Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bind: Expand description of services.bind.cacheNetworks #71828

Merged
merged 1 commit into from Nov 19, 2019

Conversation

willghatch
Copy link
Contributor

The new description should give more clear understanding of when to
edit the option.

Motivation for this change

I used NixOS to set up a DNS server that is authoritative for certain zones. The description of the cacheNetworks option made me think I needed to set it to "any" to allow people to query the zone I set up. Reading the source of the module would have clarified my understanding, but at the time I just read the description and thought little of it. Later I discovered I was getting tons of DNS requests and presumably being used for a DNS amplification attack or similar. I have fixed the problem now, but I would like the option to have a clearer description so others don't make the same mistake I did.

I'm not tied to the prose I wrote, but I would like to see the description expanded to clarify the issue.

Things done

I only changed a string. I only tested it as far as ensuring that it didn't cause a syntax error.

  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
Notify maintainers

cc @peti @globin

The new description should give more clear understanding of when to
edit the option.

I used NixOS to set up a DNS server that is authoritative for certain
zones.  The description of the `cacheNetworks` option made me think I
needed to set it to `"any"` to allow people to query the zone I set
up.  Reading the source of the module would have clarified my
understanding, but at the time I just read the description and thought
little of it.  Later I discovered I was getting tons of DNS requests
and presumably being used for a DNS amplification attack or similar.
I have fixed the problem now, but I would like the option to have a
clearer description so others don't make the same mistake I did.
Copy link
Member

@Lassulus Lassulus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks sane and informative to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants