shadow1ng/fscan · warning

invalid length in Auto-Reconnect packet

Error message

invalid length in Auto-Reconnect packet

What it means

logonInfoExtended in libs/grdp/protocol/pdu/data.go parses the auto-reconnect cookie inside the Save Session Info (LogonInfo) PDU when the LOGON_EX_AUTORECONNECTCOOKIE flag is set. MS-RDPBCGR fixes the cookie length field at 28 (CB_AUTORECONNECTCOOKIE); any other value fails this check and returns the error. It means the reconnect cookie blob is malformed or the stream is misaligned.

Source

Thrown at libs/grdp/protocol/pdu/data.go:719

	userName := core.UnicodeDecode(b)
	glog.Infof("SessionId:[%d] UserName:[ %s] Domain:[ %s]", s.LogonId, userName, domain)

	return err
}
func (s *SaveSessionInfo) logonPlainNotify(r io.Reader) (err error) {
	core.ReadBytes(576, r) /* pad (576 bytes) */
	return err
}
func (s *SaveSessionInfo) logonInfoExtended(r io.Reader) (err error) {
	s.Length, err = core.ReadUint16LE(r)
	s.FieldsPresent, err = core.ReadUInt32LE(r)
	//glog.Info("FieldsPresent:", s.FieldsPresent)
	// auto reconnect cookie
	if s.FieldsPresent&LOGON_EX_AUTORECONNECTCOOKIE != 0 {
		core.ReadUInt32LE(r)
		b, _ := core.ReadUInt32LE(r)
		if b != 28 {
			return errors.New(fmt.Sprintf("invalid length in Auto-Reconnect packet"))
		}
		b, _ = core.ReadUInt32LE(r)
		if b != 1 {
			return errors.New(fmt.Sprintf("unsupported version of Auto-Reconnect packet"))
		}
		b, _ = core.ReadUInt32LE(r)
		s.LogonId = b
		s.Random, _ = core.ReadBytes(16, r)
	} else { // logon error info
		core.ReadUInt32LE(r)
		core.ReadUInt32LE(r)
		b, _ := core.ReadUInt32LE(r)
		s.LogonId = b
	}
	core.ReadBytes(570, r)
	return err
}
func (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify with a reference client whether the server's auto-reconnect cookie is nonstandard; if only informational, downgrade this path to a warning and skip the cookie instead of failing the PDU
2. Check for stream desynchronization — if this fires together with other parse errors in the same session, fix the earlier misparse or reconnect the session
3. Upgrade grdp to a version matching your server's MS-RDPBCGR auto-reconnect cookie layout
4. Disable auto-reconnect cookies in client negotiation (omit the corresponding flag) if your use case never reconnects

err := session.HandleSaveSessionInfo(pdu)
if err != nil {
    if strings.Contains(err.Error(), "invalid length in Auto-Reconnect packet") {
        log.Printf("ignoring malformed auto-reconnect cookie: %v", err)
        return nil // non-fatal: reconnect cookie is optional
    }
    return err
}

When it happens

Trigger: Server sends a SaveSessionInfo PDU with FieldsPresent containing LOGON_EX_AUTORECONNECTCOOKIE but the 32-bit length field following it is not 28 — e.g. during automatic reconnection after a network drop, or when the reader is offset due to a prior misparse.

Common situations: Session auto-reconnect after network interruption against servers emitting a different/extended cookie format; proxy/gateway middleboxes mangling the PDU; desync caused by an earlier unpack error in the same SaveSessionInfo PDU.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• unsupported version of Auto-Reconnect packet
• unsupported Capability type 0x%04x
• Unknown data pdu type2 0x%02x
• Unsupport slow update type 0x%x
• invalid ber tag

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/5c1f967dabefbc3f. Report an issue: GitHub.