{"record":{"id":"1d1f66959836721a","repo":"shadow1ng/fscan","slug":"readconnectresponse-v","errorCode":null,"errorMessage":"ReadConnectResponse %v","messagePattern":"ReadConnectResponse (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/mcs.go","lineNumber":314,"sourceCode":"\n\tdataBuff := &bytes.Buffer{}\n\tber.WriteApplicationTag(uint8(MCS_TYPE_CONNECT_INITIAL), len(connectInitialBerEncoded), dataBuff)\n\tdataBuff.Write(connectInitialBerEncoded)\n\n\t_, err := c.transport.Write(dataBuff.Bytes())\n\tif err != nil {\n\t\tc.Emit(\"error\", errors.New(fmt.Sprintf(\"mcs sendConnectInitial write error %v\", err)))\n\t\treturn\n\t}\n\tglog.Debug(\"mcs wait for data event\")\n\tc.transport.Once(\"data\", c.recvConnectResponse)\n}\n\nfunc (c *MCSClient) recvConnectResponse(s []byte) {\n\tglog.Debug(\"mcs recvConnectResponse\", hex.EncodeToString(s))\n\tcResp, err := ReadConnectResponse(bytes.NewReader(s))\n\tif err != nil {\n\t\tc.Emit(\"error\", errors.New(fmt.Sprintf(\"ReadConnectResponse %v\", err)))\n\t\treturn\n\t}\n\t// record server gcc block\n\tserverSettings := gcc.ReadConferenceCreateResponse(cResp.userData)\n\tfor _, v := range serverSettings {\n\t\tswitch v.(type) {\n\t\tcase *gcc.ServerSecurityData:\n\t\t\tc.serverSecurityData = v.(*gcc.ServerSecurityData)\n\n\t\tcase *gcc.ServerCoreData:\n\t\t\tc.serverCoreData = v.(*gcc.ServerCoreData)\n\n\t\tcase *gcc.ServerNetworkData:\n\t\t\tc.serverNetworkData = v.(*gcc.ServerNetworkData)\n\n\t\tdefault:\n\t\t\terr := errors.New(fmt.Sprintf(\"unhandle server gcc block %v\", reflect.TypeOf(v)))\n\t\t\tglog.Error(err)","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/mcs.go#L296-L332","documentation":"recvConnectResponse is the 'data' handler waiting for the server's MCS Connect Response. It calls ReadConnectResponse on the raw bytes; any parse failure (bad application tag, bad enumerated result, bad BER tags, invalid octet string tag) is re-wrapped as 'ReadConnectResponse %v' and emitted as an error. It means the server's MCS Connect Response could not be decoded.","triggerScenarios":"The once-registered transport 'data' handler recvConnectResponse receives bytes for which ReadConnectResponse returns an error — wrong application tag (not MCS_TYPE_CONNECT_RESPONSE 0x66), failed BER parsing, or truncated userData.","commonSituations":"Connecting to a non-RDP service that replies with garbage; the server rejects the connection with a Connect Response carrying a non-zero result encoded unexpectedly; TCP coalescing/fragmentation delivers partial frames; server sent a security-negotiation failure instead of the MCS response.","solutions":["Check the hex dump logged at the top of recvConnectResponse: the first byte should indicate an MCS Connect Response (0x66<<2 pattern with BER application tag).","Verify the peer is a genuine RDP server on the expected port.","Check whether the server requires NLA and terminates the handshake early; handle security protocol negotiation before MCS.","Add the wrapped cause (%v) inspection — the inner error names exactly which BER step failed."],"exampleFix":"// before\ncResp, err := ReadConnectResponse(bytes.NewReader(s))\nif err != nil {\n    c.Emit(\"error\", errors.New(fmt.Sprintf(\"ReadConnectResponse %v\", err)))\n    return\n}\n// after\ncResp, err := ReadConnectResponse(bytes.NewReader(s))\nif err != nil {\n    c.Emit(\"error\", fmt.Errorf(\"ReadConnectResponse: %w\", err))\n    c.transport.Close()\n    return\n}","handlingStrategy":"try-catch","validationCode":"// Validate the response prefix is an MCS Connect Response before full parse:\nfunc isConnectResponse(b []byte) bool {\n    return len(b) > 2 && (b[0]&0xfc)>>2 == 0x66>>0 // BER app tag 0x66 pattern\n}","typeGuard":null,"tryCatchPattern":"mcs.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"ReadConnectResponse\") {\n        // log hex dump, verify server identity/protocol, retry\n    }\n})","preventionTips":["Probe the port with an RDP-capable client before running this library against unknown hosts.","Always inspect the logged hex dump when the response fails to parse.","Support the server's negotiated security protocol before the MCS handshake."],"tags":["rdp","protocol-parsing","mcs-handshake","network"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}