From e1d90110f7101f8bd246d272445f94833cffe998 Mon Sep 17 00:00:00 2001
From: JR <jaafer.rahmani@hs-offenburg.de>
Date: Sat, 24 Oct 2026 20:15:42 +0200
Subject: [PATCH] enipTCP: fix list reply item counts and lengths

ListServices, ListIdentity and ListInterfaces encoded itemCount (and the
ListInterfaces itemLength) big-endian, so a device reply with one item
dissected as itemCount=256. The counts and lengths also defaulted to 0,
so a built reply wrote 0 for itemCount, itemLength and
productNameLength, and peers (and scapy itself) read an empty product
name. Items after the first were dissected as Raw.

Encode them little-endian, compute them when left unset, and split the
items of a list.

AI-Assisted: yes (Claude Opus 5.5, GPT-6.1 Sol)
---
 scapy/contrib/enipTCP.py | 34 +++++++++++++-----
 test/contrib/enipTCP.uts | 76 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 96 insertions(+), 14 deletions(-)

diff --git a/scapy/contrib/enipTCP.py b/scapy/contrib/enipTCP.py
index e35d2e27f67..c79bf044d7f 100644
--- a/scapy/contrib/enipTCP.py
+++ b/scapy/contrib/enipTCP.py
@@ -139,12 +139,24 @@ class ENIPUnknownCommand(Packet):
 # List services (0x0004)
 
 
-class ENIPListServicesItem(Packet):
+class _ENIPListItem(Packet):
+    """Item whose itemLength counts every byte after the length field"""
+
+    def post_build(self, pkt, pay):
+        if self.itemLength is None:
+            pkt = pkt[:2] + struct.pack("<H", len(pkt) - 4) + pkt[4:]
+        return pkt + pay
+
+    def extract_padding(self, s):
+        return b"", s
+
+
+class ENIPListServicesItem(_ENIPListItem):
     """List Services Item Field"""
     name = "ENIPListServicesItem"
     fields_desc = [
         LEShortEnumField("itemTypeCode", 0, _typeIdList),
-        LEFieldLenField("itemLength", 0),
+        LEShortField("itemLength", None),
         LEShortField("protocolVersion", 0),
         XLEShortField("flag", 0),  # TODO: detail with BitFields
         StrFixedLenField("serviceName", None, 16),
@@ -155,7 +167,7 @@ class ENIPListServices(Packet):
     """List Services Command Field"""
     name = "ENIPListServices"
     fields_desc = [
-        FieldLenField("itemCount", 0, count_of="items"),
+        LEFieldLenField("itemCount", None, count_of="items"),
         PacketListField("items", None, ENIPListServicesItem),
     ]
 
@@ -163,12 +175,12 @@ class ENIPListServices(Packet):
 # List identity (0x0063)
 
 
-class ENIPListIdentityItem(Packet):
+class ENIPListIdentityItem(_ENIPListItem):
     """List Identity Item Fields"""
     name = "ENIPListIdentityReplyItem"
     fields_desc = [
         LEShortEnumField("itemTypeCode", 0, _typeIdList),
-        LEFieldLenField("itemLength", 0),
+        LEShortField("itemLength", None),
         LEShortField("protocolVersion", 0),
         # Socket address
         ShortField("sinFamily", 0),
@@ -183,7 +195,8 @@ class ENIPListIdentityItem(Packet):
         ByteField("revisionMinor", 0),
         LEShortField("status", 0),
         XLEIntField("serialNumber", 0),
-        ByteField("productNameLength", 0),
+        FieldLenField("productNameLength", None, length_of="productName",
+                      fmt="B"),
         StrLenField("productName", None,
                     length_from=lambda pkt: pkt.productNameLength),
         ByteField("state", 0)
@@ -194,7 +207,7 @@ class ENIPListIdentity(Packet):
     """List identity request and response"""
     name = "ENIPListIdentity"
     fields_desc = [
-        FieldLenField("itemCount", 0, count_of="items"),
+        LEFieldLenField("itemCount", None, count_of="items"),
         PacketListField("items", None, ENIPListIdentityItem)
     ]
 
@@ -207,17 +220,20 @@ class ENIPListInterfacesItem(Packet):
     name = "ENIPListInterfacesItem"
     fields_desc = [
         LEShortEnumField("itemTypeCode", 0, _typeIdList),
-        FieldLenField("itemLength", 0, length_of="itemData"),
+        LEFieldLenField("itemLength", None, length_of="itemData"),
         # TODO: Could be detailed
         StrLenField("itemData", "", length_from=lambda pkt: pkt.itemLength),
     ]
 
+    def extract_padding(self, s):
+        return b"", s
+
 
 class ENIPListInterfaces(Packet):
     """List Interfaces Command Field"""
     name = "ENIPListInterfaces"
     fields_desc = [
-        FieldLenField("itemCount", 0, count_of="items"),
+        LEFieldLenField("itemCount", None, count_of="items"),
         PacketListField("items", None, ENIPListInterfacesItem),
     ]
 
diff --git a/test/contrib/enipTCP.uts b/test/contrib/enipTCP.uts
index d2d820c669e..4dce04b1bcd 100644
--- a/test/contrib/enipTCP.uts
+++ b/test/contrib/enipTCP.uts
@@ -26,15 +26,29 @@ assert pkt.commandId == 0x4
 
 = ENIP List Services Default Values
 pkt=ENIPListServices()
-assert pkt.itemCount == 0
+assert raw(pkt) == b"\x00\x00"
 
 = ENIP List Services Custom Values
 pkt.items.append(ENIPListServicesItem(serviceName=b'test'))
 assert pkt.items[0].itemTypeCode == 0
-assert pkt.items[0].itemLength == 0
 assert pkt.items[0].protocolVersion == 0
 assert pkt.items[0].flag == 0
 assert pkt.items[0].serviceName == b'test'
+pkt = ENIPListServices(raw(pkt))
+assert pkt.itemCount == 1
+assert pkt.items[0].itemLength == 20
+
+= ENIP List Services Reply
+# Reply from a cpppo EtherNet/IP server
+listServicesRepPkt = bytes.fromhex(
+    "0400190000000000000000000000000000000000000000000100"
+    "000113000100200043"
+    "6f6d6d756e69636174696f6e7300")
+pkt = ENIPTCP(listServicesRepPkt)
+assert pkt.itemCount == 1
+assert pkt.items[0].itemTypeCode == 0x100
+assert pkt.items[0].itemLength == 19
+assert pkt.items[0].serviceName == b"Communications\x00"
 
 
 + ENIP List Identity 0x0063
@@ -47,7 +61,7 @@ b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
 
 = ENIP List Identity Default Values
 pkt=ENIPListIdentity()
-assert pkt.itemCount == 0
+assert raw(pkt) == b"\x00\x00"
 
 = ENIP List Identity Custom Values
 pkt=ENIPListIdentityItem(sinAddress="192.168.1.1",
@@ -57,6 +71,37 @@ assert pkt.sinAddress == "192.168.1.1"
 assert pkt.productNameLength == 4
 assert pkt.productName == b'test'
 
+= ENIP List Identity Reply
+# Reply from a cpppo EtherNet/IP server
+listIdentityRepPkt = bytes.fromhex(
+    "63003c0000000000000000000000000000000000000000000100"
+    "0c003600010000"
+    "02af120000000000000000000000000100"
+    "0e003600140b60311a066c0014313735362d4c36312f42204c4f47495835353631ff")
+pkt = ENIPTCP(listIdentityRepPkt)
+assert pkt.itemCount == 1
+item = pkt.items[0]
+assert item.itemTypeCode == 0x0c
+assert item.itemLength == 54
+assert item.sinPort == 44818
+assert item.deviceType == 0x0e
+assert item.serialNumber == 0x006c061a
+assert item.productNameLength == 20
+assert item.productName == b"1756-L61/B LOGIX5561"
+assert item.state == 0xff
+
+= ENIP List Identity Reply build
+pkt = ENIPListIdentity(items=[ENIPListIdentityItem(
+    itemTypeCode=0x0c, protocolVersion=1, sinFamily=2, sinPort=44818,
+    sinAddress="0.0.0.0", vendorId=1, deviceType=0x0e, productCode=0x36,
+    revisionMajor=20, revisionMinor=11, status=0x3160,
+    serialNumber=0x006c061a, productName=b"1756-L61/B LOGIX5561",
+    state=0xff)])
+assert raw(pkt) == listIdentityRepPkt[24:]
+pkt = ENIPListIdentity(raw(pkt))
+assert pkt.items[0].productName == b"1756-L61/B LOGIX5561"
+assert pkt.items[0].state == 0xff
+
 
 + ENIP List Interfaces
 = ENIP List Interfaces Reply Command ID
@@ -66,13 +111,34 @@ assert pkt.commandId == 0x64
 
 = ENIP List Interfaces Reply Default Values
 pkt=ENIPListInterfaces()
-assert pkt.itemCount == 0
+assert raw(pkt) == b"\x00\x00"
 
 = ENIP List Interfaces Reply Items Default Values
 pkt=ENIPListInterfacesItem(itemTypeCode=0x0c)
 assert pkt.itemTypeCode == 0x0c
-assert pkt.itemLength == 0
 assert pkt.itemData == b''
+assert raw(pkt) == b"\x0c\x00\x00\x00"
+
+= ENIP List Interfaces Reply
+listInterfacesRepData = b"\x01\x00\x0c\x00\x02\x00\xab\xcd"
+pkt = ENIPListInterfaces(listInterfacesRepData)
+assert pkt.itemCount == 1
+assert pkt.items[0].itemLength == 2
+assert pkt.items[0].itemData == b"\xab\xcd"
+assert raw(ENIPListInterfaces(items=[ENIPListInterfacesItem(
+    itemTypeCode=0x0c, itemData=b"\xab\xcd")])) == listInterfacesRepData
+
+= ENIP List replies with two items
+pkt = ENIPListInterfaces(raw(ENIPListInterfaces(items=[
+    ENIPListInterfacesItem(itemData=b"ab"),
+    ENIPListInterfacesItem(itemData=b"cd")])))
+assert pkt.itemCount == 2
+assert [i.itemData for i in pkt.items] == [b"ab", b"cd"]
+pkt = ENIPListIdentity(raw(ENIPListIdentity(items=[
+    ENIPListIdentityItem(productName=b"A", state=1),
+    ENIPListIdentityItem(productName=b"BC", state=2)])))
+assert pkt.itemCount == 2
+assert [(i.productName, i.state) for i in pkt.items] == [(b"A", 1), (b"BC", 2)]
 
 
 + ENIP Register Session