{"record":{"id":"1716408e2be5cec2","repo":"shadow1ng/fscan","slug":"unsupported-version-of-auto-reconnect-packet","errorCode":null,"errorMessage":"unsupported version of Auto-Reconnect packet","messagePattern":"unsupported version of Auto-Reconnect packet","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"libs/grdp/protocol/pdu/data.go","lineNumber":723,"sourceCode":"}\nfunc (s *SaveSessionInfo) logonPlainNotify(r io.Reader) (err error) {\n\tcore.ReadBytes(576, r) /* pad (576 bytes) */\n\treturn err\n}\nfunc (s *SaveSessionInfo) logonInfoExtended(r io.Reader) (err error) {\n\ts.Length, err = core.ReadUint16LE(r)\n\ts.FieldsPresent, err = core.ReadUInt32LE(r)\n\t//glog.Info(\"FieldsPresent:\", s.FieldsPresent)\n\t// auto reconnect cookie\n\tif s.FieldsPresent&LOGON_EX_AUTORECONNECTCOOKIE != 0 {\n\t\tcore.ReadUInt32LE(r)\n\t\tb, _ := core.ReadUInt32LE(r)\n\t\tif b != 28 {\n\t\t\treturn errors.New(fmt.Sprintf(\"invalid length in Auto-Reconnect packet\"))\n\t\t}\n\t\tb, _ = core.ReadUInt32LE(r)\n\t\tif b != 1 {\n\t\t\treturn errors.New(fmt.Sprintf(\"unsupported version of Auto-Reconnect packet\"))\n\t\t}\n\t\tb, _ = core.ReadUInt32LE(r)\n\t\ts.LogonId = b\n\t\ts.Random, _ = core.ReadBytes(16, r)\n\t} else { // logon error info\n\t\tcore.ReadUInt32LE(r)\n\t\tcore.ReadUInt32LE(r)\n\t\tb, _ := core.ReadUInt32LE(r)\n\t\ts.LogonId = b\n\t}\n\tcore.ReadBytes(570, r)\n\treturn err\n}\nfunc (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {\n\ts.InfoType, err = core.ReadUInt32LE(r)\n\tswitch s.InfoType {\n\tcase INFOTYPE_LOGON:\n\t\terr = s.logonInfoV1(r)","sourceCodeStart":705,"sourceCodeEnd":741,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/pdu/data.go#L705-L741","documentation":"Immediately after the length check, logonInfoExtended validates the auto-reconnect cookie's version field, which per MS-RDPBCGR must be 1 (AUTORECONNECT_PACKET version). A different value returns this error. It means the server's auto-reconnect packet uses an unrecognized version — usually a malformed or misaligned read rather than a genuinely new version.","triggerScenarios":"Server sends SaveSessionInfo with the auto-reconnect cookie flag set and the version dword read as != 1, typically during auto-reconnect flows or when the byte stream shifted after a prior parse error.","commonSituations":"Network blips triggering reconnect cookies against unusual server builds; middleboxes/gateways altering the PDU; cumulative stream desync so the version field reads garbage.","solutions":["Confirm alignment: if other PDUs in the same session also fail to parse, treat it as desync and reconnect rather than chasing the version value","Relax/extend the check in data.go if your server legitimately emits a different version — log the value and skip the cookie instead of erroring","Update grdp for your server platform's SaveSessionInfo format","Disable auto-reconnect cookie exchange if reconnection support is not required"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := session.HandleSaveSessionInfo(pdu)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported version of Auto-Reconnect packet\") {\n        log.Printf(\"skipping reconnect cookie with unknown version: %v\", err)\n        return nil // proceed without auto-reconnect support\n    }\n    return err\n}","preventionTips":["Log the actual version dword once to identify server-specific formats","Treat as non-fatal: only seamless reconnection is lost","Rule out desync — verify earlier PDUs parse correctly in the same session","Update grdp if your server build ships a newer auto-reconnect packet format"],"tags":["rdp","reconnect","protocol-parsing"],"backgroundTag":"schema-validation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}