nxos_igmp_snooping: group-timeout fails when igmp snooping disabled (#53079)

* nxos_igmp_snooping: group-timeout fails when igmp snooping disabled

group-timeout config will be rejected by the device if `ip igmp snooping` is disabled.

  * raise a failure for this condition

  * reorder the command list so that group-timeout is always last

* SA fixes

* SA fixes

* only call gt_dependency if gt

lib/ansible/modules/network/nxos/nxos_igmp_snooping.py

@@ -218,6 +218,19 @@ def get_igmp_snooping_defaults():
     return default
 
 
+def igmp_snooping_gt_dependency(command, existing, module):
+    # group-timeout will fail if igmp snooping is disabled
+    gt = [i for i in command if i.startswith('ip igmp snooping group-timeout')]
+    if gt:
+        if 'no ip igmp snooping' in command or (existing['snooping'] is False and 'ip igmp snooping' not in command):
+            msg = "group-timeout cannot be enabled or changed when ip igmp snooping is disabled"
+            module.fail_json(msg=msg)
+        else:
+            # ensure that group-timeout command is configured last
+            command.remove(gt[0])
+            command.append(gt[0])
+
+
 def main():
     argument_spec = dict(
         snooping=dict(required=False, type='bool'),
@@ -260,6 +273,8 @@ def main():
         if delta:
             command = config_igmp_snooping(delta, existing)
             if command:
+                if group_timeout:
+                    igmp_snooping_gt_dependency(command, existing, module)
                 commands.append(command)
     elif state == 'default':
         proposed = get_igmp_snooping_defaults()

test/integration/targets/nxos_igmp_snooping/tests/common/sanity.yaml

@@ -18,7 +18,7 @@
   - name: Configure igmp snooping with non-default values
     nxos_igmp_snooping: &non-default
       snooping: false
-      group_timeout: "{{group_timeout|default(omit)}}"
+      # group_timeout: n/a when snooping:false
       link_local_grp_supp: false
       report_supp: false
       v3_report_supp: true
@@ -39,6 +39,38 @@
           - "result.changed == false"
     when: (imagetag and (imagetag is version_compare('D1', 'ne')))
 
+  - block:
+    - name: Negative Test config group-timeout when igmp snooping disabled
+      nxos_igmp_snooping:
+        snooping: false
+        group_timeout: "{{group_timeout|default(omit)}}"
+        provider: "{{ connection }}"
+        state: present
+      ignore_errors: yes
+      register: result
+
+    - assert:
+        that:
+          - "result.failed == true"
+          - "result.msg == 'group-timeout cannot be enabled or changed when ip igmp snooping is disabled'"
+
+    - name: Configure group-timeout non-default
+      nxos_igmp_snooping: &non-defgt
+        snooping: true
+        group_timeout: "{{group_timeout|default(omit)}}"
+        provider: "{{ connection }}"
+        state: present
+      register: result
+
+    - assert: *true
+
+    - name: "Check Idempotence"
+      nxos_igmp_snooping: *non-defgt
+      register: result
+
+    - assert: *false
+    when: gt_run
+
   - name: Configure igmp snooping with default group timeout
     nxos_igmp_snooping: &defgt
       group_timeout: "{{def_group_timeout|default(omit)}}"