{"record":{"id":"9f2e6d727431279c","repo":"shadow1ng/fscan","slug":"ano-w","errorCode":null,"errorMessage":"ANO: %w","messagePattern":"ANO: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":120,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tdefer conn.Close()\n\n\ts := &oracleSession{\n\t\tconn:              conn,\n\t\tversion:           317,\n\t\tsessionDataUnit:   0x200000,\n\t\ttransportDataUnit: 0x200000,\n\t\tclrChunkSize:      0x40,\n\t\ttimeout:           timeout,\n\t}\n\tif err := s.connect(ctx, host, port, serviceName); err != nil {\n\t\treturn err\n\t}\n\tif s.acfl0&1 != 0 && s.acfl0&4 == 0 && s.acfl1&8 == 0 {\n\t\tif err := s.advancedNegotiation(); err != nil {\n\t\t\treturn fmt.Errorf(\"ANO: %w\", err)\n\t\t}\n\t}\n\tnego, err := s.protocolNegotiation()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := s.dataTypeNegotiation(nego); err != nil {\n\t\treturn err\n\t}\n\treturn s.authenticate(nego, host, port, serviceName, username, password)\n}\n\nfunc (s *oracleSession) connect(ctx context.Context, host string, port int, serviceName string) error {\n\tconnectData := oracleConnectData(host, port, serviceName)\n\tpacketLen := 70 + len(connectData)\n\tif len(connectData) > 230 {\n\t\tpacketLen = 70\n\t}","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L102-L138","documentation":"oracleRawAuth wraps any failure of s.advancedNegotiation() with the \"ANO: %w\" prefix. Advanced Negotiation Options (ANO) is an optional phase of the Oracle TNS/Two-Task handshake (gated by bits in acfl0/acfl1); failure means the client and server could not agree on ANO services such as encryption, data integrity, or compression.","triggerScenarios":"oracleRawAuth connects, sees acfl0&1 set (ANO requested) with acfl0&4==0 and acfl1&8==0, calls advancedNegotiation, and the server's ANO response contains an error code or malformed service data.","commonSituations":"Server requires Oracle Native Encryption/Checksum that the lightweight client cannot negotiate; version mismatch between client's ANO implementation and server; MITM or middlebox corrupting the ANO exchange.","solutions":["Read the wrapped inner error for the specific ANO failure (e.g. ora-N code from errorIndex 439)","Disable required encryption/checksum on the server (SQLNET.ENCRYPTION_SERVER=REJECTED) or implement the needed ANO service","Align client with the server's Oracle version's ANO behavior","Retry against a listener without ANO enforcement to isolate the cause"],"exampleFix":"// server-side sqlnet.ora before\nSQLNET.ENCRYPTION_SERVER = REQUIRED\n// after\nSQLNET.ENCRYPTION_SERVER = REJECTED  # allow clients without ANO encryption support","handlingStrategy":"try-catch","validationCode":"// detect ANO requirement before full auth:\n// after connect, inspect s.acfl0/acfl1 flags\nif s.acfl0&1 != 0 && s.acfl0&4 == 0 && s.acfl1&8 == 0 {\n    log.Println(\"server requires ANO; lightweight client must support negotiated services\")\n}","typeGuard":"func isANOError(err error) bool { return err != nil && strings.HasPrefix(err.Error(), \"ANO: \") }","tryCatchPattern":"err := oracleRawAuth(ctx, host, port, svc)\nif isANOError(err) {\n    // unwrap inner cause, adjust server SQLNET encryption/checksum policy or retry without ANO\n    return fmt.Errorf(\"ANO negotiation failed: %w\", errors.Unwrap(err))\n}","preventionTips":["Check SQLNET.ENCRYPTION_SERVER / CRYPTO_CHECKSUM_SERVER settings on the target before scanning","Keep the client's ANO service list aligned with the server's Oracle version","Treat 'ANO: '-prefixed errors as configuration mismatches, not credential failures"],"tags":["oracle","tns","negotiation","handshake"],"backgroundTag":"oracle-advanced-negotiation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}