Fwd: [oracle/ktls-utils] tlshd/handshake: handle the UNKNOWN_PSK_IDENTITY alert (PR #149)

Another pull request that needs some review. Hannes, can you have a look?

----- Original message -----
From: Wilfred Mallawa <[email protected]>
To: oracle/ktls-utils <[email protected]>
Cc: Subscribed <[email protected]>
Subject: [oracle/ktls-utils] tlshd/handshake: handle the UNKNOWN_PSK_IDENTITY alert (PR #149)
Date: Sunday, May 10, 2026 9:11 PM

During TLS handshake, an endpoint may issue an UNKNOWN_PSK_IDENTITY alert if it does not recognize the PSK identifier. For example, when using NVMe TCP in-band authentication with secure concatenation, if the target resets; the host kernel attempts to reconnect using a stale PSK, which the re-initialized target no longer recognizes.

Map this specific TLS alert to EKEYREJECTED. This allows the kernel to identify that the failure is due to stale credentials, trigger key revocation, and proceed with fresh in-band authentication on the next reconnection attempt.
You can view, comment on, or merge this pull request online at:

  https://github.com/oracle/ktls-utils/pull/149

-- Commit Summary --

  * tlshd/handshake: handle the UNKNOWN_PSK_IDENTITY alert

-- File Changes --

    M src/tlshd/handshake.c (4)

-- Patch Links --

https://github.com/oracle/ktls-utils/pull/149.patchhttps://github.com/oracle/ktls-utils/pull/149.diff
-- 
Reply to this email directly or view it on GitHub:
https://github.com/oracle/ktls-utils/pull/149
You are receiving this because you are subscribed to this thread.

Message ID: &lt;oracle/ktls-utils/pull/[email protected]&gt;


-- 
Chuck Lever