)]}'
{
  "commit": "bbb6477be3e05c5027dca5f8fcba22c74559383a",
  "tree": "2619ecf8b094ef5f26bce36179f8bc5e08774587",
  "parents": [
    "241c36a6a2bafc25e68aa0cd8e4dc0b6daa3d491"
  ],
  "author": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Wed Jun 17 15:13:34 2026 +0100"
  },
  "committer": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Wed Jun 17 16:35:22 2026 +0100"
  },
  "message": "[tls] Accept only explicitly supported FFDHE groups\n\nWe do not currently perform any validation on the DHE field prime or\ngenerator.  RFC 7919 defines a family of known-safe finite fields, and\nTLS version 1.3 completely removes the ability to provide an explicit\nfield prime and generator.\n\nVerify that the field prime and generator correspond to one of the\nexplicitly configured groups.\n\nThis may break connections to the (now very rare) TLS servers that use\ncustom FFDHE groups and that choose to use DHE rather than ECDHE (or\nthat do not support ECDHE).  We already advertise ECDHE cipher suites\nas preferred over DHE cipher suites, and advertise all ECDHE groups as\npreferred over all FFDHE groups.  It is therefore very unlikely that\nthis change will cause any issues in practice.\n\nSigned-off-by: Michael Brown \u003cmcb30@ipxe.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "41d50287e911a0953d80d9ace682d18e3bc5f387",
      "old_mode": 33188,
      "old_path": "src/net/tls.c",
      "new_id": "bd4b14b6a519898961bfa97ee4ee2b5b783905b6",
      "new_mode": 33188,
      "new_path": "src/net/tls.c"
    }
  ]
}