[grpc-io] Re: Why SSL renegotiation isn't allowed in gRPC C/C++ stack ?

2023-10-04 Thread 'Gregory Cooke' via grpc.io
Hello, SSL renegotiation represents a large attack surface, and historically has caused security issues. Because of this we just haven't seen much interest in it's use, so it hasn't been high up on the feature list to support. We definitely wouldn't want it to be default-on, but I don't see a

[grpc-io] Re: How to find boringSSL version in grpcio 1.21.1 ?

2023-10-04 Thread 'Luwei Ge' via grpc.io
gRPC-python wraps gRPC-Core as they are in the same repo. So if you go to the specific git tag, e.g. https://github.com/grpc/grpc/tree/v1.58.0/third_party, you can find the commit of the BorgingSSL dependency (boringssl-with-bazel ...). In this case of 1.58.0, it's