Handle invalid url enrollment

deps/CMakeLists.txt

@@ -9,7 +9,7 @@ if (NOT TARGET tlsuv)
     else ()
         FetchContent_Declare(tlsuv
                 GIT_REPOSITORY https://github.com/openziti/tlsuv.git
-                GIT_TAG v0.33.8
+                GIT_TAG v0.33.9
         )
         FetchContent_MakeAvailable(tlsuv)
     endif (tlsuv_DIR)

library/ziti_ctrl.c

@@ -612,7 +612,6 @@ int ziti_ctrl_init(uv_loop_t *loop, ziti_controller *ctrl, model_list *urls, tls
     ctrl->page_size = DEFAULT_PAGE_SIZE;
     ctrl->loop = loop;
     memset(&ctrl->version, 0, sizeof(ctrl->version));
-    ctrl->client = calloc(1, sizeof(tlsuv_http_t));
 
     const char *ep;
     MODEL_LIST_FOREACH(ep, *urls) {
@@ -624,7 +623,13 @@ int ziti_ctrl_init(uv_loop_t *loop, ziti_controller *ctrl, model_list *urls, tls
     const char *initial_ep = ctrl_next_ep(ctrl, NULL);
     ctrl->url = strdup(initial_ep);
     CTRL_LOG(INFO, "using %s", ctrl->url);
+
+    ctrl->client = calloc(1, sizeof(tlsuv_http_t));
     if (tlsuv_http_init(loop, ctrl->client, ctrl->url) != 0) {
+        if (tlsuv_http_close(ctrl->client, (tlsuv_http_close_cb) free) != 0) {
+            free(ctrl->client);
+        }
+        ctrl->client = NULL;
         return ZITI_INVALID_CONFIG;
     }
 

library/ziti_enroll.c

@@ -155,7 +155,7 @@ int ziti_enroll(const ziti_enroll_opts *opts, uv_loop_t *loop,
 static void network_jwt_cb(ziti_network_jwt_array arr, const ziti_error *err, void *ctx) {
     struct ziti_enroll_req *er = ctx;
     if (err) {
-        er->enroll_cb(NULL, ZITI_ENROLLMENT_METHOD_UNSUPPORTED, ziti_errorstr(ZITI_ENROLLMENT_METHOD_UNSUPPORTED), er->ctx);
+        er->enroll_cb(NULL, err->err, err->message, er->ctx);
         free_enroll_req(er);
         return;
     }
@@ -181,18 +181,21 @@ int fetch_network_token(struct ziti_enroll_req *er) {
 
     er->tls = default_tls_context(NULL, 0);
 
+    model_list ctrls = {};
+
     if (url.query != NULL) {
         // TODO magic URL
     } else {
         // controller URL must be verifiable with default/OS cert bundle
-        model_list ctrls = {};
         model_list_append(&ctrls, er->opts.url);
-        ziti_ctrl_init(er->loop, &er->controller, &ctrls, er->tls);
-        ziti_ctrl_get_network_jwt(&er->controller, network_jwt_cb, er);
-        model_list_clear(&ctrls, NULL);
-
+        rc = ziti_ctrl_init(er->loop, &er->controller, &ctrls, er->tls);
+        if (rc == ZITI_OK) {
+            ziti_ctrl_get_network_jwt(&er->controller, network_jwt_cb, er);
+        }
     }
-    return ZITI_OK;
+
+    model_list_clear(&ctrls, NULL);
+    return rc;
 }
 
 static int start_enrollment(struct ziti_enroll_req *er) {
@@ -260,7 +263,9 @@ static int start_enrollment(struct ziti_enroll_req *er) {
 
 static void free_enroll_req(struct ziti_enroll_req * er) {
     if (er) {
-        ziti_ctrl_close(&er->controller);
+        if (er->controller.loop) {
+            ziti_ctrl_close(&er->controller);
+        }
         if (er->tls) er->tls->free_ctx(er->tls);
         if (er->pk != NULL) { er->pk->free(er->pk); }
         if (er->cert != NULL) { er->cert->free(er->cert); }

tests/integ/CMakeLists.txt

@@ -1,7 +1,7 @@
 
 find_program(EXPECTOR NAMES expect)
 if (NOT EXPECTOR)
     message(WARNING "expect not found: integration testing is not enabled")
     return()
 endif ()
 
@@ -27,6 +27,7 @@
         legacy-auth.cpp
         oidc-tests.cpp
         ctrl_tests.cpp
+        enroll_tests.cpp
 )
 target_include_directories(integ-tests
         PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/include

tests/integ/enroll_tests.cpp

@@ -0,0 +1,97 @@
+/*
+ Copyright 2025 NetFoundry Inc.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "../catch2_includes.hpp"
+#include "fixtures.h"
+
+#include <ziti/ziti.h>
+
+TEST_CASE_METHOD(LoopTestCase, "enroll-invalid-url", "[enroll][integration]") {
+    ziti_enroll_opts opts {
+        .url = "not a valid url",
+    };
+
+    struct test_ctx_t {
+        bool called{false};
+        int status{INT32_MAX};
+        std::string error;
+
+    } test_ctx;
+    auto rc = ziti_enroll(&opts, loop(), [](const ziti_config *cfg, int status, const char *err_message, void *enroll_ctx){
+        auto tctx = (test_ctx_t*)enroll_ctx;
+        tctx->called = true;
+        tctx->status = status;
+        tctx->error = err_message ? err_message : "OK";
+    }, &test_ctx);
+
+    uv_run(loop(), UV_RUN_DEFAULT);
+
+    CHECK(rc == ZITI_INVALID_CONFIG);
+    CHECK(!test_ctx.called);
+}
+
+TEST_CASE_METHOD(LoopTestCase, "enroll-unknown-url", "[enroll][integration]") {
+    ziti_enroll_opts opts {
+            .url = "https://this.is.not.a.valid.address:18443",
+    };
+
+    struct test_ctx_t {
+        bool called{false};
+        int status{INT32_MAX};
+        std::string error;
+
+    } test_ctx;
+    auto rc = ziti_enroll(&opts, loop(), [](const ziti_config *cfg, int status, const char *err_message, void *enroll_ctx){
+        auto tctx = (test_ctx_t*)enroll_ctx;
+        tctx->called = true;
+        tctx->status = status;
+        tctx->error = err_message ? err_message : "OK";
+    }, &test_ctx);
+
+    uv_run(loop(), UV_RUN_DEFAULT);
+
+    CHECK(rc == ZITI_OK);
+    CHECK(test_ctx.called);
+    CHECK(test_ctx.status == ZITI_CONTROLLER_UNAVAILABLE);
+    CHECK(test_ctx.error == uv_strerror(UV_EAI_NONAME));
+}
+
+TEST_CASE_METHOD(LoopTestCase, "enroll-nonziti-url", "[enroll][integration]") {
+    ziti_enroll_opts opts {
+            .url = "https://google.com",
+    };
+
+    struct test_ctx_t {
+        bool called{false};
+        int status{INT32_MAX};
+        std::string error;
+
+    } test_ctx;
+    auto rc = ziti_enroll(&opts, loop(), [](const ziti_config *cfg, int status, const char *err_message, void *enroll_ctx){
+        auto tctx = (test_ctx_t*)enroll_ctx;
+        tctx->called = true;
+        tctx->status = status;
+        tctx->error = err_message ? err_message : "OK";
+    }, &test_ctx);
+
+    uv_run(loop(), UV_RUN_DEFAULT);
+
+    CHECK(rc == ZITI_OK);
+    CHECK(test_ctx.called);
+    CHECK(test_ctx.status == ZITI_INVALID_STATE);
+    INFO(test_ctx.error);
+    CHECK(test_ctx.error != "OK");
+}

tests/integ/fixtures.h

@@ -21,14 +21,15 @@
 class LoopTestCase {
     uv_loop_t *m_loop;
 
-  protected:
+protected:
     LoopTestCase():
                      m_loop(uv_loop_new())
     {}
 
     ~LoopTestCase() {
-        uv_loop_close(loop());
-        free(m_loop);
+        //uv_loop_close(loop());
+        uv_loop_delete(m_loop);
+//        free(m_loop);
     }
 
     uv_loop_t *loop() { return m_loop; }