VQL: Adding a grpc function

[c-f]

Idea

Some container runtimes, such as containerd or CRI-O expose a UNIX socket, but only communicate via grpc.

A new grpc function inside VQL would allow communicating with grpc services without using external tooling.

Protobuf

It is necessary to define pb files for parsing requests and responses i was wondering what's your opinion how to implement this.

If you find this idea useful then i can try to create a PR for this.

[scudette]

It is not really possible because protobuf files need to be compiled into structured data so we can call grpc - i dont think we can use generic json dicts since everything needs to conform with the grpc schema.

Its basically the same problem as calling a compiled interface like grpc from an interpreted language like python - we need to compile the proto files into something that can be encoded on the wire as binary protobuf wire format.

[c-f]

Thanks for the very quick response.

Indeed the protobuf schema is required.

But velo supports js functions already - it would be possible to compile the request/response in a similar way (as well as processing the output).

Something similar to:

// https://docs.velociraptor.app/vql_reference/experimental/js
LET _ <= js(js='''
    function convert_request(){
        // do some protobuf stuff 
        return [bts]
     }
     
     function parse_response(res){
        // do some protobuf convert
       // 
       return {}
     }
''') 

// TODO provide pb files (e.g. as an argument from the artifact)
// https://docs.velociraptor.app/vql_reference/experimental/js_set
LET _ <= js_set(var='pb_definition', value='')


// e.g js_call(func='convert_request') 
SELECT * from grpc_client(url="",req='convert_request', res='parse_response')