Is there a way to initialise a client using a file descriptor or an XPC connection?

[jvimal-eg]

What are you trying to achieve?

There are 3 ways to start a grpc client today: host and port, socket address, and unix domain socket path. Is there a way to start one using a file descriptor?

My use case is that I have a server and client running in two different sandboxes. For some reason, I am unable to share a unix domain socket across the two, and I've resorted to using a TCP socket, which is insecure as any process can connect to it.

Ideally, it would be great if grpc client can work over an XPC connection, which offers stronger authentication between client/server using codesign certificates. Alternatively, I could have the server pass a file descriptor to an authenticated client over XPC and use that file descriptor to start the client.

What have you tried so far?

I tried looking at the source code to see how else I can create connections.

[Lukasa]

grpc-over-xpc is unlikely to be a good design pattern: XPC is not really built for bulk data transfer in this way. Passing an FD over XPC and using that would be better, and grpc could absolutely support that as a design pattern, but I'll defer to @glbrntt as to whether that exists today.

[jvimal-eg]

@Lukasa that's great, thank you. I remember reading in Apple dev forums that XPC is pretty fast, even faster than unix domain sockets: https://developer.apple.com/forums/thread/74498. I have't benchmarked it myself, so I'll defer it to the experts.

@glbrntt is there a way to use the grpc-swift library to achieve it today without an additional implementation?

[glbrntt]

There's no API in grpc to do this at the moment, but NIO provides a withConnectedSocket(_:) which we should be able to just wire through the grpc API.

We'd need:

• A new entry on ConnectionTarget
• New API on the ClientConnection builder here (the channel pool uses ConnectionTarget directly so does not need new API)
• Some validation that we're not trying to use this API with a NIOTSEventLoopGroup or NIOTSEventLoop (as far as I can tell, using a file descriptor directly is not possible with Network.framework)
• Tests

Ideally we would give the server the same treatment.

[wwang71119]

hmm, seems to me it is overkill, I think GRPC has it's own authentication. see: https://grpc.io/docs/guides/auth/

[jvimal-eg]

@glbrntt Sorry for the delay. I have this implemented in a branch that builds fine, but I am having difficulty writing a unit test that uses the withConnectedSocket(_:) API for a unix domain socket. I looked at existing unit tests, and I couldn't find an example that uses a real unix domain socket. Would you be able to help me flush that out?

Would EchoTestClientTests.testGetWithRealClientAndServer be a good candidate to test this out?

[glbrntt]

Resolved by #1385