Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 07:00 UTC
caddytls: Drop `rate_limit` and `burst`, has been deprecated (#6611)
Francis Lavoie committed
Oct 7, 2024 at 17:39 UTC
d7564d632fbed209e81978c5c2c529a7bf1836f7
7 files changed
+7
-89
caddyconfig/httpcaddyfile/options.go
+2
-28
@@ -394,36 +394,10 @@ func parseOptOnDemand(d *caddyfile.Dispenser, _ any) (any, error) {
394
ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", modName, nil)
395
396
case "interval":
397
- if !d.NextArg() {
398
- return nil, d.ArgErr()
399
- }
400
- dur, err := caddy.ParseDuration(d.Val())
401
- if err != nil {
402
- return nil, err
403
- }
404
- if ond == nil {
405
- ond = new(caddytls.OnDemandConfig)
406
- }
407
- if ond.RateLimit == nil {
408
- ond.RateLimit = new(caddytls.RateLimit)
409
- }
410
- ond.RateLimit.Interval = caddy.Duration(dur)
397
+ return nil, d.Errf("the on_demand_tls 'interval' option is no longer supported, remove it from your config")
398
399
case "burst":
413
- if !d.NextArg() {
414
- return nil, d.ArgErr()
415
- }
416
- burst, err := strconv.Atoi(d.Val())
417
- if err != nil {
418
- return nil, err
419
- }
420
- if ond == nil {
421
- ond = new(caddytls.OnDemandConfig)
422
- }
423
- if ond.RateLimit == nil {
424
- ond.RateLimit = new(caddytls.RateLimit)
425
- }
426
- ond.RateLimit.Burst = burst
400
+ return nil, d.Errf("the on_demand_tls 'burst' option is no longer supported, remove it from your config")
401
402
default:
403
return nil, d.Errf("unrecognized parameter '%s'", d.Val())
caddytest/integration/caddyfile_adapt/global_options.caddyfiletest
-6
@@ -17,8 +17,6 @@
17
admin off
18
on_demand_tls {
19
ask https://example.com
20
- interval 30s
21
- burst 20
20
}
21
local_certs
22
key_type ed25519
@@ -72,10 +70,6 @@
70
"permission": {
71
"endpoint": "https://example.com",
72
"module": "http"
75
- },
76
- "rate_limit": {
77
- "interval": 30000000000,
78
- "burst": 20
73
}
74
}
75
},
caddytest/integration/caddyfile_adapt/global_options_acme.caddyfiletest
-6
@@ -17,8 +17,6 @@
17
admin off
18
on_demand_tls {
19
ask https://example.com
20
- interval 30s
21
- burst 20
20
}
21
storage_clean_interval 7d
22
renew_interval 1d
@@ -89,10 +87,6 @@
87
"permission": {
88
"endpoint": "https://example.com",
89
"module": "http"
92
- },
93
- "rate_limit": {
94
- "interval": 30000000000,
95
- "burst": 20
90
}
91
},
92
"ocsp_interval": 172800000000000,
caddytest/integration/caddyfile_adapt/global_options_admin.caddyfiletest
-6
@@ -16,8 +16,6 @@
16
}
17
on_demand_tls {
18
ask https://example.com
19
- interval 30s
20
- burst 20
19
}
20
local_certs
21
key_type ed25519
@@ -74,10 +72,6 @@
72
"permission": {
73
"endpoint": "https://example.com",
74
"module": "http"
77
- },
78
- "rate_limit": {
79
- "interval": 30000000000,
80
- "burst": 20
75
}
76
}
77
}
modules/caddytls/automation.go
-6
@@ -322,12 +322,6 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
322
return err
323
}
324
325
- // check the rate limiter last because
326
- // doing so makes a reservation
327
- if !onDemandRateLimiter.Allow() {
328
- return fmt.Errorf("on-demand rate limit exceeded")
329
- }
330
-
325
return nil
326
},
327
Managers: ap.Managers,
modules/caddytls/ondemand.go
+5
-26
@@ -38,12 +38,11 @@ func init() {
38
39
// OnDemandConfig configures on-demand TLS, for obtaining
40
// needed certificates at handshake-time. Because this
41
-// feature can easily be abused, you should use this to
42
-// establish rate limits and/or an internal endpoint that
43
-// Caddy can "ask" if it should be allowed to manage
44
-// certificates for a given hostname.
41
+// feature can easily be abused, Caddy must ask permission
42
+// to your application whether a particular domain is allowed
43
+// to have a certificate issued for it.
44
type OnDemandConfig struct {
46
- // DEPRECATED. WILL BE REMOVED SOON. Use 'permission' instead.
45
+ // DEPRECATED. WILL BE REMOVED SOON. Use 'permission' instead with the `http` module.
46
Ask string `json:"ask,omitempty"`
47
48
// REQUIRED. A module that will determine whether a
@@ -51,25 +50,6 @@ type OnDemandConfig struct {
50
// or obtained from an issuer on demand.
51
PermissionRaw json.RawMessage `json:"permission,omitempty" caddy:"namespace=tls.permission inline_key=module"`
52
permission OnDemandPermission
54
-
55
- // DEPRECATED. An optional rate limit to throttle
56
- // the checking of storage and the issuance of
57
- // certificates from handshakes if not already in
58
- // storage. WILL BE REMOVED IN A FUTURE RELEASE.
59
- RateLimit *RateLimit `json:"rate_limit,omitempty"`
60
-}
61
-
62
-// DEPRECATED. WILL LIKELY BE REMOVED SOON.
63
-// Instead of using this rate limiter, use a proper tool such as a
64
-// level 3 or 4 firewall and/or a permission module to apply rate limits.
65
-type RateLimit struct {
66
- // A duration value. Storage may be checked and a certificate may be
67
- // obtained 'burst' times during this interval.
68
- Interval caddy.Duration `json:"interval,omitempty"`
69
-
70
- // How many times during an interval storage can be checked or a
71
- // certificate can be obtained.
72
- Burst int `json:"burst,omitempty"`
53
}
54
55
// OnDemandPermission is a type that can give permission for
@@ -195,8 +175,7 @@ var ErrPermissionDenied = errors.New("certificate not allowed by permission modu
175
176
// These perpetual values are used for on-demand TLS.
177
var (
198
- onDemandRateLimiter = certmagic.NewRateLimiter(0, 0)
199
- onDemandAskClient = &http.Client{
178
+ onDemandAskClient = &http.Client{
179
Timeout: 10 * time.Second,
180
CheckRedirect: func(req *http.Request, via []*http.Request) error {
181
return fmt.Errorf("following http redirects is not allowed")
modules/caddytls/tls.go
-11
@@ -188,17 +188,6 @@ func (t *TLS) Provision(ctx caddy.Context) error {
188
t.Automation.OnDemand.permission = val.(OnDemandPermission)
189
}
190
191
- // on-demand rate limiting (TODO: deprecated, and should be removed later; rate limiting is ineffective now that permission modules are required)
192
- if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.RateLimit != nil {
193
- t.logger.Warn("DEPRECATED: on_demand.rate_limit will be removed in a future release; use permission modules or external certificate managers instead")
194
- onDemandRateLimiter.SetMaxEvents(t.Automation.OnDemand.RateLimit.Burst)
195
- onDemandRateLimiter.SetWindow(time.Duration(t.Automation.OnDemand.RateLimit.Interval))
196
- } else {
197
- // remove any existing rate limiter
198
- onDemandRateLimiter.SetWindow(0)
199
- onDemandRateLimiter.SetMaxEvents(0)
200
- }
201
-
191
// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
192
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
193
t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)