From 4ee098e8e7b1d5b9c2a2c714ddd162de837247d1 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 11 Sep 2026 12:22:26 +0100 Subject: [PATCH] Document random query ids in INSTALL and changelog --- INSTALL | 11 ++++++++--- changelog | 3 ++- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/INSTALL b/INSTALL index 94eb617..35c5c10 100644 --- a/INSTALL +++ b/INSTALL @@ -81,12 +81,12 @@ at all, and has no defence against bad nameservers or fake packets which appear to come from your real nameservers. It relies on the full-service resolvers listed in resolv.conf to handle these tasks. -For secure and reasonable operation you MUST run a full-service +For secure and reasonable operation you should run a full-service nameserver on the same system as your adns applications, or on the -same local, fully trusted network. You MUST only list such +same local, fully trusted network. You should only list such nameservers in the adns configuration (eg resolv.conf). -You MUST use a firewall or other means to block packets which appear +You should use a firewall or other means to block packets which appear to come from these nameservers, but which were actually sent by other, untrusted, entities. @@ -94,6 +94,11 @@ Furthermore, adns is not DNSSEC-aware in this version; it doesn't understand even how to ask a DNSSEC-aware nameserver to perform the DNSSEC cryptographic signature checking. +adns does use random query ids, since 1.7.0. (In the unlikely event +this is not possible, adns will log a message to stderr.) +The position is similar to other stub resolvers, such as the one in +glibc used by gethostbyname etc. + COPYRIGHT diff --git a/changelog b/changelog index 24d5f77..6729008 100644 --- a/changelog +++ b/changelog @@ -1,6 +1,7 @@ adns (1.6.3~) UPSTREAM; urgency=medium - * + * Select query IDs randomly using getentropy, if we can. + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145407. -- -- 2.30.2