Tunnel: Conditional capabilities, fix RNG usage