{"record":{"id":"3103ef6c01923010","repo":"shadow1ng/fscan","slug":"not-a-valid-license-packet","errorCode":null,"errorMessage":"Not a valid license packet","messagePattern":"Not a valid license packet","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/sec/sec.go","lineNumber":757,"sourceCode":"\t\tgoto connect\n\tcase lic.ERROR_ALERT:\n\t\tmessage := p.LicensingMessage.(*lic.ErrorMessage)\n\t\tglog.Info(\"sec ERROR_ALERT and ErrorCode:\", message.DwErrorCode)\n\t\tif message.DwErrorCode == lic.STATUS_VALID_CLIENT && message.DwStateTransaction == lic.ST_NO_TRANSITION {\n\t\t\tgoto connect\n\t\t}\n\t\tgoto retry\n\tcase lic.LICENSE_REQUEST:\n\t\tglog.Info(\"sec LICENSE_REQUEST\")\n\t\tc.sendClientNewLicenseRequest(p.LicensingMessage.([]byte))\n\t\tgoto retry\n\tcase lic.PLATFORM_CHALLENGE:\n\t\tglog.Info(\"sec PLATFORM_CHALLENGE\")\n\t\tc.sendClientChallengeResponse(p.LicensingMessage.([]byte))\n\t\tgoto retry\n\tdefault:\n\t\tglog.Error(\"Not a valid license packet\")\n\t\tc.Emit(\"error\", errors.New(\"Not a valid license packet\"))\n\t\treturn\n\t}\n\nconnect:\n\tc.transport.On(\"sec\", c.recvData)\n\tc.Emit(\"connect\", c.clientData[0].(*gcc.ClientCoreData), c.userId, c.channelId)\n\treturn\n\nretry:\n\tc.transport.Once(\"sec\", c.recvLicenceInfo)\n\treturn\n}\n\nfunc (c *Client) sendClientNewLicenseRequest(data []byte) {\n\tvar req lic.ServerLicenseRequest\n\tstruc.Unpack(bytes.NewReader(data), &req)\n\n\tvar sc gcc.ServerCertificate","sourceCodeStart":739,"sourceCodeEnd":775,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/sec/sec.go#L739-L775","documentation":"During the RDP connect sequence, the client received a licensing PDU whose message type is not one it handles (e.g. not PLATFORM_CHALLENGE). The sec layer cannot process the license packet, emits the error on the 'error' channel, and aborts the connection before emitting 'connect'. It indicates the server sent an unexpected licensing message type.","triggerScenarios":"Calling client.Connect()/NewClient against an RDP server whose licensing PDU uses a message type other than PLATFORM_CHALLENGE (e.g. valid-client license, error alert, or a malformed/garbage packet landing in the license switch's default branch).","commonSituations":"Connecting to non-Windows or partially implemented RDP servers (xrdp, FreeRDP-based gateways, VNC-over-RDP bridges) that send licensing data this library doesn't understand; middleboxes/proxies corrupting the license PDU; targeting servers that skip standard licensing negotiation.","solutions":["Identify the server product; if it is xrdp/FreeRDP-based, update the server or grdp to a version handling its license PDU type","Capture the licensing PDU (e.g. Wireshark with RDP decryption) and add a case for the received message type in the license switch, treating it like PLATFORM_CHALLENGE or ignoring it","Try disabling NLA/licensing-sensitive negotiation (set security level to standard RDP or TLS-only) so the server sends a simpler license flow","Verify you are actually talking to an RDP server on that port and not another service that emits garbage in the license slot"],"exampleFix":"// before\ndefault:\n    glog.Error(\"Not a valid license packet\")\n    c.Emit(\"error\", errors.New(\"Not a valid license packet\"))\n    return\n\n// after\ncase lic.LICENSE_VALID_CLIENT, lic.NEW_LICENSE:\n    glog.Info(\"sec: license accepted, continuing\")\n    goto retry\ndefault:\n    glog.Errorf(\"Not a valid license packet: type %v\", p.LicensingMessage)\n    c.Emit(\"error\", errors.New(\"Not a valid license packet\"))\n    return","handlingStrategy":"try-catch","validationCode":"// before connecting, verify the server speaks RDP\nconn, _ := net.DialTimeout(\"tcp\", host+\":3389\", 5*time.Second)\n// X.224 negotiation completes only against a real RDP endpoint; also ensure server version supports this client's license handling\n_ = conn","typeGuard":null,"tryCatchPattern":"client.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"Not a valid license packet\") {\n        // fall back: retry with different requestedProtocols or flag server for manual review\n    }\n})","preventionTips":["Pin the server type you support (xrdp/Windows) and test license negotiation against it in CI","Listen on the client's 'error' event and log the server product/version for triage","Capture a known-good license PDU trace to diff against failures"],"tags":["rdp","licensing","protocol","handshake"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}