Skip to content

Send Large Forward Open service code (0x5B) when large_open is set - #24

Closed
dhruvkpatel wants to merge 1 commit into
Joylei:mainfrom
lumaril-oss:fix/large-forward-open-service-code
Closed

Send Large Forward Open service code (0x5B) when large_open is set#24
dhruvkpatel wants to merge 1 commit into
Joylei:mainfrom
lumaril-oss:fix/large-forward-open-service-code

Conversation

@dhruvkpatel

Copy link
Copy Markdown

Problem

OpenOptions::large_open(true) makes forward_open encode the request body with
large-format (32-bit) network connection parameters, but the request is still sent
with service code 0x54 (standard Forward Open). No Large Forward Open is actually
issued — a large-format body goes out under the standard service code.

Impact

Targets that require the Large Forward Open service code reject or ignore the
request. On a live Allen-Bradley ControlLogix, the request is rejected with general
status 0x01 / extended status 0x0111, which makes large (>511-byte) connections
unusable — the exact case large_open exists to enable. pycomm3 sends 0x5B for
this case and works.

Fix

Select the service code from request.large_open:
SERVICE_LARGE_FORWARD_OPEN (0x5B) for a large open, SERVICE_FORWARD_OPEN
(0x54) otherwise. The reply decode and Forward Close paths are unchanged.

CIP Vol 1 defines Large Forward Open as its own service (0x5B), distinct from
Forward Open (0x54); the two differ in the width of the network connection
parameters, so the service code has to match the body format.

forward_open in src/adapters/eip.rs hardcoded the standard Forward Open
service code 0x54 even when OpenOptions::large_open was set. rseip already
encodes the request body in large-parameter format (32-bit network
connection parameters) in that case, but sending it under the standard
service code makes the target parse a large-format body as a standard
request.

Observed on a live Allen-Bradley ControlLogix: the Large Forward Open is
rejected with general status 0x01 / extended status 0x0111, so no
connected reads succeed. pycomm3 sends the Large Forward Open service code
0x5B (SERVICE_LARGE_FORWARD_OPEN) and works.

Select the service code from request.large_open: 0x5B for a large open,
0x54 otherwise. Forward Close is unaffected and the reply decode does not
assert a specific reply service code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@lumaril-oss lumaril-oss closed this by deleting the head repository Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants