shadow1ng/fscan · error

oracle advanced negotiation error ora-%d

Error message

oracle advanced negotiation error ora-%d

What it means

advancedNegotiation parses the server's ANO service headers; each service carries a native error code. When errCode != 0 the session aborts with 'oracle advanced negotiation error ora-%d', surfacing the server's native Oracle error for the ANO service negotiation — commonly encryption/checksum/supervisor services refusing the client's proposal.

Source

Thrown at plugins/services/oracle_raw.go:731

	body := ab.out.Bytes()
	s.reset()
	s.writeANOHeader(13+len(body), 4, 0)
	s.putBytes(body...)

	if err := s.writeData(); err != nil {
		return err
	}
	header, err := s.readANOHeader()
	if err != nil {
		return err
	}
	for i := 0; i < header.serviceCount; i++ {
		serviceType, subPackets, errCode, err := s.readANOServiceHeader()
		if err != nil {
			return err
		}
		if errCode != 0 {
			return fmt.Errorf("oracle advanced negotiation error ora-%d", errCode)
		}
		if err := s.readANOServiceData(serviceType, subPackets); err != nil {
			return err
		}
	}
	return nil
}

type oracleANOHeader struct {
	serviceCount int
}

func (s *oracleSession) writeANOHeader(length, serviceCount int, flags uint8) {
	s.putInt(uint64(0xdeadbeef), 4, true, false)
	s.putInt(length, 2, true, false)
	s.putInt(0x0b200200, 4, true, false)
	s.putInt(serviceCount, 2, true, false)
	s.putBytes(flags)

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Identify the ora-N code and look it up in Oracle docs (e.g. ORA-12649: encryption required but unknown, ORA-12650)
  2. Relax server-side SQLNET.ENCRYPTION_SERVER / SQLNET.CRYPTO_CHECKSUM_SERVER to REJECTED or REQUESTED
  3. Extend the client's ANO service proposal to include the required service (e.g. RC4/AES, MD5/SHA1 checksum)
  4. Skip ANO by connecting to a listener configuration that does not set the ANO-required flag

Example fix

// sqlnet.ora before
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
// after
SQLNET.CRYPTO_CHECKSUM_SERVER = REJECTED  # allow lightweight ANO clients
Defensive patterns

Strategy: try-catch

Validate before calling

// check server ANO requirements pre-auth where possible:
// SQLNET.ENCRYPTION_SERVER / CRYPTO_CHECKSUM_SERVER should not be REQUIRED

Type guard

func isOracleANOErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "oracle advanced negotiation error ora-")
}

Try / catch

err := s.advancedNegotiation()
if isOracleANOErr(err) {
    var code int
    fmt.Sscanf(err.Error(), "oracle advanced negotiation error ora-%d", &code)
    return fmt.Errorf("ANO service rejected by server (ORA-%d): adjust SQLNET encryption/checksum policy", code)
}

Prevention

When it happens

Trigger: oracleRawAuth triggers advancedNegotiation (acfl0&1 set) and one of the header.serviceCount service headers returns a non-zero errCode.

Common situations: Server requires Oracle Native Network Encryption that the lightweight client's ANO proposal doesn't satisfy (often ORA-12649/ORA-12650 family); mismatched SQLNET encryption/checksum settings; unsupported service type proposed by the server.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/d226d9792cb66806. Report an issue: GitHub.