tree 488f5fbae32b4aa36d643958b1caf23777d2d7fd
parent c6d1c3ed1c39a4ce002bcc99fcaa0fbc941a38f0
author Hanno Becker <hanno.becker@arm.com> 1551793473 +0000
committer Hanno Becker <hanno.becker@arm.com> 1561450036 +0100

Introduce compile-time option to always flush X.509 CRT caches

This commit introduces a compile-time option MBEDTLS_X509_ALWAYS_FLUSH
which controls whether releasing of CRT frames or public key contexts
associated to X.509 CRTs (or, in the future, other cached parsed X.509
structures) should lead to freeing those structures immediately.

Enabling this alongside of the MBEDTLS_X509_ON_DEMAND_PARSING leads
to significant reduction of the average RAM consumption of Mbed TLS.

The option is enabled by default to reduce the permanent RAM overhead of
MBEDTLS_X509_ON_DEMAND_PARSING in case the latter is *disabled* (default).
(Note that there is very little performance penalty enabling
MBEDTLS_X509_ALWAYS_FLUSH in case MBEDTLS_X509_ON_DEMAND_PARSING is disabled,
because hardly any parsing needs to be done to setup a CRT frame / PK context
from the legacy `mbedtls_x509_crt` structure.)