feat(router) new API router with multiple hosts/paths and HTTP methods support

.ci/run_tests.sh

@@ -3,17 +3,15 @@ set -e
 export BUSTED_ARGS="-o gtest -v --exclude-tags=ci"
 export TEST_CMD="KONG_SERF_PATH=$SERF_PATH bin/busted $BUSTED_ARGS"
 
+createuser --createdb kong
+createdb -U kong kong_tests
+
 if [ "$TEST_SUITE" == "lint" ]; then
-  make lint
+    make lint
 elif [ "$TEST_SUITE" == "unit" ]; then
-  make test
-else
-  createuser --createdb kong
-  createdb -U kong kong_tests
-
-  if [ "$TEST_SUITE" == "integration" ]; then
+    make test
+elif [ "$TEST_SUITE" == "integration" ]; then
     make test-integration
-  elif [ "$TEST_SUITE" == "plugins" ]; then
+elif [ "$TEST_SUITE" == "plugins" ]; then
     make test-plugins
-  fi
 fi

kong-0.9.7-0.rockspec

@@ -76,6 +76,8 @@ build = {
     ["kong.api.routes.cache"] = "kong/api/routes/cache.lua",
     ["kong.api.routes.cluster"] = "kong/api/routes/cluster.lua",
     ["kong.api.routes.upstreams"] = "kong/api/routes/upstreams.lua",
+    ["kong.api.routes.certificates"] = "kong/api/routes/certificates.lua",
+    ["kong.api.routes.snis"] = "kong/api/routes/snis.lua",
 
     ["kong.tools.dns"] = "kong/tools/dns.lua",
     ["kong.tools.utils"] = "kong/tools/utils.lua",
@@ -86,7 +88,7 @@ build = {
 
     ["kong.core.handler"] = "kong/core/handler.lua",
     ["kong.core.certificate"] = "kong/core/certificate.lua",
-    ["kong.core.resolver"] = "kong/core/resolver.lua",
+    ["kong.core.router"] = "kong/core/router.lua",
     ["kong.core.plugins_iterator"] = "kong/core/plugins_iterator.lua",
     ["kong.core.hooks"] = "kong/core/hooks.lua",
     ["kong.core.reports"] = "kong/core/reports.lua",
@@ -104,6 +106,8 @@ build = {
     ["kong.dao.schemas.plugins"] = "kong/dao/schemas/plugins.lua",
     ["kong.dao.schemas.upstreams"] = "kong/dao/schemas/upstreams.lua",
     ["kong.dao.schemas.targets"] = "kong/dao/schemas/targets.lua",
+    ["kong.dao.schemas.ssl_certificates"] = "kong/dao/schemas/ssl_certificates.lua",
+    ["kong.dao.schemas.ssl_servers_names"] = "kong/dao/schemas/ssl_servers_names.lua",
     ["kong.dao.db"] = "kong/dao/db/init.lua",
     ["kong.dao.db.cassandra"] = "kong/dao/db/cassandra.lua",
     ["kong.dao.db.postgres"] = "kong/dao/db/postgres.lua",
@@ -204,10 +208,6 @@ build = {
     ["kong.plugins.cors.handler"] = "kong/plugins/cors/handler.lua",
     ["kong.plugins.cors.schema"] = "kong/plugins/cors/schema.lua",
 
-    ["kong.plugins.ssl.handler"] = "kong/plugins/ssl/handler.lua",
-    ["kong.plugins.ssl.hooks"] = "kong/plugins/ssl/hooks.lua",
-    ["kong.plugins.ssl.schema"] = "kong/plugins/ssl/schema.lua",
-
     ["kong.plugins.ip-restriction.handler"] = "kong/plugins/ip-restriction/handler.lua",
     ["kong.plugins.ip-restriction.schema"] = "kong/plugins/ip-restriction/schema.lua",
     ["kong.plugins.ip-restriction.migrations.cassandra"] = "kong/plugins/ip-restriction/migrations/cassandra.lua",

kong/api/crud_helpers.lua

@@ -91,8 +91,9 @@ function _M.paginated_set(self, dao_collection)
   end
 
   return responses.send_HTTP_OK {
-    -- can't use empty_array_mt here since apparently metatables are removed
-    -- before JSON encoding.
+    -- FIXME: remove and stick to previous `empty_array_mt` metatable
+    -- assignment once https://github.com/openresty/lua-cjson/pull/16
+    -- is included in the OpenResty release we use.
     data = #rows > 0 and rows or cjson.empty_array,
     total = total_count,
     offset = offset,

kong/api/init.lua

@@ -110,7 +110,7 @@ end
 ngx.log(ngx.DEBUG, "Loading Admin API endpoints")
 
 -- Load core routes
-for _, v in ipairs({"kong", "apis", "consumers", "plugins", "cache", "cluster", "upstreams" }) do
+for _, v in ipairs({"kong", "apis", "consumers", "plugins", "cache", "cluster", "certificates", "snis", "upstreams"}) do
   local routes = require("kong.api.routes."..v)
   attach_routes(insert_405(routes))
 end

kong/api/routes/cache.lua

@@ -57,7 +57,7 @@ return {
     GET = function(self, dao_factory)
       if self.params.key then
         local cached_item = caches[self.params.cache]("get", self.params.key)
-        if cached_item then
+        if cached_item ~= nil then
           return responses.send_HTTP_OK(cached_item)
         end
       end

kong/api/routes/certificates.lua

@@ -0,0 +1,159 @@
+local crud = require "kong.api.crud_helpers"
+local utils = require "kong.tools.utils"
+local cjson = require "cjson"
+
+
+return {
+  ["/certificates/"] = {
+    POST = function(self, dao_factory, helpers)
+      local snis
+      if type(self.params.snis) == "string" then
+        snis = utils.split(self.params.snis, ",")
+        self.params.snis = nil
+      end
+
+      local ssl_cert, err = dao_factory.ssl_certificates:insert(self.params)
+      if err then
+        return helpers.yield_error(err)
+      end
+
+      -- insert SNIs if given
+
+      if type(snis) == "table" then
+        ssl_cert.snis = {}
+
+        for i = 1, #snis do
+          local ssl_server_name = {
+            name                = snis[i],
+            ssl_certificate_id  = ssl_cert.id,
+          }
+
+          local row, err = dao_factory.ssl_servers_names:insert(ssl_server_name)
+          if err then
+            return helpers.yield_error(err)
+          end
+
+          table.insert(ssl_cert.snis, row.name)
+        end
+      end
+
+      return helpers.responses.send_HTTP_CREATED(ssl_cert)
+    end,
+
+
+    GET = function(self, dao_factory, helpers)
+      local ssl_certificates, err = dao_factory.ssl_certificates:find_all()
+      if err then
+        return helpers.yield_error(err)
+      end
+
+      for i = 1, #ssl_certificates do
+        local rows, err = dao_factory.ssl_servers_names:find_all {
+          ssl_certificate_id = ssl_certificates[i].id
+        }
+        if err then
+          return helpers.yield_error(err)
+        end
+
+        ssl_certificates[i].snis = setmetatable({}, cjson.empty_array_mt)
+
+        for j = 1, #rows do
+          table.insert(ssl_certificates[i].snis, rows[j].name)
+        end
+
+        -- FIXME: remove and stick to previous `empty_array_mt` metatable
+        -- assignment once https://github.com/openresty/lua-cjson/pull/16
+        -- is included in the OpenResty release we use.
+        if #ssl_certificates[i].snis == 0 then
+          ssl_certificates[i].snis = cjson.empty_array
+        end
+      end
+
+      return helpers.responses.send_HTTP_OK(ssl_certificates)
+    end,
+
+
+    PUT = function(self, dao_factory, helpers)
+      return crud.put(self.params, dao_factory.ssl_certificates)
+    end,
+  },
+
+
+  ["/certificates/:sni_or_uuid"] = {
+    before = function(self, dao_factory, helpers)
+      if utils.is_valid_uuid(self.params.sni_or_uuid) then
+        self.ssl_certificate_id = self.params.sni_or_uuid
+
+      else
+        -- get requested SNI
+
+        local row, err = dao_factory.ssl_servers_names:find {
+          name = self.params.sni_or_uuid
+        }
+        if err then
+          return helpers.yield_error(err)
+        end
+
+        if not row then
+          return helpers.responses.send_HTTP_NOT_FOUND()
+        end
+
+        -- cache certificate row id
+
+        self.ssl_certificate_id = row.ssl_certificate_id
+      end
+
+      self.params.sni_or_uuid = nil
+    end,
+
+
+    GET = function(self, dao_factory, helpers)
+      local row, err = dao_factory.ssl_certificates:find {
+        id = self.ssl_certificate_id
+      }
+      if err then
+        return helpers.yield_error(err)
+      end
+
+      assert(row, "no SSL certificate for given SNI")
+
+      -- add list of other SNIs for this certificate
+
+      row.snis = setmetatable({}, cjson.empty_array_mt)
+
+      local rows, err = dao_factory.ssl_servers_names:find_all {
+        ssl_certificate_id = self.ssl_certificate_id
+      }
+      if err then
+        return helpers.yield_error(err)
+      end
+
+      for i = 1, #rows do
+        table.insert(row.snis, rows[i].name)
+      end
+
+      -- FIXME: remove and stick to previous `empty_array_mt` metatable
+      -- assignment once https://github.com/openresty/lua-cjson/pull/16
+      -- is included in the OpenResty release we use.
+      if #row.snis == 0 then
+        row.snis = cjson.empty_array
+      end
+
+      return helpers.responses.send_HTTP_OK(row)
+    end,
+
+
+    PATCH = function(self, dao_factory, helpers)
+      return crud.patch(self.params, dao_factory.ssl_certificates, {
+        id = self.ssl_certificate_id
+      })
+    end,
+
+
+    DELETE = function(self, dao_factory, helpers)
+      return crud.delete({
+        id = self.ssl_certificate_id
+      }, dao_factory.ssl_certificates)
+    end,
+  }
+}

kong/api/routes/snis.lua

@@ -0,0 +1,53 @@
+local crud = require "kong.api.crud_helpers"
+
+
+return {
+  ["/snis/"] = {
+    GET = function(self, dao_factory)
+      crud.paginated_set(self, dao_factory.ssl_servers_names)
+    end,
+
+
+    PUT = function(self, dao_factory)
+      crud.put(self.params, dao_factory.ssl_servers_names)
+    end,
+
+
+    POST = function(self, dao_factory)
+      crud.post(self.params, dao_factory.ssl_servers_names)
+    end,
+  },
+
+
+  ["/snis/:name"] = {
+    before = function(self, dao_factory, helpers)
+      local row, err = dao_factory.ssl_servers_names:find {
+        name = self.params.name
+      }
+      if err then
+        return helpers.yield_error(err)
+      end
+
+      if not row then
+        return helpers.responses.send_HTTP_NOT_FOUND()
+      end
+
+      self.sni = row
+    end,
+
+
+    GET = function(self, dao_factory, helpers)
+      return helpers.responses.send_HTTP_OK(self.sni)
+    end,
+
+
+    PATCH = function(self, dao_factory)
+      crud.patch(self.params, dao_factory.ssl_servers_names, self.sni)
+    end,
+
+
+    DELETE = function(self, dao_factory)
+      crud.delete(self.sni, dao_factory.ssl_servers_names)
+    end,
+  }
+}

kong/constants.lua

@@ -1,5 +1,5 @@
 local plugins = {
-  "ssl", "jwt", "acl", "correlation-id", "cors", "oauth2", "tcp-log", "udp-log",
+  "jwt", "acl", "correlation-id", "cors", "oauth2", "tcp-log", "udp-log",
   "file-log", "http-log", "key-auth", "hmac-auth", "basic-auth", "ip-restriction",
   "galileo", "request-transformer", "response-transformer",
   "request-size-limiting", "rate-limiting", "response-ratelimiting", "syslog",
@@ -47,4 +47,4 @@ return {
   CACHE = {
     CLUSTER = "cluster"
   }
-}
+}