Mention REFUSED has the TC bit set with unmatched allow_cookie acl in the manpage

[wtoorop]

Also moved the part about bypassing ip-ratelimit to the ip-ratelimit description as it will be bypassed with a valid DNS-Cookie regardless of the allow_cookie acl.

[wcawijngaards]

Okay, glad my suggested part of the text made it through, mostly :-) . I feel it is okay to have a reference to the cookie ratelimit, or its difference to ordinary ratelimit at the allow_cookie description, but also the new location for the text is more genuine since other access control settings can have cookie traffic that uses the cookie ratelimit. So I am happy with the current solution.

[gthess]

Can we please squash before merging this? :)

[wtoorop]

Can we please squash before merging this? :)

Wait a minute, looking at the code I'm not convinced ip-ratelimit will be bypassed with a valid cookie regardless of the allow_cookie acl. @gthess perhaps pre_edns_ip_ratelimit should be set if worker->env.cfg->answer_cookie is set instead of based on allow_cookie acl, WDYT?

[gthess]

That's true. Currently only if you demand clients with cookies (i.e., allow_cookie in acl) you can bypass the ratelimit.
I am not sure what is the correct behavior.
You would expect that by presenting a cookie the client would be allowed through ratelimit even if demand for it is not necessary? But that makes sense only in case you do ip-ratelimit as a countermeasure for spoofing. I mean maybe you just want to ratelimit access for certain IPs. If they start doing cookies they are through.

[gthess]

But you are right, with the current code the text is wrong.

[wtoorop]

I mean maybe you just want to ratelimit access for certain IPs. If they start doing cookies they are through.

But currently ip-ratelimit is global anyway. There is no rate-limiting for certain IPs, right?
If you want to do it regardless of cookies, you can also set the ip-ratelimit-cookie setting. This would be conform the docs.

[gthess]

Ah you are right, I was confused with regular ratelimit to the upstream where it is not global only.
Then your current change makes sense to me.

[gthess]

So this looks good, merging.