Documentation
¶
Overview ¶
Package grpcdecode decodes gRPC Length-Prefixed Messages per the gRPC wire-protocol specification. gRPC uses HTTP/2 as its transport; this package focuses on the gRPC-specific framing layer that sits inside HTTP/2 DATA frames.
gRPC Length-Prefixed Message format (5-byte header) ¶
- compressed_flag (1 byte) : 0 = not compressed, 1 = compressed
- message_length (4 BE) : byte count of the following payload
- message_bytes[message_length]: serialized protobuf (not decoded)
gRPC runs over HTTP/2 on TCP/443 (TLS, most cloud services), TCP/80 (cleartext h2c, internal microservice meshes), and TCP/50051 (canonical insecure dev default). gRPC-Web (HTTP/1.1 variant) is sometimes exposed publicly on TCP/8080 / TCP/443 without authentication.
Security relevance
- Default gRPC has NO authentication (insecure.NewCredentials()). Many internal microservice meshes run without TLS or auth.
- gRPC reflection service (grpc.reflection.v1alpha) exposes the full service/method schema when enabled — canonical pentest recon.
- Method paths (/package.Service/Method) leak internal API structure as cleartext HTTP/2 headers.
- Protobuf messages are binary but NOT encrypted — field values are visible if the .proto schema is known; field numbers + wire types are always visible without the schema.
- gRPC status codes (grpc-status trailer) distinguish OK from authentication / authorization failures.
Protobuf wire format (best-effort surface scan) ¶
Each field tag is a varint: (field_number << 3) | wire_type. Wire types: 0=varint, 1=64-bit, 2=length-delimited, 5=32-bit. This package walks the first few fields and counts them; it does NOT recursively decode nested messages or extract field values.
gRPC status codes ¶
0=OK, 1=CANCELLED, 2=UNKNOWN, 3=INVALID_ARGUMENT, 4=DEADLINE_EXCEEDED, 5=NOT_FOUND, 6=ALREADY_EXISTS, 7=PERMISSION_DENIED, 8=RESOURCE_EXHAUSTED, 9=FAILED_PRECONDITION, 10=ABORTED, 11=OUT_OF_RANGE, 12=UNIMPLEMENTED, 13=INTERNAL, 14=UNAVAILABLE, 15=DATA_LOSS, 16=UNAUTHENTICATED.
What this package covers
- gRPC Length-Prefixed Message 5-byte header detection
- compressed_flag + message_length extraction
- Best-effort protobuf field count + first field numbers/wire types
- Multiple concatenated messages (streaming gRPC)
- total_bytes
What this package does NOT cover (deliberately out of scope)
- HTTP/2 frame parsing (use internal/http2)
- HPACK header decompression (use internal/hpack)
- Full protobuf value decoding (use the protobuf_decode tool)
- gzip/deflate decompression of compressed messages
- gRPC-Web envelope (different framing byte)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GRPCStatusName ¶
GRPCStatusName returns the canonical gRPC status code name for code c.
Types ¶
type Message ¶
type Message struct {
Compressed bool `json:"compressed"`
MessageLength int `json:"message_length"`
ProtobufFieldCount int `json:"protobuf_field_count"`
ProtobufFields []ProtoField `json:"protobuf_fields,omitempty"`
}
Message is the decode of a single gRPC Length-Prefixed Message.
type ProtoField ¶
type ProtoField struct {
FieldNumber int `json:"field_number"`
WireType int `json:"wire_type"`
WireTypeName string `json:"wire_type_name"`
}
ProtoField is a single best-effort protobuf field tag decoded from the message payload.
Source Files