RPC Status: 1818 CallCancelled responding to CONN/A1 RTS PDU request

Copper Contributor

I'm trying to build a PHP mapiHTTP interface to solve RCA (https://testconnectivity.microsoft.com/) Exchange Server->Outlook connectivity test. I was able to pass `Autodiscover` stages and all `mapiHTTP` steps. Now I've problems establishing connection RPC over HTTP [MS-RPCH].

RCA is sending
```
Host: 92.117.223.65:12000
User-Agent: MSRPC
Accept: application/rpc
Pragma: SessionId=7a6fca0d-d59b-4e54-8422-ef425c9e1132
Connection: close
Cache-Control: no-cache
Content-Length: 76
User: email address removed for privacy reasons
Password: mamma
Request: RPC_OUT_DATA /rpc/rpcproxy.dll?xxx.de:6001 HTTP/1.1
Authorization: Basic xxxxx
```

Pseudo code:

```
<PDU>
<!-- Converted binary data received from client -->
<MajorVersion Var="I1" Pos="0x0 (0)">5</MajorVersion>
<MinorVersion Var="I1" Pos="0x1 (1)">0</MinorVersion>
<PacketType Var="I1" Pos="0x2 (2)">RTS</PacketType>
<PFCFlags Var="I1" Pos="0x3 (3)">FIRST_FRAG|LAST_FRAG</PFCFlags>
<DataTypes>
<Vars Var="I1" Pos="0x4 (4)">ASCII</Vars>
<Float Var="I1" Pos="0x5 (5)">IEEE</Float>
<Unused Var="I2" Pos="0x6 (6)">0</Unused>
</DataTypes>
<FragLen Var="I2" Pos="0x8 (8)">76</FragLen>
<AuthLen Var="I2" Pos="0xA (10)">0</AuthLen>
<CallId Var="I4" Pos="0xC (12)">0</CallId>
<RTSFlags Var="I2" Pos="0x10 (16)">NONE</RTSFlags>
<CmdCnt Var="I2" Pos="0x12 (18)">4</CmdCnt>
<Cmds Var="" Pos="0x14 (20)">
<Cmd Var="I4" Pos="0x14 (20)">Version</Cmd>
<Data Var="I4" Pos="0x18 (24)">1</Data>
<Cmd Var="I4" Pos="0x1C (28)">Cookie</Cmd>
<Data Var="A16" Pos="0x20 (32)">006b59eeb8f5cc1e446e46a337616ccd</Data>
<Cmd Var="I4" Pos="0x30 (48)">Cookie</Cmd>
<Data Var="A16" Pos="0x34 (52)">f8272562bd40b02d9d17f744959b0725</Data>
<Cmd Var="I4" Pos="0x44 (68)">ReceiveWindowSize</Cmd>
<Data Var="I4" Pos="0x48 (72)">65536</Data>
</Cmds>
</PDU>
```
This seems to be a `[MS-RPCH] 2.2.4.2 CONN/A1 RTS PDU` request.

My PHP program is sending back a `[MS-RPCH]2.2.4.4 CONN/A3 RTS PDU`:

```
Response: HTTP/1.1 200 Success
Content-Type: application/rpc
Content-Length: 1000000000
Pragma: SessionId=7a6fca0d-d59b-4e54-8422-ef425c9e1132
Connection: Keep-Alive
Cache-Control: private
```

Pseudo code:
```
<PDU>
<!-- Converted binary data received from client -->
<MajorVersion Var="I1" Pos="0x0 (0)">5</MajorVersion>
<MinorVersion Var="I1" Pos="0x1 (1)">0</MinorVersion>
<PacketType Var="I1" Pos="0x2 (2)">RTS</PacketType>
<PFCFlags Var="I1" Pos="0x3 (3)">FIRST_FRAG|LAST_FRAG</PFCFlags>
<DataTypes>
<Vars Var="I1" Pos="0x4 (4)">ASCII</Vars>
<Float Var="I1" Pos="0x5 (5)">IEEE</Float>
<Unused Var="I2" Pos="0x6 (6)">0</Unused>
</DataTypes>
<FragLen Var="I2" Pos="0x8 (8)">28</FragLen>
<AuthLen Var="I2" Pos="0xA (10)">0</AuthLen>
<CallId Var="I4" Pos="0xC (12)">0</CallId>
<RTSFlags Var="I2" Pos="0x10 (16)">NONE</RTSFlags>
<CmdCnt Var="I2" Pos="0x12 (18)">1</CmdCnt>
<Cmds Var="" Pos="0x14 (20)">
<Cmd Var="I4" Pos="0x14 (20)">ConnectionTimeout</Cmd>
<Data Var="I4" Pos="0x18 (24)">14400000</Data>
</Cmds>
</PDU>
```

Then I get error message:
```
Attempting to ping the MAPI Mail Store endpoint with identity: xxx.de:6001.
The attempt to ping the endpoint failed.
Additional Details
An RPC error was thrown by the RPC Runtime process. Error 1818 CallCancelled
RPC Status: 1818 CallCancelled
Timestamp: 11/5/2022 1:25:37 PM
Generating Component: 14 (WinHttp)
Status: 1818
Detection Location: 1390 (HTTP2ClientVirtualConnection__ClientOpenInternal10)
Flags: 0
Parameters:
30000
```
Any help appreciated!

0 Replies