oracle - 如何使用 oracle db 19c 创建从 Windows 客户端到另一台 Windows 机器的 ssl/tls 连接？

Question

目标:我试图建立一个到 oracle 19c 数据库的 ssl 连接，以捕获为另一个项目生成的网络流量，但我有一段时间了。任何帮助都感激不尽。提前致谢。

症状:tcp 3 路握手成功启动 SYN, SYN ACK 但监听器立即使用 FIN ACK 优雅连接将其关闭。

TNS-12560:TNS:协议(protocol)适配器错误

TNS-00540:SSL 协议(protocol)适配器故障

我用过 sqlplus 和 toad。

到端口 1521 的非 ssl 连接在 sqlplus 和 toad 上工作得很好。

listener.ora (服务器)

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = CLRExtProc)
      (ORACLE_HOME = C:\App\db_home)
      (PROGRAM = extproc)
      (ENVS = "EXTPROC_DLLS=ONLY:C:\App\db_home\bin\oraclr19.dll")
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = C:\App\db_home\wallet)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = WIN-10-ORACL-DB)(PORT = 2484))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC2484))
    )
  )

ADR_BASE_LISTENER = C:\App\db_home\log

sqlnet.ora (服务器)

SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS, NTS)

SSL_VERSION = 3.1

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

SSL_CLIENT_AUTHENTICATION = FALSE

SQLNET.ENCRYPTION_TYPES_SERVER= (AES256)

WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = C:\App\db_home\wallet)
    )
  )

SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_128_CBC_SHA256, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_GCM_SHA384)

ADR_BASE = C:\App\db_home\log

tnsnames.ora (服务器)

ORACLR_CONNECTION_DATA =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = IPC)(Key = EXTPROC1521))
      (ADDRESS = (PROTOCOL = IPC)(Key = EXTPROC2484))
    )
    (CONNECT_DATA =
      (SID = CLRExtProc)
      (PRESENTATION = RO)
    )
  )

LISTENER_ORCL =
  (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))


ORCL =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (ADDRESS = (PROTOCOL = TCP)(HOST = WIN-10-ORACL-DB)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = WIN-10-ORACL-DB)(PORT = 2484))
    )
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl.greenbuff.local)
    )
  )

sqlnet.ora(客户端)

SQLNET.AUTHENTICATION_SERVICE = (TCPS, NTS)

SSL_VERSION= 3.1


SSL_CLIENT_AUTHENTICATION = FALSE

WALLET_LOCATION =
    (SOURCE = 
        (METHOD = FILE)
        (METHOD_DATA = 
            (DIRECTORY = C:\oracle\instant_client_19_6\network\wallet)
        )
    )

ADR_BASE = C:\oracle\instant_client_19_6\network\log
NAMES.DIRECTORY_PATH=(EZCONNECT,TNSNAMES)
LOG_DIRECTORY_CLIENT=C:\oracle\instantclient_19_6\network\log
LOG_FILE_CLIENT=sqlnet_log
SQLNET.EXPIRE_TIME=3
TRACE_FILELEN_CLIENT=100
TRACE_FILENO_CLIENT=3
TRACE_LEVEL_CLIENT=support
TRACE_TIMESTAMP_CLIENT=ON
TRACE_UNIQUE_CLIENT=ON
USE_DEDICATED_SERVER=OFF

tnsnames.ora(客户端)

REMOTE_SSL_DB = 
(DESCRIPTION = 
    (ADDRESS = (PROTOCOL = TCPS)(HOST = 172.20.191.102)(PORT = 2484))
    (CONNECT_DATA=
        (SERVER = DEDICATED)
        (SERVICE_NAME = orcl.greenbuff.local)
    )
)

REMOTE_DB = 
(DESCRIPTION = 
    (ADDRESS = (PROTOCOL = TCP)(HOST = 172.20.191.102)(PORT = 1521))
    (CONNECT_DATA=
        (SERVER = DEDICATED)
        (SERVICE_NAME = orcl.greenbuff.local)
    )
)

Answer 1

SSL_VERSION=3.1 无效。 SSL 的有效值为“3.0”，TLS 的有效值为“1.0”、“1.1”、“1.2”。建议使用 TLS，它是最强的。

https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/parameters-for-the-sqlnet.ora.html#GUID-A2A81CEE-162D-4602-8315-990C8CC9E9E2