26 Commits

Author SHA1 Message Date
Brad Fitzpatrick
1d93bdce20 control/controlclient: remove x/net/http2, use net/http
Saves 352 KB, removing one of our two HTTP/2 implementations linked
into the binary.

Fixes #17305
Updates #15015

Change-Id: I53a04b1f2687dca73c8541949465038b69aa6ade
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-02 08:25:14 -07:00
Brad Fitzpatrick
c45f8813b4 feature/featuretags, all: add build features, use existing ones in more places
Saves 270 KB.

Updates #12614

Change-Id: I4c3fe06d32c49edb3a4bb0758a8617d83f291cf5
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-02 08:07:25 -07:00
Brad Fitzpatrick
c2f37c891c all: use Go 1.20's errors.Join instead of our multierr package
Updates #7123

Change-Id: Ie9be6814831f661ad5636afcd51d063a0d7a907d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-01 08:10:59 -07:00
Brad Fitzpatrick
5b09913d64 ipn/ipnlocal, engine: avoid runtime/pprof with two usages of ts_omit_debug
Saves 258 KB.

Updates #12614

Change-Id: I37c2f7f916480e3534883f338de4c64d08f7ef2b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-30 14:58:25 -07:00
Brad Fitzpatrick
f7afb9b6ca feature/featuretags, ipn/conffile: make HuJSON support in config files optional
Saves 33 KB.

Updates #12614

Change-Id: Ie701c230e0765281f409f29ed263910b9be9cc77
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-30 14:32:55 -07:00
Brad Fitzpatrick
9386a101d8 cmd/tailscaled, ipn/localapi, util/eventbus: don't link in regexp when debug is omitted
Saves 442 KB. Lock it with a new min test.

Updates #12614

Change-Id: Ia7bf6f797b6cbf08ea65419ade2f359d390f8e91
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-30 12:13:17 -07:00
Brad Fitzpatrick
442a3a779d feature, net/tshttpproxy: pull out support for using proxies as a feature
Saves 139 KB.

Also Synology support, which I saw had its own large-ish proxy parsing
support on Linux, but support for proxies without Synology proxy
support is reasonable, so I pulled that out as its own thing.

Updates #12614

Change-Id: I22de285a3def7be77fdcf23e2bec7c83c9655593
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-30 10:25:56 -07:00
Brad Fitzpatrick
87ee0f4e98 ipn/ipnlocal: move last unconditional gvisor import, complete ts_omit_netstack support
Fixes #17283

Change-Id: Ia84d269683e4a68d7d10562561204934eeaf53bb
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-26 14:00:12 -07:00
Brad Fitzpatrick
b3ae1cb0cc wgengine/netstack/gro: permit building without GRO
This only saves ~32KB in the minimal linux/amd64 binary, but it's a
step towards permitting not depending on gvisor for small builds.

Updates #17283

Change-Id: Iae8da5e9465127de354dbcaf25e794a6832d891b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-26 09:07:48 -07:00
Brad Fitzpatrick
45d635cc98 feature/portlist: pull portlist service porting into extension, use eventbus
And yay: tsnet (and thus k8s-operator etc) no longer depends on
portlist! And LocalBackend is smaller.

Removes 50 KB from the minimal binary.

Updates #12614

Change-Id: Iee04057053dc39305303e8bd1d9599db8368d926
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-25 12:19:03 -07:00
Brad Fitzpatrick
21dc5f4e21 derp/derpserver: split off derp.Server out of derp into its own package
This exports a number of things from the derp (generic + client) package
to be used by the new derpserver package, as now used by cmd/derper.

And then enough other misc changes to lock in that cmd/tailscaled can
be configured to not bring in tailscale.com/client/local. (The webclient
in particular, even when disabled, was bringing it in, so that's now fixed)

Fixes #17257

Change-Id: I88b6c7958643fb54f386dd900bddf73d2d4d96d5
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-24 09:19:01 -07:00
Brad Fitzpatrick
b3e9a128af net/dns, feature/featuretags: make NetworkManager, systemd-resolved, and DBus modular
Saves 360 KB (19951800 => 19591352 on linux/amd64 --extra-small --box binary)

Updates #12614
Updates #17206

Change-Id: Iafd5b2536dd735111b447546cba335a7a64379ed
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-24 08:55:32 -07:00
Brad Fitzpatrick
8fe575409f feature/featuretags: add build tag to remove captive portal detection
This doesn't yet fully pull it out into a feature/captiveportal package.
This is the usual first step, moving the code to its own files within
the same packages.

Updates #17254

Change-Id: Idfaec839debf7c96f51ca6520ce36ccf2f8eec92
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-24 08:31:13 -07:00
Brad Fitzpatrick
5e698a81b6 cmd/tailscaled: make the outbound HTTP/SOCKS5 proxy modular
Updates #12614

Change-Id: Icba6f1c0838dce6ee13aa2dc662fb551813262e4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-19 11:22:08 -07:00
Naman Sood
b9cda4bca5
tsnet,internal/client/tailscale: resolve OAuth into authkeys in tsnet (#17191)
* tsnet,internal/client/tailscale: resolve OAuth into authkeys in tsnet

Updates #8403.

* internal/client/tailscale: omit OAuth library via build tag

Updates #12614.

Signed-off-by: Naman Sood <mail@nsood.in>
2025-09-19 12:31:44 -04:00
Brad Fitzpatrick
697098ed6c ipn/ipnlocal: fix a case where ts_omit_ssh was still linking in x/crypto/ssh
And add a test.

Updates #12614

Change-Id: Icb1c77f5890def794a4938583725c1a0886b197d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-16 18:37:46 -07:00
Brad Fitzpatrick
e180fc267b feature/featuretags, all: add ts_omit_acme to disable TLS cert support
I'd started to do this in the earlier ts_omit_server PR but
decided to split it into this separate PR.

Updates #17128

Change-Id: Ief8823a78d1f7bbb79e64a5cab30a7d0a5d6ff4b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-16 14:11:15 -07:00
Brad Fitzpatrick
99b3f69126 feature/portmapper: make the portmapper & its debugging tools modular
Starting at a minimal binary and adding one feature back...
    tailscaled tailscale combined (linux/amd64)
     30073135  17451704  31543692 omitting everything
    +  480302 +   10258 +  493896 .. add debugportmapper
    +  475317 +  151943 +  467660 .. add portmapper
    +  500086 +  162873 +  510511 .. add portmapper+debugportmapper

Fixes #17148

Change-Id: I90bd0e9d1bd8cbe64fa2e885e9afef8fb5ee74b1
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-16 11:35:49 -07:00
Brad Fitzpatrick
3a49b7464c all: add ts_omit_tailnetlock as a start of making it build-time modular
Updates #17115

Change-Id: I6b083c0db4c4d359e49eb129d626b7f128f0a9d2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-12 12:23:34 -07:00
Brad Fitzpatrick
a1dcf12b67 feature/drive: start factoring out Taildrive, add ts_omit_drive build tag
As of this commit (per the issue), the Taildrive code remains where it
was, but in new files that are protected by the new ts_omit_drive
build tag. Future commits will move it.

Updates #17058

Change-Id: Idf0a51db59e41ae8da6ea2b11d238aefc48b219e
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-11 14:26:08 -07:00
Brad Fitzpatrick
3e4b0c1516 cmd/tailscale, ipn/ipnlocal: add ts_omit_webclient
Fixes #17063
Updates #12614

Change-Id: I0a189f6a4d1c4558351e3195839867725774fa96
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08 12:59:42 -07:00
Brad Fitzpatrick
21f21bd2a2 util/syspolicy: finish adding ts_omit_syspolicy build tags, tests
Fixes #16998
Updates #12614

Change-Id: Idf2b1657898111df4be31f356091b2376d0d7f0b
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-02 18:09:16 -07:00
Percy Wegmann
2e95313b8b ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh
The upstream crypto package now supports sending banners at any time during
authentication, so the Tailscale fork of crypto/ssh is no longer necessary.

github.com/tailscale/golang-x-crypto is still needed for some custom ACME
autocert functionality.

tempfork/gliderlabs is still necessary because of a few other customizations,
mostly related to TTY handling.

Originally implemented in 46fd4e58a27495263336b86ee961ee28d8c332b7,
which was reverted in b60f6b849af1fae1cf343be98f7fb1714c9ea165 to
keep the change out of v1.80.

Updates #8593

Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-31 16:36:39 -06:00
Percy Wegmann
b60f6b849a Revert "ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh"
This reverts commit 46fd4e58a27495263336b86ee961ee28d8c332b7.

We don't want to include this in 1.80 yet, but can add it back post 1.80.

Updates #8593

Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-29 10:47:45 -06:00
Percy Wegmann
46fd4e58a2 ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh
The upstream crypto package now supports sending banners at any time during
authentication, so the Tailscale fork of crypto/ssh is no longer necessary.

github.com/tailscale/golang-x-crypto is still needed for some custom ACME
autocert functionality.

tempfork/gliderlabs is still necessary because of a few other customizations,
mostly related to TTY handling.

Updates #8593

Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-28 14:20:55 -06:00
Brad Fitzpatrick
23880eb5b0 cmd/tailscaled: support "ts_omit_ssh" build tag to remove SSH
Some environments would like to remove Tailscale SSH support for the
binary for various reasons when not needed (either for peace of mind,
or the ~1MB of binary space savings).

Updates tailscale/corp#24454
Updates #1278
Updates #12614

Change-Id: Iadd6c5a393992c254b5dc9aa9a526916f96fd07a
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-07 16:06:59 -08:00