diff --git a/changelog/67078.fixed.md b/changelog/67078.fixed.md new file mode 100644 index 00000000000..7625de1d390 --- /dev/null +++ b/changelog/67078.fixed.md @@ -0,0 +1 @@ +Fix nftables module check function doesn't understand that braces are optional diff --git a/salt/modules/nftables.py b/salt/modules/nftables.py index 4c9f1aad44a..03094240ba6 100644 --- a/salt/modules/nftables.py +++ b/salt/modules/nftables.py @@ -569,13 +569,12 @@ def check(table="filter", chain=None, rule=None, family="ipv4"): return res nft_family = _NFTABLES_FAMILIES[family] - cmd = "{} --handle --numeric --numeric --numeric list chain {} {} {}".format( - _nftables_cmd(), nft_family, table, chain - ) - search_rule = f"{rule} #" - out = __salt__["cmd.run"](cmd, python_shell=False).find(search_rule) + cmd = f"{_nftables_cmd()} --handle list chain {nft_family} {table} {chain}" + search_rule = f"{rule} #".replace("{ ", "{? ?").replace(" }", " ?}?") + out = __salt__["cmd.run"](cmd, python_shell=False) + found = re.search(search_rule, out) - if out == -1: + if not found: ret["comment"] = ( "Rule {} in chain {} in table {} in family {} does not exist".format( rule, chain, table, family diff --git a/tests/pytests/unit/modules/test_nftables.py b/tests/pytests/unit/modules/test_nftables.py index 8c866a52305..cf26c648b17 100644 --- a/tests/pytests/unit/modules/test_nftables.py +++ b/tests/pytests/unit/modules/test_nftables.py @@ -1062,3 +1062,18 @@ def test_set_policy(): assert nftables.set_policy( table="filter", chain="input", policy="accept", family="ipv4" ) + + +@pytest.mark.parametrize( + "rule", + ["ct state { new } tcp dport { 22 } accept", "ct state new tcp dport 22 accept"], +) +def test_check_should_handles_braces_for_single_value_returns(rule): + ret = { + "result": True, + "comment": f"Rule {rule} in chain input in table filter in family ipv4 exists", + } + nft_list_out = "table ip filter {\n\tchain input { # handle 1\n\t\tct state new tcp dport 22 accept # handle 6\n\t}\n}" + mock = MagicMock(return_value=nft_list_out) + with patch.dict(nftables.__salt__, {"cmd.run": mock}): + assert nftables.check(chain="input", rule=rule) == ret