From faf67b10670a14c24ce601be703dfb65f07ffa45 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Mon, 21 Oct 2019 12:03:51 -0600 Subject: tls: Make the on-demand rate limiter actually work This required a custom rate limiter implementation in CertMagic --- modules/caddytls/acmemanager.go | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) (limited to 'modules/caddytls/acmemanager.go') diff --git a/modules/caddytls/acmemanager.go b/modules/caddytls/acmemanager.go index dbc8fc9..9f31215 100644 --- a/modules/caddytls/acmemanager.go +++ b/modules/caddytls/acmemanager.go @@ -138,14 +138,10 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf return err } } - // check the rate limiter last, since - // even checking consumes a token; so - // don't even bother checking if the - // other regulations fail anyway - if onDemand.RateLimit != nil { - if !onDemandRateLimiter.Allow() { - return fmt.Errorf("on-demand rate limit exceeded") - } + // check the rate limiter last because + // doing so makes a reservation + if !onDemandRateLimiter.Allow() { + return fmt.Errorf("on-demand rate limit exceeded") } } return nil -- cgit v1.2.3