{"record":{"id":"c5cf751762986df4","repo":"shadow1ng/fscan","slug":"oracle-connect-failed","errorCode":null,"errorMessage":"oracle_connect_failed","messagePattern":"oracle_connect_failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle.go","lineNumber":92,"sourceCode":"\t\tconnectCtx, cancel := context.WithTimeout(ctx, config.ModuleTimeout())\n\t\terr := oracleRawAuth(connectCtx, info.Host, info.Port, serviceName, cred.Username, cred.Password, config.ModuleTimeout())\n\t\tcancel()\n\t\tif err == nil {\n\t\t\tstate.IncrementTCPSuccessPacketCount()\n\t\t\treturn &AuthResult{Success: true}\n\t\t}\n\n\t\terrorType := classifyOracleErrorType(err)\n\t\tif errorType == ErrorTypeAuth {\n\t\t\treturn &AuthResult{Success: false, ErrorType: errorType, Error: err}\n\t\t}\n\t}\n\n\tstate.IncrementTCPFailedPacketCount()\n\treturn &AuthResult{\n\t\tSuccess:   false,\n\t\tErrorType: ErrorTypeNetwork,\n\t\tError:     fmt.Errorf(\"%s\", i18n.GetText(\"oracle_connect_failed\")),\n\t}\n}\n\n\n// classifyOracleErrorType Oracle错误分类\nfunc classifyOracleErrorType(err error) ErrorType {\n\tif err == nil {\n\t\treturn ErrorTypeUnknown\n\t}\n\n\toracleAuthErrors := []string{\n\t\t\"invalid username/password\",\n\t\t\"logon denied\",\n\t\t\"ora-01017\",\n\t\t\"ora-01045\",\n\t\t\"ora-28000\",\n\t\t\"ora-28001\",\n\t\t\"authentication failed\",","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle.go#L74-L110","documentation":"doOracleAuth reports ErrorTypeNetwork with the localized oracle_connect_failed message when the underlying oracleRawAuth connection phase fails — the scanner could not establish or complete the initial Oracle TNS connection to the target. This is a network-level failure, distinct from wrong credentials.","triggerScenarios":"testUnauthorizedAccess (or the anonymous auth wrapper) invokes doOracleAuth and the inner s.connect / handshake returns an error such as TCP refusal, timeout, or TNS refuse packet.","commonSituations":"Oracle listener not running on the scanned port; firewall dropping TCP; wrong service name in config; listener configured to refuse connections from the scanner's IP (node checking / valid node checking).","solutions":["Verify the Oracle listener is up: telnet/nc to host:port and check lsnrctl status","Confirm the SERVICE_NAME configured matches the target database","Check firewall and Oracle's VALID_NODE_CHECKING/INVITED_NODES settings","Rerun with retries — transient network failures set ErrorTypeNetwork so an outer retry loop may already handle them"],"exampleFix":"// before\ndoOracleAuth(host, port) // listener down\n// after\nif err := ensureListenerUp(host, port); err != nil {\n    return fmt.Errorf(\"oracle listener unreachable: %w\", err)\n}\ndoOracleAuth(host, port)","handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(host, strconv.Itoa(port)), 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"oracle port unreachable before auth: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"res := doOracleAuth(host, port, svc)\nif res.ErrorType == ErrorTypeNetwork {\n    // transient/infra failure: backoff and retry, not a credential problem\n    time.Sleep(backoff)\n    res = doOracleAuth(host, port, svc)\n}","preventionTips":["TCP-check the listener port before running the auth flow","Confirm SERVICE_NAME with the DBA or via lsnrctl status","Account for Oracle valid-node-checking/firewalls that refuse scanner IPs","Use exponential backoff for ErrorTypeNetwork results"],"tags":["oracle","network","connection"],"backgroundTag":"connection-refused","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}