all: use math/rand/v2 more

Updates #11058

Signed-off-by: Maisem Ali <maisem@tailscale.com>

cmd/sniproxy/handlers.go

@@ -7,7 +7,7 @@
 	"context"
 	"fmt"
 	"log"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/netip"
 	"slices"
@@ -47,7 +47,7 @@ func (h *tcpRoundRobinHandler) Handle(c net.Conn) {
 		return netutil.NewOneConnListener(c, nil), nil
 	}
 
-	dest := h.To[rand.Intn(len(h.To))]
+	dest := h.To[rand.IntN(len(h.To))]
 	dial := &tcpproxy.DialProxy{
 		Addr:        fmt.Sprintf("%s:%s", dest, port),
 		DialContext: h.DialContext,

cmd/stund/depaware.txt

@@ -153,7 +153,7 @@ tailscale.com/cmd/stund dependencies: (generated by github.com/tailscale/depawar
         math/big                                                     from crypto/dsa+
         math/bits                                                    from compress/flate+
         math/rand                                                    from math/big+
-        math/rand/v2                                                 from tailscale.com/util/fastuuid
+        math/rand/v2                                                 from tailscale.com/util/fastuuid+
         mime                                                         from github.com/prometheus/common/expfmt+
         mime/multipart                                               from net/http
         mime/quotedprintable                                         from mime/multipart

cmd/stunstamp/stunstamp.go

@@ -15,7 +15,7 @@
 	"io"
 	"log"
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -151,7 +151,7 @@ func probe(meta nodeMeta, conn io.ReadWriteCloser, fn measureFn) (*time.Duration
 		Port: 3478,
 	}
 
-	time.Sleep(time.Millisecond * time.Duration(rand.Intn(200))) // jitter across tx
+	time.Sleep(rand.N(200 * time.Millisecond)) // jitter across tx
 	rtt, err := fn(conn, ua)
 	if err != nil {
 		if isTemporaryOrTimeoutErr(err) {

cmd/tailscale/depaware.txt

@@ -277,6 +277,7 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         math/big                                                     from crypto/dsa+
         math/bits                                                    from compress/flate+
         math/rand                                                    from github.com/mdlayher/netlink+
+        math/rand/v2                                                 from tailscale.com/derp+
         mime                                                         from golang.org/x/oauth2/internal+
         mime/multipart                                               from net/http
         mime/quotedprintable                                         from mime/multipart

cmd/tailscaled/depaware.txt

@@ -529,7 +529,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         math/big                                                     from crypto/dsa+
         math/bits                                                    from compress/flate+
         math/rand                                                    from github.com/mdlayher/netlink+
-        math/rand/v2                                                 from tailscale.com/util/rands
+        math/rand/v2                                                 from tailscale.com/util/rands+
         mime                                                         from github.com/tailscale/xnet/webdav+
         mime/multipart                                               from net/http+
         mime/quotedprintable                                         from mime/multipart

cmd/tsconnect/wasm/wasm_js.go

@@ -16,7 +16,7 @@
 	"encoding/json"
 	"fmt"
 	"log"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -604,7 +604,7 @@ func filterSlice[T any](a []T, f func(T) bool) []T {
 func generateHostname() string {
 	tails := words.Tails()
 	scales := words.Scales()
-	if rand.Int()%2 == 0 {
+	if rand.IntN(2) == 0 {
 		// JavaScript
 		tails = filterSlice(tails, func(s string) bool { return strings.HasPrefix(s, "j") })
 		scales = filterSlice(scales, func(s string) bool { return strings.HasPrefix(s, "s") })
@@ -614,8 +614,8 @@ func generateHostname() string {
 		scales = filterSlice(scales, func(s string) bool { return strings.HasPrefix(s, "a") })
 	}
 
-	tail := tails[rand.Intn(len(tails))]
-	scale := scales[rand.Intn(len(scales))]
+	tail := tails[rand.IntN(len(tails))]
+	scale := scales[rand.IntN(len(scales))]
 	return fmt.Sprintf("%s-%s", tail, scale)
 }
 

derp/derp_server.go

@@ -22,7 +22,7 @@
 	"log"
 	"math"
 	"math/big"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -1514,7 +1514,7 @@ func (c *sclient) sendLoop(ctx context.Context) error {
 		}
 	}()
 
-	jitter := time.Duration(rand.Intn(5000)) * time.Millisecond
+	jitter := rand.N(5 * time.Second)
 	keepAliveTick, keepAliveTickChannel := c.s.clock.NewTicker(keepAlive + jitter)
 	defer keepAliveTick.Stop()
 

ipn/ipnlocal/cert.go

@@ -22,7 +22,7 @@
 	"fmt"
 	"io"
 	"log"
-	insecurerand "math/rand"
+	randv2 "math/rand/v2"
 	"net"
 	"os"
 	"path/filepath"
@@ -212,7 +212,7 @@ func (b *LocalBackend) domainRenewalTimeByARI(cs certStore, pair *TLSCertKeyPair
 	// passed. Time is randomized per recommendation in
 	// https://datatracker.ietf.org/doc/draft-ietf-acme-ari/
 	start, end := ri.SuggestedWindow.Start, ri.SuggestedWindow.End
-	renewTime := start.Add(time.Duration(insecurerand.Int63n(int64(end.Sub(start)))))
+	renewTime := start.Add(randv2.N(end.Sub(start)))
 	return renewTime, nil
 }
 

ipn/ipnlocal/local.go

@@ -15,7 +15,7 @@
 	"log"
 	"maps"
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -6650,12 +6650,12 @@ func pickWeighted(candidates []tailcfg.NodeView) []tailcfg.NodeView {
 
 // randomRegion is a selectRegionFunc that selects a uniformly random region.
 func randomRegion(regions views.Slice[int]) int {
-	return regions.At(rand.Intn(regions.Len()))
+	return regions.At(rand.IntN(regions.Len()))
 }
 
 // randomNode is a selectNodeFunc that returns a uniformly random node.
 func randomNode(nodes views.Slice[tailcfg.NodeView]) tailcfg.NodeView {
-	return nodes.At(rand.Intn(nodes.Len()))
+	return nodes.At(rand.IntN(nodes.Len()))
 }
 
 // minLatencyDERPRegion returns the region with the lowest latency value given the last netcheck report.

ipn/ipnlocal/profiles.go

@@ -5,10 +5,10 @@
 
 import (
 	"cmp"
+	"crypto/rand"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"math/rand"
 	"runtime"
 	"slices"
 	"strings"

logtail/backoff/backoff.go

@@ -6,7 +6,7 @@
 
 import (
 	"context"
-	"math/rand"
+	"math/rand/v2"
 	"time"
 
 	"tailscale.com/tstime"

logtail/logtail.go

@@ -12,7 +12,7 @@
 	"fmt"
 	"io"
 	"log"
-	mrand "math/rand"
+	mrand "math/rand/v2"
 	"net/http"
 	"net/netip"
 	"os"
@@ -435,7 +435,7 @@ func (l *Logger) uploading(ctx context.Context) {
 				// Sleep for the specified retryAfter period,
 				// otherwise default to some random value.
 				if retryAfter <= 0 {
-					retryAfter = time.Duration(30+mrand.Intn(30)) * time.Second
+					retryAfter = mrand.N(30*time.Second) + 30*time.Second
 				}
 				tstime.Sleep(ctx, retryAfter)
 			} else {

net/netcheck/netcheck.go

@@ -14,7 +14,7 @@
 	"io"
 	"log"
 	"maps"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -1010,7 +1010,7 @@ func (c *Client) checkCaptivePortal(ctx context.Context, dm *tailcfg.DERPMap, pr
 		if len(rids) == 0 {
 			return false, nil
 		}
-		preferredDERP = rids[rand.Intn(len(rids))]
+		preferredDERP = rids[rand.IntN(len(rids))]
 	}
 
 	node := dm.Regions[preferredDERP].Nodes[0]

net/portmapper/upnp.go

@@ -15,7 +15,7 @@
 	"encoding/xml"
 	"fmt"
 	"io"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"net/netip"
@@ -165,7 +165,7 @@ func addAnyPortMapping(
 	// number in [0, 65535 - 1024] and then adding 1024 to it, shifting the
 	// range to [1024, 65535].
 	if externalPort < 1024 {
-		externalPort = uint16(rand.Intn(65535-1024) + 1024)
+		externalPort = uint16(rand.N(65535-1024) + 1024)
 	}
 
 	// First off, try using AddAnyPortMapping; if there's a conflict, the

tstest/integration/testcontrol/testcontrol.go

@@ -14,7 +14,7 @@
 	"io"
 	"log"
 	"maps"
-	"math/rand"
+	"math/rand/v2"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -774,7 +774,7 @@ func (s *Server) serveMap(w http.ResponseWriter, r *http.Request, mkey key.Machi
 		go panic(fmt.Sprintf("bad map request: %v", err))
 	}
 
-	jitter := time.Duration(rand.Intn(8000)) * time.Millisecond
+	jitter := rand.N(8 * time.Second)
 	keepAlive := 50*time.Second + jitter
 
 	node := s.Node(req.NodeKey)

tstest/jsdeps/jsdeps.go

@@ -14,7 +14,7 @@
 	_ "encoding/json"
 	_ "fmt"
 	_ "log"
-	_ "math/rand"
+	_ "math/rand/v2"
 	_ "net"
 	_ "strings"
 	_ "time"

tstest/natlab/natlab.go

@@ -14,7 +14,7 @@
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/netip"
 	"os"
@@ -566,7 +566,7 @@ func (m *Machine) pickEphemPort() (port uint16, err error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	for tries := 0; tries < 500; tries++ {
-		port := uint16(rand.Intn(32<<10) + 32<<10)
+		port := uint16(rand.IntN(32<<10) + 32<<10)
 		if !m.portInUseLocked(port) {
 			return port, nil
 		}

tstime/jitter.go

@@ -4,33 +4,10 @@
 package tstime
 
 import (
-	crand "crypto/rand"
-	"encoding/binary"
-	"math/rand"
-	"sync"
+	"math/rand/v2"
 	"time"
 )
 
-// crandSource is a rand.Source64 that gets its numbers from
-// crypto/rand.Reader.
-type crandSource struct{ sync.Mutex }
-
-var _ rand.Source64 = (*crandSource)(nil)
-
-func (s *crandSource) Int63() int64 { return int64(s.Uint64() >> 1) }
-
-func (s *crandSource) Uint64() uint64 {
-	s.Lock()
-	defer s.Unlock()
-	var buf [8]byte
-	crand.Read(buf[:])
-	return binary.BigEndian.Uint64(buf[:])
-}
-
-func (*crandSource) Seed(seed int64) {} // nope
-
-var durRand = rand.New(new(crandSource))
-
 // RandomDurationBetween returns a random duration in range [min,max).
 // If panics if max < min.
 func RandomDurationBetween(min, max time.Duration) time.Duration {
@@ -38,6 +15,5 @@ func RandomDurationBetween(min, max time.Duration) time.Duration {
 	if diff == 0 {
 		return min
 	}
-	ns := durRand.Int63n(int64(diff))
-	return min + time.Duration(ns)
+	return min + rand.N(max-min)
 }

util/cloudenv/cloudenv.go

@@ -8,7 +8,7 @@
 	"context"
 	"encoding/json"
 	"log"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"os"
@@ -74,8 +74,7 @@ func getDigitalOceanResolver() string {
 	// Randomly select one of the available resolvers so we don't overload
 	// one of them by sending all traffic there.
 	return digitalOceanResolver.Get(func() string {
-		rn := rand.New(rand.NewSource(time.Now().UnixNano()))
-		return digitalOceanResolvers[rn.Intn(len(digitalOceanResolvers))]
+		return digitalOceanResolvers[rand.IntN(len(digitalOceanResolvers))]
 	})
 }
 

util/reload/reload.go

@@ -9,7 +9,7 @@
 	"context"
 	"encoding/json"
 	"fmt"
-	"math/rand"
+	"math/rand/v2"
 	"os"
 	"reflect"
 	"time"
@@ -73,7 +73,7 @@ func (r *ReloadOpts[T]) intervalWithJitter() time.Duration {
 		return tt
 	}
 
-	jitter := time.Duration(rand.Intn(int(r.IntervalJitter)))
+	jitter := rand.N(r.IntervalJitter)
 	return tt + jitter
 }
 

util/slicesx/slicesx.go

@@ -4,7 +4,7 @@
 // Package slicesx contains some helpful generic slice functions.
 package slicesx
 
-import "math/rand"
+import "math/rand/v2"
 
 // Interleave combines two slices of the form [a, b, c] and [x, y, z] into a
 // slice with elements interleaved; i.e. [a, x, b, y, c, z].
@@ -34,11 +34,11 @@ func Shuffle[S ~[]T, T any](s S) {
 	n := len(s)
 	i := n - 1
 	for ; i > 1<<31-1-1; i-- {
-		j := int(rand.Int63n(int64(i + 1)))
+		j := int(rand.N(int64(i + 1)))
 		s[i], s[j] = s[j], s[i]
 	}
 	for ; i > 0; i-- {
-		j := int(rand.Int31n(int32(i + 1)))
+		j := int(rand.N(int32(i + 1)))
 		s[i], s[j] = s[j], s[i]
 	}
 }

wgengine/magicsock/derp.go

@@ -136,6 +136,7 @@ func (c *Conn) pickDERPFallback() int {
 		return pickDERPFallbackForTests()
 	}
 
+	// TODO: use math/rand/v2 here.
 	h := fnv.New64()
 	fmt.Fprintf(h, "%p/%d", c, processStartUnixNano) // arbitrary
 	return ids[rand.New(rand.NewSource(int64(h.Sum64()))).Intn(len(ids))]

wgengine/magicsock/endpoint.go

@@ -10,7 +10,7 @@
 	"errors"
 	"fmt"
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/netip"
 	"reflect"
@@ -592,7 +592,7 @@ func (de *endpoint) addrForWireGuardSendLocked(now mono.Time) (udpAddr netip.Add
 		// Randomly select an address to use until we retrieve latency information
 		// and give it a short trustBestAddrUntil time so we avoid flapping between
 		// addresses while waiting on latency information to be populated.
-		udpAddr = candidates[rand.Intn(len(candidates))]
+		udpAddr = candidates[rand.IntN(len(candidates))]
 	}
 
 	de.bestAddr.AddrPort = udpAddr