Add IPv6 validation to parseCIDRv6 to prevent IPv4 CIDR panics

The parseCIDRv6 function now explicitly validates that the provided CIDR
is IPv6, not IPv4. Previously, net.ParseCIDR() would accept IPv4 CIDRs,
and To16() would return a non-nil value (IPv4-mapped IPv6), but the mask
would only be 4 bytes. This caused a panic when the code tried to index
ipnet.Mask[i] assuming a 16-byte mask.

The fix adds two validation checks:
1. ip.To4() == nil (ensures it's not IPv4)
2. len(ipnet.Mask) == net.IPv6len (ensures 16-byte mask)

Added unit test TestParseCIDRv6_RejectsIPv4 to verify the validation.

Author: bhouse-nexthop

cloudstack/resource_cloudstack_network.go

@@ -541,11 +541,19 @@ func parseCIDRv6(d *schema.ResourceData, specifyiprange bool) (map[string]string
 	m := make(map[string]string, 4)
 
 	cidr := d.Get("ip6cidr").(string)
-	_, ipnet, err := net.ParseCIDR(cidr)
+	ip, ipnet, err := net.ParseCIDR(cidr)
 	if err != nil {
 		return nil, fmt.Errorf("Unable to parse cidr %s: %s", cidr, err)
 	}
 
+	// Validate that this is actually an IPv6 CIDR
+	if ip.To4() != nil {
+		return nil, fmt.Errorf("ip6cidr must be an IPv6 CIDR, got IPv4: %s", cidr)
+	}
+	if len(ipnet.Mask) != net.IPv6len {
+		return nil, fmt.Errorf("ip6cidr must be an IPv6 CIDR with 16-byte mask, got %d bytes: %s", len(ipnet.Mask), cidr)
+	}
+
 	if gateway, ok := d.GetOk("ip6gateway"); ok {
 		m["ip6gateway"] = gateway.(string)
 	} else {

cloudstack/resource_cloudstack_network_unit_test.go

@@ -133,3 +133,19 @@ func TestParseCIDRv6_SmallerPrefix(t *testing.T) {
 		t.Errorf("Expected end IP %s, got %s", expectedEndIP, result["endipv6"])
 	}
 }
+
+func TestParseCIDRv6_RejectsIPv4(t *testing.T) {
+	d := schema.TestResourceDataRaw(t, resourceCloudStackNetwork().Schema, map[string]interface{}{
+		"ip6cidr": "10.0.0.0/24",
+	})
+
+	_, err := parseCIDRv6(d, false)
+	if err == nil {
+		t.Fatal("parseCIDRv6 should reject IPv4 CIDR")
+	}
+
+	expectedError := "ip6cidr must be an IPv6 CIDR, got IPv4"
+	if err.Error()[:len(expectedError)] != expectedError {
+		t.Errorf("Expected error message to start with '%s', got '%s'", expectedError, err.Error())
+	}
+}