{"record":{"id":"d226d9792cb66806","repo":"shadow1ng/fscan","slug":"oracle-advanced-negotiation-error-ora-d","errorCode":null,"errorMessage":"oracle advanced negotiation error ora-%d","messagePattern":"oracle advanced negotiation error ora-(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":731,"sourceCode":"\tbody := ab.out.Bytes()\n\ts.reset()\n\ts.writeANOHeader(13+len(body), 4, 0)\n\ts.putBytes(body...)\n\n\tif err := s.writeData(); err != nil {\n\t\treturn err\n\t}\n\theader, err := s.readANOHeader()\n\tif err != nil {\n\t\treturn err\n\t}\n\tfor i := 0; i < header.serviceCount; i++ {\n\t\tserviceType, subPackets, errCode, err := s.readANOServiceHeader()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif errCode != 0 {\n\t\t\treturn fmt.Errorf(\"oracle advanced negotiation error ora-%d\", errCode)\n\t\t}\n\t\tif err := s.readANOServiceData(serviceType, subPackets); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\ntype oracleANOHeader struct {\n\tserviceCount int\n}\n\nfunc (s *oracleSession) writeANOHeader(length, serviceCount int, flags uint8) {\n\ts.putInt(uint64(0xdeadbeef), 4, true, false)\n\ts.putInt(length, 2, true, false)\n\ts.putInt(0x0b200200, 4, true, false)\n\ts.putInt(serviceCount, 2, true, false)\n\ts.putBytes(flags)","sourceCodeStart":713,"sourceCodeEnd":749,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L713-L749","documentation":"advancedNegotiation parses the server's ANO service headers; each service carries a native error code. When errCode != 0 the session aborts with 'oracle advanced negotiation error ora-%d', surfacing the server's native Oracle error for the ANO service negotiation — commonly encryption/checksum/supervisor services refusing the client's proposal.","triggerScenarios":"oracleRawAuth triggers advancedNegotiation (acfl0&1 set) and one of the header.serviceCount service headers returns a non-zero errCode.","commonSituations":"Server requires Oracle Native Network Encryption that the lightweight client's ANO proposal doesn't satisfy (often ORA-12649/ORA-12650 family); mismatched SQLNET encryption/checksum settings; unsupported service type proposed by the server.","solutions":["Identify the ora-N code and look it up in Oracle docs (e.g. ORA-12649: encryption required but unknown, ORA-12650)","Relax server-side SQLNET.ENCRYPTION_SERVER / SQLNET.CRYPTO_CHECKSUM_SERVER to REJECTED or REQUESTED","Extend the client's ANO service proposal to include the required service (e.g. RC4/AES, MD5/SHA1 checksum)","Skip ANO by connecting to a listener configuration that does not set the ANO-required flag"],"exampleFix":"// sqlnet.ora before\nSQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED\n// after\nSQLNET.CRYPTO_CHECKSUM_SERVER = REJECTED  # allow lightweight ANO clients","handlingStrategy":"try-catch","validationCode":"// check server ANO requirements pre-auth where possible:\n// SQLNET.ENCRYPTION_SERVER / CRYPTO_CHECKSUM_SERVER should not be REQUIRED","typeGuard":"func isOracleANOErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"oracle advanced negotiation error ora-\")\n}","tryCatchPattern":"err := s.advancedNegotiation()\nif isOracleANOErr(err) {\n    var code int\n    fmt.Sscanf(err.Error(), \"oracle advanced negotiation error ora-%d\", &code)\n    return fmt.Errorf(\"ANO service rejected by server (ORA-%d): adjust SQLNET encryption/checksum policy\", code)\n}","preventionTips":["Look up the extracted ORA-N code in Oracle docs to pinpoint the refused service","Set SQLNET.ENCRYPTION_SERVER and CRYPTO_CHECKSUM_SERVER to REJECTED/REQUESTED for scanner compatibility","Extend the client's ANO proposal (encryption/checksum algorithms) to cover server requirements"],"tags":["oracle","tns","ano","negotiation","ora-error"],"backgroundTag":"oracle-advanced-negotiation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}