usr.lib/ilbd/ilbd_scf.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <stdlib.h>
#include <stdio.h>
#include <strings.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/list.h>
#include <libilb.h>
#include <assert.h>
#include <libscf.h>
#include "libilb_impl.h"
#include "ilbd.h"

#define ILBD_PG_NAME_RULE "rule_"
#define ILBD_PG_NAME_SG "sg_"
#define ILBD_PG_NAME_HC "hc_"
#define ILBD_SVC_FMRI "svc:/network/loadbalancer/ilb"
#define ILBD_INST_NAME "default"

typedef enum {
    ILBD_RULE_STATUS,
    ILBD_RULE_VIP,
    ILBD_RULE_PROTO,
    ILBD_RULE_PORT,
    ILBD_RULE_ALGO,
    ILBD_RULE_TOPO,
    ILBD_RULE_NAT_STR,
    ILBD_RULE_NAT_END,
    ILBD_RULE_STI_MASK,
    ILBD_RULE_SGNAME,
    ILBD_RULE_HCNAME,
    ILBD_RULE_HCPORT,
    ILBD_RULE_HCPFLAG,
    ILBD_RULE_DRAINTIME,
    ILBD_RULE_NAT_TO,
    ILBD_RULE_PERS_TO,

    ILBD_SG_SERVER,

    ILBD_HC_TEST,
    ILBD_HC_TIMEOUT,
    ILBD_HC_INTERVAL,
    ILBD_HC_DEF_PING,
    ILBD_HC_COUNT,

    ILBD_VAR_INVALID
} ilbd_var_type_t;

typedef struct prop_tbl_entry {
    ilbd_var_type_t val_type;
    const char *scf_propname;
    scf_type_t scf_proptype;
} prop_tbl_entry_t;

/*
 * this table contains a map of all SCF properties, including rules,
 * servergroups and health checks. The place to add new property needs to be
 * watched carefully. When new properties are added, corresponding *VAR_NUM
 * needs to be adjusted to reflect the correct index of the table
 */
prop_tbl_entry_t prop_tbl[] = {
    /* entried for rule */
    {ILBD_RULE_STATUS, "status", SCF_TYPE_BOOLEAN},
    /* SCF_TYPE_NET_ADDR_V4 or SCF_TYPE_NET_ADDR_V6 */
    {ILBD_RULE_VIP, "vip", SCF_TYPE_INVALID},
    {ILBD_RULE_PROTO, "protocol", SCF_TYPE_ASTRING},
    {ILBD_RULE_PORT, "port", SCF_TYPE_ASTRING},
    {ILBD_RULE_ALGO, "ilb-algo", SCF_TYPE_ASTRING},
    {ILBD_RULE_TOPO, "ilb-type", SCF_TYPE_ASTRING},
    {ILBD_RULE_NAT_STR, "ilb-nat-start", SCF_TYPE_INVALID},
    {ILBD_RULE_NAT_END, "ilb-nat-end", SCF_TYPE_INVALID},
    {ILBD_RULE_STI_MASK, "ilb-sti-mask", SCF_TYPE_INVALID},
    {ILBD_RULE_SGNAME, "servergroup", SCF_TYPE_ASTRING},
    {ILBD_RULE_HCNAME, "healthcheck", SCF_TYPE_ASTRING},
    {ILBD_RULE_HCPORT, "hc-port", SCF_TYPE_INTEGER},
    {ILBD_RULE_HCPFLAG, "hcp-flag", SCF_TYPE_INTEGER},
    {ILBD_RULE_DRAINTIME, "drain-time", SCF_TYPE_INTEGER},
    {ILBD_RULE_NAT_TO, "nat-timeout", SCF_TYPE_INTEGER},
    {ILBD_RULE_PERS_TO, "pers-timeout", SCF_TYPE_INTEGER},
    /* add new rule related prop here */
    /* entries for sg */
    {ILBD_SG_SERVER, "server", SCF_TYPE_ASTRING},
    /* add new sg related prop here */
    /* entries for hc */
    {ILBD_HC_TEST, "test", SCF_TYPE_ASTRING},
    {ILBD_HC_TIMEOUT, "timeout", SCF_TYPE_INTEGER},
    {ILBD_HC_INTERVAL, "interval", SCF_TYPE_INTEGER},
    {ILBD_HC_DEF_PING, "ping", SCF_TYPE_BOOLEAN},
    /* add new hc related prop here */
    {ILBD_HC_COUNT, "count", SCF_TYPE_INTEGER}
};

#define ILBD_PROP_VAR_NUM (ILBD_HC_COUNT + 1)
#define ILBD_RULE_VAR_NUM (ILBD_SG_SERVER)
#define ILBD_SG_VAR_NUM (ILBD_HC_TEST - ILBD_SG_SERVER)
#define ILBD_HC_VAR_NUM (ILBD_PROP_VAR_NUM - ILBD_HC_TEST)

static ilb_status_t ilbd_scf_set_prop(scf_propertygroup_t *, const char *,
    scf_type_t, scf_value_t *);
static ilb_status_t ilbd_scf_retrieve_pg(const char *, scf_propertygroup_t **,
    boolean_t);
static ilb_status_t ilbd_scf_delete_pg(scf_propertygroup_t *);
static ilb_status_t ilbd_scf_get_prop_val(scf_propertygroup_t *, const char *,
    scf_value_t **);

#define MIN(a, b)   ((a) < (b) ? (a) : (b))

int
ilbd_scf_limit(int type)
{
    return (MIN(scf_limit(type), 120));
}

/*
 * Translate libscf error to libilb status
 */
ilb_status_t
ilbd_scf_err_to_ilb_err()
{
    switch (scf_error()) {
    case SCF_ERROR_NONE:
        return (ILB_STATUS_OK);
    case SCF_ERROR_HANDLE_MISMATCH:
    case SCF_ERROR_HANDLE_DESTROYED:
    case SCF_ERROR_VERSION_MISMATCH:
    case SCF_ERROR_NOT_BOUND:
    case SCF_ERROR_CONSTRAINT_VIOLATED:
    case SCF_ERROR_NOT_SET:
    case SCF_ERROR_TYPE_MISMATCH:
    case SCF_ERROR_INVALID_ARGUMENT:
        return (ILB_STATUS_EINVAL);
    case SCF_ERROR_NO_MEMORY:
    case SCF_ERROR_NO_RESOURCES:
        return (ILB_STATUS_ENOMEM);
    case SCF_ERROR_NOT_FOUND:
    case SCF_ERROR_DELETED:
        return (ILB_STATUS_ENOENT);
    case SCF_ERROR_EXISTS:
        return (ILB_STATUS_EEXIST);
    case SCF_ERROR_PERMISSION_DENIED:
        return (ILB_STATUS_PERMIT);
    case SCF_ERROR_CALLBACK_FAILED:
        return (ILB_STATUS_CALLBACK);
    case SCF_ERROR_IN_USE:
        return (ILB_STATUS_INUSE);
    default:
        return (ILB_STATUS_INTERNAL);
    }
}

static void
ilbd_name_to_scfpgname(ilbd_scf_pg_type_t pg_type, const char *pgname,
    char *scf_pgname)
{
    switch (pg_type) {
    case ILBD_SCF_RULE:
        (void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
            ILBD_PG_NAME_RULE "%s", pgname);
        return;
    case ILBD_SCF_SG:
        (void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
            ILBD_PG_NAME_SG "%s", pgname);
        return;
    case ILBD_SCF_HC:
        (void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
            ILBD_PG_NAME_HC "%s", pgname);
        return;
    /* Should not happen.  Log it and put ILB service in maintenance. */
    default:
        logerr("ilbd_name_to_scfpgname: invalid pg type %d for pg %s",
            pg_type, pgname);
        (void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
        exit(EXIT_FAILURE);
        return;
    }
}

static void
ilbd_scf_destroy(scf_handle_t *h, scf_service_t *s, scf_instance_t *inst,
    scf_propertygroup_t *pg)
{
    if (pg != NULL)
        scf_pg_destroy(pg);
    if (inst != NULL)
        scf_instance_destroy(inst);
    if (s != NULL)
        scf_service_destroy(s);
    if (h != NULL)
        scf_handle_destroy(h);
}


static ilb_status_t
ilbd_scf_get_inst(scf_handle_t **h, scf_service_t **svc, scf_instance_t **inst)
{
    if ((*h = scf_handle_create(SCF_VERSION)) == NULL)
        return (ILB_STATUS_INTERNAL);

    if (scf_handle_bind(*h) != 0) {
        ilbd_scf_destroy(*h, NULL, NULL, NULL);
        return (ilbd_scf_err_to_ilb_err());
    }

    if ((*svc = scf_service_create(*h)) == NULL) {
        ilbd_scf_destroy(*h, NULL, NULL, NULL);
        return (ilbd_scf_err_to_ilb_err());
    }

    if (scf_handle_decode_fmri(*h, ILBD_SVC_FMRI, NULL, *svc, NULL, NULL,
        NULL, SCF_DECODE_FMRI_EXACT) != 0) {
        ilbd_scf_destroy(*h, *svc, NULL, NULL);
        return (ilbd_scf_err_to_ilb_err());
    }

    if ((*inst = scf_instance_create(*h)) == NULL) {
        ilbd_scf_destroy(*h, *svc, NULL, NULL);
        return (ilbd_scf_err_to_ilb_err());
    }

    if (scf_service_get_instance(*svc, ILBD_INST_NAME, *inst) != 0) {
        ilbd_scf_destroy(*h, *svc, *inst, NULL);
        return (ilbd_scf_err_to_ilb_err());
    }
    return (ILB_STATUS_OK);
}

/*
 * If create is set, create a new prop group, destroy the old one if exists.
 * If create not set, try to find the prop group with given name.
 * The created or found entry is returned as *pg.
 * Caller frees *pg and its handle scf_pg_handle(pg)
 */
static ilb_status_t
ilbd_scf_retrieve_pg(const char *pgname, scf_propertygroup_t **pg,
    boolean_t create)
{
    scf_instance_t *inst;
    scf_handle_t *h;
    scf_service_t *svc;
    ilb_status_t ret;

    ret = ilbd_scf_get_inst(&h, &svc, &inst);
    if (ret != ILB_STATUS_OK)
        return (ret);

    *pg = scf_pg_create(h);
    if (*pg == NULL)
        return (ILB_STATUS_INTERNAL);

    if (scf_instance_get_pg(inst, pgname, *pg) != 0) {
        if (scf_error() != SCF_ERROR_NOT_FOUND ||
            (scf_error() == SCF_ERROR_NOT_FOUND && (!create))) {
            ilbd_scf_destroy(h, svc, inst, *pg);
            *pg = NULL;
            return (ilbd_scf_err_to_ilb_err());
        }
    } else {
        /*
         * Found pg, don't want to create, return EEXIST.  Note that
         * h cannot be destroyed here since the caller needs to use it.
         * The caller gets it by calling scf_pg_handle().
         */
        if (!create) {
            ilbd_scf_destroy(NULL, svc, inst, NULL);
            return (ILB_STATUS_EEXIST);
        }
        /* found pg, need to create, destroy the existing one */
        else
            (void) ilbd_scf_delete_pg(*pg);
    }

    if (create) {
        if (scf_instance_add_pg(inst, pgname,
            SCF_GROUP_APPLICATION, 0, *pg) != 0) {
            ilbd_scf_destroy(h, svc, inst, *pg);
            *pg = NULL;
            return (ilbd_scf_err_to_ilb_err());
        }
    }

    /*
     * Note that handle cannot be destroyed here, caller sometimes needs
     * to use it.  It gets the handle by calling scf_pg_handle().
     */
    ilbd_scf_destroy(NULL, svc, inst, NULL);
    return (ILB_STATUS_OK);
}

struct algo_tbl_entry {
    ilb_algo_t algo_type;
    const char *algo_str;
} algo_tbl[] = {
    {ILB_ALG_ROUNDROBIN, "ROUNDROBIN"},
    {ILB_ALG_HASH_IP, "HASH-IP"},
    {ILB_ALG_HASH_IP_SPORT, "HASH-IP-PORT"},
    {ILB_ALG_HASH_IP_VIP, "HASH-IP-VIP"}
};

#define ILBD_ALGO_TBL_SIZE (sizeof (algo_tbl) / \
    sizeof (*algo_tbl))

void
ilbd_algo_to_str(ilb_algo_t algo_type, char *valstr)
{
    int i;

    for (i = 0; i < ILBD_ALGO_TBL_SIZE; i++) {
        if (algo_type == algo_tbl[i].algo_type) {
            (void) strlcpy(valstr, algo_tbl[i].algo_str,
                ILBD_MAX_VALUE_LEN);
            return;
        }
    }
    logerr("ilbd_algo_to_str: algo not found");
}

static void
ilbd_scf_str_to_algo(ilb_algo_t *algo_type, char *valstr)
{
    int i;

    for (i = 0; i < ILBD_ALGO_TBL_SIZE; i++) {
        if (strcmp(valstr, algo_tbl[i].algo_str) == 0) {
            *algo_type = algo_tbl[i].algo_type;
            return;
        }
    }
    logerr("ilbd_scf_str_to_algo: algo not found");
}

struct topo_tbl_entry {
    ilb_topo_t topo_type;
    const char *topo_str;
} topo_tbl[] = {
    {ILB_TOPO_DSR, "DSR"},
    {ILB_TOPO_NAT, "NAT"},
    {ILB_TOPO_HALF_NAT, "HALF-NAT"}
};

#define ILBD_TOPO_TBL_SIZE (sizeof (topo_tbl) / \
    sizeof (*topo_tbl))

void
ilbd_topo_to_str(ilb_topo_t topo_type, char *valstr)
{
    int i;

    for (i = 0; i < ILBD_TOPO_TBL_SIZE; i++) {
        if (topo_type == topo_tbl[i].topo_type) {
            (void) strlcpy(valstr, topo_tbl[i].topo_str,
                ILBD_MAX_VALUE_LEN);
            return;
        }
    }
    logerr("ilbd_scf_topo_to_str: topo not found");
}

static void
ilbd_scf_str_to_topo(ilb_topo_t *topo_type, char *valstr)
{
    int i;

    for (i = 0; i < ILBD_TOPO_TBL_SIZE; i++) {
        if (strcmp(valstr, topo_tbl[i].topo_str) == 0) {
            *topo_type = topo_tbl[i].topo_type;
            return;
        }
    }
    logerr("ilbd_scf_str_to_topo: topo not found");
}

static void
ilbd_get_svr_field(char *valstr, struct in6_addr *sgs_addr,
    int32_t *min_port, int32_t *max_port, int32_t *sgs_flags)
{
    char *ipaddr, *ipverstr, *portstr, *flagstr;
    int ip_ver;
    ilb_ip_addr_t temp_ip;
    void *addrptr;
    char *max_portstr;

    ipaddr = strtok(valstr, ";");
    ipverstr = strtok(NULL, ";");
    portstr = strtok(NULL, ";");
    flagstr = strtok(NULL, ";");

    if (ipaddr == NULL || ipverstr == NULL || portstr == NULL ||
        flagstr == NULL) {
        logerr("%s: invalid server fields", __func__);
        (void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
        exit(EXIT_FAILURE);
    }
    ip_ver = atoi(ipverstr);
    addrptr = (ip_ver == AF_INET) ? (void *)&temp_ip.ia_v4 :
        (void *)&temp_ip.ia_v6;
    if (inet_pton(ip_ver, ipaddr, addrptr) == NULL) {
        logerr("ilbd_get_svr_field: inet_pton failed");
        return;
    }

    if (ip_ver == AF_INET) {
        IN6_INADDR_TO_V4MAPPED(&(temp_ip.ia_v4), sgs_addr);
    } else {
        (void) memcpy(sgs_addr, &(temp_ip.ia_v6),
            sizeof (struct in6_addr));
    }

    *sgs_flags = atoi(flagstr);
    *min_port = atoi(strtok(portstr, "-"));
    *min_port = ntohs(*min_port);
    max_portstr = strtok(NULL, "-");
    if (max_portstr != NULL) {
        *max_port = atoi(max_portstr);
        *max_port = ntohs(*max_port);
    }
}

/*
 * Convert the info of a server to its SCF string value representation.
 * Argument value is assumed to be of size ILBD_MAX_VALUE_LEN.
 */
static void
ilbd_srv_scf_val(ilbd_srv_t *srv, char *value)
{
    char ipstr[INET6_ADDRSTRLEN];
    int ipver;

    if (GET_AF(&srv->isv_addr) == AF_INET) {
        struct in_addr v4_addr;

        IN6_V4MAPPED_TO_INADDR(&srv->isv_addr, &v4_addr);
        (void) inet_ntop(AF_INET, &v4_addr, ipstr, sizeof (ipstr));
        ipver = AF_INET;
    } else {
        (void) inet_ntop(AF_INET6, &srv->isv_addr, ipstr,
            sizeof (ipstr));
        ipver = AF_INET6;
    }
    (void) snprintf(value, ILBD_MAX_VALUE_LEN, "%s;%d;%d-%d;%d",
        ipstr, ipver, ntohs(srv->isv_minport), ntohs(srv->isv_maxport),
        srv->isv_flags);
}

/* get the "ip:port:status" str of the #num server in the servergroup */
ilb_status_t
ilbd_get_svr_info(ilbd_sg_t *sg, int num, char *valstr, char *svrname)
{
    int i;
    ilbd_srv_t *tmp_srv = NULL;

    tmp_srv = list_head(&sg->isg_srvlist);
    if (tmp_srv == NULL)
        return (ILB_STATUS_ENOENT);

    for (i = 0; i < num; i++)
        tmp_srv = list_next(&sg->isg_srvlist, tmp_srv);

    assert(tmp_srv != NULL);
    if (valstr != NULL)
        ilbd_srv_scf_val(tmp_srv, valstr);

    if (svrname != NULL) {
        (void) snprintf(svrname, ILBD_MAX_NAME_LEN, "server%d",
            tmp_srv->isv_id);
    }

    return (ILB_STATUS_OK);
}

/* convert a struct in6_addr to valstr */
ilb_status_t
ilbd_scf_ip_to_str(uint16_t ipversion, struct in6_addr *addr,
    scf_type_t *scftype, char *valstr)
{
    size_t vallen;
    ilb_ip_addr_t ipaddr;
    void *addrptr;

    vallen = (ipversion == AF_INET) ? INET_ADDRSTRLEN :
        INET6_ADDRSTRLEN;
    if (scftype != NULL)
        *scftype = (ipversion == AF_INET) ? SCF_TYPE_NET_ADDR_V4 :
            SCF_TYPE_NET_ADDR_V6;

    IP_COPY_IMPL_2_CLI(addr, &ipaddr);
    addrptr = (ipversion == AF_INET) ?
        (void *)&ipaddr.ia_v4 : (void *)&ipaddr.ia_v6;
    (void) inet_ntop(ipversion, (void *)addrptr, valstr, vallen);
    return (ILB_STATUS_OK);
}

/*
 * This function takes a ilbd internal data struct and translate its value to
 * scf value. The data struct is passed in within "data".
 * Upon successful return, the scf val will be stored in "val" and the scf type
 * will be returned in "scftype" if scftype != NULL, the number of values
 * translated will be in "numval"
 * If it failed, no data will be written to SCF
 */
static ilb_status_t
ilbd_data_to_scfval(ilbd_scf_pg_type_t pg_type, ilbd_var_type_t type,
    scf_handle_t *h, void *data, scf_value_t ***val, scf_type_t *scftype,
    int *numval)
{
    scf_value_t *v, **varray = NULL;
    int ret = ILB_STATUS_OK;
    int i;
    int scf_val_len = ILBD_MAX_VALUE_LEN;
    char *valstr = NULL;
    int valint;
    uint8_t valbool = 0;
    ilbd_rule_t *r_ent = NULL;
    ilbd_sg_t *s_ent = NULL;
    ilbd_hc_t *h_ent = NULL;

    switch (pg_type) {
    case ILBD_SCF_RULE:
        r_ent = (ilbd_rule_t *)data;
        break;
    case ILBD_SCF_SG:
        s_ent = (ilbd_sg_t *)data;
        break;
    case ILBD_SCF_HC:
        h_ent = (ilbd_hc_t *)data;
        break;
    }

    v = scf_value_create(h);
    if (v == NULL)
        return (ILB_STATUS_INTERNAL);

    if ((valstr = malloc(scf_val_len)) == NULL)
            return (ILB_STATUS_ENOMEM);
    switch (type) {
    case ILBD_RULE_STATUS:
        valbool = r_ent->irl_flags & ILB_FLAGS_RULE_ENABLED;
        break;
    case ILBD_RULE_VIP:
        ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion, &r_ent->irl_vip,
            scftype, valstr);
        if (ret != ILB_STATUS_OK) {
            free(valstr);
            scf_value_destroy(v);
            return (ret);
        }
        break;
    case ILBD_RULE_PROTO: {
        struct protoent *protoent;

        protoent = getprotobynumber(r_ent->irl_proto);
        (void) strlcpy(valstr, protoent->p_name, scf_val_len);
        break;
    }
    case ILBD_RULE_PORT:
        (void) snprintf(valstr, scf_val_len, "%d-%d",
            r_ent->irl_minport, r_ent->irl_maxport);
        break;
    case ILBD_RULE_ALGO:
        ilbd_algo_to_str(r_ent->irl_algo, valstr);
        break;
    case ILBD_RULE_TOPO:
        ilbd_topo_to_str(r_ent->irl_topo, valstr);
        break;
    case ILBD_RULE_NAT_STR:
        ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
            &r_ent->irl_nat_src_start, scftype, valstr);
        if (ret != ILB_STATUS_OK) {
            free(valstr);
            scf_value_destroy(v);
            return (ret);
        }
        break;
    case ILBD_RULE_NAT_END:
        ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
            &r_ent->irl_nat_src_end, scftype, valstr);
        if (ret != ILB_STATUS_OK) {
            free(valstr);
            scf_value_destroy(v);
            return (ret);
        }
        break;
    case ILBD_RULE_STI_MASK:
        ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
            &r_ent->irl_stickymask, scftype, valstr);
        if (ret != ILB_STATUS_OK) {
            free(valstr);
            scf_value_destroy(v);
            return (ret);
        }
        break;
    case ILBD_RULE_SGNAME:
        (void) strlcpy(valstr, r_ent->irl_sgname, scf_val_len);
        break;
    case ILBD_RULE_HCNAME:
        if (r_ent->irl_hcname[0] != '\0')
            (void) strlcpy(valstr, r_ent->irl_hcname,
                scf_val_len);
        else
            bzero(valstr, ILBD_MAX_VALUE_LEN);
        break;
    case ILBD_RULE_HCPORT:
        valint = r_ent->irl_hcport;
        break;
    case ILBD_RULE_HCPFLAG:
        valint = r_ent->irl_hcpflag;
        break;
    case ILBD_RULE_DRAINTIME:
        valint = r_ent->irl_conndrain;
        break;
    case ILBD_RULE_NAT_TO:
        valint = r_ent->irl_nat_timeout;
        break;
    case ILBD_RULE_PERS_TO:
        valint = r_ent->irl_sticky_timeout;
        break;

    case ILBD_SG_SERVER:
        if (s_ent->isg_srvcount == 0) {
            (void) strlcpy(valstr, "EMPTY_SERVERGROUP",
                scf_val_len);
            break;
        }

        varray = calloc(sizeof (*varray), s_ent->isg_srvcount);
        if (varray == NULL) {
            scf_value_destroy(v);
            free(valstr);
            return (ILB_STATUS_ENOMEM);
        }

        for (i = 0; i < s_ent->isg_srvcount; i++) {
            if (v == NULL) {
                for (i--; i >= 0; i--)
                    scf_value_destroy(varray[i]);
                free(valstr);
                return (ILB_STATUS_ENOMEM);
            }

            ret = ilbd_get_svr_info(s_ent, i, valstr, NULL);
            if (ret != ILB_STATUS_OK) {
                scf_value_destroy(v);
                for (i--; i >= 0; i--)
                    scf_value_destroy(varray[i]);
                free(valstr);
                free(varray);
                return (ret);
            }
            (void) scf_value_set_astring(v, valstr);
            varray[i] = v;
            v = scf_value_create(h);
        }
        /* the last 'v' we created will go unused, so drop it */
        scf_value_destroy(v);
        *numval = s_ent->isg_srvcount;
        *val = varray;
        free(valstr);
        return (ret);
    case ILBD_HC_TEST:
        (void) strlcpy(valstr, h_ent->ihc_test, scf_val_len);
        break;
    case ILBD_HC_TIMEOUT:
        valint = h_ent->ihc_timeout;
        break;
    case ILBD_HC_INTERVAL:
        valint = h_ent->ihc_interval;
        break;
    case ILBD_HC_DEF_PING:
        valbool = h_ent->ihc_def_ping;
        break;
    case ILBD_HC_COUNT:
        valint = h_ent->ihc_count;
        break;
    }

    switch (*scftype) {
    case SCF_TYPE_BOOLEAN:
        scf_value_set_boolean(v, valbool);
        break;
    case SCF_TYPE_ASTRING:
        (void) scf_value_set_astring(v, valstr);
        break;
    case SCF_TYPE_INTEGER:
        scf_value_set_integer(v, valint);
        break;
    case SCF_TYPE_NET_ADDR_V4:
        (void) scf_value_set_from_string(v, SCF_TYPE_NET_ADDR_V4,
            valstr);
        break;
    case SCF_TYPE_NET_ADDR_V6:
        (void) scf_value_set_from_string(v, SCF_TYPE_NET_ADDR_V6,
            valstr);
        break;
    }
    free(valstr);

    varray = calloc(1, sizeof (*varray));
    if (varray == NULL) {
        scf_value_destroy(v);
        return (ILB_STATUS_ENOMEM);
    }
    varray[0] = v;
    *val = varray;
    *numval = 1;
    return (ret);
}

/*
 * create a scf property group
 */
ilb_status_t
ilbd_create_pg(ilbd_scf_pg_type_t pg_type, void *data)
{
    ilb_status_t ret;
    char *pgname;
    scf_propertygroup_t *pg = NULL;
    scf_value_t **val;
    scf_handle_t *h;
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char  *scfpgbuf; /* property group name or group type */
    int i, i_st, i_end;

    switch (pg_type) {
    case ILBD_SCF_RULE: {
        ilbd_rule_t *r_ent = (ilbd_rule_t *)data;

        pgname = r_ent->irl_name;
        i_st = 0;
        i_end = ILBD_RULE_VAR_NUM;
        break;
    }
    case ILBD_SCF_SG: {
        ilbd_sg_t *s_ent = (ilbd_sg_t *)data;

        pgname = s_ent->isg_name;
        i_st = ILBD_RULE_VAR_NUM;
        i_end = ILBD_RULE_VAR_NUM + ILBD_SG_VAR_NUM;
        break;
    }
    case ILBD_SCF_HC: {
        ilbd_hc_t *h_ent = (ilbd_hc_t *)data;

        pgname = h_ent->ihc_name;
        i_st = ILBD_RULE_VAR_NUM + ILBD_SG_VAR_NUM;
        i_end = ILBD_PROP_VAR_NUM;
        break;
    }
    default:
        logdebug("ilbd_create_pg: invalid pg type %d for pg %s",
            pg_type, pgname);
        return (ILB_STATUS_EINVAL);
    }
    if ((scfpgbuf = malloc(scf_name_len)) == NULL)
        return (ILB_STATUS_ENOMEM);

    ilbd_name_to_scfpgname(pg_type, pgname, scfpgbuf);

    ret = ilbd_scf_retrieve_pg(scfpgbuf, &pg, B_TRUE);
    if (ret != ILB_STATUS_OK) {
        free(scfpgbuf);
        return (ret);
    }
    h = scf_pg_handle(pg);

    /* fill in props */
    for (i = i_st; i < i_end; i++) {
        int num, j;
        scf_type_t scftype = prop_tbl[i].scf_proptype;

        ret = ilbd_data_to_scfval(pg_type, prop_tbl[i].val_type, h,
            data, &val, &scftype, &num);
        if (ret != ILB_STATUS_OK)
            goto done;

        for (j = 0; j < num; j++) {
            if (pg_type == ILBD_SCF_SG) {
                ret = ilbd_get_svr_info(data, j, NULL,
                    scfpgbuf);
                if (ret == ILB_STATUS_ENOENT) {
                    (void) strlcpy(scfpgbuf,
                        "EMPTY_SERVER", scf_name_len);
                }
                ret = ilbd_scf_set_prop(pg, scfpgbuf,
                    scftype, val[j]);
            } else {
                ret = ilbd_scf_set_prop(pg,
                    prop_tbl[i].scf_propname, scftype, val[j]);
            }
            scf_value_destroy(val[j]);
        }
        free(val);
    }

done:
    free(scfpgbuf);
    ilbd_scf_destroy(h, NULL, NULL, pg);
    return (ret);
}

/*
 * destroy a scf property group
 */
static ilb_status_t
ilbd_scf_delete_pg(scf_propertygroup_t *pg)
{
    if (scf_pg_delete(pg) != 0)
        return (ilbd_scf_err_to_ilb_err());
    return (ILB_STATUS_OK);
}

/* sg can have same name as rule */
ilb_status_t
ilbd_destroy_pg(ilbd_scf_pg_type_t pg_t, const char *pgname)
{
    ilb_status_t ret;
    scf_propertygroup_t *pg;
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char *scfname;

    if ((scfname = malloc(scf_name_len)) == NULL)
        return (ILB_STATUS_ENOMEM);
    ilbd_name_to_scfpgname(pg_t, pgname, scfname);

    ret = ilbd_scf_retrieve_pg(scfname, &pg, B_FALSE);
    free(scfname);
    if (ret != ILB_STATUS_EEXIST)
        return (ret);
    ret = ilbd_scf_delete_pg(pg);
    ilbd_scf_destroy(scf_pg_handle(pg), NULL, NULL, pg);
    return (ret);
}

/*
 * Set named property to scf value specified.  If property is new,
 * create it.
 */
static ilb_status_t
ilbd_scf_set_prop(scf_propertygroup_t *pg, const char *propname,
    scf_type_t proptype, scf_value_t *val)
{
    scf_handle_t *h = NULL;
    scf_property_t *prop = NULL;
    scf_value_t *oldval = NULL;
    scf_transaction_t *tx = NULL;
    scf_transaction_entry_t *ent = NULL;
    boolean_t new = B_FALSE;
    ilb_status_t ret = ILB_STATUS_OK;
    int commit_ret;

    h = scf_pg_handle(pg);
    if (h == NULL || propname == NULL)
        return (ILB_STATUS_EINVAL);

    ret = ilbd_scf_get_prop_val(pg, propname, &oldval);
    if (oldval != NULL)
        scf_value_destroy(oldval);
    if (ret == ILB_STATUS_ENOENT)
        new = B_TRUE;
    else if (ret != ILB_STATUS_OK)
        return (ret);

    if ((prop = scf_property_create(h)) == NULL)
        return (ilbd_scf_err_to_ilb_err());
    if ((tx = scf_transaction_create(h)) == NULL ||
        (ent = scf_entry_create(h)) == NULL) {
        ret = ilbd_scf_err_to_ilb_err();
        logdebug("ilbd_scf_set_prop: create scf transaction failed\n");
        goto out;
    }

    if (scf_transaction_start(tx, pg) == -1) {
        ret = ilbd_scf_err_to_ilb_err();
        logdebug("ilbd_scf_set_prop: start scf transaction failed\n");
        goto out;
    }

    if (new) {
        if (scf_transaction_property_new(tx, ent, propname,
            proptype) == -1) {
            ret = ilbd_scf_err_to_ilb_err();
            logdebug("ilbd_scf_set_prop: create scf prop failed\n");
            goto out;
        }
    } else {
        if (scf_transaction_property_change(tx, ent, propname, proptype)
            == -1) {
            ret = ilbd_scf_err_to_ilb_err();
            logdebug("ilbd_scf_set_prop: change scf prop failed\n");
            goto out;
        }
    }

    if (scf_entry_add_value(ent, val) != 0) {
        logdebug("ilbd_scf_set_prop: add scf entry failed\n");
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }

    commit_ret = scf_transaction_commit(tx);
    switch (commit_ret) {
    case 1:
        ret = ILB_STATUS_OK;
        /* update pg here, so subsequent property setting  succeeds */
        (void) scf_pg_update(pg);
        break;
    case 0:
        /* transaction failed due to not having most recent pg */
        ret = ILB_STATUS_INUSE;
        break;
    default:
        ret = ilbd_scf_err_to_ilb_err();
        break;
    }
out:
    if (tx != NULL)
        scf_transaction_destroy(tx);
    if (ent != NULL)
        scf_entry_destroy(ent);
    if (prop != NULL)
        scf_property_destroy(prop);

    return (ret);
}

/*
 * get a prop's scf val
 */
static ilb_status_t
ilbd_scf_get_prop_val(scf_propertygroup_t *pg, const char *propname,
    scf_value_t **val)
{
    scf_handle_t *h = NULL;
    scf_property_t *prop = NULL;
    scf_value_t *value = NULL;
    ilb_status_t ret = ILB_STATUS_OK;

    h = scf_pg_handle(pg);
    if (h == NULL || propname == NULL)
        return (ILB_STATUS_EINVAL);

    if ((prop = scf_property_create(h)) == NULL)
        return (ilbd_scf_err_to_ilb_err());

    if (scf_pg_get_property(pg, propname, prop) != 0) {
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }

    if ((value = scf_value_create(h)) == NULL) {
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }

    if (scf_property_get_value(prop, value) != 0) {
        scf_value_destroy(value);
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }

    *val = value;
out:
    if (prop != NULL)
        scf_property_destroy(prop);

    return (ret);
}

typedef struct ilbd_data
{
    union {
        ilb_sg_info_t *sg_info;
        ilb_hc_info_t *hc_info;
        ilb_rule_info_t *rule_info;
    } data;
    ilbd_scf_pg_type_t pg_type; /* type of data */
#define sg_data data.sg_info
#define hc_data data.hc_info
#define rule_data data.rule_info
} ilbd_data_t;

void
ilbd_scf_str_to_ip(int ipversion, char *ipstr, struct in6_addr *addr)
{
    ilb_ip_addr_t ipaddr;
    void *addrptr;

    addrptr = (ipversion == AF_INET) ?
        (void *)&ipaddr.ia_v4 : (void *)&ipaddr.ia_v6;
    (void) inet_pton(ipversion, ipstr, addrptr);
    if (ipversion == AF_INET) {
        IN6_INADDR_TO_V4MAPPED(&(ipaddr.ia_v4), addr);
    } else {
        (void) memcpy(addr, &(ipaddr.ia_v6),
            sizeof (struct in6_addr));
    }
}

/*
 * This function takes a scf value and writes it to the correct field of the
 * corresponding data struct.
 */
static ilb_status_t
ilbd_scfval_to_data(const char *propname, ilbd_var_type_t ilb_type,
    scf_value_t *val, ilbd_data_t *ilb_data)
{

    scf_type_t scf_type = scf_value_type(val);
    ilbd_scf_pg_type_t pg_type = ilb_data->pg_type;
    int ret = 0;
    ilb_rule_info_t *r_ent = NULL;
    ilb_sg_info_t *s_ent = NULL;
    ilb_hc_info_t *h_ent = NULL;
    char ipstr[INET6_ADDRSTRLEN];
    char *valstr;
    int64_t valint;
    uint8_t valbool;
    int ipversion;

    switch (pg_type) {
    case ILBD_SCF_RULE:
        r_ent = ilb_data->rule_data;
        break;
    case ILBD_SCF_HC:
        h_ent = ilb_data->hc_data;
        break;
    case ILBD_SCF_SG:
        s_ent = ilb_data->sg_data;
        break;
    }

    /* get scf value out */
    if ((valstr = malloc(ILBD_MAX_VALUE_LEN)) == NULL)
        return (ILB_STATUS_ENOMEM);
    switch (scf_type) {
        case SCF_TYPE_NET_ADDR_V4:
            if (scf_value_get_as_string_typed(val,
                SCF_TYPE_NET_ADDR_V4, ipstr, INET_ADDRSTRLEN) < 0) {
                free(valstr);
                return (ILB_STATUS_INTERNAL);
            }
            ipversion = AF_INET;
            break;
        case SCF_TYPE_NET_ADDR_V6:
            if (scf_value_get_as_string_typed(val,
                SCF_TYPE_NET_ADDR_V6, ipstr,
                INET6_ADDRSTRLEN) < 0) {
                free(valstr);
                return (ILB_STATUS_INTERNAL);
            }
            ipversion = AF_INET6;
            break;
        case SCF_TYPE_BOOLEAN:
            if (scf_value_get_boolean(val, &valbool) < 0) {
                free(valstr);
                return (ILB_STATUS_INTERNAL);
            }
            break;
        case SCF_TYPE_ASTRING:
            if (scf_value_get_astring(val, valstr,
                ILBD_MAX_VALUE_LEN) < 0) {
                free(valstr);
                return (ILB_STATUS_INTERNAL);
            }
            break;
        case SCF_TYPE_INTEGER:
            if (scf_value_get_integer(val, &valint) < 0) {
                free(valstr);
                return (ILB_STATUS_INTERNAL);
            }
            break;
        default:
            free(valstr);
            return (ILB_STATUS_INTERNAL);
    }

    ret = ILB_STATUS_OK;
    switch (ilb_type) {
    case ILBD_RULE_STATUS:
        if (valbool)
            r_ent->rl_flags |= ILB_FLAGS_RULE_ENABLED;
        break;
    case ILBD_RULE_VIP:
        r_ent->rl_ipversion = ipversion;
        ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_vip);
        break;
    case ILBD_RULE_PROTO: {
        struct protoent *protoent;

        protoent = getprotobyname(valstr);
        r_ent->rl_proto = protoent->p_proto;
        break;
    }
    case ILBD_RULE_PORT: {
        char *token1, *token2;

        token1 = strtok(valstr, "-");
        token2 = strtok(NULL, "-");
        r_ent->rl_minport = atoi(token1);
        r_ent->rl_maxport = atoi(token2);
        break;
    }
    case ILBD_RULE_ALGO:
        ilbd_scf_str_to_algo(&(r_ent->rl_algo), valstr);
        break;
    case ILBD_RULE_TOPO:
        ilbd_scf_str_to_topo(&(r_ent->rl_topo), valstr);
        break;
    case ILBD_RULE_NAT_STR:
        ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_nat_src_start);
        break;
    case ILBD_RULE_NAT_END:
        ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_nat_src_end);
        break;
    case ILBD_RULE_STI_MASK:
        ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_stickymask);
        if (ipversion == AF_INET) {
            if (!IN6_IS_ADDR_V4MAPPED_ANY(&r_ent->rl_stickymask))
                r_ent->rl_flags |= ILB_FLAGS_RULE_STICKY;
        } else {
            if (!IN6_IS_ADDR_UNSPECIFIED(&r_ent->rl_stickymask))
                r_ent->rl_flags |= ILB_FLAGS_RULE_STICKY;
        }
        break;
    case ILBD_RULE_SGNAME:
        (void) strlcpy(r_ent->rl_sgname, valstr,
            sizeof (r_ent->rl_sgname));
        break;
    case ILBD_RULE_HCNAME:
        (void) strlcpy(r_ent->rl_hcname, valstr,
            sizeof (r_ent->rl_hcname));
        break;
    case ILBD_RULE_HCPORT:
        r_ent->rl_hcport = valint;
        break;
    case ILBD_RULE_HCPFLAG:
        r_ent->rl_hcpflag = valint;
        break;
    case ILBD_RULE_DRAINTIME:
        r_ent->rl_conndrain = valint;
        break;
    case ILBD_RULE_NAT_TO:
        r_ent->rl_nat_timeout = valint;
        break;
    case ILBD_RULE_PERS_TO:
        r_ent->rl_sticky_timeout = valint;
        break;

    case ILBD_SG_SERVER: {
        int svr_cnt = s_ent->sg_srvcount;

        /* found a new server, increase the svr count of this sg */
        s_ent->sg_srvcount++;

        /*
         * valstr contains information of one server in the servergroup
         * valstr is in the format of "ip:minport-maxport:enable"
         */
        s_ent = realloc(s_ent, sizeof (ilb_sg_info_t) +
            s_ent->sg_srvcount * sizeof (ilb_sg_srv_t));

        /* sgs_srvID is the sg name, leave it blank */
        /*
         * sgs_id is the digit in propname, propname is in a format of
         * "server" + the digital serverID. We get the serverID by
         * reading from the 7th char of propname.
         */
        s_ent->sg_servers[svr_cnt].sgs_id = atoi(&propname[6]);

        ilbd_get_svr_field(valstr,
            &s_ent->sg_servers[svr_cnt].sgs_addr,
            &s_ent->sg_servers[svr_cnt].sgs_minport,
            &s_ent->sg_servers[svr_cnt].sgs_maxport,
            &s_ent->sg_servers[svr_cnt].sgs_flags);
        ilb_data->sg_data = s_ent;

        break;
    }
    case ILBD_HC_TEST:
        (void) strlcpy(h_ent->hci_test, valstr,
            sizeof (h_ent->hci_test));
        break;
    case ILBD_HC_TIMEOUT:
        h_ent->hci_timeout = valint;
        break;
    case ILBD_HC_INTERVAL:
        h_ent->hci_interval = valint;
        break;
    case ILBD_HC_DEF_PING:
        h_ent->hci_def_ping = valbool;
        break;
    case ILBD_HC_COUNT:
        h_ent->hci_count = valint;
        break;
    case ILBD_VAR_INVALID:
        /*
         * An empty server group is represented by an invalid
         * SCF property.  So when loading a server group, this
         * case can be hit.  But it should happen only for this
         * single case.  So if it happens in another case, move
         * the service into maintenance mode.
         */
        if (pg_type != ILBD_SCF_SG || scf_type != SCF_TYPE_ASTRING) {
            logerr("%s: invalid ilb type", __func__);
            (void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
        } else {
            logdebug("%s: invalid ilb type", __func__);
        }
        break;
    }

    free(valstr);
    return (ret);
}

static ilbd_var_type_t
ilbd_name_to_valtype(const char *prop_name)
{
    int i;

    for (i = 0; i < ILBD_PROP_VAR_NUM; i++)
        if (strncmp(prop_name, prop_tbl[i].scf_propname,
            strlen(prop_tbl[i].scf_propname)) == 0)
            return (prop_tbl[i].val_type);

    logdebug("ilbd_name_to_valtype: couldn't find prop %s", prop_name);
    return (ILBD_VAR_INVALID);
}

/* callback for pg_walk_prop, arg is ilbd_data_t */
static ilb_status_t
ilbd_scf_load_prop(scf_propertygroup_t *pg, const char *prop_name, void *arg)
{
    scf_handle_t *h;
    scf_value_t *val;
    ilb_status_t ret;
    ilbd_data_t *ilb_data = (ilbd_data_t *)arg;
    ilbd_var_type_t val_type = ilbd_name_to_valtype(prop_name);

    h = scf_pg_handle(pg);
    if (h == NULL)
        return (ILB_STATUS_EINVAL);

    ret = ilbd_scf_get_prop_val(pg, prop_name, &val);
    if (ret == ILB_STATUS_ENOENT)
        return (ILB_STATUS_OK);
    else if (ret != ILB_STATUS_OK)
        return (ret);

    /*
     * Load value to ilb_data.
     */
    ret = ilbd_scfval_to_data(prop_name, val_type, val, ilb_data);

out:
    if (val != NULL)
        scf_value_destroy(val);

    return (ret);
}

/*
 * walk properties in one prop group, arg is ilbd_data
 * cb is ilbd_scf_load_prop()
 */
static ilb_status_t
ilbd_scf_pg_walk_props(scf_propertygroup_t *pg,
    ilb_status_t (*cb)(scf_propertygroup_t *, const char *, void *),
    void *arg)
{
    scf_handle_t *h;
    scf_iter_t *propiter;
    scf_property_t *prop;
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char *prop_name = NULL;
    ilb_status_t ret = ILB_STATUS_OK;
    int scf_ret = -1;

    h = scf_pg_handle(pg);
    if (h == NULL)
        return (ILB_STATUS_EINVAL);

    prop = scf_property_create(h);
    propiter = scf_iter_create(h);
    if (prop == NULL || propiter == NULL)
        goto out;

    if (scf_iter_pg_properties(propiter, pg) != 0)
        goto out;

    if ((prop_name = malloc(scf_name_len)) == NULL) {
        ret = ILB_STATUS_ENOMEM;
        goto out;
    }
    while ((scf_ret = scf_iter_next_property(propiter, prop)) == 1) {
        if (scf_property_get_name(prop, prop_name, scf_name_len)
            < 0) {
            ret = ilbd_scf_err_to_ilb_err();
            goto out;
        }
        ret = cb(pg, prop_name, arg);
        if (ret != ILB_STATUS_OK)
            break;
    }
out:
    if (prop_name != NULL)
        free(prop_name);
    if (scf_ret == -1)
        ret = ilbd_scf_err_to_ilb_err();
    if (prop != NULL)
        scf_property_destroy(prop);
    if (propiter != NULL)
        scf_iter_destroy(propiter);

    return (ret);
}

/* cbs are libd_create_X */
static ilb_status_t
ilbd_scf_instance_walk_pg(scf_instance_t *inst,
    ilbd_scf_pg_type_t pg_type,
    ilb_status_t (*cb)(void *, int, struct passwd *, ucred_t *),
    void *arg1, void *arg2)
{
    int         scf_ret;
    ilb_status_t        ret;
    scf_handle_t        *h;
    scf_iter_t      *pgiter;
    scf_propertygroup_t *newpg;
    int         port = *((int *)arg1);
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char *pg_name = NULL;

    if (inst == NULL)
        return (ILB_STATUS_EINVAL);

    h = scf_instance_handle(inst);
    if (h == NULL)
        return (ILB_STATUS_EINVAL);

    if ((newpg = scf_pg_create(h)) == NULL)
        return (ilbd_scf_err_to_ilb_err());

    if ((pgiter = scf_iter_create(h)) == NULL) {
        scf_pg_destroy(newpg);
        return (ilbd_scf_err_to_ilb_err());
    }

    if ((scf_ret = scf_iter_instance_pgs(pgiter, inst)) < 0)
        goto out;

    if ((pg_name = malloc(scf_name_len)) == NULL) {
        ret = ILB_STATUS_ENOMEM;
        goto out;
    }
    while ((scf_ret = scf_iter_next_pg(pgiter, newpg)) > 0) {
        ilbd_data_t data;

        if (scf_pg_get_name(newpg, pg_name, scf_name_len) < 0) {
            ret = ilbd_scf_err_to_ilb_err();
            goto out;
        }

        /*
         * if pg name indicates it's a ilb configuration, walk its prop
         */
        data.pg_type = pg_type;
        data.hc_data = NULL;
        data.sg_data = NULL;
        data.rule_data = NULL;

        switch (pg_type) {
        case ILBD_SCF_RULE:
            if (strncmp(ILBD_PG_NAME_RULE, pg_name,
                strlen(ILBD_PG_NAME_RULE)) == 0) {
                data.rule_data = calloc(1,
                    sizeof (ilb_rule_info_t));
                if (data.rule_data == NULL) {
                    ret = ILB_STATUS_ENOMEM;
                    goto out;
                }
                ret = ilbd_scf_pg_walk_props(newpg,
                    ilbd_scf_load_prop, &data);
                if (ret != ILB_STATUS_OK)
                    goto out;
                assert(data.rule_data != NULL);
                /* set rule name */
                (void) strlcpy(data.rule_data->rl_name,
                    &pg_name[strlen(ILBD_PG_NAME_RULE)],
                    sizeof (data.rule_data->rl_name));

                ret = cb(data.rule_data, port, arg2, NULL);
                free(data.rule_data);
                if (ret != ILB_STATUS_OK)
                    goto out;
            }
            break;
        case ILBD_SCF_SG:
            if (strncmp(ILBD_PG_NAME_SG, pg_name,
                strlen(ILBD_PG_NAME_SG)) == 0) {
                data.sg_data = calloc(1,
                    sizeof (ilb_sg_info_t));
                if (data.sg_data == NULL) {
                    ret = ILB_STATUS_ENOMEM;
                    goto out;
                }
                ret = ilbd_scf_pg_walk_props(newpg,
                    ilbd_scf_load_prop, &data);
                if (ret != ILB_STATUS_OK) {
                    free(data.sg_data);
                    goto out;
                }
                assert(data.sg_data != NULL);
                /* set sg name */
                (void) strlcpy(data.sg_data->sg_name,
                    &pg_name[strlen(ILBD_PG_NAME_SG)],
                    sizeof (data.sg_data->sg_name));
                ret = cb(data.sg_data, port, arg2, NULL);
                if (ret != ILB_STATUS_OK) {
                    free(data.sg_data);
                    goto out;
                }
                /*
                 * create a servergroup is two-step operation.
                 * 1. create an empty servergroup.
                 * 2. add server(s) to the group.
                 *
                 * since we are here from:
                 * main_loop()->ilbd_read_config()->
                 * ilbd_walk_sg_pgs()
                 * there is no cli to send. So in this
                 * path auditing will skip the
                 * adt_set_from_ucred() check
                 */
                if (data.sg_data->sg_srvcount > 0) {
                    ret = ilbd_add_server_to_group(
                        data.sg_data, port, NULL, NULL);
                    if (ret != ILB_STATUS_OK) {
                        free(data.sg_data);
                        goto out;
                    }
                    free(data.sg_data);
                }
            }
            break;
        case ILBD_SCF_HC:
            if (strncmp(ILBD_PG_NAME_HC, pg_name,
                strlen(ILBD_PG_NAME_HC)) == 0) {
                data.hc_data = calloc(1,
                    sizeof (ilb_hc_info_t));
                if (data.hc_data == NULL) {
                    ret = ILB_STATUS_ENOMEM;
                    goto out;
                }
                ret = ilbd_scf_pg_walk_props(newpg,
                    ilbd_scf_load_prop, &data);
                if (ret != ILB_STATUS_OK)
                    goto out;
                assert(data.hc_data != NULL);
                /* set hc name */
                (void) strlcpy(data.hc_data->hci_name,
                    &pg_name[strlen(ILBD_PG_NAME_HC)],
                    sizeof (data.hc_data->hci_name));
                ret = cb(data.hc_data, port, arg2, NULL);
                free(data.hc_data);
                if (ret != ILB_STATUS_OK)
                    goto out;
            }
            break;
        }
    }

out:
    if (pg_name != NULL)
        free(pg_name);
    if (scf_ret < 0)
        ret = ilbd_scf_err_to_ilb_err();
    scf_pg_destroy(newpg);
    scf_iter_destroy(pgiter);
    return (ret);
}

typedef ilb_status_t (*ilbd_scf_walker_fn)(void *, int, struct passwd *,
    ucred_t *);

ilb_status_t
ilbd_walk_rule_pgs(ilb_status_t (*func)(ilb_rule_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
    scf_instance_t *inst;
    scf_handle_t *h;
    scf_service_t *svc;
    ilb_status_t ret;

    ret = ilbd_scf_get_inst(&h, &svc, &inst);
    if (ret != ILB_STATUS_OK)
        return (ret);

    /* get rule prop group, transfer it to ilb_lrule_info_t */
    ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_RULE,
        (ilbd_scf_walker_fn)func, arg1, arg2);
    ilbd_scf_destroy(h, svc, inst, NULL);
    return (ret);
}

ilb_status_t
ilbd_walk_sg_pgs(ilb_status_t (*func)(ilb_sg_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
    scf_instance_t *inst;
    scf_handle_t *h;
    scf_service_t *svc;
    ilb_status_t ret;

    ret = ilbd_scf_get_inst(&h, &svc, &inst);
    if (ret != ILB_STATUS_OK)
        return (ret);

    ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_SG,
        (ilbd_scf_walker_fn)func, arg1, arg2);
    ilbd_scf_destroy(h, svc, inst, NULL);
    return (ret);
}

ilb_status_t
ilbd_walk_hc_pgs(ilb_status_t (*func)(const ilb_hc_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
    scf_instance_t *inst;
    scf_handle_t *h;
    scf_service_t *svc;
    ilb_status_t ret;

    ret = ilbd_scf_get_inst(&h, &svc, &inst);
    if (ret != ILB_STATUS_OK)
        return (ret);

    ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_HC,
        (ilbd_scf_walker_fn)func, arg1, arg2);
    ilbd_scf_destroy(h, svc, inst, NULL);
    return (ret);
}

ilb_status_t
ilbd_change_prop(ilbd_scf_pg_type_t pg_type, const char *pg_name,
    const char *prop_name, void *new_val)
{
    int ret;
    scf_propertygroup_t *scfpg = NULL;
    char *scf_pgname = NULL;
    scf_type_t scftype;
    scf_value_t *scfval;
    scf_handle_t *h;

    if ((scf_pgname = malloc(ILBD_MAX_NAME_LEN)) == NULL)
        return (ILB_STATUS_ENOMEM);
    ilbd_name_to_scfpgname(pg_type, pg_name, scf_pgname);
    ret = ilbd_scf_retrieve_pg(scf_pgname, &scfpg, B_FALSE);
    free(scf_pgname);

    if (ret != ILB_STATUS_EEXIST)
        return (ret);

    assert(scfpg != NULL);

    h = scf_pg_handle(scfpg);
    if (h == NULL) {
        ret = ILB_STATUS_EINVAL;
        goto done;
    }

    if ((scfval = scf_value_create(h)) == NULL) {
        ret = ILB_STATUS_ENOMEM;
        goto done;
    }

    if (pg_type == ILBD_SCF_RULE) {
        scftype = SCF_TYPE_BOOLEAN;
        scf_value_set_boolean(scfval, *(boolean_t *)new_val);
    } else if (pg_type == ILBD_SCF_SG) {
        scftype = SCF_TYPE_ASTRING;
        (void) scf_value_set_astring(scfval, (char *)new_val);
    }
    ret = ilbd_scf_set_prop(scfpg, prop_name, scftype, scfval);

done:
    if (scf_pg_handle(scfpg) != NULL)
        scf_handle_destroy(scf_pg_handle(scfpg));
    if (scfpg != NULL)
        scf_pg_destroy(scfpg);
    if (scfval != NULL)
        scf_value_destroy(scfval);
    return (ret);
}

/*
 * Update the persistent configuration with a new server, srv, added to a
 * server group, sg.
 */
ilb_status_t
ilbd_scf_add_srv(ilbd_sg_t *sg, ilbd_srv_t *srv)
{
    scf_propertygroup_t *pg;
    scf_handle_t *h;
    scf_value_t *val;
    ilb_status_t ret;
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char *buf = NULL;

    if ((buf = malloc(scf_name_len)) == NULL)
        return (ILB_STATUS_ENOMEM);

    ilbd_name_to_scfpgname(ILBD_SCF_SG, sg->isg_name, buf);
    ret = ilbd_scf_retrieve_pg(buf, &pg, B_FALSE);
    /*
     * The server group does not exist in persistent storage.  This
     * cannot happen.  Should probably transition the service to
     * maintenance since it should be there.
     */
    if (ret != ILB_STATUS_EEXIST) {
        logerr("ilbd_scf_add_srv: SCF update failed - entering"
            " maintenance mode");
        (void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
        free(buf);
        return (ILB_STATUS_INTERNAL);
    }

    if ((h = scf_pg_handle(pg)) == NULL) {
        ilbd_scf_destroy(NULL, NULL, NULL, pg);
        free(buf);
        return (ilbd_scf_err_to_ilb_err());
    }

    if ((val = scf_value_create(h)) == NULL) {
        ilbd_scf_destroy(h, NULL, NULL, pg);
        free(buf);
        return (ILB_STATUS_ENOMEM);
    }
    ilbd_srv_scf_val(srv, buf);
    (void) scf_value_set_astring(val, buf);

    (void) snprintf(buf, scf_name_len, "server%d", srv->isv_id);
    ret = ilbd_scf_set_prop(pg, buf, SCF_TYPE_ASTRING, val);
    free(buf);
    ilbd_scf_destroy(h, NULL, NULL, pg);
    scf_value_destroy(val);

    return (ret);
}

/*
 * Delete a server, srv, of a server group, sg, from the persistent
 * configuration.
 */
ilb_status_t
ilbd_scf_del_srv(ilbd_sg_t *sg, ilbd_srv_t *srv)
{
    ilb_status_t ret;
    scf_propertygroup_t *pg;
    scf_handle_t *h;
    int scf_name_len = ILBD_MAX_NAME_LEN;
    char *buf;
    scf_transaction_t *tx = NULL;
    scf_transaction_entry_t *entry = NULL;

    if ((buf = malloc(scf_name_len)) == NULL)
        return (ILB_STATUS_ENOMEM);
    ilbd_name_to_scfpgname(ILBD_SCF_SG, sg->isg_name, buf);
    ret = ilbd_scf_retrieve_pg(buf, &pg, B_FALSE);
    /*
     * The server group does not exist in persistent storage.  This
     * cannot happen. THe caller of this function puts service in
     * maintenance mode.
     */
    if (ret != ILB_STATUS_EEXIST) {
        free(buf);
        return (ILB_STATUS_INTERNAL);
    }
    ret = ILB_STATUS_OK;

    if ((h = scf_pg_handle(pg)) == NULL) {
        logdebug("ilbd_scf_del_srv: scf_pg_handle: %s\n",
            scf_strerror(scf_error()));
        ilbd_scf_destroy(NULL, NULL, NULL, pg);
        free(buf);
        return (ilbd_scf_err_to_ilb_err());
    }

    if ((tx = scf_transaction_create(h)) == NULL ||
        (entry = scf_entry_create(h)) == NULL) {
        logdebug("ilbd_scf_del_srv: create scf transaction failed: "
            "%s\n", scf_strerror(scf_error()));
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }

    (void) snprintf(buf, scf_name_len, "server%d", srv->isv_id);

    if (scf_transaction_start(tx, pg) == -1) {
        logdebug("ilbd_scf_set_prop: start scf transaction failed: "
            "%s\n", scf_strerror(scf_error()));
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }
    if (scf_transaction_property_delete(tx, entry, buf) == -1) {
        logdebug("ilbd_scf_set_prop: delete property failed: %s\n",
            scf_strerror(scf_error()));
        ret = ilbd_scf_err_to_ilb_err();
        goto out;
    }
    if (scf_transaction_commit(tx) != 1) {
        logdebug("ilbd_scf_set_prop: commit transaction failed: %s\n",
            scf_strerror(scf_error()));
        ret = ilbd_scf_err_to_ilb_err();
    }

out:
    free(buf);
    if (entry != NULL)
        scf_entry_destroy(entry);
    if (tx != NULL)
        scf_transaction_destroy(tx);
    ilbd_scf_destroy(h, NULL, NULL, pg);

    return (ret);
}