fix(abcip): unblock the controller-browse gate, and fix the decoder it exposed (#468)

The AbCip controller browse could never be verified end to end: libplctag's
ab_server answers CIP service 0x55 (Get Instance Attribute List) on the Symbol
Object class with "unsupported", so the `@tags` walk had no backend. #468's own
definition of done offered a sim that serves `@tags` as an alternative to real
hardware; this is that.

The fixture now applies a vendored patch teaching ab_server to serve the Symbol
Object listing, with partial-transfer paging. Correctness is checked against
libplctag's own `list_tags_logix` rather than against our decoder — our decoder
is the thing under test, so its agreement would prove nothing. The clone is also
pinned to a concrete tag: the Dockerfile called `--branch release` "pinned" while
tracking a branch that moves.

That immediately exposed a real defect. CipSymbolObjectDecoder advanced to an
even byte boundary after each symbol name, but entries are packed with no
padding — libplctag walks them by sizeof(entry) + string_len, and a captured
reply confirms it. Any odd-length name therefore desynchronised every entry
behind it, and odd-length names are ordinary. In the live browse below,
`Motor_Run` is 9 bytes and first on the wire, so the old decoder would have
shown that one tag and silently dropped the other eight.

Every existing multi-entry test passed throughout, because the test builder
padded exactly as the decoder did: the two agreed with each other and neither
agreed with a controller. The builder no longer pads, and the layout is pinned
by a captured reply (CipSymbolObjectWireCaptureTests) instead of by a second
statement of the assumption. Restoring the alignment step reddens exactly the
three new tests and none of the 29 others.

Live gate on docker-dev, all three of #468's criteria:
  - populated tree — all nine seeded tags render as leaves, in wire order
  - refresh re-captures
  - leaf commit — Pump_1_Speed + TestDINT saved with their CIP tag paths

The gate also surfaced two things it was not asked about: browse-commit drops
the discovered data type, so a browsed REAL commits as a DINT and the driver
decodes it as one (filed as #536), and Test Connect fails against this fixture
regardless of the device because it probes `@raw_cpu_type` (documented).

TwinCAT and FOCAS still have no browsable backend; #468's AbCip half is closed,
theirs is not.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/Dockerfile

@@ -15,13 +15,23 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Pinned tag matches the `ab_server` version AbServerFixture + CI treat as
-# canonical. Bump deliberately alongside a driver-side change that needs
-# something newer.
-ARG LIBPLCTAG_TAG=release
+# A concrete tag, not a branch. This said "pinned" while cloning `release`,
+# which moves — so two builds of the same Dockerfile could produce different
+# servers, and the patch below could not be relied on to apply. Bump
+# deliberately alongside a driver-side change that needs something newer, and
+# re-check the patch against the new tag.
+ARG LIBPLCTAG_TAG=v2.7.0
 RUN git clone --depth 1 --branch "${LIBPLCTAG_TAG}" https://github.com/libplctag/libplctag.git /src
 
+# Upstream ab_server answers CIP service 0x55 (Get Instance Attribute List) with
+# "unsupported", so a controller-tag browse against it returns nothing. The
+# patch implements the Symbol Object listing that a real Logix controller
+# serves, which is what the AbCip driver's `@tags` walk reads. Verified against
+# libplctag's own `list_tags_logix` client — see README.md.
+COPY patches/ /patches/
 WORKDIR /src
+RUN git apply --verbose /patches/*.patch
+
 RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
  && cmake --build build --target ab_server --parallel
 

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/README.md

@@ -12,6 +12,47 @@ clone needs Docker Desktop and nothing else.
 |---|---|
 | [`Dockerfile`](Dockerfile) | Multi-stage: build from libplctag at pinned tag → copy binary into `debian:bookworm-slim` runtime image |
 | [`docker-compose.yml`](docker-compose.yml) | One service per family (`controllogix` / `compactlogix` / `micro800` / `guardlogix`); all bind `:44818` |
+| [`patches/`](patches/) | Applied to the libplctag checkout before the build — see [Local patches](#local-patches) |
+
+## Local patches
+
+`patches/0001-ab_server-serve-cip-symbol-object-listing.patch` teaches `ab_server`
+to answer **CIP service 0x55 (Get Instance Attribute List) on class 0x6B**, the
+Symbol Object listing a client reads through the `@tags` pseudo-tag to enumerate
+a controller's symbol table. Upstream answers `unsupported`, which is what left
+the AbCip controller browse unverifiable (Gitea #468) — the browse binding was
+proven alive, but no backend ever returned a tag.
+
+Two things worth knowing before touching it:
+
+- **The reply layout is fixed to the attribute set libplctag asks for** —
+  `{0x02 symbol type, 0x07 element size, 0x08 array dimensions, 0x01 symbol
+  name}`. A request for a different set is refused rather than answered with a
+  differently-shaped reply the client would misparse.
+- **Entries are packed with no padding.** The next entry begins on the byte
+  after the last name byte, even on an odd offset. This is not a detail of the
+  fixture: it is what a controller does, and assuming otherwise is exactly the
+  decoder defect the gate found.
+
+Correctness is checked against **libplctag's own `list_tags_logix`** client, not
+against our decoder — our decoder is the thing under test, so agreeing with it
+would prove nothing. `list_tags_logix` is the reference implementation exercised
+against real Logix hardware:
+
+```bash
+git clone --depth 1 --branch v2.7.0 https://github.com/libplctag/libplctag.git
+cd libplctag && cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build --parallel
+./build/bin_dist/list_tags_logix 10.100.0.35 1,0    # expect all nine tags, "SUCCESS!"
+```
+
+Partial-transfer paging is exercised the same way by starting `ab_server` with a
+few hundred tags: all of them should come back, with no duplicates and no gaps
+at the page boundaries.
+
+**Bumping `LIBPLCTAG_TAG` means re-checking the patch against the new tag.** It
+is a concrete tag rather than the `release` branch precisely so that this stays
+a deliberate act — the branch moves, and the Dockerfile previously called it
+"pinned" while tracking it.
 
 ## Run
 
@@ -64,7 +105,7 @@ place means updating both.
 
 | Family | Seeded tags | Notes |
 |---|---|---|
-| ControlLogix | `TestDINT` `TestREAL` `TestBOOL` `TestSINT` `TestString` `TestArray` | Widest-coverage; PR 9 baseline. UDT emulation missing from ab_server |
+| ControlLogix | `TestDINT` `TestREAL` `TestBOOL` `TestSINT` `TestString` `TestArray` `Pump_1_Speed` `Line1_Count` `Motor_Run` | Widest-coverage; PR 9 baseline. UDT emulation missing from ab_server. The last three serve the controller-browse gate and are additive — the read/write suites key off the `Test*` tags. `Motor_Run` (9), `Line1_Count` (11) and `TestArray` (9) have **odd-length names on purpose**: entries are unpadded, so an odd name puts every following entry on an odd offset, and a decoder that assumes even alignment loses everything behind it |
 | CompactLogix | `TestDINT` `TestREAL` `TestBOOL` | Narrow ConnectionSize cap enforced driver-side; ab_server accepts any size |
 | Micro800 | `TestDINT` `TestREAL` | ab_server has no `micro800` mode; falls back to `controllogix` emulation |
 | GuardLogix | `TestDINT` `SafetyDINT_S` | ab_server has no safety subsystem; `_S` suffix triggers driver-side classification only |
@@ -73,7 +114,17 @@ place means updating both.
 
 - **No UDT / CIP Template Object emulation** — `ab_server` covers atomic
   types only. UDT reads + task #194 whole-UDT optimization verify via
-  unit tests with golden byte buffers.
+  unit tests with golden byte buffers. The Symbol Object patch above lists
+  symbols, including their types; it does not add Template Object support, so a
+  browsed UDT still cannot be expanded into members here.
+- **No `@raw_cpu_type`** — the driver's Test Connect probe falls back to that
+  pseudo-tag when a device has no authored tags, and `ab_server` answers
+  `ErrorBadParam`. So **Test Connect reports failure against this fixture even
+  when the device is fine**, and browse works regardless. Author one tag and the
+  probe uses it instead.
+- **Controller-scope listing only** — a program-scope listing arrives with a
+  leading symbolic segment naming the program, and `ab_server` has no notion of
+  programs. `Program:`-scoped tags cannot be browsed here.
 - **Family-specific quirks trust driver-side code** — ab_server emulates
   a generic Logix CPU; the ConnectionSize cap, empty-path unconnected
   mode, and safety-partition write rejection all need lab rigs for

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/docker-compose.yml

@@ -20,6 +20,12 @@ services:
     restart: "no"
     ports:
       - "44818:44818"
+    # The last three are here for the controller-browse gate (Gitea #468) and
+    # are additive — the read/write suites key off the Test* tags above.
+    # Odd-length names are deliberate: Symbol Object entries are packed with no
+    # padding, so a name with an odd byte count puts every following entry on an
+    # odd offset. A decoder that assumes even alignment reads all six correctly
+    # and then loses everything after the first odd name.
     command: [
       "ab_server",
       "--plc=ControlLogix",
@@ -30,7 +36,10 @@ services:
       "--tag=TestBOOL:BOOL[1]",
       "--tag=TestSINT:SINT[1]",
       "--tag=TestString:STRING[1]",
-      "--tag=TestArray:DINT[16]"
+      "--tag=TestArray:DINT[16]",
+      "--tag=Pump_1_Speed:REAL[1]",
+      "--tag=Line1_Count:DINT[1]",
+      "--tag=Motor_Run:BOOL[1]"
     ]
 
   compactlogix:

tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/patches/0001-ab_server-serve-cip-symbol-object-listing.patch

@@ -0,0 +1,204 @@
+diff --git a/src/tools/ab_server/cip.c b/src/tools/ab_server/cip.c
+index 68a5794..f266bf6 100644
+--- a/src/tools/ab_server/cip.c
++++ b/src/tools/ab_server/cip.c
+@@ -111,6 +111,18 @@ const uint8_t CIP_OBJ_CONNECTION_MANAGER[] = {0x20, 0x06, 0x24, 0x01};
+ 
+ #define CIP_TAG_MAX_INDEXES ((uint32_t)3) /* should double check for OMRON */
+ 
++/* Symbol Object (class 0x6B) listing — see handle_list_tags_request(). */
++#define CIP_SYMBOL_OBJECT_CLASS ((uint8_t)0x6b)
++#define CIP_LIST_TAGS_PATH_SIZE ((size_t)6)   /* 0x20 0x6B 0x25 0x00 <instance u16> */
++#define CIP_LIST_TAGS_ENTRY_HEADER_SIZE ((size_t)22)
++#define CIP_LIST_TAGS_PAYLOAD_MIN_SIZE ((size_t)2) /* two bytes for the attribute count */
++#define CIP_LIST_TAGS_ATTR_COUNT ((uint16_t)4)
++#define CIP_SYM_ATTR_NAME ((uint16_t)0x01)
++#define CIP_SYM_ATTR_TYPE ((uint16_t)0x02)
++#define CIP_SYM_ATTR_ELEM_SIZE ((uint16_t)0x07)
++#define CIP_SYM_ATTR_DIMENSIONS ((uint16_t)0x08)
++#define CIP_SYM_TYPE_DIM_SHIFT (13) /* bits 13-14 carry the array dimension count. */
++
+ #define MAX_SUB_PACKETS ((uint16_t)1000) /* maximum number of sub-packets in a multi-service request */
+ 
+ #define CIP_MINIMAL_RESPONSE_SIZE ((size_t)6) /* four bytes for header plus 2 for optional extended status. */
+@@ -126,6 +138,8 @@ static slice_s handle_read_request(uint8_t cip_service, slice_s cip_service_path
+                                    plc_s *plc);
+ static slice_s handle_write_request(uint8_t cip_service, slice_s cip_service_path, slice_s cip_service_payload, slice_s output,
+                                     plc_s *plc);
++static slice_s handle_list_tags_request(uint8_t cip_service, slice_s cip_service_path, slice_s cip_service_payload,
++                                        slice_s output, plc_s *plc);
+ static slice_s handle_multi_request(uint8_t cip_service, slice_s cip_service_path, slice_s cip_service_payload, slice_s output,
+                                     plc_s *plc);
+ 
+@@ -220,6 +234,10 @@ slice_s cip_dispatch_request(slice_s input, slice_s output, plc_s *plc) {
+             return handle_write_request(cip_service, cip_service_path, cip_service_payload, output, plc);
+             break;
+ 
++        case CIP_SRV_INSTANCES_ATTRIBS:
++            return handle_list_tags_request(cip_service, cip_service_path, cip_service_payload, output, plc);
++            break;
++
+         default: return make_cip_log_error(output, cip_service, CIP_ERR_UNSUPPORTED, false, 0); break;
+     }
+ }
+@@ -877,6 +895,160 @@ slice_s handle_read_request(uint8_t cip_service, slice_s cip_service_path, slice
+ }
+ 
+ 
++/*
++ * Handle the CIP "Get Instance Attribute List" service (0x55) against the Symbol
++ * Object class (0x6B).  This is the request a client issues to enumerate the
++ * controller's symbol table — libplctag sends it when an application reads the
++ * "@tags" pseudo-tag.
++ *
++ * Request path (6 bytes):
++ *      0x20 0x6B       8-bit class segment, Symbol Object
++ *      0x25 0x00       16-bit instance segment + pad
++ *      u16             instance id to start from
++ *
++ * Request payload:
++ *      u16             attribute count
++ *      u16 * count     attribute ids
++ *
++ * The reply layout is determined by the requested attributes, so this server
++ * serves exactly the set libplctag asks for — symbol type, element size, array
++ * dimensions, symbol name — and refuses anything else rather than returning a
++ * differently-shaped reply the client would silently misparse.
++ *
++ * Reply payload is a packed run of entries, each:
++ *      u32             instance id
++ *      u16             symbol type
++ *      u16             element length in bytes
++ *      u32 [3]         array dimensions
++ *      u16             name length
++ *      u8 * length     name
++ *
++ * NOTE: entries are NOT padded.  The next entry starts on the byte immediately
++ * after the last name byte, even when that leaves it on an odd offset — see
++ * libplctag's own reply walker in eip_cip_special.c, which advances by
++ * sizeof(entry) + string_len with no alignment step.
++ *
++ * When the entries do not all fit in the response buffer the reply carries
++ * status 0x06 (partial transfer) and the client asks again starting from the
++ * last instance id it saw, plus one.
++ */
++slice_s handle_list_tags_request(uint8_t cip_service, slice_s cip_service_path, slice_s cip_service_payload, slice_s output,
++                                 plc_s *plc) {
++    uint16_t start_instance_id = 0;
++    uint16_t attribute_count = 0;
++    uint16_t instance_id = 0;
++    size_t payload_offset = 0;
++    size_t output_offset = CIP_RESPONSE_HEADER_SIZE;
++    bool more_to_come = false;
++    tag_def_s *tag = NULL;
++
++    log_info("Processing Get Instance Attribute List (Symbol Object) request.");
++
++    /* Only the controller-scope listing is served.  A program-scope listing
++     * arrives with a leading symbolic segment naming the program, and this
++     * server has no notion of program scopes to list. */
++    if(slice_len(cip_service_path) != CIP_LIST_TAGS_PATH_SIZE || slice_get_uint8(cip_service_path, 0) != 0x20
++       || slice_get_uint8(cip_service_path, 1) != CIP_SYMBOL_OBJECT_CLASS || slice_get_uint8(cip_service_path, 2) != 0x25
++       || slice_get_uint8(cip_service_path, 3) != 0x00) {
++        log_info("Unsupported path for a Symbol Object listing request!");
++        log_info_slice(cip_service_path);
++        return make_cip_log_error(output, cip_service, CIP_ERR_PATH_SEGMENT, false, 0);
++    }
++
++    start_instance_id = slice_get_uint16_le(cip_service_path, 4);
++
++    log_info("Listing symbols from instance %u.", (unsigned int)start_instance_id);
++
++    if(slice_len(cip_service_payload) < CIP_LIST_TAGS_PAYLOAD_MIN_SIZE) {
++        log_info("Insufficient data in the Symbol Object listing payload!");
++        return make_cip_log_error(output, cip_service, CIP_ERR_INSUFFICIENT_DATA, false, 0);
++    }
++
++    attribute_count = slice_get_uint16_le(cip_service_payload, payload_offset);
++    payload_offset += 2;
++
++    if(slice_len(cip_service_payload) < payload_offset + ((size_t)attribute_count * 2)) {
++        log_info("Symbol Object listing payload is shorter than its attribute count claims!");
++        return make_cip_log_error(output, cip_service, CIP_ERR_INSUFFICIENT_DATA, false, 0);
++    }
++
++    if(attribute_count != CIP_LIST_TAGS_ATTR_COUNT
++       || slice_get_uint16_le(cip_service_payload, payload_offset + 0) != CIP_SYM_ATTR_TYPE
++       || slice_get_uint16_le(cip_service_payload, payload_offset + 2) != CIP_SYM_ATTR_ELEM_SIZE
++       || slice_get_uint16_le(cip_service_payload, payload_offset + 4) != CIP_SYM_ATTR_DIMENSIONS
++       || slice_get_uint16_le(cip_service_payload, payload_offset + 6) != CIP_SYM_ATTR_NAME) {
++        log_info("Symbol Object listing requested an attribute set this server does not serve!");
++        log_info_slice(cip_service_payload);
++        return make_cip_log_error(output, cip_service, CIP_ERR_INVALID_PARAM, false, 0);
++    }
++
++    if(slice_len(output) < CIP_RESPONSE_HEADER_SIZE) {
++        log_info("Insufficient space in the output buffer for the response header!");
++        return make_cip_log_error(output, cip_service, CIP_ERR_INSUFFICIENT_DATA, false, 0);
++    }
++
++    /* Instance ids are assigned by position in the tag list.  The walk order is
++     * stable across requests, so ids ascend the same way every time and paging
++     * can simply resume at the first id the client has not seen. */
++    for(tag = plc->tags; tag; tag = tag->next_tag) {
++        size_t name_len = 0;
++        size_t entry_len = 0;
++        uint16_t symbol_type = 0;
++
++        instance_id++;
++
++        if(instance_id < start_instance_id) { continue; }
++
++        name_len = strlen(tag->name);
++        entry_len = CIP_LIST_TAGS_ENTRY_HEADER_SIZE + name_len;
++
++        if(output_offset + entry_len > slice_len(output)) {
++            log_info("Response buffer full — %u symbol(s) sent, more to come.", (unsigned int)(instance_id - 1));
++            more_to_come = true;
++            break;
++        }
++
++        /* Bits 13-14 of the symbol type carry the array dimension count; the
++         * low 12 bits carry the CIP type code. */
++        symbol_type = (uint16_t)(tag->tag_type | ((uint16_t)(tag->num_dimensions & 0x03) << CIP_SYM_TYPE_DIM_SHIFT));
++
++        slice_set_uint32_le(output, output_offset + 0, (uint32_t)instance_id);
++        slice_set_uint16_le(output, output_offset + 4, symbol_type);
++        slice_set_uint16_le(output, output_offset + 6, (uint16_t)tag->elem_size);
++
++        for(size_t dim = 0; dim < 3; dim++) {
++            uint32_t dim_size = (dim < tag->num_dimensions) ? (uint32_t)tag->dimensions[dim] : 0;
++            slice_set_uint32_le(output, output_offset + 8 + (dim * 4), dim_size);
++        }
++
++        slice_set_uint16_le(output, output_offset + 20, (uint16_t)name_len);
++
++        if(!slice_copy_data_in(slice_from_slice(output, output_offset + CIP_LIST_TAGS_ENTRY_HEADER_SIZE, name_len),
++                               (uint8_t *)tag->name, name_len)) {
++            log_info("Unable to copy the symbol name into the response!");
++            return make_cip_log_error(output, cip_service, CIP_ERR_INVALID_PARAM, false, 0);
++        }
++
++        output_offset += entry_len;
++    }
++
++    /* A partial reply carrying no entries at all would leave the client asking
++     * for the same instance forever, because it advances its cursor from the
++     * last entry it received.  Fail the request instead of looping it. */
++    if(more_to_come && output_offset == CIP_RESPONSE_HEADER_SIZE) {
++        log_info("A single symbol entry does not fit in the response buffer!");
++        return make_cip_log_error(output, cip_service, CIP_ERR_EXTENDED, true, CIP_ERR_EX_TOO_LONG);
++    }
++
++    slice_set_uint8(output, 0, cip_service | CIP_DONE);
++    slice_set_uint8(output, 1, 0);                                           /* reserved */
++    slice_set_uint8(output, 2, (more_to_come ? CIP_ERR_FRAG : CIP_OK));      /* status */
++    slice_set_uint8(output, 3, 0);                                           /* no extended error */
++
++    return slice_from_slice(output, 0, output_offset);
++}
++
++
+ #define CIP_WRITE_MIN_SIZE (6)
+ #define CIP_WRITE_FRAG_MIN_SIZE (10)
+