{"record":{"id":"e8bcea2ea1d9f1de","repo":"shadow1ng/fscan","slug":"unsupported-oracle-advanced-service-algorithm-d","errorCode":null,"errorMessage":"unsupported oracle advanced service algorithm %d","messagePattern":"unsupported oracle advanced service algorithm (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":878,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif name != \"\" && name != \"TCPS\" {\n\t\t\t\treturn fmt.Errorf(\"unsupported oracle authentication service %s\", name)\n\t\t\t}\n\t\t} else if status != 0xfbff {\n\t\t\treturn errors.New(\"oracle advanced authentication negotiation failed\")\n\t\t}\n\tcase 2, 3:\n\t\tif _, err := s.readANOVersion(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\talgo, err := s.readANOUB1()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif algo != 0 {\n\t\t\treturn fmt.Errorf(\"unsupported oracle advanced service algorithm %d\", algo)\n\t\t}\n\t\tfor i := 2; i < subPackets; i++ {\n\t\t\tif err := s.skipANOPacket(); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\tcase 4:\n\t\tif _, err := s.readANOVersion(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif _, err := s.readANOStatus(); err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err := s.readANOBytes()\n\t\treturn err\n\tdefault:\n\t\tfor i := 0; i < subPackets; i++ {\n\t\t\tif err := s.skipANOPacket(); err != nil {","sourceCodeStart":860,"sourceCodeEnd":896,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L860-L896","documentation":"During ANO service types 2/3 (data integrity / encryption) negotiation, the server advertises an algorithm ID for the crypto service. The library only supports algorithm ID 0 (i.e. no algorithm / pass-through), so any negotiated encryption or checksumming algorithm is rejected with the numeric ID.","triggerScenarios":"advancedNegotiation -> readANOServiceData(serviceType=2 or 3) reads a UB1 algorithm byte that is non-zero, because the server requires Oracle Native Encryption or MD5/SHA checksumming for this connection.","commonSituations":"Server has SQLNET.ENCRYPTION_SERVER=REQUIRED or SQLNET.CRC_SERVER=REQUIRED with AES/3DES/RC4 configured; connecting from an environment where DBAs mandate network encryption at the TNS layer instead of TLS.","solutions":["Change server sqlnet.ora: set SQLNET.ENCRYPTION_SERVER and SQLNET.CRC_SERVER to REJECTED or ACCEPTED (not REQUIRED) so the no-algorithm option is acceptable.","Use TCPS (TLS) connections instead of native network encryption, which this library supports.","If native TNS encryption is mandatory, switch to Oracle's official driver (godror/ODPI-C) which implements ANO crypto algorithms."],"exampleFix":"# before (sqlnet.ora)\nSQLNET.ENCRYPTION_SERVER=(REQUIRED)\n# after\nSQLNET.ENCRYPTION_SERVER=(REQUESTED)","handlingStrategy":"validation","validationCode":"// Verify server ANO crypto policy before connecting:\n// sqlnet.ora must not set SQLNET.ENCRYPTION_SERVER=(REQUIRED)\n// or SQLNET.CRC_SERVER=(REQUIRED); use REQUESTED/ACCEPTED.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use TLS (TCPS) for encrypted connections instead of native TNS encryption","Keep ENCRYPTION_SERVER/CRC_SERVER at REQUESTED, never REQUIRED, for this client","Test connectivity after every sqlnet.ora change"],"tags":["oracle","encryption","negotiation","unsupported-feature"],"backgroundTag":"unsupported-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}