Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls: Make the on-demand rate limiter actually work
This required a custom rate limiter implementation in CertMagic
Matthew Holt committed
Oct 21, 2019 at 12:03 UTC
faf67b10670a14c24ce601be703dfb65f07ffa45
4 files changed
+13
-19
go.mod
+1
-1
@@ -14,7 +14,7 @@ require (
14
github.com/klauspost/compress v1.8.6
15
github.com/klauspost/cpuid v1.2.1
16
github.com/lucas-clemente/quic-go v0.12.1
17
- github.com/mholt/certmagic v0.8.0
17
+ github.com/mholt/certmagic v0.8.3
18
github.com/muhammadmuzzammil1998/jsonc v0.0.0-20190906142622-1265e9b150c6
19
github.com/rs/cors v1.7.0
20
github.com/russross/blackfriday/v2 v2.0.1
go.sum
+2
-2
@@ -172,8 +172,8 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
172
github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
173
github.com/mattn/go-tty v0.0.0-20180219170247-931426f7535a/go.mod h1:XPvLUNfbS4fJH25nqRHfWLMa1ONC8Amw+mIA639KxkE=
174
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
175
-github.com/mholt/certmagic v0.8.0 h1:WEQhZ4+ySd2cQz0Gf1iEk6xsUaEmmHe10SZiiKd7BdY=
176
-github.com/mholt/certmagic v0.8.0/go.mod h1:91uJzK5K8IWtYQqTi5R2tsxV1pCde+wdGfaRaOZi6aQ=
175
+github.com/mholt/certmagic v0.8.3 h1:JOUiX9IAZbbgyjNP2GY6v/6lorH+9GkZsc7ktMpGCSo=
176
+github.com/mholt/certmagic v0.8.3/go.mod h1:91uJzK5K8IWtYQqTi5R2tsxV1pCde+wdGfaRaOZi6aQ=
177
github.com/miekg/dns v1.1.15 h1:CSSIDtllwGLMoA6zjdKnaE6Tx6eVUxQ29LUgGetiDCI=
178
github.com/miekg/dns v1.1.15/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
179
github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
modules/caddytls/acmemanager.go
+4
-8
@@ -138,14 +138,10 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf
138
return err
139
}
140
}
141
- // check the rate limiter last, since
142
- // even checking consumes a token; so
143
- // don't even bother checking if the
144
- // other regulations fail anyway
145
- if onDemand.RateLimit != nil {
146
- if !onDemandRateLimiter.Allow() {
147
- return fmt.Errorf("on-demand rate limit exceeded")
148
- }
141
+ // check the rate limiter last because
142
+ // doing so makes a reservation
143
+ if !onDemandRateLimiter.Allow() {
144
+ return fmt.Errorf("on-demand rate limit exceeded")
145
}
146
}
147
return nil
modules/caddytls/tls.go
+6
-8
@@ -26,7 +26,6 @@ import (
26
"github.com/caddyserver/caddy/v2"
27
"github.com/go-acme/lego/v3/challenge"
28
"github.com/mholt/certmagic"
29
- "golang.org/x/time/rate"
29
)
30
31
func init() {
@@ -104,13 +103,12 @@ func (t *TLS) Provision(ctx caddy.Context) error {
103
104
// on-demand rate limiting
105
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.RateLimit != nil {
107
- limit := rate.Every(time.Duration(t.Automation.OnDemand.RateLimit.Interval))
108
- onDemandRateLimiter.SetLimit(limit)
109
- onDemandRateLimiter.SetBurst(t.Automation.OnDemand.RateLimit.Burst)
106
+ onDemandRateLimiter.SetMaxEvents(t.Automation.OnDemand.RateLimit.Burst)
107
+ onDemandRateLimiter.SetWindow(time.Duration(t.Automation.OnDemand.RateLimit.Interval))
108
} else {
111
- // if no rate limit is specified, be sure to remove any existing limit
112
- onDemandRateLimiter.SetLimit(0)
113
- onDemandRateLimiter.SetBurst(0)
109
+ // remove any existing rate limiter
110
+ onDemandRateLimiter.SetMaxEvents(0)
111
+ onDemandRateLimiter.SetWindow(0)
112
}
113
114
// load manual/static (unmanaged) certificates - we do this in
@@ -384,7 +382,7 @@ type ManagerMaker interface {
382
383
// These perpetual values are used for on-demand TLS.
384
var (
387
- onDemandRateLimiter = rate.NewLimiter(0, 1)
385
+ onDemandRateLimiter = certmagic.NewRateLimiter(0, 0)
386
onDemandAskClient = &http.Client{
387
Timeout: 10 * time.Second,
388
CheckRedirect: func(req *http.Request, via []*http.Request) error {