Fix nftables module check function doesn't understand that braces are optional

changelog/67078.fixed.md

@@ -0,0 +1 @@
+Fix nftables module check function doesn't understand that braces are optional

salt/modules/nftables.py

@@ -569,13 +569,12 @@ def check(table="filter", chain=None, rule=None, family="ipv4"):
         return res
 
     nft_family = _NFTABLES_FAMILIES[family]
-    cmd = "{} --handle --numeric --numeric --numeric list chain {} {} {}".format(
-        _nftables_cmd(), nft_family, table, chain
-    )
-    search_rule = f"{rule} #"
-    out = __salt__["cmd.run"](cmd, python_shell=False).find(search_rule)
+    cmd = f"{_nftables_cmd()} --handle list chain {nft_family} {table} {chain}"
+    search_rule = f"{rule} #".replace("{ ", "{? ?").replace(" }", " ?}?")
+    out = __salt__["cmd.run"](cmd, python_shell=False)
+    found = re.search(search_rule, out)
 
-    if out == -1:
+    if not found:
         ret["comment"] = (
             "Rule {} in chain {} in table {} in family {} does not exist".format(
                 rule, chain, table, family

tests/pytests/unit/modules/test_nftables.py

@@ -1062,3 +1062,18 @@ def test_set_policy():
             assert nftables.set_policy(
                 table="filter", chain="input", policy="accept", family="ipv4"
             )
+
+
+@pytest.mark.parametrize(
+    "rule",
+    ["ct state { new } tcp dport { 22 } accept", "ct state new tcp dport 22 accept"],
+)
+def test_check_should_handles_braces_for_single_value_returns(rule):
+    ret = {
+        "result": True,
+        "comment": f"Rule {rule} in chain input in table filter in family ipv4 exists",
+    }
+    nft_list_out = "table ip filter {\n\tchain input { # handle 1\n\t\tct state new tcp dport 22 accept # handle 6\n\t}\n}"
+    mock = MagicMock(return_value=nft_list_out)
+    with patch.dict(nftables.__salt__, {"cmd.run": mock}):
+        assert nftables.check(chain="input", rule=rule) == ret