1
votes

Goal: Im trying to establish a ssl connection to a oracle 19c database for the purpose of capturing the network traffic generated for another project, but I have had a heck of a time. Any help will be much appreciated. Thanks in advance.

Symptoms: tcp 3 way handshake is started successfully SYN, SYN ACK but the listener immediately shuts it down with a FIN ACK graceful connection.

TNS-12560: TNS:protocol adapter error

TNS-00540: SSL protocol adapter failure

I've used sqlplus and toad.

The non ssl connection to port 1521 works just fine on sqlplus and toad.

listener.ora (SERVER)

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = CLRExtProc)
      (ORACLE_HOME = C:\App\db_home)
      (PROGRAM = extproc)
      (ENVS = "EXTPROC_DLLS=ONLY:C:\App\db_home\bin\oraclr19.dll")
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = C:\App\db_home\wallet)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = WIN-10-ORACL-DB)(PORT = 2484))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC2484))
    )
  )

ADR_BASE_LISTENER = C:\App\db_home\log

sqlnet.ora (SERVER)

SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, NTS)

SSL_VERSION = 3.1

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

SSL_CLIENT_AUTHENTICATION = FALSE

SQLNET.ENCRYPTION_TYPES_SERVER= (AES256)

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = C:\App\db_home\wallet)
    )
  )

SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_128_CBC_SHA256, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_GCM_SHA384)

ADR_BASE = C:\App\db_home\log

tnsnames.ora (SERVER)

ORACLR_CONNECTION_DATA =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = IPC)(Key = EXTPROC1521))
      (ADDRESS = (PROTOCOL = IPC)(Key = EXTPROC2484))
    )
    (CONNECT_DATA =
      (SID = CLRExtProc)
      (PRESENTATION = RO)
    )
  )

LISTENER_ORCL =
  (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))


ORCL =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = WIN-10-ORACL-DB)(PORT = 2484))
    )
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl.greenbuff.local)
    )
  )

sqlnet.ora (CLIENT)

SQLNET.AUTHENTICATION_SERVICE = (TCPS, NTS)

SSL_VERSION= 3.1


SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION =
    (SOURCE = 
        (METHOD = FILE)
        (METHOD_DATA = 
            (DIRECTORY = C:\oracle\instant_client_19_6\network\wallet)
        )
    )

ADR_BASE = C:\oracle\instant_client_19_6\network\log
NAMES.DIRECTORY_PATH=(EZCONNECT,TNSNAMES)
LOG_DIRECTORY_CLIENT=C:\oracle\instantclient_19_6\network\log
LOG_FILE_CLIENT=sqlnet_log
SQLNET.EXPIRE_TIME=3
TRACE_FILELEN_CLIENT=100
TRACE_FILENO_CLIENT=3
TRACE_LEVEL_CLIENT=support
TRACE_TIMESTAMP_CLIENT=ON
TRACE_UNIQUE_CLIENT=ON
USE_DEDICATED_SERVER=OFF

tnsnames.ora (CLIENT)

REMOTE_SSL_DB = 
(DESCRIPTION = 
    (ADDRESS = (PROTOCOL = TCPS)(HOST = 172.20.191.102)(PORT = 2484))
    (CONNECT_DATA=
        (SERVER = DEDICATED)
        (SERVICE_NAME = orcl.greenbuff.local)
    )
)

REMOTE_DB = 
(DESCRIPTION = 
    (ADDRESS = (PROTOCOL = TCP)(HOST = 172.20.191.102)(PORT = 1521))
    (CONNECT_DATA=
        (SERVER = DEDICATED)
        (SERVICE_NAME = orcl.greenbuff.local)
    )
)
2
Try removing SQLNET.AUTHENTICATION_SERVICE from the client's sqlnet.ora. That's a server-side parameter and it has a tendency to cause problems for clients. - pmdba
@pmdba I went ahead and removed that line you indicated from the sqlnet.ora and rebooted both server and client. I then tried to reconnect and got the same issue. I found a trace logging file on the server. Its location is "C:\App\db_home\log\diag\tnslsnr\WIN-10-ORACL-DB\listener\trace". I think that logging is not very verbose. Anyway, heres what it says: 2020-05-05T11:57:22.181591-07:00 05-MAY-2020 11:57:22 * 12560 TNS-12560: TNS:protocol adapter error TNS-00540: SSL protocol adapter failure - buckc
@buckc -while this doesn't solve your problem, for future reference there is no need to reboot just because you modified sqlnet.ora. It is read dynamically as needed. And FWIW, same for tnsnames.ora. A change to listener.ora would require a restart (or reload) of the listener, but never a full reboot. - EdStevens

2 Answers

0
votes

SSL_VERSION=3.1 is not valid. Valid values are "3.0" for SSL, or "1.0", "1.1", "1.2" for TLS. TLS is recommended, being the strongest.

https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html#GUID-A2A81CEE-162D-4602-8315-990C8CC9E9E2

0
votes

I encountered the same issue. What finally solved it for me was adding the permission on the .sso and .pk wallet file for the service account which oracle database uses in case Oracle Database was installed with a virtual account. i.e. NT Service\OracleService and NTService\OracleListener(These 2 accounts).

After enabling the permissions to full control for both account for .sso and .pk wallet file, I was able to establish the connection. You can leave the SSL_VERSION = 0 after making the above change. client and server can negotiate the best available protocol

Note: This answer is windows specific but the permission assignment was originaly suggested for the same kind of issue on a linux machine

Upate 05/02/2021. Dont use the wallet manager provided by oracle. Only use orapki. For some reason using wallet manager always screws the TCPS connection and due to unable to open the file error inspite of having all the required permissions provided to the virtual accounts if any