{"record":{"id":"5c1f967dabefbc3f","repo":"shadow1ng/fscan","slug":"invalid-length-in-auto-reconnect-packet","errorCode":null,"errorMessage":"invalid length in Auto-Reconnect packet","messagePattern":"invalid length in Auto-Reconnect packet","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"libs/grdp/protocol/pdu/data.go","lineNumber":719,"sourceCode":"\tuserName := core.UnicodeDecode(b)\n\tglog.Infof(\"SessionId:[%d] UserName:[ %s] Domain:[ %s]\", s.LogonId, userName, domain)\n\n\treturn err\n}\nfunc (s *SaveSessionInfo) logonPlainNotify(r io.Reader) (err error) {\n\tcore.ReadBytes(576, r) /* pad (576 bytes) */\n\treturn err\n}\nfunc (s *SaveSessionInfo) logonInfoExtended(r io.Reader) (err error) {\n\ts.Length, err = core.ReadUint16LE(r)\n\ts.FieldsPresent, err = core.ReadUInt32LE(r)\n\t//glog.Info(\"FieldsPresent:\", s.FieldsPresent)\n\t// auto reconnect cookie\n\tif s.FieldsPresent&LOGON_EX_AUTORECONNECTCOOKIE != 0 {\n\t\tcore.ReadUInt32LE(r)\n\t\tb, _ := core.ReadUInt32LE(r)\n\t\tif b != 28 {\n\t\t\treturn errors.New(fmt.Sprintf(\"invalid length in Auto-Reconnect packet\"))\n\t\t}\n\t\tb, _ = core.ReadUInt32LE(r)\n\t\tif b != 1 {\n\t\t\treturn errors.New(fmt.Sprintf(\"unsupported version of Auto-Reconnect packet\"))\n\t\t}\n\t\tb, _ = core.ReadUInt32LE(r)\n\t\ts.LogonId = b\n\t\ts.Random, _ = core.ReadBytes(16, r)\n\t} else { // logon error info\n\t\tcore.ReadUInt32LE(r)\n\t\tcore.ReadUInt32LE(r)\n\t\tb, _ := core.ReadUInt32LE(r)\n\t\ts.LogonId = b\n\t}\n\tcore.ReadBytes(570, r)\n\treturn err\n}\nfunc (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {","sourceCodeStart":701,"sourceCodeEnd":737,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/pdu/data.go#L701-L737","documentation":"logonInfoExtended in libs/grdp/protocol/pdu/data.go parses the auto-reconnect cookie inside the Save Session Info (LogonInfo) PDU when the LOGON_EX_AUTORECONNECTCOOKIE flag is set. MS-RDPBCGR fixes the cookie length field at 28 (CB_AUTORECONNECTCOOKIE); any other value fails this check and returns the error. It means the reconnect cookie blob is malformed or the stream is misaligned.","triggerScenarios":"Server sends a SaveSessionInfo PDU with FieldsPresent containing LOGON_EX_AUTORECONNECTCOOKIE but the 32-bit length field following it is not 28 — e.g. during automatic reconnection after a network drop, or when the reader is offset due to a prior misparse.","commonSituations":"Session auto-reconnect after network interruption against servers emitting a different/extended cookie format; proxy/gateway middleboxes mangling the PDU; desync caused by an earlier unpack error in the same SaveSessionInfo PDU.","solutions":["Verify with a reference client whether the server's auto-reconnect cookie is nonstandard; if only informational, downgrade this path to a warning and skip the cookie instead of failing the PDU","Check for stream desynchronization — if this fires together with other parse errors in the same session, fix the earlier misparse or reconnect the session","Upgrade grdp to a version matching your server's MS-RDPBCGR auto-reconnect cookie layout","Disable auto-reconnect cookies in client negotiation (omit the corresponding flag) if your use case never reconnects"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := session.HandleSaveSessionInfo(pdu)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid length in Auto-Reconnect packet\") {\n        log.Printf(\"ignoring malformed auto-reconnect cookie: %v\", err)\n        return nil // non-fatal: reconnect cookie is optional\n    }\n    return err\n}","preventionTips":["Treat reconnect-cookie parse failures as non-fatal unless you rely on seamless reconnection","If multiple PDUs misparse, assume stream desync and re-establish the connection","Keep grdp current with MS-RDPBCGR SaveSessionInfo changes","Avoid middleboxes/proxies that rewrite RDP PDU payloads"],"tags":["rdp","reconnect","protocol-parsing"],"backgroundTag":"schema-validation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}