Python code coverage for Python/random.c

#	count	content
1	n/a	#include "Python.h"
2	n/a	#ifdef MS_WINDOWS
3	n/a	# include <windows.h>
4	n/a	/* All sample MSDN wincrypt programs include the header below. It is at least
5	n/a	* required with Min GW. */
6	n/a	# include <wincrypt.h>
7	n/a	#else
8	n/a	# include <fcntl.h>
9	n/a	# ifdef HAVE_SYS_STAT_H
10	n/a	# include <sys/stat.h>
11	n/a	# endif
12	n/a	# ifdef HAVE_LINUX_RANDOM_H
13	n/a	# include <linux/random.h>
14	n/a	# endif
15	n/a	# if defined(HAVE_SYS_RANDOM_H) && (defined(HAVE_GETRANDOM) \|\| defined(HAVE_GETENTROPY))
16	n/a	# include <sys/random.h>
17	n/a	# endif
18	n/a	# if !defined(HAVE_GETRANDOM) && defined(HAVE_GETRANDOM_SYSCALL)
19	n/a	# include <sys/syscall.h>
20	n/a	# endif
21	n/a	#endif
22	n/a
23	n/a	#ifdef Py_DEBUG
24	n/a	int _Py_HashSecret_Initialized = 0;
25	n/a	#else
26	n/a	static int _Py_HashSecret_Initialized = 0;
27	n/a	#endif
28	n/a
29	n/a	#ifdef MS_WINDOWS
30	n/a	static HCRYPTPROV hCryptProv = 0;
31	n/a
32	n/a	static int
33	n/a	win32_urandom_init(int raise)
34	n/a	{
35	n/a	/* Acquire context */
36	n/a	if (!CryptAcquireContext(&hCryptProv, NULL, NULL,
37	n/a	PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
38	n/a	goto error;
39	n/a
40	n/a	return 0;
41	n/a
42	n/a	error:
43	n/a	if (raise) {
44	n/a	PyErr_SetFromWindowsErr(0);
45	n/a	}
46	n/a	return -1;
47	n/a	}
48	n/a
49	n/a	/* Fill buffer with size pseudo-random bytes generated by the Windows CryptoGen
50	n/a	API. Return 0 on success, or raise an exception and return -1 on error. */
51	n/a	static int
52	n/a	win32_urandom(unsigned char *buffer, Py_ssize_t size, int raise)
53	n/a	{
54	n/a	Py_ssize_t chunk;
55	n/a
56	n/a	if (hCryptProv == 0)
57	n/a	{
58	n/a	if (win32_urandom_init(raise) == -1) {
59	n/a	return -1;
60	n/a	}
61	n/a	}
62	n/a
63	n/a	while (size > 0)
64	n/a	{
65	n/a	chunk = size > INT_MAX ? INT_MAX : size;
66	n/a	if (!CryptGenRandom(hCryptProv, (DWORD)chunk, buffer))
67	n/a	{
68	n/a	/* CryptGenRandom() failed */
69	n/a	if (raise) {
70	n/a	PyErr_SetFromWindowsErr(0);
71	n/a	}
72	n/a	return -1;
73	n/a	}
74	n/a	buffer += chunk;
75	n/a	size -= chunk;
76	n/a	}
77	n/a	return 0;
78	n/a	}
79	n/a
80	n/a	#else /* !MS_WINDOWS */
81	n/a
82	n/a	#if defined(HAVE_GETRANDOM) \|\| defined(HAVE_GETRANDOM_SYSCALL)
83	n/a	#define PY_GETRANDOM 1
84	n/a
85	n/a	/* Call getrandom() to get random bytes:
86	n/a
87	n/a	- Return 1 on success
88	n/a	- Return 0 if getrandom() is not available (failed with ENOSYS or EPERM),
89	n/a	or if getrandom(GRND_NONBLOCK) failed with EAGAIN (system urandom not
90	n/a	initialized yet) and raise=0.
91	n/a	- Raise an exception (if raise is non-zero) and return -1 on error:
92	n/a	if getrandom() failed with EINTR, raise is non-zero and the Python signal
93	n/a	handler raised an exception, or if getrandom() failed with a different
94	n/a	error.
95	n/a
96	n/a	getrandom() is retried if it failed with EINTR: interrupted by a signal. */
97	n/a	static int
98	n/a	py_getrandom(void *buffer, Py_ssize_t size, int blocking, int raise)
99	n/a	{
100	n/a	/* Is getrandom() supported by the running kernel? Set to 0 if getrandom()
101	n/a	failed with ENOSYS or EPERM. Need Linux kernel 3.17 or newer, or Solaris
102	n/a	11.3 or newer */
103	n/a	static int getrandom_works = 1;
104	n/a	int flags;
105	n/a	char *dest;
106	n/a	long n;
107	n/a
108	n/a	if (!getrandom_works) {
109	n/a	return 0;
110	n/a	}
111	n/a
112	n/a	flags = blocking ? 0 : GRND_NONBLOCK;
113	n/a	dest = buffer;
114	n/a	while (0 < size) {
115	n/a	#ifdef sun
116	n/a	/* Issue #26735: On Solaris, getrandom() is limited to returning up
117	n/a	to 1024 bytes. Call it multiple times if more bytes are
118	n/a	requested. */
119	n/a	n = Py_MIN(size, 1024);
120	n/a	#else
121	n/a	n = Py_MIN(size, LONG_MAX);
122	n/a	#endif
123	n/a
124	n/a	errno = 0;
125	n/a	#ifdef HAVE_GETRANDOM
126	n/a	if (raise) {
127	n/a	Py_BEGIN_ALLOW_THREADS
128	n/a	n = getrandom(dest, n, flags);
129	n/a	Py_END_ALLOW_THREADS
130	n/a	}
131	n/a	else {
132	n/a	n = getrandom(dest, n, flags);
133	n/a	}
134	n/a	#else
135	n/a	/* On Linux, use the syscall() function because the GNU libc doesn't
136	n/a	expose the Linux getrandom() syscall yet. See:
137	n/a	https://sourceware.org/bugzilla/show_bug.cgi?id=17252 */
138	n/a	if (raise) {
139	n/a	Py_BEGIN_ALLOW_THREADS
140	n/a	n = syscall(SYS_getrandom, dest, n, flags);
141	n/a	Py_END_ALLOW_THREADS
142	n/a	}
143	n/a	else {
144	n/a	n = syscall(SYS_getrandom, dest, n, flags);
145	n/a	}
146	n/a	#endif
147	n/a
148	n/a	if (n < 0) {
149	n/a	/* ENOSYS: the syscall is not supported by the kernel.
150	n/a	EPERM: the syscall is blocked by a security policy (ex: SECCOMP)
151	n/a	or something else. */
152	n/a	if (errno == ENOSYS \|\| errno == EPERM) {
153	n/a	getrandom_works = 0;
154	n/a	return 0;
155	n/a	}
156	n/a
157	n/a	/* getrandom(GRND_NONBLOCK) fails with EAGAIN if the system urandom
158	n/a	is not initialiazed yet. For _PyRandom_Init(), we ignore the
159	n/a	error and fall back on reading /dev/urandom which never blocks,
160	n/a	even if the system urandom is not initialized yet:
161	n/a	see the PEP 524. */
162	n/a	if (errno == EAGAIN && !raise && !blocking) {
163	n/a	return 0;
164	n/a	}
165	n/a
166	n/a	if (errno == EINTR) {
167	n/a	if (raise) {
168	n/a	if (PyErr_CheckSignals()) {
169	n/a	return -1;
170	n/a	}
171	n/a	}
172	n/a
173	n/a	/* retry getrandom() if it was interrupted by a signal */
174	n/a	continue;
175	n/a	}
176	n/a
177	n/a	if (raise) {
178	n/a	PyErr_SetFromErrno(PyExc_OSError);
179	n/a	}
180	n/a	return -1;
181	n/a	}
182	n/a
183	n/a	dest += n;
184	n/a	size -= n;
185	n/a	}
186	n/a	return 1;
187	n/a	}
188	n/a
189	n/a	#elif defined(HAVE_GETENTROPY)
190	n/a	#define PY_GETENTROPY 1
191	n/a
192	n/a	/* Fill buffer with size pseudo-random bytes generated by getentropy():
193	n/a
194	n/a	- Return 1 on success
195	n/a	- Return 0 if getentropy() syscall is not available (failed with ENOSYS or
196	n/a	EPERM).
197	n/a	- Raise an exception (if raise is non-zero) and return -1 on error:
198	n/a	if getentropy() failed with EINTR, raise is non-zero and the Python signal
199	n/a	handler raised an exception, or if getentropy() failed with a different
200	n/a	error.
201	n/a
202	n/a	getentropy() is retried if it failed with EINTR: interrupted by a signal. */
203	n/a	static int
204	n/a	py_getentropy(char *buffer, Py_ssize_t size, int raise)
205	n/a	{
206	n/a	/* Is getentropy() supported by the running kernel? Set to 0 if
207	n/a	getentropy() failed with ENOSYS or EPERM. */
208	n/a	static int getentropy_works = 1;
209	n/a
210	n/a	if (!getentropy_works) {
211	n/a	return 0;
212	n/a	}
213	n/a
214	n/a	while (size > 0) {
215	n/a	/* getentropy() is limited to returning up to 256 bytes. Call it
216	n/a	multiple times if more bytes are requested. */
217	n/a	Py_ssize_t len = Py_MIN(size, 256);
218	n/a	int res;
219	n/a
220	n/a	if (raise) {
221	n/a	Py_BEGIN_ALLOW_THREADS
222	n/a	res = getentropy(buffer, len);
223	n/a	Py_END_ALLOW_THREADS
224	n/a	}
225	n/a	else {
226	n/a	res = getentropy(buffer, len);
227	n/a	}
228	n/a
229	n/a	if (res < 0) {
230	n/a	/* ENOSYS: the syscall is not supported by the running kernel.
231	n/a	EPERM: the syscall is blocked by a security policy (ex: SECCOMP)
232	n/a	or something else. */
233	n/a	if (errno == ENOSYS \|\| errno == EPERM) {
234	n/a	getentropy_works = 0;
235	n/a	return 0;
236	n/a	}
237	n/a
238	n/a	if (errno == EINTR) {
239	n/a	if (raise) {
240	n/a	if (PyErr_CheckSignals()) {
241	n/a	return -1;
242	n/a	}
243	n/a	}
244	n/a
245	n/a	/* retry getentropy() if it was interrupted by a signal */
246	n/a	continue;
247	n/a	}
248	n/a
249	n/a	if (raise) {
250	n/a	PyErr_SetFromErrno(PyExc_OSError);
251	n/a	}
252	n/a	return -1;
253	n/a	}
254	n/a
255	n/a	buffer += len;
256	n/a	size -= len;
257	n/a	}
258	n/a	return 1;
259	n/a	}
260	n/a	#endif /* defined(HAVE_GETENTROPY) && !defined(sun) */
261	n/a
262	n/a
263	n/a	static struct {
264	n/a	int fd;
265	n/a	dev_t st_dev;
266	n/a	ino_t st_ino;
267	n/a	} urandom_cache = { -1 };
268	n/a
269	n/a	/* Read random bytes from the /dev/urandom device:
270	n/a
271	n/a	- Return 0 on success
272	n/a	- Raise an exception (if raise is non-zero) and return -1 on error
273	n/a
274	n/a	Possible causes of errors:
275	n/a
276	n/a	- open() failed with ENOENT, ENXIO, ENODEV, EACCES: the /dev/urandom device
277	n/a	was not found. For example, it was removed manually or not exposed in a
278	n/a	chroot or container.
279	n/a	- open() failed with a different error
280	n/a	- fstat() failed
281	n/a	- read() failed or returned 0
282	n/a
283	n/a	read() is retried if it failed with EINTR: interrupted by a signal.
284	n/a
285	n/a	The file descriptor of the device is kept open between calls to avoid using
286	n/a	many file descriptors when run in parallel from multiple threads:
287	n/a	see the issue #18756.
288	n/a
289	n/a	st_dev and st_ino fields of the file descriptor (from fstat()) are cached to
290	n/a	check if the file descriptor was replaced by a different file (which is
291	n/a	likely a bug in the application): see the issue #21207.
292	n/a
293	n/a	If the file descriptor was closed or replaced, open a new file descriptor
294	n/a	but don't close the old file descriptor: it probably points to something
295	n/a	important for some third-party code. */
296	n/a	static int
297	n/a	dev_urandom(char *buffer, Py_ssize_t size, int raise)
298	n/a	{
299	n/a	int fd;
300	n/a	Py_ssize_t n;
301	n/a
302	n/a	if (raise) {
303	n/a	struct _Py_stat_struct st;
304	n/a
305	n/a	if (urandom_cache.fd >= 0) {
306	n/a	/* Does the fd point to the same thing as before? (issue #21207) */
307	n/a	if (_Py_fstat_noraise(urandom_cache.fd, &st)
308	n/a	\|\| st.st_dev != urandom_cache.st_dev
309	n/a	\|\| st.st_ino != urandom_cache.st_ino) {
310	n/a	/* Something changed: forget the cached fd (but don't close it,
311	n/a	since it probably points to something important for some
312	n/a	third-party code). */
313	n/a	urandom_cache.fd = -1;
314	n/a	}
315	n/a	}
316	n/a	if (urandom_cache.fd >= 0)
317	n/a	fd = urandom_cache.fd;
318	n/a	else {
319	n/a	fd = _Py_open("/dev/urandom", O_RDONLY);
320	n/a	if (fd < 0) {
321	n/a	if (errno == ENOENT \|\| errno == ENXIO \|\|
322	n/a	errno == ENODEV \|\| errno == EACCES) {
323	n/a	PyErr_SetString(PyExc_NotImplementedError,
324	n/a	"/dev/urandom (or equivalent) not found");
325	n/a	}
326	n/a	/* otherwise, keep the OSError exception raised by _Py_open() */
327	n/a	return -1;
328	n/a	}
329	n/a	if (urandom_cache.fd >= 0) {
330	n/a	/* urandom_fd was initialized by another thread while we were
331	n/a	not holding the GIL, keep it. */
332	n/a	close(fd);
333	n/a	fd = urandom_cache.fd;
334	n/a	}
335	n/a	else {
336	n/a	if (_Py_fstat(fd, &st)) {
337	n/a	close(fd);
338	n/a	return -1;
339	n/a	}
340	n/a	else {
341	n/a	urandom_cache.fd = fd;
342	n/a	urandom_cache.st_dev = st.st_dev;
343	n/a	urandom_cache.st_ino = st.st_ino;
344	n/a	}
345	n/a	}
346	n/a	}
347	n/a
348	n/a	do {
349	n/a	n = _Py_read(fd, buffer, (size_t)size);
350	n/a	if (n == -1)
351	n/a	return -1;
352	n/a	if (n == 0) {
353	n/a	PyErr_Format(PyExc_RuntimeError,
354	n/a	"Failed to read %zi bytes from /dev/urandom",
355	n/a	size);
356	n/a	return -1;
357	n/a	}
358	n/a
359	n/a	buffer += n;
360	n/a	size -= n;
361	n/a	} while (0 < size);
362	n/a	}
363	n/a	else {
364	n/a	fd = _Py_open_noraise("/dev/urandom", O_RDONLY);
365	n/a	if (fd < 0) {
366	n/a	return -1;
367	n/a	}
368	n/a
369	n/a	while (0 < size)
370	n/a	{
371	n/a	do {
372	n/a	n = read(fd, buffer, (size_t)size);
373	n/a	} while (n < 0 && errno == EINTR);
374	n/a
375	n/a	if (n <= 0) {
376	n/a	/* stop on error or if read(size) returned 0 */
377	n/a	close(fd);
378	n/a	return -1;
379	n/a	}
380	n/a
381	n/a	buffer += n;
382	n/a	size -= n;
383	n/a	}
384	n/a	close(fd);
385	n/a	}
386	n/a	return 0;
387	n/a	}
388	n/a
389	n/a	static void
390	n/a	dev_urandom_close(void)
391	n/a	{
392	n/a	if (urandom_cache.fd >= 0) {
393	n/a	close(urandom_cache.fd);
394	n/a	urandom_cache.fd = -1;
395	n/a	}
396	n/a	}
397	n/a	#endif /* !MS_WINDOWS */
398	n/a
399	n/a
400	n/a	/* Fill buffer with pseudo-random bytes generated by a linear congruent
401	n/a	generator (LCG):
402	n/a
403	n/a	x(n+1) = (x(n) * 214013 + 2531011) % 2^32
404	n/a
405	n/a	Use bits 23..16 of x(n) to generate a byte. */
406	n/a	static void
407	n/a	lcg_urandom(unsigned int x0, unsigned char *buffer, size_t size)
408	n/a	{
409	n/a	size_t index;
410	n/a	unsigned int x;
411	n/a
412	n/a	x = x0;
413	n/a	for (index=0; index < size; index++) {
414	n/a	x *= 214013;
415	n/a	x += 2531011;
416	n/a	/* modulo 2 ^ (8 * sizeof(int)) */
417	n/a	buffer[index] = (x >> 16) & 0xff;
418	n/a	}
419	n/a	}
420	n/a
421	n/a	/* Read random bytes:
422	n/a
423	n/a	- Return 0 on success
424	n/a	- Raise an exception (if raise is non-zero) and return -1 on error
425	n/a
426	n/a	Used sources of entropy ordered by preference, preferred source first:
427	n/a
428	n/a	- CryptGenRandom() on Windows
429	n/a	- getrandom() function (ex: Linux and Solaris): call py_getrandom()
430	n/a	- getentropy() function (ex: OpenBSD): call py_getentropy()
431	n/a	- /dev/urandom device
432	n/a
433	n/a	Read from the /dev/urandom device if getrandom() or getentropy() function
434	n/a	is not available or does not work.
435	n/a
436	n/a	Prefer getrandom() over getentropy() because getrandom() supports blocking
437	n/a	and non-blocking mode: see the PEP 524. Python requires non-blocking RNG at
438	n/a	startup to initialize its hash secret, but os.urandom() must block until the
439	n/a	system urandom is initialized (at least on Linux 3.17 and newer).
440	n/a
441	n/a	Prefer getrandom() and getentropy() over reading directly /dev/urandom
442	n/a	because these functions don't need file descriptors and so avoid ENFILE or
443	n/a	EMFILE errors (too many open files): see the issue #18756.
444	n/a
445	n/a	Only the getrandom() function supports non-blocking mode.
446	n/a
447	n/a	Only use RNG running in the kernel. They are more secure because it is
448	n/a	harder to get the internal state of a RNG running in the kernel land than a
449	n/a	RNG running in the user land. The kernel has a direct access to the hardware
450	n/a	and has access to hardware RNG, they are used as entropy sources.
451	n/a
452	n/a	Note: the OpenSSL RAND_pseudo_bytes() function does not automatically reseed
453	n/a	its RNG on fork(), two child processes (with the same pid) generate the same
454	n/a	random numbers: see issue #18747. Kernel RNGs don't have this issue,
455	n/a	they have access to good quality entropy sources.
456	n/a
457	n/a	If raise is zero:
458	n/a
459	n/a	- Don't raise an exception on error
460	n/a	- Don't call the Python signal handler (don't call PyErr_CheckSignals()) if
461	n/a	a function fails with EINTR: retry directly the interrupted function
462	n/a	- Don't release the GIL to call functions.
463	n/a	*/
464	n/a	static int
465	n/a	pyurandom(void *buffer, Py_ssize_t size, int blocking, int raise)
466	n/a	{
467	n/a	#if defined(PY_GETRANDOM) \|\| defined(PY_GETENTROPY)
468	n/a	int res;
469	n/a	#endif
470	n/a
471	n/a	if (size < 0) {
472	n/a	if (raise) {
473	n/a	PyErr_Format(PyExc_ValueError,
474	n/a	"negative argument not allowed");
475	n/a	}
476	n/a	return -1;
477	n/a	}
478	n/a
479	n/a	if (size == 0) {
480	n/a	return 0;
481	n/a	}
482	n/a
483	n/a	#ifdef MS_WINDOWS
484	n/a	return win32_urandom((unsigned char *)buffer, size, raise);
485	n/a	#else
486	n/a
487	n/a	#if defined(PY_GETRANDOM) \|\| defined(PY_GETENTROPY)
488	n/a	#ifdef PY_GETRANDOM
489	n/a	res = py_getrandom(buffer, size, blocking, raise);
490	n/a	#else
491	n/a	res = py_getentropy(buffer, size, raise);
492	n/a	#endif
493	n/a	if (res < 0) {
494	n/a	return -1;
495	n/a	}
496	n/a	if (res == 1) {
497	n/a	return 0;
498	n/a	}
499	n/a	/* getrandom() or getentropy() function is not available: failed with
500	n/a	ENOSYS or EPERM. Fall back on reading from /dev/urandom. */
501	n/a	#endif
502	n/a
503	n/a	return dev_urandom(buffer, size, raise);
504	n/a	#endif
505	n/a	}
506	n/a
507	n/a	/* Fill buffer with size pseudo-random bytes from the operating system random
508	n/a	number generator (RNG). It is suitable for most cryptographic purposes
509	n/a	except long living private keys for asymmetric encryption.
510	n/a
511	n/a	On Linux 3.17 and newer, the getrandom() syscall is used in blocking mode:
512	n/a	block until the system urandom entropy pool is initialized (128 bits are
513	n/a	collected by the kernel).
514	n/a
515	n/a	Return 0 on success. Raise an exception and return -1 on error. */
516	n/a	int
517	n/a	_PyOS_URandom(void *buffer, Py_ssize_t size)
518	n/a	{
519	n/a	return pyurandom(buffer, size, 1, 1);
520	n/a	}
521	n/a
522	n/a	/* Fill buffer with size pseudo-random bytes from the operating system random
523	n/a	number generator (RNG). It is not suitable for cryptographic purpose.
524	n/a
525	n/a	On Linux 3.17 and newer (when getrandom() syscall is used), if the system
526	n/a	urandom is not initialized yet, the function returns "weak" entropy read
527	n/a	from /dev/urandom.
528	n/a
529	n/a	Return 0 on success. Raise an exception and return -1 on error. */
530	n/a	int
531	n/a	_PyOS_URandomNonblock(void *buffer, Py_ssize_t size)
532	n/a	{
533	n/a	return pyurandom(buffer, size, 0, 1);
534	n/a	}
535	n/a
536	n/a	void
537	n/a	_PyRandom_Init(void)
538	n/a	{
539	n/a	char *env;
540	n/a	unsigned char secret = (unsigned char )&_Py_HashSecret.uc;
541	n/a	Py_ssize_t secret_size = sizeof(_Py_HashSecret_t);
542	n/a	Py_BUILD_ASSERT(sizeof(_Py_HashSecret_t) == sizeof(_Py_HashSecret.uc));
543	n/a
544	n/a	if (_Py_HashSecret_Initialized)
545	n/a	return;
546	n/a	_Py_HashSecret_Initialized = 1;
547	n/a
548	n/a	/*
549	n/a	Hash randomization is enabled. Generate a per-process secret,
550	n/a	using PYTHONHASHSEED if provided.
551	n/a	*/
552	n/a
553	n/a	env = Py_GETENV("PYTHONHASHSEED");
554	n/a	if (env && *env != '\0' && strcmp(env, "random") != 0) {
555	n/a	char *endptr = env;
556	n/a	unsigned long seed;
557	n/a	seed = strtoul(env, &endptr, 10);
558	n/a	if (*endptr != '\0'
559	n/a	\|\| seed > 4294967295UL
560	n/a	\|\| (errno == ERANGE && seed == ULONG_MAX))
561	n/a	{
562	n/a	Py_FatalError("PYTHONHASHSEED must be \"random\" or an integer "
563	n/a	"in range [0; 4294967295]");
564	n/a	}
565	n/a	if (seed == 0) {
566	n/a	/* disable the randomized hash */
567	n/a	memset(secret, 0, secret_size);
568	n/a	}
569	n/a	else {
570	n/a	lcg_urandom(seed, secret, secret_size);
571	n/a	}
572	n/a	}
573	n/a	else {
574	n/a	int res;
575	n/a
576	n/a	/* _PyRandom_Init() is called very early in the Python initialization
577	n/a	and so exceptions cannot be used (use raise=0).
578	n/a
579	n/a	_PyRandom_Init() must not block Python initialization: call
580	n/a	pyurandom() is non-blocking mode (blocking=0): see the PEP 524. */
581	n/a	res = pyurandom(secret, secret_size, 0, 0);
582	n/a	if (res < 0) {
583	n/a	Py_FatalError("failed to get random numbers to initialize Python");
584	n/a	}
585	n/a	}
586	n/a	}
587	n/a
588	n/a	void
589	n/a	_PyRandom_Fini(void)
590	n/a	{
591	n/a	#ifdef MS_WINDOWS
592	n/a	if (hCryptProv) {
593	n/a	CryptReleaseContext(hCryptProv, 0);
594	n/a	hCryptProv = 0;
595	n/a	}
596	n/a	#else
597	n/a	dev_urandom_close();
598	n/a	#endif
599	n/a	}