usr.lib/ilbd/ilbd_rules.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <stdlib.h>
#include <strings.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/list.h>
#include <net/if.h>
#include <assert.h>
#include <errno.h>
#include <libintl.h>
#include <libilb.h>
#include <inet/ilb.h>
#include "libilb_impl.h"
#include "ilbd.h"

/* until we all use AF_* macros ... */
#define AF_2_IPPROTO(_af)   (_af == AF_INET)?IPPROTO_IP:IPPROTO_IPV6
#define IPPROTO_2_AF(_i)    (_i == IPPROTO_IP)?AF_INET:AF_INET6

#define PROTOCOL_LEN    16              /* protocol type */
#define ADDR_LEN    (2 * INET6_ADDRSTRLEN + 1)  /* prxy src range */
#define PORT_LEN    6           /* hcport:1-65535 or "ANY" */

static ilb_status_t ilbd_disable_one_rule(ilbd_rule_t *, boolean_t);
static uint32_t i_flags_d2k(int);

#define ILB_SGSRV_2_KSRV(s, k)          \
    (k)->addr  = (s)->sgs_addr;     \
    (k)->min_port = (s)->sgs_minport;   \
    (k)->max_port = (s)->sgs_maxport;   \
    (k)->flags = i_flags_d2k((s)->sgs_flags);   \
    (k)->err = 0;               \
    (void) strlcpy((k)->name, (s)->sgs_srvID, sizeof ((k)->name))

list_t      ilbd_rule_hlist;

static ilb_algo_t
algo_impl2lib(ilb_algo_impl_t a)
{
    switch (a) {
    case ILB_ALG_IMPL_ROUNDROBIN:
        return (ILB_ALG_ROUNDROBIN);
    case ILB_ALG_IMPL_HASH_IP:
        return (ILB_ALG_HASH_IP);
    case ILB_ALG_IMPL_HASH_IP_SPORT:
        return (ILB_ALG_HASH_IP_SPORT);
    case ILB_ALG_IMPL_HASH_IP_VIP:
        return (ILB_ALG_HASH_IP_VIP);
    }
    return (0);
}

static ilb_topo_t
topo_impl2lib(ilb_topo_impl_t t)
{
    switch (t) {
    case ILB_TOPO_IMPL_DSR:
        return (ILB_TOPO_DSR);
    case ILB_TOPO_IMPL_NAT:
        return (ILB_TOPO_NAT);
    case ILB_TOPO_IMPL_HALF_NAT:
        return (ILB_TOPO_HALF_NAT);
    }
    return (0);
}

ilb_algo_impl_t
algo_lib2impl(ilb_algo_t a)
{
    switch (a) {
    case ILB_ALG_ROUNDROBIN:
        return (ILB_ALG_IMPL_ROUNDROBIN);
    case ILB_ALG_HASH_IP:
        return (ILB_ALG_IMPL_HASH_IP);
    case ILB_ALG_HASH_IP_SPORT:
        return (ILB_ALG_IMPL_HASH_IP_SPORT);
    case ILB_ALG_HASH_IP_VIP:
        return (ILB_ALG_IMPL_HASH_IP_VIP);
    }
    return (0);
}

ilb_topo_impl_t
topo_lib2impl(ilb_topo_t t)
{
    switch (t) {
    case ILB_TOPO_DSR:
        return (ILB_TOPO_IMPL_DSR);
    case ILB_TOPO_NAT:
        return (ILB_TOPO_IMPL_NAT);
    case ILB_TOPO_HALF_NAT:
        return (ILB_TOPO_IMPL_HALF_NAT);
    }
    return (0);
}

/*
 * Walk the list of rules and check if its safe to add the
 * the server to the rule (this is a list of rules hanging
 * off of a server group)
 */
ilb_status_t
i_check_srv2rules(list_t *rlist, ilb_sg_srv_t *srv)
{
    ilb_status_t    rc = ILB_STATUS_OK;
    ilbd_rule_t *rl;
    int     server_portrange, rule_portrange;
    int     srv_minport, srv_maxport;
    int     r_minport, r_maxport;

    if (srv == NULL)
        return (ILB_STATUS_OK);

    srv_minport = ntohs(srv->sgs_minport);
    srv_maxport = ntohs(srv->sgs_maxport);

    for (rl = list_head(rlist); rl != NULL; rl = list_next(rlist, rl)) {
        r_minport = ntohs(rl->irl_minport);
        r_maxport = ntohs(rl->irl_maxport);

        if ((srv_minport != 0) && (srv_minport == srv_maxport)) {
            /* server has single port */
            if (rl->irl_topo == ILB_TOPO_DSR) {
                /*
                 * either we have a DSR rule with a port
                 * range, or both server and rule
                 * have single ports but their values
                 * don't match - this is incompatible
                 */
                if (r_maxport > r_minport) {
                    rc = ILB_STATUS_INVAL_SRVR;
                    break;
                } else if (srv_minport != r_minport) {
                    rc = ILB_STATUS_BADPORT;
                    break;
                }
            }
            if (rl->irl_hcpflag == ILB_HCI_PROBE_FIX &&
                rl->irl_hcport != srv_minport) {
                rc = ILB_STATUS_BADPORT;
                break;
            }
        } else if (srv_maxport > srv_minport) {
            /* server has a port range */
            if ((rl->irl_topo == ILB_TOPO_DSR) &&
                (r_maxport > r_minport)) {
                if ((r_minport != srv_minport) ||
                    (r_maxport != srv_maxport)) {
                    /*
                     * we have a DSR rule with a port range
                     * and its min and max port values
                     * does not meet that of server's
                     * - this is incompatible
                     */
                    rc = ILB_STATUS_BADPORT;
                    break;
                }
            } else if ((rl->irl_topo == ILB_TOPO_DSR) &&
                (r_maxport == r_minport)) {
                    /*
                     * we have a DSR rule with a single
                     * port and a server with a port range
                     * - this is incompatible
                     */
                    rc = ILB_STATUS_INVAL_SRVR;
                    break;
            } else if (((rl->irl_topo == ILB_TOPO_NAT) ||
                (rl->irl_topo == ILB_TOPO_HALF_NAT)) &&
                (r_maxport > r_minport)) {
                server_portrange = srv_maxport - srv_minport;
                rule_portrange = r_maxport - r_minport;
                if (rule_portrange != server_portrange) {
                    /*
                     * we have a NAT/Half-NAT rule with
                     * a port range and server with a port
                     * range and there is a mismatch in the
                     * sizes of the port ranges - this is
                     * incompatible
                     */
                    rc = ILB_STATUS_INVAL_SRVR;
                    break;
                }
            }
            if (rl->irl_hcpflag == ILB_HCI_PROBE_FIX &&
                (rl->irl_hcport > srv_maxport ||
                rl->irl_hcport < srv_minport)) {
                rc = ILB_STATUS_BADPORT;
                break;
            }
        }
    }

    return (rc);
}

void
i_setup_rule_hlist(void)
{
    list_create(&ilbd_rule_hlist, sizeof (ilbd_rule_t),
        offsetof(ilbd_rule_t, irl_link));
}

ilb_status_t
i_ilbd_save_rule(ilbd_rule_t *irl, ilbd_scf_cmd_t scf_cmd)
{
    boolean_t enable = irl->irl_flags & ILB_FLAGS_RULE_ENABLED;

    switch (scf_cmd) {
    case ILBD_SCF_CREATE:
        return (ilbd_create_pg(ILBD_SCF_RULE, (void *)irl));
    case ILBD_SCF_DESTROY:
        return (ilbd_destroy_pg(ILBD_SCF_RULE, irl->irl_name));
    case ILBD_SCF_ENABLE_DISABLE:
        return (ilbd_change_prop(ILBD_SCF_RULE, irl->irl_name,
            "status", &enable));
    default:
        logdebug("i_ilbd_save_rule: invalid scf cmd %d", scf_cmd);
        return (ILB_STATUS_INVAL_CMD);
    }
}

/*
 * allocate a new daemon-specific rule from the "template" passed
 * in in *r
 */
static ilbd_rule_t *
i_alloc_ilbd_rule(ilb_rule_info_t *r)
{
    ilbd_rule_t *rl;

    rl = calloc(sizeof (*rl), 1);
    if (rl != NULL && r != NULL)
        bcopy(r, &rl->irl_info, sizeof (*r));

    return (rl);
}

static ilbd_rule_t *
i_find_rule_byname(const char *name)
{
    ilbd_rule_t *rl;

    /* find position of rule in list */
    rl = list_head(&ilbd_rule_hlist);
    while (rl != NULL &&
        strncmp(rl->irl_name, name, sizeof (rl->irl_name)) != 0) {
        rl = list_next(&ilbd_rule_hlist, rl);
    }

    return (rl);
}

/*
 * get exactly one rule (named in rl->irl_name) data from kernel
 */
static ilb_status_t
ilb_get_krule(ilb_rule_info_t *rl)
{
    ilb_status_t    rc;
    ilb_rule_cmd_t  kcmd;

    kcmd.cmd = ILB_LIST_RULE;
    (void) strlcpy(kcmd.name, rl->rl_name, sizeof (kcmd.name));
    kcmd.flags = 0;

    rc = do_ioctl(&kcmd, 0);
    if (rc != ILB_STATUS_OK)
        return (rc);

    rl->rl_flags = kcmd.flags;
    rl->rl_ipversion = IPPROTO_2_AF(kcmd.ip_ver);
    rl->rl_vip = kcmd.vip;
    rl->rl_proto = kcmd.proto;
    rl->rl_minport = kcmd.min_port;
    rl->rl_maxport = kcmd.max_port;
    rl->rl_algo = algo_impl2lib(kcmd.algo);
    rl->rl_topo = topo_impl2lib(kcmd.topo);
    rl->rl_stickymask = kcmd.sticky_mask;
    rl->rl_nat_src_start = kcmd.nat_src_start;
    rl->rl_nat_src_end = kcmd.nat_src_end;
    (void) strlcpy(rl->rl_name, kcmd.name, sizeof (rl->rl_name));
    rl->rl_conndrain = kcmd.conn_drain_timeout;
    rl->rl_nat_timeout = kcmd.nat_expiry;
    rl->rl_sticky_timeout = kcmd.sticky_expiry;

    return (ILB_STATUS_OK);
}

ilb_status_t
ilbd_retrieve_rule(ilbd_name_t rl_name, uint32_t *rbuf, size_t *rbufsz)
{
    ilbd_rule_t *irl = NULL;
    ilb_status_t    rc;
    ilb_rule_info_t *rinfo;

    irl = i_find_rule_byname(rl_name);
    if (irl == NULL)
        return (ILB_STATUS_ENOENT);

    ilbd_reply_ok(rbuf, rbufsz);
    rinfo = (ilb_rule_info_t *)&((ilb_comm_t *)rbuf)->ic_data;
    bcopy(&irl->irl_info, rinfo, sizeof (*rinfo));

    /*
     * Check if the various timeout values are 0.  If one is, get the
     * default values from kernel.
     */
    if (rinfo->rl_conndrain == 0 || rinfo->rl_nat_timeout == 0 ||
        rinfo->rl_sticky_timeout == 0) {
        ilb_rule_info_t tmp_info;

        (void) strcpy(tmp_info.rl_name, rinfo->rl_name);
        rc = ilb_get_krule(&tmp_info);
        if (rc != ILB_STATUS_OK)
            return (rc);
        if (rinfo->rl_conndrain == 0)
            rinfo->rl_conndrain = tmp_info.rl_conndrain;
        if ((rinfo->rl_topo == ILB_TOPO_NAT ||
            rinfo->rl_topo == ILB_TOPO_HALF_NAT) &&
            rinfo->rl_nat_timeout == 0) {
            rinfo->rl_nat_timeout = tmp_info.rl_nat_timeout;
        }
        if ((rinfo->rl_flags & ILB_FLAGS_RULE_STICKY) &&
            rinfo->rl_sticky_timeout == 0) {
            rinfo->rl_sticky_timeout = tmp_info.rl_sticky_timeout;
        }
    }
    *rbufsz += sizeof (ilb_rule_info_t);

    return (ILB_STATUS_OK);
}

static ilb_status_t
ilbd_destroy_one_rule(ilbd_rule_t *irl)
{
    ilb_status_t    rc;
    ilb_name_cmd_t  kcmd;

    /*
     * as far as talking to the kernel is concerned, "all rules"
     * is handled in one go somewhere else, so we only
     * tell the kernel about single rules here.
     */
    if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
        kcmd.cmd = ILB_DESTROY_RULE;
        (void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
        kcmd.flags = 0;

        rc = do_ioctl(&kcmd, 0);
        if (rc != ILB_STATUS_OK)
            return (rc);

    }
    list_remove(&irl->irl_sg->isg_rulelist, irl);
    list_remove(&ilbd_rule_hlist, irl);

    /*
     * When dissociating a rule, only two errors can happen.  The hc
     * name is incorrect or the rule is not associated with the hc
     * object.  Both should not happen....  The check is for debugging
     * purpose.
     */
    if (RULE_HAS_HC(irl) && (rc = ilbd_hc_dissociate_rule(irl)) !=
        ILB_STATUS_OK) {
        logerr("ilbd_destroy_one_rule: cannot "
            "dissociate %s from hc object %s: %d",
            irl->irl_name, irl->irl_hcname, rc);
    }

    rc = i_ilbd_save_rule(irl, ILBD_SCF_DESTROY);
    if (rc != ILB_STATUS_OK)
        logdebug("ilbd_destroy_rule: save rule failed");

    free(irl);
    return (rc);
}

/*
 * the following two functions are the other's opposite, and can
 * call into each other for roll back purposes in case of error.
 * To avoid endless recursion, the 'is_rollback' parameter must be
 * set to B_TRUE in the roll back case.
 */
static ilb_status_t
ilbd_enable_one_rule(ilbd_rule_t *irl, boolean_t is_rollback)
{
    ilb_status_t    rc = ILB_STATUS_OK;
    ilb_name_cmd_t  kcmd;

    /* no use sending a no-op to the kernel */
    if ((irl->irl_flags & ILB_FLAGS_RULE_ENABLED) != 0)
        return (ILB_STATUS_OK);

    irl->irl_flags |= ILB_FLAGS_RULE_ENABLED;

    /* "all rules" is handled in one go somewhere else, not here */
    if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
        kcmd.cmd = ILB_ENABLE_RULE;
        (void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
        kcmd.flags = 0;

        rc = do_ioctl(&kcmd, 0);
        if (rc != ILB_STATUS_OK)
            return (rc);
    }
    if (RULE_HAS_HC(irl) && (rc = ilbd_hc_enable_rule(irl)) !=
        ILB_STATUS_OK) {
        /* Undo the kernel work */
        kcmd.cmd = ILB_DISABLE_RULE;
        /* Cannot do much if ioctl fails... */
        (void) do_ioctl(&kcmd, 0);
        return (rc);
    }

    if (!is_rollback) {
        if (rc == ILB_STATUS_OK)
            rc = i_ilbd_save_rule(irl, ILBD_SCF_ENABLE_DISABLE);
        if (rc != ILB_STATUS_OK)
            /* ignore rollback return code */
            (void) ilbd_disable_one_rule(irl, B_TRUE);
    }

    return (rc);
}

static ilb_status_t
ilbd_disable_one_rule(ilbd_rule_t *irl, boolean_t is_rollback)
{
    ilb_status_t    rc = ILB_STATUS_OK;
    ilb_name_cmd_t  kcmd;

    /* no use sending a no-op to the kernel */
    if ((irl->irl_flags & ILB_FLAGS_RULE_ENABLED) == 0)
        return (ILB_STATUS_OK);

    irl->irl_flags &= ~ILB_FLAGS_RULE_ENABLED;

    /* "all rules" is handled in one go somewhere else, not here */
    if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
        kcmd.cmd = ILB_DISABLE_RULE;
        (void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
        kcmd.flags = 0;

        rc = do_ioctl(&kcmd, 0);
        if (rc != ILB_STATUS_OK)
            return (rc);
    }

    if (RULE_HAS_HC(irl) && (rc = ilbd_hc_disable_rule(irl)) !=
        ILB_STATUS_OK) {
        /* Undo the kernel work */
        kcmd.cmd = ILB_ENABLE_RULE;
        /* Cannot do much if ioctl fails... */
        (void) do_ioctl(&kcmd, 0);
        return (rc);
    }

    if (!is_rollback) {
        if (rc == ILB_STATUS_OK)
            rc = i_ilbd_save_rule(irl, ILBD_SCF_ENABLE_DISABLE);
        if (rc != ILB_STATUS_OK)
            /* ignore rollback return code */
            (void) ilbd_enable_one_rule(irl, B_TRUE);
    }

    return (rc);
}

/*
 * Generates an audit record for a supplied rule name
 * Used for enable_rule, disable_rule, delete_rule,
 * and create_rule subcommands
 */
static void
ilbd_audit_rule_event(const char *audit_rule_name,
    ilb_rule_info_t *rlinfo, ilbd_cmd_t cmd, ilb_status_t rc,
    ucred_t *ucredp)
{
    adt_session_data_t  *ah;
    adt_event_data_t    *event;
    au_event_t      flag;
    int         scf_val_len = ILBD_MAX_VALUE_LEN;
    char            *aobuf = NULL; /* algo:topo */
    char            *valstr1 = NULL;
    char            *valstr2 = NULL;
    char            pbuf[PROTOCOL_LEN]; /* protocol */
    char            hcpbuf[PORT_LEN]; /* hcport */
    int         audit_error;

    if ((ucredp == NULL) && (cmd == ILBD_CREATE_RULE))  {
        /*
         * we came here from the path where ilbd incorporates
         * the configuration that is listed in SCF :
         * i_ilbd_read_config->ilbd_walk_rule_pgs->
         *    ->ilbd_scf_instance_walk_pg->ilbd_create_rule
         * We skip auditing in that case
         */
        return;
    }
    if (adt_start_session(&ah, NULL, 0) != 0) {
        logerr("ilbd_audit_rule_event: adt_start_session failed");
        exit(EXIT_FAILURE);
    }
    if (adt_set_from_ucred(ah, ucredp, ADT_NEW) != 0) {
        (void) adt_end_session(ah);
        logerr("ilbd_audit_rule_event: adt_set_from_ucred failed");
        exit(EXIT_FAILURE);
    }
    if (cmd == ILBD_ENABLE_RULE)
        flag = ADT_ilb_enable_rule;
    else if (cmd == ILBD_DISABLE_RULE)
        flag = ADT_ilb_disable_rule;
    else if (cmd == ILBD_DESTROY_RULE)
        flag = ADT_ilb_delete_rule;
    else if (cmd == ILBD_CREATE_RULE)
        flag = ADT_ilb_create_rule;

    if ((event = adt_alloc_event(ah, flag)) == NULL) {
        logerr("ilbd_audit_rule_event: adt_alloc_event failed");
        exit(EXIT_FAILURE);
    }

    (void) memset((char *)event, 0, sizeof (adt_event_data_t));

    switch (cmd) {
    case ILBD_DESTROY_RULE:
        event->adt_ilb_delete_rule.auth_used = NET_ILB_CONFIG_AUTH;
        event->adt_ilb_delete_rule.rule_name = (char *)audit_rule_name;
        break;
    case ILBD_ENABLE_RULE:
        event->adt_ilb_enable_rule.auth_used = NET_ILB_ENABLE_AUTH;
        event->adt_ilb_enable_rule.rule_name = (char *)audit_rule_name;
        break;
    case ILBD_DISABLE_RULE:
        event->adt_ilb_disable_rule.auth_used = NET_ILB_ENABLE_AUTH;
        event->adt_ilb_disable_rule.rule_name = (char *)audit_rule_name;
        break;
    case ILBD_CREATE_RULE:
        if (((aobuf = malloc(scf_val_len)) == NULL) ||
            ((valstr1 = malloc(scf_val_len)) == NULL) ||
            ((valstr2 = malloc(scf_val_len)) == NULL)) {
            logerr("ilbd_audit_rule_event: could not"
                " allocate buffer");
            exit(EXIT_FAILURE);
        }

        event->adt_ilb_create_rule.auth_used = NET_ILB_CONFIG_AUTH;

        /* Fill in virtual IP address type */
        if (IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_vip)) {
            event->adt_ilb_create_rule.virtual_ipaddress_type =
                ADT_IPv4;
            cvt_addr(event->adt_ilb_create_rule.virtual_ipaddress,
                ADT_IPv4, rlinfo->rl_vip);
        } else {
            event->adt_ilb_create_rule.virtual_ipaddress_type =
                ADT_IPv6;
            cvt_addr(event->adt_ilb_create_rule.virtual_ipaddress,
                ADT_IPv6, rlinfo->rl_vip);
        }
        /* Fill in port - could be a single value or a range */
        event->adt_ilb_create_rule.min_port = ntohs(rlinfo->rl_minport);
        if (ntohs(rlinfo->rl_maxport) > ntohs(rlinfo->rl_minport)) {
            /* port range */
            event->adt_ilb_create_rule.max_port =
                ntohs(rlinfo->rl_maxport);
        } else {
            /* in audit record, max=min when single port */
            event->adt_ilb_create_rule.max_port =
                ntohs(rlinfo->rl_minport);
        }

        /*
         * Fill in  protocol - if user does not specify it,
         * its TCP by default
         */
        if (rlinfo->rl_proto == IPPROTO_UDP)
            (void) snprintf(pbuf, PROTOCOL_LEN, "UDP");
        else
            (void) snprintf(pbuf, PROTOCOL_LEN, "TCP");
        event->adt_ilb_create_rule.protocol = pbuf;

        /* Fill in algorithm and operation type */
        ilbd_algo_to_str(rlinfo->rl_algo, valstr1);
        ilbd_topo_to_str(rlinfo->rl_topo, valstr2);
        (void) snprintf(aobuf, scf_val_len, "%s:%s",
            valstr1, valstr2);
        event->adt_ilb_create_rule.algo_optype = aobuf;

        /* Fill in proxy-src for the NAT case */
        if (rlinfo->rl_topo == ILB_TOPO_NAT)  {
            /* copy starting proxy-src address */
            if (IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_nat_src_start)) {
                /* V4 case */
                event->adt_ilb_create_rule.proxy_src_min_type =
                    ADT_IPv4;
                cvt_addr(
                    event->adt_ilb_create_rule.proxy_src_min,
                    ADT_IPv4, rlinfo->rl_nat_src_start);
            } else {
                /* V6 case */
                event->adt_ilb_create_rule.proxy_src_min_type =
                    ADT_IPv6;
                cvt_addr(
                    event->adt_ilb_create_rule.proxy_src_min,
                    ADT_IPv6, rlinfo->rl_nat_src_start);
            }

            /* copy ending proxy-src address */
            if (&rlinfo->rl_nat_src_end == 0) {
                /* proxy-src is a single address */
                event->adt_ilb_create_rule.proxy_src_max_type =
                    event->
                    adt_ilb_create_rule.proxy_src_min_type;
                (void) memcpy(
                    event->adt_ilb_create_rule.proxy_src_max,
                    event->adt_ilb_create_rule.proxy_src_min,
                    (4 * sizeof (uint32_t)));
            } else if (
                IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_nat_src_end)) {
                /*
                 * proxy-src is a address range - copy ending
                 * proxy-src address
                 * V4 case
                 */
                event->adt_ilb_create_rule.proxy_src_max_type =
                    ADT_IPv4;
                cvt_addr(
                    event->adt_ilb_create_rule.proxy_src_max,
                    ADT_IPv4, rlinfo->rl_nat_src_end);
            } else {
                /* V6 case */
                event->adt_ilb_create_rule.proxy_src_max_type =
                    ADT_IPv6;
                cvt_addr(
                    event->adt_ilb_create_rule.proxy_src_max,
                    ADT_IPv6, rlinfo->rl_nat_src_end);
            }
        }

        /*
         * Fill in pmask if user has specified one - 0 means
         * no persistence
         */
        valstr1[0] = '\0';
        ilbd_ip_to_str(rlinfo->rl_ipversion, &rlinfo->rl_stickymask,
            valstr1);
            event->adt_ilb_create_rule.persist_mask = valstr1;

        /* If there is a hcname */
        if (rlinfo->rl_hcname[0] != '\0')
            event->adt_ilb_create_rule.hcname = rlinfo->rl_hcname;

        /* Fill in hcport */
        if (rlinfo->rl_hcpflag == ILB_HCI_PROBE_FIX) {
            /* hcport is specified by user */
            (void) snprintf(hcpbuf, PORT_LEN, "%d",
                rlinfo->rl_hcport);
            event->adt_ilb_create_rule.hcport = hcpbuf;
        } else if (rlinfo->rl_hcpflag == ILB_HCI_PROBE_ANY) {
            /* user has specified "ANY" */
            (void) snprintf(hcpbuf, PORT_LEN, "ANY");
            event->adt_ilb_create_rule.hcport = hcpbuf;
        }
        /*
         * Fill out the conndrain, nat_timeout and persist_timeout
         * If the user does not specify them, the default value
         * is set in the kernel. Userland does not know what
         * the values are. So if the user
         * does not specify these values they will show up as
         * 0 in the audit record.
         */
        event->adt_ilb_create_rule.conndrain_timeout =
            rlinfo->rl_conndrain;
        event->adt_ilb_create_rule.nat_timeout =
            rlinfo->rl_nat_timeout;
        event->adt_ilb_create_rule.persist_timeout =
            rlinfo->rl_sticky_timeout;

        /* Fill out servergroup and rule name */
        event->adt_ilb_create_rule.server_group = rlinfo->rl_sgname;
        event->adt_ilb_create_rule.rule_name = rlinfo->rl_name;
        break;
    }
    if (rc == ILB_STATUS_OK) {
        if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS) != 0) {
            logerr("ilbd_audit_rule_event:adt_put_event failed");
            exit(EXIT_FAILURE);
        }
    } else {
        audit_error = ilberror2auditerror(rc);
        if (adt_put_event(event, ADT_FAILURE, audit_error) != 0) {
            logerr("ilbd_audit_rule_event: adt_put_event failed");
            exit(EXIT_FAILURE);
        }
    }
    adt_free_event(event);
    free(aobuf);
    free(valstr1);
    free(valstr2);
    (void) adt_end_session(ah);
}
/*
 * converts IP address from in6_addr format to uint32_t[4]
 * This conversion is needed for recording IP address in
 * audit records.
 */
void
cvt_addr(uint32_t *audit, int32_t type, struct in6_addr address)
{

    if (type == ADT_IPv4)  {
        /* address is IPv4 */
        audit[0] = address._S6_un._S6_u32[3];
    } else {
        /* address is IPv6 */
        (void) memcpy(audit, address._S6_un._S6_u32,
            (4 * sizeof (uint32_t)));
    }
}

static ilb_status_t
i_ilbd_action_switch(ilbd_rule_t *irl, ilbd_cmd_t cmd,
    boolean_t is_rollback, ucred_t *ucredp)
{
    ilb_status_t    rc;

    switch (cmd) {
    case ILBD_DESTROY_RULE:
        rc = ilbd_destroy_one_rule(irl);
        if (!is_rollback) {
            ilbd_audit_rule_event(irl->irl_name, NULL,
                cmd, rc, ucredp);
        }
        return (rc);
    case ILBD_ENABLE_RULE:
        rc = ilbd_enable_one_rule(irl, is_rollback);
        if (!is_rollback) {
            ilbd_audit_rule_event(irl->irl_name, NULL, cmd,
                rc, ucredp);
        }
        return (rc);
    case ILBD_DISABLE_RULE:
        rc = ilbd_disable_one_rule(irl, is_rollback);
        if (!is_rollback) {
            ilbd_audit_rule_event(irl->irl_name, NULL, cmd,
                rc, ucredp);
        }
        return (rc);
    }
    return (ILB_STATUS_INVAL_CMD);
}

static ilb_cmd_t
i_ilbd2ilb_cmd(ilbd_cmd_t c)
{
    ilb_cmd_t   r;

    switch (c) {
    case ILBD_CREATE_RULE:
        r = ILB_CREATE_RULE;
        break;
    case ILBD_DESTROY_RULE:
        r = ILB_DESTROY_RULE;
        break;
    case ILBD_ENABLE_RULE:
        r = ILB_ENABLE_RULE;
        break;
    case ILBD_DISABLE_RULE:
        r = ILB_DISABLE_RULE;
        break;
    }
    return (r);
}

static ilbd_cmd_t
get_undo_cmd(ilbd_cmd_t cmd)
{
    ilbd_cmd_t  u_cmd;

    switch (cmd) {
    case ILBD_DESTROY_RULE:
        u_cmd = ILBD_BAD_CMD;
        break;
    case ILBD_ENABLE_RULE:
        u_cmd = ILBD_DISABLE_RULE;
        break;
    case ILBD_DISABLE_RULE:
        u_cmd = ILBD_ENABLE_RULE;
        break;
    }

    return (u_cmd);
}

static ilb_status_t
i_ilbd_rule_action(const char *rule_name, const struct passwd *ps,
    ilbd_cmd_t cmd, ucred_t *ucredp)
{
    ilbd_rule_t *irl, *irl_next;
    boolean_t   is_all_rules = B_FALSE;
    ilb_status_t    rc = ILB_STATUS_OK;
    ilb_name_cmd_t  kcmd;
    ilbd_cmd_t  u_cmd;
    char    rulename[ILB_NAMESZ];

    if (ps != NULL) {
        if ((cmd == ILBD_ENABLE_RULE) || (cmd == ILBD_DISABLE_RULE))
            rc = ilbd_check_client_enable_auth(ps);
        else
            rc = ilbd_check_client_config_auth(ps);
        /* generate the audit record before bailing out */
        if (rc != ILB_STATUS_OK) {
            if (rule_name != '\0') {
                ilbd_audit_rule_event(rule_name, NULL,
                    cmd, rc, ucredp);
            } else {
                (void) snprintf(rulename, sizeof (rulename),
                    "all");
                ilbd_audit_rule_event(rulename, NULL, cmd, rc,
                    ucredp);
            }
            goto out;
        }
    }
    is_all_rules = rule_name[0] == 0;

    /* just one rule */
    if (!is_all_rules) {
        irl = i_find_rule_byname(rule_name);
        if (irl == NULL) {
            rc = ILB_STATUS_ENORULE;
            ilbd_audit_rule_event(rule_name, NULL, cmd, rc, ucredp);
            goto out;
        }
        /* auditing will be done by i_ilbd_action_switch() */
        rc = i_ilbd_action_switch(irl, cmd, B_FALSE, ucredp);
        goto out;
    }

    /* all rules: first tell the kernel, then walk the daemon's list */
    kcmd.cmd = i_ilbd2ilb_cmd(cmd);
    kcmd.flags = ILB_RULE_ALLRULES;

    rc = do_ioctl(&kcmd, 0);
    if (rc != ILB_STATUS_OK) {
        (void) snprintf(rulename, sizeof (rulename), "all");
        ilbd_audit_rule_event(rulename, NULL, cmd, rc, ucredp);
        goto out;
    }

    irl = list_head(&ilbd_rule_hlist);
    while (irl != NULL) {
        irl_next = list_next(&ilbd_rule_hlist, irl);
        irl->irl_flags |= ILB_FLAGS_RULE_ALLRULES;
        /* auditing will be done by i_ilbd_action_switch() */
        rc = i_ilbd_action_switch(irl, cmd, B_FALSE, ucredp);
        irl->irl_flags &= ~ILB_FLAGS_RULE_ALLRULES;
        if (rc != ILB_STATUS_OK)
            goto rollback_list;
        irl = irl_next;
    }
    return (rc);

rollback_list:
    u_cmd = get_undo_cmd(cmd);
    if (u_cmd == ILBD_BAD_CMD)
        return (rc);

    if (is_all_rules) {
        kcmd.cmd = i_ilbd2ilb_cmd(u_cmd);
        (void) do_ioctl(&kcmd, 0);
    }
    /* current list element failed, so we start with previous one */
    irl = list_prev(&ilbd_rule_hlist, irl);
    while (irl != NULL) {
        if (is_all_rules)
            irl->irl_flags |= ILB_FLAGS_RULE_ALLRULES;

        /*
         * When the processing of a command consists of
         * multiple sequential steps, and one of them fails,
         * ilbd performs rollback to undo the steps taken before the
         * failing step. Since ilbd is initiating these steps
         * there is not need to audit them.
         */
        rc = i_ilbd_action_switch(irl, u_cmd, B_TRUE, NULL);
        irl->irl_flags &= ~ILB_FLAGS_RULE_ALLRULES;

        irl = list_prev(&ilbd_rule_hlist, irl);
    }
out:
    return (rc);
}

ilb_status_t
ilbd_destroy_rule(ilbd_name_t rule_name, const struct passwd *ps,
    ucred_t *ucredp)
{
    return (i_ilbd_rule_action(rule_name, ps, ILBD_DESTROY_RULE, ucredp));
}

ilb_status_t
ilbd_enable_rule(ilbd_name_t rule_name, const struct passwd *ps,
    ucred_t *ucredp)
{
    return (i_ilbd_rule_action(rule_name, ps, ILBD_ENABLE_RULE, ucredp));

}

ilb_status_t
ilbd_disable_rule(ilbd_name_t rule_name, const struct passwd *ps,
    ucred_t *ucredp)
{
    return (i_ilbd_rule_action(rule_name, ps, ILBD_DISABLE_RULE, ucredp));
}

/*
 * allocate storage for a kernel rule command and fill from
 * "template" irl, if non-NULL
 */
static ilb_rule_cmd_t *
i_alloc_kernel_rule_cmd(ilbd_rule_t *irl)
{
    ilb_rule_cmd_t *kcmd;

    kcmd = (ilb_rule_cmd_t *)malloc(sizeof (*kcmd));
    if (kcmd == NULL)
        return (kcmd);

    bzero(kcmd, sizeof (*kcmd));

    if (irl != NULL) {
        kcmd->flags = irl->irl_flags;
        kcmd->ip_ver = AF_2_IPPROTO(irl->irl_ipversion);
        kcmd->vip = irl->irl_vip;
        kcmd->proto = irl->irl_proto;
        kcmd->min_port = irl->irl_minport;
        kcmd->max_port = irl->irl_maxport;
        kcmd->algo = algo_lib2impl(irl->irl_algo);
        kcmd->topo = topo_lib2impl(irl->irl_topo);
        kcmd->sticky_mask = irl->irl_stickymask;
        kcmd->nat_src_start = irl->irl_nat_src_start;
        kcmd->nat_src_end = irl->irl_nat_src_end;
        kcmd->conn_drain_timeout = irl->irl_conndrain;
        kcmd->nat_expiry = irl->irl_nat_timeout;
        kcmd->sticky_expiry = irl->irl_sticky_timeout;
        (void) strlcpy(kcmd->name, irl->irl_name,
            sizeof (kcmd->name));
    }
    return (kcmd);
}

/*
 * ncount is the next to be used index into (*kcmdp)->servers
 */
static ilb_status_t
adjust_srv_info_cmd(ilb_servers_info_cmd_t **kcmdp, int index)
{
    ilb_servers_info_cmd_t  *kcmd = *kcmdp;
    size_t          sz;

    if (kcmd != NULL && kcmd->num_servers > index + 1)
        return (ILB_STATUS_OK);

    /*
     * the first ilb_server_info_t is part of *kcmd, so
     * by using index (which is one less than the total needed) here,
     * we allocate exactly the amount we need.
     */
    sz = sizeof (*kcmd) + (index * sizeof (ilb_server_info_t));
    kcmd = (ilb_servers_info_cmd_t *)realloc(kcmd, sz);
    if (kcmd == NULL)
        return (ILB_STATUS_ENOMEM);

    /*
     * we don't count the slot we newly allocated yet.
     */
    kcmd->num_servers = index;
    *kcmdp = kcmd;

    return (ILB_STATUS_OK);
}

/*
 * this function adds all servers in srvlist to the kernel(!) rule
 * the name of which is passed as argument.
 */
static ilb_status_t
i_update_ksrv_rules(char *name, ilbd_sg_t *sg, ilbd_rule_t *rl)
{
    ilb_status_t        rc;
    ilbd_srv_t      *srvp;
    ilb_servers_info_cmd_t  *kcmd = NULL;
    int         i;

    /*
     * If the servergroup doesn't have any servers associated with
     * it yet, there's nothing more to do here.
     */
    if (sg->isg_srvcount == 0)
        return (ILB_STATUS_OK);

    /*
     * walk the list of servers attached to this SG
     */
    srvp = list_head(&sg->isg_srvlist);
    for (i = 0; srvp != NULL; srvp = list_next(&sg->isg_srvlist, srvp)) {
        rc = adjust_srv_info_cmd(&kcmd, i);
        if (rc != ILB_STATUS_OK)
            goto rollback_kcmd;

        ILB_SGSRV_2_KSRV(&srvp->isv_srv, &kcmd->servers[i]);
        /*
         * "no port" means "copy rule's port" (for kernel rule)
         */
        if (kcmd->servers[i].min_port == 0) {
            kcmd->servers[i].min_port = rl->irl_minport;
            kcmd->servers[i].max_port = rl->irl_maxport;
        }
        i++;
    }
    assert(kcmd != NULL);

    kcmd->cmd = ILB_ADD_SERVERS;
    kcmd->num_servers = i;
    (void) strlcpy(kcmd->name, name, sizeof (kcmd->name));

    rc = do_ioctl(kcmd, 0);
    if (rc != ILB_STATUS_OK)
        goto rollback_kcmd;

    for (i = 0; i < kcmd->num_servers; i++) {
        int e;

        if ((e = kcmd->servers[i].err) != 0) {
            logerr("i_update_ksrv_rules "
                "ioctl indicates failure: %s", strerror(e));
            rc = ilb_map_errno2ilbstat(e);
            /*
             * if adding even a single server failed, we need to
             * roll back the whole wad. We ignore any errors and
             * return the one that was returned by the first ioctl.
             */
            kcmd->cmd = ILB_DEL_SERVERS;
            (void) do_ioctl(kcmd, 0);
            goto rollback_kcmd;
        }
    }

rollback_kcmd:
    free(kcmd);
    return (rc);
}

/* convert a struct in6_addr to valstr */
void
ilbd_ip_to_str(uint16_t ipversion, struct in6_addr *addr, char *valstr)
{
    size_t  vallen;
    ilb_ip_addr_t   ipaddr;
    void    *addrptr;

    vallen = (ipversion == AF_INET) ? INET_ADDRSTRLEN : INET6_ADDRSTRLEN;

    IP_COPY_IMPL_2_CLI(addr, &ipaddr);
    addrptr = (ipversion == AF_INET) ?
        (void *)&ipaddr.ia_v4 : (void *)&ipaddr.ia_v6;
    if (inet_ntop(ipversion, (void *)addrptr, valstr, vallen == NULL))
        logerr("ilbd_ip_to_str: inet_ntop failed");
    return;

}

ilb_status_t
ilbd_create_rule(ilb_rule_info_t *rl, int ev_port,
    const struct passwd *ps, ucred_t *ucredp)
{
    ilb_status_t    rc;
    ilbd_rule_t *irl = NULL;
    ilbd_sg_t   *sg;
    ilb_rule_cmd_t  *kcmd = NULL;

    if (ps != NULL) {
        if ((rc = ilbd_check_client_config_auth(ps)) != ILB_STATUS_OK)
            goto out;
    }

    if (i_find_rule_byname(rl->rl_name) != NULL) {
        logdebug("ilbd_create_rule: rule %s"
            " already exists", rl->rl_name);
        ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE,
            ILB_STATUS_DUP_RULE, ucredp);
        return (ILB_STATUS_DUP_RULE);
    }

    sg = i_find_sg_byname(rl->rl_sgname);
    if (sg == NULL) {
        logdebug("ilbd_create_rule: rule %s uses non-existent"
            " servergroup name %s", rl->rl_name, rl->rl_sgname);
        ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE,
            ILB_STATUS_SGUNAVAIL, ucredp);
        return (ILB_STATUS_SGUNAVAIL);
    }

    if ((rc = ilbd_sg_check_rule_port(sg, rl)) != ILB_STATUS_OK) {
        ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE, rc, ucredp);
        return (rc);
    }

    /* allocs and copies contents of arg (if != NULL) into new rule */
    irl = i_alloc_ilbd_rule(rl);
    if (irl == NULL) {
        ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE,
            ILB_STATUS_ENOMEM, ucredp);
        return (ILB_STATUS_ENOMEM);
    }

    /* make sure rule's IPversion (via vip) and SG's match */
    if (sg->isg_srvcount > 0) {
        ilbd_srv_t  *srv = list_head(&sg->isg_srvlist);
        int32_t     r_af = rl->rl_ipversion;
        int32_t     s_af = GET_AF(&srv->isv_addr);

        if (r_af != s_af) {
            logdebug("address family mismatch with servergroup");
            rc = ILB_STATUS_MISMATCHSG;
            goto out;
        }
    }
    irl->irl_sg = sg;

    /* Try associating the rule with the given hc oject. */
    if (RULE_HAS_HC(irl)) {
        if ((rc = ilbd_hc_associate_rule(irl, ev_port)) !=
            ILB_STATUS_OK)
            goto out;
    }

    /*
     * checks are done, now:
     * 1. create rule in kernel
     * 2. tell it about the backend server (which we maintain in SG)
     * 3. attach the rule in memory
     */
    /* 1. */
    /* allocs and copies contents of arg (if != NULL) into new rule */
    kcmd = i_alloc_kernel_rule_cmd(irl);
    if (kcmd == NULL) {
        rc = ILB_STATUS_ENOMEM;
        goto rollback_hc;
    }
    kcmd->cmd = ILB_CREATE_RULE;

    rc = do_ioctl(kcmd, 0);
    if (rc != ILB_STATUS_OK)
        goto rollback_kcmd;

    /* 2. */
    rc = i_update_ksrv_rules(kcmd->name, sg, irl);
    if (rc != ILB_STATUS_OK)
        goto rollback_kcmd;

    /* 3. */
    (void) i_attach_rule2sg(sg, irl);
    list_insert_tail(&ilbd_rule_hlist, irl);

    if (ps != NULL) {
        rc = i_ilbd_save_rule(irl, ILBD_SCF_CREATE);
        if (rc != ILB_STATUS_OK)
            goto rollback_rule;
    }

    free(kcmd);
    ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE,
        ILB_STATUS_OK, ucredp);
    return (ILB_STATUS_OK);

rollback_rule:
    /*
     * ilbd_destroy_one_rule() also frees irl, as well as dissociate
     * rule and HC, so all we need to do afterwards is free the kcmd
     * and return.
     */
    (void) ilbd_destroy_one_rule(irl);
    ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE, rc, ucredp);
    free(kcmd);
    return (rc);

rollback_kcmd:
    free(kcmd);
rollback_hc:
    /* Cannot fail since the rule is just associated with the hc object. */
    if (RULE_HAS_HC(irl))
        (void) ilbd_hc_dissociate_rule(irl);
out:
    ilbd_audit_rule_event(NULL, rl, ILBD_CREATE_RULE, rc, ucredp);
    free(irl);
    return (rc);
}

static uint32_t
i_flags_d2k(int f)
{
    uint32_t    r = 0;

    if (ILB_IS_SRV_ENABLED(f))
        r |= ILB_SERVER_ENABLED;
    /* more as they are defined */

    return (r);
}

/*
 * walk the list of rules and add srv to the *kernel* rule
 * (this is a list of rules hanging off of a server group)
 */
ilb_status_t
i_add_srv2krules(list_t *rlist, ilb_sg_srv_t *srv, int ev_port)
{
    ilb_status_t        rc = ILB_STATUS_OK;
    ilbd_rule_t     *rl, *del_rl;
    ilb_servers_info_cmd_t  kcmd;
    ilb_servers_cmd_t   del_kcmd;

    kcmd.cmd = ILB_ADD_SERVERS;
    kcmd.num_servers = 1;
    kcmd.servers[0].err = 0;
    kcmd.servers[0].addr = srv->sgs_addr;
    kcmd.servers[0].flags = i_flags_d2k(srv->sgs_flags);
    (void) strlcpy(kcmd.servers[0].name, srv->sgs_srvID,
        sizeof (kcmd.servers[0].name));

    /*
     * a note about rollback: since we need to start rollback with the
     * current list element in some case, and with the previous one
     * in others, we must "go back" in this latter case before
     * we jump to the rollback code.
     */
    for (rl = list_head(rlist); rl != NULL; rl = list_next(rlist, rl)) {
        (void) strlcpy(kcmd.name, rl->irl_name, sizeof (kcmd.name));
        /*
         * sgs_minport == 0 means "no port specified"; this
         * indicates that the server matches anything the rule
         * provides.
         * NOTE: this can be different for different rules
         * using the same server group, therefore we don't modify
         * this information in the servergroup, but *only* in
         * the kernel's rule.
         */
        if (srv->sgs_minport == 0) {
            kcmd.servers[0].min_port = rl->irl_minport;
            kcmd.servers[0].max_port = rl->irl_maxport;
        } else {
            kcmd.servers[0].min_port = srv->sgs_minport;
            kcmd.servers[0].max_port = srv->sgs_maxport;
        }
        rc = do_ioctl((void *)&kcmd, 0);
        if (rc != ILB_STATUS_OK) {
            logdebug("i_add_srv2krules: do_ioctl call failed");
            del_rl = list_prev(rlist, rl);
            goto rollback;
        }

        /*
         * if ioctl() returns != 0, it doesn't perform the copyout
         * necessary to indicate *which* server failed (we could be
         * adding more than one); therefore we must check this
         * 'err' field even if ioctl() returns 0.
         */
        if (kcmd.servers[0].err != 0) {
            logerr("i_add_srv2krules: SIOCILB ioctl returned"
                " error %d", kcmd.servers[0].err);
            rc = ilb_map_errno2ilbstat(kcmd.servers[0].err);
            del_rl = list_prev(rlist, rl);
            goto rollback;
        }
        if (RULE_HAS_HC(rl)) {
            if ((rc = ilbd_hc_add_server(rl, srv, ev_port)) !=
                ILB_STATUS_OK) {
                logerr("i_add_srv2krules: cannot start timer "
                    " for rules %s server %s", rl->irl_name,
                    srv->sgs_srvID);

                del_rl = rl;
                goto rollback;
            }
        }
    }

    return (rc);

rollback:
    /*
     * this is almost, but not quite, the same as i_rem_srv_frm_krules()
     * therefore we keep it seperate.
     */
    del_kcmd.cmd = ILB_DEL_SERVERS;
    del_kcmd.num_servers = 1;
    del_kcmd.servers[0].addr = srv->sgs_addr;
    while (del_rl != NULL) {
        if (RULE_HAS_HC(del_rl))
            (void) ilbd_hc_del_server(del_rl, srv);
        (void) strlcpy(del_kcmd.name, del_rl->irl_name,
            sizeof (del_kcmd.name));
        (void) do_ioctl((void *)&del_kcmd, 0);
        del_rl = list_prev(rlist, del_rl);
    }

    return (rc);
}

/*
 * ev_port is only used for rollback purposes in this function
 */
ilb_status_t
i_rem_srv_frm_krules(list_t *rlist, ilb_sg_srv_t *srv, int ev_port)
{
    ilb_status_t        rc = ILB_STATUS_OK;
    ilbd_rule_t     *rl, *add_rl;
    ilb_servers_cmd_t   kcmd;
    ilb_servers_info_cmd_t  add_kcmd;

    kcmd.cmd = ILB_DEL_SERVERS;
    kcmd.num_servers = 1;
    kcmd.servers[0].err = 0;
    kcmd.servers[0].addr = srv->sgs_addr;

    for (rl = list_head(rlist); rl != NULL; rl = list_next(rlist, rl)) {
        (void) strlcpy(kcmd.name, rl->irl_name, sizeof (kcmd.name));
        rc = do_ioctl((void *)&kcmd, 0);
        if (rc != ILB_STATUS_OK) {
            logdebug("i_rem_srv_frm_krules: do_ioctl"
                "call failed");
            add_rl = list_prev(rlist, rl);
            goto rollback;
        }
        /*
         * if ioctl() returns != 0, it doesn't perform the copyout
         * necessary to indicate *which* server failed (we could be
         * removing more than one); therefore we must check this
         * 'err' field even if ioctl() returns 0.
         */
        if (kcmd.servers[0].err != 0) {
            logerr("i_rem_srv_frm_krules: SIOCILB ioctl"
                " returned error %s",
                strerror(kcmd.servers[0].err));
            rc = ilb_map_errno2ilbstat(kcmd.servers[0].err);
            add_rl = list_prev(rlist, rl);
            goto rollback;
        }
        if (RULE_HAS_HC(rl) &&
            (rc = ilbd_hc_del_server(rl, srv)) != ILB_STATUS_OK) {
            logerr("i_rem_srv_frm_krules: cannot delete "
                "timer for rules %s server %s", rl->irl_name,
                srv->sgs_srvID);
            add_rl = rl;
            goto rollback;
        }
    }

    return (rc);

rollback:
    /* Don't do roll back if ev_port == -1. */
    if (ev_port == -1)
        return (rc);

    add_kcmd.cmd = ILB_ADD_SERVERS;
    add_kcmd.num_servers = 1;
    add_kcmd.servers[0].err = 0;
    add_kcmd.servers[0].addr = srv->sgs_addr;
    add_kcmd.servers[0].flags = i_flags_d2k(srv->sgs_flags);
    (void) strlcpy(add_kcmd.servers[0].name, srv->sgs_srvID,
        sizeof (add_kcmd.servers[0].name));
    while (add_rl != NULL) {
        if (srv->sgs_minport == 0) {
            add_kcmd.servers[0].min_port = add_rl->irl_minport;
            add_kcmd.servers[0].max_port = add_rl->irl_maxport;
        } else {
            add_kcmd.servers[0].min_port = srv->sgs_minport;
            add_kcmd.servers[0].max_port = srv->sgs_maxport;
        }
        if (RULE_HAS_HC(add_rl))
            (void) ilbd_hc_add_server(add_rl, srv, ev_port);
        (void) strlcpy(add_kcmd.name, add_rl->irl_name,
            sizeof (add_kcmd.name));
        (void) do_ioctl((void *)&add_kcmd, 0);
        add_rl = list_prev(rlist, add_rl);
    }

    return (rc);
}