fix(tls): allow TLS 1.2 for S7-1500 PLCs (#760)

The TLS context forced minimum_version to TLS 1.3, but S7-1500 PLCs
with firmware < V3.0 (e.g. 1512SP-1 FW V4.1.2) only support TLS 1.2.
The ClientHello offered only TLS 1.3 cipher suites and versions, so the
PLC rejected the connection with a TCP RST.

Lower the minimum to TLS 1.2 so Python's ssl module auto-negotiates the
highest mutually-supported version.

Also surface the CreateObject return value: when non-zero the PLC is
rejecting the session (typically because TLS is required), but the old
code silently fell through to the misleading "V1-initial SessionKey"
warning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gijzelaerr

s7/_s7commplus_async_client.py

@@ -821,13 +821,16 @@ async def _create_session(self) -> None:
         # Parse response body: ReturnValue(VLQ) + ObjectIdCount + ObjectIds(VLQ).
         # The usable session id is ObjectIds[0] (NOT the header SessionId field).
         body = response[14:]
-        object_ids, obj_end = parse_create_object_session_id(body)
+        object_ids, obj_end, return_value = parse_create_object_session_id(body)
         if object_ids:
             self._session_id = object_ids[0]
         else:
             self._session_id = struct.unpack_from(">I", response, 9)[0]
         self._protocol_version = version
 
+        if return_value != 0:
+            logger.warning(f"CreateObject returned error 0x{return_value:X} — PLC may require TLS (use_tls=True)")
+
         self._server_session_version = parse_server_session_version(response[14 + obj_end :])
         if self._server_session_version is not None:
             logger.info(f"ServerSessionVersion captured: {len(self._server_session_version)} bytes")

s7/codec.py

@@ -612,15 +612,15 @@ def skip_typed_value(data: bytes, offset: int, datatype: int, flags: int) -> int
         return offset
 
 
-def parse_create_object_session_id(body: bytes) -> tuple[list[int], int]:
+def parse_create_object_session_id(body: bytes) -> tuple[list[int], int, int]:
     """Parse a CreateObject response body (after the 14-byte response header).
 
     Body layout: ReturnValue (UInt64 VLQ) + ObjectIdCount (1 byte) + ObjectIds (UInt32 VLQ
     each). The usable session id is ``ObjectIds[0]`` (not the header SessionId field).
 
-    Returns ``(object_ids, offset)`` where ``offset`` points just past the ObjectIds.
+    Returns ``(object_ids, offset, return_value)`` where ``offset`` points just past the ObjectIds.
     """
-    _return_value, consumed = decode_uint64_vlq(body, 0)
+    return_value, consumed = decode_uint64_vlq(body, 0)
     boff = consumed
     obj_count = body[boff] if boff < len(body) else 0
     boff += 1
@@ -629,7 +629,7 @@ def parse_create_object_session_id(body: bytes) -> tuple[list[int], int]:
         oid, c = decode_uint32_vlq(body, boff)
         boff += c
         object_ids.append(oid)
-    return object_ids, boff
+    return object_ids, boff, return_value
 
 
 def parse_server_session_version(payload: bytes) -> Optional[bytes]:

s7/connection.py

@@ -759,7 +759,7 @@ def _create_session(self) -> None:
         # Parse response body: ReturnValue(UInt64 VLQ) + ObjectIdCount + ObjectIds(VLQ).
         # The usable session id is ObjectIds[0] (NOT the header SessionId field).
         body = response[14:]
-        object_ids, obj_end = parse_create_object_session_id(body)
+        object_ids, obj_end, return_value = parse_create_object_session_id(body)
         if object_ids:
             self._session_id = object_ids[0]
         else:
@@ -778,6 +778,9 @@ def _create_session(self) -> None:
         logger.debug(f"CreateObject response payload: {response[14:].hex(' ')}")
         logger.debug(f"Session created: id=0x{self._session_id:08X} ({self._session_id}), version=V{version}")
 
+        if return_value != 0:
+            logger.warning(f"CreateObject returned error 0x{return_value:X} — PLC may require TLS (use_tls=True)")
+
         # Parse response payload to extract ServerSessionVersion
         self._server_session_version = parse_server_session_version(response[14 + obj_end :])
         if self._server_session_version is not None:
@@ -1020,12 +1023,11 @@ def _setup_ssl_context(
             Configured SSLContext
         """
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-        ctx.minimum_version = ssl.TLSVersion.TLSv1_3
+        # S7-1500 FW < V3.0 only supports TLS 1.2; newer firmware negotiates 1.3.
+        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
 
-        # TLS 1.3 ciphersuites are configured differently from TLS 1.2
         if hasattr(ctx, "set_ciphersuites"):
             ctx.set_ciphersuites("TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256")
-        # If set_ciphersuites not available, TLS 1.3 uses its mandatory defaults
 
         if cert_path and key_path:
             ctx.load_cert_chain(cert_path, key_path)