canbus: reverse-engineer OneControl IDS-CAN bus (read fully mapped, write auth-gated)

Tapped the X180T's CAN bus via CANable 2.0 at the monitor panel's terminator
port. The bus is NOT RV-C — it's Lippert's proprietary IDS-CAN (250k, 11-bit
IDs, (page<<8)|node, 1 Hz broadcasts).

Read side fully mapped from live captures:
- device classes (page-2 type byte: 0x0A tank, 0x1E switched load, 0x21 motor)
- node map for this rig (Catalina 263BHSCK): tanks 27/E2/7D/FE, lights 2A/F8,
  heater 95, pump 61, awning 75 (+ direction & live motor current)
- battery voltage on 29-bit extended frames

Write side: commands are DLC-0 ext frames 0006<node><op>, but auth-gated by a
rolling challenge-response (page 42/43). Replay confirmed dead (spoofed cansend
did not actuate). Not the BLE TEA cypher. response=f(challenge) is deterministic
(no session state) so crackable offline later — seeded 42 pairs in
sniff/2A-auth-pairs.txt.

Includes raw captures (sniff/*.log, force-added past *.log ignore), a read-only
esp32_can ESPHome skeleton, and the log-can.sh sniff helper. Full writeup in
canbus/README.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

canbus/sniff/log-can.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Bring up the CANable at RV-C speed and log timestamped raw frames.
+#
+# Usage:
+#   ./log-can.sh            # bring up can0 @ 250k, live candump
+#   ./log-can.sh rec NAME   # also tee a timestamped log to NAME-<date>.log
+#   ./log-can.sh sniff      # cansniffer color-diff view (toggle a load, watch bytes)
+#   ./log-can.sh down       # take the interface down
+#
+# Requires: can-utils (pacman -S can-utils). CANable 2.0 with candleLight/gs_usb
+# firmware enumerates as a native socketcan device (default can0).
+
+set -euo pipefail
+IFACE="${IFACE:-can0}"
+BITRATE=250000          # RV-C is always 250k
+CMD="${1:-up}"
+
+up() {
+  if ! ip link show "$IFACE" &>/dev/null; then
+    echo "No $IFACE — is the CANable plugged in? (dmesg | grep -i gs_usb)" >&2
+    exit 1
+  fi
+  sudo ip link set "$IFACE" down 2>/dev/null || true
+  sudo ip link set "$IFACE" up type can bitrate "$BITRATE"
+  echo "$IFACE up @ ${BITRATE} bps"
+}
+
+case "$CMD" in
+  up)    up; exec candump -ta -x "$IFACE" ;;
+  rec)   up
+         name="${2:-onecontrol}"; out="$(dirname "$0")/${name}-$(date +%F_%H%M%S).log"
+         echo "logging -> $out  (Ctrl-C to stop)"
+         exec candump -ta -x "$IFACE" | tee "$out" ;;
+  sniff) up; exec cansniffer -c "$IFACE" ;;
+  down)  sudo ip link set "$IFACE" down; echo "$IFACE down" ;;
+  *)     echo "usage: $0 {up|rec NAME|sniff|down}" >&2; exit 2 ;;
+esac