update alias

management/internals/modules/agentnetwork/labelgen/labelgen.go

@@ -3,9 +3,10 @@ package labelgen
 
 import (
 	"fmt"
-	"math/rand"
 	"sort"
 	"sync"
+
+	"github.com/netbirdio/netbird/management/server/util"
 )
 
 // pickAttempts caps the random retries before falling back to the
@@ -40,16 +41,15 @@ func uniqueWords() []string {
 // PickUnique selects a label not already in `taken`. It tries up to
 // pickAttempts random picks; on exhaustion it scans the deduplicated
 // wordlist for any remaining free entry, and if none is left appends
-// `-<fallbackSuffix>` to a deterministic word and returns. The caller
-// is responsible for seeding rng (math/rand).
-func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string) string {
+// `-<fallbackSuffix>` to a random word and returns.
+func PickUnique(taken map[string]struct{}, fallbackSuffix string) string {
 	pool := uniqueWords()
 	if len(pool) == 0 {
 		return fallbackSuffix
 	}
 
 	for i := 0; i < pickAttempts; i++ {
-		w := pool[rng.Intn(len(pool))]
+		w := pool[util.RandIntn(len(pool))]
 		if _, ok := taken[w]; !ok {
 			return w
 		}
@@ -61,6 +61,6 @@ func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string
 		}
 	}
 
-	w := pool[rng.Intn(len(pool))]
+	w := pool[util.RandIntn(len(pool))]
 	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
 }

management/internals/modules/agentnetwork/labelgen/labelgen_test.go

@@ -1,7 +1,7 @@
 package labelgen
 
 import (
-	"math/rand"
+	"slices"
 	"strings"
 	"testing"
 
@@ -9,19 +9,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestPickUnique_DeterministicWithSeededRng locks the property the
-// caller relies on: same seed + same taken set → same pick. Without
-// that, the bootstrap flow can't reproduce a label across retries.
-func TestPickUnique_DeterministicWithSeededRng(t *testing.T) {
-	taken := map[string]struct{}{}
+// TestPickUnique_ReturnsWordFromPool confirms a pick against an empty
+// taken set is always drawn verbatim from the wordlist.
+func TestPickUnique_ReturnsWordFromPool(t *testing.T) {
+	got := PickUnique(map[string]struct{}{}, "abcd")
 
-	rngA := rand.New(rand.NewSource(42))
-	rngB := rand.New(rand.NewSource(42))
-
-	a := PickUnique(rngA, taken, "abcd")
-	b := PickUnique(rngB, taken, "abcd")
-
-	assert.Equal(t, a, b, "Same seed and taken set must produce identical pick")
+	assert.True(t, slices.Contains(uniqueWords(), got), "Pick %q must be drawn from the wordlist", got)
 }
 
 // TestPickUnique_AvoidsTakenWordsWhenMostAreReserved seeds taken with
@@ -46,8 +39,7 @@ func TestPickUnique_AvoidsTakenWordsWhenMostAreReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(7))
-	got := PickUnique(rng, taken, "abcd")
+	got := PickUnique(taken, "abcd")
 
 	_, isFree := free[got]
 	assert.True(t, isFree, "PickUnique must return one of the free words; got %q", got)
@@ -65,8 +57,7 @@ func TestPickUnique_FallsBackWhenAllReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(99))
-	got := PickUnique(rng, taken, "abcd")
+	got := PickUnique(taken, "abcd")
 
 	assert.True(t, strings.HasSuffix(got, "-abcd"), "Exhausted pool must produce <word>-<suffix>; got %q", got)
 

management/internals/modules/agentnetwork/manager.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math/rand"
 	"slices"
 	"strings"
 	"sync"
@@ -128,11 +127,6 @@ type managerImpl struct {
 	// accountID, then by synthesised service ID.
 	reconcileMu    sync.Mutex
 	reconcileCache map[string]map[string]*proto.ProxyMapping
-
-	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
-	// state; concurrent provider creates would otherwise race.
-	labelRngMu sync.Mutex
-	labelRng   *rand.Rand
 }
 
 // NewManager constructs the persistent Agent Network manager. The
@@ -152,7 +146,6 @@ func NewManager(
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
 		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
-		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
 
@@ -658,9 +651,7 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 		suffix = suffix[:4]
 	}
 
-	m.labelRngMu.Lock()
-	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
-	m.labelRngMu.Unlock()
+	subdomain := labelgen.PickUnique(taken, suffix)
 
 	now := time.Now().UTC()
 	settings := &types.Settings{

management/server/account.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"os"
@@ -63,7 +62,7 @@ const (
 type userLoggedInOnce bool
 
 func cacheEntryExpiration() time.Duration {
-	r := rand.Intn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
+	r := util.RandIntn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
 	return time.Duration(r) * time.Millisecond
 }
 
@@ -2459,8 +2458,7 @@ func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transacti
 		return transaction.UpdateAccountNetworkV6(ctx, accountID, network.NetV6)
 	}
 	if network.NetV6.IP == nil {
-		r := rand.New(rand.NewSource(time.Now().UnixNano()))
-		network.NetV6 = types.AllocateIPv6Subnet(r)
+		network.NetV6 = types.AllocateIPv6Subnet()
 
 		// Sync settings to match the allocated subnet so SaveAccountSettings persists it.
 		ones, _ := network.NetV6.Mask.Size()

management/server/group_ipv6_test.go

@@ -2,7 +2,6 @@ package server
 
 import (
 	"context"
-	"math/rand"
 	"testing"
 	"time"
 
@@ -28,7 +27,7 @@ func TestGroupIPv6Assignment(t *testing.T) {
 	require.NoError(t, err)
 
 	// Allocate IPv6 subnet for the account
-	account.Network.NetV6 = types.AllocateIPv6Subnet(rand.New(rand.NewSource(time.Now().UnixNano())))
+	account.Network.NetV6 = types.AllocateIPv6Subnet()
 	require.NoError(t, am.Store.SaveAccount(ctx, account))
 
 	// Create setup key

management/server/idp/util.go

@@ -2,11 +2,12 @@ package idp
 
 import (
 	"encoding/json"
-	"math/rand"
 	"net/url"
 	"os"
 	"strings"
 	"time"
+
+	"github.com/netbirdio/netbird/management/server/util"
 )
 
 var (
@@ -33,31 +34,32 @@ func GeneratePassword(passwordLength, minSpecialChar, minNum, minUpperCase int)
 
 	//Set special character
 	for i := 0; i < minSpecialChar; i++ {
-		random := rand.Intn(len(specialCharSet))
+		random := util.RandIntn(len(specialCharSet))
 		password.WriteString(string(specialCharSet[random]))
 	}
 
 	//Set numeric
 	for i := 0; i < minNum; i++ {
-		random := rand.Intn(len(numberSet))
+		random := util.RandIntn(len(numberSet))
 		password.WriteString(string(numberSet[random]))
 	}
 
 	//Set uppercase
 	for i := 0; i < minUpperCase; i++ {
-		random := rand.Intn(len(upperCharSet))
+		random := util.RandIntn(len(upperCharSet))
 		password.WriteString(string(upperCharSet[random]))
 	}
 
 	remainingLength := passwordLength - minSpecialChar - minNum - minUpperCase
 	for i := 0; i < remainingLength; i++ {
-		random := rand.Intn(len(allCharSet))
+		random := util.RandIntn(len(allCharSet))
 		password.WriteString(string(allCharSet[random]))
 	}
 	inRune := []rune(password.String())
-	rand.Shuffle(len(inRune), func(i, j int) {
+	for i := len(inRune) - 1; i > 0; i-- {
+		j := util.RandIntn(i + 1)
 		inRune[i], inRune[j] = inRune[j], inRune[i]
-	})
+	}
 	return string(inRune)
 }
 

management/server/types/aliases.go

@@ -2,7 +2,6 @@ package types
 
 import (
 	"context"
-	"math/rand"
 	"net"
 	"net/netip"
 
@@ -86,8 +85,8 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
 }
 
-func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
-	return sharedtypes.AllocateIPv6Subnet(r)
+func AllocateIPv6Subnet() net.IPNet {
+	return sharedtypes.AllocateIPv6Subnet()
 }
 
 func NewNetwork() *Network {

management/server/util/util.go

@@ -1,5 +1,20 @@
 package util
 
+import (
+	"crypto/rand"
+	"math/big"
+)
+
+// RandIntn returns a uniformly distributed int in [0, n) sourced from
+// crypto/rand. It panics if n <= 0 or the platform randomness source fails.
+func RandIntn(n int) int {
+	v, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
+	if err != nil {
+		panic(err)
+	}
+	return int(v.Int64())
+}
+
 // Difference returns the elements in `a` that aren't in `b`.
 func Difference(a, b []string) []string {
 	mb := make(map[string]struct{}, len(b))

shared/management/types/network.go

@@ -1,20 +1,20 @@
 package types
 
 import (
+	"crypto/rand"
 	"encoding/binary"
 	"fmt"
-	"math/rand"
 	"net"
 	"net/netip"
 	"slices"
 	"sync"
-	"time"
 
 	"github.com/c-robinson/iplib"
 	"github.com/rs/xid"
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -171,14 +171,12 @@ func NewNetwork() *Network {
 	n := iplib.NewNet4(net.ParseIP("100.64.0.0"), NetSize)
 	sub, _ := n.Subnet(SubnetSize)
 
-	s := rand.NewSource(time.Now().UnixNano())
-	r := rand.New(s)
-	intn := r.Intn(len(sub))
+	intn := util.RandIntn(len(sub))
 
 	return &Network{
 		Identifier: xid.New().String(),
 		Net:        sub[intn].IPNet,
-		NetV6:      AllocateIPv6Subnet(r),
+		NetV6:      AllocateIPv6Subnet(),
 		Dns:        "",
 		Serial:     0,
 	}
@@ -188,18 +186,13 @@ func NewNetwork() *Network {
 // The format follows RFC 4193 section 3.1: fd + 40-bit Global ID + 16-bit Subnet ID.
 // The Global ID and Subnet ID are randomized (simplified from the SHA-1 algorithm
 // in section 3.2.2), giving 2^56 possible /64 subnets across all accounts.
-func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
+func AllocateIPv6Subnet() net.IPNet {
 	ip := make(net.IP, 16)
 	ip[0] = 0xfd
-	// Bytes 1-5: 40-bit random Global ID
-	ip[1] = byte(r.Intn(256))
-	ip[2] = byte(r.Intn(256))
-	ip[3] = byte(r.Intn(256))
-	ip[4] = byte(r.Intn(256))
-	ip[5] = byte(r.Intn(256))
-	// Bytes 6-7: 16-bit random Subnet ID
-	ip[6] = byte(r.Intn(256))
-	ip[7] = byte(r.Intn(256))
+	// Bytes 1-5: 40-bit random Global ID, bytes 6-7: 16-bit random Subnet ID
+	if _, err := rand.Read(ip[1:8]); err != nil {
+		panic(err)
+	}
 
 	return net.IPNet{
 		IP:   ip,
@@ -233,10 +226,22 @@ func (n *Network) Copy() *Network {
 	}
 }
 
+// validateIPv4Prefix ensures the prefix is an IPv4 network with assignable host addresses.
+func validateIPv4Prefix(prefix netip.Prefix) error {
+	if !prefix.IsValid() || !prefix.Addr().Is4() || prefix.Bits() < 1 || prefix.Bits() >= 31 {
+		return fmt.Errorf("invalid IPv4 subnet: %s", prefix.String())
+	}
+	return nil
+}
+
 // AllocatePeerIP picks an available IP from a netip.Prefix.
 // This method considers already taken IPs and reuses IPs if there are gaps in takenIps.
 // E.g. if prefix=100.30.0.0/16 and takenIps=[100.30.0.1, 100.30.0.4] then the result would be 100.30.0.2 or 100.30.0.3.
 func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, error) {
+	if err := validateIPv4Prefix(prefix); err != nil {
+		return netip.Addr{}, err
+	}
+
 	b := prefix.Masked().Addr().As4()
 	baseIP := binary.BigEndian.Uint32(b[:])
 	hostBits := 32 - prefix.Bits()
@@ -247,15 +252,17 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 	taken[baseIP+totalIPs-1] = struct{}{} // reserve broadcast IP
 
 	for _, ip := range takenIps {
+		if !ip.Is4() {
+			continue
+		}
 		ab := ip.As4()
 		taken[binary.BigEndian.Uint32(ab[:])] = struct{}{}
 	}
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
 	maxAttempts := (int(totalIPs) - len(taken)) / 100
 
 	for i := 0; i < maxAttempts; i++ {
-		offset := uint32(rng.Intn(int(totalIPs-2))) + 1
+		offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
 		candidate := baseIP + offset
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
@@ -274,13 +281,16 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 
 // AllocateRandomPeerIP picks a random available IP from a netip.Prefix.
 func AllocateRandomPeerIP(prefix netip.Prefix) (netip.Addr, error) {
+	if err := validateIPv4Prefix(prefix); err != nil {
+		return netip.Addr{}, err
+	}
+
 	b := prefix.Masked().Addr().As4()
 	baseIP := binary.BigEndian.Uint32(b[:])
 	hostBits := 32 - prefix.Bits()
 	totalIPs := uint32(1 << hostBits)
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	offset := uint32(rng.Intn(int(totalIPs-2))) + 1
+	offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
 
 	candidate := baseIP + offset
 	return uint32ToIP(candidate), nil
@@ -296,23 +306,26 @@ func AllocateRandomPeerIPv6(prefix netip.Prefix) (netip.Addr, error) {
 
 	ip := prefix.Addr().As16()
 
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-
 	// Determine which byte the host bits start in
 	firstHostByte := ones / 8
 	// If the prefix doesn't end on a byte boundary, handle the partial byte
 	partialBits := ones % 8
 
+	var rnd [16]byte
+	if _, err := rand.Read(rnd[firstHostByte:]); err != nil {
+		return netip.Addr{}, err
+	}
+
 	if partialBits > 0 {
 		// Keep the network bits in the partial byte, randomize the rest
 		hostMask := byte(0xff >> partialBits)
-		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (byte(rng.Intn(256)) & hostMask)
+		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (rnd[firstHostByte] & hostMask)
 		firstHostByte++
 	}
 
 	// Randomize remaining full host bytes
 	for i := firstHostByte; i < 16; i++ {
-		ip[i] = byte(rng.Intn(256))
+		ip[i] = rnd[i]
 	}
 
 	// Avoid all-zeros and all-ones host parts by checking only host bits.

shared/management/types/network_test.go

@@ -143,6 +143,34 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 	}
 }
 
+func TestAllocateIPv4InvalidPrefixes(t *testing.T) {
+	prefixes := []netip.Prefix{
+		{},
+		netip.MustParsePrefix("0.0.0.0/0"),
+		netip.MustParsePrefix("192.168.1.0/31"),
+		netip.MustParsePrefix("192.168.1.1/32"),
+		netip.MustParsePrefix("fd12:3456:7890:abcd::/64"),
+	}
+
+	for _, prefix := range prefixes {
+		t.Run(prefix.String(), func(t *testing.T) {
+			_, err := AllocatePeerIP(prefix, nil)
+			assert.Error(t, err)
+
+			_, err = AllocateRandomPeerIP(prefix)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestAllocatePeerIPIgnoresNonIPv4TakenIPs(t *testing.T) {
+	prefix := netip.MustParsePrefix("192.168.1.0/29")
+
+	ip, err := AllocatePeerIP(prefix, []netip.Addr{netip.MustParseAddr("fd12:3456:7890:abcd::1")})
+	require.NoError(t, err)
+	assert.True(t, prefix.Contains(ip))
+}
+
 func TestGenerateIPs(t *testing.T) {
 	ipNet := net.IPNet{IP: net.ParseIP("100.64.0.0"), Mask: net.IPMask{255, 255, 255, 0}}
 	ips, ipsLen := generateIPs(&ipNet, map[string]struct{}{"100.64.0.0": {}})