Use ProcessPrng on Windows

[josephlr]

Use ProcessPrng on Windows 10 and up, and use RtlGenRandom on older legacy Windows versions. Don't use BCryptGenRandom due to stability issues.

[briansmith]

Besides the lines I commented on, I didn't review the rest.

[josephlr]

@briansmith the above are really good point w.r.t. sandboxing. I think that it would be good to have general documentation along the lines of "before starting a sandbox, you should first successfully call getrandom() on a non-empty buffer". That should be good platform-agnostic advice, and will handle things like LoadLibrary and libc::dlsym.

More generally, this won't work inside many sandboxes, including Chromium's.

I think that this won't cause issues in some sandboxes provided that ProcessPRNG is already loaded. IIRC the sandbox only complains on loading a new dll, not upon looking up a symbol from an already loaded DLL. Regardless, having specific documentation will be good here.

[josephlr]

@newpavlov and @briansmith this is now ready for review!

[newpavlov]

Other than the two minor nits, it looks good to me. But as I noted in the issue, I would prefer if we released this change as v0.3.

[briansmith]

It's unfortunate to have this ugliness without the program that generated it to confirm that it actually created this ugliness. However, I also think it's fine because of how repr(transparent) works so it isn't the end of the world.

[josephlr]

I think this is a good point. For both APIs I didn't directly use the output of windows-bindgen, but instead took that output as a starting point, then deleted lines until I got code that looked decent.

I think that referencing windows-bindgen in the comments at all was misleading, so I changed the comments to just reference the API metadata names directly. Given that, I also changed the BOOL/BOOLEAN types to just be typedefs (which is more honest IMO).

[josephlr]

For reference, here's the full output for running windows-bindgen with the following arguments:

// Bindings generated by `windows-bindgen` 0.56.0#![allow( non_snake_case, non_upper_case_globals, non_camel_case_types, dead_code, clippy::all)]#[inline]pubunsafefnRtlGenRandom(randombuffer:*mut core::ffi::c_void,randombufferlength:u32,) -> BOOLEAN{
windows_targets::link!("advapi32.dll""system""SystemFunction036"fnRtlGenRandom(randombuffer :*mut core::ffi::c_void, randombufferlength :u32) -> BOOLEAN);RtlGenRandom(randombuffer, randombufferlength)}#[inline]pubunsafefnProcessPrng(pbdata:&mut[u8]) -> BOOL{
windows_targets::link!("bcryptprimitives.dll""system"fnProcessPrng(pbdata :*mutu8, cbdata :usize) -> BOOL);ProcessPrng(
core::mem::transmute(pbdata.as_ptr()),
pbdata.len().try_into().unwrap(),)}#[repr(transparent)]#[derive(PartialEq,Eq)]pubstructBOOL(pubi32);implDefaultforBOOL{fndefault() -> Self{unsafe{ core::mem::zeroed()}}}implCloneforBOOL{fnclone(&self) -> Self{*self}}implCopyforBOOL{}impl core::fmt::DebugforBOOL{fnfmt(&self,f:&mut core::fmt::Formatter<'_>) -> core::fmt::Result{
f.debug_tuple("BOOL").field(&self.0).finish()}}impl windows_core::TypeKindforBOOL{typeTypeKind = windows_core::CopyType;}#[repr(transparent)]#[derive(PartialEq,Eq)]pubstructBOOLEAN(pubu8);implDefaultforBOOLEAN{fndefault() -> Self{unsafe{ core::mem::zeroed()}}}implCloneforBOOLEAN{fnclone(&self) -> Self{*self}}implCopyforBOOLEAN{}impl core::fmt::DebugforBOOLEAN{fnfmt(&self,f:&mut core::fmt::Formatter<'_>) -> core::fmt::Result{
f.debug_tuple("BOOLEAN").field(&self.0).finish()}}impl windows_core::TypeKindforBOOLEAN{typeTypeKind = windows_core::CopyType;}pubconstTRUE:BOOL = BOOL(1i32);