[client] Clear the login-required latch after installing the new client

Run() released the latch before setState() swapped in the fresh connect
client, so Status() calls landing in that window still read the previous
run's context state — which holds the NeedsLogin that prompted the login
— and re-latched what had just been cleared. The generation guard does
not catch this: the clear precedes the observation, so the generation
matches and the store counts as current. The state-change goroutine
calls Status() on every recorder tick, and the login path emits several,
so the window is ordinary traffic rather than a rare interleaving.

Clear once the replacement client is installed instead.

client/android/client.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"os"
 	"slices"
-	"strings"
 	"sync"
 	"time"
 
@@ -76,6 +75,24 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+
+	stateChangeMu    sync.Mutex
+	stateChangeSubID string
+	eventSub         *peer.EventSubscription
+	// Closed to stop the watch goroutines from delivering buffered items to a
+	// listener that has been removed or replaced. See stopStateChangeWatchLocked.
+	stateChangeDone chan struct{}
+
+	// Latched "the server wants an interactive login": survives the engine
+	// restarts that replace the run loop's context state. See Client.Status.
+	// Guarded by loginRequiredMu together with loginCleared, which counts
+	// clears so a stale observation cannot re-latch over one.
+	loginRequiredMu sync.Mutex
+	loginRequired   bool
+	loginCleared    uint64
+
+	extendMu     sync.Mutex
+	extendCancel context.CancelFunc
 }
 
 func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
@@ -149,11 +166,16 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	if err != nil {
 		return err
 	}
-
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
 	c.setState(cfg, cacheDir, connectClient)
+	// This path runs the interactive SSO flow, so reaching here means the peer
+	// is authenticated again — release the latch Status() reports from. Clear
+	// only once the fresh connect client is installed: until then Status()
+	// still reads the previous run's context state, which holds the NeedsLogin
+	// that prompted this login, and would re-latch what was just cleared.
+	c.clearLoginRequired()
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -300,13 +322,6 @@ func (c *Client) SetInfoLogLevel() {
 // PeersList return with the list of the PeerInfos
 func (c *Client) PeersList() *PeerInfoArray {
 
-	// The recorder only caches transfer counters and handshake times; nothing
-	// refreshes them on its own, so without this they read as zero. The desktop
-	// daemon does the same before serving a full peer status.
-	if err := c.recorder.RefreshWireGuardStats(); err != nil {
-		log.Debugf("failed to refresh WireGuard stats: %v", err)
-	}
-
 	fullStatus := c.recorder.GetFullStatus()
 
 	peerInfos := make([]PeerInfo, len(fullStatus.Peers))
@@ -317,20 +332,6 @@ func (c *Client) PeersList() *PeerInfoArray {
 			FQDN:       p.FQDN,
 			ConnStatus: int(p.ConnStatus),
 			Routes:     PeerRoutes{routes: maps.Keys(p.GetRoutes())},
-
-			PubKey:                     p.PubKey,
-			Latency:                    formatDuration(p.Latency),
-			LatencyMs:                  p.Latency.Milliseconds(),
-			BytesRx:                    p.BytesRx,
-			BytesTx:                    p.BytesTx,
-			ConnStatusUpdate:           formatTime(p.ConnStatusUpdate),
-			Relayed:                    p.Relayed,
-			RosenpassEnabled:           p.RosenpassEnabled,
-			LastWireguardHandshake:     formatTime(p.LastWireguardHandshake),
-			LocalIceCandidateType:      p.LocalIceCandidateType,
-			RemoteIceCandidateType:     p.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  p.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: p.RemoteIceCandidateEndpoint,
 		}
 		peerInfos[n] = pi
 	}
@@ -461,6 +462,10 @@ func (c *Client) RemoveConnectionListener() {
 	c.recorder.RemoveConnectionListener()
 }
 
+func (c *Client) toggleRoute(command routeCommand) error {
+	return command.toggleRoute()
+}
+
 func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	client := c.getConnectClient()
 	if client == nil {
@@ -480,22 +485,22 @@ func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	return manager, nil
 }
 
-func (c *Client) SelectRoute(id string) error {
+func (c *Client) SelectRoute(route string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return manager.SelectRoutes([]route.NetID{route.NetID(id)}, true)
+	return c.toggleRoute(selectRouteCommand{route: route, manager: manager})
 }
 
-func (c *Client) DeselectRoute(id string) error {
+func (c *Client) DeselectRoute(route string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return manager.DeselectRoutes([]route.NetID{route.NetID(id)})
+	return c.toggleRoute(deselectRouteCommand{route: route, manager: manager})
 }
 
 // getNetworkDomainsFromRoute extracts domains from a route and enriches each domain
@@ -530,28 +535,3 @@ func exportEnvList(list *EnvList) {
 		}
 	}
 }
-
-// formatDuration renders a duration for display, trimming the fractional part
-// to two digits so latencies read as "12.34ms" rather than "12.345678ms".
-func formatDuration(d time.Duration) string {
-	ds := d.String()
-	dotIndex := strings.Index(ds, ".")
-	if dotIndex == -1 {
-		return ds
-	}
-
-	endIndex := min(dotIndex+3, len(ds))
-
-	// Skip the remaining digits so only the unit suffix is appended back.
-	unitStart := endIndex
-	for unitStart < len(ds) && ds[unitStart] >= '0' && ds[unitStart] <= '9' {
-		unitStart++
-	}
-	return ds[:endIndex] + ds[unitStart:]
-}
-
-// formatTime renders a timestamp in UTC using a fixed layout. The zero time is
-// passed through as-is so the UI can recognise it and show "never" instead.
-func formatTime(t time.Time) string {
-	return t.UTC().Format("2006-01-02 15:04:05")
-}

client/android/peer_notifier.go

@@ -12,30 +12,12 @@ const (
 )
 
 // PeerInfo describe information about the peers. It designed for the UI usage
-//
-// The fields below ConnStatus back the peer detail screen. Durations and times
-// are pre-formatted into strings so the UI does not have to know Go's layouts;
-// Latency is additionally exposed as LatencyMs for colour coding.
 type PeerInfo struct {
 	IP         string
 	IPv6       string
 	FQDN       string
 	ConnStatus int
 	Routes     PeerRoutes
-
-	PubKey                     string
-	Latency                    string
-	LatencyMs                  int64
-	BytesRx                    int64
-	BytesTx                    int64
-	ConnStatusUpdate           string
-	Relayed                    bool
-	RosenpassEnabled           bool
-	LastWireguardHandshake     string
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
 }
 
 func (p *PeerInfo) GetPeerRoutes() *PeerRoutes {

client/android/route_command.go

@@ -0,0 +1,70 @@
+//go:build android
+
+package android
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/client/internal/routemanager"
+	"github.com/netbirdio/netbird/route"
+)
+
+func executeRouteToggle(id string, manager routemanager.Manager,
+	operationName string,
+	routeOperation func(routes []route.NetID, allRoutes []route.NetID) error) error {
+	netID := route.NetID(id)
+	routes := []route.NetID{netID}
+
+	routesMap := manager.GetClientRoutesWithNetID()
+	routes = route.ExpandV6ExitPairs(routes, routesMap)
+
+	log.Debugf("%s with ids: %v", operationName, routes)
+
+	if err := routeOperation(routes, maps.Keys(routesMap)); err != nil {
+		log.Debugf("error when %s: %s", operationName, err)
+		return fmt.Errorf("error %s: %w", operationName, err)
+	}
+
+	manager.TriggerSelection(manager.GetClientRoutes())
+
+	return nil
+}
+
+type routeCommand interface {
+	toggleRoute() error
+}
+
+type selectRouteCommand struct {
+	route   string
+	manager routemanager.Manager
+}
+
+func (s selectRouteCommand) toggleRoute() error {
+	routeSelector := s.manager.GetRouteSelector()
+	if routeSelector == nil {
+		return fmt.Errorf("no route selector available")
+	}
+
+	routeOperation := func(routes []route.NetID, allRoutes []route.NetID) error {
+		return routeSelector.SelectRoutes(routes, true, allRoutes)
+	}
+
+	return executeRouteToggle(s.route, s.manager, "selecting route", routeOperation)
+}
+
+type deselectRouteCommand struct {
+	route   string
+	manager routemanager.Manager
+}
+
+func (d deselectRouteCommand) toggleRoute() error {
+	routeSelector := d.manager.GetRouteSelector()
+	if routeSelector == nil {
+		return fmt.Errorf("no route selector available")
+	}
+
+	return executeRouteToggle(d.route, d.manager, "deselecting route", routeSelector.DeselectRoutes)
+}

client/android/session.go

@@ -0,0 +1,309 @@
+//go:build android
+
+package android
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+// StateChangeListener receives client state notifications.
+//
+// OnStateChanged is a payload-free wake-up whenever the state snapshot
+// changed: connection state, the run-loop status label (e.g. NeedsLogin) or
+// the session deadline. It mirrors the daemon's SubscribeStatus stream
+// trigger — on each signal the consumer pulls the fresh values via
+// Status() / SessionExpiresAtUnix().
+//
+// OnSessionExpiring forwards the engine's session-expiry warnings, fired at
+// sessionwatch.WarningLead before the deadline and again at FinalWarningLead
+// (finalWarning true). The second one is suppressed when the user dismissed
+// the first via DismissSessionWarning. The daemon turns the same events into
+// its tray notification.
+type StateChangeListener interface {
+	OnStateChanged()
+	OnSessionExpiring(expiresAtUnix int64, leadMinutes int64, finalWarning bool)
+}
+
+// Status returns the connect run-loop's status label — the same value the
+// desktop daemon serves in StatusResponse.Status. "NeedsLogin" means the
+// management server rejected the peer and an interactive login is required.
+//
+// The label is latched: the run loop keeps its status in a per-run context
+// state, which a restart replaces with a fresh Idle one, so an engine restart
+// (network change, always-on) would otherwise erase the fact that the peer
+// still needs to log in. Only a successful interactive login or extend clears
+// it — see clearLoginRequired.
+func (c *Client) Status() string {
+	latched, generation := c.loginRequiredState()
+	if latched {
+		return string(internal.StatusNeedsLogin)
+	}
+	cc := c.getConnectClient()
+	if cc == nil {
+		return string(internal.StatusIdle)
+	}
+	status := cc.Status()
+	if status == internal.StatusNeedsLogin {
+		c.latchLoginRequired(generation)
+	}
+	return string(status)
+}
+
+func (c *Client) loginRequiredState() (bool, uint64) {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	return c.loginRequired, c.loginCleared
+}
+
+// latchLoginRequired records a NeedsLogin observation, unless a clear landed
+// while the caller was reading the run loop's status: cc.Status() is read
+// outside the lock, so a login or extend completing in that window would
+// otherwise be undone by this stale observation, stranding the UI on
+// "login required" over a healthy session.
+func (c *Client) latchLoginRequired(observedGeneration uint64) {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	if c.loginCleared != observedGeneration {
+		return
+	}
+	c.loginRequired = true
+}
+
+// clearLoginRequired releases the latch after a successful interactive login
+// or session extend, and invalidates any observation already in flight.
+func (c *Client) clearLoginRequired() {
+	c.loginRequiredMu.Lock()
+	defer c.loginRequiredMu.Unlock()
+	c.loginRequired = false
+	c.loginCleared++
+}
+
+// SessionExpiresAtUnix returns the SSO session deadline as unix seconds, or 0
+// when no deadline is known (not SSO-registered, expiry disabled, or the
+// engine has not received one yet). A past value means the session expired.
+// Mirror of StatusResponse.sessionExpiresAt on the desktop daemon.
+func (c *Client) SessionExpiresAtUnix() int64 {
+	deadline := c.recorder.GetSessionExpiresAt()
+	if deadline.IsZero() {
+		return 0
+	}
+	return deadline.Unix()
+}
+
+// SetStateChangeListener registers the state notification listener.
+// Replaces any previously registered listener; remove it with
+// RemoveStateChangeListener.
+func (c *Client) SetStateChangeListener(listener StateChangeListener) {
+	c.stateChangeMu.Lock()
+	defer c.stateChangeMu.Unlock()
+	c.stopStateChangeWatchLocked()
+	if listener == nil {
+		return
+	}
+
+	// Both subscriptions are buffered (one pending tick, ten pending events),
+	// so unsubscribing is not enough to stop callbacks: the loops would drain
+	// what is already queued and deliver it to a listener the caller has
+	// already removed or replaced. Gate every callback on this registration's
+	// own signal, which is closed before unsubscribing.
+	done := make(chan struct{})
+	c.stateChangeDone = done
+
+	id, ch := c.recorder.SubscribeToStateChanges()
+	c.stateChangeSubID = id
+	// The channel is closed by UnsubscribeFromStateChanges, which ends the
+	// goroutine. Ticks are coalesced (buffer of one), so a burst of changes
+	// wakes the listener once.
+	go func() {
+		for range ch {
+			select {
+			case <-done:
+				return
+			default:
+			}
+			listener.OnStateChanged()
+		}
+	}()
+
+	c.eventSub = c.recorder.SubscribeToEvents()
+	go watchSessionWarnings(c.eventSub, listener, done)
+}
+
+// RemoveStateChangeListener unregisters the state notification listener.
+func (c *Client) RemoveStateChangeListener() {
+	c.stateChangeMu.Lock()
+	defer c.stateChangeMu.Unlock()
+	c.stopStateChangeWatchLocked()
+}
+
+// DismissSessionWarning records the user's "Dismiss" on the first expiry
+// warning and suppresses the final one for the current deadline. A refreshed
+// deadline re-arms both. No-op while the engine is not running.
+func (c *Client) DismissSessionWarning() {
+	cc := c.getConnectClient()
+	if cc == nil {
+		return
+	}
+	engine := cc.Engine()
+	if engine == nil {
+		return
+	}
+	engine.DismissSessionWarning()
+}
+
+// ExtendAuthSession runs the interactive SSO flow to obtain a fresh JWT and
+// asks the management server to extend the session deadline. The tunnel is
+// untouched: no resync, no reconnect. Async; the result arrives on the
+// listener. Mirror of the daemon's RequestExtendAuthSession /
+// WaitExtendAuthSession RPC pair, with URLOpener playing the "UI opens the
+// browser" role.
+//
+// Only one flow may be in flight: the PKCE step binds a fixed loopback port,
+// so a second concurrent flow would fail on that bind. Call
+// CancelExtendAuthSession when the user abandons the browser.
+func (c *Client) ExtendAuthSession(urlOpener URLOpener, isAndroidTV bool, resultListener ErrListener) {
+	ctx, err := c.beginExtend()
+	if err != nil {
+		resultListener.OnError(err)
+		return
+	}
+
+	go func() {
+		defer c.endExtend()
+		if err := c.extendAuthSession(ctx, urlOpener, isAndroidTV); err != nil {
+			resultListener.OnError(err)
+			return
+		}
+		resultListener.OnSuccess()
+	}()
+}
+
+// CancelExtendAuthSession aborts an in-flight ExtendAuthSession. The tunnel is
+// left alone — unlike the login flow, which cancels the whole client context
+// by stopping the engine. Without this the abandoned PKCE wait keeps its
+// loopback port for the full flow timeout and blocks every later attempt.
+// No-op when no flow is running.
+func (c *Client) CancelExtendAuthSession() {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		c.extendCancel()
+	}
+}
+
+func (c *Client) stopStateChangeWatchLocked() {
+	// Signal first, unsubscribe second: closing the channels only stops new
+	// items, and the loops would still hand whatever is buffered to a listener
+	// that is no longer registered.
+	if c.stateChangeDone != nil {
+		close(c.stateChangeDone)
+		c.stateChangeDone = nil
+	}
+	if c.stateChangeSubID != "" {
+		c.recorder.UnsubscribeFromStateChanges(c.stateChangeSubID)
+		c.stateChangeSubID = ""
+	}
+	if c.eventSub != nil {
+		// Closes the channel, which ends watchSessionWarnings.
+		c.recorder.UnsubscribeFromEvents(c.eventSub)
+		c.eventSub = nil
+	}
+}
+
+// watchSessionWarnings forwards the engine's session-expiry warnings to the
+// listener. The event stream also carries unrelated traffic — network-map
+// updates on every sync, DNS and route errors — so everything but an
+// AUTHENTICATION event carrying the session-warning marker is dropped. Exits
+// when the subscription is closed by UnsubscribeFromEvents, or earlier when
+// done is closed — the stream buffers up to ten events, and a deregistered
+// listener must not receive the ones already queued.
+func watchSessionWarnings(sub *peer.EventSubscription, listener StateChangeListener, done <-chan struct{}) {
+	for ev := range sub.Events() {
+		select {
+		case <-done:
+			return
+		default:
+		}
+		if ev.GetCategory() != cProto.SystemEvent_AUTHENTICATION {
+			continue
+		}
+		meta := ev.GetMetadata()
+		if meta[sessionwatch.MetaSessionWarning] != "true" {
+			// Other AUTHENTICATION events exist (e.g. a deadline rejected as
+			// out of range); they carry no warning marker.
+			continue
+		}
+		deadline, err := sessionwatch.ParseExpiresAt(meta[sessionwatch.MetaSessionExpiresAt])
+		if err != nil {
+			log.Warnf("session warning event with unparsable deadline: %v", err)
+			continue
+		}
+		lead, err := sessionwatch.ParseLeadMinutes(meta[sessionwatch.MetaSessionLeadMinutes])
+		if err != nil {
+			// Informational only — the deadline above is what drives the UI.
+			lead = 0
+		}
+		listener.OnSessionExpiring(deadline.Unix(), int64(lead),
+			meta[sessionwatch.MetaSessionFinal] == "true")
+	}
+}
+
+func (c *Client) beginExtend() (context.Context, error) {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		return nil, fmt.Errorf("session extend already in progress")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	c.extendCancel = cancel
+	return ctx, nil
+}
+
+func (c *Client) endExtend() {
+	c.extendMu.Lock()
+	defer c.extendMu.Unlock()
+	if c.extendCancel != nil {
+		c.extendCancel()
+		c.extendCancel = nil
+	}
+}
+
+func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
+	cfg, _, cc := c.stateSnapshot()
+	if cfg == nil || cc == nil {
+		return fmt.Errorf("engine is not running")
+	}
+	engine := cc.Engine()
+	if engine == nil {
+		return fmt.Errorf("engine is not initialized")
+	}
+
+	authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)
+	if err != nil {
+		return fmt.Errorf("failed to create auth client: %v", err)
+	}
+	defer authClient.Close()
+
+	a := &Auth{ctx: ctx, config: cfg}
+	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
+	if err != nil {
+		return fmt.Errorf("interactive sso login failed: %v", err)
+	}
+
+	if _, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse()); err != nil {
+		return err
+	}
+	c.clearLoginRequired()
+
+	go urlOpener.OnLoginSuccess()
+	return nil
+}

client/internal/conn_mgr.go

@@ -385,20 +385,11 @@ func inactivityThresholdEnv() *time.Duration {
 		return nil
 	}
 
-	// Documented format: a Go duration such as "30m" or "1h".
-	if d, err := time.ParseDuration(envValue); err == nil {
-		if d <= 0 {
-			return nil
-		}
-		return &d
+	parsedMinutes, err := strconv.Atoi(envValue)
+	if err != nil || parsedMinutes <= 0 {
+		return nil
 	}
 
-	// Backwards compatibility: a bare integer used to be interpreted as minutes.
-	if parsedMinutes, err := strconv.Atoi(envValue); err == nil && parsedMinutes > 0 {
-		d := time.Duration(parsedMinutes) * time.Minute
-		return &d
-	}
-
-	log.Warnf("invalid %s value %q: expected a Go duration such as 30m or 1h", lazyconn.EnvInactivityThreshold, envValue)
-	return nil
+	d := time.Duration(parsedMinutes) * time.Minute
+	return &d
 }

client/internal/conn_mgr_test.go

@@ -104,38 +104,3 @@ func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
 	close(done)
 	wg.Wait()
 }
-
-func TestInactivityThresholdEnv(t *testing.T) {
-	tests := []struct {
-		name string
-		val  string
-		want *time.Duration
-	}{
-		{name: "unset", val: "", want: nil},
-		{name: "go duration minutes", val: "30m", want: durPtr(30 * time.Minute)},
-		{name: "go duration hours", val: "1h", want: durPtr(time.Hour)},
-		{name: "go duration seconds", val: "90s", want: durPtr(90 * time.Second)},
-		{name: "bare integer is minutes (backwards compat)", val: "5", want: durPtr(5 * time.Minute)},
-		{name: "zero duration", val: "0s", want: nil},
-		{name: "zero integer", val: "0", want: nil},
-		{name: "negative duration", val: "-5m", want: nil},
-		{name: "garbage", val: "abc", want: nil},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(lazyconn.EnvInactivityThreshold, tc.val)
-			got := inactivityThresholdEnv()
-			switch {
-			case tc.want == nil && got != nil:
-				t.Fatalf("want nil, got %v", *got)
-			case tc.want != nil && got == nil:
-				t.Fatalf("want %v, got nil", *tc.want)
-			case tc.want != nil && *got != *tc.want:
-				t.Fatalf("want %v, got %v", *tc.want, *got)
-			}
-		})
-	}
-}
-
-func durPtr(d time.Duration) *time.Duration { return &d }

client/internal/connect.go

@@ -34,7 +34,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/internal/tunnelnotifier"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
@@ -137,13 +136,10 @@ func (c *ConnectClient) RunOniOS(
 	// Set GC percent to 5% to reduce memory usage as iOS only allows 50MB of memory for the extension.
 	debug.SetGCPercent(5)
 
-	notifier := tunnelnotifier.New(networkChangeListener, dnsManager)
-	defer notifier.Close()
-
 	mobileDependency := MobileDependency{
 		FileDescriptor:        fileDescriptor,
-		NetworkChangeListener: notifier,
-		DnsManager:            notifier,
+		NetworkChangeListener: networkChangeListener,
+		DnsManager:            dnsManager,
 		StateFilePath:         stateFilePath,
 		TempDir:               cacheDir,
 	}

client/internal/mobile_dependency.go

@@ -11,14 +11,12 @@ import (
 
 // MobileDependency collect all dependencies for mobile platform
 type MobileDependency struct {
-	// Android and iOS
-	NetworkChangeListener listener.NetworkChangeListener
-
 	// Android only
-	TunAdapter       device.TunAdapter
-	IFaceDiscover    stdnet.ExternalIFaceDiscover
-	HostDNSAddresses []netip.AddrPort
-	DnsReadyListener dns.ReadyListener
+	TunAdapter            device.TunAdapter
+	IFaceDiscover         stdnet.ExternalIFaceDiscover
+	NetworkChangeListener listener.NetworkChangeListener
+	HostDNSAddresses      []netip.AddrPort
+	DnsReadyListener      dns.ReadyListener
 
 	//	iOS only
 	DnsManager     dns.IosDnsManager

client/internal/routemanager/manager.go

@@ -52,10 +52,6 @@ type Manager interface {
 	UpdateRoutes(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	TriggerSelection(route.HAMap)
-	SelectRoutes(ids []route.NetID, appendRoute bool) error
-	DeselectRoutes(ids []route.NetID) error
-	SelectAllRoutes()
-	DeselectAllRoutes()
 	GetRouteSelector() *routeselector.RouteSelector
 	GetClientRoutes() route.HAMap
 	GetSelectedClientRoutes() route.HAMap
@@ -804,7 +800,7 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	var info exitNodeInfo
 
 	for haID, routes := range clientRoutes {
-		if !isExitNodeRoutes(routes) {
+		if !m.isExitNodeRoute(routes) {
 			continue
 		}
 
@@ -824,6 +820,13 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	return info
 }
 
+func (m *DefaultManager) isExitNodeRoute(routes []*route.Route) bool {
+	if len(routes) == 0 {
+		return false
+	}
+	return route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network)
+}
+
 func (m *DefaultManager) categorizeUserSelection(netID route.NetID, info *exitNodeInfo) {
 	if m.routeSelector.IsSelected(netID) {
 		info.userSelected = append(info.userSelected, netID)

client/internal/routemanager/mock.go

@@ -16,8 +16,6 @@ type MockManager struct {
 	ClassifyRoutesFunc           func(routes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	UpdateRoutesFunc             func(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	TriggerSelectionFunc         func(haMap route.HAMap)
-	SelectRoutesFunc             func(ids []route.NetID, appendRoute bool) error
-	DeselectRoutesFunc           func(ids []route.NetID) error
 	GetRouteSelectorFunc         func() *routeselector.RouteSelector
 	GetClientRoutesFunc          func() route.HAMap
 	GetSelectedClientRoutesFunc  func() route.HAMap
@@ -57,30 +55,6 @@ func (m *MockManager) TriggerSelection(networks route.HAMap) {
 	}
 }
 
-// SelectRoutes mock implementation of SelectRoutes from Manager interface
-func (m *MockManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
-	if m.SelectRoutesFunc != nil {
-		return m.SelectRoutesFunc(ids, appendRoute)
-	}
-	return nil
-}
-
-// DeselectRoutes mock implementation of DeselectRoutes from Manager interface
-func (m *MockManager) DeselectRoutes(ids []route.NetID) error {
-	if m.DeselectRoutesFunc != nil {
-		return m.DeselectRoutesFunc(ids)
-	}
-	return nil
-}
-
-// SelectAllRoutes mock implementation of SelectAllRoutes from Manager interface
-func (m *MockManager) SelectAllRoutes() {
-}
-
-// DeselectAllRoutes mock implementation of DeselectAllRoutes from Manager interface
-func (m *MockManager) DeselectAllRoutes() {
-}
-
 // GetRouteSelector mock implementation of GetRouteSelector from Manager interface
 func (m *MockManager) GetRouteSelector() *routeselector.RouteSelector {
 	if m.GetRouteSelectorFunc != nil {

client/internal/routemanager/notifier/notifier_ios.go

@@ -3,6 +3,7 @@
 package notifier
 
 import (
+	"container/list"
 	"net/netip"
 	"slices"
 	"sort"
@@ -15,12 +16,20 @@ import (
 
 type Notifier struct {
 	mu              sync.Mutex
+	cond            *sync.Cond
 	currentPrefixes []string
 	listener        listener.NetworkChangeListener
+	queue           *list.List
+	closed          bool
 }
 
 func NewNotifier() *Notifier {
-	return &Notifier{}
+	n := &Notifier{
+		queue: list.New(),
+	}
+	n.cond = sync.NewCond(&n.mu)
+	go n.deliverLoop()
+	return n
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
@@ -50,19 +59,44 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	sort.Strings(newNets)
 
 	n.mu.Lock()
-	defer n.mu.Unlock()
 	if slices.Equal(n.currentPrefixes, newNets) {
+		n.mu.Unlock()
 		return
 	}
 	n.currentPrefixes = newNets
-	if n.listener != nil {
-		n.listener.OnNetworkChanged(strings.Join(n.currentPrefixes, ","))
-	}
+	routes := strings.Join(n.currentPrefixes, ",")
+	n.queue.PushBack(routes)
+	n.cond.Signal()
+	n.mu.Unlock()
 }
 
 func (n *Notifier) Close() {
+	n.mu.Lock()
+	n.closed = true
+	n.cond.Signal()
+	n.mu.Unlock()
 }
 
 func (n *Notifier) GetInitialRouteRanges() []string {
 	return nil
 }
+
+func (n *Notifier) deliverLoop() {
+	for {
+		n.mu.Lock()
+		for n.queue.Len() == 0 && !n.closed {
+			n.cond.Wait()
+		}
+		if n.closed && n.queue.Len() == 0 {
+			n.mu.Unlock()
+			return
+		}
+		routes := n.queue.Remove(n.queue.Front()).(string)
+		l := n.listener
+		n.mu.Unlock()
+
+		if l != nil {
+			l.OnNetworkChanged(routes)
+		}
+	}
+}

client/internal/routemanager/selection.go

@@ -1,138 +0,0 @@
-package routemanager
-
-import (
-	"fmt"
-	"slices"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/route"
-)
-
-// SelectRoutes selects the routes with the given network IDs and applies the
-// new selection. V4/v6 exit-node pairs are expanded automatically. Exit nodes
-// are mutually exclusive: if the selection activates an exit node, every other
-// available exit node is deselected so two can't be active at once. With
-// appendRoute=false the previous selection is replaced instead of extended.
-func (m *DefaultManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
-	if err := m.selectRoutes(ids, appendRoute); err != nil {
-		return err
-	}
-	m.TriggerSelection(m.GetClientRoutes())
-	return nil
-}
-
-// DeselectRoutes removes the routes with the given network IDs from the
-// selection and applies the change. V4/v6 exit-node pairs are expanded
-// automatically.
-func (m *DefaultManager) DeselectRoutes(ids []route.NetID) error {
-	if err := m.deselectRoutes(ids); err != nil {
-		return err
-	}
-	m.TriggerSelection(m.GetClientRoutes())
-	return nil
-}
-
-func (m *DefaultManager) deselectRoutes(ids []route.NetID) error {
-	routesMap := m.GetClientRoutesWithNetID()
-	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
-
-	log.Debugf("deselecting routes with ids: %v", routes)
-
-	if err := m.routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
-		return fmt.Errorf("deselect routes: %w", err)
-	}
-
-	return nil
-}
-
-// SelectAllRoutes selects every available route and applies the selection.
-// Exit nodes stay mutually exclusive: at most one remains active.
-func (m *DefaultManager) SelectAllRoutes() {
-	m.selectAllRoutes()
-	m.TriggerSelection(m.GetClientRoutes())
-}
-
-func (m *DefaultManager) selectAllRoutes() {
-	m.routeSelector.SelectAllRoutes()
-
-	// Select-all wipes every explicit selection, so exit nodes fall back to
-	// management's auto-apply flags — which may mark several at once.
-	// Reconcile immediately so at most one exit node stays active instead of
-	// waiting for the next network map to enforce it.
-	m.mux.Lock()
-	defer m.mux.Unlock()
-	m.updateRouteSelectorFromManagement(m.clientRoutes)
-}
-
-// DeselectAllRoutes deselects every route and applies the change.
-func (m *DefaultManager) DeselectAllRoutes() {
-	m.routeSelector.DeselectAllRoutes()
-	m.TriggerSelection(m.GetClientRoutes())
-}
-
-func (m *DefaultManager) selectRoutes(ids []route.NetID, appendRoute bool) error {
-	routesMap := m.GetClientRoutesWithNetID()
-	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
-	allIDs := maps.Keys(routesMap)
-
-	log.Debugf("selecting routes with ids: %v", routes)
-
-	// A partial failure (e.g. an unknown ID in the request) still selects the
-	// valid routes, so exclusivity below must run regardless of the error.
-	var merr *multierror.Error
-	if err := m.routeSelector.SelectRoutes(routes, appendRoute, allIDs); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("select routes: %w", err))
-	}
-
-	// Exit nodes are mutually exclusive: if this selection activates an
-	// exit node, deselect every other available exit node so two can't be
-	// selected at once. Non-exit route selections are left untouched.
-	if requestActivatesExitNode(routes, routesMap) {
-		if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
-			if err := m.routeSelector.DeselectRoutes(others, allIDs); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("deselect sibling exit nodes: %w", err))
-			}
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func isExitNodeRoutes(routes []*route.Route) bool {
-	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
-}
-
-// requestActivatesExitNode reports whether any requested NetID maps to an exit
-// node (default route) in the current route table.
-func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
-	for _, id := range requested {
-		if isExitNodeRoutes(routesMap[id]) {
-			return true
-		}
-	}
-	return false
-}
-
-// otherExitNodeIDs returns every available exit-node NetID that is not in the
-// requested set — the siblings to deselect so a single exit node stays active.
-func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
-	keep := make(map[route.NetID]struct{}, len(requested))
-	for _, id := range requested {
-		keep[id] = struct{}{}
-	}
-	var others []route.NetID
-	for id, routes := range routesMap {
-		if !isExitNodeRoutes(routes) {
-			continue
-		}
-		if _, ok := keep[id]; ok {
-			continue
-		}
-		others = append(others, id)
-	}
-	return others
-}

client/internal/routemanager/selection_test.go

@@ -1,129 +0,0 @@
-package routemanager
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/routeselector"
-	"github.com/netbirdio/netbird/route"
-)
-
-func v6ExitRoute(netID, peer string) *route.Route {
-	return &route.Route{
-		NetID:   route.NetID(netID),
-		Network: netip.MustParsePrefix("::/0"),
-		Peer:    peer,
-	}
-}
-
-func newSelectionTestManager() *DefaultManager {
-	return &DefaultManager{
-		routeSelector: routeselector.NewRouteSelector(),
-		clientRoutes: route.HAMap{
-			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", true)},
-			"exitA-v6|::/0":      {v6ExitRoute("exitA-v6", "p1")},
-			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", true)},
-			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
-		},
-	}
-}
-
-func TestSelectRoutes_ExitNodeExclusivity(t *testing.T) {
-	m := newSelectionTestManager()
-
-	// Selecting an exit node selects its v6 pair and deselects the sibling.
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA should be selected")
-	assert.True(t, m.routeSelector.IsSelected("exitA-v6"), "the v6 pair follows its v4 base")
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "the sibling exit node must be deselected")
-
-	// Switching to the sibling deselects the previous exit node and its v6 pair.
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitB"), "exitB should now be selected")
-	assert.False(t, m.routeSelector.IsSelected("exitA"), "the previous exit node must be deselected")
-	assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "the previous exit node's v6 pair must be deselected")
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
-
-	// Selecting a non-exit route leaves the active exit node alone.
-	require.NoError(t, m.selectRoutes([]route.NetID{"lan"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitB"), "selecting a non-exit route keeps the exit node")
-
-	// Deselecting the active exit node turns every exit node off.
-	require.NoError(t, m.deselectRoutes([]route.NetID{"exitB"}))
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB should be deselected")
-	assert.False(t, m.routeSelector.IsSelected("exitA"), "exitA stays deselected")
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
-}
-
-func TestSelectRoutes_PartialErrorStillEnforcesExclusivity(t *testing.T) {
-	// The unknown ID must be reported, but the valid exit node in the same
-	// request is still selected — so its sibling must still be deselected.
-	// Both orderings are covered: processing must continue past the invalid
-	// ID wherever it sits in the request.
-	requests := map[string][]route.NetID{
-		"invalid id first": {"missing", "exitB"},
-		"invalid id last":  {"exitB", "missing"},
-	}
-
-	for name, ids := range requests {
-		t.Run(name, func(t *testing.T) {
-			m := newSelectionTestManager()
-
-			require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
-
-			err := m.selectRoutes(ids, true)
-			assert.Error(t, err, "unknown id must be reported")
-			assert.True(t, m.routeSelector.IsSelected("exitB"), "valid exit node from the request is selected")
-			assert.False(t, m.routeSelector.IsSelected("exitA"), "sibling exit node must be deselected despite the error")
-			assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "sibling's v6 pair must be deselected too")
-		})
-	}
-}
-
-func TestSelectAllRoutes_KeepsSingleExitNode(t *testing.T) {
-	// Both exit nodes are marked for auto-apply by management
-	// (SkipAutoApply=false), the state where select-all could turn on two at
-	// once without the immediate reconciliation.
-	m := &DefaultManager{
-		routeSelector: routeselector.NewRouteSelector(),
-		clientRoutes: route.HAMap{
-			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
-			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
-			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
-		},
-	}
-
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
-
-	m.selectAllRoutes()
-
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit routes are all selected")
-	assert.True(t, m.routeSelector.IsSelected("exitA"), "the deterministic management pick stays active")
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "select-all must not leave a second exit node active")
-}
-
-func TestSelectRoutes_UnknownRoute(t *testing.T) {
-	m := newSelectionTestManager()
-
-	assert.Error(t, m.selectRoutes([]route.NetID{"missing"}, true), "selecting an unavailable route must fail")
-	assert.Error(t, m.deselectRoutes([]route.NetID{"missing"}), "deselecting an unavailable route must fail")
-}
-
-func TestExitNodeSelectionHelpers(t *testing.T) {
-	routesMap := map[route.NetID][]*route.Route{
-		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
-		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
-		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
-	}
-
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
-
-	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
-	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
-}

client/internal/tunnelnotifier/notifier.go

@@ -1,124 +0,0 @@
-package tunnelnotifier
-
-import (
-	"container/list"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/listener"
-)
-
-type eventKind int
-
-const (
-	eventRoutes eventKind = iota
-	eventIfaceIP
-	eventIfaceIPv6
-	eventDNS
-)
-
-var (
-	_ listener.NetworkChangeListener = (*Notifier)(nil)
-	_ dns.IosDnsManager              = (*Notifier)(nil)
-)
-
-type event struct {
-	kind    eventKind
-	payload string
-}
-
-type Notifier struct {
-	mu     sync.Mutex
-	cond   *sync.Cond
-	queue  *list.List
-	closed bool
-	done   chan struct{}
-
-	listener   listener.NetworkChangeListener
-	dnsManager dns.IosDnsManager
-}
-
-func New(l listener.NetworkChangeListener, dm dns.IosDnsManager) *Notifier {
-	n := &Notifier{
-		queue:      list.New(),
-		done:       make(chan struct{}),
-		listener:   l,
-		dnsManager: dm,
-	}
-	n.cond = sync.NewCond(&n.mu)
-	go n.deliverLoop()
-	return n
-}
-
-func (n *Notifier) OnNetworkChanged(routes string) {
-	n.enqueue(event{kind: eventRoutes, payload: routes})
-}
-
-func (n *Notifier) SetInterfaceIP(ip string) {
-	n.enqueue(event{kind: eventIfaceIP, payload: ip})
-}
-
-func (n *Notifier) SetInterfaceIPv6(ip string) {
-	n.enqueue(event{kind: eventIfaceIPv6, payload: ip})
-}
-
-func (n *Notifier) ApplyDns(config string) {
-	n.enqueue(event{kind: eventDNS, payload: config})
-}
-
-// Close stops accepting new events and blocks until the delivery loop has
-// drained all queued events and exited.
-func (n *Notifier) Close() {
-	n.mu.Lock()
-	n.closed = true
-	n.cond.Signal()
-	n.mu.Unlock()
-	<-n.done
-}
-
-func (n *Notifier) enqueue(ev event) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if n.closed {
-		return
-	}
-	n.queue.PushBack(ev)
-	n.cond.Signal()
-}
-
-func (n *Notifier) deliverLoop() {
-	defer close(n.done)
-	for {
-		n.mu.Lock()
-		for n.queue.Len() == 0 && !n.closed {
-			n.cond.Wait()
-		}
-		if n.closed && n.queue.Len() == 0 {
-			n.mu.Unlock()
-			return
-		}
-		ev := n.queue.Remove(n.queue.Front()).(event)
-		l := n.listener
-		dm := n.dnsManager
-		n.mu.Unlock()
-
-		switch ev.kind {
-		case eventRoutes:
-			if l != nil {
-				l.OnNetworkChanged(ev.payload)
-			}
-		case eventIfaceIP:
-			if l != nil {
-				l.SetInterfaceIP(ev.payload)
-			}
-		case eventIfaceIPv6:
-			if l != nil {
-				l.SetInterfaceIPv6(ev.payload)
-			}
-		case eventDNS:
-			if dm != nil {
-				dm.ApplyDns(ev.payload)
-			}
-		}
-	}
-}

client/internal/tunnelnotifier/notifier_test.go

@@ -1,192 +0,0 @@
-package tunnelnotifier
-
-import (
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type call struct {
-	kind    string
-	payload string
-}
-
-type recorder struct {
-	mu       sync.Mutex
-	calls    []call
-	inFlight atomic.Int32
-	overlap  atomic.Bool
-	delay    time.Duration
-}
-
-func (r *recorder) record(kind, payload string) {
-	if r.inFlight.Add(1) != 1 {
-		r.overlap.Store(true)
-	}
-	if r.delay > 0 {
-		time.Sleep(r.delay)
-	}
-	r.mu.Lock()
-	r.calls = append(r.calls, call{kind: kind, payload: payload})
-	r.mu.Unlock()
-	r.inFlight.Add(-1)
-}
-
-func (r *recorder) count() int {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return len(r.calls)
-}
-
-func (r *recorder) snapshot() []call {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := make([]call, len(r.calls))
-	copy(out, r.calls)
-	return out
-}
-
-type fakeListener struct {
-	rec *recorder
-}
-
-func (f *fakeListener) OnNetworkChanged(routes string) {
-	f.rec.record("routes", routes)
-}
-
-func (f *fakeListener) SetInterfaceIP(ip string) {
-	f.rec.record("ip", ip)
-}
-
-func (f *fakeListener) SetInterfaceIPv6(ip string) {
-	f.rec.record("ipv6", ip)
-}
-
-type fakeDNSManager struct {
-	rec *recorder
-}
-
-func (f *fakeDNSManager) ApplyDns(config string) {
-	f.rec.record("dns", config)
-}
-
-func TestFIFOOrder(t *testing.T) {
-	rec := &recorder{}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	n.SetInterfaceIP("10.0.0.1")
-	n.SetInterfaceIPv6("fd00::1")
-	n.ApplyDns(`{"domains":[]}`)
-	n.OnNetworkChanged("10.0.0.0/8,192.168.0.0/16")
-	n.ApplyDns(`{"domains":["example.com"]}`)
-
-	require.Eventually(t, func() bool { return rec.count() == 5 }, time.Second, time.Millisecond)
-
-	expected := []call{
-		{kind: "ip", payload: "10.0.0.1"},
-		{kind: "ipv6", payload: "fd00::1"},
-		{kind: "dns", payload: `{"domains":[]}`},
-		{kind: "routes", payload: "10.0.0.0/8,192.168.0.0/16"},
-		{kind: "dns", payload: `{"domains":["example.com"]}`},
-	}
-	assert.Equal(t, expected, rec.snapshot())
-}
-
-func TestNoOverlappingCalls(t *testing.T) {
-	rec := &recorder{delay: 100 * time.Microsecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	const producers = 8
-	const perProducer = 25
-
-	var wg sync.WaitGroup
-	for i := 0; i < producers; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < perProducer; j++ {
-				payload := fmt.Sprintf("%d-%d", id, j)
-				switch j % 4 {
-				case 0:
-					n.OnNetworkChanged(payload)
-				case 1:
-					n.SetInterfaceIP(payload)
-				case 2:
-					n.SetInterfaceIPv6(payload)
-				case 3:
-					n.ApplyDns(payload)
-				}
-			}
-		}(i)
-	}
-	wg.Wait()
-
-	require.Eventually(t, func() bool { return rec.count() == producers*perProducer }, 5*time.Second, time.Millisecond)
-	assert.False(t, rec.overlap.Load())
-}
-
-func TestDNSAndRoutesInterleaved(t *testing.T) {
-	rec := &recorder{delay: 100 * time.Microsecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	const events = 50
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		for i := 0; i < events; i++ {
-			n.ApplyDns(fmt.Sprintf("dns-%d", i))
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		for i := 0; i < events; i++ {
-			n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
-		}
-	}()
-	wg.Wait()
-
-	require.Eventually(t, func() bool { return rec.count() == 2*events }, 5*time.Second, time.Millisecond)
-	assert.False(t, rec.overlap.Load())
-
-	var dnsSeen, routesSeen int
-	for _, c := range rec.snapshot() {
-		switch c.kind {
-		case "dns":
-			assert.Equal(t, fmt.Sprintf("dns-%d", dnsSeen), c.payload)
-			dnsSeen++
-		case "routes":
-			assert.Equal(t, fmt.Sprintf("routes-%d", routesSeen), c.payload)
-			routesSeen++
-		}
-	}
-	assert.Equal(t, events, dnsSeen)
-	assert.Equal(t, events, routesSeen)
-}
-
-func TestCloseDrainsQueue(t *testing.T) {
-	rec := &recorder{delay: time.Millisecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-
-	const events = 20
-	for i := 0; i < events; i++ {
-		n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
-	}
-	n.Close()
-
-	require.Equal(t, events, rec.count(), "Close must not return before all queued events are delivered")
-
-	n.OnNetworkChanged("after-close")
-	n.ApplyDns("after-close")
-	time.Sleep(50 * time.Millisecond)
-	assert.Equal(t, events, rec.count())
-}

client/ios/NetBirdSDK/client.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
@@ -636,18 +637,23 @@ func (c *Client) SelectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
+	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("select all routes")
-		routeManager.SelectAllRoutes()
-		return nil
-	}
-
-	log.Debugf("select route with id: %s", id)
-	if err := routeManager.SelectRoutes(toNetIDs([]string{id}), true); err != nil {
-		log.Debugf("error when selecting routes: %s", err)
-		return err
+		routeSelector.SelectAllRoutes()
+	} else {
+		log.Debugf("select route with id: %s", id)
+		routes := toNetIDs([]string{id})
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		if err := routeSelector.SelectRoutes(routes, true, maps.Keys(routesMap)); err != nil {
+			log.Debugf("error when selecting routes: %s", err)
+			return fmt.Errorf("select routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
+
 }
 
 func (c *Client) DeselectRoute(id string) error {
@@ -661,17 +667,21 @@ func (c *Client) DeselectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
+	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("deselect all routes")
-		routeManager.DeselectAllRoutes()
-		return nil
-	}
-
-	log.Debugf("deselect route with id: %s", id)
-	if err := routeManager.DeselectRoutes(toNetIDs([]string{id})); err != nil {
-		log.Debugf("error when deselecting routes: %s", err)
-		return err
+		routeSelector.DeselectAllRoutes()
+	} else {
+		log.Debugf("deselect route with id: %s", id)
+		routes := toNetIDs([]string{id})
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		if err := routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
+			log.Debugf("error when deselecting routes: %s", err)
+			return fmt.Errorf("deselect routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
 }
 

client/server/network.go

@@ -8,6 +8,7 @@ import (
 	"sort"
 	"strings"
 
+	"golang.org/x/exp/maps"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
@@ -160,11 +161,30 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		return nil, fmt.Errorf("no route manager")
 	}
 
+	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeManager.SelectAllRoutes()
-	} else if err := routeManager.SelectRoutes(toNetIDs(req.GetNetworkIDs()), req.GetAppend()); err != nil {
-		return nil, err
+		routeSelector.SelectAllRoutes()
+	} else {
+		routes := toNetIDs(req.GetNetworkIDs())
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		netIdRoutes := maps.Keys(routesMap)
+		if err := routeSelector.SelectRoutes(routes, req.GetAppend(), netIdRoutes); err != nil {
+			return nil, fmt.Errorf("select routes: %w", err)
+		}
+
+		// Exit nodes are mutually exclusive: if this selection activates an
+		// exit node, deselect every other available exit node so two can't be
+		// selected at once. Non-exit route selections are left untouched.
+		if requestActivatesExitNode(routes, routesMap) {
+			if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
+				if err := routeSelector.DeselectRoutes(others, netIdRoutes); err != nil {
+					return nil, fmt.Errorf("deselect sibling exit nodes: %w", err)
+				}
+			}
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -204,11 +224,19 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		return nil, fmt.Errorf("no route manager")
 	}
 
+	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeManager.DeselectAllRoutes()
-	} else if err := routeManager.DeselectRoutes(toNetIDs(req.GetNetworkIDs())); err != nil {
-		return nil, err
+		routeSelector.DeselectAllRoutes()
+	} else {
+		routes := toNetIDs(req.GetNetworkIDs())
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		netIdRoutes := maps.Keys(routesMap)
+		if err := routeSelector.DeselectRoutes(routes, netIdRoutes); err != nil {
+			return nil, fmt.Errorf("deselect routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -233,3 +261,37 @@ func toNetIDs(routes []string) []route.NetID {
 	return netIDs
 }
 
+func isExitNodeRoutes(routes []*route.Route) bool {
+	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
+}
+
+// requestActivatesExitNode reports whether any requested NetID maps to an exit
+// node (default route) in the current route table.
+func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
+	for _, id := range requested {
+		if isExitNodeRoutes(routesMap[id]) {
+			return true
+		}
+	}
+	return false
+}
+
+// otherExitNodeIDs returns every available exit-node NetID that is not in the
+// requested set — the siblings to deselect so a single exit node stays active.
+func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
+	keep := make(map[route.NetID]struct{}, len(requested))
+	for _, id := range requested {
+		keep[id] = struct{}{}
+	}
+	var others []route.NetID
+	for id, routes := range routesMap {
+		if !isExitNodeRoutes(routes) {
+			continue
+		}
+		if _, ok := keep[id]; ok {
+			continue
+		}
+		others = append(others, id)
+	}
+	return others
+}

client/server/network_exitnode_test.go

@@ -0,0 +1,26 @@
+package server
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestExitNodeSelectionHelpers(t *testing.T) {
+	routesMap := map[route.NetID][]*route.Route{
+		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
+		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
+		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
+	}
+
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
+
+	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
+	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
+}

management/internals/modules/agentnetwork/labelgen/labelgen.go

@@ -3,10 +3,9 @@ package labelgen
 
 import (
 	"fmt"
+	"math/rand"
 	"sort"
 	"sync"
-
-	"github.com/netbirdio/netbird/management/server/util"
 )
 
 // pickAttempts caps the random retries before falling back to the
@@ -41,15 +40,16 @@ func uniqueWords() []string {
 // PickUnique selects a label not already in `taken`. It tries up to
 // pickAttempts random picks; on exhaustion it scans the deduplicated
 // wordlist for any remaining free entry, and if none is left appends
-// `-<fallbackSuffix>` to a random word and returns.
-func PickUnique(taken map[string]struct{}, fallbackSuffix string) string {
+// `-<fallbackSuffix>` to a deterministic word and returns. The caller
+// is responsible for seeding rng (math/rand).
+func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string) string {
 	pool := uniqueWords()
 	if len(pool) == 0 {
 		return fallbackSuffix
 	}
 
 	for i := 0; i < pickAttempts; i++ {
-		w := pool[util.RandIntn(len(pool))]
+		w := pool[rng.Intn(len(pool))]
 		if _, ok := taken[w]; !ok {
 			return w
 		}
@@ -61,6 +61,6 @@ func PickUnique(taken map[string]struct{}, fallbackSuffix string) string {
 		}
 	}
 
-	w := pool[util.RandIntn(len(pool))]
+	w := pool[rng.Intn(len(pool))]
 	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
 }

management/internals/modules/agentnetwork/labelgen/labelgen_test.go

@@ -1,7 +1,7 @@
 package labelgen
 
 import (
-	"slices"
+	"math/rand"
 	"strings"
 	"testing"
 
@@ -9,12 +9,19 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestPickUnique_ReturnsWordFromPool confirms a pick against an empty
-// taken set is always drawn verbatim from the wordlist.
-func TestPickUnique_ReturnsWordFromPool(t *testing.T) {
-	got := PickUnique(map[string]struct{}{}, "abcd")
+// TestPickUnique_DeterministicWithSeededRng locks the property the
+// caller relies on: same seed + same taken set → same pick. Without
+// that, the bootstrap flow can't reproduce a label across retries.
+func TestPickUnique_DeterministicWithSeededRng(t *testing.T) {
+	taken := map[string]struct{}{}
 
-	assert.True(t, slices.Contains(uniqueWords(), got), "Pick %q must be drawn from the wordlist", got)
+	rngA := rand.New(rand.NewSource(42))
+	rngB := rand.New(rand.NewSource(42))
+
+	a := PickUnique(rngA, taken, "abcd")
+	b := PickUnique(rngB, taken, "abcd")
+
+	assert.Equal(t, a, b, "Same seed and taken set must produce identical pick")
 }
 
 // TestPickUnique_AvoidsTakenWordsWhenMostAreReserved seeds taken with
@@ -39,7 +46,8 @@ func TestPickUnique_AvoidsTakenWordsWhenMostAreReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	got := PickUnique(taken, "abcd")
+	rng := rand.New(rand.NewSource(7))
+	got := PickUnique(rng, taken, "abcd")
 
 	_, isFree := free[got]
 	assert.True(t, isFree, "PickUnique must return one of the free words; got %q", got)
@@ -57,7 +65,8 @@ func TestPickUnique_FallsBackWhenAllReserved(t *testing.T) {
 		taken[w] = struct{}{}
 	}
 
-	got := PickUnique(taken, "abcd")
+	rng := rand.New(rand.NewSource(99))
+	got := PickUnique(rng, taken, "abcd")
 
 	assert.True(t, strings.HasSuffix(got, "-abcd"), "Exhausted pool must produce <word>-<suffix>; got %q", got)
 

management/internals/modules/agentnetwork/manager.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand"
 	"slices"
 	"strings"
 	"sync"
@@ -127,6 +128,11 @@ type managerImpl struct {
 	// accountID, then by synthesised service ID.
 	reconcileMu    sync.Mutex
 	reconcileCache map[string]map[string]*proto.ProxyMapping
+
+	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
+	// state; concurrent provider creates would otherwise race.
+	labelRngMu sync.Mutex
+	labelRng   *rand.Rand
 }
 
 // NewManager constructs the persistent Agent Network manager. The
@@ -146,6 +152,7 @@ func NewManager(
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
 		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
+		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
 
@@ -651,7 +658,9 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 		suffix = suffix[:4]
 	}
 
-	subdomain := labelgen.PickUnique(taken, suffix)
+	m.labelRngMu.Lock()
+	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
+	m.labelRngMu.Unlock()
 
 	now := time.Now().UTC()
 	settings := &types.Settings{

management/server/account.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net"
 	"net/netip"
 	"os"
@@ -62,7 +63,7 @@ const (
 type userLoggedInOnce bool
 
 func cacheEntryExpiration() time.Duration {
-	r := util.RandIntn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
+	r := rand.Intn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
 	return time.Duration(r) * time.Millisecond
 }
 
@@ -2458,7 +2459,8 @@ func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transacti
 		return transaction.UpdateAccountNetworkV6(ctx, accountID, network.NetV6)
 	}
 	if network.NetV6.IP == nil {
-		network.NetV6 = types.AllocateIPv6Subnet()
+		r := rand.New(rand.NewSource(time.Now().UnixNano()))
+		network.NetV6 = types.AllocateIPv6Subnet(r)
 
 		// Sync settings to match the allocated subnet so SaveAccountSettings persists it.
 		ones, _ := network.NetV6.Mask.Size()

management/server/group_ipv6_test.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"math/rand"
 	"testing"
 	"time"
 
@@ -27,7 +28,7 @@ func TestGroupIPv6Assignment(t *testing.T) {
 	require.NoError(t, err)
 
 	// Allocate IPv6 subnet for the account
-	account.Network.NetV6 = types.AllocateIPv6Subnet()
+	account.Network.NetV6 = types.AllocateIPv6Subnet(rand.New(rand.NewSource(time.Now().UnixNano())))
 	require.NoError(t, am.Store.SaveAccount(ctx, account))
 
 	// Create setup key

management/server/idp/util.go

@@ -2,12 +2,11 @@ package idp
 
 import (
 	"encoding/json"
+	"math/rand"
 	"net/url"
 	"os"
 	"strings"
 	"time"
-
-	"github.com/netbirdio/netbird/management/server/util"
 )
 
 var (
@@ -34,32 +33,31 @@ func GeneratePassword(passwordLength, minSpecialChar, minNum, minUpperCase int)
 
 	//Set special character
 	for i := 0; i < minSpecialChar; i++ {
-		random := util.RandIntn(len(specialCharSet))
+		random := rand.Intn(len(specialCharSet))
 		password.WriteString(string(specialCharSet[random]))
 	}
 
 	//Set numeric
 	for i := 0; i < minNum; i++ {
-		random := util.RandIntn(len(numberSet))
+		random := rand.Intn(len(numberSet))
 		password.WriteString(string(numberSet[random]))
 	}
 
 	//Set uppercase
 	for i := 0; i < minUpperCase; i++ {
-		random := util.RandIntn(len(upperCharSet))
+		random := rand.Intn(len(upperCharSet))
 		password.WriteString(string(upperCharSet[random]))
 	}
 
 	remainingLength := passwordLength - minSpecialChar - minNum - minUpperCase
 	for i := 0; i < remainingLength; i++ {
-		random := util.RandIntn(len(allCharSet))
+		random := rand.Intn(len(allCharSet))
 		password.WriteString(string(allCharSet[random]))
 	}
 	inRune := []rune(password.String())
-	for i := len(inRune) - 1; i > 0; i-- {
-		j := util.RandIntn(i + 1)
+	rand.Shuffle(len(inRune), func(i, j int) {
 		inRune[i], inRune[j] = inRune[j], inRune[i]
-	}
+	})
 	return string(inRune)
 }
 

management/server/types/aliases.go

@@ -2,6 +2,7 @@ package types
 
 import (
 	"context"
+	"math/rand"
 	"net"
 	"net/netip"
 
@@ -85,8 +86,8 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
 }
 
-func AllocateIPv6Subnet() net.IPNet {
-	return sharedtypes.AllocateIPv6Subnet()
+func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
+	return sharedtypes.AllocateIPv6Subnet(r)
 }
 
 func NewNetwork() *Network {

management/server/user.go

@@ -321,10 +321,6 @@ func (am *DefaultAccountManager) DeleteUser(ctx context.Context, accountID, init
 		return err
 	}
 
-	if targetUser.AccountID != accountID {
-		return status.NewUserNotFoundError(targetUserID)
-	}
-
 	if targetUser.Role == types.UserRoleOwner {
 		return status.NewOwnerDeletePermissionError()
 	}

management/server/user_test.go

@@ -802,52 +802,6 @@ func TestUser_DeleteUser_SelfDelete(t *testing.T) {
 	}
 }
 
-func TestUser_DeleteUser_OtherAccount(t *testing.T) {
-	testStore, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	if err != nil {
-		t.Fatalf("Error when creating store: %s", err)
-	}
-	t.Cleanup(cleanup)
-
-	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
-	if err = testStore.SaveAccount(context.Background(), account); err != nil {
-		t.Fatalf("Error when saving account: %s", err)
-	}
-
-	otherAccount := newAccountWithId(context.Background(), "otherAccount", "otherOwner", "", "", "", false)
-	otherAccount.Users["otherRegularUser"] = &types.User{
-		Id:        "otherRegularUser",
-		AccountID: "otherAccount",
-		Role:      types.UserRoleUser,
-	}
-	otherAccount.Users["otherServiceUser"] = &types.User{
-		Id:              "otherServiceUser",
-		AccountID:       "otherAccount",
-		Role:            types.UserRoleUser,
-		IsServiceUser:   true,
-		ServiceUserName: "otherServiceUser",
-	}
-	if err = testStore.SaveAccount(context.Background(), otherAccount); err != nil {
-		t.Fatalf("Error when saving other account: %s", err)
-	}
-
-	am := DefaultAccountManager{
-		Store:              testStore,
-		eventStore:         &activity.InMemoryEventStore{},
-		permissionsManager: permissions.NewManager(testStore),
-	}
-
-	for _, targetUserID := range []string{"otherRegularUser", "otherServiceUser"} {
-		t.Run(targetUserID, func(t *testing.T) {
-			err := am.DeleteUser(context.Background(), mockAccountID, mockUserID, targetUserID)
-			assert.Equal(t, status.NewUserNotFoundError(targetUserID), err)
-
-			_, err = testStore.GetUserByUserID(context.Background(), store.LockingStrengthNone, targetUserID)
-			assert.NoError(t, err, "user of another account must not be deleted")
-		})
-	}
-}
-
 func TestUser_DeleteUser_regularUser(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {

management/server/util/util.go

@@ -1,20 +1,5 @@
 package util
 
-import (
-	"crypto/rand"
-	"math/big"
-)
-
-// RandIntn returns a uniformly distributed int in [0, n) sourced from
-// crypto/rand. It panics if n <= 0 or the platform randomness source fails.
-func RandIntn(n int) int {
-	v, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
-	if err != nil {
-		panic(err)
-	}
-	return int(v.Int64())
-}
-
 // Difference returns the elements in `a` that aren't in `b`.
 func Difference(a, b []string) []string {
 	mb := make(map[string]struct{}, len(b))

shared/management/types/network.go

@@ -1,20 +1,20 @@
 package types
 
 import (
-	"crypto/rand"
 	"encoding/binary"
 	"fmt"
+	"math/rand"
 	"net"
 	"net/netip"
 	"slices"
 	"sync"
+	"time"
 
 	"github.com/c-robinson/iplib"
 	"github.com/rs/xid"
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -171,12 +171,14 @@ func NewNetwork() *Network {
 	n := iplib.NewNet4(net.ParseIP("100.64.0.0"), NetSize)
 	sub, _ := n.Subnet(SubnetSize)
 
-	intn := util.RandIntn(len(sub))
+	s := rand.NewSource(time.Now().UnixNano())
+	r := rand.New(s)
+	intn := r.Intn(len(sub))
 
 	return &Network{
 		Identifier: xid.New().String(),
 		Net:        sub[intn].IPNet,
-		NetV6:      AllocateIPv6Subnet(),
+		NetV6:      AllocateIPv6Subnet(r),
 		Dns:        "",
 		Serial:     0,
 	}
@@ -186,13 +188,18 @@ func NewNetwork() *Network {
 // The format follows RFC 4193 section 3.1: fd + 40-bit Global ID + 16-bit Subnet ID.
 // The Global ID and Subnet ID are randomized (simplified from the SHA-1 algorithm
 // in section 3.2.2), giving 2^56 possible /64 subnets across all accounts.
-func AllocateIPv6Subnet() net.IPNet {
+func AllocateIPv6Subnet(r *rand.Rand) net.IPNet {
 	ip := make(net.IP, 16)
 	ip[0] = 0xfd
-	// Bytes 1-5: 40-bit random Global ID, bytes 6-7: 16-bit random Subnet ID
-	if _, err := rand.Read(ip[1:8]); err != nil {
-		panic(err)
-	}
+	// Bytes 1-5: 40-bit random Global ID
+	ip[1] = byte(r.Intn(256))
+	ip[2] = byte(r.Intn(256))
+	ip[3] = byte(r.Intn(256))
+	ip[4] = byte(r.Intn(256))
+	ip[5] = byte(r.Intn(256))
+	// Bytes 6-7: 16-bit random Subnet ID
+	ip[6] = byte(r.Intn(256))
+	ip[7] = byte(r.Intn(256))
 
 	return net.IPNet{
 		IP:   ip,
@@ -226,22 +233,10 @@ func (n *Network) Copy() *Network {
 	}
 }
 
-// validateIPv4Prefix ensures the prefix is an IPv4 network with assignable host addresses.
-func validateIPv4Prefix(prefix netip.Prefix) error {
-	if !prefix.IsValid() || !prefix.Addr().Is4() || prefix.Bits() < 1 || prefix.Bits() >= 31 {
-		return fmt.Errorf("invalid IPv4 subnet: %s", prefix.String())
-	}
-	return nil
-}
-
 // AllocatePeerIP picks an available IP from a netip.Prefix.
 // This method considers already taken IPs and reuses IPs if there are gaps in takenIps.
 // E.g. if prefix=100.30.0.0/16 and takenIps=[100.30.0.1, 100.30.0.4] then the result would be 100.30.0.2 or 100.30.0.3.
 func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, error) {
-	if err := validateIPv4Prefix(prefix); err != nil {
-		return netip.Addr{}, err
-	}
-
 	b := prefix.Masked().Addr().As4()
 	baseIP := binary.BigEndian.Uint32(b[:])
 	hostBits := 32 - prefix.Bits()
@@ -252,17 +247,15 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 	taken[baseIP+totalIPs-1] = struct{}{} // reserve broadcast IP
 
 	for _, ip := range takenIps {
-		if !ip.Is4() {
-			continue
-		}
 		ab := ip.As4()
 		taken[binary.BigEndian.Uint32(ab[:])] = struct{}{}
 	}
 
+	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
 	maxAttempts := (int(totalIPs) - len(taken)) / 100
 
 	for i := 0; i < maxAttempts; i++ {
-		offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
+		offset := uint32(rng.Intn(int(totalIPs-2))) + 1
 		candidate := baseIP + offset
 		if _, exists := taken[candidate]; !exists {
 			return uint32ToIP(candidate), nil
@@ -281,16 +274,13 @@ func AllocatePeerIP(prefix netip.Prefix, takenIps []netip.Addr) (netip.Addr, err
 
 // AllocateRandomPeerIP picks a random available IP from a netip.Prefix.
 func AllocateRandomPeerIP(prefix netip.Prefix) (netip.Addr, error) {
-	if err := validateIPv4Prefix(prefix); err != nil {
-		return netip.Addr{}, err
-	}
-
 	b := prefix.Masked().Addr().As4()
 	baseIP := binary.BigEndian.Uint32(b[:])
 	hostBits := 32 - prefix.Bits()
 	totalIPs := uint32(1 << hostBits)
 
-	offset := uint32(util.RandIntn(int(totalIPs-2))) + 1
+	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
+	offset := uint32(rng.Intn(int(totalIPs-2))) + 1
 
 	candidate := baseIP + offset
 	return uint32ToIP(candidate), nil
@@ -306,26 +296,23 @@ func AllocateRandomPeerIPv6(prefix netip.Prefix) (netip.Addr, error) {
 
 	ip := prefix.Addr().As16()
 
+	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
+
 	// Determine which byte the host bits start in
 	firstHostByte := ones / 8
 	// If the prefix doesn't end on a byte boundary, handle the partial byte
 	partialBits := ones % 8
 
-	var rnd [16]byte
-	if _, err := rand.Read(rnd[firstHostByte:]); err != nil {
-		return netip.Addr{}, err
-	}
-
 	if partialBits > 0 {
 		// Keep the network bits in the partial byte, randomize the rest
 		hostMask := byte(0xff >> partialBits)
-		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (rnd[firstHostByte] & hostMask)
+		ip[firstHostByte] = (ip[firstHostByte] & ^hostMask) | (byte(rng.Intn(256)) & hostMask)
 		firstHostByte++
 	}
 
 	// Randomize remaining full host bytes
 	for i := firstHostByte; i < 16; i++ {
-		ip[i] = rnd[i]
+		ip[i] = byte(rng.Intn(256))
 	}
 
 	// Avoid all-zeros and all-ones host parts by checking only host bits.

shared/management/types/network_test.go

@@ -143,34 +143,6 @@ func TestAllocatePeerIPVariousCIDRs(t *testing.T) {
 	}
 }
 
-func TestAllocateIPv4InvalidPrefixes(t *testing.T) {
-	prefixes := []netip.Prefix{
-		{},
-		netip.MustParsePrefix("0.0.0.0/0"),
-		netip.MustParsePrefix("192.168.1.0/31"),
-		netip.MustParsePrefix("192.168.1.1/32"),
-		netip.MustParsePrefix("fd12:3456:7890:abcd::/64"),
-	}
-
-	for _, prefix := range prefixes {
-		t.Run(prefix.String(), func(t *testing.T) {
-			_, err := AllocatePeerIP(prefix, nil)
-			assert.Error(t, err)
-
-			_, err = AllocateRandomPeerIP(prefix)
-			assert.Error(t, err)
-		})
-	}
-}
-
-func TestAllocatePeerIPIgnoresNonIPv4TakenIPs(t *testing.T) {
-	prefix := netip.MustParsePrefix("192.168.1.0/29")
-
-	ip, err := AllocatePeerIP(prefix, []netip.Addr{netip.MustParseAddr("fd12:3456:7890:abcd::1")})
-	require.NoError(t, err)
-	assert.True(t, prefix.Contains(ip))
-}
-
 func TestGenerateIPs(t *testing.T) {
 	ipNet := net.IPNet{IP: net.ParseIP("100.64.0.0"), Mask: net.IPMask{255, 255, 255, 0}}
 	ips, ipsLen := generateIPs(&ipNet, map[string]struct{}{"100.64.0.0": {}})