Carried over from UPSTREAM_PRS.md, where it is recorded as mineable from upstream CamM2325/microlink#22 but not done yet. Filing it as an issue so it is not lost in a docs table.
ml_derp_connect()'s failure paths only close the socket — they never free the mbedTLS context. That leaks roughly 20 KB of TLS I/O buffers per failed attempt, and under CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC=y that is internal RAM. It compounds because microlink_rebind() reconnects DERP on every WiFi reconnect.
Upstream's fix is a derp_tls_abort() helper. It is independent of the headscale-specific parts of #22, so it can be taken on its own rather than pulling that whole rewrite.
Needs adapting, not cherry-picking as-is: this fork already deleted the entropy / ctr_drbg init+free pairs from ml_derp.c for mbedTLS 4.x (see ESP_IDF_6X_COMPAT.md §2–3), so our derp_tls_abort() must free only ssl / ssl_conf and not the fields we removed.
Carried over from
UPSTREAM_PRS.md, where it is recorded as mineable from upstream CamM2325/microlink#22 but not done yet. Filing it as an issue so it is not lost in a docs table.ml_derp_connect()'s failure paths only close the socket — they never free the mbedTLS context. That leaks roughly 20 KB of TLS I/O buffers per failed attempt, and underCONFIG_MBEDTLS_INTERNAL_MEM_ALLOC=ythat is internal RAM. It compounds becausemicrolink_rebind()reconnects DERP on every WiFi reconnect.Upstream's fix is a
derp_tls_abort()helper. It is independent of the headscale-specific parts of #22, so it can be taken on its own rather than pulling that whole rewrite.Needs adapting, not cherry-picking as-is: this fork already deleted the
entropy/ctr_drbginit+free pairs fromml_derp.cfor mbedTLS 4.x (seeESP_IDF_6X_COMPAT.md§2–3), so ourderp_tls_abort()must free onlyssl/ssl_confand not the fields we removed.