oracle - ORA-24247: 发送电子邮件 oracle 时网络访问被访问控制列表 (ACL) 拒绝

Question

我已经完成了下面提到的所有事件，请告诉我缺少哪一步/事件。

BEGIN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL(
                                    acl         => 'apex_user.xml',
                                    description => 'access to apex email',
                                    principal   => 'DBUSER',
                                    is_grant    => TRUE,
                                    privilege   => 'connect',
                                    start_date  => SYSTIMESTAMP,
                                    end_date    =>Null
                                    );
 COMMIT;
 END; 
  BEGIN
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
                                        acl       => 'apex_user.xml',
                                       principal => 'DBUSER',
                                       is_grant  => true,
                                       privilege => 'resolve'
                                       );

 COMMIT;
 END;

   BEGIN
  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL(
                                    acl         => 'apex_user.xml',
                                    host        => 'smtp.gmail.com',
                                    lower_port  =>587,
                                    upper_port  =>587
                                    );
COMMIT;
 END;

为了确保用户可以访问 smtp 包，请以 SYS 身份运行

GRANT EXECUTE ON UTL_TCP  TO DBUSER;
GRANT EXECUTE ON UTL_SMTP TO DBUSER;
GRANT EXECUTE ON UTL_MAIL TO DBUSER;
GRANT EXECUTE ON UTL_http TO DBUSER;

启用UTL_MAIL

alter system set smtp_out_server = 'smtp.gmail.com:587' scope = both;

一旦我从[email protected]开始在Oracle中执行以下查询Google 帐户中的应用程序安全性较低

begin
  utl_mail.send(
  sender     => '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="4f29263c3b212e222a61232e3c3b212e222a0f28222e2623612c2022" rel="noreferrer noopener nofollow">[email protected]</a>',
  recipients => '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a7c1ced4d3c9c6cac289cbc6d4d3c9c6cac2e7c0cac6cecb89c4c8ca" rel="noreferrer noopener nofollow">[email protected]</a>',
  message    => 'Hello World'
   );
end;

Error report - ORA-29279: SMTP permanent error: 530 5.7.0 Must issue a STARTTLS command first

并在从 apex 调用时给出错误

APEX_MAIL.SEND( 
    p_to => '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d9bfb0aaadb7b8b4bcf7b5b8aaadb7b8b4bc99beb4b8b0b5f7bab6b4" rel="noreferrer noopener nofollow">[email protected]</a>', 
    p_from => '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="23454a50574d424e460d4f4250574d424e4663444e424a4f0d404c4e" rel="noreferrer noopener nofollow">[email protected]</a>', 
    p_subj => 'APEX_MAIL with attachment', 
    p_body => 'Please review the attachment.', 
    p_body_html => '<b>Please</b> review the attachment');

ORA-24247: network access denied by access control list (ACL)

但是我尝试使用 utl_smtp 并再次出现相同的错误

create or replace PROCEDURE send_email(p_to        IN VARCHAR2,
                                       p_from      IN VARCHAR2,
                                       p_message   IN VARCHAR2,
                                       p_smtp_host IN VARCHAR2,
                                       p_smtp_port IN NUMBER DEFAULT 587)
AS
  l_mail_conn   UTL_SMTP.connection;
BEGIN
  l_mail_conn := UTL_SMTP.open_connection(p_smtp_host, p_smtp_port);
  UTL_SMTP.helo(l_mail_conn, p_smtp_host);
  UTL_SMTP.mail(l_mail_conn, p_from);
  UTL_SMTP.rcpt(l_mail_conn, p_to);
  UTL_SMTP.data(l_mail_conn, p_message  || UTL_TCP.crlf || UTL_TCP.crlf);
  UTL_SMTP.quit(l_mail_conn);
END;

ORA-29279: SMTP permanent error: 530 5.7.0 Must issue a STARTTLS command first. c13sm6735648wrb.38 - gsmtp

请告知哪个命令或任何遗漏的内容..

Answer 1

您不需要任何提交，因为这些操作不会执行显式 DML 操作。并且每个方法调用都不需要使用 begin..end block 。

您的问题源于以下事实:还需要使用 privilege => 'connect' 选项调用 Dbms_Network_Acl_Admin.Add_Privilege 方法。所以你可以使用以下内容:

BEGIN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL(
                                    acl         => 'apex_user.xml',
                                    description => 'access to apex email',
                                    principal   => 'DBUSER',
                                    is_grant    => TRUE,
                                    privilege   => 'connect',
                                    start_date  => SYSTIMESTAMP,
                                    end_date    =>Null
                                    );
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
                                       acl       => 'apex_user.xml',
                                       principal => 'DBUSER',
                                       is_grant  => true,
                                       privilege => 'connect'
                                       );

  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
                                       acl       => 'apex_user.xml',
                                       principal => 'DBUSER',
                                       is_grant  => true,
                                       privilege => 'resolve'
                                       );


  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL(
                                    acl         => 'apex_user.xml',
                                    host        => 'smtp.gmail.com',
                                    lower_port  =>587,
                                    upper_port  =>587
                                    );
 END;

通过以下查询，可以检查所有特权访问(通过 SYS 或 SYSTEM 架构):

select a.host,p.*
  from dba_network_acl_privileges p
  join dba_network_acls a on a.aclid = p.aclid
 order by a.host, p.principal, p.privilege;