fix: improve query ID randomness and anti-spoofing

Author: msimerson

.github/workflows/release.yml

@@ -43,10 +43,10 @@ jobs:
         with:
           node-version: "24"
       - uses: actions/checkout@v6
-      - run: npm ci || npm install
+      - run: npm ci
       - run: npm test
 
-  create-release:
+  release:
     needs: [build, version]
     runs-on: ubuntu-latest
     permissions:
@@ -77,3 +77,18 @@ jobs:
           tag_name: v${{ needs.version.outputs.version }}
           name: ${{ needs.version.outputs.version }}
           generate_release_notes: false
+
+  publish:
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: https://registry.npmjs.org/
+      - run: npm ci
+      - run: npm publish --provenance

CHANGELOG.md

@@ -4,9 +4,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Unreleased
 
-### 2.2.0 - 2026-05-25
+### 2.2.1 - 2026-05-25
 
 - fix(packet): preserve RDLENGTH+RDATA for unknown RR types
+- fix(packet): use crypto.randomInt for Packet.uuid (RFC 5452)
+
+### 2.2.0 - 2026-05-25
+
 - feat(client): add retryOverTCP option #117
 - feat(client): support `dns` argument, fix docs #116
 - feat: add resolveSOA #115

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dns2",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "A DNS Server and Client Implementation in Pure JavaScript with no dependencies.",
   "main": "index.js",
   "types": "ts/index.d.ts",
@@ -41,12 +41,12 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/song940/node-dns.git"
+    "url": "git+https://github.com/lsongdev/node-dns.git"
   },
   "bugs": {
-    "url": "https://github.com/song940/node-dns/issues"
+    "url": "https://github.com/lsongdev/node-dns/issues"
   },
-  "homepage": "https://github.com/song940/node-dns#readme",
+  "homepage": "https://github.com/lsongdev/node-dns#readme",
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@stylistic/eslint-plugin": "^5.10.0",

packet.js

@@ -1,4 +1,5 @@
 const { debuglog } = require('node:util');
+const { randomInt } = require('node:crypto');
 const BufferReader = require('./lib/reader');
 const BufferWriter = require('./lib/writer');
 
@@ -145,11 +146,13 @@ Packet.EDNS_OPTION_CODE = {
 };
 
 /**
- * [uuid description]
- * @return {[type]} [description]
+ * Generate a cryptographically random 16-bit DNS transaction ID.
+ * RFC 5452 §3 — the full 16-bit space must be used from a CSPRNG to make
+ * response forgery / cache poisoning impractical.
+ * @return {number} integer in [0, 0xFFFF]
  */
 Packet.uuid = function() {
-  return Math.floor(Math.random() * 1e5);
+  return randomInt(0x10000);
 };
 
 /**

test/packet.js

@@ -672,8 +672,8 @@ test('Packet.RCODE is preserved through encode/parse round-trip', function() {
 });
 
 test('Resource encode round-trips unknown type via raw data fallback', function() {
-  // C1 (AUDIT-RFC.md): the encoder must write RDLENGTH+RDATA for types it
-  // doesn't know how to serialize, otherwise the wire format is truncated.
+  // the encoder must write RDLENGTH+RDATA for types it doesn't know how
+  // to serialize, else the wire format is truncated.
   // 0xABCD is intentionally not in Packet.TYPE.
   const rdata = Buffer.from([ 0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x01 ]);
   const packet = new Packet();
@@ -695,9 +695,8 @@ test('Resource encode round-trips unknown type via raw data fallback', function(
 });
 
 test('Resource encode of unknown type does not corrupt following records', function() {
-  // The strongest signal for the C1 fix: without it, the missing RDLENGTH
-  // would make the parser interpret the next record's bytes as RDATA, and
-  // the A record below would never appear in `answers`.
+  // without the fix, the missing RDLENGTH would make the parser interpret the
+  // next record's bytes as RDATA, and the A record would never appear in `answers`.
   const packet = new Packet();
   packet.header.qr = 1;
   packet.answers.push({
@@ -747,6 +746,32 @@ test('Resource encode of unknown type with no data writes empty RDATA', function
   assert.equal(parsed.answers[1].address, '198.51.100.1');
 });
 
+test('Packet.uuid returns a 16-bit integer', function() {
+  // must use the full 16-bit space, not Math.random()*1e5.
+  for (let i = 0; i < 1000; i++) {
+    const id = Packet.uuid();
+    assert.ok(Number.isInteger(id), `not an integer: ${id}`);
+    assert.ok(id >= 0 && id <= 0xFFFF, `out of range: ${id}`);
+  }
+});
+
+test('Packet.uuid exercises the full 16-bit range with high diversity', function() {
+  // Sample size large enough that a CSPRNG over [0, 0xFFFF] almost certainly
+  // produces values in every quartile of the range. Catches regressions to a
+  // constant, low-entropy, or capped implementation.
+  const samples = new Set();
+  const quartile = [ 0, 0, 0, 0 ];
+  for (let i = 0; i < 5000; i++) {
+    const id = Packet.uuid();
+    samples.add(id);
+    quartile[Math.floor((id / 0x10000) * 4)]++;
+  }
+  assert.ok(samples.size > 4000, `expected high diversity, got ${samples.size}`);
+  for (let q = 0; q < 4; q++) {
+    assert.ok(quartile[q] > 200, `quartile ${q} underrepresented (${quartile[q]}/5000)`);
+  }
+});
+
 test('Packet.parse tolerates multiple questions', function() {
   const request = new Packet();
   request.header.id = 0x9999;