This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author christian.heimes
Recipients christian.heimes, vstinner
Date 2013-08-15.12:34:59
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
A couple of reports and check-in messages like

  Postgres / pgcrypto CVE-2013-1900

suggests that OpenSSL's PRNG should be reset or re-seeded after fork(). Otherwise child processes can generate the same or similar pseudo random values.

Python doesn't have an API to run code before and after fork yet. The patch uses pthread_atfork() for the task. It's available on all pthread platforms -- which are all official supported platforms that have fork(), too.

The patch doesn't use RAND_cleanup() like Postgres because child process would hav to initial the PRNG again by opening and reading from /dev/urandom. The atfork prepare hook pulls from random bytes from the PRNG and stores them in a static buffer. The child handler seeds the PRNG from that buffer + pid + current time. PID and current time are mixed into the state to extenuate race conditions.
Date User Action Args
2013-08-15 12:35:01christian.heimessetrecipients: + christian.heimes, vstinner
2013-08-15 12:35:01christian.heimessetmessageid: <>
2013-08-15 12:35:01christian.heimeslinkissue18747 messages
2013-08-15 12:35:01christian.heimescreate