Merge c1b9f7f5e8 into 4a49d67adc

Makefile

@@ -50,7 +50,7 @@ IMAGE = $(REGISTRY)/$(IMGNAME)
 MULTI_ARCH_IMG = $(IMAGE)-$(ARCH)
 
 # Set default base image dynamically for each arch
-BASEIMAGE?=quay.io/kubernetes-ingress-controller/nginx-$(ARCH):0.34
+BASEIMAGE?=quay.io/kubernetes-ingress-controller/nginx-$(ARCH):0.35
 
 ifeq ($(ARCH),arm)
 	QEMUARCH=arm

cmd/nginx/flags.go

@@ -131,6 +131,8 @@ func parseFlags() (bool, *controller.Configuration, error) {
 		publishStatusAddress = flags.String("publish-status-address", "",
 			`User customized address to be set in the status of ingress resources. The controller will set the
 		endpoint records on the ingress using this address.`)
+
+		dynamicReload = flags.Bool("dynamic-reload", false, `Enable dynamic reloads`)
 	)
 
 	flag.Set("logtostderr", "true")
@@ -222,6 +224,7 @@ func parseFlags() (bool, *controller.Configuration, error) {
 			SSLProxy: *sslProxyPort,
 			Status:   *statusPort,
 		},
+		DynamicReload: *dynamicReload,
 	}
 
 	return false, config, nil

cmd/nginx/main.go

@@ -117,6 +117,12 @@ func main() {
 		glog.Fatalf("resync period (%vs) is too low", conf.ResyncPeriod.Seconds())
 	}
 
+	if conf.DynamicReload {
+		glog.Infof("Dynamic Reload ENABLED")
+	} else {
+		glog.Infof("Dynamic Reload DISABLED")
+	}
+
 	// create the default SSL certificate (dummy)
 	defCert, defKey := ssl.GetFakeSSLCert()
 	c, err := ssl.AddOrUpdateCertAndKey(fakeCertificate, defCert, defKey, []byte{}, fs)

docs/user-guide/cli-arguments.md

@@ -60,4 +60,5 @@ Usage of :
       --version                           Shows release information about the NGINX Ingress controller
       --vmodule moduleSpec                comma-separated list of pattern=N settings for file-filtered logging
       --watch-namespace string            Namespace to watch for Ingress. Default is to watch all namespaces
+      --dynamic-reload                    Defines if NGINX should add/remove virtualhosts without the classic reload (default false)
 ```

internal/ingress/controller/config/config.go

@@ -616,6 +616,7 @@ type TemplateConfig struct {
 	RedirectServers         map[string]string
 	ListenPorts             *ListenPorts
 	PublishService          *apiv1.Service
+	DynamicReload           bool
 }
 
 // ListenPorts describe the ports required to run the

internal/ingress/controller/controller.go

@@ -95,6 +95,8 @@ type Configuration struct {
 	FakeCertificateSHA  string
 
 	SyncRateLimit float32
+
+	DynamicReload bool
 }
 
 // GetPublishService returns the configured service used to set ingress status
@@ -169,7 +171,7 @@ func (n *NGINXController) syncIngress(item interface{}) error {
 		return nil
 	}
 
-	glog.Infof("backend reload required")
+	glog.Infof("backend reload/update required")
 
 	err := n.OnUpdate(pcfg)
 	if err != nil {
@@ -178,7 +180,7 @@ func (n *NGINXController) syncIngress(item interface{}) error {
 		return err
 	}
 
-	glog.Infof("ingress backend successfully reloaded...")
+	glog.Infof("ingress backend successfully reloaded/updated...")
 	incReloadCount()
 	setSSLExpireTime(servers)
 

internal/ingress/controller/nginx.go

@@ -44,6 +44,8 @@ import (
 
 	"path/filepath"
 
+	"net/http"
+
 	"k8s.io/ingress-nginx/internal/file"
 	"k8s.io/ingress-nginx/internal/ingress"
 	"k8s.io/ingress-nginx/internal/ingress/annotations"
@@ -70,10 +72,11 @@ const (
 )
 
 var (
-	tmplPath    = "/etc/nginx/template/nginx.tmpl"
-	geoipPath   = "/etc/nginx/geoip"
-	cfgPath     = "/etc/nginx/nginx.conf"
-	nginxBinary = "/usr/sbin/nginx"
+	tmplPath      = "/etc/nginx/template/nginx.tmpl"
+	geoipPath     = "/etc/nginx/geoip"
+	cfgPath       = "/etc/nginx/nginx.conf"
+	tmpldcfgsPath = "/etc/nginx/template/dcfgs.tmpl"
+	nginxBinary   = "/usr/sbin/nginx"
 )
 
 // NewNGINXController creates a new NGINX Ingress controller.
@@ -181,6 +184,13 @@ Error loading new template : %v
 
 	n.t = ngxTpl
 
+	ngxdcfgsTpl, err := ngx_template.NewTemplate(tmpldcfgsPath, fs)
+	if err != nil {
+		glog.Fatalf("invalid NGINX Dynamic configs template: %v", err)
+	}
+
+	n.td = ngxdcfgsTpl
+
 	// TODO: refactor
 	if _, ok := fs.(filesystem.DefaultFs); !ok {
 		watch.NewDummyFileWatcher(tmplPath, onTemplateChange)
@@ -254,7 +264,8 @@ type NGINXController struct {
 
 	forceReload int32
 
-	t *ngx_template.Template
+	t  *ngx_template.Template
+	td *ngx_template.Template
 
 	binary   string
 	resolver []net.IP
@@ -623,6 +634,7 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error {
 		IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
 		ListenPorts:             n.cfg.ListenPorts,
 		PublishService:          n.GetPublishService(),
+		DynamicReload:           n.cfg.DynamicReload,
 	}
 
 	content, err := n.t.Write(tc)
@@ -663,16 +675,67 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error {
 		}
 	}
 
-	err = ioutil.WriteFile(cfgPath, content, 0644)
-	if err != nil {
-		return err
-	}
+	if n.cfg.DynamicReload {
+		src, _ := ioutil.ReadFile(cfgPath)
+		if !bytes.Equal(src, content) {
+			err = ioutil.WriteFile(cfgPath, content, 0644)
+			if err != nil {
+				return err
+			}
 
-	o, err := exec.Command(n.binary, "-s", "reload", "-c", cfgPath).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("%v\n%v", err, string(o))
-	}
+			o, err := exec.Command(n.binary, "-s", "reload", "-c", cfgPath).CombinedOutput()
+			if err != nil {
+				return fmt.Errorf("%v\n%v", err, string(o))
+			}
+		} else {
+			glog.Infof("NGINX reload not needed, executing live update only\n")
+		}
 
+		content, err = n.td.Write(tc)
+
+		if err != nil {
+			return err
+		}
+
+		retries := 1
+		updateOK := false
+		for retries <= 5 {
+			if !updateOK {
+				if glog.V(2) {
+					glog.Infof("Updating nginx endpoints with\n%v\n", content)
+				}
+				if retries > 1 {
+					glog.Infof("NGINX dynamic update (retrying)\n")
+				}
+				resp, err := http.Post("http://localhost:"+strconv.Itoa(n.cfg.ListenPorts.Status)+"/nginx_update",
+					"application/json", bytes.NewBuffer(content))
+				if err != nil {
+					time.Sleep(1 * time.Second)
+					glog.Infof("NGINX dynamic update not ready\n")
+				} else if resp.StatusCode != 200 {
+					time.Sleep(1 * time.Second)
+					glog.Infof("NGINX dynamic update not ready\n")
+				} else {
+					updateOK = true
+					glog.Infof("NGINX dynamic update OK\n")
+				}
+			}
+			retries++
+		}
+		if !updateOK {
+			return fmt.Errorf("%v\n%v", err, "Unexpected NGINX update error")
+		}
+	} else {
+		err = ioutil.WriteFile(cfgPath, content, 0644)
+		if err != nil {
+			return err
+		}
+
+		o, err := exec.Command(n.binary, "-s", "reload", "-c", cfgPath).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("%v\n%v", err, string(o))
+		}
+	}
 	return nil
 }
 

rootfs/Dockerfile

@@ -28,6 +28,9 @@ RUN mkdir -p /var/log/nginx \
 
 COPY . /
 
+RUN /usr/local/bin/luajit -b /etc/nginx/lua/balancer.lua /etc/nginx/lua/balancer.ljbc \
+  && /usr/local/bin/luajit -b /etc/nginx/lua/update.lua /etc/nginx/lua/update.ljbc
+
 ENTRYPOINT ["/usr/bin/dumb-init"]
 
 CMD ["/nginx-ingress-controller"]

rootfs/etc/nginx/lua/balancer.lua

@@ -0,0 +1,113 @@
+local json = require "json"
+local b = require "ngx.balancer"
+
+local function compare(t, fn)
+    if #t == 0 then return nil, nil end
+    local key, value = 1, t[1]
+    for i = 2, #t do
+        if fn(value, t[i]) then
+            key, value = i, t[i]
+        end
+    end
+    return key, value
+end
+
+local http_host = ngx.var.http_host
+local remote_addr = ngx.var.remote_addr
+local proxy_upstream_name = ngx.var.proxy_upstream_name
+local shared_memory = ngx.shared.shared_memory;
+local cfgs_json = shared_memory:get("CFGS")
+if cfgs_json == nil then
+    ngx.status = 503
+    ngx.exit(ngx.status)
+end
+local cfgs = json.decode(cfgs_json)
+local loadbalancealgorithm = cfgs.cfg.loadbalancealgorithm
+local backend = cfgs.backends[proxy_upstream_name]
+if backend == nil then
+    ngx.status = 503
+    ngx.exit(ngx.status)
+end
+local selected_endpoint
+if backend.sessionaffinity.affinitytype == "cookie" then
+    local backend_cookie_name = backend.sessionaffinity.cookiesessionaffinity.name
+    local backend_cookie_hash = backend.sessionaffinity.cookiesessionaffinity.hash
+    local var_name = "cookie_SESSION_" .. backend_cookie_name .. backend_cookie_hash
+    
+    local cookie_value = ngx.var[var_name]
+
+    if cookie_value == nil then
+        local endpoints_roundrobin = ngx.shared.endpoints_roundrobin
+        local ep_index = endpoints_roundrobin:get(http_host)
+        if ep_index == nil then
+            selected_endpoint = backend.endpoints[1]
+            endpoints_roundrobin:set(http_host, 1, 600)
+        else
+            local new_index = ep_index + 1
+            if backend.endpoints[new_index] == nil then
+                selected_endpoint = backend.endpoints[1]
+                endpoints_roundrobin:set(http_host, 1, 600)
+            else
+                selected_endpoint = backend.endpoints[new_index]
+                endpoints_roundrobin:set(http_host, new_index, 600)
+            end
+        end
+        ngx.header['Set-Cookie'] = var_name .. '=' .. tostring(ep_index)
+    else
+        selected_endpoint = backend.endpoints[tonumber(cookie_value)]
+    end
+else
+    if loadbalancealgorithm == "" or loadbalancealgorithm == "round_robin" then
+        local endpoints_roundrobin = ngx.shared.endpoints_roundrobin
+        local ep_index = endpoints_roundrobin:get(http_host)
+        if ep_index == nil then
+            selected_endpoint = backend.endpoints[1]
+            endpoints_roundrobin:set(http_host, 1, 600)
+        else
+            local new_index = ep_index + 1
+            if backend.endpoints[new_index] == nil then
+                selected_endpoint = backend.endpoints[1]
+                endpoints_roundrobin:set(http_host, 1, 600)
+            else
+                selected_endpoint = backend.endpoints[new_index]
+                endpoints_roundrobin:set(http_host, new_index, 600)
+            end
+        end
+    elseif loadbalancealgorithm == "ip_hash" or loadbalancealgorithm == "least_conn" then
+        local endpoints_leastconn = ngx.shared.endpoints_leastconn
+        local ep_index = endpoints_leastconn:get(remote_addr)
+        if ep_index == nil then
+            local counter = {}
+            for k, v in pairs(backend.endpoints) do
+                counter[k] = 0
+            end
+            local leastconn_rows = endpoints_leastconn:get_keys(0)
+            for _, v in pairs(leastconn_rows) do
+                counter[v] = counter[v] + 1
+            end
+            local free_endpoint_id, _ = compare(counter, function(a,b) return a > b end)
+            selected_endpoint = backend.endpoints[free_endpoint_id]
+            endpoints_leastconn:set(remote_addr, free_endpoint_id, 600)
+        else
+            selected_endpoint = backend.endpoints[ep_index]
+            endpoints_leastconn:set(remote_addr, ep_index, 600)
+        end
+    else
+        ngx.status = 503
+        ngx.exit(ngx.status)
+    end
+end
+
+local max_retries = 20
+if selected_endpoint.maxfails ~= 0 then
+    max_retries = selected_endpoint.maxfails
+end
+
+assert(b.set_current_peer(selected_endpoint.hostname, selected_endpoint.port))
+if (selected_endpoint.failtimeout ~= 0) then
+    assert(b.set_timeouts(selected_endpoint.failtimeout, selected_endpoint.failtimeout, selected_endpoint.failtimeout))
+end
+if (selected_endpoint.maxfails ~= 0) then
+    assert(b.set_more_tries(selected_endpoint.maxfails))
+end
+ngx.log(ngx.DEBUG, "Using endpoint" .. selected_endpoint.hostname .. ":" .. tostring(selected_endpoint.port) .. " timeout:" .. tostring(selected_endpoint.failtimeout) .. " maxfails:" .. tostring(selected_endpoint.maxfails))

rootfs/etc/nginx/lua/update.lua

@@ -0,0 +1,13 @@
+if ngx.var.request_method == "POST" then
+    ngx.req.read_body()
+    local backends_json = ngx.req.get_body_data()
+    local shared_memory = ngx.shared.shared_memory
+    local success, err, forcible = shared_memory:set("CFGS", backends_json, 0)
+    if ( success ) then
+        ngx.exit(200)
+    end
+    ngx.log(ngx.WARN, "Error initializing CFGS: err=" .. tostring(err), ", forcible=" .. tostring(forcible))
+    ngx.exit(400)
+elseif method == "GET" then
+    ngx.exit(405)
+end

rootfs/etc/nginx/template/dcfgs.tmpl

@@ -0,0 +1,34 @@
+{{ $cfg := .Cfg }}
+{{ $backends := .Backends }}
+
+{
+    "cfg" : {
+        "upstreamkeepaliveconnections" : "{{ $cfg.UpstreamKeepaliveConnections }}",
+        "loadbalancealgorithm" : "{{ $cfg.LoadBalanceAlgorithm }}"
+    },
+    "backends" : {
+        {{ range $index, $upstream := $backends }}
+        {{if $index}},{{ end }}
+        "{{ $upstream.Name }}" : {
+            "sessionaffinity" : {
+                "affinitytype" : "{{ $upstream.SessionAffinity.AffinityType }}",
+                "cookiesessionaffinity" : {
+                    "name" : "{{ $upstream.SessionAffinity.CookieSessionAffinity.Name }}",
+                    "hash" : "{{ $upstream.SessionAffinity.CookieSessionAffinity.Hash }}"
+                }
+            },
+            "endpoints" : [
+                {{ range $index, $endpoint := $upstream.Endpoints }}
+                {{if $index}},{{end}}
+                {
+                    "hostname" : "{{ $endpoint.Address | formatIP }}",
+                    "port" : {{ $endpoint.Port }},
+                    "maxfails" : {{ $endpoint.MaxFails }},
+                    "failtimeout" : {{ $endpoint.FailTimeout }}
+                }
+                {{ end }}
+            ]
+        }
+        {{ end }}
+    }
+}

rootfs/etc/nginx/template/nginx.tmpl

@@ -32,6 +32,13 @@ events {
 }
 
 http {
+    {{ if $all.DynamicReload }}
+    lua_package_path '/usr/local/lib/lua/0.10.12rc2/?.lua;;';
+    lua_shared_dict shared_memory 512m;
+    lua_shared_dict endpoints_roundrobin 512m;
+    lua_shared_dict endpoints_leastconn 512m;
+    {{ end}}
+
     {{/* we use the value of the header X-Forwarded-For to be able to use the geo_ip module */}}
     {{ if $cfg.UseProxyProtocol }}
     real_ip_header      proxy_protocol;
@@ -305,6 +312,7 @@ http {
     {{ end }}
 
     {{ range $name, $upstream := $backends }}
+    {{ if (or (not ($all.DynamicReload)) (eq $upstream.Name "upstream-default-backend")) }}
     {{ if eq $upstream.SessionAffinity.AffinityType "cookie" }}
     upstream sticky-{{ $upstream.Name }} {
         sticky hash={{ $upstream.SessionAffinity.CookieSessionAffinity.Hash }} name={{ $upstream.SessionAffinity.CookieSessionAffinity.Name }}  httponly;
@@ -336,6 +344,20 @@ http {
         {{ end }}
     }
 
+    {{ end }}
+    {{ end }}
+
+    {{ if $all.DynamicReload }}
+
+    ## start server vhosts
+
+    upstream dynamic-upstream {
+        server 0.0.0.1;
+        balancer_by_lua_file /etc/nginx/lua/balancer.ljbc;
+    }
+
+    ## end server vhosts
+
     {{ end }}
 
     {{/* build the maps that will be use to validate the Whitelist */}}
@@ -441,6 +463,18 @@ http {
             return 200;
         }
 
+        {{ if $all.DynamicReload }}
+        location /nginx_update {
+            client_max_body_size 512m;
+            client_body_buffer_size 512m;
+            access_log off;
+            content_by_lua_file /etc/nginx/lua/update.ljbc;
+            limit_except POST {
+                deny all;
+            }
+        }
+        {{ end }}
+
         location /nginx_status {
             set $proxy_upstream_name "internal";
 
@@ -887,6 +921,10 @@ stream {
             proxy_set_header       X-Service-Name     $service_name;
             {{ end }}
 
+            {{ if $all.DynamicReload }}
+            proxy_pass             http://dynamic-upstream;
+            {{ else }}
+
             {{ if not (empty $location.Backend) }}
             {{ buildProxyPass $server.Hostname $all.Backends $location }}
             {{ if (or (eq $location.Proxy.ProxyRedirectFrom "default") (eq $location.Proxy.ProxyRedirectFrom "off")) }}
@@ -898,6 +936,9 @@ stream {
             # No endpoints available for the request
             return 503;
             {{ end }}
+
+            {{ end }}
+
             {{ else }}
             # Location denied. Reason: {{ $location.Denied }}
             return 503;

rootfs/usr/local/share/luajit-2.1.0-beta3/json.lua

@@ -0,0 +1,380 @@
+--
+-- json.lua
+--
+-- Copyright (c) 2015 rxi
+--
+-- This library is free software; you can redistribute it and/or modify it
+-- under the terms of the MIT license. See LICENSE for details.
+--
+
+local json = { _version = "0.1.0" }
+
+-------------------------------------------------------------------------------
+-- Encode
+-------------------------------------------------------------------------------
+
+local encode
+
+local escape_char_map = {
+    [ "\\" ] = "\\\\",
+    [ "\"" ] = "\\\"",
+    [ "\b" ] = "\\b",
+    [ "\f" ] = "\\f",
+    [ "\n" ] = "\\n",
+    [ "\r" ] = "\\r",
+    [ "\t" ] = "\\t",
+}
+
+local escape_char_map_inv = { [ "\\/" ] = "/" }
+for k, v in pairs(escape_char_map) do
+    escape_char_map_inv[v] = k
+end
+
+
+local function escape_char(c)
+    return escape_char_map[c] or string.format("\\u%04x", c:byte())
+end
+
+
+local function encode_nil(val)
+    return "null"
+end
+
+
+local function encode_table(val, stack)
+    local res = {}
+    stack = stack or {}
+
+    -- Circular reference?
+    if stack[val] then error("circular reference") end
+
+    stack[val] = true
+
+    if val[1] ~= nil or next(val) == nil then
+        -- Treat as array -- check keys are valid and it is not sparse
+        local n = 0
+        for k in pairs(val) do
+            if type(k) ~= "number" then
+                error("invalid table: mixed or invalid key types")
+            end
+            n = n + 1
+        end
+        if n ~= #val then
+            error("invalid table: sparse array")
+        end
+        -- Encode
+        for i, v in ipairs(val) do
+            table.insert(res, encode(v, stack))
+        end
+        stack[val] = nil
+        return "[" .. table.concat(res, ",") .. "]"
+
+    else
+        -- Treat as an object
+        for k, v in pairs(val) do
+            if type(k) ~= "string" then
+                error("invalid table: mixed or invalid key types")
+            end
+            table.insert(res, encode(k, stack) .. ":" .. encode(v, stack))
+        end
+        stack[val] = nil
+        return "{" .. table.concat(res, ",") .. "}"
+    end
+end
+
+
+local function encode_string(val)
+    return '"' .. val:gsub('[%z\1-\31\\"]', escape_char) .. '"'
+end
+
+
+local function encode_number(val)
+    -- Check for NaN, -inf and inf
+    if val ~= val or val <= -math.huge or val >= math.huge then
+        error("unexpected number value '" .. tostring(val) .. "'")
+    end
+    return string.format("%.14g", val)
+end
+
+
+local type_func_map = {
+    [ "nil"     ] = encode_nil,
+    [ "table"   ] = encode_table,
+    [ "string"  ] = encode_string,
+    [ "number"  ] = encode_number,
+    [ "boolean" ] = tostring,
+}
+
+
+encode = function(val, stack)
+    local t = type(val)
+    local f = type_func_map[t]
+    if f then
+        return f(val, stack)
+    end
+    error("unexpected type '" .. t .. "'")
+end
+
+
+function json.encode(val)
+    return ( encode(val) )
+end
+
+
+-------------------------------------------------------------------------------
+-- Decode
+-------------------------------------------------------------------------------
+
+local parse
+
+local function create_set(...)
+    local res = {}
+    for i = 1, select("#", ...) do
+        res[ select(i, ...) ] = true
+    end
+    return res
+end
+
+local space_chars   = create_set(" ", "\t", "\r", "\n")
+local delim_chars   = create_set(" ", "\t", "\r", "\n", "]", "}", ",")
+local escape_chars  = create_set("\\", "/", '"', "b", "f", "n", "r", "t", "u")
+local literals      = create_set("true", "false", "null")
+
+local literal_map = {
+    [ "true"  ] = true,
+    [ "false" ] = false,
+    [ "null"  ] = nil,
+}
+
+
+local function next_char(str, idx, set, negate)
+    for i = idx, #str do
+        if set[str:sub(i, i)] ~= negate then
+            return i
+        end
+    end
+    return #str + 1
+end
+
+
+local function decode_error(str, idx, msg)
+    local line_count = 1
+    local col_count = 1
+    for i = 1, idx - 1 do
+        col_count = col_count + 1
+        if str:sub(i, i) == "\n" then
+            line_count = line_count + 1
+            col_count = 1
+        end
+    end
+    error( string.format("%s at line %d col %d", msg, line_count, col_count) )
+end
+
+
+local function codepoint_to_utf8(n)
+    -- http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=iws-appendixa
+    local f = math.floor
+    if n <= 0x7f then
+        return string.char(n)
+    elseif n <= 0x7ff then
+        return string.char(f(n / 64) + 192, n % 64 + 128)
+    elseif n <= 0xffff then
+        return string.char(f(n / 4096) + 224, f(n % 4096 / 64) + 128, n % 64 + 128)
+    elseif n <= 0x10ffff then
+        return string.char(f(n / 262144) + 240, f(n % 262144 / 4096) + 128,
+                f(n % 4096 / 64) + 128, n % 64 + 128)
+    end
+    error( string.format("invalid unicode codepoint '%x'", n) )
+end
+
+
+local function parse_unicode_escape(s)
+    local n1 = tonumber( s:sub(3, 6),  16 )
+    local n2 = tonumber( s:sub(9, 12), 16 )
+    -- Surrogate pair?
+    if n2 then
+        return codepoint_to_utf8((n1 - 0xd800) * 0x400 + (n2 - 0xdc00) + 0x10000)
+    else
+        return codepoint_to_utf8(n1)
+    end
+end
+
+
+local function parse_string(str, i)
+    local has_unicode_escape = false
+    local has_surrogate_escape = false
+    local has_escape = false
+    local last
+    for j = i + 1, #str do
+        local x = str:byte(j)
+
+        if x < 32 then
+            decode_error(str, j, "control character in string")
+        end
+
+        if last == 92 then -- "\\" (escape char)
+            if x == 117 then -- "u" (unicode escape sequence)
+                local hex = str:sub(j + 1, j + 5)
+                if not hex:find("%x%x%x%x") then
+                    decode_error(str, j, "invalid unicode escape in string")
+                end
+                if hex:find("^[dD][89aAbB]") then
+                    has_surrogate_escape = true
+                else
+                    has_unicode_escape = true
+                end
+            else
+                local c = string.char(x)
+                if not escape_chars[c] then
+                    decode_error(str, j, "invalid escape char '" .. c .. "' in string")
+                end
+                has_escape = true
+            end
+            last = nil
+
+        elseif x == 34 then -- '"' (end of string)
+            local s = str:sub(i + 1, j - 1)
+            if has_surrogate_escape then
+                s = s:gsub("\\u[dD][89aAbB]..\\u....", parse_unicode_escape)
+            end
+            if has_unicode_escape then
+                s = s:gsub("\\u....", parse_unicode_escape)
+            end
+            if has_escape then
+                s = s:gsub("\\.", escape_char_map_inv)
+            end
+            return s, j + 1
+
+        else
+            last = x
+        end
+    end
+    decode_error(str, i, "expected closing quote for string")
+end
+
+
+local function parse_number(str, i)
+    local x = next_char(str, i, delim_chars)
+    local s = str:sub(i, x - 1)
+    local n = tonumber(s)
+    if not n then
+        decode_error(str, i, "invalid number '" .. s .. "'")
+    end
+    return n, x
+end
+
+
+local function parse_literal(str, i)
+    local x = next_char(str, i, delim_chars)
+    local word = str:sub(i, x - 1)
+    if not literals[word] then
+        decode_error(str, i, "invalid literal '" .. word .. "'")
+    end
+    return literal_map[word], x
+end
+
+
+local function parse_array(str, i)
+    local res = {}
+    local n = 1
+    i = i + 1
+    while 1 do
+        local x
+        i = next_char(str, i, space_chars, true)
+        -- Empty / end of array?
+        if str:sub(i, i) == "]" then
+            i = i + 1
+            break
+        end
+        -- Read token
+        x, i = parse(str, i)
+        res[n] = x
+        n = n + 1
+        -- Next token
+        i = next_char(str, i, space_chars, true)
+        local chr = str:sub(i, i)
+        i = i + 1
+        if chr == "]" then break end
+        if chr ~= "," then decode_error(str, i, "expected ']' or ','") end
+    end
+    return res, i
+end
+
+
+local function parse_object(str, i)
+    local res = {}
+    i = i + 1
+    while 1 do
+        local key, val
+        i = next_char(str, i, space_chars, true)
+        -- Empty / end of object?
+        if str:sub(i, i) == "}" then
+            i = i + 1
+            break
+        end
+        -- Read key
+        if str:sub(i, i) ~= '"' then
+            decode_error(str, i, "expected string for key")
+        end
+        key, i = parse(str, i)
+        -- Read ':' delimiter
+        i = next_char(str, i, space_chars, true)
+        if str:sub(i, i) ~= ":" then
+            decode_error(str, i, "expected ':' after key")
+        end
+        i = next_char(str, i + 1, space_chars, true)
+        -- Read value
+        val, i = parse(str, i)
+        -- Set
+        res[key] = val
+        -- Next token
+        i = next_char(str, i, space_chars, true)
+        local chr = str:sub(i, i)
+        i = i + 1
+        if chr == "}" then break end
+        if chr ~= "," then decode_error(str, i, "expected '}' or ','") end
+    end
+    return res, i
+end
+
+
+local char_func_map = {
+    [ '"' ] = parse_string,
+    [ "0" ] = parse_number,
+    [ "1" ] = parse_number,
+    [ "2" ] = parse_number,
+    [ "3" ] = parse_number,
+    [ "4" ] = parse_number,
+    [ "5" ] = parse_number,
+    [ "6" ] = parse_number,
+    [ "7" ] = parse_number,
+    [ "8" ] = parse_number,
+    [ "9" ] = parse_number,
+    [ "-" ] = parse_number,
+    [ "t" ] = parse_literal,
+    [ "f" ] = parse_literal,
+    [ "n" ] = parse_literal,
+    [ "[" ] = parse_array,
+    [ "{" ] = parse_object,
+}
+
+
+parse = function(str, idx)
+    local chr = str:sub(idx, idx)
+    local f = char_func_map[chr]
+    if f then
+        return f(str, idx)
+    end
+    decode_error(str, idx, "unexpected character '" .. chr .. "'")
+end
+
+
+function json.decode(str)
+    if type(str) ~= "string" then
+        error("expected argument of type string, got " .. type(str))
+    end
+    return ( parse(str, next_char(str, 1, space_chars, true)) )
+end
+
+
+return json