Can we please squash before merging this? :)

Can we please squash before merging this? :)

Wait a minute, looking at the code I'm not convinced ip-ratelimit will be bypassed with a valid cookie regardless of the allow_cookie acl. @gthess perhaps pre_edns_ip_ratelimit should be set if worker->env.cfg->answer_cookie is set instead of based on allow_cookie acl, WDYT?

That's true. Currently only if you demand clients with cookies (i.e., allow_cookie in acl) you can bypass the ratelimit.
I am not sure what is the correct behavior.
You would expect that by presenting a cookie the client would be allowed through ratelimit even if demand for it is not necessary? But that makes sense only in case you do ip-ratelimit as a countermeasure for spoofing. I mean maybe you just want to ratelimit access for certain IPs. If they start doing cookies they are through.

But you are right, with the current code the text is wrong.

I mean maybe you just want to ratelimit access for certain IPs. If they start doing cookies they are through.

But currently ip-ratelimit is global anyway. There is no rate-limiting for certain IPs, right?
If you want to do it regardless of cookies, you can also set the ip-ratelimit-cookie setting. This would be conform the docs.

Ah you are right, I was confused with regular ratelimit to the upstream where it is not global only.
Then your current change makes sense to me.

So this looks good, merging.