Document random query ids in INSTALL and changelog

diff --git a/INSTALL b/INSTALL
index 94eb6176068aa320b99d5afd23b1f2a0e03df0fd..35c5c1008ac71acf747cd95c702f7c42cb4f6e5b 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -81,12 +81,12 @@ at all, and has no defence against bad nameservers or fake packets
 which appear to come from your real nameservers.  It relies on the
 full-service resolvers listed in resolv.conf to handle these tasks.
 
-For secure and reasonable operation you MUST run a full-service
+For secure and reasonable operation you should run a full-service
 nameserver on the same system as your adns applications, or on the
-same local, fully trusted network.  You MUST only list such
+same local, fully trusted network.  You should only list such
 nameservers in the adns configuration (eg resolv.conf).
 
-You MUST use a firewall or other means to block packets which appear
+You should use a firewall or other means to block packets which appear
 to come from these nameservers, but which were actually sent by other,
 untrusted, entities.
 
@@ -94,6 +94,11 @@ Furthermore, adns is not DNSSEC-aware in this version; it doesn't
 understand even how to ask a DNSSEC-aware nameserver to perform the
 DNSSEC cryptographic signature checking.
 
+adns does use random query ids, since 1.7.0.  (In the unlikely event
+this is not possible, adns will log a message to stderr.)
+The position is similar to other stub resolvers, such as the one in
+glibc used by gethostbyname etc.
+
 
 COPYRIGHT
 

diff --git a/changelog b/changelog
index 24d5f775980b3c7714c5178d0388c439bec5bac9..672900811a3a2202b3edefd909e91f56cb787116 100644 (file)
--- a/changelog
+++ b/changelog
@@ -1,6 +1,7 @@
 adns (1.6.3~) UPSTREAM; urgency=medium
 
-  * 
+  * Select query IDs randomly using getentropy, if we can.
+    See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145407.
 
  --