{"record":{"id":"b26c6eb014045c31","repo":"shadow1ng/fscan","slug":"oracle-connection-refused-s","errorCode":null,"errorMessage":"oracle connection refused: %s","messagePattern":"oracle connection refused: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":1827,"sourceCode":"\tmsg := string(s.summary.errorMessage)\n\tif msg == \"\" {\n\t\tmsg = fmt.Sprintf(\"ORA-%05d\", s.summary.retCode)\n\t}\n\treturn fmt.Errorf(\"%s\", msg)\n}\n\nfunc oracleRefuseError(raw []byte) error {\n\tif len(raw) < 12 {\n\t\treturn errors.New(\"oracle connection refused\")\n\t}\n\tdataLen := int(binary.BigEndian.Uint16(raw[10:12]))\n\tif len(raw) < 12+dataLen {\n\t\treturn errors.New(\"oracle connection refused\")\n\t}\n\tmsg := string(raw[12 : 12+dataLen])\n\tcode := oracleExtractCode(msg)\n\tif code == 0 {\n\t\treturn fmt.Errorf(\"oracle connection refused: %s\", msg)\n\t}\n\treturn fmt.Errorf(\"ORA-%05d: %s\", code, msg)\n}\n\nfunc oracleExtractCode(msg string) int {\n\tupper := strings.ToUpper(msg)\n\tfor _, marker := range []string{\"ERR=\", \"CODE=\"} {\n\t\tidx := strings.Index(upper, marker)\n\t\tif idx < 0 {\n\t\t\tcontinue\n\t\t}\n\t\tidx += len(marker)\n\t\tfor idx < len(upper) && (upper[idx] < '0' || upper[idx] > '9') {\n\t\t\tidx++\n\t\t}\n\t\tstart := idx\n\t\tfor idx < len(upper) && upper[idx] >= '0' && upper[idx] <= '9' {\n\t\t\tidx++","sourceCodeStart":1809,"sourceCodeEnd":1845,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L1809-L1845","documentation":"When the Oracle listener refuses the connection, the raw refuse packet contains a text message. If no ORA-/TNS- code can be extracted from that text, the library wraps the raw text in this error; if a code is found it formats 'ORA-<code>: <msg>' instead. It signals the listener actively rejected the connection before authentication.","triggerScenarios":"oracleRefuseError(raw) receives a refuse packet where len(raw) >= 12+dataLen, extracts raw[12:12+dataLen], and oracleExtractCode finds no numeric code in the text — e.g. 'TNS-12514: TNS:listener does not currently know of service' variants without a parseable code, or free-form refusal text.","commonSituations":"Wrong SID/service name in the DSN (TNS-12514/12505); listener not registered with the instance after restart (ORA-12528); listener rejecting due to valid node checking or max connections; connecting before the DB finished starting up.","solutions":["Check the embedded refusal text for the actual TNS- code and fix accordingly — usually the service name/SID is wrong: verify with lsnrctl status.","If the database just started, wait for service registration or use a static listener registration (SID_LIST_LISTENER in listener.ora).","Confirm network ACLs / valid node checking on the listener allow the client host."],"exampleFix":"// before\ndsn := \"oracle://user:pass@host:1521/ORCLW\" // unknown service\n// after\ndsn := \"oracle://user:pass@host:1521/ORCLPDB1\" // service registered with listener","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := connect(ctx, dsn)\nif err != nil && strings.Contains(err.Error(), \"oracle connection refused\") {\n    // service may still be registering after a DB restart\n    return backoffRetry(ctx, 5, 2*time.Second, func() error { return connect(ctx, dsn) })\n}","preventionTips":["Verify service names with lsnrctl status before deploying config changes","Add startup health checks that wait for service registration after DB restarts","Register services statically in listener.ora to avoid registration races"],"tags":["oracle","connection","listener","refused"],"backgroundTag":"connection-refused","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}