Oracle TNS 314 协议分析：三、连接认证流程与包分析

柔光的暖阳◎ 2023-03-12 12:30 6阅读 0赞

# **Connect 流程** #

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> Client </td> 
 <td style="vertical-align:top;width:42.45pt;"> &nbsp; </td> 
 <td style="vertical-align:top;width:163.1pt;"> &nbsp; </td> 
 <td style="vertical-align:top;width:42.5pt;"> &nbsp; </td> 
 <td style="vertical-align:top;width:79.15pt;"> Server </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 1 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Connect(01) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> 获取连接字符串 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 2 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Resend </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 3 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Connect(01) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 4 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Accept </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> 获取协议Version&nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 5 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data NetworkService(deadbeef) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> 网络参数交换 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 6 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data NetworkService(deadbeef) </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 7 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data SetProtocal(01) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 8 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data SetProtocal(01) </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 9 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data SetDataTypes(02) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 10 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data SetDataTypes(02) </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 11 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data UOCIFun(03) GetSessionKey(76) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 12 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data OPIParam(08) &nbsp;with&nbsp;3 params Sessionkey，verifydata,，dbid </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 13 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data UOCIFun(03) Generic&nbsp;Auth&nbsp;call(73) </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> 获取验证参数：用户名，密码在此传输 Username&nbsp;sessionkey&nbsp;pass </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 14 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data OPIParam(08) with&nbsp;40 params </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> 认证结果包含 AuthDBName；dbid：AuthUserID；SessionID </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 15 </td> 
 <td style="vertical-align:top;width:42.45pt;"> ------- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data Piggyback(11) session switch（6b） </td> 
 <td style="vertical-align:top;width:42.5pt;"> -----&gt; </td> 
 <td style="vertical-align:top;width:79.15pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:42.3pt;"> 16 </td> 
 <td style="vertical-align:top;width:42.45pt;"> &lt;----- </td> 
 <td style="vertical-align:top;width:163.1pt;"> Data OPIParam(08) </td> 
 <td style="vertical-align:top;width:42.5pt;"> ------- </td> 
 <td style="vertical-align:top;width:79.15pt;"> Oracle版本号 </td> 
 </tr> 
 </tbody> 
</table>

认证错误时从14包往后，会返回一个marker，然后客户端会发送一个请求marker，接着服务端返回错误信息，此过程详细参见错误信息返回这个章节

# **特殊数据定义** #

在分析32位和64位客户端时，可以注意到不同版本客户端再解析上出现64位feffffffffffffff和00000000000000 在32位情况下分别都被代换为01和00的情况，所以我们定义

feMagic，在32位时为0x01 64位下为0xfe ff ff ff ff ff ff ff

00Magic，在32位时为0x00 64位下为0x00 00 00 00 00 00 00 00

# **获取协议版本暨协议头解析** #

Connect 的Accept包是获取TNS版本号的最佳地点，Connect过程会协商版本号，Connect过程中，client会传输自己支持的版本号，服务端会结合自己的情况，最终在Accept中选定一个版本号。Accept包的Package Type为2

## **Accept包格式** ##

<table> 
 <tbody> 
 <tr> 
 <td style="width:130.8pt;"> &nbsp; </td> 
 <td style="width:60.65pt;"> 32bit </td> 
 <td style="width:71.85pt;"> 64bit </td> 
 <td style="width:91.4pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Version </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 版本号 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Service Option </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> Bit标志选项 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Session Data Unit Size </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 一个DataUnit最多多大，在传输超长包时，Data 包会被拆解成如此大小的包 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Max Transmition Unit Size </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 最大Data长度 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Value Of 1 </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 指定了服务端的Endian类型 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Accept Data Length </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Accept Data Offset </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 指向Accept data的指针，一般直接指向结尾（包含TNS头） </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Connect Flag0 </td> 
 <td style="width:60.65pt;"> 1 </td> 
 <td style="width:71.85pt;"> 1 </td> 
 <td style="width:91.4pt;"> 标志位 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Connect Flag1 </td> 
 <td style="width:60.65pt;"> 1 </td> 
 <td style="width:71.85pt;"> 1 </td> 
 <td style="width:91.4pt;"> 标志位 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Unknown </td> 
 <td style="width:60.65pt;"> 8 or 17 </td> 
 <td style="width:71.85pt;"> 8 or 17 </td> 
 <td style="width:91.4pt;"> 未知，一般前8字节为0 </td> 
 </tr> 
 </tbody> 
</table>

**Service Option****:**

..0. .... .... .... = Broken Connect Notify

...0 .... .... .... = Packet Checksum

.... 0... .... .... = Header Checksum

.... .0.. .... .... = Full Duplex

.... ..0. .... .... = Half Duplex

.... ...0 .... .... = Don't Care

.... .... 0... .... = Don't Care

.... .... ...0 .... = Direct IO to Transpor

.... .... .... 0... = Attention Processing

.... .... .... .0.. = Can Receive Attention

.... .... .... ..0. = Can Send Attention

**Connect Flag0 and flag1**

...0 .... = NA services required

.... 0... = NA services linked in

.... .0.. = NA services enabled

.... ..0. = Interchange is involved

.... ...0 = NA services wanted

## **Accept包示例** ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70][]

## **代码示例** ##

从此包中解析TNS version

--02 get tns version
            if(data:byte(3)==2) then
                tnsVersion=string.unpack(">I2",data:sub(7))
                print("tnsVersion:"..tnsVersion)
            end

# **获取连接字符串及客户端信息** #

通过解析包Connect包可以获得连接字符串，进而获取客户端的详细信息，包含客户端程序，当前用户，windows版本等。

## Connect包格式 ##

<table> 
 <tbody> 
 <tr> 
 <td style="width:130.8pt;"> &nbsp; </td> 
 <td style="width:60.65pt;"> 32bit </td> 
 <td style="width:71.85pt;"> 64bit </td> 
 <td style="width:91.4pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Version </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 版本号 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Compatible Version </td> 
 <td style="width:60.65pt;">2</td> 
 <td style="width:71.85pt;">2</td> 
 <td style="width:91.4pt;">兼容最低版本</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Service Options </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> Bit标志选项 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Session Data Unit Size </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 一个DataUnit最多多大，在传输超长包时，Data 包会被拆解成如此大小的包 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;">Max Transmition Unit Size</td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 最大Data长度 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> NT Protocol Characteristics </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 网络参数 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Line Turn Around Value </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Value 1 </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 指定了本地的Endian类型 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Length of Connect Data </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 连接字符串长度 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Offset of Connect Data </td> 
 <td style="width:60.65pt;"> 2 </td> 
 <td style="width:71.85pt;"> 2 </td> 
 <td style="width:91.4pt;"> 连接字符串从TNS头算的偏移量 </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Max Receivable Connect Data </td> 
 <td style="width:60.65pt;"> 4 </td> 
 <td style="width:71.85pt;"> 4 </td> 
 <td style="width:91.4pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Connection Flag0 </td> 
 <td style="width:60.65pt;">1</td> 
 <td style="width:71.85pt;">1</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Connection Flag1 </td> 
 <td style="width:60.65pt;">1</td> 
 <td style="width:71.85pt;">1</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Trace Across Facility item1 </td> 
 <td style="width:60.65pt;">4</td> 
 <td style="width:71.85pt;">4</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;">Trace Across Facility item2</td> 
 <td style="width:60.65pt;">4</td> 
 <td style="width:71.85pt;">4</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> Trace Unique Connection ID </td> 
 <td style="width:60.65pt;">8</td> 
 <td style="width:71.85pt;">8</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 <tr> 
 <td style="width:130.8pt;"> unknown </td> 
 <td style="width:60.65pt;">8 or 20</td> 
 <td style="width:71.85pt;">8 or 20</td> 
 <td style="width:91.4pt;">&nbsp;</td> 
 </tr> 
 </tbody> 
</table>

Service Options,Connection Flag 同Accept

NT Protocol Characteristics:  
0... .... .... .... = Hangon to listener connect  
.0.. .... .... .... = Confirmed release  
..0. .... .... .... = TDU based IO  
...0 .... .... .... = Spawner running  
.... 0... .... .... = Data test  
.... .0.. .... .... = Callback IO supported  
.... ..0. .... .... = ASync IO Supported  
.... ...0 .... .... = Packet oriented IO  
.... .... 0... .... = Can grant connection to another  
.... .... .0.. .... = Can handoff connection to another  
.... .... ..0. .... = Generate SIGIO signal  
.... .... ...0 .... = Generate SIGPIPE signal  
.... .... .... 0... = Generate SIGURG signal  
.... .... .... .0.. = Urgent IO supported  
.... .... .... ..0. = Full duplex IO supported  
.... .... .... ...0 = Test operation

## 包示例 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 1][]

## 示例代码 ##

获取TNS版本及连接字符串

if(data:byte(3)==1) then
                tnsVersion=string.unpack(">I2",data,7)
                print("requestTnsVersion:"..tnsVersion)
                
                local connectDataLength=string.unpack(">I2",data,23)
                local connectDataOffset=string.unpack(">I2",data,25)
                
                print("connect string:"..string.unpack("c"..connectDataLength,data,connectDataOffset-2))
            end

# **网络参数交换（deadbeef）Secure Network Service** #

通过解析包 Data Network Service 包可以获得网络相关参数比如servie version，其意义暂不明确，注意此包是data包，下面示例数据没有带data包头

## 包解析示例 ##

![20200510104332588.png][]

# **获取验证参数** #

通过解析包dataid 03 callid 73可以获得用户名，密码hash等很多信息

## 包格式 ##

<table> 
 <tbody> 
 <tr> 
 <td style="width:156.45pt;"> &nbsp; </td> 
 <td style="width:72.5pt;"> 32bit </td> 
 <td style="width:72.5pt;"> 64bit </td> 
 <td style="width:53.25pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:156.45pt;"> 序列号 </td> 
 <td style="width:72.5pt;"> 1 </td> 
 <td style="width:72.5pt;"> 1 </td> 
 <td style="width:53.25pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:156.45pt;"> 可变字节 </td> 
 <td style="width:72.5pt;"> 16 or 20 </td> 
 <td style="width:72.5pt;"> 44 or 48 </td> 
 <td style="width:53.25pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:156.45pt;"> 用户名长度 </td> 
 <td style="width:72.5pt;"> 1 </td> 
 <td style="width:72.5pt;"> 1 </td> 
 <td style="width:53.25pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:156.45pt;"> 用户名 </td> 
 <td style="width:72.5pt;"> 上字节决定 </td> 
 <td style="width:72.5pt;"> 上字节决定 </td> 
 <td style="width:53.25pt;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:156.45pt;"> Keyvalue pairs </td> 
 <td style="width:72.5pt;"> 变长 </td> 
 <td style="width:72.5pt;"> 变长 </td> 
 <td style="width:53.25pt;"> sessionkey及密码等数据 </td> 
 </tr> 
 </tbody> 
</table>

**可变头**

注意到使用不同客户端连接不同数据库，数据包到用户名这里的偏移量不同（可能原因，oracle版本，不同的客户端）

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:126.9pt;"> Sqlplus11 to&nbsp;oracle12c </td> 
 <td style="vertical-align:top;width:126.9pt;"> Navicat to oracle11&nbsp; &nbsp; </td> 
 <td style="vertical-align:top;width:126.9pt;"> 32位Navicat </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:126.9pt;"> fe ff ff ff ff ff ff ff 18 00 00 00 01 01 00 00 fe ff ff ff ff ff ff ff 12 00 00 00 00 00 00 00 fe ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff </td> 
 <td style="vertical-align:top;width:126.9pt;"> fe ff ff ff ff ff ff&nbsp;ff 0f 00 00 00 01 01 00 00 fe ff ff ff ff ff ff ff 12 00 00 00 fe ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff &nbsp; </td> 
 <td style="vertical-align:top;width:126.9pt;"> 01 0f 00 00 00 01 01 00 00 01 13&nbsp;00 00 00 01 01 </td> 
 </tr> 
 </tbody> 
</table>

一个在序号后有44个字节，一个48个字节，具体处理可以先跳过44个字节看是否ff，如果是跳到48个字节

32位情况类似，只是将feMagic变为01，所以也有两种情况16或20个字节

**Keyvalue对**

对灰色头部以下内容除直接跟的用户名外，全部以keyvalue形式存在。

Key和value间存在固定4字节未知字段，keyvalue对之间存在8字节未知字段。

Key和value均以长度开头，长度fe表示变长，fe后续一个字节的长度byte并以00结尾如sessionid的值。

下面以上面的包为例进行解析：

<table> 
 <tbody> 
 <tr> 
 <td style="width:91.9pt;"> 用户名：scott </td> 
 <td style="width:277.6pt;"> 0863232373636f7474 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 4字节未知字段 </td> 
 <td style="width:277.6pt;"> 24000000 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> AUTH_SESSKEY </td> 
 <td style="width:277.6pt;"> 0c415554485f534553534b4559 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 4字节未知字段 </td> 
 <td style="width:277.6pt;"> 20010000 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> value </td> 
 <td style="width:277.6pt;"> fe403346334137413241324636443935363537434643383241304439314141383033354334334532413932313746424334384437313935343137323638374442414120423145303544373245443630413239333636454331334131444232423941303500 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 8字节未知字段 </td> 
 <td style="width:277.6pt;"> 100000027000000 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> AUTH_PASSWORD </td> 
 <td style="width:277.6pt;"> 0d415554485f50415353574f5244 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 4字节未知字段 </td> 
 <td style="width:277.6pt;"> c0000000 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> value </td> 
 <td style="width:277.6pt;"> 4042353343343732314336334342323537334244423535383936364541364630363844353834423034364134313945373146463430444444363537464343343742 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> ... </td> 
 <td style="width:277.6pt;"> ... </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> ... </td> 
 <td style="width:277.6pt;"> ... </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> ... </td> 
 <td style="width:277.6pt;"> ... </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 8字节未知字段 </td> 
 <td style="width:277.6pt;"> 0000000030000000 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> AUTH_FAILOVER_ID </td> 
 <td style="width:277.6pt;"> 10415554485f4641494c4f5645525f4944 </td> 
 </tr> 
 <tr> 
 <td style="width:91.9pt;"> 8字节未知字段 </td> 
 <td style="width:277.6pt;"> 0000000000000000 </td> 
 </tr> 
 </tbody> 
</table>

## **包示例** ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 2][]

## 代码示例 ##

获取用户名

--060307 get username
            if(data:byte(3)==6 and data:byte(9)==3 and data:byte(10)==0x73) then
                local userNamePos
                --test client 32bit or 64bit
                if(data:byte(12)~=0xfe)then
                    is64Bit=false 
                end
                if(is64Bit) then print("64bit:true") else print("64bit:false") end
                if(is64Bit) then
                    if(data:byte(9+2+1+43)==0xff)then userNamePos=9+2+1+44 end
                    if(data:byte(9+2+1+47)==0xff)then userNamePos=9+2+1+48 end
                else
                    if(data:byte(9+2+1+15)==0xff)then userNamePos=9+2+1+16 end
                    if(data:byte(9+2+1+21)==0xff)then userNamePos=9+2+1+20 end
                end
                if(userNamePos) then
                    local username=string.unpack("s1",data,userNamePos)
                    print("username:"..username)
                    ngx.ctx.username=username
                end
            end

# **获取Oracle版本号** #

在连接完成之后，客户端会发起data 116b包，内部后续一个data DB Version（033b）请求，ThinClient 下会直接发起data 033b，请求oracle版本，版本号以data 08包形式返回，解析其返回包可以获得Oracle版本号。注意返回的data 08 包不止在这里使用，很多命令的返回都使用此包，此种包有这样几种形式，

08后直接后续字段：如版本号包

08后后续返回字段数，再接续字段：比如认证结果返回

获取版本包格式如下

<table> 
 <tbody> 
 <tr> 
 <td style="width:134px;"> &nbsp; </td> 
 <td style="width:144px;"> 32bit </td> 
 <td style="width:148px;"> 64bit </td> 
 <td style="width:458px;"> &nbsp; </td> 
 </tr> 
 <tr> 
 <td style="width:134px;"> unused </td> 
 <td style="width:144px;"> 2 </td> 
 <td style="width:148px;"> 2 </td> 
 <td style="width:458px;"> ThinDriver 此处为1 </td> 
 </tr> 
 <tr> 
 <td style="width:134px;"> Banner Length </td> 
 <td style="width:144px;"> 1 </td> 
 <td style="width:148px;"> 1 </td> 
 <td style="width:458px;"> 版本字符串长度 </td> 
 </tr> 
 <tr> 
 <td style="width:134px;"> Banner </td> 
 <td style="width:144px;"> 上字节决定 </td> 
 <td style="width:148px;"> 上字节决定 </td> 
 <td style="width:458px;"> Oracle版本字符串 </td> 
 </tr> 
 <tr> 
 <td style="width:134px;"> 版本号 </td> 
 <td style="width:144px;"> 4 </td> 
 <td style="width:148px;"> 4 </td> 
 <td style="width:458px;"> 版本int表示，little endian，minor版本号和build号分别用第二个字节的高低4bit表示 </td> 
 </tr> 
 <tr> 
 <td style="width:134px;">变长结尾</td> 
 <td style="width:144px;">变长</td> 
 <td style="width:148px;">变长</td> 
 <td style="width:458px;">可能是1702包也可能是0901包，内容不详</td> 
 </tr> 
 </tbody> 
</table>

## **包示例** ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 3][]

### **代码示例** ###

--06033b oracle version request
    if(data:byte(3)==6 and data:byte(9)==3 and data:byte(10)==0x3b) then
        cHeaderPos=9
    end
            
    --start to process db version request
    if(cHeaderPos>1 and data:byte(cHeaderPos)==3 and data:byte(cHeaderPos+1)==0x3b) then
        requestOracleVersion=true
    end
    
    --06089a get oracle version
    if(data:byte(3)==6 and requestOracleVersion) then
        local versionString,p=string.unpack("s1",data,12)
        print("oracleVersion:"..versionString)
        local minor        
    oracleVersion.fix,oracleVersion.subbuild,minor,oracleVersion.major=string.unpack("BBBB",data,p)
        oracleVersion.minor=minor/16
        oracleVersion.build=minor%16           print(oracleVersion.major..'.'..oracleVersion.minor..'.'..oracleVersion.build..'.'..oracleVersion.subbuild..'.'..oracleVersion.fix)
        requestOracleVersion=false
    end

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70]: /images/20230312/fb3aaf38539d40b9aa746013b0617167.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 1]: /images/20230312/0cd887a4eb5d4dac9e482f68a7759a53.png
[20200510104332588.png]: /images/20230312/6d191c771c2c45508bea9969ca72c710.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 2]: /images/20230312/c623b8b12f57477998626ff115275b7e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lpemh1MjAwMA_size_16_color_FFFFFF_t_70 3]: /images/20230312/74570d6786a94c6f82c8116820c41b47.png