TSG-22752 Delete SSL Fingerprints, use is_app_not_pinning to determine Certificate Not Installed or Certificate Pinning

1 files changed, 106 insertions, 240 deletions

diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp
index 2a9f59d..fccabfa 100644
--- a/platform/src/ssl_service_cache.cpp
+++ b/platform/src/ssl_service_cache.cpp
@@ -1,17 +1,8 @@
 #include <ssl_service_cache.h>
 #include <MESA/maat.h>
-#include <tfe_resource.h>
 #include <ssl_stream.h>
 #include <cjson/cJSON.h>
 
-struct ssl_svc_ja3
-{
-	uuid_t uuid;
-	char ja3_hash[33];
-	int pinning_state;
-	int ref_cnt;
-};
-
 struct ssl_svc_addr
 {
 	const char *sip;
@@ -20,170 +11,6 @@ struct ssl_svc_addr
 	const char *dport;
 };
 
-static void ssl_svc_ja3_param_dup_cb(const char *table_name, void **to, void **from, long argl, void *argp)
-{
-	struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*from;
-	if (param)
-	{
-		__sync_add_and_fetch(&(param->ref_cnt), 1);
-		*to = param;
-	}
-	else
-	{
-		*to = NULL;
-	}
-	return;
-}
-
-// NOTE: key is ja3_hash
-static void ssl_svc_ja3_param_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp)
-{
-	cJSON *json = NULL;
-	cJSON *item = NULL;
-	struct ssl_svc_ja3 *param = NULL;
-
-	char *json_str = strdup(table_line);
-	json = cJSON_Parse(json_str);
-	if (json == NULL)
-	{
-		TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid json format) %s", table_line);
-		goto error_out;
-	}
-
-	param = ALLOC(struct ssl_svc_ja3, 1);
-	param->ref_cnt = 1;
-
-	// uuid
-	item = cJSON_GetObjectItem(json, "uuid");
-	if (!item || !cJSON_IsString(item))
-	{
-		TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid uuid param) %s", table_line);
-		goto error_out;
-	}
-	uuid_parse(item->valuestring, param->uuid);
-
-	// ja3_hash
-	item = cJSON_GetObjectItem(json, "ja3_hash");
-	if (!item || !cJSON_IsString(item))
-	{
-		TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid ja3_hash param) %s", table_line);
-		goto error_out;
-	}
-	strncpy(param->ja3_hash, item->valuestring, 32);
-
-	// pinning_state
-	item = cJSON_GetObjectItem(json, "pinning_state");
-	if (!item || !cJSON_IsNumber(item))
-	{
-		TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid pinning_state param) %s", table_line);
-		goto error_out;
-	}
-	param->pinning_state = item->valueint;
-
-	*ad = param;
-	TFE_LOG_INFO(g_default_logger, "Add JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d",
-				 key, param->ja3_hash, param->pinning_state);
-
-	cJSON_Delete(json);
-	free(json_str);
-	return;
-
-error_out:
-	if (json)
-	{
-		cJSON_Delete(json);
-	}
-	if (json_str)
-	{
-		free(json_str);
-	}
-	if (param)
-	{
-		free(param);
-	}
-	*ad = NULL;
-	return;
-}
-
-static void ssl_svc_ja3_param_free_cb(const char *table_name, void **ad, long argl, void *argp)
-{
-	struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*ad;
-	if (param == NULL)
-	{
-		return;
-	}
-
-	if ((__sync_sub_and_fetch(&param->ref_cnt, 1) == 0))
-	{
-		char uuid_str[UUID_STRING_SIZE] = {0};
-		uuid_unparse(param->uuid, uuid_str);
-		TFE_LOG_INFO(g_default_logger, "Del JA3 policy: id:%s", uuid_str);
-		free(param);
-		*ad = NULL;
-	}
-}
-
-static void ssl_svc_ja3_param_free(struct ssl_svc_ja3 *param)
-{
-	ssl_svc_ja3_param_free_cb(NULL, (void **)&param, 0, NULL);
-}
-
-static int ssl_svc_ja3_init()
-{
-	if (maat_plugin_table_ex_schema_register(tfe_get_maat_handle(),
-											 "PXY_SSL_FINGERPRINT",
-											 ssl_svc_ja3_param_new_cb,
-											 ssl_svc_ja3_param_free_cb,
-											 ssl_svc_ja3_param_dup_cb,
-											 0,
-											 NULL) != 0)
-	{
-		TFE_LOG_ERROR(g_default_logger, "failed at Maat_plugin_EX_register(PXY_SSL_FINGERPRINT)");
-		return -1;
-	}
-	else
-	{
-		return 0;
-	}
-}
-
-enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str)
-{
-	enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN;
-	struct ssl_svc_ja3 *param = NULL;
-	char uuid_str[UUID_STRING_SIZE] = {0};
-
-	param = (struct ssl_svc_ja3 *)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "PXY_SSL_FINGERPRINT", ja3_hash, strlen(ja3_hash));
-	if (param == NULL)
-	{
-		ret = JA3_PINNING_STATUS_UNKNOWN;
-		goto end;
-	}
-	uuid_unparse(param->uuid, uuid_str);
-	TFE_LOG_INFO(g_default_logger, "Hit JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d, addr:%s",
-				 uuid_str, param->ja3_hash, param->pinning_state, addr_str);
-
-	// 1 - pinning
-	if (param->pinning_state)
-	{
-		ret = JA3_PINNING_STATUS_IS_PINNING;
-	}
-	// 0 - not pinning
-	else
-	{
-		ret = JA3_PINNING_STATUS_NOT_PINNING;
-	}
-
-end:
-	if (param)
-	{
-		ssl_svc_ja3_param_free(param);
-		param = NULL;
-	}
-
-	return ret;
-}
-
 struct ssl_svc_client_st
 {
 	time_t last_update_time;
@@ -200,6 +27,11 @@ struct ssl_svc_server_st
 	long long ct_st_switched;
 	struct ssl_service_cache* ref_svc_cache;
 };
+struct ssl_svc_app_st
+{
+	unsigned int down_ssl_success_cnt;
+	struct ssl_service_cache *ref_svc_cache;
+};
 struct ssl_service_write_args
 {
 	struct ssl_service_cache* cache;
@@ -241,40 +73,26 @@ static void ssl_svc_free_server_st(void * data)
 	free(p);
 	return;
 }
-static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello,  const struct tfe_stream *tcp_stream, char* key_buff, size_t sz)
+static void ssl_svc_free_app_st(void *data)
+{
+	struct ssl_svc_app_st *p = (struct ssl_svc_app_st *)data;
+	struct ssl_service_cache *svc_cache = p->ref_svc_cache;
+	if (p->down_ssl_success_cnt > svc_cache->succ_as_app_not_pinning_count)
+	{
+		svc_cache->stat.app_not_pinning_cnt--;
+	}
+	free(p);
+}
+static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, char* key_buff, size_t sz)
 {
 	size_t key_len=0;
 	key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null");
 	return key_len;
 }
-static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
+static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz)
 {
-    char ja3_val[64] = {0};
-    uint16_t ja3_len = 0;
-    size_t key_len = 0;
-    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
-    if (cmsg != NULL)
-    {
-        int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
-        if (ret != 0)
-        {
-            TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info);
-        }
-		else
-		{
-            TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info);
-        }	
-    }
-
-    // If ja3 is successfully obtained, use ja3 to generate hashkey
-    if (strlen(ja3_val))
-    {
-        key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip);
-        return key_len;
-    }
-
-    // otherwise, splicing ssl attributes to generate hashkey
-    key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
+    // splicing ssl attributes to generate hashkey
+    size_t key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
 												chello->max_version.ossl_format,
 												chello->sni?chello->sni: addr_info->dip ,
 												chello->alpn?chello->alpn:"null");
@@ -295,14 +113,14 @@ static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct
 	}
 	return key_len;
 }
-static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
+static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz)
 {
 	size_t key_len=0;
 	char chello_id_buff[sz];
 	size_t chello_id_len=0;
 
 	key_len=snprintf(key_buff, sz, "%s:", addr_info->sip);
-    chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
+    chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, chello_id_buff, sizeof(chello_id_buff));
     memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
 	key_len += MIN(chello_id_len, sz-key_len);
 
@@ -407,6 +225,7 @@ static long srv_st_read_cb(void * data, const uchar * key, uint size, void * use
 	result->is_ev=srv_st->is_ev;
 	return 1;
 }
+
 static long srv_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
 {
 	struct ssl_svc_server_st* srv_st=(struct ssl_svc_server_st*)data;
@@ -443,6 +262,46 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
 	return 1;
 }
 
+static long app_st_read_cb(void *data, const uchar *key, uint size, void *user_arg)
+{
+	struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data;
+	struct ssl_service_status *result = (struct ssl_service_status *)user_arg;
+	if (app_st == NULL)
+	{
+		return 0;
+	}
+	if (app_st->down_ssl_success_cnt > app_st->ref_svc_cache->succ_as_app_not_pinning_count)
+	{
+		result->is_app_not_pinning = 1;
+	}
+	return 1;
+}
+
+static long app_st_write_cb(void *data, const uchar *key, uint size, void *user_arg)
+{
+	struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data;
+	struct ssl_service_write_args *args = (struct ssl_service_write_args *)user_arg;
+	const struct ssl_service_status *status = args->status;
+	struct ssl_service_cache *cache = args->cache;
+	UNUSED int ret = 0;
+	if (app_st == NULL)
+	{
+		app_st = ALLOC(struct ssl_svc_app_st, 1);
+		app_st->ref_svc_cache = cache;
+		ret = MESA_htable_add(cache->app_st_hash, key, size, app_st);
+		assert(ret >= 0);
+	}
+	if (status->is_app_not_pinning)
+	{
+		app_st->down_ssl_success_cnt++;
+	}
+	if (app_st->down_ssl_success_cnt > cache->succ_as_app_not_pinning_count)
+	{
+		cache->stat.app_not_pinning_cnt++;
+	}
+	return 1;
+}
+
 int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result)
 {
 	long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
@@ -460,39 +319,27 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
     tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
 
 	memset(hash_key, 0, sizeof(hash_key));
-    temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
+    temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
     hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
 	MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
 	TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%ld, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
 				hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
 
 	memset(hash_key, 0, sizeof(hash_key));
-    temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
+    temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
     hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
 	MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
 	TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%ld, sni:%s, addr:%s, ct:%d, ev:%d",
 				hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev);
 
-    char ja3_hash[64] = {0};
-    uint16_t ja3_len = 0;
-    result->ja3_pinning_status = JA3_PINNING_STATUS_UNKNOWN;
-    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
-    if (cmsg)
-    {
-        int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len);
-        if (ret == 0)
-        {
-            result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info);
-            if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN)
-			{
-                app_st_cb_ret = 1;
-            }
-        }
-    }
-    TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, ja3_pinning_status:%d",
-                  ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status);
+	memset(hash_key, 0, sizeof(hash_key));
+	temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
+	hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+	MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
+	TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, app_not_pinning:%d",
+				  hash_key, app_st_cb_ret, chello->sni, addr_str, result->is_app_not_pinning);
 
-    free(addr_str);
+	free(addr_str);
 
     if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
 	{
@@ -525,7 +372,7 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
 	if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
 	{
 		memset(hash_key, 0, sizeof(hash_key));
-        temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
+        temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
         hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
         TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
                       hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
@@ -534,23 +381,27 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
 	if(status->is_ct||status->is_ev)
 	{	
 		memset(hash_key, 0, sizeof(hash_key));
-        temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
+        temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
         hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
         TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
                       hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev);
         MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
 	}
+	if (status->is_app_not_pinning)
+	{
+		memset(hash_key, 0, sizeof(hash_key));
+		temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
+		hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+		TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, sni:%s, addr:%s, app_not_pinning:%d",
+					  hash_key, chello->sni, addr_str, status->is_app_not_pinning);
+		MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
+	}
 
 	free(addr_str);
 }
-struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
+struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win, int succ_as_app_not_pinning_cnt)
 {
-    if (ssl_svc_ja3_init() != 0)
-    {
-        return NULL;
-    }
-
-    struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
+	struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
 	unsigned max_num = slot_size * 4;
 	UNUSED int ret = 0;
 	MESA_htable_handle htable=NULL, saved[3];
@@ -558,8 +409,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
 	cache->fail_as_cli_pinning_count=fail_as_pinning_cnt;
 	cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
 	cache->fail_time_window=fail_time_win;
-	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
-	for(i=0; i<2; i++)
+	cache->succ_as_app_not_pinning_count = succ_as_app_not_pinning_cnt;
+	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st};
+	for(i=0; i<3; i++)
 	{
 		htable = MESA_htable_born();
 		opt_val=0;
@@ -570,10 +422,21 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
 		ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val));
 		ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size));
 		ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num));
+		// for app table
+		if (i == 2)
+		{
+			unsigned int app_expire_seconds = 2 * expire_seconds;
+			ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds));
+			opt_val = HASH_ELIMINATE_ALGO_LRU;
+			ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
+		}
 		// for client table and server table
-		ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
-		opt_val = HASH_ELIMINATE_ALGO_FIFO;
-		ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
+		else
+		{
+			ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
+			opt_val = HASH_ELIMINATE_ALGO_FIFO;
+			ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
+		}
 
 		ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE,
 			(void*)free_func[i], sizeof(free_func[i]));
@@ -584,8 +447,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
 	}
 	cache->cli_st_hash=saved[0];
 	cache->srv_st_hash=saved[1];
-	
-    return cache;
+	cache->app_st_hash=saved[2];
+
+	return cache;
 }
 void ssl_service_cache_destroy(struct ssl_service_cache* cache)
 {
@@ -593,6 +457,8 @@ void ssl_service_cache_destroy(struct ssl_service_cache* cache)
 	cache->cli_st_hash=NULL;
 	MESA_htable_destroy(cache->srv_st_hash, NULL);
 	cache->srv_st_hash=NULL;
+	MESA_htable_destroy(cache->app_st_hash, NULL);
+	cache->app_st_hash=NULL;
 	free(cache);
 	return;
 }