{"record":{"id":"a32209c656e65a7e","repo":"shadow1ng/fscan","slug":"unexpected-connect-in-auth-only-mode","errorCode":null,"errorMessage":"unexpected connect in auth-only mode","messagePattern":"unexpected connect in auth-only mode","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/login/screen.go","lineNumber":153,"sourceCode":"\tg.x224 = x224.New(g.tpkt)\n\n\t// 设置NLA仅验证模式\n\tg.tpkt.SetNLAAuthOnly(true)\n\n\t// 使用 PROTOCOL_HYBRID (NLA) 协议\n\tg.x224.SetRequestedProtocol(x224.PROTOCOL_HYBRID)\n\n\t// 用于接收结果的通道\n\tresultChan := make(chan error, 1)\n\n\t// 监听错误事件（包括 ErrNLAAuthSuccess）\n\tg.x224.On(\"error\", func(err error) {\n\t\tresultChan <- err\n\t})\n\n\t// 监听连接事件（不应该发生在 auth-only 模式）\n\tg.x224.On(\"connect\", func(protocol uint32) {\n\t\tresultChan <- fmt.Errorf(\"unexpected connect in auth-only mode\")\n\t})\n\n\t// 发起连接\n\terr = g.x224.Connect()\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\t// 等待结果或超时\n\tselect {\n\tcase err := <-resultChan:\n\t\tif err == tpkt.ErrNLAAuthSuccess {\n\t\t\treturn true, nil\n\t\t}\n\t\treturn false, err\n\tcase <-time.After(time.Duration(timeout*3) * time.Second):\n\t\treturn false, fmt.Errorf(\"NLA auth timeout\")\n\t}","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/login/screen.go#L135-L171","documentation":"In NLA auth-only mode the client only performs CredSSP/NLA negotiation and must never complete a full X.224 connection sequence. If the x224 layer signals a 'connect' event (the server accepted and offered a protocol, moving beyond auth-only expectations), the library deliberately aborts with this internal invariant error.","triggerScenarios":"Calling NlaAuthOnly and the RDP server responds in a way that advances x224 to a full connect state — e.g. the server skips or accepts NLA negotiation unexpectedly (Protocol fallback to plain RDP security), or a protocol/state bug in the negotiated handshake.","commonSituations":"Target servers configured without NLA (Encryption Level 'Client Compatible'/'Low'), causing the server to bypass CredSSP and proceed straight to a session connect; older Windows targets with relaxed security policy.","solutions":["Enable NLA on the target host (System Properties > Remote > 'Allow connections only with NLA') so the auth-only probe stays within CredSSP.","Use a full Client.Login/connect flow instead of NlaAuthOnly if you intend to establish a session.","Check the negotiated protocol in the connect callback; if the server falls back from PROTOCOL_HYBRID, it lacks NLA support.","Treat this as an internal invariant violation and report it if the server does have NLA enabled."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"ok, err := client.NlaAuthOnly(domain, user, pwd, timeout)\nif err != nil && strings.Contains(err.Error(), \"unexpected connect in auth-only mode\") {\n\t// server lacks NLA; fall back to full session flow or mark as non-NLA host\n\treturn classifyNonNLAHost(host)\n}","preventionTips":["Only use NlaAuthOnly against hosts known to require NLA.","Detect NLA support (PROTOCOL_HYBRID) before choosing auth-only mode.","Treat this error as 'server without NLA', not as a code bug, in triage runbooks.","Keep grdp updated for x224 protocol edge cases."],"tags":["rdp","nla","x224","state-error","internal"],"backgroundTag":"invalid-state-transition","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}