuristics_first);
 gboolean socketcan_set_source_and_destination_columns(packet_info* pinfo, can_info_t *caninfo);
 
 /*
- * CAN XL SDU types.
+ * CAN XL SDU types from CAN CiA 611-1
  */
-#define CANXL_SDU_TYPE_CONTENT_BASED_ADDRESSING	                 0x01
-#define CANXL_SDU_TYPE_CLASSICAL_CAN_AND_CAN_FD_MAPPED_TUNNELING 0x03
-#define CANXL_SDU_TYPE_IEEE_802_3_MAC_FRAME_TUNNELLING           0x04
-#define CANXL_SDU_TYPE_IEEE_802_3_MAC_FRAME_MAPPED_TUNNELING     0x05
-#define CANXL_SDU_TYPE_CLASSICAL_CAN_MAPPED_TUNNELING            0x06
-#define CANXL_SDU_TYPE_CAN_FD_MAPPED_TUNNELING                   0x07
+#define CANXL_SDU_TYPE_CONTENT_BASED_ADDRESSING 0x01
+#define CANXL_SDU_TYPE_CAN_CC_CAN_FD            0x03
+#define CANXL_SDU_TYPE_IEEE_802_3               0x04
+#define CANXL_SDU_TYPE_IEEE_802_3_EXTENDED      0x05
+#define CANXL_SDU_TYPE_CAN_CC                   0x06
+#define CANXL_SDU_TYPE_CAN_FD                   0x07
+#define CANXL_SDU_TYPE_CIA_611_2                0x08
+#define CANXL_SDU_TYPE_AUTOSAR_MPDU             0x09
+#define CANXL_SDU_TYPE_CIA_613_2                0x0A
 
 #endif /* __PACKET_SOCKETCAN_H__ */
 
 /*
  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
-- 
2.43.0

Re: [Wireshark-dev] [PATCH 0/4] Wireshark SocketCAN updates

[Gerald Combs]

Thanks for your contribution! Can you submit a merge request at

https://gitlab.com/wireshark/wireshark/ ?

Complete documentation on contributing code to Wireshark can be found in our Developer's Guide at

https://www.wireshark.org/docs/wsdg_html/#ChSrcContribute

On 3/18/24 3:46 AM, Oliver Hartkopp via Wireshark-dev wrote:
> This patchset simplifies the CAN packet type detection as it focusses
> on the rules to distiguish the different CAN CC/FD/XL frames from the
> Linux kernel API.
> 
> Additionally some more content is shown in the dissector and the
> CAN CiA 611-1 definitions have been cleaned up and extended by CiA.
> 
> Oliver Hartkopp (4):
>    socketcan: simplify CAN packet type detection
>    socketcan: display CANFD_FDF and CANXL_XLF flag content
>    socketcan: display len8dlc content for Classical CAN
>    socketcan: update CAN CiA 611-1 definitions
> 
>   epan/dissectors/packet-socketcan.c | 86 ++++++++++--------------------
>   epan/dissectors/packet-socketcan.h | 17 +++---
>   2 files changed, 39 insertions(+), 64 deletions(-)
> 

Re: [Wireshark-dev] [PATCH 0/4] Wireshark SocketCAN updates

[Oliver Hartkopp]

Hi Gerald,

thanks for the pointer and the excellent documentation!!
That was a 10 minutes job:

https://gitlab.com/wireshark/wireshark/-/merge_requests/14886

I assumed the Wireshark development process taking place on the mailing 
list - but GitLab is even better. Happy review ;-)

Many thanks and best regards,
Oliver

On 2024-03-18 17:37, Gerald Combs wrote:
> Thanks for your contribution! Can you submit a merge request at
> 
> https://gitlab.com/wireshark/wireshark/ ?
> 
> Complete documentation on contributing code to Wireshark can be found in 
> our Developer's Guide at
> 
> https://www.wireshark.org/docs/wsdg_html/#ChSrcContribute
> 
> On 3/18/24 3:46 AM, Oliver Hartkopp via Wireshark-dev wrote:
>> This patchset simplifies the CAN packet type detection as it focusses
>> on the rules to distiguish the different CAN CC/FD/XL frames from the
>> Linux kernel API.
>>
>> Additionally some more content is shown in the dissector and the
>> CAN CiA 611-1 definitions have been cleaned up and extended by CiA.
>>
>> Oliver Hartkopp (4):
>>    socketcan: simplify CAN packet type detection
>>    socketcan: display CANFD_FDF and CANXL_XLF flag content
>>    socketcan: display len8dlc content for Classical CAN
>>    socketcan: update CAN CiA 611-1 definitions
>>
>>   epan/dissectors/packet-socketcan.c | 86 ++++++++++--------------------
>>   epan/dissectors/packet-socketcan.h | 17 +++---
>>   2 files changed, 39 insertions(+), 64 deletions(-)
>>
>