{"record":{"id":"0ad9662af7b743c7","repo":"shadow1ng/fscan","slug":"oracle-redirect-is-not-supported-by-lightweight-au","errorCode":null,"errorMessage":"oracle redirect is not supported by lightweight auth","messagePattern":"oracle redirect is not supported by lightweight auth","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":214,"sourceCode":"\t\ts.sessionDataUnit = uint32(binary.BigEndian.Uint16(p.raw[12:14]))\n\t\ts.transportDataUnit = uint32(binary.BigEndian.Uint16(p.raw[14:16]))\n\t\tif s.version >= 315 {\n\t\t\ts.sessionDataUnit = binary.BigEndian.Uint32(p.raw[32:36])\n\t\t\ts.transportDataUnit = binary.BigEndian.Uint32(p.raw[36:40])\n\t\t}\n\t\tif s.transportDataUnit < s.sessionDataUnit {\n\t\t\ts.sessionDataUnit = s.transportDataUnit\n\t\t}\n\t\ts.acfl0 = p.raw[22]\n\t\ts.acfl1 = p.raw[23]\n\t\tif s.version >= 315 {\n\t\t\ts.handshakeComplete = true\n\t\t}\n\t\treturn nil\n\tcase oraclePacketRefuse:\n\t\treturn oracleRefuseError(p.raw)\n\tcase oraclePacketRedirect:\n\t\treturn errors.New(\"oracle redirect is not supported by lightweight auth\")\n\tdefault:\n\t\treturn fmt.Errorf(\"unexpected oracle packet type %d\", p.typ)\n\t}\n}\n\nfunc oracleConnectData(host string, port int, serviceName string) string {\n\taddress := fmt.Sprintf(\"(ADDRESS=(PROTOCOL=tcp)(HOST=%s)(PORT=%d))\", host, port)\n\tconnectData := \"(CONNECT_DATA=(SERVICE_NAME=\" + serviceName + \"))\"\n\treturn \"(DESCRIPTION=\" + address + connectData + \")\"\n}\n\ntype oraclePacket struct {\n\ttyp  uint8\n\tflag uint8\n\traw  []byte\n\tdata []byte\n}\n","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L196-L232","documentation":"The lightweight Oracle TNS client does not implement the REDIRECT packet flow of the TNS handshake. When the listener responds with a Redirect packet (typical when the listener hands the connection off to a dispatcher or a separate node), the client cannot follow it and returns this error immediately. The connection was accepted at the listener level, but the actual session must be re-established elsewhere.","triggerScenarios":"connect() (via oracleRawAuth) receives a packet with typ == oraclePacketRedirect, e.g. when the database uses shared server/dispatchers or a RAC setup where the listener redirects new connections.","commonSituations":"Oracle RAC or SCAN listeners redirecting to node VIPs; shared-server (MTS) configurations with dispatchers; misconfigured listener with DIRECT_HANDOFF or connection load balancing enabled.","solutions":["Connect directly to the database node VIP/hostname instead of the SCAN or redirecting listener.","Configure the connection to use DEDICATED server mode (SERVER=DEDICATED) to avoid dispatcher redirects.","Implement REDIRECT handling in the client: parse the redirect address from the packet and reconnect to it.","Ask the DBA to disable connection redirect for this listener if direct connections are acceptable."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// prefer dedicated server to avoid redirects: include in connect data\n// (CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=orcl))","typeGuard":"func isRedirectPacket(p oraclePacket) bool {\n    return p.typ == oraclePacketRedirect\n}","tryCatchPattern":"if err := s.connect(p); err != nil {\n    if strings.Contains(err.Error(), \"oracle redirect is not supported\") {\n        return connectDirect(nodeVIP, port, svc) // skip SCAN/listener redirect\n    }\n    return err\n}","preventionTips":["Target node VIPs or use SCAN names configured without redirects","Request DEDICATED server mode in connect data to bypass dispatchers","Ask DBAs about RAC/shared-server redirect behavior before scanning","Parse the redirect address and reconnect if you add REDIRECT support"],"tags":["oracle","tns","redirect","unsupported-feature"],"backgroundTag":"operation-not-supported","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}