improve validation of provider RPC responses

[abergmeier]

Terraform Version

Terraform v1.1.9
on linux_amd64

Terraform Configuration Files

resource "buildx_instance" "foo" {
  name = "test-basic"
  driver {
    name = "docker-container"
  }
  bootstrap = true
}

resource "buildx_built" "foo" {
  file    = "testdata/Containerfile"
  context = "."
  output {
    docker {
      dest = "image.docker"
    }
  }
  instance = buildx_instance.foo.name
}

Debug Output

See https://gist.github.com/abergmeier/fe55ad498453c30c85dde63aca2aa54b

Expected Behavior

It should not have crashed.

Actual Behavior

It crashes.

Steps to Reproduce

CGO_ENABLED=0 TF_ACC=1 TF_LOG=trace go test ./internal/resources/builttest -v

References

[jbardin]

Hi @abergmeier,

Thanks for reporting the issue. While Terraform might be able to better validate the plugin return values and prevent the crash, the problem ultimately looks like an invalid schema returned by the provider.

Without any provider code to see, it's hard to determine what may be producing the invalid schema. If by "Framework Provider" you mean that this is using the terraform-plugin-framework, then I would start by filing an issue there with a reproduction case.

Thanks!

[abergmeier]

the problem ultimately looks like an invalid schema returned by the provider.

Well personally I would be expecting Terraform to be stable enough to not crash upon whatever the provider is doing "wrong" or even better give a proper error message in those cases.

[jbardin]

@abergmeier, yes, both sides should be responsible for the correct protocol handling. I'm leaving this open as an issue to improve the validation in the Terraform CLI, but the fact that an invalid data structure was returned by the framework is possibly a bug there as well.

[abergmeier]

So looking at CLI code it should be as easy as adding a check whether Block is nil and then gracefully producing an error.
Also if this check is omitted often in the codebase maybe a general sweep across usage of Protobuf types would be good so these kind of errors get squashed.

[bflad]

@jbardin additional details here: hashicorp/terraform-plugin-framework#326 (comment)

Outside the missing nil checks in the internal/plugin6/convert code, the GetProviderSchema receiving code should probably also ensure there was no error diagnostics from the provider before proceeding with conversion logic of potentially incomplete/invalid schemas.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.