Wireshark-dev: [Wireshark-dev] SocketCAN Support is broken in latest Wireshark-v4.3.0rc0-1430-g

From: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
Date: Tue, 6 Feb 2024 19:42:47 +0100
Hi all,

unfortunately I did not get any feedback from subscribing to this list via https://www.wireshark.org/mailman/listinfo/wireshark-dev - so I'm just sending my issue directly to the list.

I'm currently working on CAN XL support which is the latest CAN protocol after Classical CAN and CAN FD.

With Wireshark 3.6 I was able to add this dissector for CAN XL
https://github.com/hartkopp/canxl-utils/blob/main/wireshark/can_xl.lua
where Wireshark displayed Classical CAN, CAN FD and CAN XL correctly.

As I could see from Guys commit 39604740898f ("socketcan: support the CANFD_FDF flag for identifying CAN FD frames.") there has been a change from LINKTYPE_LINUX_SLL (worked and had different ETH_P_* types) to LINKTYPE_CAN_SOCKETCAN.

I assume with the LINKTYPE_CAN_SOCKETCAN the correct display of the different CAN traffic types broke.

The below traffic on a virtual CAN XL device has been created with:

$ cansend xlsrc 123#1122
$ cansend xlsrc 123##511223344
$ canxlgen xlsrc -l 10:10 -s -v
00242#81.00.AFAFAFAF.00000000.00000000.0000

$ canxlrcv xlsrc
(1707244011.846798) xlsrc 123#1122
(1707244019.414383) xlsrc 123##511223344
(1707244023.054845) xlsrc 00242#81.00.AFAFAFAF.00000000.00000000.0000

But for Wireshark there is only Classical CAN traffic happening (see attached picture) - not even the CAN FD frame is detected in the "Protocol" field and correctly decoded with the CAN FD specific flags.
Only Classical CAN decoding is applied on any type of CAN traffic.

So why are the other CAN frame types not visible (via LINKTYPE_CAN_SOCKETCAN) ??

When the ETH_P_CAN/ETH_P_CANFD/ETH_P_CANXL Linux ethernet types are not visible within the LINKTYPE_CAN_SOCKETCAN the frame types can be distinguished by:

Length = 16 == sizeof(struct can_frame) -> Classical CAN
Length = 72 == sizeof(struct canfd_frame) -> CAN FD
Byte at Offset 4 (former CAN data length) has 0x80 set -> CAN XL

So how can I help to fix the broken display of CAN types and also add proper CAN XL support?

Best regards,
Oliver

Attachment: Wireshark-v4.3.0rc0-1430-g600de02805d0.png
Description: PNG image