fix: disallow 0.0.0.0/0 in egress firewall cidr_list

The CloudStack API does not reject 0.0.0.0/0 as an egress firewall CIDR
but silently replaces it with the network's own CIDR. This causes a
permanent drift between the Terraform state (which stores 0.0.0.0/0)
and the actual API state (which returns the network CIDR), resulting in
Terraform perpetually planning to recreate the resource.

Validate early in verifyEgressFirewallRuleParams to surface a clear
error before the API call is made.

Author: elivlo

cloudstack/resource_cloudstack_egress_firewall.go

@@ -542,7 +542,7 @@ func deleteEgressFirewallRules(d *schema.ResourceData, meta interface{}, rules *
 	return errs.ErrorOrNil()
 }
 
-func deleteEgressFirewallRule(d *schema.ResourceData, meta interface{}, rule map[string]interface{}) error {
+func deleteEgressFirewallRule(_ *schema.ResourceData, meta interface{}, rule map[string]interface{}) error {
 	cs := meta.(*cloudstack.CloudStackClient)
 	uuids := rule["uuids"].(map[string]interface{})
 
@@ -589,7 +589,13 @@ func verifyEgressFirewallParams(d *schema.ResourceData) error {
 	return nil
 }
 
-func verifyEgressFirewallRuleParams(d *schema.ResourceData, rule map[string]interface{}) error {
+func verifyEgressFirewallRuleParams(_ *schema.ResourceData, rule map[string]interface{}) error {
+	if cidrList, ok := rule["cidr_list"].(*schema.Set); ok {
+		if cidrList.Contains("0.0.0.0/0") {
+			return fmt.Errorf("CIDR 0.0.0.0/0 is not allowed in egress firewall rules. cidr_list must be within the network subnet")
+		}
+	}
+
 	protocol := rule["protocol"].(string)
 	if strings.ToLower(protocol) != "all" && protocol != "tcp" && protocol != "udp" && protocol != "icmp" {
 		return fmt.Errorf(

cloudstack/resource_cloudstack_egress_firewall_test.go

@@ -25,10 +25,44 @@ import (
 	"testing"
 
 	"github.com/apache/cloudstack-go/v2/cloudstack"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 )
 
+func TestVerifyEgressFirewallRuleParams_disallowAnyIP(t *testing.T) {
+	cidrSet := schema.NewSet(schema.HashString, []interface{}{"0.0.0.0/0"})
+	rule := map[string]interface{}{
+		"cidr_list": cidrSet,
+		"protocol":  "tcp",
+		"ports":     schema.NewSet(schema.HashString, []interface{}{"80"}),
+		"uuids":     map[string]interface{}{},
+	}
+
+	err := verifyEgressFirewallRuleParams(nil, rule)
+	if err == nil {
+		t.Fatal("expected error for cidr 0.0.0.0/0, got nil")
+	}
+	if !strings.Contains(err.Error(), "0.0.0.0/0") {
+		t.Fatalf("expected error message to mention 0.0.0.0/0, got: %s", err.Error())
+	}
+}
+
+func TestVerifyEgressFirewallRuleParams_allowValidCIDR(t *testing.T) {
+	cidrSet := schema.NewSet(schema.HashString, []interface{}{"10.1.1.0/24"})
+	rule := map[string]interface{}{
+		"cidr_list": cidrSet,
+		"protocol":  "tcp",
+		"ports":     schema.NewSet(schema.HashString, []interface{}{"80"}),
+		"uuids":     map[string]interface{}{},
+	}
+
+	err := verifyEgressFirewallRuleParams(nil, rule)
+	if err != nil {
+		t.Fatalf("expected no error for valid cidr, got: %s", err.Error())
+	}
+}
+
 func TestAccCloudStackEgressFirewall_basic(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },