req.rdp_cookie, req.rdp_cookie_cnt, their deprecated rdp_cookie and
rdp_cookie_cnt spellings and the req_rdp_cookie/req_rdp_cookie_cnt ACL
forms had no coverage. The notes listed the test as doable, the only
obstacle being that the RDP connection request has to be built by hand,
which sendhex does here: the parser only skips the 11 bytes of the TPKT
and X.224 headers and looks for a "Cookie:" line behind them, without
checking any of the lengths.
Four packets are sent to a TCP frontend which reports the fetches in
its log: one carrying "mstshash=hello", one whose line is not a cookie,
one carrying another cookie name, which only the unnamed form returns,
and one with extra spaces between the colon and the name.