xref: /illumos-gate/usr/src/cmd/cmd-inet/usr.sbin/ipqosconf/ipqosconf.c (revision 85280f08e3cfa2e404951ad6817bbb974b576858)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/* enable debug output and some debug asserts */
#undef	_IPQOS_CONF_DEBUG

#include <stdlib.h>
#include <unistd.h>
#include <libintl.h>
#include <signal.h>
#include <strings.h>
#include <sys/nvpair.h>
#include <stdio.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <ctype.h>
#include <sys/socket.h>
#include <limits.h>
#include <netdb.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <libipp.h>
#include <ipp/ipp_config.h>
#include <ipp/ipgpc/ipgpc.h>
#include <ipp/ipp.h>
#ifdef	_IPQOS_CONF_DEBUG
#include <assert.h>
#endif
#include <sys/sockio.h>
#include <syslog.h>
#include <stdarg.h>
#include <libintl.h>
#include <locale.h>
#include <pwd.h>
#include "ipqosconf.h"

#if	defined(_IPQOS_CONF_DEBUG)

/* debug level */
static int ipqosconf_dbg_flgs =
/*
 */
RBK |
MHME |
KRET |
DIFF |
APPLY |
L2 |
L1 |
L0 |
0;



#define	IPQOSCDBG0(lvl, x)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x)

#define	IPQOSCDBG1(lvl, x, y)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x, y)

#define	IPQOSCDBG2(lvl, x, y, z)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x, y, z)

#define	IPQOSCDBG3(lvl, x, y, z, a)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x, y, z, a)

#define	IPQOSCDBG4(lvl, x, y, z, a, b)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x, y, z, a, b)

#define	IPQOSCDBG5(lvl, x, y, z, a, b, c)\
	if (lvl & ipqosconf_dbg_flgs)\
		(void) fprintf(stderr, x, y, z, a, b, c)

#else	/* defined(_IPQOS_CONF_DEBUG) && !defined(lint) */

#define	IPQOSCDBG0(lvl, x)
#define	IPQOSCDBG1(lvl, x, y)
#define	IPQOSCDBG2(lvl, x, y, z)
#define	IPQOSCDBG3(lvl, x, y, z, a)
#define	IPQOSCDBG4(lvl, x, y, z, a, b)
#define	IPQOSCDBG5(lvl, x, y, z, a, b, c)

#endif	/* defined(_IPQOS_CONF_DEBUG) */



/* function prototypes */

static int modify_params(char *, nvlist_t **, int, boolean_t);
static int add_class(char *, char *, int, boolean_t, char *);
static int modify_class(char *, char *, int, boolean_t, char *,
    enum ipp_flags);
static int remove_class(char *, char *, int, enum ipp_flags);
static int add_filter(char *, ipqos_conf_filter_t *, int);
static int modify_filter(char *, ipqos_conf_filter_t *, int);
static int remove_filter(char *, char *, int, int);
static boolean_t arrays_equal(int *, int *, uint32_t);
static int diffclass(ipqos_conf_class_t *, ipqos_conf_class_t *);
static int diffparams(ipqos_conf_params_t *, ipqos_conf_params_t *, char *);
static int difffilter(ipqos_conf_filter_t *, ipqos_conf_filter_t *, char *);
static int add_filters(ipqos_conf_filter_t *, char *, int, boolean_t);
static int add_classes(ipqos_conf_class_t *, char *,  int, boolean_t);
static int modify_items(ipqos_conf_action_t *);
static int add_items(ipqos_conf_action_t *, boolean_t);
static int add_item(ipqos_conf_action_t *, boolean_t);
static int remove_items(ipqos_conf_action_t *, boolean_t);
static int remove_item(ipqos_conf_action_t *, boolean_t);
static int undo_modifys(ipqos_conf_action_t *, ipqos_conf_action_t *);
static int applydiff(ipqos_conf_action_t *, ipqos_conf_action_t *);
static int rollback(ipqos_conf_action_t *, ipqos_conf_action_t *);
static int rollback_recover(ipqos_conf_action_t *);
static ipqos_conf_class_t *classexist(char *, ipqos_conf_class_t *);
static ipqos_conf_filter_t *filterexist(char *, int, ipqos_conf_filter_t *);
static ipqos_conf_action_t *actionexist(char *, ipqos_conf_action_t *);
static int diffnvlists(nvlist_t *, nvlist_t *, char *, int *, place_t);
static int diffaction(ipqos_conf_action_t *, ipqos_conf_action_t *);
static int diffconf(ipqos_conf_action_t *, ipqos_conf_action_t *);
static int readllong(char *, long long *, char **);
static int readuint8(char *, uint8_t *, char **);
static int readuint16(char *, uint16_t *, char **);
static int readint16(char *, int16_t *, char **);
static int readint32(char *, int *, char **);
static int readuint32(char *, uint32_t *, char **);
static int readbool(char *, boolean_t *);
static void setmask(int, in6_addr_t *, int);
static int readtoken(FILE *, char **);
static nvpair_t *find_nvpair(nvlist_t *, char *);
static char *prepend_module_name(char *, char *);
static int readnvpair(FILE *, FILE *, nvlist_t **, nvpair_t **,
    ipqos_nvtype_t *, place_t, char *);
static int add_aref(ipqos_conf_act_ref_t **, char *, char *);
static int readparams(FILE *, FILE *, char *, ipqos_conf_params_t *);
static int readclass(FILE *, char *, ipqos_conf_class_t **, char **, int);
static int readfilter(FILE *, FILE *, char *, ipqos_conf_filter_t **, char **,
    int);
static FILE *validmod(char *, int *);
static int readaction(FILE *, ipqos_conf_action_t **);
static int actions_unique(ipqos_conf_action_t *, char **);
static int validconf(ipqos_conf_action_t *, int);
static int readconf(FILE *, ipqos_conf_action_t **);
static int flush(boolean_t *);
static int atomic_flush(boolean_t);
static int flushconf();
static int writeconf(ipqos_conf_action_t *, char *);
static int commitconf();
static int applyconf(char *ifile);
static int block_all_signals();
static int restore_all_signals();
static int unlock(int fd);
static int lock();
static int viewconf(int);
static void usage();
static int valid_name(char *);
static int in_cycle(ipqos_conf_action_t *);
static int readtype(FILE *, char *, char *, ipqos_nvtype_t *, str_val_nd_t **,
    char *, boolean_t, place_t *);
static int read_int_array_info(char *, str_val_nd_t **, uint32_t *, int *,
    int *, char *);
static str_val_nd_t *read_enum_nvs(char *, char *);
static int add_str_val_entry(str_val_nd_t **, char *, uint32_t);
static void free_str_val_entrys(str_val_nd_t *);
static void get_str_val_value_range(str_val_nd_t *, int *, int *);
static int read_enum_value(FILE *, char *, str_val_nd_t *, uint32_t *);
static int read_mapped_values(FILE *, nvlist_t **, char *, char *,
    int);
static int read_int_array(FILE *, char *, int **, uint32_t, int, int,
    str_val_nd_t *);
static int str_val_list_lookup(str_val_nd_t *, char *, uint32_t *);
static int parse_kparams(char *, ipqos_conf_params_t *, nvlist_t *);
static int parse_kclass(ipqos_conf_class_t *, nvlist_t *);
static int parse_kfilter(ipqos_conf_filter_t *, nvlist_t *);
static int parse_kaction(nvlist_t *, ipqos_actinfo_prm_t *);
static int readkconf(ipqos_conf_action_t **);
static void print_int_array(FILE *, int *, uint32_t, int, int, str_val_nd_t *,
    int);
static void printrange(FILE *fp, uint32_t, uint32_t);
static void printenum(FILE *, uint32_t, str_val_nd_t *);
static void printproto(FILE *, uint8_t);
static void printport(FILE *, uint16_t);
static int printnvlist(FILE *, char *, nvlist_t *, int, ipqos_conf_filter_t *,
    int, place_t);
static int virtual_action(char *);
static void free_arefs(ipqos_conf_act_ref_t *);
static void print_action_nm(FILE *, char *);
static int add_orig_ipqosconf(nvlist_t *);
static char *get_originator_nm(uint32_t);
static void mark_classes_filters_new(ipqos_conf_action_t *);
static void mark_classes_filters_del(ipqos_conf_action_t *);
static void mark_config_new(ipqos_conf_action_t *);
static int printifname(FILE *, int);
static int readifindex(char *, int *);
static void cleanup_string_table(char **, int);
static int domultihome(ipqos_conf_filter_t *, ipqos_conf_filter_t **,
    boolean_t);
static int dup_filter(ipqos_conf_filter_t *, ipqos_conf_filter_t **, int, int,
    void *, void *, int);
static void free_actions(ipqos_conf_action_t *);
static ipqos_conf_filter_t *alloc_filter();
static void free_filter(ipqos_conf_filter_t *);
static int read_curl_begin(FILE *);
static ipqos_conf_class_t *alloc_class(void);
static int diffclasses(ipqos_conf_action_t *old, ipqos_conf_action_t *new);
static int difffilters(ipqos_conf_action_t *old, ipqos_conf_action_t *new);
static int dup_class(ipqos_conf_class_t *src, ipqos_conf_class_t **dst);
static int add_action(ipqos_conf_action_t *act);
static int masktocidr(int af, in6_addr_t *mask);
static int read_perm_items(int, FILE *, char *, char ***, int *);
static int in_string_table(char *stable[], int size, char *string);
static void list_end(ipqos_list_el_t **listp, ipqos_list_el_t ***lendpp);
static void add_to_list(ipqos_list_el_t **listp, ipqos_list_el_t *el);
static int read_cfile_ver(FILE *, char *);
static char *quote_ws_string(const char *);
static int read_tfile_ver(FILE *, char *, char *);
static int ver_str_to_int(char *);
static void printuser(FILE *fp, uid_t uid);
static int readuser(char *str, uid_t *uid);

/*
 * macros to call list functions with the more complex list element type
 * cast to the skeletal type iqpos_list_el_t.
 */
#define	GET_LIST_END(list, end)\
	list_end((ipqos_list_el_t **)list,  (ipqos_list_el_t ***)end)
#define	ADD_TO_LIST(list, el)\
	add_to_list((ipqos_list_el_t **)list, (ipqos_list_el_t *)el)

/*
 *	Macros to produce a quoted string containing the value of a
 *	preprocessor macro. For example, if SIZE is defined to be 256,
 *	VAL2STR(SIZE) is "256". This is used to construct format
 *	strings for scanf-family functions below.
 */
#define	QUOTE(x)	#x
#define	VAL2STR(x)	QUOTE(x)


/* globals */

/* table of supported parameter types and enum value */
static str_val_t nv_types[] = {
{"uint8",		IPQOS_DATA_TYPE_UINT8},
{"int16",		IPQOS_DATA_TYPE_INT16},
{"uint16",		IPQOS_DATA_TYPE_UINT16},
{"int32",		IPQOS_DATA_TYPE_INT32},
{"uint32",		IPQOS_DATA_TYPE_UINT32},
{"boolean",		IPQOS_DATA_TYPE_BOOLEAN},
{"string",		IPQOS_DATA_TYPE_STRING},
{"action",		IPQOS_DATA_TYPE_ACTION},
{"address",		IPQOS_DATA_TYPE_ADDRESS},
{"port",		IPQOS_DATA_TYPE_PORT},
{"protocol",		IPQOS_DATA_TYPE_PROTO},
{"enum",		IPQOS_DATA_TYPE_ENUM},
{"ifname",		IPQOS_DATA_TYPE_IFNAME},
{"mindex",		IPQOS_DATA_TYPE_M_INDEX},
{"int_array",		IPQOS_DATA_TYPE_INT_ARRAY},
{"user",		IPQOS_DATA_TYPE_USER},
{"",			0}
};

/* table of name to id mappings for originator field */

static str_val_t originators[] = {
{IPP_CONFIG_NAME_PERMANENT,	IPP_CONFIG_PERMANENT},
{IPP_CONFIG_NAME_IPQOSCONF,	IPP_CONFIG_IPQOSCONF},
{IPP_CONFIG_NAME_FTPCL,		IPP_CONFIG_FTPCL},
{"", -1}
};

/* current parse line */
static int lineno;

/* verbose output flag */
static int verbose;

/* use syslog for msg reporting flag */
static int use_syslog;

#ifdef	_IPQOS_CONF_DEBUG
/*
 * flag used to indicate that a rollback should be carried out regardless.
 * Only settable during debug.
 */
static int force_rback = 0;
#endif	/* _IPQOS_CONF_DEBUG */

/*
 * delivers messages to either syslog or stderr, dependant upon the
 * the state of the flags use_syslog and verbose. The type
 * of the msg as given in msg_type is indicated in the output msg.
 *
 * valid message types are:
 * o  MT_ERROR (standard error message)
 * o  MT_ENOSTR (error message with system error string appended)
 * o  MT_WARNING (warning message)
 * o  MT_LOG (logging message)
 *
 * Log messages only go to syslog. Warning messages only go to stderr
 * and only when the verbose flag is set. All other messages go by default
 * to the console; to syslog if syslog flag set, and to both if both
 * syslog and verbose are set.
 *
 */
/*PRINTFLIKE2*/
static void
ipqos_msg(enum msg_type msgt, char *format, ...)
{
	va_list ap;
	char str_buf[IPQOS_MSG_BUF_SZ];
	char fmt_buf[IPQOS_MSG_BUF_SZ];
	char *cp;

	IPQOSCDBG0(L1, "In ipqos_msg:\n");

	va_start(ap, format);

	/*
	 * send msgs to syslog if use_syslog set (except warning msgs),
	 * or a log msg.
	 */
	if ((use_syslog && (msgt != MT_WARNING)) || msgt == MT_LOG) {

		/* fill in format string */
		(void) vsnprintf(str_buf, IPQOS_MSG_BUF_SZ, format, ap);

		/*
		 * print message to syslog with appropriate severity
		 */
		if (msgt == MT_ERROR) {
			syslog(LOG_ERR, str_buf);
		} else if (msgt == MT_LOG) {
			syslog(LOG_INFO, str_buf);
		/*
		 * for errno message type suffix with %m for syslog to
		 * interpret.
		 */
		} else if (msgt == MT_ENOSTR) {
			/*
			 * remove any newline in message parameter.
			 * syslog will reapply a newline for us later.
			 */
			if ((cp = strchr(str_buf, '\n')) != NULL)
				*cp = '\0';
			(void) strlcat(str_buf, ": %m", IPQOS_MSG_BUF_SZ);
			syslog(LOG_ERR, str_buf);
		}
	}

	/*
	 * send msgs to stderr if use_syslog not set (except log msgs), or
	 * if verbose set.
	 */
	if ((!use_syslog && (msgt != MT_LOG)) || (verbose)) {

		/*
		 * prefix message with appropriate severity string
		 */
		if (msgt == MT_ERROR) {
			(void) strlcpy(fmt_buf, gettext("Error: "),
			    IPQOS_MSG_BUF_SZ);
		} else if (msgt == MT_WARNING) {
			if (!verbose) { /* don't show warn msg if !verbose */
				va_end(ap);
				return;
			}
			(void) strlcpy(fmt_buf, gettext("Warning: "),
			    IPQOS_MSG_BUF_SZ);
		} else if (msgt == MT_ENOSTR) {
			(void) strlcpy(fmt_buf, gettext("Error: "),
			    IPQOS_MSG_BUF_SZ);
		} else if (msgt == MT_LOG) {
			(void) strlcpy(fmt_buf, gettext("Notice: "),
			    IPQOS_MSG_BUF_SZ);
		}
		(void) strlcat(fmt_buf, format, IPQOS_MSG_BUF_SZ);

		/*
		 * for errno message type suffix message with errno string
		 */
		if (msgt == MT_ENOSTR) {
			/*
			 * get rid of any newline in passed message.
			 * we'll apply another later.
			 */
			if ((cp = strchr(fmt_buf, '\n')) != NULL)
				*cp = '\0';
			(void) strlcat(fmt_buf, ": ", IPQOS_MSG_BUF_SZ);
			(void) strlcat(fmt_buf, strerror(errno),
			    IPQOS_MSG_BUF_SZ);
		}

		/*
		 * append a newline to message if not one already.
		 */
		if ((cp = strchr(fmt_buf, '\n')) == NULL)
			(void) strlcat(fmt_buf, "\n", IPQOS_MSG_BUF_SZ);

		(void) vfprintf(stderr, fmt_buf, ap);
	}

	va_end(ap);
}

/* **************** kernel filter/class/params manipulation fns *********** */


/*
 * modify the kernel parameters of the action action_nm using the nvlist
 * parameter nvl and setting the stats according to stats_enable.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */

static int
modify_params(
char *action_name,
nvlist_t **nvl,
int module_version,
boolean_t stats_enable)
{

	int res;
	int created = 0;

	IPQOSCDBG1(APPLY, "In modify_params: action: %s\n", action_name);

	/* create nvlist if NULL */
	if (*nvl == NULL) {
		created++;
		res = nvlist_alloc(nvl, NV_UNIQUE_NAME, 0);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_alloc");
			return (IPQOS_CONF_ERR);
		}
	}

	/* add params modify config type */
	res = nvlist_add_byte(*nvl, IPP_CONFIG_TYPE, IPP_SET);
	if (res != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		goto fail;
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(*nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add stats_enable */
	res = nvlist_add_uint32(*nvl, IPP_ACTION_STATS_ENABLE,
	    (uint32_t)stats_enable);
	if (res != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add ipqosconf as originator */
	res = add_orig_ipqosconf(*nvl);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* call lib to do modify */
	res = ipp_action_modify(action_name, nvl, 0);
	if (res != 0) {

		/* invalid parameters */

		if (errno == EINVAL) {
			ipqos_msg(MT_ERROR,
			    gettext("Invalid parameters for action %s.\n"),
			    action_name);


		} else if (errno == ENOENT) {
			ipqos_msg(MT_ERROR,
			    gettext("Mandatory parameter missing for "
			    "action %s.\n"), action_name);


		} else {	/* unexpected error */
			ipqos_msg(MT_ERROR, gettext("Failed to modify action "
			    "%s parameters: %s.\n"), action_name,
			    strerror(errno));
		}

		goto fail;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	if (created && *nvl != NULL) {
		nvlist_free(*nvl);
		*nvl = NULL;
	}
	return (IPQOS_CONF_ERR);
}

/*
 * add a class to the kernel action action_name called class_name with
 * stats set according to stats_enable and the first action set to
 * first_action.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
add_class(
char *action_name,
char *class_name,
int module_version,
boolean_t stats_enable,
char *first_action)
{

	nvlist_t *nvl;

	IPQOSCDBG4(APPLY, "add_class: action: %s, class: %s, "
	    "first_action: %s, stats: %s\n", action_name, class_name,
	    first_action, (stats_enable == B_TRUE ? "true" : "false"));


	/* create nvlist */
	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_alloc");
		return (IPQOS_CONF_ERR);
	}

	/* add 'add class' config type */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE, CLASSIFIER_ADD_CLASS) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		goto fail;
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add class name */
	if (nvlist_add_string(nvl, CLASSIFIER_CLASS_NAME, class_name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		goto fail;
	}

	/* add next action */
	if (nvlist_add_string(nvl, CLASSIFIER_NEXT_ACTION, first_action) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		goto fail;
	}

	/* add stats_enable */
	if (nvlist_add_uint32(nvl, CLASSIFIER_CLASS_STATS_ENABLE,
	    (uint32_t)stats_enable) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add ipqosconf as originator */
	if (add_orig_ipqosconf(nvl) != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* call lib to do modify */
	if (ipp_action_modify(action_name, &nvl, 0) != 0) {

		/* ipgpc max classes */

		if (errno == ENOSPC &&
		    strcmp(action_name, IPGPC_CLASSIFY) == 0) {
			ipqos_msg(MT_ERROR,
			    gettext("Max number of classes reached in %s.\n"),
			    IPGPC_NAME);

		/* other errors */

		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Failed to create class %s in action "
			    "%s: %s.\n"), class_name, action_name,
			    strerror(errno));
		}

		goto fail;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	nvlist_free(nvl);
	return (IPQOS_CONF_ERR);
}


/*
 * modify the class in the kernel action action_name called class_name with
 * stats set according to stats_enable and the first action set to
 * first_action.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
modify_class(
char *action_name,
char *class_name,
int module_version,
boolean_t stats_enable,
char *first_action,
enum ipp_flags flags)
{

	nvlist_t *nvl;

	IPQOSCDBG5(APPLY, "modify_class: action: %s, class: %s, first: %s, "
	    "stats: %s, flags: %x\n", action_name, class_name, first_action,
	    stats_enable == B_TRUE ? "true" : "false", flags);


	/* create nvlist */
	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_alloc");
		return (IPQOS_CONF_ERR);
	}

	/* add 'modify class' config type */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE, CLASSIFIER_MODIFY_CLASS) !=
	    0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		goto fail;
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add class name */
	if (nvlist_add_string(nvl, CLASSIFIER_CLASS_NAME, class_name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		goto fail;
	}

	/* add next action */
	if (nvlist_add_string(nvl, CLASSIFIER_NEXT_ACTION, first_action) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		goto fail;
	}

	/* add stats enable */
	if (nvlist_add_uint32(nvl, CLASSIFIER_CLASS_STATS_ENABLE,
	    (uint32_t)stats_enable) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add originator ipqosconf */
	if (add_orig_ipqosconf(nvl) != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* call lib to do modify */
	if (ipp_action_modify(action_name, &nvl, flags) != 0) {

		/* generic error message */

		ipqos_msg(MT_ERROR,
		    gettext("Modifying class %s in action %s failed: %s.\n"),
		    class_name, action_name, strerror(errno));

		goto fail;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	nvlist_free(nvl);
	return (IPQOS_CONF_ERR);
}

/*
 * removes the class class_name from the kernel action action_name. The
 * flags argument can currently be set to IPP_ACTION_DESTROY which will
 * result in the action this class references being destroyed.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
remove_class(
char *action_name,
char *class_name,
int module_version,
enum ipp_flags flags)
{

	nvlist_t *nvl;

	IPQOSCDBG3(APPLY, "remove_class: action: %s, class: %s, "
	    "flags: %x\n", action_name, class_name, flags);

	/* allocate nvlist */
	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_alloc");
		return (IPQOS_CONF_ERR);
	}

	/* add 'remove class' config type */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE, CLASSIFIER_REMOVE_CLASS) !=
	    0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		goto fail;
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		goto fail;
	}

	/* add class name */
	if (nvlist_add_string(nvl, CLASSIFIER_CLASS_NAME, class_name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		goto fail;
	}

	if (ipp_action_modify(action_name, &nvl, flags) != 0) {

		/* generic error message */

		ipqos_msg(MT_ERROR,
		    gettext("Removing class %s in action %s failed: %s.\n"),
		    class_name, action_name, strerror(errno));

		goto fail;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	nvlist_free(nvl);
	return (IPQOS_CONF_ERR);
}

/*
 * add the filter flt to the kernel action named action_name.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
add_filter(
char *action_name,
ipqos_conf_filter_t *flt,
int module_version)
{

	nvlist_t *nvl = flt->nvlist;
	char ipvsbuf[IPQOS_INT_STR_LEN];

	IPQOSCDBG4(APPLY, "add_filter: action: %s, filter: %s, "
	    "instance: %d, class: %s\n", action_name, flt->name,
	    flt->instance, flt->class_name);


	/* add 'add filter' config type to filter nvlist */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE, CLASSIFIER_ADD_FILTER) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		return (IPQOS_CONF_ERR);
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		return (IPQOS_CONF_ERR);
	}

	/* add filter name to nvlist */
	if (nvlist_add_string(nvl, CLASSIFIER_FILTER_NAME, flt->name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		return (IPQOS_CONF_ERR);
	}

	/* add class name to nvlist */
	if (nvlist_add_string(nvl, CLASSIFIER_CLASS_NAME, flt->class_name) !=
	    0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		return (IPQOS_CONF_ERR);
	}

	/* add ipqosconf as originator to nvlist */
	if (add_orig_ipqosconf(nvl) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* add ipgpc specific nv entrys */
	if (strcmp(action_name, IPGPC_CLASSIFY) == 0) {

		/* add src and dst nodes to nvlist if present */

		if (flt->src_nd_name != NULL &&
		    nvlist_add_string(nvl, IPGPC_SADDR_HOSTNAME,
		    flt->src_nd_name) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_string");
			return (IPQOS_CONF_ERR);
		}
		if (flt->dst_nd_name != NULL &&
		    nvlist_add_string(nvl, IPGPC_DADDR_HOSTNAME,
		    flt->dst_nd_name) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_string");
			return (IPQOS_CONF_ERR);
		}

		/*
		 * add ip_version to private list element if present.
		 * NOTE: this value is of only real use to ipqosconf so
		 * it is placed in this opaque private field.
		 */
		if (flt->ip_versions != 0) {
			(void) sprintf(ipvsbuf, "%d", flt->ip_versions);
			if (nvlist_add_string(nvl, IPGPC_FILTER_PRIVATE,
			    ipvsbuf) != 0) {
				ipqos_msg(MT_ENOSTR, "nvlist_add_string");
				return (IPQOS_CONF_ERR);
			}
		}

		/* add filter instance if present */

		if (nvlist_add_int32(nvl, IPGPC_FILTER_INSTANCE,
		    flt->instance) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_int32");
			return (IPQOS_CONF_ERR);
		}
	}

	if (ipp_action_modify(action_name, &flt->nvlist, 0) != 0) {

		/* invalid parameters */

		if (errno == EINVAL) {
			ipqos_msg(MT_ERROR,
			    gettext("Invalid/missing parameters for filter "
			    "%s in action %s.\n"), flt->name, action_name);

		/* max ipgpc filters/classes */

		} else if (errno == ENOSPC &&
		    strcmp(action_name, IPGPC_CLASSIFY) == 0) {
			ipqos_msg(MT_ERROR, gettext("Max number of filters "
			    "reached in action %s.\n"), IPGPC_NAME);

		/* anything other errnos */
		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Failed to create filter %s in action "
			    "%s: %s.\n"), flt->name, action_name,
			    strerror(errno));
		}

		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * modify the filter flt in the kernel action named action_name.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
modify_filter(
char *action_name,
ipqos_conf_filter_t *flt,
int module_version)
{

	nvlist_t *nvl = flt->nvlist;
	char ipvsbuf[IPQOS_INT_STR_LEN];

	IPQOSCDBG4(APPLY, "modify_filter: action: %s, filter: %s, "
	    "instance: %d, class: %s\n", action_name, flt->name,
	    flt->instance, flt->class_name);

/* show src address and dst address if present */
#ifdef	_IPQOS_CONF_DEBUG
	if (ipqosconf_dbg_flgs & APPLY) {
		uint_t tmp;
		in6_addr_t *add;
		char st[100];

		if (nvlist_lookup_uint32_array(nvl, IPGPC_SADDR,
		    (uint32_t **)&add, &tmp) == 0) {
			(void) fprintf(stderr, "saddr: %s\n",
			    inet_ntop(AF_INET6, add, st, 100));
		}

		if (nvlist_lookup_uint32_array(nvl, IPGPC_DADDR,
		    (uint32_t **)&add, &tmp) == 0) {
			(void) fprintf(stderr, "daddr: %s\n",
			    inet_ntop(AF_INET6, add, st, 100));
		}
	}
#endif	/* _IPQOS_CONF_DEBUG */

	/* add 'modify filter' config type to filters nvlist */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE,
	    CLASSIFIER_MODIFY_FILTER) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		return (IPQOS_CONF_ERR);
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		return (IPQOS_CONF_ERR);
	}

	/* add filter name to nvlist */
	if (nvlist_add_string(nvl, CLASSIFIER_FILTER_NAME, flt->name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		return (IPQOS_CONF_ERR);
	}

	/* add class name to nvlist */
	if (nvlist_add_string(nvl, CLASSIFIER_CLASS_NAME, flt->class_name) !=
	    0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		return (IPQOS_CONF_ERR);
	}

	/* add originator ipqosconf to nvlist */
	if (add_orig_ipqosconf(nvl) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* add ipgpc specific nvpairs */
	if (strcmp(action_name, IPGPC_CLASSIFY) == 0) {

		/* add src and dst nodes to nvlist if present */

		if (flt->src_nd_name &&
		    nvlist_add_string(nvl, IPGPC_SADDR_HOSTNAME,
		    flt->src_nd_name) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_string");
			return (IPQOS_CONF_ERR);
		}
		if (flt->dst_nd_name &&
		    nvlist_add_string(nvl, IPGPC_DADDR_HOSTNAME,
		    flt->dst_nd_name) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_string");
			return (IPQOS_CONF_ERR);
		}

		/*
		 * add ip_version to private list element if present.
		 * NOTE: this value is of only real use to ipqosconf so
		 * it is placed in this opaque private field.
		 */
		if (flt->ip_versions != 0) {
			(void) sprintf(ipvsbuf, "%d", flt->ip_versions);
			if (nvlist_add_string(nvl, IPGPC_FILTER_PRIVATE,
			    ipvsbuf) != 0) {
				ipqos_msg(MT_ENOSTR, "nvlist_add_string");
				return (IPQOS_CONF_ERR);
			}
		}

		/* add filter instance if present */

		if (nvlist_add_int32(nvl, IPGPC_FILTER_INSTANCE,
		    flt->instance) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_int32");
			return (IPQOS_CONF_ERR);
		}
	}

	if (ipp_action_modify(action_name, &flt->nvlist, 0) != 0) {

		/* invalid parameters */

		if (errno == EINVAL) {
			ipqos_msg(MT_ERROR, gettext("Missing/Invalid "
			    "parameter for filter %s in action %s.\n"),
			    flt->name, action_name);

		/* any other errnos */

		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Failed to modify filter %s in action %s: "
			    "%s.\n"), flt->name, action_name, strerror(errno));
		}

		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * remove the filter named filter_name instance number instance from the
 * kernel action action_name.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
remove_filter(
char *action_name,
char *filter_name,
int instance,
int module_version)
{

	nvlist_t *nvl;

	IPQOSCDBG2(APPLY, "remove_filter: action: %s, filter: %s\n",
	    action_name, filter_name);

	/* create nvlist */
	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_alloc");
		return (IPQOS_CONF_ERR);
	}

	/* add 'remove filter' config type to list */
	if (nvlist_add_byte(nvl, IPP_CONFIG_TYPE, CLASSIFIER_REMOVE_FILTER)
	!= 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		return (IPQOS_CONF_ERR);
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(nvl, IPP_MODULE_VERSION,
	    (uint32_t)module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		return (IPQOS_CONF_ERR);
	}

	/* add filter name to list */
	if (nvlist_add_string(nvl, CLASSIFIER_FILTER_NAME, filter_name) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_string");
		return (IPQOS_CONF_ERR);
	}

	/* add instance number if part of multi-instance filter */
	if (instance != -1 && nvlist_add_int32(nvl, IPGPC_FILTER_INSTANCE,
	    instance) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_int32");
		return (IPQOS_CONF_ERR);
	}

	/* call into lib to remove */
	if (ipp_action_modify(action_name, &nvl, 0) != 0) {

		/* generic error message */

		ipqos_msg(MT_ERROR,
		    gettext("Removing filter %s in action %s failed: %s.\n"),
		    filter_name, action_name, strerror(errno));

		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/* ******************************************************************* */


/*
 * add originator nvpair set to ipqosconf to nvl.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
add_orig_ipqosconf(nvlist_t *nvl)
{

	if (nvlist_add_uint32(nvl, IPP_CONFIG_ORIGINATOR,
	    IPP_CONFIG_IPQOSCONF) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32: originator:");
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/* ************************* differencing functions ************************ */


/*
 * compares the contents of arrays array1 and array2, both of size size, and
 * returns B_TRUE or B_FALSE if they're equal or not respectively.
 * RETURNS: B_TRUE if equal, else B_FALSE.
 */
static boolean_t
arrays_equal(
int array1[],
int array2[],
uint32_t size)
{
	int x;

	for (x = 0; x < size; x++) {
		if (array1[x] != array2[x])
			return (B_FALSE);
	}
	return (B_TRUE);
}

/*
 * difference class old against class new. It marks the new class as
 * modified if it is different.
 * RETURNS: IPQOS_CONF_SUCCESS.
 */
static int
diffclass(
ipqos_conf_class_t *old,
ipqos_conf_class_t *new)
{

	IPQOSCDBG0(L0, "In diffclass:\n");

	/* two different spec'd actions */
	if (strcmp(old->alist->name, new->alist->name) != 0) {
		IPQOSCDBG1(DIFF, "marking class %s as modified\n", new->name);

		new->modified = B_TRUE;
		return (IPQOS_CONF_SUCCESS);
	}

	/* different stats values */
	if (old->stats_enable != new->stats_enable) {
		IPQOSCDBG1(DIFF, "marking class %s as modified\n", new->name);

		new->modified = B_TRUE;
		return (IPQOS_CONF_SUCCESS);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * difference params set old against params set new of module module_name. It
 * marks the new params as modified if different.
 * RETURNS: if error IPQOS_CONF_ERR, else IPQOS_CONF_SUCCESS.
 */
static int
diffparams(
ipqos_conf_params_t *old,
ipqos_conf_params_t *new,
char *module_name)
{

	int diff;
	int res;

	IPQOSCDBG0(L0, "In diffparams\n");

	/* diff stats */
	if (old->stats_enable != new->stats_enable) {

		new->modified = B_TRUE;
		return (IPQOS_CONF_SUCCESS);
	}

	/* diff module specific params */
	res = diffnvlists(old->nvlist, new->nvlist, module_name, &diff,
	    PL_PARAMS);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}
	if (diff) {

		new->modified = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * differences filter old against filter new of module module_name. It marks
 * filter new as different if so.
 * RETURNS: if error IPQOS_CONF_ERR, else IPQOS_CONF_SUCCESS.
 */
static int
difffilter(
ipqos_conf_filter_t *old,
ipqos_conf_filter_t *new,
char *module_name)
{

	int res;
	int diff;

	IPQOSCDBG0(L0, "In difffilter\n");

	/* compare class name */

	if (strcmp(old->class_name, new->class_name) != 0) {
		IPQOSCDBG1(DIFF, "Marking filter %s as modified\n", new->name);

		new->modified = B_TRUE;
		return (IPQOS_CONF_SUCCESS);
	}

	/* compare module specific params */

	res = diffnvlists(old->nvlist, new->nvlist, module_name, &diff,
	    PL_FILTER);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	if (diff) {
		IPQOSCDBG1(DIFF, "Marking filter %s as modified\n", new->name);
		new->modified = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * mark all the filters and classes in parameter action either
 * for deletion (if they are ipqosconf originated) or for modification.
 */
static void
mark_classes_filters_del(ipqos_conf_action_t *action)
{

	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;

	IPQOSCDBG1(L1, "In mark_classes_filters_del: action: %s\n",
	    action->name);

	/* mark all non-permanent filters for del and permanent to modify */
	for (flt = action->filters; flt; flt = flt->next) {
		if (flt->originator == IPP_CONFIG_PERMANENT) {
			IPQOSCDBG1(DIFF, "Marking prm filter %s as modified.\n",
			    flt->name);

			flt->modified = B_TRUE;
		} else {
			IPQOSCDBG1(DIFF, "Marking filter %s as del.\n",
			    flt->name);

			flt->todel = B_TRUE;
		}
	}

	/* mark all non-permanent classes for del and permanent to modify */
	for (cls = action->classes; cls; cls = cls->next) {
		if (cls->originator == IPP_CONFIG_PERMANENT) {
			IPQOSCDBG1(DIFF, "Marking prm class %s as modified.\n",
			    cls->name);

			cls->modified = B_TRUE;
		} else {
			IPQOSCDBG1(DIFF, "Marking class %s as del.\n",
			    cls->name);

			cls->todel = B_TRUE;
		}
	}
}

/*
 * mark all classes and filters either new (non-permanent) or modified.
 */
static void
mark_classes_filters_new(ipqos_conf_action_t *action)
{

	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;

	IPQOSCDBG1(L1, "In mark_classes_filters_new: action: %s\n",
	    action->name);

	/* mark all permanent filters as modified and all others new */

	for (flt = action->filters; flt; flt = flt->next) {
		if (flt->originator == IPP_CONFIG_PERMANENT) {
			IPQOSCDBG1(DIFF, "Marking prm filter %s as modified.\n",
			    flt->name);

			flt->modified = B_TRUE;
			action->modified = B_TRUE;
		} else {
			IPQOSCDBG1(DIFF, "Marking filter %s as new.\n",
			    flt->name);

			flt->new = B_TRUE;
		}
	}

	/* mark all permanent classes as modified and all others new */
	for (cls = action->classes; cls; cls = cls->next) {
		if (cls->originator == IPP_CONFIG_PERMANENT) {
			IPQOSCDBG1(DIFF, "Marking prm class %s as modified.\n",
			    cls->name);

			cls->modified = B_TRUE;
			action->modified = B_TRUE;
		} else {
			IPQOSCDBG1(DIFF, "Marking class %s as new.\n",
			    cls->name);

			cls->new = B_TRUE;
		}
	}
}

/*
 * Marks all the actions and their constituent elements in conf
 * as new.
 */
static void
mark_config_new(
ipqos_conf_action_t *conf)
{
	while (conf != NULL) {
		IPQOSCDBG1(DIFF, "Marking action %s as new\n", conf->name);
		mark_classes_filters_new(conf);
		conf->new = B_TRUE;
		conf->visited = 0;
		conf = conf->next;
	}
}

/*
 * differences the configuration  in new against old marking the actions
 * and their contents appropriately.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
diffconf(
ipqos_conf_action_t *old,
ipqos_conf_action_t *new)
{

	int res;
	ipqos_conf_action_t *act;
	ipqos_conf_action_t *tmp;

	IPQOSCDBG0((L0 | DIFF), "In diffconf\n");

	/* check the new actions against the old */

	for (act = new; act; act = act->next) {

		/* if action not in old mark it and it's contents as new */

		if ((tmp = actionexist(act->name, old)) == NULL) {
			IPQOSCDBG1(DIFF, "marking act %s as new\n", act->name);

			act->new = B_TRUE;
			mark_classes_filters_new(act);
			continue;
		}

		/* if action in old diff old against new */

		res = diffaction(tmp, act);
		if (res != IPQOS_CONF_SUCCESS) {
			return (res);
		}
	}

	/*
	 * mark actions, and their contents, in old but not new that were
	 * created by us for del.
	 */

	for (act = old; act; act = act->next) {
		if (act->params->originator == IPP_CONFIG_IPQOSCONF &&
		    actionexist(act->name, new) == NULL) {
			IPQOSCDBG1(DIFF, "marking act %s for del\n", act->name);

			act->todel = B_TRUE;
			mark_classes_filters_del(act);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * differences action old against action new, comparing its classes, filters
 * and parameters. If it is different the new action is marked as modified
 * and it's different sub-objects are also marked approriately.
 * RETURNS: IPQOS_CONF_ERR if error, else IPQOS_CONF_SUCCESS.
 */
static int
diffaction(
ipqos_conf_action_t *old,
ipqos_conf_action_t *new)
{

	int res;

	IPQOSCDBG0(L0, "In diffaction\n");

	/* compare and mark classes */
	res = diffclasses(old, new);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* compare and mark filters */
	res = difffilters(old, new);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* compare and mark parameters */
	res = diffparams(old->params, new->params, old->module);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* mark action as modified if params are */
	if (new->params->modified == B_TRUE) {
		IPQOSCDBG1(DIFF, "Marking params for action %s modified\n",
		    new->name);

		new->modified = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * differences the set of classes in new against those in old, marking any
 * that are new/modified, approriately in the new class, and any removed
 * in the old class appropriately. Also marks the action which has had an
 * object within marked, as modified.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */

static int
diffclasses(
ipqos_conf_action_t *old,
ipqos_conf_action_t *new)
{


	ipqos_conf_class_t *cls;
	ipqos_conf_class_t *tmpc;
	ipqos_conf_class_t *ncls;
	int res;


	/* loop through old classes checking for classes not present in new */

	for (cls = old->classes; cls; cls = cls->next) {

		if (classexist(cls->name, new->classes) == NULL) {

			/* if we created original class mark for deletion */

			if (cls->originator == IPP_CONFIG_IPQOSCONF) {
				IPQOSCDBG1(DIFF, "marking class %s for del\n",
				    cls->name);

				cls->todel = B_TRUE;

				/* mark old action */
				old->modified = B_TRUE;

			/*
			 * if permanent class and next action created by us
			 * copy it, set it's next action to continue and
			 * add it to new action. This will cause the class
			 * to be marked as and modified. This returns the class
			 * to an assumed default state and prevents the
			 * case where the class is pointing at an action
			 * we want to remove and therefore couldn't without
			 * this forced modify.
			 */
			} else if (cls->originator == IPP_CONFIG_PERMANENT &&
			    cls->alist->action &&	/* not virtual action */
			    cls->alist->action->params->originator ==
			    IPP_CONFIG_IPQOSCONF) {

				/* copy class */

				res = dup_class(cls, &ncls);
				if (res != IPQOS_CONF_SUCCESS) {
					return (IPQOS_CONF_ERR);
				}

				/* set next action to continue */

				(void) strcpy(ncls->alist->name,
				    IPP_ANAME_CONT);

				/* add to news classes to be diffed below */
				ADD_TO_LIST(&new->classes, ncls);
			}
		}
	}

	/* loop through new classes checking for new / modified classes */

	for (cls = new->classes; cls; cls = cls->next) {

		/* new ipqosconf class */

		if ((tmpc = classexist(cls->name, old->classes)) == NULL ||
		    (tmpc->originator != IPP_CONFIG_IPQOSCONF &&
		    tmpc->originator != IPP_CONFIG_PERMANENT)) {
			IPQOSCDBG1(DIFF, "marking class %s new\n",
			    cls->name);

			cls->new = B_TRUE;

			new->modified = B_TRUE;	/* mark new action */
			continue;

		/* existing ipqosconf/perm class */
		} else {
			res = diffclass(tmpc, cls);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}

			if (cls->modified == B_TRUE) {
				new->modified = B_TRUE;
			}
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * differences the set of filters in new against those in old, marking any
 * that are new/modified, approriately in the new filter/s, and any removed
 * in the old filter appropriately. Also marks the action which has had an
 * object within marked, as modified.
 * RETURNS: IPQOS_CONF_SUCCESS (we return an int for symmetry with diffclasses
 * and difffparams).
 */
static int
difffilters(
ipqos_conf_action_t *old,
ipqos_conf_action_t *new)
{

	ipqos_conf_filter_t *flt;
	ipqos_conf_filter_t *tmpf;
	int maxi;
	int newi;
	int res;

	/* check for new/modified filters */

	for (flt = new->filters; flt; flt = flt->next) {

		/* new ipqosconf filter */

		if ((tmpf = filterexist(flt->name, -1, old->filters)) == NULL) {

			/* mark all instances of this filter as new */
			for (;;) {
				IPQOSCDBG1(DIFF, "Marking filter %s as "
				    "new\n", flt->name);

				flt->new = B_TRUE;


				if (flt->next == NULL ||
				    strcmp(flt->next->name, flt->name) != 0) {
					break;
				}
				flt = flt->next;
			}
			new->modified = B_TRUE;	/* mark new action */

		/* ipqosconf/permanent filter existed */
		} else {
			/*
			 * if ip node name force filter refresh - ie. mark
			 * all old filter instances as todel and all new new.
			 */
			if (tmpf->src_nd_name || tmpf->dst_nd_name ||
			    flt->src_nd_name || flt->dst_nd_name) {

				/* init max previous filter instance */
				maxi = tmpf->instance;

				/* mark old instances for deletion */
				do {
					IPQOSCDBG2(DIFF, "Marking filter "
					    "%s, instance %d for del\n",
					    tmpf->name, tmpf->instance);

					tmpf->todel = B_TRUE;

					/*
					 * check and update previous instance
					 * max.
					 */
					if (tmpf->instance > maxi) {
						maxi = tmpf->instance;
					}

					tmpf = tmpf->next;
				} while (tmpf != NULL &&
					strcmp(tmpf->name, flt->name) == 0);

				/*
				 * use the max previous instance + 1 for
				 * the start of the new instance numbers.
				 */
				newi = (uint32_t)++maxi % INT_MAX;

				/*
				 * mark new instances for addition and
				 * give new instance number.
				 */
				for (;;) {
					IPQOSCDBG2(DIFF, "Marking filter "
					    "%s, instance %d as new\n",
					    flt->name, newi);

					flt->new = B_TRUE;
					flt->instance = newi++;
					if (flt->next == NULL ||
					    strcmp(flt->next->name,
					    flt->name) != 0) {
						break;
					}
					flt = flt->next;
				}
				new->modified = B_TRUE; /* mark new action */

				/* mark old action */
				old->modified = B_TRUE;

			/* non-node name filter */
			} else {
				/* compare and mark as modified if diff */

				res = difffilter(tmpf, flt, new->module);
				if (res != IPQOS_CONF_SUCCESS) {
					return (res);
				}
				if (flt->modified == B_TRUE) {
					/* mark action if diff */
					new->modified = B_TRUE;
				}
			}
		}
	}

	/*
	 * Check for deleted ipqosconf created filters and mark
	 * any found for deletion.
	 * For non-ipqosconf generated filters, including permanent
	 * ones (none of these exist at the moment) we just leave
	 * the filter unmarked.
	 */
	for (flt = old->filters; flt; flt = flt->next) {

		if (flt->originator == IPP_CONFIG_IPQOSCONF &&
		    filterexist(flt->name, -1, new->filters) == NULL) {

			/* mark all old instances for deletions */
			for (;;) {
				IPQOSCDBG2(DIFF, "marking flt %s, inst %d "
				    "for del\n", flt->name, flt->instance);

				flt->todel = B_TRUE;
				old->modified = B_TRUE; /* mark old action */

				if (flt->next == NULL ||
				    strcmp(flt->next->name, flt->name) != 0) {
					break;
				}
				flt = flt->next;
			}
		}
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * differences the elements of nvlists old and new using the types file
 * for module name to interpret the element types. It sets pdiff to either
 * 0 or 1 if they are the same or different respectively.
 * RETURNS: IPQOS_CONF_ERR if any errors, else IPQOS_CONF_SUCCESS.
 */
static int
diffnvlists(
nvlist_t *old,
nvlist_t *new,
char *module_name,
int *pdiff,
place_t place)
{

	int first_pass = 1;
	nvlist_t *tmp;
	int res;
	nvpair_t *nvp;
	FILE *tfp;
	str_val_nd_t *enum_nvs;
	char dfltst[IPQOS_VALST_MAXLEN+1] = "";
	char *lo;
	ipqos_nvtype_t type;
	char *nme;
	int diff;
	int openerr;


	IPQOSCDBG0(L0, "In diffnvlists\n");

	/* open stream to types file */

	tfp = validmod(module_name, &openerr);
	if (tfp == NULL) {
		if (openerr) {
			ipqos_msg(MT_ENOSTR, "fopen");
		}
		return (IPQOS_CONF_ERR);
	}
start:
	/*
	 * loop through each of the elements of the new list comparing
	 * it with the old one if present. If the old one isn't present
	 * then it is compared with the default value for that type (if
	 * set). Any time the values are determined to be different
	 * or the default value is to be used but isn't present the diff
	 * param is set to 1 and we return.
	 *
	 * If the loop runs its course then the new and old nvlists are
	 * reversed and the loop is entered for a second time.
	 */
	nvp = nvlist_next_nvpair(new, NULL);
	while (nvp != NULL) {

		/* get name */
		nme = nvpair_name(nvp);

		/*
		 * get type.
		 */
		place = PL_ANY;
		res = readtype(tfp, module_name, SHORT_NAME(nme), &type,
		    &enum_nvs, dfltst, B_TRUE, &place);
		if (res != IPQOS_CONF_SUCCESS) {
			return (res);
		}

		/* init diff to 1 */
		diff = 1;

		switch (type) {

		/* interface name */
		case IPQOS_DATA_TYPE_IFINDEX: {
			uint32_t ifidx;
			uint32_t oifidx;

			/* get new value */
			(void) nvpair_value_uint32(nvp, &ifidx);

			/* compare against old if present */

			res = nvlist_lookup_uint32(old, nme, &oifidx);
			if (res == 0) {
				/* diff values */
				diff = (ifidx != oifidx);

			/* not in old so see if new value is default */

			} else {
				diff = (ifidx != 0);
			}
			break;
		}
		/* protocol */
		case IPQOS_DATA_TYPE_PROTO: {
			uchar_t proto;
			uchar_t oproto;

			(void) nvpair_value_byte(nvp, &proto);

			res = nvlist_lookup_byte(old, nme, &oproto);
			if (res == 0) {
				diff = (proto != oproto);
			} else {
				diff = (proto != 0);
			}
			break;
		}
		/* port */
		case IPQOS_DATA_TYPE_PORT: {
			uint16_t port;
			uint16_t oport;

			(void) nvpair_value_uint16(nvp, &port);
			res = nvlist_lookup_uint16(old, nme, &oport);
			if (res == 0) {
				diff = (port != oport);
			} else {
				diff = (port != 0);
			}
			break;
		}
		/* action name / string */
		case IPQOS_DATA_TYPE_ACTION:
		case IPQOS_DATA_TYPE_STRING: {
			char *str;
			char *ostr;

			(void) nvpair_value_string(nvp, &str);
			res = nvlist_lookup_string(old, nme, &ostr);
			if (res == 0) {
				diff = strcmp(str, ostr);
			} else if (*dfltst) {
				diff = strcmp(str, dfltst);
			}
			break;
		}
		/* address mask / address */
		case IPQOS_DATA_TYPE_ADDRESS_MASK:
		case IPQOS_DATA_TYPE_ADDRESS: {
			in6_addr_t *in6;
			in6_addr_t *oin6;
			uint_t x;

			/*
			 * all addresses are stored as v6 addresses, so
			 * a uint32_t[4] array is used.
			 */

			/* lookup new value */

			(void) nvpair_value_uint32_array(nvp,
			    (uint32_t **)&in6, &x);

			/* see if there's an old value and diff it */

			res = nvlist_lookup_uint32_array(old, nme,
			    (uint32_t **)&oin6, &x);
			if (res == 0) {
				/* diff each of the 16 v6 address bytes */

				for (x = 0; x < 16; x++) {
					if (in6->s6_addr[x] !=
					    oin6->s6_addr[x]) {
						diff++;
						break;
					}
				}
			}
			break;
		}
		/* boolean */
		case IPQOS_DATA_TYPE_BOOLEAN: {
			boolean_t bl;
			boolean_t obl;

			(void) nvpair_value_uint32(nvp, (uint32_t *)&bl);

			/* see if there's an old value and diff it */
			res = nvlist_lookup_uint32(old, nme, (uint32_t *)&obl);
			if (res == 0) {
				diff = (bl != obl);

			/* compare against default if present */
			} else if (*dfltst) {
				res = readbool(dfltst, &obl);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (bl != obl);
				}
			}
			break;
		}
		/* uint 8 */
		case IPQOS_DATA_TYPE_UINT8: {
			uint8_t u8;
			uint8_t ou8;

			(void) nvpair_value_byte(nvp, (uchar_t *)&u8);
			res = nvlist_lookup_byte(old, nme, (uchar_t *)&ou8);
			if (res == 0) {
				diff = (u8 != ou8);
			} else if (*dfltst) {
				res = readuint8(dfltst, &ou8, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (u8 != ou8);
				}
			}
			break;
		}
		/* int 16 */
		case IPQOS_DATA_TYPE_INT16: {
			int16_t i16;
			int16_t oi16;

			(void) nvpair_value_int16(nvp, &i16);
			res = nvlist_lookup_int16(old, nme, &oi16);
			if (res == 0) {
				diff = (i16 != oi16);
			} else if (*dfltst) {
				res = readint16(dfltst, &oi16, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (i16 != oi16);
				}
			}
			break;
		}
		/* uint16 */
		case IPQOS_DATA_TYPE_UINT16: {
			uint16_t ui16;
			uint16_t oui16;

			(void) nvpair_value_uint16(nvp, &ui16);
			res = nvlist_lookup_uint16(old, nme, &oui16);
			if (res == 0) {
				diff = (ui16 != oui16);
			} else if (*dfltst) {
				res = readuint16(dfltst, &oui16, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (ui16 != oui16);
				}
			}
			break;
		}
		/*
		 * int32 and user.
		 * Since user uids are stored in an int32 nvpair we can use
		 * the same comparison code.
		 */
		case IPQOS_DATA_TYPE_USER:
		case IPQOS_DATA_TYPE_INT32: {
			int32_t i32;
			int32_t oi32;

			(void) nvpair_value_int32(nvp, &i32);
			res = nvlist_lookup_int32(old, nme, &oi32);
			if (res == 0) {
				diff = (i32 != oi32);
			} else if (*dfltst) {
				res = readint32(dfltst, &oi32, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (i32 != oi32);
				}
			}
			break;
		}
		/* uint32 */
		case IPQOS_DATA_TYPE_UINT32: {
			uint32_t ui32;
			uint32_t oui32;

			(void) nvpair_value_uint32(nvp, &ui32);
			res = nvlist_lookup_uint32(old, nme, &oui32);
			if (res == 0) {
				diff = (ui32 != oui32);
			} else if (*dfltst) {
				res = readuint32(dfltst, &oui32, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (ui32 != oui32);
				}
			}
			break;
		}
		/* enumeration */
		case IPQOS_DATA_TYPE_ENUM: {
			uint32_t eval;
			uint32_t oeval;

			(void) nvpair_value_uint32(nvp, &eval);
			res = nvlist_lookup_uint32(old, nme, &oeval);
			if (res == 0) {
				diff = (eval != oeval);
			} else if (*dfltst) {
				res = readuint32(dfltst, &oeval, &lo);
				if (res == IPQOS_CONF_SUCCESS) {
					diff = (eval != oeval);
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_M_INDEX: {
			uint8_t idx, oidx;

			(void) nvpair_value_byte(nvp, &idx);
			res = nvlist_lookup_byte(old, nme, &oidx);
			if (res == 0)
				diff = (idx != oidx);
			break;
		}
		case IPQOS_DATA_TYPE_INT_ARRAY: {
			int *oarr, *arr;
			uint32_t osize, size;

			(void) nvpair_value_int32_array(nvp, &arr, &size);
			res = nvlist_lookup_int32_array(old, nme, &oarr,
			    &osize);
			if (res == 0)
				diff = (arrays_equal(arr, oarr, size) ==
				    B_FALSE);
			break;
		}
#ifdef	_IPQOS_CONF_DEBUG
		default: {
			/* shouldn't get here as all types should be covered */
			assert(1);
		}
#endif
		}	/* switch */
		if (diff != 0) {
			IPQOSCDBG1(DIFF, "parameter %s different\n", nme);
			*pdiff = 1;
			(void) fclose(tfp);
			return (IPQOS_CONF_SUCCESS);
		}


		nvp = nvlist_next_nvpair(new, nvp);

	}

	/* now compare all the stuff in the second list with the first */
	if (first_pass) {
		tmp = old;
		old = new;
		new = tmp;
		first_pass = 0;
		goto start;
	}

	(void) fclose(tfp);

	*pdiff = 0;
	return (IPQOS_CONF_SUCCESS);
}



/* ************************** difference application *********************** */



/*
 * causes all items marked as requiring change in actions and old_actions
 * to have the change applied.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
applydiff(
ipqos_conf_action_t *actions,
ipqos_conf_action_t *old_actions)
{

	int res;

	IPQOSCDBG0(L1, "In applydiff:\n");


	/* add each item marked as new */

	res = add_items(actions, B_FALSE);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* modify items marked for modification */

	res = modify_items(actions);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* delete items marked for deletion */

	res = remove_items(old_actions, B_FALSE);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	return (IPQOS_CONF_SUCCESS);
}

static int
add_items(
ipqos_conf_action_t *actions,
boolean_t rem_undo)
{

	int res;
	ipqos_conf_action_t *act;

	IPQOSCDBG1(L1, "In add_items, rem_undo: %u\n", rem_undo);

	/*
	 * we need to create ipgpc action before any others as some actions
	 * such as ftpcl which make calls to it depend on it being there on
	 * their creation.
	 */
	act = actionexist(IPGPC_CLASSIFY, actions);
	if (act &&
	    (rem_undo == B_FALSE && act->new == B_TRUE ||
	    rem_undo == B_TRUE && act->deleted == B_TRUE)) {

		res = add_action(act);
		if (res != IPQOS_CONF_SUCCESS) {
			return (res);
		}
	}

	/*
	 * loop though action list and add any actions marked as
	 * new/modified action and apply any additions there, then return.
	 */

	for (act = actions; act; act = act->next) {
		res = add_item(act, rem_undo);
		if (res != IPQOS_CONF_SUCCESS) {
			return (IPQOS_CONF_ERR);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 *
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
add_item(
ipqos_conf_action_t *actions,
boolean_t rem_undo)
{

	ipqos_conf_action_t *act = actions;
	int res;
	ipqos_conf_class_t *cls;
	ipqos_conf_act_ref_t *pact;

	IPQOSCDBG2(L1, "In add_item: action: %s, rem_undo: %u\n",
	    actions->name, rem_undo);

	/* if already visited return immediately */

	if (act->visited == ADD_VISITED) {
		IPQOSCDBG0(L1, "Early exit due to visited\n");
		return (IPQOS_CONF_SUCCESS);
	}
	act->visited = ADD_VISITED;


	/* recurse to last action in tree */

	for (cls = act->classes; cls; cls = cls->next) {

		/* if not virtual action */

		if (cls->alist->action) {
			res = add_item(cls->alist->action, rem_undo);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}
		}
	}

	for (pact = act->params->actions; pact; pact = pact->next) {

		/* if not virtual */

		if (pact->action) {
			res = add_item(pact->action, rem_undo);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}
		}
	}


	/* if action marked as new and not ipgpc, create */

	if (((rem_undo == B_FALSE && act->new == B_TRUE) ||
	    (rem_undo == B_TRUE && act->deleted == B_TRUE)) &&
	    strcmp(act->name, IPGPC_CLASSIFY) != 0) {
		res = add_action(act);
		if (res != IPQOS_CONF_SUCCESS) {
			return (res);
		}
	}

	/* add any classes and filters marked as new */

	if (add_classes(act->classes, act->name, act->module_version,
	    rem_undo) != IPQOS_CONF_SUCCESS ||
	    add_filters(act->filters, act->name, act->module_version,
	    rem_undo) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * Uses the contents of acts params nvlist and adds an originator
 * element set to ipqosconf and the stats parameter. This list
 * is then used as the parameter to a call to ipp_action_create to create
 * this action in the kernel.
 * RETURNS: IPQOS_CONF_ERR on err, else IPQOS_CONF_SUCCESS.
 */
static int
add_action(ipqos_conf_action_t *act)
{

	int res;
	nvlist_t **nvl;

	IPQOSCDBG2(APPLY, "add_action: action: %s, module: %s\n", act->name,
	    act->module);

	nvl = &act->params->nvlist;

	/* alloc params nvlist if not already one */

	if (*nvl == NULL) {
		res = nvlist_alloc(nvl, NV_UNIQUE_NAME, 0);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_alloc");
			return (IPQOS_CONF_ERR);
		}
	}

	/*
	 * add module version
	 */
	if (nvlist_add_uint32(*nvl, IPP_MODULE_VERSION,
	    (uint32_t)act->module_version) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32");
		return (IPQOS_CONF_ERR);
	}

	/* add action stats */

	if (nvlist_add_uint32(*nvl, IPP_ACTION_STATS_ENABLE,
	    (uint32_t)act->params->stats_enable) != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_uint32: action stats");
		return (IPQOS_CONF_ERR);
	}

	/* add ipqosconf originator id */

	if (add_orig_ipqosconf(*nvl) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* call into lib to create action */

	res = ipp_action_create(act->module, act->name, nvl, 0);
	if (res != 0) {
		IPQOSCDBG2(APPLY, "Create action %s, module %s failed\n",
		    act->name, act->module);

		/* invalid params */

		if (errno == EINVAL) {
			ipqos_msg(MT_ERROR,
			    gettext("Invalid Parameters for action %s.\n"),
			    act->name);

		} else if (errno == ENOENT) {
			ipqos_msg(MT_ERROR,
			    gettext("Missing required parameter for action "
			    "%s.\n"), act->name);

		} else {	/* unexpected error */
			ipqos_msg(MT_ERROR, gettext("Failed to create action "
			    "%s: %s.\n"), act->name, strerror(errno));
		}

		return (IPQOS_CONF_ERR);
	}

	/* mark action as created */
	act->cr_mod = B_TRUE;

	return (IPQOS_CONF_SUCCESS);
}

/*
 * for each of the filters in parameter filters if rem_undo is false and
 * the filter is marked as new or if rem_undo is true and the filter is
 * marked as deleted then add the filter to the kernel action named by action
 * and if successful mark as created.
 * RETURNS: IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
static int
add_filters(
ipqos_conf_filter_t *filters,
char *action,
int module_version,
boolean_t rem_undo)
{

	ipqos_conf_filter_t *flt;

	IPQOSCDBG0(L1, "In add_filters\n");

	/* loop through filters in filters param */
	for (flt = filters; flt; flt = flt->next) {
		/*
		 * skip filter if in normal mode and not new filter or
		 * if doing rollback and filter wasn't previously deleted.
		 */
		if ((rem_undo == B_FALSE && flt->new == B_FALSE) ||
		    (rem_undo == B_TRUE && flt->deleted == B_FALSE)) {
			continue;
		}

		/* add filter to action */
		if (add_filter(action, flt, module_version) !=
		    IPQOS_CONF_SUCCESS) {
			return (IPQOS_CONF_ERR);
		}

		/* mark as created */
		flt->cr_mod = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * for each of the classes in parameter classes if rem_undo is false and
 * the class is marked as new or if rem_undo is true and the class is
 * marked as deleted then add the class to the kernel action named by action
 * and if successful mark as created.
 * RETURNS: IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
int
add_classes(
ipqos_conf_class_t *classes,
char *action,
int module_version,
boolean_t rem_undo) {

	int res;
	ipqos_conf_class_t *cls;

	IPQOSCDBG0(L1, "In add_classes\n");

	/* for each class */
	for (cls = classes; cls; cls = cls->next) {
		/*
		 * skip class if in normal mode and not new class or
		 * if doing rollback and class wasn't deleted.
		 */
		if ((rem_undo == B_FALSE && cls->new == B_FALSE) ||
		(rem_undo == B_TRUE && cls->deleted == B_FALSE)) {
			continue;
		}

		/* add class to action */
		res = add_class(action, cls->name, module_version,
		    cls->stats_enable, cls->alist->name);
		if (res != IPQOS_CONF_SUCCESS) {
			return (IPQOS_CONF_ERR);
		}

		/* mark class as created */
		cls->cr_mod = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * For each of the actions in actions remove the action if marked as
 * such or remove any objects within marked as such.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
remove_items(
ipqos_conf_action_t *actions,
boolean_t add_undo)
{

	int res;
	ipqos_conf_action_t *act;

	IPQOSCDBG1(L0, "In remove_items, add_undo: %u\n", add_undo);

	/*
	 * loop through actions removing any actions, or action contents
	 * that are marked as such.
	 */
	for (act = actions; act; act = act->next) {
		res = remove_item(act, add_undo);
		if (res != IPQOS_CONF_SUCCESS) {
			return (res);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Deletes this action if marked for deletion or any of it's contents marked
 * for deletion. If the action is marked for deletion any actions referencing
 * this action are destroyed first if marked or have their contents destroyed
 * if marked. This is recursive.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
remove_item(
ipqos_conf_action_t *act,
boolean_t add_undo)
{

	ipqos_conf_class_t *cls;
	ipqos_conf_filter_t *flt;
	ipqos_conf_act_ref_t *dep;
	int res;

	IPQOSCDBG3(L1, "In remove_item: action: %s, add_undo: %u, mod: %u\n",
	    act->name, add_undo, act->modified);


	/* return immmediately if previously visited in remove phase */

	if (act->visited == REM_VISITED) {
		IPQOSCDBG0(L1, "Exit due to REM_VISITED set\n");
		return (IPQOS_CONF_SUCCESS);
	}
	act->visited = REM_VISITED;


	/* if this action is to be deleted */

	if (add_undo == B_FALSE && act->todel == B_TRUE ||
	    add_undo == B_TRUE && act->new == B_TRUE &&
	    act->cr_mod == B_TRUE) {

		/* modify parent actions first */

		for (dep = act->dependencies; dep; dep = dep->next) {
			res = remove_item(dep->action, add_undo);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}
		}

		/* delete this action */

			IPQOSCDBG1(APPLY, "deleting action %s\n", act->name);
		res = ipp_action_destroy(act->name, 0);
		if (res != 0) {
			IPQOSCDBG1(APPLY, "failed to destroy action %s\n",
			    act->name);
			return (IPQOS_CONF_ERR);
		}

		/* flag as deleted */

		act->deleted = B_TRUE;

	/* if modified action */

	} else if (act->modified == B_TRUE) {

		/* loop through removing any filters marked for del */

		for (flt = act->filters; flt; flt = flt->next) {
			if ((add_undo == B_FALSE && flt->todel == B_TRUE) ||
			    (add_undo == B_TRUE && flt->new == B_TRUE &&
			    flt->cr_mod == B_TRUE)) {

				/* do deletion */

				res = remove_filter(act->name, flt->name,
				    flt->instance, act->module_version);
				if (res != IPQOS_CONF_SUCCESS) {
					IPQOSCDBG2(APPLY, "failed to destroy "
					    "filter %s, inst: %d\n", flt->name,
					    flt->instance);

					return (IPQOS_CONF_ERR);
				}

				/* flag deleted */

				flt->deleted = B_TRUE;
			}
		}

		/* remove any classes marked for del */

		for (cls = act->classes; cls; cls = cls->next) {
			if ((add_undo == B_FALSE && cls->todel == B_TRUE) ||
			    (add_undo == B_TRUE && cls->new == B_TRUE &&
			    cls->cr_mod == B_TRUE)) {

				/* do deletion */

				res = remove_class(act->name, cls->name,
				    act->module_version, 0);
				if (res != IPQOS_CONF_SUCCESS) {
					IPQOSCDBG1(APPLY, "failed to destroy "
					    "class %s\n", cls->name);

					return (IPQOS_CONF_ERR);
				}

				/* flag deleted */

				cls->deleted = B_TRUE;
			}
		}

		/* mark action as having been modified */

		act->cr_mod = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * for each of the actions in parameter actions apply any objects marked as
 * modified as a modification to the kernel action represented.
 * RETURNS: IPQOS_CONF_ERR on err, else IPQOS_CONF_SUCCESS.
 */
static int
modify_items(ipqos_conf_action_t *actions)
{

	ipqos_conf_action_t *act;
	int res;
	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;


	IPQOSCDBG0(L1, "In modify_items\n");

	/* loop through actions in parameter actions */

	for (act = actions; act; act = act->next) {

		/* skip unchanged actions */

		if (act->modified == B_FALSE) {
			continue;
		}

		/* apply any parameter mods */

		if (act->params->modified) {
			res = modify_params(act->name,
			    &act->params->nvlist,
			    act->module_version, act->params->stats_enable);
			if (res != IPQOS_CONF_SUCCESS) {
				return (IPQOS_CONF_ERR);
			}

			act->params->cr_mod = B_TRUE;
		}

		/* apply any class mods */

		for (cls = act->classes; cls; cls = cls->next) {
			if (cls->modified) {
				res = modify_class(act->name, cls->name,
				    act->module_version, cls->stats_enable,
				    cls->alist->name, 0);
				if (res != IPQOS_CONF_SUCCESS) {
					return (IPQOS_CONF_ERR);
				}

				/* mark modification done */
				cls->cr_mod = B_TRUE;
			}
		}

		/* apply any filter mods */

		for (flt = act->filters; flt; flt = flt->next) {
			if (flt->modified) {
				res = modify_filter(act->name, flt,
				    act->module_version);
				if (res != 0) {
					return (IPQOS_CONF_ERR);
				}

				/* mark modification done */
				flt->cr_mod = B_TRUE;
			}
		}

		/* mark action modified */

		act->cr_mod = B_TRUE;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * For each of the objects of each of the actions in nactions that are
 * marked as having been modified the object modification is done in
 * reverse using the same named object from oactions.
 * RETURNS: IPQOS_CONF_ERR on error, IPQOS_CONF_SUCCESS otherwise.
 */
static int
undo_modifys(
ipqos_conf_action_t *oactions,
ipqos_conf_action_t *nactions)
{

	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;
	ipqos_conf_action_t *act;
	ipqos_conf_action_t *oldact;
	ipqos_conf_filter_t *oldflt;
	ipqos_conf_class_t *oldcls;
	int res;

	IPQOSCDBG0(L1, "In undo_modifys:\n");

	/* loop throught new actions */

	for (act = nactions; act; act = act->next) {
		oldact = actionexist(act->name, oactions);

		/*
		 * if the action was new then it will be removed and
		 * any permamanent items that were marked for modify
		 * will dissappear, so ignore action.
		 */
		if (oldact == NULL) {
			continue;
		}

		/* if parameters were modified switch them back */

		if (act->params->modified == B_TRUE &&
		    act->params->cr_mod == B_TRUE) {
			res = modify_params(act->name,
			    &oldact->params->nvlist,
			    act->module_version, act->params->stats_enable);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}
		}

		/* for each filter in action if filter modified switch back */

		for (flt = act->filters; flt; flt = flt->next) {
			if (flt->modified == B_TRUE &&
			    flt->cr_mod == B_TRUE) {
				oldflt = filterexist(flt->name, -1,
				    oldact->filters);
				res = modify_filter(act->name, oldflt,
				    act->module_version);
				if (res != IPQOS_CONF_SUCCESS) {
					return (res);
				}
			}
		}

		/* for each class in action if class modified switch back */

		for (cls = act->classes; cls; cls = cls->next) {
			if (cls->modified == B_TRUE &&
			    cls->cr_mod == B_TRUE) {
				oldcls = classexist(cls->name, oldact->classes);
				if (oldcls->alist) {
					res = modify_class(act->name,
					    cls->name, act->module_version,
					    oldcls->stats_enable,
					    oldcls->alist->name, 0);
				}
				if (res != IPQOS_CONF_SUCCESS) {
					return (res);
				}
			}
		}
	}

	/*
	 * Go through the old actions modifying perm filters and classes
	 * whose action was deleted.
	 *
	 */
	for (act = oactions; act != NULL; act = act->next) {

		if (act->deleted == B_FALSE) {
			continue;
		}

		for (flt = act->filters; flt != NULL; flt = flt->next) {
			if (flt->originator == IPP_CONFIG_PERMANENT) {
				res = modify_filter(act->name, flt,
				    act->module_version);
				if (res != IPQOS_CONF_SUCCESS) {
					return (res);
				}
			}
		}

		for (cls = act->classes; cls != NULL; cls = cls->next) {
			if (cls->originator == IPP_CONFIG_PERMANENT) {
				res = modify_class(act->name, cls->name,
				    act->module_version, cls->stats_enable,
				    cls->alist->name, 0);
				if (res != IPQOS_CONF_SUCCESS) {
					return (res);
				}
			}

		}
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * causes all changes marked as being done in actions and old_actions
 * to be undone.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
rollback(
ipqos_conf_action_t *actions,
ipqos_conf_action_t *old_actions)
{

	int res;

	IPQOSCDBG0(RBK, "In rollback:\n");

	/* re-add items that were deleted */

	res = add_items(old_actions, B_TRUE);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* change modified items back how they were */

	res = undo_modifys(old_actions, actions);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/* remove new items that were added */

	res = remove_items(actions, B_TRUE);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	return (IPQOS_CONF_SUCCESS);
}

/* ******************************* print config **************************** */

/*
 * Prints the username of the user with uid 'uid' to 'fp' if the uid belongs
 * to a known user on the system, otherwise just print 'uid'.
 */
static void
printuser(
FILE *fp,
uid_t uid)
{
	struct passwd *pwd;

	IPQOSCDBG0(L0, "In printuser\n");

	pwd = getpwuid(uid);
	if (pwd != NULL) {
		(void) fprintf(fp, "%s\n", pwd->pw_name);
	} else {
		(void) fprintf(fp, "%u\n", (int)uid);
	}
}

/*
 * print either a single value of start to fp (if start equals end), else
 * print start'-'end if start is the smaller of the two values, otherwise
 * print end'-'start.
 */
static void
printrange(
FILE *fp,
uint32_t start,
uint32_t end)
{
	uint32_t tmp;

	if (start > end) {
		tmp = start;
		start = end;
		end = tmp;
	}

	(void) fprintf(fp, "%u", start);
	if (end != start)
		(void) fprintf(fp, "-%u", end);
}

/*
 * print the contents of the array arr to fp in the form:
 * {0-6:1;7-12:2;13:3.....} or {0-6:GREEN;7-12:YELLOW:...}
 * dependant upon whether this is an integer or enumerated array resectively
 * (if enum_nvs isn't set to NULL this is assumed to be an enumerated array);
 * where 0-6 is the range of indexes with value 1 (or GREEN), 7-12 the range
 * with value 2 (or YELLOW), and so forth. size is the array size and llimit
 * and ulimit are the lower and upper limits of the array values printed
 * respectively. For enumerated arrays enum_nvs carries the list of name
 * and value pairs and ulimit and llimit parameters are ignored and instead
 * determined from the enum_nvs list.
 */
static void
print_int_array(
FILE *fp,
int arr[],
uint32_t size,
int llimit,
int ulimit,
str_val_nd_t *enum_nvs,
int tab_inserts)
{
	int x, y;
	uint32_t first, last;
	boolean_t first_entry;	/* first 'ranges:value' to be printed ? */
	boolean_t first_range;	/* first range for a value to be printed ? */
	boolean_t found_range;	/* did we find a range for this value ? */

	IPQOSCDBG4(L0, "In print_int_array: size: %u, llimit: %u, ulimit: %u, "
	    "enum_nvs: %x \n", size, llimit, ulimit, enum_nvs);

	/*
	 * if an enumeration retrieve value range.
	 */
	if (enum_nvs != NULL)
		get_str_val_value_range(enum_nvs, &llimit, &ulimit);

	/*
	 * print opening curl.
	 */
	(void) fprintf(fp, "%c\n", CURL_BEGIN);
	PRINT_TABS(fp, tab_inserts + 1);

	first_entry = B_TRUE;
	/*
	 * for each value in range.
	 */
	for (x = llimit; x <= ulimit; x++) {
		found_range = B_FALSE;
		first_range = B_TRUE;
		y = 0;
		/*
		 * scan array and print ranges of indexes with value x.
		 */
		while (y < size) {
			/*
			 * get first occurence of value for this range.
			 */
			while ((arr[y] != x) && (y < size))
				y++;
			if (y == size) {
				break;
			} else {
				found_range = B_TRUE;
			}
			first = y;

			/*
			 * get last occurence of value for this range.
			 */
			while ((arr[y] == x) && (y < size))
				y++;
			last = y - 1;

			/*
			 * print entry delimiter (semi-colon)? It must be
			 * the first range for this value and this mustn't
			 * be the first 'ranges:value' entry.
			 */
			if (!first_entry && first_range) {
				(void) fprintf(fp, ";\n");
				PRINT_TABS(fp, tab_inserts + 1);
			} else {
				first_entry = B_FALSE;
			}

			/*
			 * print comma (range delimeter) only if there was
			 * a previous range for this value.
			 */
			if (!first_range) {
				(void) fprintf(fp, ",");
			} else {
				first_range = B_FALSE;
			}

			/*
			 * print range.
			 */
			printrange(fp, first, last);
		}
		/*
		 * only print a colon and value if we found a range with
		 * this value.
		 */
		if (found_range) {
			(void) fprintf(fp, ":");

			/*
			 * print numeric/symbolic value.
			 */
			if (enum_nvs) {
				printenum(fp, x, enum_nvs);
			} else {
				(void) fprintf(fp, "%d", x);
			}
		}
	}

	/*
	 * print closing curl.
	 */
	(void) fprintf(fp, "\n");
	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, "%c\n", CURL_END);
}

/* print the protocol name for proto, or if unknown protocol number proto. */
static void
printproto(
FILE *fp,
uint8_t proto)
{

	struct protoent *pent;

	pent = getprotobynumber(proto);
	if (pent != NULL) {
		(void) fprintf(fp, "%s\n", pent->p_name);
	} else {
		(void) fprintf(fp, "%u\n", proto);
	}
}

/*
 * prints the name associated with interface with index ifindex to fp.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
printifname(
FILE *fp,
int ifindex)
{

	int s;
	struct lifconf lc;
	struct lifnum ln;
	struct lifreq *lr;
	char *buf;
	int len;
	char *cp;
	int ret;
	int x;
	int idx;

	/* open socket */

	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
		ipqos_msg(MT_ENOSTR, gettext("opening AF_INET socket"));
		return (IPQOS_CONF_ERR);
	}

	/* get number of lifreq structs that need to be alloc'd for */

	ln.lifn_family = AF_UNSPEC;
	ln.lifn_flags = 0;
	ret = ioctl(s, SIOCGLIFNUM, &ln);
	if (ret < 0) {
		ipqos_msg(MT_ENOSTR, "SIOCLIFNUM ioctl");
		(void) close(s);
		return (IPQOS_CONF_ERR);
	}

	/* allocate buffer for SIOGLIFCONF ioctl */

	len = ln.lifn_count * sizeof (struct lifreq);
	buf = malloc(len);
	if (buf == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		(void) close(s);
		return (IPQOS_CONF_ERR);
	}

	/* setup lifconf params for ioctl */

	lc.lifc_family = AF_UNSPEC;
	lc.lifc_flags = 0;
	lc.lifc_len = len;
	lc.lifc_buf = buf;

	/* do SIOCGLIFCONF ioctl */

	ret = ioctl(s, SIOCGLIFCONF, &lc);
	if (ret < 0) {
		ipqos_msg(MT_ENOSTR, "SIGLIFCONF");
		(void) close(s);
		free(buf);
		return (IPQOS_CONF_ERR);
	}
	(void) close(s);

	/*
	 * for each interface name given in the returned lifreq list get
	 * it's index and compare with ifindex param. Break if equal.
	 */
	for (x = ln.lifn_count, lr = lc.lifc_req; x > 0; x--, lr++) {
		ret = readifindex(lr->lifr_name, &idx);
		if (ret != IPQOS_CONF_SUCCESS) {
			free(buf);
			return (IPQOS_CONF_ERR);
		}
		if (idx == ifindex) {
			break;
		}
	}
	free(buf);

	if (x == 0) {
		IPQOSCDBG1(L1, "Failed to find if index %u in returned "
		    "if list.\n", ifindex);
		return (IPQOS_CONF_ERR);
	}
	/* truncate any logical suffix */

	if ((cp = strchr(lr->lifr_name, '@')) != NULL) {
		*cp = NULL;
	}

	/* print interface name */
	(void) fprintf(fp, "%s\n", lr->lifr_name);

	return (IPQOS_CONF_SUCCESS);
}

/*
 * print to fp the enumeration clause evaluating to the value val using the
 * names/values given in enum_nvs.
 */
static void
printenum(
FILE *fp,
uint32_t val,
str_val_nd_t *enum_nvs)
{

	boolean_t isfirstval = B_TRUE;
	str_val_nd_t *name_val = enum_nvs;

	/* for each value in enum_nvs if same bit set in val print name */

	while (name_val) {
		if ((name_val->sv.value & val) == name_val->sv.value) {
			if (isfirstval == B_TRUE) {
				(void) fprintf(fp, "%s", name_val->sv.string);
				isfirstval = B_FALSE;
			} else {
				(void) fprintf(fp, ", %s", name_val->sv.string);
			}
		}
		name_val = name_val->next;
	}
}


/* prints the service name of port, or if unknown the number to fp. */
static void
printport(
FILE *fp,
uint16_t port)
{

	struct servent *sent;

	sent = getservbyport(port, NULL);
	if (sent != NULL) {
		(void) fprintf(fp, "%s\n", sent->s_name);
	} else {
		(void) fprintf(fp, "%u\n", ntohs(port));
	}
}

/*
 * prints tp fp the name and value of all user specifiable parameters in the
 * nvlist.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
printnvlist(
FILE *fp,
char *module,
nvlist_t *nvl,
int printall,	/* are we want ip addresses printing if node name */
ipqos_conf_filter_t *flt,	/* used to determine if node name set */
int tab_inserts,
place_t place)
{
	FILE *tfp;
	nvpair_t *nvp;
	char *name;
	ipqos_nvtype_t type;
	str_val_nd_t *enum_nvs;
	int ret;
	char dfltst[IPQOS_VALST_MAXLEN+1];
	char *param;
	int openerr;
	int res;

	IPQOSCDBG0(L1, "In printnvlist\n");


	/* open stream to types file */

	tfp = validmod(module, &openerr);
	if (tfp == NULL) {
		if (openerr) {
			ipqos_msg(MT_ENOSTR, "fopen");
		}
		return (IPQOS_CONF_ERR);
	}


	/* go through list getting param name and type and printing it */

	nvp = nvlist_next_nvpair(nvl, NULL);
	while (nvp) {

		/* get nvpair name */
		name = nvpair_name(nvp);
		IPQOSCDBG1(L0, "processing element %s.\n", name);

		/* skip ipgpc params that are not explicitly user settable */

		if (strcmp(name, IPGPC_FILTER_TYPE) == 0 ||
		    strcmp(name, IPGPC_SADDR_MASK) == 0 ||
		    strcmp(name, IPGPC_DADDR_MASK) == 0 ||
		    strcmp(name, IPGPC_SPORT_MASK) == 0 ||
		    strcmp(name, IPGPC_DPORT_MASK) == 0) {
			nvp = nvlist_next_nvpair(nvl, nvp);
			continue;
		}

		param = SHORT_NAME(name);

		/*
		 * get parameter type from types file.
		 */
		place = PL_ANY;
		ret = readtype(tfp, module, param, &type, &enum_nvs, dfltst,
		    B_TRUE, &place);
		if (ret != IPQOS_CONF_SUCCESS) {
			return (ret);
		}

		/*
		 * for map entries we don't print the map value, only
		 * the index value it was derived from.
		 */
		if (place == PL_MAP) {
			nvp = nvlist_next_nvpair(nvl, nvp);
			continue;
		}

		/*
		 * the ifindex is converted to the name and printed out
		 * so print the parameter name as ifname.
		 */
		if (strcmp(name, IPGPC_IF_INDEX) == 0) {
			PRINT_TABS(fp, tab_inserts);
			(void) fprintf(fp, "%s ", IPQOS_IFNAME_STR);
		/*
		 * we may not print the address due to us instead printing
		 * the node name in printfilter, therefore we leave the
		 * printing of the parameter in the addresses switch case code.
		 */
		} else if ((strcmp(name, IPGPC_SADDR) != 0 &&
		    strcmp(name, IPGPC_DADDR) != 0)) {
			PRINT_TABS(fp, tab_inserts);
			(void) fprintf(fp, "%s ", param);
		}

		switch (type) {
			case IPQOS_DATA_TYPE_IFINDEX: {
				uint32_t ifidx;

				(void) nvpair_value_uint32(nvp, &ifidx);
				(void) printifname(fp, ifidx);
				break;
			}
			case IPQOS_DATA_TYPE_BOOLEAN: {
				boolean_t bl;

				(void) nvpair_value_uint32(nvp,
				    (uint32_t *)&bl);
				(void) fprintf(fp, "%s\n",
				    bl == B_TRUE ? "true" : "false");
				break;
			}
			case IPQOS_DATA_TYPE_ACTION: {
				char *strval;

				(void) nvpair_value_string(nvp, &strval);
				print_action_nm(fp, strval);
				break;
			}
			case IPQOS_DATA_TYPE_STRING: {
				char *strval;

				(void) nvpair_value_string(nvp, &strval);
				(void) fprintf(fp, "%s\n",
				    quote_ws_string(strval));
				break;
			}
			case IPQOS_DATA_TYPE_ADDRESS: {
				uint_t tmp;
				in6_addr_t *addr;
				char addrstr[INET6_ADDRSTRLEN];
				uchar_t ftype;
				int af;
				in6_addr_t *mask;

				/*
				 * skip addresses that have node names for
				 * non printall listings.
				 */
				if (printall == 0 &&
				    (strcmp(nvpair_name(nvp), IPGPC_SADDR) ==
				    0 && flt->src_nd_name ||
				    strcmp(nvpair_name(nvp), IPGPC_DADDR) ==
				    0 && flt->dst_nd_name)) {
					break;
				}

				/* we skipped this above */

				PRINT_TABS(fp, tab_inserts);
				(void) fprintf(fp, "%s ", param);

				(void) nvpair_value_uint32_array(nvp,
				    (uint32_t **)&addr, &tmp);

				/* get filter type */

				(void) nvlist_lookup_byte(nvl,
				    IPGPC_FILTER_TYPE, &ftype);
				if (ftype == IPGPC_V4_FLTR) {
					af = AF_INET;
					addr = (in6_addr_t *)
					&V4_PART_OF_V6((*addr));
				} else {
					af = AF_INET6;
				}
				/* get mask */

				if (strcmp(nvpair_name(nvp), IPGPC_SADDR) ==
				    0) {
					ret = nvlist_lookup_uint32_array(nvl,
					    IPGPC_SADDR_MASK,
					    (uint32_t **)&mask, &tmp);
				} else {
					ret = nvlist_lookup_uint32_array(nvl,
					    IPGPC_DADDR_MASK,
					    (uint32_t **)&mask, &tmp);
				}

				/* print address/mask to fp */

				(void) fprintf(fp, "%s/%u\n",
				    inet_ntop(af, addr, addrstr,
				    INET6_ADDRSTRLEN), masktocidr(af, mask));
				break;
			}
			case IPQOS_DATA_TYPE_ENUM: {
				uint32_t val;

				(void) nvpair_value_uint32(nvp, &val);

				/*
				 * print list of tokens resulting in val
				 */
				(void) fprintf(fp, "{ ");
				printenum(fp, val, enum_nvs);
				(void) fprintf(fp, " }\n");
				break;
			}
			case IPQOS_DATA_TYPE_PORT: {
				uint16_t port;

				(void) nvpair_value_uint16(nvp, &port);
				printport(fp, port);
				break;
			}
			case IPQOS_DATA_TYPE_PROTO: {
				uint8_t proto;

				(void) nvpair_value_byte(nvp, &proto);
				printproto(fp, proto);
				break;
			}
			case IPQOS_DATA_TYPE_M_INDEX:
			case IPQOS_DATA_TYPE_UINT8: {
				uchar_t u8;

				(void) nvpair_value_byte(nvp, &u8);
				(void) fprintf(fp, "%u\n", u8);
				break;
			}
			case IPQOS_DATA_TYPE_UINT16: {
				uint16_t u16;

				(void) nvpair_value_uint16(nvp, &u16);
				(void) fprintf(fp, "%u\n", u16);
				break;
			}
			case IPQOS_DATA_TYPE_INT16: {
				int16_t i16;

				(void) nvpair_value_int16(nvp, &i16);
				(void) fprintf(fp, "%d\n", i16);
				break;
			}
			case IPQOS_DATA_TYPE_UINT32: {
				uint32_t u32;

				(void) nvpair_value_uint32(nvp, &u32);
				(void) fprintf(fp, "%u\n", u32);
				break;
			}
			case IPQOS_DATA_TYPE_INT32: {
				int i32;

				(void) nvpair_value_int32(nvp, &i32);
				(void) fprintf(fp, "%d\n", i32);
				break;
			}
			case IPQOS_DATA_TYPE_INT_ARRAY: {
				str_val_nd_t *arr_enum_nvs = NULL;
				uint32_t size;
				int llimit, ulimit;
				int *arr;

				(void) nvpair_value_int32_array(nvp, &arr,
				    &size);

				/*
				 * read array info from types file.
				 */
				res = read_int_array_info(dfltst,
				    &arr_enum_nvs, &size, &llimit, &ulimit,
				    module);

				/*
				 * print array with numbers, or symbols
				 * if enumerated.
				 */
				if (res == IPQOS_CONF_SUCCESS) {
					print_int_array(fp, arr, size,
					    llimit, ulimit, arr_enum_nvs,
					    tab_inserts);
					if (arr_enum_nvs != NULL) {
						free_str_val_entrys(
						    arr_enum_nvs);
					}
				}
				break;
			}
			case IPQOS_DATA_TYPE_USER: {
				uid_t uid;

				(void) nvpair_value_int32(nvp, (int *)&uid);
				printuser(fp, uid);
				break;
			}
#ifdef	_IPQOS_CONF_DEBUG
			default: {
				/*
				 * we should have catered for all used data
				 * types that readtype returns.
				 */
				assert(1);
			}
#endif
		}

		nvp = nvlist_next_nvpair(nvl, nvp);
	}

	(void) fclose(tfp);
	return (IPQOS_CONF_SUCCESS);
}

/*
 * print a parameter clause for the parmeters given in params to fp.
 * If printall is set, then the originator of the parameter object is printed.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
printparams(
FILE *fp,
char *module,
ipqos_conf_params_t *params,
int printall,
int tab_inserts)
{

	int res;

	/* print opening clause */

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, IPQOS_CONF_PARAMS_STR " {\n");

	/* print originator name if printall flag set */

	if (printall) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(stdout, "Originator %s\n",
		    quote_ws_string(get_originator_nm(params->originator)));
	}

	/* print global stats */

	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_GLOBAL_STATS_STR " %s\n",
	    params->stats_enable == B_TRUE ? "true" : "false");

	/* print module specific parameters */
	res = printnvlist(fp, module, params->nvlist, printall, NULL,
	    tab_inserts + 1, PL_PARAMS);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, "}\n");

	return (IPQOS_CONF_SUCCESS);
}

/*
 * print the interpreted name of the action_nm parameter if it is a special
 * action, else action_nm verbatim to fp parameter.
 */
static void
print_action_nm(FILE *fp, char *action_nm)
{

	if (strcmp(action_nm, IPP_ANAME_CONT) == 0) {
		(void) fprintf(fp, IPQOS_CONF_CONT_STR "\n");
	} else if (strcmp(action_nm, IPP_ANAME_DEFER) == 0) {
		(void) fprintf(fp, IPQOS_CONF_DEFER_STR "\n");
	} else if (strcmp(action_nm, IPP_ANAME_DROP) == 0) {
		(void) fprintf(fp, IPQOS_CONF_DROP_STR "\n");
	} else {
		(void) fprintf(fp, "%s\n", quote_ws_string(action_nm));
	}
}

/*
 * print a class clause for class to fp. If printall is set the originator
 * is printed.
 */
static void
printclass(
FILE *fp,
ipqos_conf_class_t *class,
int printall,
int tab_inserts)
{

	/* print opening clause */

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, IPQOS_CONF_CLASS_STR " {\n");


	/* if printall flag print originator name */

	if (printall) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(stdout, "Originator %s\n",
		    get_originator_nm(class->originator));
	}

	/* print name, next action and stats enable */

	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_NAME_STR " %s\n",
	    quote_ws_string(class->name));
	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_NEXT_ACTION_STR " ");
	    print_action_nm(fp, class->alist->name);
	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_STATS_ENABLE_STR " %s\n",
	    class->stats_enable == B_TRUE ? "true" : "false");

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, "}\n");
}

/*
 * Returns a ptr to the originator name associated with origid. If unknown
 * id returns ptr to "unknown".
 * RETURNS: ptr to originator name, or if id not known "unknown".
 */
static char *
get_originator_nm(uint32_t origid)
{

	int x;

	/* scan originators table for origid */

	for (x = 0; originators[x].value != -1 &&
	    originators[x].value != origid; x++) {}

	/* if we've reached end of array due to unknown type return "unknown" */

	if (originators[x].value == -1) {
		return ("unknown");
	}

	return (originators[x].string);
}

/*
 * print a filter clause for filter pointed to by filter out to fp. If printall
 * is set then the originator is printed, for filters with node names instance
 * numbers are printed, and the filter pointer isn't advanced to point at the
 * last instance of the printed filter.
 * RETURNS: IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
static int
printfilter(
FILE *fp,
char *module,
ipqos_conf_filter_t **filter,
int printall,
int tab_inserts)
{

	int res;

	/* print opening clause */

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, IPQOS_CONF_FILTER_STR " {\n");

	/* print originator if printall flag set */

	if (printall) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(stdout, "Originator %s\n",
		    quote_ws_string(get_originator_nm((*filter)->originator)));
	}

	/* print name and class */

	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_NAME_STR " %s\n",
	    quote_ws_string((*filter)->name));
	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_CLASS_STR " %s\n",
	    quote_ws_string((*filter)->class_name));

	/* print the instance if printall and potential mhomed addresses */

	if (printall && ((*filter)->src_nd_name || (*filter)->dst_nd_name)) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(fp, "Instance %u\n", (*filter)->instance);
	}

	/* print node names if any */

	if ((*filter)->src_nd_name) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(fp, "%s %s\n", strchr(IPGPC_SADDR, '.') + 1,
		    (*filter)->src_nd_name);
	}
	if ((*filter)->dst_nd_name) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(fp, "%s %s\n", strchr(IPGPC_DADDR, '.') + 1,
		    (*filter)->dst_nd_name);
	}

	/* print ip_version enumeration if set */

	if ((*filter)->ip_versions != 0) {
		PRINT_TABS(fp, tab_inserts + 1);
		(void) fprintf(fp, IPQOS_CONF_IP_VERSION_STR " {");
		if (VERSION_IS_V4(*filter)) {
			(void) fprintf(fp, " V4");
		}
		if (VERSION_IS_V6(*filter)) {
			(void) fprintf(fp, " V6");
		}
		(void) fprintf(fp, " }\n");
	}

	/* print other module specific parameters parameters */

	res = printnvlist(fp, module, (*filter)->nvlist, printall, *filter,
	    tab_inserts + 1, PL_FILTER);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, "}\n");

	/*
	 * if not printall advance filter parameter to last instance of this
	 * filter.
	 */

	if (!printall) {
		for (;;) {
			if ((*filter)->next == NULL ||
			    strcmp((*filter)->name, (*filter)->next->name) !=
			    0) {
				break;
			}
			*filter = (*filter)->next;
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Returns a pointer to str if no whitespace is present, else it returns
 * a pointer to a string with the contents of str enclose in double quotes.
 * This returned strings contents may change in subsequent calls so a copy
 * should be made of it if the caller wishes to retain it.
 */
static char *
quote_ws_string(const char *str)
{
	static char *buf = NULL;
	const char *cp;	/* we don't modify the contents of str so const */

	IPQOSCDBG0(L0, "In quote_ws_string\n");

	/*
	 * Just return str if no whitespace.
	 */
	for (cp = str; (*cp != '\0') && !isspace(*cp); cp++)
		;
	if (*cp == '\0')
		return ((char *)str);

	if (buf == NULL) {
		/*
		 * if first run just allocate buffer of
		 * strlen(str) + 2 quote characters + NULL terminator.
		 */
		buf = malloc(strlen(str) + 3);
	} else if ((strlen(str) + 2) > strlen(buf)) {
		/*
		 * Not first run, so check if we have a big enough buffer
		 * and if not reallocate the buffer to a sufficient size.
		 */
		buf = realloc(buf, strlen(str) + 3);
	}
	if (buf == NULL)
		return ("");

	/*
	 * copy string into buffer with quotes.
	 */
	(void) strcpy(buf, "\"");
	(void) strcat(buf, str);
	(void) strcat(buf, "\"");

	return (buf);
}

/*
 * print an action clause for action to fp. If the printall flag is set
 * then all filters and classes (regardless of their originator) and
 * their originators are displayed.
 * RETURNS: IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
static int
printaction(
FILE *fp,
ipqos_conf_action_t *action,
int printall,
int tab_inserts)
{

	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;
	int res;

	/* print opening clause, module and name */

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, IPQOS_CONF_ACTION_STR " {\n");
	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, IPQOS_CONF_MODULE_STR " %s\n",
	    quote_ws_string(action->module));
	PRINT_TABS(fp, tab_inserts + 1);
	(void) fprintf(fp, "name %s\n", quote_ws_string(action->name));

	/* print params clause */

	(void) fprintf(fp, "\n");
	res = printparams(fp, action->module, action->params, printall,
	    tab_inserts + 1);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/*
	 * print classes clause for each class if printall is set, else
	 * just ipqosconf created or permanent classes.
	 */
	for (cls = action->classes; cls != NULL; cls = cls->next) {
		if (printall ||
		    cls->originator == IPP_CONFIG_IPQOSCONF ||
		    cls->originator == IPP_CONFIG_PERMANENT) {
			(void) fprintf(fp, "\n");
			printclass(fp, cls, printall, tab_inserts + 1);
		}
	}

	/*
	 * print filter clause for each filter if printall is set, else
	 * just ipqosconf created or permanent filters.
	 */
	for (flt = action->filters; flt != NULL; flt = flt->next) {
		if (printall ||
		    flt->originator == IPP_CONFIG_IPQOSCONF ||
		    flt->originator == IPP_CONFIG_PERMANENT) {
			(void) fprintf(fp, "\n");
			res = printfilter(fp, action->module, &flt, printall,
			    tab_inserts + 1);
			if (res != IPQOS_CONF_SUCCESS) {
				return (res);
			}
		}
	}

	PRINT_TABS(fp, tab_inserts);
	(void) fprintf(fp, "}\n");

	return (IPQOS_CONF_SUCCESS);
}



/* *************************************************************** */


static void
list_end(
ipqos_list_el_t **listp,
ipqos_list_el_t ***lendpp)
{
	*lendpp = listp;
	while (**lendpp != NULL) {
		*lendpp = &(**lendpp)->next;
	}
}

static void
add_to_list(
ipqos_list_el_t **listp,
ipqos_list_el_t *el)
{
	el->next = *listp;
	*listp = el;
}

/*
 * given mask calculates the number of bits it spans. The mask must be
 * continuous.
 * RETURNS: number of bits spanned.
 */
static int
masktocidr(
int af,
in6_addr_t *mask)
{
	int zeros = 0;
	int byte;
	int cidr;

	/*
	 * loop through from lowest byte to highest byte counting the
	 * number of zero bits till hitting a one bit.
	 */
	for (byte = 15; byte >= 0; byte--) {
		/*
		 * zero byte, so add 8 to zeros.
		 */
		if (mask->s6_addr[byte] == 0) {
			zeros += 8;
		/*
		 * non-zero byte, add zero count to zeros.
		 */
		} else {
			zeros += (ffs((int)mask->s6_addr[byte]) - 1);
			break;
		}
	}
	/*
	 * translate zero bits to 32 or 128 bit mask based on af.
	 */
	if (af == AF_INET) {
		cidr = 32 - zeros;
	} else {
		cidr = 128 - zeros;
	}

	return (cidr);
}

/*
 * Sets the first prefix_len bits in the v4 or v6 address (based upon af)
 * contained in the v6 address referenced by addr to 1.
 */
static void
setmask(int prefix_len, in6_addr_t *addr, int af)
{

	int i;
	int shift;
	int maskstartbit = 128 - prefix_len;
	int end_u32;

	IPQOSCDBG2(L1, "In setmask, prefix_len: %u, af: %s\n", prefix_len,
	    af == AF_INET ? "AF_INET" : "AF_INET6");

	/* zero addr */
	bzero(addr, sizeof (in6_addr_t));


	/* set which 32bits in *addr are relevant to this af */

	if (af == AF_INET) {
		end_u32 = 3;
		maskstartbit = 32 - prefix_len;
	/* AF_INET6 */
	} else {
		end_u32 = 0;
	}
	/*
	 * go through each of the 32bit quantities in 128 bit in6_addr_t
	 * and set appropriate bits according to prefix_len.
	 */
	for (i = 3; i >= end_u32; i--) {

		/* does the prefix apply to this 32bits? */

		if (maskstartbit < ((4 - i) * 32)) {

			/* is this 32bits fully masked? */

			if (maskstartbit <= ((3 - i) * 32)) {
				shift = 0;
			} else {
				shift = maskstartbit % 32;
			}
			addr->_S6_un._S6_u32[i] = (uint32_t)~0;
			addr->_S6_un._S6_u32[i] =
			    addr->_S6_un._S6_u32[i] >> shift;
			addr->_S6_un._S6_u32[i] =
			    addr->_S6_un._S6_u32[i] << shift;
		}

		/* translate to NBO */
		addr->_S6_un._S6_u32[i] = htonl(addr->_S6_un._S6_u32[i]);
	}
}

/*
 * search nvlist for an element with the name specified and return a ptr
 * to it if found.
 * RETURNS: pointer to nvpair named name if found, else NULL.
 */
static nvpair_t *
find_nvpair(nvlist_t *nvl, char *name)
{

	nvpair_t *nvp;
	nvpair_t *match = NULL;
	char *nvp_name;

	IPQOSCDBG0(L1, "In find_nvpair\n");

	nvp = nvlist_next_nvpair(nvl, NULL);
	while (nvp) {
		nvp_name = nvpair_name(nvp);
		if (strcmp(name, nvp_name) == 0) {
			match = nvp;
		}
		nvp = nvlist_next_nvpair(nvl, nvp);
	}

	return (match);
}

/*
 * returns a string containing module_name '.' name.
 * RETURNS: IPQOS_CONF_ERR if error, else IPQOS_CONF_SUCCESS.
 */
static char *
prepend_module_name(
char *name,
char *module)
{

	char *ret;

	IPQOSCDBG0(L2, "In prepend_module_name\n");

	ret = malloc(strlen(module) + strlen(".") + strlen(name) + 1);
	if (ret == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (NULL);
	}

	(void) strcpy(ret, module);
	(void) strcat(ret, ".");
	(void) strcat(ret, name);

	return (ret);
}

#if 0

/*
 * check if element with matching s1 and s2 string is in table table.
 * RETURNS: 1 if found else 0.
 */
static int
in_str_str_table(
str_str_t *table,
char *s1,
char *s2)
{

	str_str_t *ss = table;

	/* loop through table till matched or end */

	while (ss->s1[0] != '\0' &&
	    (strcmp(ss->s1, s1) != 0 || strcmp(ss->s2, s2) != 0)) {
		ss++;
	}

	if (ss->s1[0] != '\0') {
		return (1);
	}

	return (0);
}
#endif	/* 0 */

/*
 * check whether name is a valid action/class/filter name.
 * RETURNS: IPQOS_CONF_ERR if invalid name else IPQOS_CONF_SUCCESS.
 */
static int
valid_name(char *name)
{

	IPQOSCDBG1(L1, "In valid_name: name: %s\n", name);

	/* first char can't be '!' */
	if (name[0] == '!') {
		ipqos_msg(MT_ERROR, gettext("Name not allowed to start with "
		    "'!', line %u.\n"), lineno);
		return (IPQOS_CONF_ERR);
	}

	/* can't exceed IPQOS_CONF_NAME_LEN size */
	if (strlen(name) >= IPQOS_CONF_NAME_LEN) {
		ipqos_msg(MT_ERROR, gettext("Name exceeds maximum name length "
		    "line %u.\n"), lineno);
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/* ********************* string value manip fns ************************** */


/*
 * searches through the str_val_nd_t list of string value pairs finding
 * the minimum and maximum values for value and places them in the
 * integers pointed at by min and max.
 */
static void
get_str_val_value_range(
str_val_nd_t *svnp,
int *min,
int *max)
{
	if (svnp != NULL) {
		*min = *max = svnp->sv.value;
		svnp = svnp->next;
	}
	while (svnp != NULL) {
		if (svnp->sv.value > *max)
			*max = svnp->sv.value;
		if (svnp->sv.value < *min)
			*min = svnp->sv.value;
		svnp = svnp->next;
	}
}

/*
 * add an entry with string string and value val to sv_entrys.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
add_str_val_entry(
str_val_nd_t **sv_entrys,
char *string,
uint32_t val)
{

	str_val_nd_t *sv_entry;

	IPQOSCDBG2(L1, "In add_str_val_entry: string: %s, val: %u\n", string,
	    val);

	/* alloc new node */

	sv_entry = malloc(sizeof (str_val_nd_t));
	if (sv_entry == NULL) {
		return (IPQOS_CONF_ERR);
	}

	/* populate node */

	sv_entry->sv.string = malloc(strlen(string) + 1);
	if (sv_entry->sv.string == NULL) {
		free(sv_entry);
		ipqos_msg(MT_ENOSTR, "malloc");
		return (IPQOS_CONF_ERR);
	} else {
		(void) strcpy(sv_entry->sv.string, string);
	}
	sv_entry->sv.value = val;

	/* place at start of sv_entrys list */

	sv_entry->next = *sv_entrys;
	*sv_entrys = sv_entry;

	return (IPQOS_CONF_SUCCESS);
}


/* frees all the elements of sv_entrys. */
static void
free_str_val_entrys(
str_val_nd_t *sv_entrys)
{

	str_val_nd_t *sve = sv_entrys;
	str_val_nd_t *tmp;

	IPQOSCDBG0(L1, "In free_str_val_entrys\n");

	while (sve) {
		free(sve->sv.string);
		tmp = sve->next;
		free(sve);
		sve = tmp;
	}
}

/*
 * finds the value associated with string and assigns it to value ref'd by
 * val.
 * RETURNS: IPQOS_CONF_ERR if string not found, else IPQOS_CONF_SUCCESS.
 */
static int
str_val_list_lookup(
str_val_nd_t *svs,
char *string,
uint32_t *val)
{

	str_val_nd_t *sv = svs;

	IPQOSCDBG1(L1, "In str_val_list_lookup: %s\n", string);

	/* loop through list and exit when found or list end */

	while (sv != NULL) {
		if (strcmp(sv->sv.string, string) == 0) {
			break;
		}
		sv = sv->next;
	}

	/* ret error if not found */

	if (sv == NULL) {
		return (IPQOS_CONF_ERR);
	}

	*val = sv->sv.value;

	IPQOSCDBG1(L1, "svll: Value returned is %u\n", *val);
	return (IPQOS_CONF_SUCCESS);
}


/* ************************ conf file read fns ***************************** */

/*
 * Reads a uid or username from string 'str' and assigns either the uid
 * or associated uid respectively to storage pointed at by 'uid'. The
 * function determines whether to read a uid by checking whether the first
 * character of 'str' is numeric, in which case it reads a uid; otherwise it
 * assumes a username.
 * RETURNS: IPQOS_CONF_ERR if a NULL string pointer is passed, the read uid
 * doesn't have an entry on the system, or the read username doesn't have an
 * entry on the system.
 */
static int
readuser(
char *str,
uid_t *uid)
{
	struct passwd *pwd;
	char *lo;

	IPQOSCDBG1(L0, "In readuser, str: %s\n", str);

	if (str == NULL)
		return (IPQOS_CONF_ERR);
	/*
	 * Check if this appears to be a uid, and if so check that a
	 * corresponding user exists.
	 */
	if (isdigit((int)str[0])) {
		/*
		 * Read a 32bit integer and check in doing so that
		 * we have consumed the whole string.
		 */
		if (readint32(str, (int *)uid, &lo) != IPQOS_CONF_SUCCESS ||
		    *lo != '\0')
			return (IPQOS_CONF_ERR);
		if (getpwuid(*uid) == NULL)
			return (IPQOS_CONF_ERR);

	} else {	/* This must be a username, so lookup the uid. */
		pwd = getpwnam(str);
		if (pwd == NULL) {
			return (IPQOS_CONF_ERR);
		} else {
			*uid = pwd->pw_uid;
		}
	}
	return (IPQOS_CONF_SUCCESS);
}

/*
 * Reads a range from range_st, either of form 'a-b' or simply 'a'.
 * In the former case lower and upper have their values set to a
 * and b respectively; in the later lower and upper have both
 * their values set to a.
 * RETURNS: IPQOS_CONF_ERR if there's a parse error, else IPQOS_CONF_SUCCESS.
 */
static int
readrange(
char *range_st,
int *lower,
int *upper)
{
	char *cp;
	char *end, *end2;

	IPQOSCDBG1(L0, "In readrange: string: %s\n", range_st);

	/*
	 * get range boundarys.
	 */
	cp = strchr(range_st, '-');

	if (cp != NULL) {	/* we have a range */
		*cp++ = '\0';
		*lower = (int)strtol(range_st, &end, 10);
		*upper = (int)strtol(cp, &end2, 10);
		SKIPWS(end);
		SKIPWS(end2);
		if ((range_st == end) || (*end != NULL) ||
		    (cp == end) || (*end2 != NULL)) {
			IPQOSCDBG0(L0, "Failed reading a-b\n");
			return (IPQOS_CONF_ERR);
		}

	} else {		/* single value */

		*lower = *upper = (int)strtol(range_st, &end, 10);
		SKIPWS(end);
		if ((range_st == end) || (*end != NULL)) {
			IPQOSCDBG0(L0, "Failed reading a\n");
			return (IPQOS_CONF_ERR);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Reads the values of an integer array from fp whose format is:
 * '{'RANGE[,RANGE[..]]:VALUE[;RANGE:VALUE[..]]'}', creates an array of size
 * arr_size, applies the values to it and points arrp at this array.
 * RANGE is one set of array indexes over which this value is to
 * be applied, and VALUE either an integer within the range
 * llimit - ulimit, or if enum_nvs isn't NULL, an enumeration value
 * found in the list enum_nvs. Those values which aren't explicity set
 * will be set to -1.
 *
 * RETURNS: IPQOS_CONF_ERR on resource or parse error, else IPQOS_CONF_SUCCESS.
 */
static int
read_int_array(
FILE *fp,
char *first_token,
int **arrp,
uint32_t arr_size,
int llimit,
int ulimit,
str_val_nd_t *enum_nvs)
{

	char buf[5 * IPQOS_CONF_LINEBUF_SZ];
	char *token;
	char *range;
	char *ranges;
	char *svalue;
	int value;
	int res;
	char *entry;
	char *tmp;
	char *end;
	int lower, upper;
	int x;
	uint32_t startln;

	IPQOSCDBG4(L0, "In read_int_array: size: %u, lower: %u, upper: %u, "
	    "first_token: %s\n", arr_size, llimit, ulimit, first_token);

	/*
	 * read beginning curl.
	 */
	if (first_token[0] != CURL_BEGIN) {
		ipqos_msg(MT_ERROR, gettext("\'{\' missing at line "
		    "%u.\n"), lineno);
		return (IPQOS_CONF_ERR);
	}

	/*
	 * allocate and initialise array for holding read values.
	 */
	*arrp = malloc(arr_size * sizeof (int));
	if (*arrp == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (IPQOS_CONF_ERR);
	}
	(void) memset(*arrp, -1, arr_size * sizeof (int));

	/*
	 * read whole array declaration string into buffer.
	 * this is because readtoken doesn't interpret our
	 * delimeter values specially and may return them
	 * within another string.
	 */
	startln = lineno;	/* store starting lineno for error reports */
	buf[0] = '\0';
	res = readtoken(fp, &token);
	while ((res != IPQOS_CONF_CURL_END) && (res != IPQOS_CONF_ERR) &&
	    (res != IPQOS_CONF_EOF)) {
		(void) strlcat(buf, token, sizeof (buf));
		free(token);
		res = readtoken(fp, &token);
	}
	if (res != IPQOS_CONF_CURL_END) {
		goto array_err;
	}
	IPQOSCDBG1(L0, "array declaration buffer contains: %s\n", buf);

	/*
	 * loop reading "ranges ':' value;" till end of buffer.
	 */
	entry = strtok(buf, ";");
	while (entry != NULL) {
		svalue = strchr(entry, ':');
		if (svalue == NULL) {	/* missing value string */
			IPQOSCDBG0(L0, "Missing value string\n");
			goto array_err;
		}
		*svalue++ = '\0';
		ranges = entry;

		/*
		 * get value of number or enumerated symbol.
		 */
		if (enum_nvs) {
			/*
			 * get rid of surrounding whitespace so as not to
			 * confuse read_enum_value.
			 */
			SKIPWS(svalue);
			tmp = svalue;
			while (*tmp != '\0') {
				if (isspace(*tmp)) {
					*tmp = '\0';
					break;
				} else {
					tmp++;
				}
			}

			/*
			 * read enumeration value.
			 */
			res = read_enum_value(NULL, svalue, enum_nvs,
			    (uint32_t *)&value);
			if (res != IPQOS_CONF_SUCCESS)
				goto array_err;
		} else {
			value = (int)strtol(svalue, &end, 10);
			SKIPWS(end);
			if ((svalue == end) || (*end != NULL)) {
				IPQOSCDBG0(L0, "Invalid value\n");
				goto array_err;
			}
			IPQOSCDBG1(L0, "value: %u\n", value);

			/*
			 * check value within valid range.
			 */
			if ((value < llimit) || (value > ulimit)) {
				IPQOSCDBG0(L0, "value out of range\n");
				goto array_err;
			}
		}

		/*
		 * loop reading ranges for this value.
		 */
		range = strtok_r(ranges, ",", &tmp);
		while (range != NULL) {
			res = readrange(range, &lower, &upper);
			if (res != IPQOS_CONF_SUCCESS)
				goto array_err;
			IPQOSCDBG2(L0, "range: %u - %u\n", lower, upper);


			if (upper < lower) {
				uint32_t u = lower;
				lower = upper;
				upper = u;
			}

			/*
			 * check range valid for array size.
			 */
			if ((lower < 0) || (upper > arr_size)) {
				IPQOSCDBG0(L0, "Range out of array "
				    "dimensions\n");
				goto array_err;
			}

			/*
			 * add this value to array indexes within range.
			 */
			for (x = lower; x <= upper; x++)
				(*arrp)[x] = value;

			/*
			 * get next range.
			 */
			range = strtok_r(NULL, ",", &tmp);
		}

		entry = strtok(NULL, ";");
	}

	return (IPQOS_CONF_SUCCESS);

array_err:
	ipqos_msg(MT_ERROR,
	    gettext("Array declaration line %u is invalid.\n"), startln);
	free(*arrp);
	return (IPQOS_CONF_ERR);
}

static int
readllong(char *str, long long *llp, char **lo)
{

	*llp = strtoll(str, lo, 0);
	if (*lo == str) {
		return (IPQOS_CONF_ERR);
	}
	return (IPQOS_CONF_SUCCESS);
}

static int
readuint8(char *str, uint8_t *ui8, char **lo)
{

	long long tmp;

	if (readllong(str, &tmp, lo) != 0) {
		return (IPQOS_CONF_ERR);
	}
	if (tmp > UCHAR_MAX || tmp < 0) {
		return (IPQOS_CONF_ERR);
	}
	*ui8 = (uint8_t)tmp;
	return (IPQOS_CONF_SUCCESS);
}

static int
readuint16(char *str, uint16_t *ui16, char **lo)
{
	long long tmp;

	if (readllong(str, &tmp, lo) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}
	if (tmp > USHRT_MAX || tmp < 0) {
		return (IPQOS_CONF_ERR);
	}
	*ui16 = (uint16_t)tmp;
	return (IPQOS_CONF_SUCCESS);
}

static int
readint16(char *str, int16_t *i16, char **lo)
{
	long long tmp;

	if (readllong(str, &tmp, lo) != 0) {
		return (IPQOS_CONF_ERR);
	}
	if (tmp > SHRT_MAX || tmp < SHRT_MIN) {
		return (IPQOS_CONF_ERR);
	}
	*i16 = (int16_t)tmp;
	return (IPQOS_CONF_SUCCESS);
}

static int
readint32(char *str, int *i32, char **lo)
{
	long long tmp;

	if (readllong(str, &tmp, lo) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}
	if (tmp > INT_MAX || tmp < INT_MIN) {
		return (IPQOS_CONF_ERR);
	}
	*i32 = tmp;
	return (IPQOS_CONF_SUCCESS);
}

static int
readuint32(char *str, uint32_t *ui32, char **lo)
{
	long long tmp;

	if (readllong(str, &tmp, lo) != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}
	if (tmp > UINT_MAX || tmp < 0) {
		return (IPQOS_CONF_ERR);
	}
	*ui32 = (uint32_t)tmp;
	return (IPQOS_CONF_SUCCESS);
}

/*
 * retrieves the index associated with the interface named ifname and assigns
 * it to the int pointed to by ifindex.
 * RETURNS: IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
static int
readifindex(
char *ifname,
int *ifindex)
{

	int s;
	struct lifreq lifrq;


	/* open socket */

	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {
		ipqos_msg(MT_ENOSTR, gettext("opening AF_INET socket"));
		return (IPQOS_CONF_ERR);
	}

	/* copy ifname into lifreq */

	(void) strlcpy(lifrq.lifr_name, ifname, LIFNAMSIZ);

	/* do SIOGLIFINDEX ioctl */

	if (ioctl(s, SIOCGLIFINDEX, (caddr_t)&lifrq) == -1) {
		(void) close(s);
		return (IPQOS_CONF_ERR);
	}

	/* Warn if a virtual interface is specified */
	if ((ioctl(s, SIOCGLIFFLAGS, (caddr_t)&lifrq) != -1) &&
	    (lifrq.lifr_flags & IFF_VIRTUAL)) {
		ipqos_msg(MT_WARNING, gettext("Invalid interface"));
	}
	(void) close(s);
	*ifindex = lifrq.lifr_index;
	return (IPQOS_CONF_SUCCESS);
}

/*
 * Case insensitively compares the string in str with IPQOS_CONF_TRUE_STR
 * and IPQOS_CONF_FALSE_STR and sets boolean pointed to by bool accordingly.
 * RETURNS: if failure to match either IPQOS_CONF_ERR, else IPQOS_CONF_SUCCESS.
 */
static int
readbool(char *str, boolean_t *bool)
{

	if (strcasecmp(str, IPQOS_CONF_TRUE_STR) == 0) {
		*bool = B_TRUE;
	} else if (strcasecmp(str, IPQOS_CONF_FALSE_STR) == 0) {
		*bool = B_FALSE;
	} else {
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * reads a protocol name/number from proto_str and assigns the number
 * to the uint8 ref'd by proto.
 * RETURNS: If not a valid name or protocol number IPQOS_CONF_ERR, else
 * IPQOS_CONF_SUCCESS.
 */
static int
readproto(char *proto_str, uint8_t *proto)
{

	struct protoent *pent;
	char *lo;
	int res;

	IPQOSCDBG1(L1, "In readproto: string: %s\n", proto_str);

	/* try name lookup */

	pent = getprotobyname(proto_str);
	if (pent) {
		*proto = pent->p_proto;

	/* check valid protocol number */
	} else {
		res = readuint8(proto_str, proto, &lo);
		if (res != IPQOS_CONF_SUCCESS || proto == 0) {
			return (IPQOS_CONF_ERR);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * reads either a port service, or a port number from port_str and assigns
 * the associated port number to short ref'd by port.
 * RETURNS: If invalid name and number IPQOS_CONF_ERR, else IPQOS_CONF_SUCCESS.
 */
static int
readport(char *port_str, uint16_t *port)
{

	struct servent *sent;
	char *tmp;

	IPQOSCDBG1(L1, "In readport: string: %s\n", port_str);

	/* try service name lookup */
	sent = getservbyname(port_str, NULL);

	/* failed name lookup so read port number */
	if (sent == NULL) {
		if (readuint16(port_str, port, &tmp) != IPQOS_CONF_SUCCESS ||
		    *port == 0) {
			return (IPQOS_CONF_ERR);
		}
		*port = htons(*port);
	} else {
		*port = sent->s_port;
	}

	return (IPQOS_CONF_SUCCESS);
}


/*
 * Reads a curly brace, a string enclosed in double quotes, or a whitespace/
 * curly brace delimited string. If a double quote enclosed string the
 * closing quotes need to be on the same line.
 * RETURNS:
 * on reading a CURL_BEGIN token it returns IPQOS_CONF_CURL_BEGIN,
 * on reading a CURL_END token it returns IPQOS_CONF_CURL_END,
 * on reading another valid token it returns IPQOS_CONF_SUCCESS.
 * for each of these token is set to point at the read string.
 * at EOF it returns IPQOS_CONF_EOF and if errors it returns IPQOS_CONF_ERR.
 */
static int
readtoken(
FILE *fp,
char **token)
{

	char *st, *tmp;
	int len;
	int quoted = 0;
	char *cmnt;
	char *bpos;
	int rembuf;

	static char *lo;
	static char *buf = NULL;
	static int bufsize;

	/* if first call initialize line buf to default size */

	if (buf == NULL) {
		bufsize = IPQOS_CONF_LINEBUF_SZ;
		buf = malloc(bufsize);
		if (buf == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			return (IPQOS_CONF_ERR);
		}
	}

	/* set buffer postition and size to use whole buffer */

	bpos = buf;
	rembuf = bufsize;


	/*
	 * loop reading lines until we've read a line with a non-whitespace
	 * char.
	 */

	do {
		/* if no leftover from previous invocation */

		if (lo == NULL) {

			/*
			 * loop reading into buffer doubling if necessary until
			 * we have either read a complete line or reached the
			 * end of file.
			 */
			for (;;) {
				st = fgets(bpos, rembuf, fp);

				if (st == NULL) {

					/* if read error */
					if (ferror(fp)) {
						free(buf);
						buf = NULL;
						ipqos_msg(MT_ENOSTR,
						    "fgets");
						return (IPQOS_CONF_ERR);

					/* end of file */
					} else {
						free(buf);
						buf = NULL;
						*token = NULL;
						return (IPQOS_CONF_EOF);
					}
				} else {
					/* if read a newline */

					if (buf[strlen(buf) - 1] == '\n') {
						lineno++;
						break;

					/* if read the last line */

					} else if (feof(fp)) {
						break;

					/*
					 * not read a full line so buffer size
					 * is too small, double it and retry.
					 */
					} else {
						bufsize *= 2;
						tmp = realloc(buf, bufsize);
						if (tmp == NULL) {
							ipqos_msg(MT_ENOSTR,
							    "realloc");
							free(buf);
							return (IPQOS_CONF_ERR);
						} else {
							buf = tmp;
						}

						/*
						 * make parameters to fgets read
						 * into centre of doubled buffer
						 * so we retain what we've
						 * already read.
						 */
						bpos = &buf[(bufsize / 2) - 1];
						rembuf = (bufsize / 2) + 1;
					}
				}
			}

			st = buf;

		/* previous leftover, assign to st */

		} else {
			st = lo;
			lo = NULL;
		}

		/* truncate at comment */

		cmnt = strchr(st, '#');
		if (cmnt) {
			*cmnt = '\0';
		}

		/* Skip any whitespace */

		while (isspace(*st) && *st != '\0') {
			st++;
		}

	} while (*st == '\0');


	/* find end of token */

	tmp = st;

	/* if curl advance 1 char */

	if (*tmp == CURL_BEGIN || *tmp == CURL_END) {
		tmp++;


	/* if dbl quote read until matching quote */

	} else if (*tmp == '"') {
		quoted++;
		tmp = ++st;

		while (*tmp != '"' && *tmp != '\n' && *tmp != '\0') {
			tmp++;
		}
		if (*tmp != '"') {
			ipqos_msg(MT_ERROR, gettext("Quoted string exceeds "
			    "line, line %u.\n"), lineno);
			free(buf);
			return (IPQOS_CONF_ERR);
		}

	/* normal token */
	} else {
		/* find first whitespace, curl, newline or string end */

		while (!isspace(*tmp) && *tmp != CURL_BEGIN &&
		    *tmp != CURL_END && *tmp != '\n' && *tmp != '\0') {
			tmp++;
		}
	}

	/* copy token to return */
	len = tmp - st;
	*token = malloc(len + 1);
	if (!*token) {
		free(buf);
		ipqos_msg(MT_ENOSTR, "malloc");
		return (IPQOS_CONF_ERR);
	}
	bcopy(st, *token, len);
	(*token)[len] = '\0';

	/* if just read quoted string remove quote from remaining string */

	if (quoted) {
		tmp++;
	}

	/* if not end of string, store rest for latter parsing */

	if (*tmp != '\0' && *tmp != '\n') {
		lo = tmp;
	}

	/* for curl_end and curl_begin return special ret codes */

	if ((*token)[1] == '\0') {
		if (**token == CURL_BEGIN) {
			return (IPQOS_CONF_CURL_BEGIN);
		} else if (**token == CURL_END) {
			return (IPQOS_CONF_CURL_END);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Reads an enumeration bitmask definition from line. The format is:
 * { NAME=VAL, NAME2=VAL2 }. The resulting names and values are returned.
 * RETURNS: NULL on error, else ptr to name/values.
 */
static str_val_nd_t *
read_enum_nvs(char *line, char *module_name)
{

	str_val_nd_t *enum_vals = NULL;
	char *cp;
	char *start;
	char *name = NULL;
	int len;
	uint32_t val;
	int ret;
	int readc;

	IPQOSCDBG1(L1, "In read_enum_nvs, line: %s\n", line);

	/* read opening brace */

	cp = strchr(line, CURL_BEGIN);
	if (cp == NULL) {
		IPQOSCDBG0(L1, "missing curl begin\n");
		goto fail;
	} else {
		start = cp + 1;
	}

	/*
	 * loop reading 'name = value' entrys seperated by comma until
	 * reach closing brace.
	 */

	for (;;) {
		SKIPWS(start);
		if (*start == '\0') {
			IPQOSCDBG0(L1, "missing closing bracket\n");
			goto fail;
		}

		/*
		 * read name - read until whitespace, '=', closing curl,
		 * or string end.
		 */

		for (cp = start;
		    !isspace(*cp) && *cp != '=' && *cp != CURL_END &&
		    *cp != '\0'; cp++) {}

		if (*cp == '\0') {
			IPQOSCDBG0(L1, "Unexpected line end in enum def'n\n");
			goto fail;

		/* finished definition, exit loop */
		} else if (*cp == CURL_END) {
			break;
		}

		/* store name */

		len = cp - start;
		name = malloc(len + 1);
		if (name == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			goto fail;
		}
		bcopy(start, name, len);
		name[len] = NULL;
		IPQOSCDBG1(L0, "Stored name: %s\n", name);

		/* read assignment */

		start = strchr(cp, '=');
		if (start == NULL) {
			IPQOSCDBG0(L1, "Missing = in enum def'n\n");
			goto fail;
		}

		/* read value */

		ret = sscanf(++start, "%x%n", &val, &readc);
		if (ret != 1) {
			IPQOSCDBG1(L1, "sscanf of value failed, string: %s\n",
			    cp);
			goto fail;
		}

		/* add name value to set */

		ret = add_str_val_entry(&enum_vals, name, val);
		if (ret != IPQOS_CONF_SUCCESS) {
			IPQOSCDBG0(L1, "Failed to add str_val entry\n");
			goto fail;
		}
		free(name);
		name = NULL;

		/* try reading comma */
		cp = strchr(start, ',');

		if (cp != NULL) {
			start = cp + 1;

		/* no comma, advance to char past value last read */
		} else {
			start += readc;
		}
	}

	return (enum_vals);
fail:
	free_str_val_entrys(enum_vals);
	if (name != NULL)
		free(name);

	/* if a parse error */

	if (errno == 0) {
		ipqos_msg(MT_ERROR, gettext("Types file for module %s is "
		    "corrupt.\n"), module_name);
	}

	return (NULL);
}

/*
 * Given mapped_list with is a comma seperated list of map names, and value,
 * which is used to index into these maps, the function creates x new entries
 * in nvpp, where x is the number of map names specified. Each of these
 * entries has the value from the map in the position indexed by value and
 * with name module.${MAP_NAME}. The maps are contained in the modules config
 * file and have the form:
 * map map1 uint32 1,23,32,45,3
 * As you can see the map values are uint32, and along with uint8 are the
 * only supported types at the moment.
 *
 * RETURNS: IPQOS_CONF_ERR if one of the maps specified in mapped_list
 * doesn't exist, if value is not a valid map position for a map, or if
 * there's a resource failure. otherwise IPQOS_CONF_SUCCESS is returned.
 */
static int
read_mapped_values(
FILE *tfp,
nvlist_t **nvlp,
char *module,
char *mapped_list,
int value)
{
	char *map_name, *lastparam, *tmpname;
	int res;
	ipqos_nvtype_t type;
	char dfltst[IPQOS_VALST_MAXLEN+1] = "";
	str_val_nd_t *enum_nvs;
	place_t place;

	IPQOSCDBG0(L1, "In read_mapped_values\n");

	map_name = (char *)strtok_r(mapped_list, ",", &lastparam);
	while (map_name != NULL) {
		char *tokval, *lastval;
		int index = 0;

		/*
		 * get map info from types file.
		 */
		place = PL_MAP;
		res = readtype(tfp, module, map_name, &type, &enum_nvs,
		    dfltst, B_FALSE, &place);
		if (res != IPQOS_CONF_SUCCESS) {
			return (IPQOS_CONF_ERR);
		}

		/*
		 * Just keep browsing the list till we get to the element
		 * with the index from the value parameter or the end.
		 */
		tokval = (char *)strtok_r(dfltst, ",", &lastval);
		for (;;) {
			if (tokval == NULL) {
				ipqos_msg(MT_ERROR,
				    gettext("Invalid value, %u, line %u.\n"),
				    value, lineno);
				return (IPQOS_CONF_ERR);
			}
			if (index++ == value) {
				break;
			}
			tokval = (char *)strtok_r(NULL, ",", &lastval);
		}


		/*
		 * create fully qualified parameter name for map value.
		 */
		tmpname = prepend_module_name(map_name, module);
		if (tmpname == NULL) {
			return (IPQOS_CONF_ERR);
		}

		/*
		 * add map value with fqn to parameter nvlist.
		 */
		IPQOSCDBG2(L0, "Adding map %s, value %u to nvlist\n",
		    tmpname, atoi(tokval));
		switch (type) {
			case IPQOS_DATA_TYPE_UINT8: {
				res = nvlist_add_byte(*nvlp, tmpname,
				    (uint8_t)atoi(tokval));
				if (res != 0)  {
					free(tmpname);
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint8");
					return (IPQOS_CONF_ERR);
				}
				break;
			}
			case IPQOS_DATA_TYPE_UINT32: {
				res = nvlist_add_uint32(*nvlp, tmpname,
				    (uint32_t)atoi(tokval));
				if (res != 0)  {
					free(tmpname);
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32");
					return (IPQOS_CONF_ERR);
				}
				break;
			}
			default: {
				ipqos_msg(MT_ERROR,
				    gettext("Types file for module %s is "
				    "corrupt.\n"), module);
				IPQOSCDBG1(L0, "Unsupported map type for "
				    "parameter %s given in types file.\n",
				    map_name);
				return (IPQOS_CONF_ERR);
			}
		}
		free(tmpname);

		map_name = (char *)strtok_r(NULL, ",", &lastparam);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Parses the string info_str into it's components. Its format is:
 * SIZE','[ENUM_DEF | RANGE], where SIZE is the size of the array,
 * ENUM_DEF is the definition of the enumeration for this array,
 * and RANGE is the set of values this array can accept. In
 * the event this array has an enumeration definition enum_nvs is
 * set to point at a str_val_nd_t structure which stores the names
 * and values associated with this enumeration. Otherwise, if this
 * is not an enumerated array, lower and upper are set to the lower
 * and upper values of RANGE.
 * RETURNS: IPQOS_CONF_ERR due to unexpected parse errors, else
 * IPQOS_CONF_SUCCESS.
 */
static int
read_int_array_info(
char *info_str,
str_val_nd_t **enum_nvs,
uint32_t *size,
int *lower,
int *upper,
char *module)
{
	int res;
	char *end;
	char *token;
	char *tmp;

	IPQOSCDBG1(L0, "In read_array_info: info_str: %s\n",
	    (info_str != NULL) ? info_str : "NULL");

	if (info_str == NULL) {
		IPQOSCDBG0(L0, "Null info string\n");
		goto fail;
	}

	/*
	 * read size.
	 */
	token = strtok(info_str, ",");
	*size = (uint32_t)strtol(token, &end, 10);
	SKIPWS(end);
	if ((end == token) || (*end != NULL)) {
		IPQOSCDBG0(L0, "Invalid size\n");
		goto fail;
	}
	IPQOSCDBG1(L0, "read size: %u\n", *size);

	/*
	 * check we have another string.
	 */
	token = strtok(NULL, "\n");
	if (token == NULL) {
		IPQOSCDBG0(L0, "Missing range/enum def\n");
		goto fail;
	}
	IPQOSCDBG1(L0, "range/enum def: %s\n", token);

	/*
	 * check if enumeration set or integer set and read enumeration
	 * definition or integer range respectively.
	 */
	tmp = strchr(token, CURL_BEGIN);
	if (tmp == NULL) {	/* a numeric range */
		res = readrange(token, lower, upper);
		if (res != IPQOS_CONF_SUCCESS) {
			IPQOSCDBG0(L0, "Failed reading range\n");
			goto fail;
		}
	} else {		/* an enumeration */
		*enum_nvs = read_enum_nvs(token, module);
		if (*enum_nvs == NULL) {
			IPQOSCDBG0(L0, "Failed reading enum def\n");
			goto fail;
		}
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	ipqos_msg(MT_ERROR,
	    gettext("Types file for module %s is corrupt.\n"), module);
	return (IPQOS_CONF_ERR);
}

/*
 * reads the value of an enumeration parameter from first_token and fp.
 * first_token is the first token of the value.
 * The format expected is NAME | { NAME1 [, NAME2 ] [, NAME3 ]  }.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
read_enum_value(
FILE *fp,
char *first_token,
str_val_nd_t *enum_vals,
uint32_t *val)
{

	uint32_t u32;
	int ret;
	char *tk;
	char *lo = NULL;
	char *cm;
	int name_expected = 0;

	IPQOSCDBG0(L1, "In read_enum_value\n");

	/* init param val */
	*val = 0;

	/* first token not curl_begin, so lookup its value */

	if (*first_token != CURL_BEGIN) {
		ret = str_val_list_lookup(enum_vals, first_token, val);
		if (ret != IPQOS_CONF_SUCCESS) {
			ipqos_msg(MT_ERROR,
			    gettext("Unrecognized value, %s, line %u.\n"),
			    first_token, lineno);
			return (ret);
		}

	/* curl_begin, so read values till curl_end, dicing at ',' */
	} else {

		name_expected++;

		for (;;) {

			/*
			 * no leftover from pervious iteration so read new
			 * token. This leftover happens because readtoken
			 * doesn't interpret comma's as special characters
			 * and thus could return 'val1,val2' as one token.
			 * If this happens the val1 will be used in the
			 * current iteration and what follows saved in lo
			 * for processing by successive iterations.
			 */

			if (lo == NULL) {
				ret = readtoken(fp, &tk);
				if (ret == IPQOS_CONF_ERR) {
					return (ret);
				} else if (ret == IPQOS_CONF_EOF) {
					ipqos_msg(MT_ERROR,
					    gettext("Unexpected EOF.\n"));
					return (IPQOS_CONF_ERR);

				}
			} else {	/* previous leftover, so use it */

				IPQOSCDBG1(L1, "Using leftover %s.\n", lo);
				tk = lo;
				lo = NULL;
			}

			if (name_expected) {
				if (ret == IPQOS_CONF_CURL_END ||
				    tk[0] == ',') {
					ipqos_msg(MT_ERROR,
					    gettext("Malformed value list "
					    "line %u.\n"), lineno);
					free(tk);
					return (IPQOS_CONF_ERR);
				}

				/*
				 * check if this token contains a ',' and
				 * if so store it and what follows for next
				 * iteration.
				 */
				cm = strchr(tk, ',');
				if (cm != NULL) {
					lo = malloc(strlen(cm) + 1);
					if (lo == NULL) {
						ipqos_msg(MT_ENOSTR, "malloc");
						free(tk);
						return (IPQOS_CONF_ERR);
					}

					(void) strcpy(lo, cm);
					*cm = '\0';
				}


				/* get name value and add to total val */

				ret = str_val_list_lookup(enum_vals, tk, &u32);
				if (ret != IPQOS_CONF_SUCCESS) {
					ipqos_msg(MT_ERROR,
					    gettext("Unrecognized value, %s, "
					    "line %u.\n"), tk, lineno);
					free(tk);
					return (IPQOS_CONF_ERR);
				}

				*val = *val | u32;
				name_expected--;

			/* comma or curl end accepted */
			} else {

				/* we've reached curl_end so break */

				if (ret == IPQOS_CONF_CURL_END) {
					free(tk);
					break;

				/* not curl end and not comma */

				} else if (tk[0] != ',') {
					ipqos_msg(MT_ERROR,
					    gettext("Malformed value list "
					    "line %u.\n"), lineno);
					free(tk);
					return (IPQOS_CONF_ERR);
				}

				/*
				 * store anything after the comma for next
				 * iteration.
				 */
				if (tk[1] != '\0') {
					lo = malloc(strlen(&tk[1]) + 1);
					if (lo == NULL) {
						ipqos_msg(MT_ENOSTR, "malloc");
						free(tk);
						return (IPQOS_CONF_ERR);
					}
					(void) strcpy(lo, &tk[1]);
				}

				name_expected++;
			}

			free(tk);
		}
	}

	IPQOSCDBG1(L1, "value returned is: %u\n", *val);

	return (IPQOS_CONF_SUCCESS);
}

/*
 * read the set of permanent classes/filter from the types file ref'd by tfp
 * and store them in a string table pointed to by perm_items,
 * with *nitems getting set to number of items read. perm_filters is set
 * to 1 if we're searching for permanent filters, else 0 for classes.
 * RETURNS: IPQOS_CONF_ERR if any errors, else IPQOS_CONF_SUCCESS.
 */
static int
read_perm_items(
int perm_filters,
FILE *tfp,
char *module_name,
char ***perm_items,
int *nitems)
{

	char lbuf[IPQOS_CONF_TYPE_LINE_LEN];
	int cnt = 0;
	char name[IPQOS_CONF_NAME_LEN+1];
	char foo[IPQOS_CONF_NAME_LEN+1];
	int res;
	char **items = NULL;
	char **tmp;
	char *marker;

	IPQOSCDBG0(L1, "In read_perm_items\n");


	/* seek to start of types file */

	if (fseek(tfp, 0, SEEK_SET) != 0) {
		ipqos_msg(MT_ENOSTR, "fseek");
		return (IPQOS_CONF_ERR);
	}

	/* select which marker were looking for */

	if (perm_filters) {
		marker = IPQOS_CONF_PERM_FILTER_MK;
	} else {
		marker = IPQOS_CONF_PERM_CLASS_MK;
	}

	/* scan file line by line till end */

	while (fgets(lbuf, IPQOS_CONF_TYPE_LINE_LEN, tfp) != NULL) {

		/*
		 * if the line is marked as containing a default item name
		 * read the name, extend the items string array
		 * and store the string off the array.
		 */
		if (strncmp(lbuf, marker, strlen(marker)) == 0) {

			res = sscanf(lbuf,
			    "%" VAL2STR(IPQOS_CONF_NAME_LEN) "s"
			    "%" VAL2STR(IPQOS_CONF_NAME_LEN) "s",
			    foo, name);
			if (res < 2) {
				ipqos_msg(MT_ERROR,
				    gettext("Types file for module %s is "
				    "corrupt.\n"), module_name);
				IPQOSCDBG1(L0, "Missing name with a %s.\n",
				    marker);
				goto fail;
			}

			/* extend items array to accomodate new item */

			tmp = realloc(items, (cnt + 1) * sizeof (char *));
			if (tmp == NULL) {
				ipqos_msg(MT_ENOSTR, "realloc");
				goto fail;
			} else {
				items = tmp;
			}

			/* copy and store item name */

			items[cnt] = malloc(strlen(name) + 1);
			if (items[cnt] == NULL) {
				ipqos_msg(MT_ENOSTR, "malloc");
				goto fail;
			}

			(void) strcpy(items[cnt], name);
			cnt++;


			IPQOSCDBG1(L1, "stored %s in perm items array\n",
			    name);
		}
	}

	*perm_items = items;
	*nitems = cnt;

	return (IPQOS_CONF_SUCCESS);
fail:
	for (cnt--; cnt >= 0; cnt--)
		free(items[cnt]);
	free(items);
	return (IPQOS_CONF_ERR);
}

/*
 * Searches types file ref'd by tfp for the parameter named name
 * with the place corresponding with place parameter. The format
 * of the lines in the file are:
 * PLACE NAME TYPE [ ENUM_DEF ] [ DEFAULT_STR ]
 * The ENUM_DEF is an enumeration definition and is only present
 * for parameters of type enum. DEFAULT_STR is a default value for
 * this parameter. If present type is set to the appropriate type
 * enumeration and dfltst filled with DEFAULT_STR if one was set.
 * Also if the type is enum enum_nvps is made to point at a
 * set of name value pairs representing ENUM_DEF.
 *
 * RETURNS: If any resource errors occur, or a matching parameter
 * isn't found IPQOS_CONF_ERR is returned, else IPQOS_CONF_SUCCESS.
 */
static int
readtype(
FILE *tfp,
char *module_name,
char *name,
ipqos_nvtype_t *type,
str_val_nd_t **enum_nvps,
char *dfltst,
boolean_t allow_ipgpc_priv,
place_t *place)
{

	int ac;
	char lbuf[IPQOS_CONF_TYPE_LINE_LEN];
	char param[IPQOS_CONF_PNAME_LEN+1];
	char typest[IPQOS_CONF_TYPE_LEN+1];
	char place_st[IPQOS_CONF_TYPE_LEN+1];
	char *cp;
	int x;
	char *ipgpc_nm;
	int found = 0;

	IPQOSCDBG1(L1, "In readtype: param: %s\n", name);


	/*
	 * if allow_ipgpc_priv is true then we allow ipgpc parameters that are
	 * private between ipqosconf and ipgpc. eg. address masks, port masks.
	 */
	if (allow_ipgpc_priv && strcmp(module_name, IPGPC_NAME) == 0) {
		ipgpc_nm = prepend_module_name(name, IPGPC_NAME);
		if (ipgpc_nm == NULL) {
			return (IPQOS_CONF_ERR);
		}

		if (strcmp(ipgpc_nm, IPGPC_SADDR_MASK) == 0 ||
		    strcmp(ipgpc_nm, IPGPC_DADDR_MASK) == 0) {
			*type = IPQOS_DATA_TYPE_ADDRESS_MASK;
			return (IPQOS_CONF_SUCCESS);
		} else if (strcmp(ipgpc_nm, IPGPC_SPORT_MASK) == 0 ||
		    strcmp(ipgpc_nm, IPGPC_DPORT_MASK) == 0) {
			*type = IPQOS_DATA_TYPE_UINT16;
			return (IPQOS_CONF_SUCCESS);
		} else if (strcmp(ipgpc_nm, IPGPC_FILTER_TYPE) == 0) {
			*type = IPQOS_DATA_TYPE_UINT32;
			return (IPQOS_CONF_SUCCESS);
		} else if (strcmp(ipgpc_nm, IPGPC_IF_INDEX) == 0) {
			*type = IPQOS_DATA_TYPE_IFINDEX;
			return (IPQOS_CONF_SUCCESS);
		}

		free(ipgpc_nm);
	}

	/*
	 * read upto and including module version line.
	 */
	if (read_tfile_ver(tfp, IPQOS_MOD_STR, module_name) == -1)
		return (IPQOS_CONF_ERR);


	/*
	 * loop reading lines of the types file until named parameter
	 * found or EOF.
	 */
	while (fgets(lbuf, IPQOS_CONF_TYPE_LINE_LEN, tfp) != NULL) {

		/*
		 * check whether blank or commented line; if so skip
		 */
		for (cp = lbuf; isspace(*cp) && *cp != '\0'; cp++) {}
		if (*cp == '\0' || *cp == '#') {
			continue;
		}

		dfltst[0] = '\0';

		/*
		 * read place, param, type and if present default str
		 * from line.
		 */
		ac = sscanf(lbuf,
		    "%" VAL2STR(IPQOS_CONF_TYPE_LEN) "s "
		    "%" VAL2STR(IPQOS_CONF_PNAME_LEN) "s "
		    "%" VAL2STR(IPQOS_CONF_TYPE_LEN) "s "
		    "%" VAL2STR(IPQOS_VALST_MAXLEN) "s",
		    place_st, param, typest, dfltst);
		if (ac < 3) {
			ipqos_msg(MT_ERROR,
			    gettext("Types file for module %s is corrupt.\n"),
			    module_name);
			IPQOSCDBG0(L0, "sscanf failed to read 3 strings.\n");
			return (IPQOS_CONF_ERR);
		}

		/*
		 * if the place and name match no need to look any further.
		 */
		if ((*place == PL_ANY) ||
		    ((*place == PL_PARAMS) &&
		    strcmp(place_st, IPQOS_PLACE_PRM_STR) == 0) ||
		    ((*place == PL_FILTER) &&
		    strcmp(place_st, IPQOS_PLACE_FILTER_STR) == 0) ||
		    ((*place == PL_MAP) &&
		    strcmp(place_st, IPQOS_PLACE_MAP_STR) == 0)) {
			if (strcmp(param, name) == 0) {
				found++;
				break;
			}
		}
	}
	if (found == 0) {
		ipqos_msg(MT_ERROR,
		    gettext("Invalid parameter, %s, line %u.\n"), name,
		    lineno);
		return (IPQOS_CONF_ERR);
	}

	/*
	 * set the place parameter to the actual place when the PL_ANY flag
	 * was set.
	 */
	if (*place == PL_ANY) {
		if (strcmp(place_st, IPQOS_PLACE_PRM_STR) == 0) {
			*place = PL_PARAMS;
		} else if (strcmp(place_st, IPQOS_PLACE_FILTER_STR) == 0) {
			*place = PL_FILTER;
		} else if (strcmp(place_st, IPQOS_PLACE_MAP_STR) == 0) {
			*place = PL_MAP;
		}
	}

	/*
	 * get type enumeration
	 */
	for (x = 0; nv_types[x].string[0]; x++) {
		if (strcmp(nv_types[x].string, typest) == 0) {
			break;
		}
	}
	/*
	 * check that we have a type corresponding with the one the types
	 * file specifies.
	 */
	if (nv_types[x].string[0] == '\0') {
		ipqos_msg(MT_ERROR,
		    gettext("Types file for module %s is corrupt.\n"),
		    module_name);
		return (IPQOS_CONF_ERR);
	}
	*type = nv_types[x].value;

	/*
	 * if enumeration type get set of name/vals and any default value
	 */
	if (*type == IPQOS_DATA_TYPE_ENUM) {
		*enum_nvps = read_enum_nvs(lbuf, module_name);
		if (*enum_nvps == NULL) {
			return (IPQOS_CONF_ERR);
		}

		dfltst[0] = '\0';
		cp = strchr(lbuf, CURL_END);
		(void) sscanf(++cp,
		    "%" VAL2STR(IPQOS_VALST_MAXLEN) "s", dfltst);
	}


	IPQOSCDBG2(L1, "read type: %s default: %s\n", nv_types[x].string,
	    *dfltst ? dfltst : "None");
	return (IPQOS_CONF_SUCCESS);
}


/*
 * Reads a name and a value from file ref'd by cfp into list indirectly
 * ref'd by nvlp; If this list is NULL it will be created to accomodate
 * the name/value. The name must be either a special token for
 * for the place, or be present in the module types file ref'd by tfp.
 * *type is set to the enumeration of the type of the parameter and
 * nvp to point at the element with the nvlp ref'd list.
 * RETURNS: IPQOS_CONF_CURL_END if read CURL_END as name,
 * IPQOS_CONF_ERR on errors, else IPQOS_CONF_SUCCESS.
 */
static int
readnvpair(
FILE *cfp,
FILE *tfp,
nvlist_t **nvlp,
nvpair_t **nvp,
ipqos_nvtype_t *type,
place_t place,
char *module_name)
{

	char *name = NULL;
	char *valst = NULL;
	int res;
	char *tmp;
	str_val_nd_t *enum_nvs = NULL;
	char dfltst[IPQOS_VALST_MAXLEN+1];

	IPQOSCDBG0(L1, "in readnvpair\n");

	/*
	 * read nvpair name
	 */
	res = readtoken(cfp, &name);

	/*
	 * if reached eof, curl end or error encountered return to caller
	 */
	if (res == IPQOS_CONF_EOF) {
		ipqos_msg(MT_ERROR, gettext("Unexpected EOF.\n"));
		return (IPQOS_CONF_ERR);
	} else if (res == IPQOS_CONF_ERR) {
		return (res);
	} else if (res == IPQOS_CONF_CURL_END) {
		free(name);
		return (res);
	}

	/*
	 * read nvpair value
	 */
	res = readtoken(cfp, &valst);

	/*
	 * check we've read a valid value
	 */
	if (res != IPQOS_CONF_SUCCESS && res != IPQOS_CONF_CURL_BEGIN) {
		if (res == IPQOS_CONF_EOF) {
			ipqos_msg(MT_ERROR, gettext("Unexpected EOF.\n"));
		} else if (res == IPQOS_CONF_CURL_END) {
			ipqos_msg(MT_ERROR,
			    gettext("Missing parameter value line %u.\n"),
			    lineno);
			free(valst);
		}	/* we do nothing special for IPQOS_CONF_ERR */
		free(name);
		return (IPQOS_CONF_ERR);
	}

	/*
	 * check for generic parameters.
	 */

	if ((place == PL_CLASS) &&
	    strcmp(name, IPQOS_CONF_NEXT_ACTION_STR) == 0) {
		*type = IPQOS_DATA_TYPE_ACTION;

	} else if (place == PL_PARAMS &&
	    strcmp(name, IPQOS_CONF_GLOBAL_STATS_STR) == 0 ||
	    place == PL_CLASS &&
	    strcmp(name, IPQOS_CONF_STATS_ENABLE_STR) == 0) {
		*type = IPQOS_DATA_TYPE_BOOLEAN;

	} else if (tfp == NULL ||
	    ((place != PL_PARAMS) && strcmp(name, IPQOS_CONF_NAME_STR) == 0) ||
	    (place == PL_FILTER) && (strcmp(name, IPQOS_CONF_CLASS_STR) ==
	    0) ||
	    (place == PL_ACTION) && (strcmp(name, IPQOS_CONF_MODULE_STR) ==
	    0)) {
		*type = IPQOS_DATA_TYPE_STRING;

	} else {	/* if not generic parameter */
		/*
		 * get type from types file
		 */
		if (readtype(tfp, module_name, name, type, &enum_nvs, dfltst,
		    B_FALSE, &place) != IPQOS_CONF_SUCCESS) {
			free(name);
			free(valst);
			return (IPQOS_CONF_ERR);
		}

		/*
		 * get full module prefix parameter name
		 */
		tmp = name;
		if ((name = prepend_module_name(name, module_name)) == NULL) {
			name = tmp;
			goto fail;
		}
		free(tmp);
	}

	IPQOSCDBG3(L1, "NVP, name: %s, str_value: %s, type: %s\n", name,
	    valst, nv_types[*type].string);


	/*
	 * create nvlist if not present already
	 */
	if (*nvlp == NULL) {
		res = nvlist_alloc(nvlp, NV_UNIQUE_NAME, 0);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_alloc");
			free(name);
			free(valst);
			return (IPQOS_CONF_ERR);
		}
	}

	/*
	 * check we haven't already read this parameter
	 */
	if (find_nvpair(*nvlp, name)) {
		ipqos_msg(MT_ERROR, gettext("Duplicate parameter line %u.\n"),
		    lineno);
		goto fail;
	}

	/*
	 * convert value string to appropriate type and add to nvlist
	 */

	switch (*type) {
		case IPQOS_DATA_TYPE_IFNAME: {
			uint32_t ifidx;

			res = readifindex(valst, (int *)&ifidx);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_uint32(*nvlp, IPGPC_IF_INDEX,
				    ifidx);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32");
					goto fail;
				}
				(void) nvlist_remove_all(*nvlp, name);
				/*
				 * change name to point at the name of the
				 * new ifindex nvlist entry as name is used
				 * later in the function.
				 */
				free(name);
				name = malloc(strlen(IPGPC_IF_INDEX) + 1);
				if (name == NULL) {
					ipqos_msg(MT_ENOSTR, "malloc");
					goto fail;
				}
				(void) strcpy(name, IPGPC_IF_INDEX);
			}
			break;
		}
		case IPQOS_DATA_TYPE_PROTO: {
			uint8_t proto;

			res = readproto(valst, &proto);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_byte(*nvlp, name, proto);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_PORT: {
			uint16_t port;

			res = readport(valst, &port);
			if (res == IPQOS_CONF_SUCCESS) {

				/* add port */

				res = nvlist_add_uint16(*nvlp, name, port);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint16");
					goto fail;
				}

				/* add appropriate all ones port mask */

				if (strcmp(name, IPGPC_DPORT) == 0) {
					res = nvlist_add_uint16(*nvlp,
					    IPGPC_DPORT_MASK, ~0);

				} else if (strcmp(name, IPGPC_SPORT) == 0) {
					res = nvlist_add_uint16(*nvlp,
					    IPGPC_SPORT_MASK, ~0);
				}
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint16");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_ADDRESS:
		case IPQOS_DATA_TYPE_ACTION:
		case IPQOS_DATA_TYPE_STRING:
			res = nvlist_add_string(*nvlp, name, valst);
			if (res != 0) {
				ipqos_msg(MT_ENOSTR, "nvlist_add_string");
				goto fail;
			}
			break;
		case IPQOS_DATA_TYPE_BOOLEAN: {
			boolean_t b;

			res = readbool(valst, &b);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_uint32(*nvlp, name,
				    (uint32_t)b);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_UINT8: {
			uint8_t u8;

			res = readuint8(valst, &u8, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_byte(*nvlp, name, u8);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_INT16: {
			int16_t i16;

			res = readint16(valst, &i16, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_int16(*nvlp, name, i16);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_int16");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_UINT16: {
			uint16_t u16;

			res = readuint16(valst, &u16, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_uint16(*nvlp, name, u16);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_int16");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_INT32: {
			int i32;

			res = readint32(valst, &i32, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_int32(*nvlp, name, i32);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_int32");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_UINT32: {
			uint32_t u32;

			res = readuint32(valst, &u32, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_uint32(*nvlp, name, u32);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32");
					goto fail;
				}
			}
			break;
		}
		case IPQOS_DATA_TYPE_ENUM: {
			uint32_t val;

			res = read_enum_value(cfp, valst, enum_nvs, &val);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_uint32(*nvlp, name, val);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32");
					goto fail;
				}
			} else {
				goto fail;
			}
			break;
		}
		/*
		 * For now the dfltst contains a comma separated list of the
		 * type we need this parameter to be mapped to.
		 * read_mapped_values will fill in all the mapped parameters
		 * and their values in the nvlist.
		 */
		case IPQOS_DATA_TYPE_M_INDEX: {
			uint8_t u8;

			res = readuint8(valst, &u8, &tmp);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_byte(*nvlp, name, u8);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint8");
					goto fail;
				}
			} else {
				*type = IPQOS_DATA_TYPE_UINT8;
				break;
			}
			res = read_mapped_values(tfp, nvlp, module_name,
			    dfltst, u8);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
			break;
		}
		case IPQOS_DATA_TYPE_INT_ARRAY: {
			str_val_nd_t *arr_enum_nvs = NULL;
			uint32_t size;
			int llimit = 0, ulimit = 0;
			int *arr;

			/*
			 * read array info from types file.
			 */
			res = read_int_array_info(dfltst, &arr_enum_nvs, &size,
			    &llimit, &ulimit, module_name);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			/*
			 * read array contents from config file and construct
			 * array with them.
			 */
			res = read_int_array(cfp, valst, &arr, size, llimit,
			    ulimit, arr_enum_nvs);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			/*
			 * add array to nvlist.
			 */
			res = nvlist_add_int32_array(*nvlp, name, arr, size);
			if (res != 0) {
				ipqos_msg(MT_ENOSTR, "nvlist_add_int32");
				goto fail;
			}

			/*
			 * free uneeded resources.
			 */
			free(arr);
			if (arr_enum_nvs)
				free_str_val_entrys(arr_enum_nvs);

			break;
		}
		case IPQOS_DATA_TYPE_USER: {
			uid_t uid;

			res = readuser(valst, &uid);
			if (res == IPQOS_CONF_SUCCESS) {
				res = nvlist_add_int32(*nvlp, name, (int)uid);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_int32");
					goto fail;
				}
			}
			break;
		}
#ifdef	_IPQOS_CONF_DEBUG
		default: {
			/*
			 * we shouldn't have a type that doesn't have a switch
			 * entry.
			 */
			assert(1);
		}
#endif
	}
	if (res != 0) {
		ipqos_msg(MT_ERROR, gettext("Invalid %s, line %u.\n"),
		    nv_types[*type].string, lineno);
		goto fail;
	}

	/* set the nvp parameter to point at the newly added nvlist entry */

	*nvp = find_nvpair(*nvlp, name);

	free(name);
	free(valst);
	if (enum_nvs)
		free_str_val_entrys(enum_nvs);
	return (IPQOS_CONF_SUCCESS);
fail:
	if (name != NULL)
		free(name);
	if (valst != NULL)
		free(valst);
	if (enum_nvs != NULL)
		free_str_val_entrys(enum_nvs);
	return (IPQOS_CONF_ERR);
}

/*
 * read a parameter clause from cfp into *params.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
readparams(
FILE *cfp,
FILE *tfp,
char *module_name,
ipqos_conf_params_t *params)
{

	int res;
	nvpair_t *nvp;
	ipqos_nvtype_t type;
	boolean_t bl;
	char *nm;
	char *action;
	char tmp[IPQOS_CONF_PNAME_LEN];
	int read_stats = 0;

	IPQOSCDBG0(L0, "in readparams\n");

	/* read beginning curl */

	res = read_curl_begin(cfp);
	if (res != IPQOS_CONF_SUCCESS) {
		return (res);
	}

	/*
	 * loop reading nvpairs, adding to params nvlist until encounter
	 * CURL_END.
	 */
	for (;;) {
		/* read nvpair */

		res = readnvpair(cfp, tfp, &params->nvlist,
		    &nvp, &type, PL_PARAMS, module_name);
		if (res == IPQOS_CONF_ERR) {
			goto fail;

		/* we have finished reading params */

		} else if (res == IPQOS_CONF_CURL_END) {
			break;
		}

		/*
		 * read global stats - place into params struct and remove
		 * from nvlist.
		 */
		if (strcmp(nvpair_name(nvp), IPQOS_CONF_GLOBAL_STATS_STR) ==
		    0) {
			/* check we haven't read stats before */

			if (read_stats) {
				ipqos_msg(MT_ERROR,
				    gettext("Duplicate parameter line %u.\n"),
				    lineno);
				goto fail;
			}
			read_stats++;

			(void) nvpair_value_uint32(nvp, (uint32_t *)&bl);
			params->stats_enable = bl;
			(void) nvlist_remove_all(params->nvlist,
			    IPQOS_CONF_GLOBAL_STATS_STR);


		/*
		 * read action type parameter - add it to list of action refs.
		 * also, if it's one of continue or drop virtual actions
		 * change the action name to their special ipp names in
		 * the action ref list and the nvlist.
		 */
		} else if (type == IPQOS_DATA_TYPE_ACTION) {

			/* get name and value from nvlist */

			nm = nvpair_name(nvp);
			(void) nvpair_value_string(nvp, &action);

			/* if virtual action names change to ipp name */

			if ((strcmp(action, IPQOS_CONF_CONT_STR) == 0) ||
			    strcmp(action, IPQOS_CONF_DROP_STR) == 0) {
				/*
				 * we copy nm to a seperate buffer as nv_pair
				 * name above gave us a ptr to internal
				 * memory which causes strange behaviour
				 * when we re-value that nvlist element.
				 */
				(void) strlcpy(tmp, nm, sizeof (tmp));
				nm = tmp;


				/* modify nvlist entry and change action */

				if (strcmp(action, IPQOS_CONF_CONT_STR) == 0) {
					action = IPP_ANAME_CONT;
					res = nvlist_add_string(params->nvlist,
					    nm, action);
				} else {
					action = IPP_ANAME_DROP;
					res = nvlist_add_string(params->nvlist,
					    nm, action);
				}
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_string");
					goto fail;
				}
			}

			/* add action reference to params */

			res = add_aref(&params->actions, nm, action);
		}
	}

	return (IPQOS_CONF_SUCCESS);
fail:

	if (params->nvlist) {
		nvlist_free(params->nvlist);
		params->nvlist = NULL;
	}
	if (params->actions) {
		free_arefs(params->actions);
		params->actions = NULL;
	}
	return (IPQOS_CONF_ERR);
}

/* ************************* class manip fns ****************************** */



/*
 * make dst point at a dupicate class struct with duplicate elements to src.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
dup_class(
ipqos_conf_class_t *src,
ipqos_conf_class_t **dst)
{

	ipqos_conf_class_t *cls;
	int res;

	IPQOSCDBG1(DIFF, "In dup_class: class: %s\n", src->name);
	cls = alloc_class();
	if (cls == NULL) {
		return (IPQOS_CONF_ERR);
	}

	/* struct copy */
	*cls = *src;

	/* we're not interested in the nvlist for a class */
	cls->nvlist = NULL;


	/* copy first action reference */
	cls->alist = NULL;
	res = add_aref(&cls->alist, src->alist->field, src->alist->name);
	if (res != IPQOS_CONF_SUCCESS) {
		free(cls);
		return (res);
	}

	*dst = cls;

	return (IPQOS_CONF_SUCCESS);
}

/*
 * create a zero'd class struct and return a ptr to it.
 * RETURNS: ptr to struct on success, NULL otherwise.
 */
static ipqos_conf_class_t *
alloc_class()
{

	ipqos_conf_class_t *class;

	class = malloc(sizeof (ipqos_conf_class_t));
	if (class) {
		bzero(class, sizeof (ipqos_conf_class_t));
	} else {
		ipqos_msg(MT_ENOSTR, "malloc");
	}

	return (class);
}

/* frees up all memory occupied by a filter struct and its contents. */
static void
free_class(ipqos_conf_class_t *cls)
{

	if (cls == NULL)
		return;

	/* free its nvlist if present */

	nvlist_free(cls->nvlist);

	/* free its action refs if present */

	if (cls->alist)
		free_arefs(cls->alist);

	/* finally free class itself */
	free(cls);
}

/*
 * Checks whether there is a class called class_nm  in classes list.
 * RETURNS: ptr to first matched class, else if not matched NULL.
 */
static ipqos_conf_class_t *
classexist(
char *class_nm,
ipqos_conf_class_t *classes)
{

	ipqos_conf_class_t *cls;

	IPQOSCDBG1(L1, "In classexist: name: %s\n", class_nm);

	for (cls = classes; cls; cls = cls->next) {
		if (strcmp(class_nm, cls->name) == 0) {
			break;
		}
	}

	return (cls);
}



/* ************************** filter manip fns **************************** */



/*
 * Checks whether there is a filter called filter_nm with instance number
 * instance in filters list created by us or permanent. Instance value -1
 * is a wildcard.
 * RETURNS: ptr to first matched filter, else if not matched NULL.
 */
static ipqos_conf_filter_t *
filterexist(
char *filter_nm,
int instance,
ipqos_conf_filter_t *filters)
{

	IPQOSCDBG2(L1, "In filterexist: name :%s, inst: %d\n", filter_nm,
	    instance);

	while (filters) {
		if (strcmp(filters->name, filter_nm) == 0 &&
		    (instance == -1 || filters->instance == instance) &&
		    (filters->originator == IPP_CONFIG_IPQOSCONF ||
		    filters->originator == IPP_CONFIG_PERMANENT)) {
			break;
		}
		filters = filters->next;
	}
	return (filters);
}

/*
 * allocate and zero a filter structure.
 * RETURNS: NULL on error, else ptr to filter struct.
 */
static ipqos_conf_filter_t *
alloc_filter()
{

	ipqos_conf_filter_t *flt;

	flt = malloc(sizeof (ipqos_conf_filter_t));
	if (flt) {
		bzero(flt, sizeof (ipqos_conf_filter_t));
		flt->instance = -1;
	} else {
		ipqos_msg(MT_ENOSTR, "malloc");
	}

	return (flt);
}

/* free flt and all it's contents. */

static void
free_filter(ipqos_conf_filter_t *flt)
{

	IPQOSCDBG2(L1, "In free_filter: filter: %s, inst: %d\n", flt->name,
	    flt->instance);

	if (flt == NULL)
		return;

	if (flt->src_nd_name)
		free(flt->src_nd_name);
	if (flt->dst_nd_name)
		free(flt->dst_nd_name);
	if (flt->nvlist) {
		nvlist_free(flt->nvlist);
	}
	free(flt);
}

/*
 * makes a copy of ofilter and its contents and points nfilter at it. It
 * also adds an instance number to the filter and if either saddr or
 * daddr are non-null that address to the filters nvlist along with
 * an all 1s address mask and the af.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
dup_filter(
ipqos_conf_filter_t *ofilter,
ipqos_conf_filter_t **nfilter,
int af,
int inv6,	/* if saddr or daddr set and v4 filter are they in v6 addr */
void *saddr,
void *daddr,
int inst)
{

	ipqos_conf_filter_t *nf;
	int res;
	in6_addr_t v6addr;
	in6_addr_t all_1s_v6;

	IPQOSCDBG4(MHME, "In dup_filter: name: %s, af: %u, inv6: %u, ins: %d\n",
	    ofilter->name, af, inv6, inst);

/* show src address and dst address if present */
#ifdef	_IPQOS_CONF_DEBUG
	if (ipqosconf_dbg_flgs & MHME) {
		char st[100];

		if (saddr) {
			(void) fprintf(stderr, "saddr: %s\n",
			    inet_ntop(inv6 ? AF_INET6 : AF_INET, saddr, st,
			    100));
		}

		if (daddr) {
			(void) fprintf(stderr, "daddr: %s\n",
			    inet_ntop(inv6 ? AF_INET6 : AF_INET, daddr, st,
			    100));
		}
	}
#endif	/* _IPQOS_CONF_DEBUG */

	/* init local v6 address to 0 */
	(void) bzero(&v6addr, sizeof (in6_addr_t));

	/* create an all 1s address for use as mask */
	(void) memset(&all_1s_v6, ~0, sizeof (in6_addr_t));

	/* create a new filter */

	nf = alloc_filter();
	if (nf == NULL) {
		return (IPQOS_CONF_ERR);
	}

	/* struct copy old filter to new */
	*nf = *ofilter;

	/* copy src filters nvlist if there is one to copy */

	if (ofilter->nvlist) {
		res = nvlist_dup(ofilter->nvlist, &nf->nvlist, 0);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_dup");
			goto fail;
		}
	}

	/* copy src and dst node names if present */

	if (ofilter->src_nd_name) {
		nf->src_nd_name = malloc(strlen(ofilter->src_nd_name) + 1);
		if (nf->src_nd_name == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			goto fail;
		}
		(void) strcpy(nf->src_nd_name, ofilter->src_nd_name);
	}
	if (ofilter->dst_nd_name) {
		nf->dst_nd_name = malloc(strlen(ofilter->dst_nd_name) + 1);
		if (nf->dst_nd_name == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			goto fail;
		}
		(void) strcpy(nf->dst_nd_name, ofilter->dst_nd_name);
	}

	/* add filter addresses type */

	res = nvlist_add_byte(nf->nvlist, IPGPC_FILTER_TYPE,
	    af == AF_INET ? IPGPC_V4_FLTR : IPGPC_V6_FLTR);
	if (res != 0) {
		ipqos_msg(MT_ENOSTR, "nvlist_add_byte");
		goto fail;
	}
	IPQOSCDBG1(MHME, "adding address type %s in dup filter\n",
	    af == AF_INET ? "AF_INET" : "AF_INET6");

	/* add saddr if present */

	if (saddr) {
		if (af == AF_INET && !inv6) {
			V4_PART_OF_V6(v6addr) = *(uint32_t *)saddr;
			saddr = &v6addr;
		}

		/* add address and all 1's mask */

		if (nvlist_add_uint32_array(nf->nvlist, IPGPC_SADDR,
		    (uint32_t *)saddr, 4) != 0 ||
		    nvlist_add_uint32_array(nf->nvlist, IPGPC_SADDR_MASK,
		    (uint32_t *)&all_1s_v6, 4) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_uint32_array");
			goto fail;
		}

	}

	/* add daddr if present */

	if (daddr) {
		if (af == AF_INET && !inv6) {
			V4_PART_OF_V6(v6addr) = *(uint32_t *)daddr;
			daddr = &v6addr;
		}

		/* add address and all 1's mask */

		if (nvlist_add_uint32_array(nf->nvlist, IPGPC_DADDR,
		    (uint32_t *)daddr, 4) != 0 ||
		    nvlist_add_uint32_array(nf->nvlist, IPGPC_DADDR_MASK,
		    (uint32_t *)&all_1s_v6, 4) != 0) {
			ipqos_msg(MT_ENOSTR, "nvlist_add_uint32_array");
			goto fail;
		}
	}

	/* add filter instance */

	nf->instance = inst;

	*nfilter = nf;
	return (IPQOS_CONF_SUCCESS);
fail:
	free_filter(nf);
	return (IPQOS_CONF_ERR);
}



/* ************************* action manip fns ********************** */



/*
 * create and zero action structure and a params structure hung off of it.
 * RETURNS: ptr to allocated action on success, else NULL.
 */
static ipqos_conf_action_t *
alloc_action()
{

	ipqos_conf_action_t *action;

	action = (ipqos_conf_action_t *)malloc(sizeof (ipqos_conf_action_t));
	if (action == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (action);
	}
	bzero(action, sizeof (ipqos_conf_action_t));

	action->params = (ipqos_conf_params_t *)
			malloc(sizeof (ipqos_conf_params_t));
	if (action->params == NULL) {
		free(action);
		return (NULL);
	}
	bzero(action->params, sizeof (ipqos_conf_params_t));
	action->params->stats_enable = B_FALSE;

	return (action);
}

/*
 * free all the memory used in all the actions in actions list.
 */
static void
free_actions(
ipqos_conf_action_t *actions)
{

	ipqos_conf_action_t *act = actions;
	ipqos_conf_action_t *next;
	ipqos_conf_filter_t *flt, *nf;
	ipqos_conf_class_t *cls, *nc;

	while (act != NULL) {
		/* free parameters */

		if (act->params != NULL) {
			free_arefs(act->params->actions);
			if (act->params->nvlist != NULL) {
				nvlist_free(act->params->nvlist);
			}
			free(act->params);
		}

		/* free action nvlist */

		if (act->nvlist != NULL)
			free(act->nvlist);

		/* free filters */

		flt = act->filters;
		while (flt != NULL) {
			nf = flt->next;
			free_filter(flt);
			flt = nf;
		}

		/* free classes */

		cls = act->classes;
		while (cls != NULL) {
			nc = cls->next;
			free_class(cls);
			cls = nc;
		}

		/* free permanent classes table */
		cleanup_string_table(act->perm_classes, act->num_perm_classes);

		/* free filters to retry */

		flt = act->retry_filters;
		while (flt != NULL) {
			nf = flt->next;
			free_filter(flt);
			flt = nf;
		}

		/* free dependency pointers */
		free_arefs(act->dependencies);

		next = act->next;
		free(act);
		act = next;
	}
}

/*
 * Checks whether there is an action called action_name in actions list.
 * RETURNS: ptr to first matched action, else if not matched NULL.
 *
 */
static ipqos_conf_action_t *
actionexist(
char *action_name,
ipqos_conf_action_t *actions)
{

	IPQOSCDBG1(L1, "In actionexist: name: %s\n", action_name);

	while (actions) {
		if (strcmp(action_name, actions->name) == 0) {
			break;
		}
		actions = actions->next;
	}

	return (actions);
}

/* **************************** act ref manip fns ******************** */


/*
 * add an action reference element with parameter field and action
 * action_name to arefs.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
add_aref(
ipqos_conf_act_ref_t **arefs,
char *field,
char *action_name)
{

	ipqos_conf_act_ref_t *aref;

	IPQOSCDBG1(L1, "add_aref: action: %s.\n", action_name);

	/* allocate zero'd aref */

	aref = malloc(sizeof (ipqos_conf_act_ref_t));
	if (aref == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (IPQOS_CONF_ERR);
	}
	(void) bzero(aref, sizeof (ipqos_conf_act_ref_t));

	/* copy parameter name if present */

	if (field)
		(void) strlcpy(aref->field, field, IPQOS_CONF_PNAME_LEN);

	/* copy action name */
	(void) strlcpy(aref->name, action_name, IPQOS_CONF_NAME_LEN);

	/* place at head of list */

	aref->next = *arefs;
	*arefs = aref;

	return (IPQOS_CONF_SUCCESS);
}

/*
 * free all the memory used by the action references in arefs.
 */
static void
free_arefs(
ipqos_conf_act_ref_t *arefs)
{

	ipqos_conf_act_ref_t *aref = arefs;
	ipqos_conf_act_ref_t *next;

	while (aref) {
		nvlist_free(aref->nvlist);
		next = aref->next;
		free(aref);
		aref = next;
	}
}



/* *************************************************************** */



/*
 * checks whether aname is a valid action name.
 * RETURNS: IPQOS_CONF_ERR if invalid, else IPQOS_CONF_SUCCESS.
 */
static int
valid_aname(char *aname)
{

	/*
	 * dissallow the use of the name of a virtual action, either
	 * the ipqosconf name, or the longer ipp names.
	 */
	if (strcmp(aname, IPQOS_CONF_CONT_STR) == 0 ||
	    strcmp(aname, IPQOS_CONF_DEFER_STR) == 0 ||
	    strcmp(aname, IPQOS_CONF_DROP_STR) == 0 ||
	    virtual_action(aname)) {
		ipqos_msg(MT_ERROR, gettext("Invalid action name line %u.\n"),
		    lineno);
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Opens a stream to the types file for module module_name (assuming
 * that the file path is TYPES_FILE_DIR/module_name.types). if
 * a file open failure occurs, *openerr is set to 1.
 * RETURNS: NULL on error, else stream ptr to module types file.
 */
static FILE *
validmod(
char *module_name,
int *openerr)
{

	FILE *fp;
	char *path;

	IPQOSCDBG1(L1, "In validmod: module_name: %s\n", module_name);

	*openerr = 0;

	/* create modules type file path */

	path = malloc(strlen(TYPES_FILE_DIR) + strlen(module_name) +
	    strlen(".types") + 1);
	if (path == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (NULL);
	}
	(void) strcpy(path, TYPES_FILE_DIR);
	(void) strcat(path, module_name);
	(void) strcat(path, ".types");


	IPQOSCDBG1(L1, "opening file %s\n", path);

	/* open stream to types file */

	fp = fopen(path, "r");
	if (fp == NULL) {
		(*openerr)++;
	}

	free(path);
	return (fp);
}


/*
 * read a class clause from cfp into a class struct and point class at this.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
readclass(
FILE *cfp,
char *module_name,
ipqos_conf_class_t **class,
char **perm_classes,
int num_perm_classes)
{

	int nm, act;
	int res;
	nvpair_t *nvp;
	ipqos_nvtype_t type;
	char *name;
	char *action;
	int stats;

	IPQOSCDBG0(L0, "in readclass\n");

	/* create and zero class struct */

	*class = alloc_class();
	if (!*class) {
		return (IPQOS_CONF_ERR);
	}
	(*class)->originator = IPP_CONFIG_IPQOSCONF;

	/* get starting line for error reporting */
	(*class)->lineno = lineno;

	/* read curl_begin */

	res = read_curl_begin(cfp);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* loop reading parameters till read curl_end */

	stats = nm = act = 0;
	for (;;) {
		/* read nvpair */
		res = readnvpair(cfp, NULL, &(*class)->nvlist,
		    &nvp, &type, PL_CLASS, module_name);
		if (res == IPQOS_CONF_ERR) {
			goto fail;

		/* reached end of class clause */
		} else if (res == IPQOS_CONF_CURL_END) {
			break;
		}

		/*
		 * catch name and action nv pairs and stats if present
		 * and place values in class structure.
		 */

		/* name */

		if (nm == 0 &&
		    strcmp(nvpair_name(nvp), IPQOS_CONF_NAME_STR) == 0) {

			(void) nvpair_value_string(nvp, &name);

			if (valid_name(name) != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
			(void) strcpy((*class)->name, name);
			nm++;

		/* next action */

		} else if (act == 0 &&
		    strcmp(nvpair_name(nvp), IPQOS_CONF_NEXT_ACTION_STR) == 0) {

			(void) nvpair_value_string(nvp, &action);

			/*
			 * if next action string continue string set action to
			 * IPP_ANAME_CONT, else if drop string IPP_ANAME_DROP
			 */
			if (strcmp(action, IPQOS_CONF_CONT_STR) == 0) {
				action = IPP_ANAME_CONT;
			} else if (strcmp(action, IPQOS_CONF_DROP_STR) == 0) {
				action = IPP_ANAME_DROP;
			}

			/* add an action reference to action list */

			res = add_aref(&(*class)->alist,
			    IPQOS_CONF_NEXT_ACTION_STR, action);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
			act++;

		/* class stats enable */

		} else if (stats == 0 &&
		    strcmp(nvpair_name(nvp), IPQOS_CONF_STATS_ENABLE_STR) ==
		    0) {
			boolean_t bl;

			(void) nvpair_value_uint32(nvp, (uint32_t *)&bl);
			(*class)->stats_enable = bl;

			stats++;

		/* no other / duplicate parameters allowed */

		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Unexpected parameter line %u.\n"), lineno);
			goto fail;
		}
	}
	if (nm == 0 || act == 0) {
		ipqos_msg(MT_ERROR,
		    gettext("Missing class name/next action before line %u.\n"),
		    lineno);
		goto fail;
	}

	/* change class originator field to permanent if permanent class */

	if (in_string_table(perm_classes, num_perm_classes, (*class)->name)) {
	    IPQOSCDBG1(L0, "Setting class %s as permanent.\n", (*class)->name);
		(*class)->originator = IPP_CONFIG_PERMANENT;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	if (*class)
		free_class(*class);
	return (IPQOS_CONF_ERR);
}

/*
 * This function assumes either src_nd_name or dst_node_nm are set in filter.
 *
 * Creates one of more copies of filter according to the ip versions
 * requested (or assumed) and the resolution of the src and dst address
 * node names if spec'd. If both node names are spec'd then a filter is
 * created for each pair of addresses (one from each node name) that is
 * compatible with the chosen address family, otherwise a filter copy is
 * created for just each address of the single node name that is
 * compatible.
 * If filter->ip_versions has been set that is used to determine the
 * af's we will create filters for, else if a numeric address was
 * added the family of that will be used, otherwise we fall back
 * to both v4 and v6 addresses.
 *
 * Any name lookup failures that occur are checked to see whether the failure
 * was a soft or hard failure and the nlerr field of filter set accordingly
 * before the error is returned.
 *
 * RETURNS: IPQOS_CONF_ERR on any error, else IPQOS_CONF_SUCCESS.
 */

static int
domultihome(
ipqos_conf_filter_t *filter,
ipqos_conf_filter_t **flist,
boolean_t last_retry)
{

	uint32_t ftype;
	int v4 = 1, v6 = 1;	/* default lookup family is v4 and v6 */
	int saf, daf;
	struct hostent *shp = NULL;
	struct hostent *dhp = NULL;
	in6_addr_t daddr, saddr;
	int idx = 0;
	ipqos_conf_filter_t *nfilter;
	int res;
	int ernum;
	int in32b = 0;
	char **sp, **dp;

	IPQOSCDBG3(MHME, "In domultihome: filter: %s, src_node: %s, "
	    "dst_node: %s\n", filter->name,
	    (filter->src_nd_name ? filter->src_nd_name : "NULL"),
	    (filter->dst_nd_name ? filter->dst_nd_name : "NULL"));

	/* check if we've read an ip_version request to get the versions */

	if (filter->ip_versions != 0) {
		v4 = VERSION_IS_V4(filter);
		v6 = VERSION_IS_V6(filter);

	/* otherwise check if we've read a numeric address and get versions */

	} else if (nvlist_lookup_uint32(filter->nvlist, IPGPC_FILTER_TYPE,
	    &ftype) == 0) {
		if (ftype == IPGPC_V4_FLTR) {
			v6--;
		} else {
			v4--;
		}
	}

	/* read saddrs if src node name */

	if (filter->src_nd_name) {

		/* v4 only address */

		if (v4 && !v6) {
			in32b++;
			shp = getipnodebyname(filter->src_nd_name, AF_INET,
			    AI_ADDRCONFIG, &ernum);

		/* v6 only  */

		} else if (v6 && !v4) {
			shp = getipnodebyname(filter->src_nd_name, AF_INET6,
			    AI_DEFAULT, &ernum);

		/* v4 and v6 */

		} else if (v6 && v4) {
			shp = getipnodebyname(filter->src_nd_name, AF_INET6,
			    AI_DEFAULT|AI_ALL, &ernum);
		}

#ifdef	TESTING_RETRY
if (!last_retry) {
	filter->nlerr = IPQOS_LOOKUP_RETRY;
	goto fail;
}
#endif

		/*
		 * if lookup error determine whether it was a soft or hard
		 * failure and mark as such in filter.
		 */
		if (shp == NULL) {
			if (ernum != TRY_AGAIN) {
				ipqos_msg(MT_ERROR, gettext("Failed to "
				    "resolve src host name for filter at "
				    "line %u, ignoring filter.\n"),
				    filter->lineno);
				filter->nlerr = IPQOS_LOOKUP_FAIL;
			} else {
				if (last_retry) {
					ipqos_msg(MT_ERROR, gettext("Failed "
					    "to resolve src host name for "
					    "filter at line %u, ignoring "
					    "filter.\n"), filter->lineno);
				}
				filter->nlerr = IPQOS_LOOKUP_RETRY;
			}
			goto fail;
		}
	}

	/* read daddrs if dst node name */
	if (filter->dst_nd_name) {

		/* v4 only address */

		if (v4 && !v6) {
			in32b++;
			dhp = getipnodebyname(filter->dst_nd_name, AF_INET,
			    AI_ADDRCONFIG, &ernum);

		/* v6 only */

		} else if (v6 && !v4) {
			dhp = getipnodebyname(filter->dst_nd_name, AF_INET6,
			    AI_DEFAULT, &ernum);

		/*  v6 and v4 addresses */

		} else {
			dhp = getipnodebyname(filter->dst_nd_name, AF_INET6,
			    AI_DEFAULT|AI_ALL, &ernum);
		}

		if (dhp == NULL) {
			if (ernum != TRY_AGAIN) {
				ipqos_msg(MT_ERROR, gettext("Failed to "
				    "resolve dst host name for filter at "
				    "line %u, ignoring filter.\n"),
				    filter->lineno);
				filter->nlerr = IPQOS_LOOKUP_FAIL;
			} else {
				if (last_retry) {
					ipqos_msg(MT_ERROR, gettext("Failed "
					    "to resolve dst host name for "
					    "filter at line %u, ignoring "
					    "filter.\n"), filter->lineno);
				}
				filter->nlerr = IPQOS_LOOKUP_RETRY;
			}
			goto fail;
		}
	}

	/*
	 * if src and dst node name, create set of filters; one for each
	 * src and dst address of matching types.
	 */
	if (filter->src_nd_name && filter->dst_nd_name) {

		for (sp = shp->h_addr_list; *sp != NULL; sp++) {
			(void) bcopy(*sp, &saddr, shp->h_length);

			/* get saddr family */

			if (in32b || IN6_IS_ADDR_V4MAPPED(&saddr)) {
				saf = AF_INET;
			} else {
				saf = AF_INET6;
			}

			for (dp = dhp->h_addr_list; *dp != NULL; dp++) {
				(void) bcopy(*dp, &daddr, dhp->h_length);

				/* get daddr family */

				if (in32b || IN6_IS_ADDR_V4MAPPED(&daddr)) {
					daf = AF_INET;
				} else {
					daf = AF_INET6;
				}

				/*
				 * if saddr and daddr same af duplicate
				 * filter adding addresses and new instance
				 * number and add to flist filter list.
				 */

				if (daf == saf) {

					res = dup_filter(filter, &nfilter, saf,
					    !in32b, &saddr, &daddr, ++idx);
					if (res != IPQOS_CONF_SUCCESS) {
						goto fail;
					}
					ADD_TO_LIST(flist, nfilter);
				}
			}
		}

	/* if src name only create set of filters, one for each node address */

	} else if (filter->src_nd_name) {

		for (sp = shp->h_addr_list; *sp != NULL; sp++) {
			(void) bcopy(*sp, &saddr, shp->h_length);

			/* get af */

			if (in32b || IN6_IS_ADDR_V4MAPPED(&saddr)) {
				saf = AF_INET;
			} else {
				saf = AF_INET6;
			}


			/*
			 * dup filter adding saddr and new instance num and
			 * add to flist filter list.
			 */
			res = dup_filter(filter, &nfilter, saf, !in32b, &saddr,
			    NULL, ++idx);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			ADD_TO_LIST(flist, nfilter);

		}

	/* if dname only create set of filters, one for each node address */

	} else {
		for (dp = dhp->h_addr_list; *dp != NULL; dp++) {
			(void) bcopy(*dp, &daddr, dhp->h_length);

			/* get af */

			if (in32b || IN6_IS_ADDR_V4MAPPED(&daddr)) {
				daf = AF_INET;
			} else {
				daf = AF_INET6;
			}

			/*
			 * dup filter adding daddr and new instance num and
			 * add to flist filter list.
			 */
			res = dup_filter(filter, &nfilter, daf, !in32b, NULL,
			    &daddr, ++idx);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			ADD_TO_LIST(flist, nfilter);
		}
	}

	if (shp)
		freehostent(shp);
	if (dhp)
		freehostent(dhp);
	return (IPQOS_CONF_SUCCESS);
fail:
	/*
	 * should really clean up any filters that we have created,
	 * however, free_actions called from readaction will cleam them up.
	 */
	if (shp)
		freehostent(shp);
	if (dhp)
		freehostent(dhp);
	return (IPQOS_CONF_ERR);
}


/*
 * read a filter clause from cfp into a filter struct and point filter
 * at this.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
readfilter(
FILE *cfp,
FILE *tfp,
char *module_name,
ipqos_conf_filter_t **filter,
char **perm_filters,
int num_perm_filters)
{

	int res;
	int nm, cls, ipv;
	in6_addr_t mask;
	char *addr_str;
	char *sl = NULL;
	in6_addr_t addr;
	int sa;
	struct hostent *hp;
	int err_num;
	int v4 = 0, v6 = 0;
	uchar_t mlen;
	char *tmp;
	nvpair_t *nvp;
	ipqos_nvtype_t type;
	char *name;
	char *class;
	uchar_t b;
	in6_addr_t v6addr;

	IPQOSCDBG0(L0, "in readfilter\n");


	/* create and zero filter struct */

	*filter = alloc_filter();
	if (*filter == NULL) {
		return (IPQOS_CONF_ERR);
	}
	(*filter)->originator = IPP_CONFIG_IPQOSCONF;

	/* get starting line for error reporting */
	(*filter)->lineno = lineno;

	/* read beginning curl */

	res = read_curl_begin(cfp);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}


	/*
	 * loop reading nvpairs onto nvlist until encounter CURL_END
	 */
	ipv = nm = cls = 0;
	for (;;) {
		/* read nvpair */

		res = readnvpair(cfp, tfp, &(*filter)->nvlist,
		    &nvp, &type, PL_FILTER, module_name);
		if (res == IPQOS_CONF_ERR) {
			goto fail;

		/* reached the end of filter definition */

		} else if (res == IPQOS_CONF_CURL_END) {
			break;
		}

		/*
		 * catch name and class and place value into filter
		 * structure.
		 */

		/* read filter name */

		if (strcmp(nvpair_name(nvp), IPQOS_CONF_NAME_STR) == 0) {
			if (nm != 0) {
				ipqos_msg(MT_ERROR,
				    gettext("Duplicate parameter line %u.\n"),
				    lineno);
				goto fail;
			}

			(void) nvpair_value_string(nvp, &name);
			if (valid_name(name) != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			(void) strcpy((*filter)->name, name);
			(void) nvlist_remove_all((*filter)->nvlist,
			    IPQOS_CONF_NAME_STR);
			nm++;

		/* read class name */

		} else if (strcmp(nvpair_name(nvp), IPQOS_CONF_CLASS_STR) ==
		    0) {
			if (cls != 0) {
				ipqos_msg(MT_ERROR,
				    gettext("Duplicate parameter line %u.\n"),
				    lineno);
				goto fail;
			}

			if (nvpair_value_string(nvp, &class) != 0) {
				ipqos_msg(MT_ENOSTR, "nvpair_value_string");
				break;
			}
			if (valid_name(class) != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
			(void) strcpy((*filter)->class_name, class);
			(void) nvlist_remove_all((*filter)->nvlist,
			    IPQOS_CONF_CLASS_STR);
			cls++;

		/*
		 * if a src or dst ip node name/address. For those that
		 * are determined to be addresses we convert them from
		 * strings here and add to the filter nvlist; for node names
		 * we add the name to the filter struct for readaction to
		 * process.
		 */
		} else if (strcmp(nvpair_name(nvp), IPGPC_SADDR) == 0 ||
		    strcmp(nvpair_name(nvp), IPGPC_DADDR) == 0) {

			sa = 0;

			if (strcmp(nvpair_name(nvp), IPGPC_SADDR) == 0) {
				sa++;
			}

			(void) nvpair_value_string(nvp, &addr_str);

			/*
			 * get the address mask if present.
			 * make a copy so that the nvlist element that
			 * it is part of doesn't dissapear and causes probs.
			 */
			sl = strchr(addr_str, '/');
			if (sl) {
				*sl = '\0';
				tmp = malloc(strlen(++sl) + 1);
				if (tmp == NULL) {
					ipqos_msg(MT_ENOSTR, "malloc");
					goto fail;
				}
				(void) strcpy(tmp, sl);
				sl = tmp;
			}


			/* if a numeric address */

			if (inet_pton(AF_INET, addr_str, &addr) == 1 ||
			    inet_pton(AF_INET6, addr_str, &addr) == 1) {

				/* get address */

				hp = getipnodebyname(addr_str, AF_INET6,
				    AI_DEFAULT, &err_num);
				if (hp == NULL) {
					ipqos_msg(MT_ENOSTR,
					    "getipnodebyname");
					goto fail;
				}

				(void) bcopy(hp->h_addr_list[0], &v6addr,
				    hp->h_length);
				freehostent(hp);

				/* determine address type */

				v4 = IN6_IS_ADDR_V4MAPPED(&v6addr);
				if (!v4) {
					v6++;
				}

				/*
				 * check any previous addresses have same
				 * version.
				 */
				if (nvlist_lookup_byte((*filter)->nvlist,
				    IPGPC_FILTER_TYPE, &b) == 0) {
					if (v4 && b != IPGPC_V4_FLTR ||
					    v6 && b != IPGPC_V6_FLTR) {
						ipqos_msg(MT_ERROR,
						    gettext("Incompatible "
						    "address version line "
						    "%u.\n"), lineno);
						goto fail;
					}
				}

				/*
				 * check that if ip_version spec'd it
				 * corresponds.
				 */
				if ((*filter)->ip_versions != 0) {
					if (v4 && !VERSION_IS_V4(*filter) ||
					    v6 && !VERSION_IS_V6(*filter)) {
						ipqos_msg(MT_ERROR,
						    gettext("Incompatible "
						    "address version line %u"
						    ".\n"), lineno);
						goto fail;
					}
				}

				/* add the address type */

				res = nvlist_add_byte(
				(*filter)->nvlist, IPGPC_FILTER_TYPE,
				    v4 ? IPGPC_V4_FLTR : IPGPC_V6_FLTR);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_byte");
					goto fail;
				}

				/* add address to list */

				res = nvlist_add_uint32_array((*filter)->nvlist,
				    sa ? IPGPC_SADDR : IPGPC_DADDR,
				    (uint32_t *)&v6addr, 4);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32_array");
					goto fail;
				}


				/*
				 * add mask entry in list.
				 */

				if (sl) {	/* have CIDR mask */
					char *lo;
					res = readuint8(sl, &mlen, &lo);
					if (res != IPQOS_CONF_SUCCESS ||
					    v4 && mlen > 32 ||
					    !v4 && mlen > 128 ||
					    mlen == 0) {
						ipqos_msg(MT_ERROR,
						    gettext("Invalid CIDR "
						    "mask line %u.\n"), lineno);
						goto fail;
					}
					setmask(mlen, &mask,
					    v4 ? AF_INET : AF_INET6);
					free(sl);
				} else {
					/* no CIDR mask spec'd - use all 1s */

					(void) memset(&mask, ~0,
					    sizeof (in6_addr_t));
				}
				res = nvlist_add_uint32_array((*filter)->nvlist,
				    sa ? IPGPC_SADDR_MASK : IPGPC_DADDR_MASK,
				    (uint32_t *)&mask, 4);
				if (res != 0) {
					ipqos_msg(MT_ENOSTR,
					    "nvlist_add_uint32_arr");
					goto fail;
				}

			/* inet_pton returns fail - we assume a node name */

			} else {
				/*
				 * doesn't make sense to have a mask
				 * with a node name.
				 */
				if (sl) {
					ipqos_msg(MT_ERROR,
					    gettext("Address masks aren't "
					    "allowed for host names line "
					    "%u.\n"), lineno);
					goto fail;
				}

				/*
				 * store node name in filter struct for
				 * later resolution.
				 */
				if (sa) {
					(*filter)->src_nd_name =
					    malloc(strlen(addr_str) + 1);
					(void) strcpy((*filter)->src_nd_name,
					    addr_str);
				} else {
					(*filter)->dst_nd_name =
					    malloc(strlen(addr_str) + 1);
					(void) strcpy((*filter)->dst_nd_name,
					    addr_str);
				}
			}

		/* ip_version enumeration */

		} else if (strcmp(nvpair_name(nvp), IPQOS_CONF_IP_VERSION) ==
		    0) {
			/* check we haven't read ip_version before */
			if (ipv) {
				ipqos_msg(MT_ERROR,
				    gettext("Duplicate parameter line %u.\n"),
				    lineno);
				goto fail;
			}
			ipv++;

			/* get bitmask value */

			(void) nvpair_value_uint32(nvp,
			    &(*filter)->ip_versions);

			/*
			 * check that if either ip address is spec'd it
			 * corresponds.
			 */
			if (v4 && !VERSION_IS_V4(*filter) ||
			    v6 && !VERSION_IS_V6(*filter)) {
				ipqos_msg(MT_ERROR, gettext("Incompatible "
				    "address version line %u.\n"), lineno);
				goto fail;
			}

			/* remove ip_version from nvlist */

			(void) nvlist_remove_all((*filter)->nvlist,
			    IPQOS_CONF_IP_VERSION);
		}
	}
	if (nm == 0 || cls == 0) {
		ipqos_msg(MT_ERROR, gettext("Missing filter/class name "
		    "before line %u.\n"), lineno);
		goto fail;
	}

	if (in_string_table(perm_filters, num_perm_filters, (*filter)->name)) {
		IPQOSCDBG1(L0, "Setting filter %s as permanent.\n",
		    (*filter)->name);

		(*filter)->originator = IPP_CONFIG_PERMANENT;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	if (*filter)
		free_filter(*filter);
	if (hp)
		freehostent(hp);
	if (sl)
		free(sl);

	return (IPQOS_CONF_ERR);
}

/*
 * reads the curl begin token from cfp stream.
 * RETURNS: IPQOS_CONF_ERR if not read successfully, else IPQOS_CONF_SUCCES.
 */
static int
read_curl_begin(FILE *cfp)
{

	int res;
	char *st;

	res = readtoken(cfp, &st);

	if (res != IPQOS_CONF_CURL_BEGIN) {
		if (res == IPQOS_CONF_EOF) {
			ipqos_msg(MT_ERROR, gettext("Unexpected EOF.\n"));

		/* if CURL_END or something else */
		} else if (res != IPQOS_CONF_ERR) {
			free(st);
			ipqos_msg(MT_ERROR, gettext("\'{\' missing at line "
			    "%u.\n"), lineno);
		}
		return (IPQOS_CONF_ERR);
	}

	free(st);
	return (IPQOS_CONF_SUCCESS);
}

/*
 * This function parses the parameter string version into a version of the
 * form "%u.%u" (as a sscanf format string). It then encodes this into an
 * int and returns this encoding.
 * RETURNS: -1 if an invalid string, else the integer encoding.
 */
static int
ver_str_to_int(
char *version)
{
	uint32_t major, minor;
	int ver;

	if (sscanf(version, "%u.%u", &major, &minor) != 2) {
		IPQOSCDBG0(L0, "Failed to process version number string\n");
		return (-1);
	}

	ver = (int)((major * 10000) + minor);
	return (ver);
}

/*
 * This function scans through the stream fp line by line looking for
 * a line beginning with version_tag and returns a integer encoding of
 * the version following it.
 *
 * RETURNS: If the version definition isn't found or the version is not
 * a valid version (%u.%u) then -1 is returned, else an integer encoding
 * of the read version.
 */
static int
read_tfile_ver(
FILE *fp,
char *version_tag,
char *module_name)
{
	char lbuf[IPQOS_CONF_LINEBUF_SZ];
	char buf[IPQOS_CONF_LINEBUF_SZ+1];
	char buf2[IPQOS_CONF_LINEBUF_SZ+1];
	int found = 0;
	int version;

	/*
	 * reset to file start
	 */
	if (fseek(fp, 0, SEEK_SET) != 0) {
		ipqos_msg(MT_ENOSTR, "fseek");
		return (-1);
	}

	/*
	 * loop reading lines till found the one beginning with version_tag.
	 */
	while (fgets(lbuf, IPQOS_CONF_LINEBUF_SZ, fp) != NULL) {
		if ((sscanf(lbuf,
		    "%" VAL2STR(IPQOS_CONF_LINEBUF_SZ) "s"
		    "%" VAL2STR(IPQOS_CONF_LINEBUF_SZ) "s",
		    buf, buf2) == 2) &&
		    (strcmp(buf, version_tag) == 0)) {
			found++;
			break;
		}
	}
	if (found == 0) {
		ipqos_msg(MT_ERROR, gettext("Types file for module %s is "
		    "corrupt.\n"), module_name);
		IPQOSCDBG1(L1, "Couldn't find %s in types file\n",
		    version_tag);
		return (-1);
	}

	/*
	 * convert version string into int.
	 */
	if ((version = ver_str_to_int(buf2)) == -1) {
		ipqos_msg(MT_ERROR, gettext("Types file for module %s is "
		    "corrupt.\n"), module_name);
		return (-1);
	}

	return (version);
}

/*
 * read action clause and params/classes/filters clauses within and
 * store in and hang off an action structure, and point action at it.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
readaction(
FILE *cfp,
ipqos_conf_action_t **action)
{

	char *st;
	FILE *tfp = NULL;
	int nm, md;
	int readprms = 0;
	int res;
	char *strval;
	char *name;
	nvpair_t *nvp;
	ipqos_nvtype_t type;
	ipqos_conf_filter_t *filter;
	ipqos_conf_class_t *class;
	int oe;
	char **perm_filters;
	int num_perm_filters;
	int tf_fmt_ver;

	IPQOSCDBG0(L0, "in readaction\n");

	res = readtoken(cfp, &st);
	if (res == IPQOS_CONF_ERR || res == IPQOS_CONF_EOF) {
		return (res);
	} else if (strcmp(st, IPQOS_CONF_ACTION_STR) != 0) {
			ipqos_msg(MT_ERROR, gettext("Missing %s token line "
			    "%u.\n"), IPQOS_CONF_ACTION_STR, lineno);
			free(st);
			return (IPQOS_CONF_ERR);
	}
	free(st);

	/* create action structure */

	*action = alloc_action();
	if (*action == NULL) {
		return (IPQOS_CONF_ERR);
	}
	(*action)->params->originator = IPP_CONFIG_IPQOSCONF;


	/* get starting line for error reporting */
	(*action)->lineno = lineno;

	/* read beginning curl */

	res = read_curl_begin(cfp);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* loop till read both action name and module */

	nm = md = 0;
	do {
		/* read nvpair */

		res = readnvpair(cfp, NULL, &(*action)->nvlist, &nvp, &type,
		    PL_ACTION, NULL);
		if (res == IPQOS_CONF_ERR) {
			goto fail;

		/* read curl_end */

		} else if (res == IPQOS_CONF_CURL_END) {
			if (nm == 0 || md == 0) {
				ipqos_msg(MT_ERROR,
				    gettext("Missing action name/ module "
				    "before line %u.\n"), lineno);
				goto fail;
			}
		}


		/* store name and module in action structure */

		name = nvpair_name(nvp);

		/* read action name */

		if (nm == 0 && strcmp(name, IPQOS_CONF_NAME_STR) == 0) {

			(void) nvpair_value_string(nvp, &strval);

			/* check name is valid */

			if (valid_name(strval) != IPQOS_CONF_SUCCESS ||
			    valid_aname(strval) != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			/* store and remove from list */

			(void) strcpy((*action)->name, strval);
			/* remove name from nvlist */
			(void) nvlist_remove_all((*action)->nvlist,
			    IPQOS_CONF_NAME_STR);

			nm++;

		/* read module name */

		} else if (md == 0 &&
		    strcmp(name, IPQOS_CONF_MODULE_STR) == 0) {
			/*
			 * check that module has a type file and get
			 * open stream to it.
			 */
			(void) nvpair_value_string(nvp, &strval);
			if ((tfp = validmod(strval, &oe)) == NULL) {
				if (oe) {
					if (errno == ENOENT) {
						ipqos_msg(MT_ERROR,
						    gettext("Invalid "
						    "module name line %u.\n"),
						    lineno);
					} else {
						ipqos_msg(MT_ENOSTR, "fopen");
					}
				}
				goto fail;
			}

			/*
			 * move module name to action struct
			 */
			(void) strlcpy((*action)->module, strval,
			    IPQOS_CONF_NAME_LEN);
			(void) nvlist_remove_all((*action)->nvlist,
			    IPQOS_CONF_MODULE_STR);
			md++;

		/* duplicate/other parameter */

		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Unexpected parameter line %u.\n"),
			    lineno);
			goto fail;
		}

	} while (nm == 0 || md == 0);

	/*
	 * check that if the ipgpc action it is named correctly
	 */
	if ((strcmp((*action)->module, IPGPC_NAME) == 0) &&
	    (strcmp((*action)->name, IPGPC_CLASSIFY) != 0)) {
		ipqos_msg(MT_ERROR,
		    gettext("%s action has incorrect name line %u.\n"),
		    IPGPC_NAME, (*action)->lineno);
		goto fail;
	}

	/* get list of permanent classes */

	res = read_perm_items(0, tfp, (*action)->module,
	    &(*action)->perm_classes, &(*action)->num_perm_classes);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* get list of permanent filters */

	res = read_perm_items(1, tfp, (*action)->module,
	    &perm_filters, &num_perm_filters);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/*
	 * get types file format version and check its supported.
	 */
	if ((tf_fmt_ver = read_tfile_ver(tfp, IPQOS_FMT_STR,
	    (*action)->module)) == -1)
		goto fail;
	if (IPP_MAJOR_MODULE_VER(tf_fmt_ver) > 1 ||
	    IPP_MINOR_MODULE_VER(tf_fmt_ver) > 0) {
		ipqos_msg(MT_ERROR, gettext("Types file for module %s is "
		    "incompatible.\n"), (*action)->module);
		IPQOSCDBG0(L1, "Unsupported fmt major/minor version\n");
		goto fail;
	}

	/*
	 * get module version
	 */
	if (((*action)->module_version = read_tfile_ver(tfp, IPQOS_MOD_STR,
	    (*action)->module)) == -1)
		goto fail;

	/* read filter/class/params blocks until CURL_END */

	for (;;) {
		/* read token */
		res = readtoken(cfp, &st);

		if (res == IPQOS_CONF_ERR) {
			goto fail;
		} else if (res == IPQOS_CONF_EOF) {
			ipqos_msg(MT_ERROR, gettext("Unexpected EOF.\n"));
			goto fail;

		/* read CURL_END - end of action definition */

		} else if (res == IPQOS_CONF_CURL_END) {
			free(st);
			break;
		}


		/*
		 * read in either a filter/class or parameter block.
		 */

		/* read filter */

		if (strcmp(st, IPQOS_CONF_FILTER_STR) == 0) {
			free(st);

			res = readfilter(cfp, tfp, (*action)->module, &filter,
			    perm_filters, num_perm_filters);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			/*
			 * if we read a host name for either src or dst addr
			 * resolve the hostnames and create the appropriate
			 * number of filters.
			 */

			if (filter->src_nd_name || filter->dst_nd_name) {

				res = domultihome(filter, &(*action)->filters,
				    B_FALSE);
				/*
				 * if a lookup fails and the filters
				 * marked as retry we add it to a list
				 * for another attempt later, otherwise
				 * it is thrown away.
				 */
				if (res != IPQOS_CONF_SUCCESS) {

					/* if not name lookup problem */

					if (filter->nlerr == 0) {
						free_filter(filter);
						goto fail;

					/* name lookup problem */

					/*
					 * if intermitent lookup failure
					 * add to list of filters to
					 * retry later.
					 */
					} else if (filter->nlerr ==
					    IPQOS_LOOKUP_RETRY) {
						filter->nlerr = 0;
						ADD_TO_LIST(
						    &(*action)->retry_filters,
						    filter);
					/*
					 * for non-existing names
					 * ignore the filter.
					 */
					} else {
						free_filter(filter);
					}

				/* creation of new filters successful */

				} else {
					free_filter(filter);
				}

			/* non-node name filter */

			} else {
				ADD_TO_LIST(&(*action)->filters, filter);
			}

		/* read class */

		} else if (strcmp(st, IPQOS_CONF_CLASS_STR) == 0) {
			free(st);
			res = readclass(cfp, (*action)->module, &class,
			    (*action)->perm_classes,
			    (*action)->num_perm_classes);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}

			ADD_TO_LIST(&(*action)->classes, class);

		/* read params */

		} else if (strcmp(st, IPQOS_CONF_PARAMS_STR) == 0) {
			free(st);
			if (readprms) {
				ipqos_msg(MT_ERROR,
				    gettext("Second parameter clause not "
				    "supported line %u.\n"), lineno);
				goto fail;
			}
			res = readparams(cfp, tfp, (*action)->module,
			    (*action)->params);
			if (res != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
			readprms++;

		/* something unexpected */
		} else {
			free(st);
			ipqos_msg(MT_ERROR,
			    gettext("Params/filter/class clause expected "
			    "line %u.\n"), lineno);
			goto fail;
		}
	}

	(void) fclose(tfp);
	return (IPQOS_CONF_SUCCESS);

fail:
	if (tfp)
		(void) fclose(tfp);
	if (*action) {
		free_actions(*action);
		*action = NULL;
	}
	return (IPQOS_CONF_ERR);
}

/*
 * check that each of the actions in actions is uniquely named. If one isn't
 * set *name to point at the name of the duplicate action.
 * RETURNS: IPQOS_CONF_ERR if a non-unique action, else IPQOS_CONF_SUCCESS.
 */
static int
actions_unique(ipqos_conf_action_t *actions, char **name)
{

	IPQOSCDBG0(L1, "In actions_unique.\n");

	while (actions) {
		if (actionexist(actions->name, actions->next)) {
			*name = actions->name;
			return (IPQOS_CONF_ERR);
		}
		actions = actions->next;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * checks whether the action parameter is involved in an action cycle.
 * RETURNS: 1 if involved in a cycle, 0 otherwise.
 */
static int
in_cycle(
ipqos_conf_action_t *action)
{

	ipqos_conf_act_ref_t *aref;
	ipqos_conf_class_t *c;

	IPQOSCDBG1(L0, "in_cycle: visiting action %s\n", action->name);


	/* have we visited this action before? */

	if (action->visited == INCYCLE_VISITED) {
		action->visited = 0;
		return (1);
	}
	action->visited = INCYCLE_VISITED;

	/*
	 * recurse down the child actions of this action through the
	 * classes next action and parameter actions.
	 */

	for (aref = action->params->actions; aref != NULL; aref = aref->next) {

		/* skip virtual actions - they can't be in a cycle */

		if (virtual_action(aref->name)) {
			continue;
		}

		if (in_cycle(aref->action)) {
			action->visited = 0;
			return (1);
		}
	}

	for (c = action->classes; c != NULL; c = c->next) {
		aref = c->alist;

		if (virtual_action(aref->name)) {
			continue;
		}

		if (in_cycle(aref->action)) {
			action->visited = 0;
			return (1);
		}
	}

	IPQOSCDBG0(L0, "in_cycle: return\n");
	action->visited = 0;
	return (0);
}

/*
 * checks that the configuration in actions is a valid whole, that
 * all actions are unique, all filters and classes are unique within
 * their action, that classes referenced by filters exist and actions
 * referenced by classes and params exist. Also checks that there are no root
 * actions but ipgpc and that no actions are involved in cycles. As
 * a consequence of checking that the actions exist two way pointers
 * are created between the dependee and dependant actions.
 *
 * In the case the the userconf flag is zero only this link creation is
 * set as we trust the kernel to return a valid configuration.
 *
 * RETURNS: IPQOS_CONF_ERR if config isn't valid, else IPQOS_CONF_SUCCESS.
 *
 */

static int
validconf(
ipqos_conf_action_t *actions,
int userconf)			/* are we checking a conf file ? */
{
	char *name;
	ipqos_conf_action_t *act;
	int res;
	ipqos_conf_action_t *dact;
	ipqos_conf_filter_t *flt;
	ipqos_conf_class_t *cls;
	ipqos_conf_params_t *params;
	ipqos_conf_act_ref_t *aref;

	IPQOSCDBG0(L0, "In validconf\n");

	/* check actions are unique */

	if (userconf && actions_unique(actions, &name) != IPQOS_CONF_SUCCESS) {
		ipqos_msg(MT_ERROR, gettext("Duplicate named action %s.\n"),
		    name);
		return (IPQOS_CONF_ERR);
	}

	for (act = actions; act; act = act->next) {

		/*
		 * check filters (for user land configs only).
		 * check they are unique in this action and their class exists.
		 */
		if (userconf) {
			for (flt = act->filters; flt; flt = flt->next) {

				/* check unique name */

				if (filterexist(flt->name, flt->instance,
				    flt->next)) {
					ipqos_msg(MT_ERROR,
					    gettext("Duplicate named filter "
					    "%s in action %s.\n"), flt->name,
					    act->name);
					return (IPQOS_CONF_ERR);
				}

				/*
				 * check existence of class and error if
				 * class doesn't exist and not a perm class
				 */

				if (!classexist(flt->class_name,
				    act->classes)) {
					if (!in_string_table(act->perm_classes,
					    act->num_perm_classes,
					    flt->class_name)) {
						ipqos_msg(MT_ERROR,
						    gettext("Undefined "
						    "class in filter %s, "
						    "action %s.\n"), flt->name,
						    act->name);
						return (IPQOS_CONF_ERR);
					}
				}
			}
		}

		/* check classes */

		for (cls = act->classes; cls; cls = cls->next) {

			/* check if class name unique (userland only) */

			if (userconf && classexist(cls->name, cls->next)) {
				ipqos_msg(MT_ERROR,
				    gettext("Duplicate named class %s in "
				    "action %s.\n"), cls->name, act->name);
				return (IPQOS_CONF_ERR);
			}

			/*
			 * virtual actions always exist so don't check for next
			 * action.
			 */
			if (virtual_action(cls->alist->name)) {
				continue;
			}

			/*
			 * check existance of next action and create link to
			 * it.
			 */
			if ((cls->alist->action =
			    actionexist(cls->alist->name, actions)) == NULL) {
				ipqos_msg(MT_ERROR,
				    gettext("Undefined action in class %s, "
				    "action %s.\n"), cls->name, act->name);
				return (IPQOS_CONF_ERR);
			}

			/* create backwards link - used for deletions */

			dact = cls->alist->action;
			res = add_aref(&dact->dependencies, NULL, act->name);
			if (res != IPQOS_CONF_SUCCESS) {
				return (IPQOS_CONF_ERR);
			}
			dact->dependencies->action = act;
		}


		/* check actions exist for action type parameters */

		params = act->params;
		for (aref = params->actions; aref; aref = aref->next) {

			/* skip virtuals */

			if (virtual_action(aref->name)) {
				continue;
			}

			/*
			 * check existance of action in this ref
			 * and if present create a ptr to it.
			 */
			aref->action = actionexist(aref->name, actions);
			if (aref->action == NULL) {
				ipqos_msg(MT_ERROR,
				    gettext("Undefined action in parameter "
				    "%s, action %s.\n"),
				    SHORT_NAME(aref->field), act->name);
				return (IPQOS_CONF_ERR);
			}

			/* create backwards link */

			dact = aref->action;
			res = add_aref(&dact->dependencies, NULL,
			    act->name);
			if (res != IPQOS_CONF_SUCCESS) {
				return (IPQOS_CONF_ERR);
			}
			dact->dependencies->action = act;
		}
	}

	/* for kernel retrieved configs we don't do the following checks. */
	if (!userconf) {
		return (IPQOS_CONF_SUCCESS);
	}

	/* check for cycles in config and orphaned actions other than ipgpc */

	for (act = actions; act; act = act->next) {

		/* check if involved in cycle */

		if (in_cycle(act)) {
			ipqos_msg(MT_ERROR,
			    gettext("Action %s involved in cycle.\n"),
			    act->name);
			return (IPQOS_CONF_ERR);
		}

		/* check that this action has a parent (except ipgpc) */

		if (act->dependencies == NULL &&
		    strcmp(act->name, IPGPC_CLASSIFY) != 0) {
			ipqos_msg(MT_ERROR, gettext("Action %s isn't "
			    "referenced by any other actions.\n"), act->name);
			return (IPQOS_CONF_ERR);
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Read the version from the config file with stream cfp with
 * the tag version_tag. The tag-value pair should be the first tokens
 * encountered.
 *
 * RETURNS: -1 if a missing or invalid version or a read error,
 * else an integer encoding of the version.
 */
static int
read_cfile_ver(
FILE *cfp,
char *version_tag)
{
	char *sp = NULL;
	int res;
	int version;

	IPQOSCDBG0(L1, "In read_cfile_ver:\n");

	/*
	 * read version tag string.
	 */
	res = readtoken(cfp, &sp);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	} else if (strcasecmp(sp, version_tag) != 0) {
		goto fail;
	}
	free(sp);
	sp = NULL;

	/*
	 * read version number string.
	 */
	res = readtoken(cfp, &sp);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/*
	 * encode version into int.
	 */
	if ((version = ver_str_to_int(sp)) == -1) {
		goto fail;
	}
	free(sp);

	return (version);
fail:
	ipqos_msg(MT_ERROR,
	    gettext("Missing/Invalid config file %s.\n"), version_tag);
	if (sp != NULL)
		free(sp);
	return (-1);
}

/*
 * read the set of actions definitions from the stream cfp and store
 * them in a list pointed to by conf.
 * RETURNS: IPQOS_CONF_ERR if any errors, else IPQOS_CONF_SUCCESS.
 */
static int
readconf(
FILE *cfp,
ipqos_conf_action_t **conf)
{

	int res;
	ipqos_conf_action_t *action;
	boolean_t ipgpc_action = B_FALSE;
	int fmt_ver;

	IPQOSCDBG0(L0, "In readconf\n");

	*conf = NULL;

	/*
	 * get config file format version.
	 */
	fmt_ver = read_cfile_ver(cfp, IPQOS_FMT_VERSION_STR);
	if (fmt_ver == -1) {
		return (IPQOS_CONF_ERR);
	} else {
		/*
		 * check version is valid
		 */
		if ((IPP_MAJOR_MODULE_VER(fmt_ver) > 1) ||
		    (IPP_MINOR_MODULE_VER(fmt_ver) > 0)) {
			ipqos_msg(MT_ERROR, gettext("Unsupported config file "
			    "format version.\n"));
			return (IPQOS_CONF_ERR);
		}
	}

	/* loop reading actions adding to conf till EOF */

	for (;;) {
		action = NULL;

		/* readaction */

		res = readaction(cfp, &action);
		if (res == IPQOS_CONF_ERR) {
			goto fail;
		}

		/* reached eof, finish */

		if (res == IPQOS_CONF_EOF) {
			break;
		}

		ADD_TO_LIST(conf, action);

		/* check if we just read an ipgpc action */

		if (strcmp(action->name, IPGPC_CLASSIFY) == 0)
			ipgpc_action = B_TRUE;
	}

	/* check that there is one or more actions and that one is ipgpc */

	if (ipgpc_action == B_FALSE) {
		ipqos_msg(MT_ERROR, gettext("No %s action defined.\n"),
		    IPGPC_NAME);
		goto fail;
	}

	return (IPQOS_CONF_SUCCESS);
fail:
	free_actions(*conf);
	*conf = NULL;
	return (IPQOS_CONF_ERR);
}

/* ************************ kernel config retrieval ************************ */


/*
 * read the current configuration from the kernel and make *conf a ptr to it.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
readkconf(ipqos_conf_action_t **conf)
{

	int res;
	char **modnames = NULL;
	int nmods;
	char **actnames = NULL;
	int nacts;
	int x, y;
	FILE *tfp;
	int openerr;
	ipqos_actinfo_prm_t ai_prm;


	IPQOSCDBG0(L0, "In readkconf\n");

	/* initialise conf to NULL */
	*conf = NULL;

	/* get list of modules currently loaded */

	res = ipp_list_mods(&modnames, &nmods);
	if (res != 0) {
		ipqos_msg(MT_ENOSTR, "ipp_list_mods");
		return (IPQOS_CONF_ERR);
	}

	/*
	 * iterate through all loaded modules retrieving their list of actions
	 * and then retrieving the configuration of each of these
	 * and attatching it to conf.
	 */
	for (x = 0; x < nmods; x++) {

		/* skip actions of modules that we can't open types file of */

		if ((tfp = validmod(modnames[x], &openerr)) == NULL) {

			/* mem error */

			if (!openerr) {
				goto fail;

			/*
			 * fopen fail - if we failed because the file didn't
			 * exist we assume this is an unknown module and
			 * ignore this module, otherwise error.
			 */
			} else {
				if (errno == ENOENT) {
					continue;
				} else {
					ipqos_msg(MT_ENOSTR, "fopen");
					goto fail;
				}
			}
		}
		(void) fclose(tfp);

		/* get action list for this module */

		res = ipp_mod_list_actions(modnames[x], &actnames, &nacts);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "ipp_mod_list_actions");
			goto fail;
		}

		/* read config of each action of this module */

		for (y = 0; y < nacts; y++) {
			ai_prm.action = alloc_action();
			if (ai_prm.action == NULL) {
				goto fail;
			}

			/* copy action name into action struct */

			(void) strlcpy(ai_prm.action->name, actnames[y],
			    IPQOS_CONF_NAME_LEN);

			/* copy module name into action struct */

			(void) strlcpy(ai_prm.action->module, modnames[x],
			    IPQOS_CONF_NAME_LEN);

			/* get action info */

			res = ipp_action_info(actnames[y],
			    (int (*)(nvlist_t *, void *))parse_kaction,
			    (void *)&ai_prm, 0);
			if (res != 0) {
				/* was this an ipp error */
				if (ai_prm.intl_ret == IPQOS_CONF_SUCCESS) {
					ipqos_msg(MT_ENOSTR,
					    "ipp_action_info");
				}
				goto fail;
			}

			ADD_TO_LIST(conf, ai_prm.action);
		}

		cleanup_string_table(actnames, nacts);
	}

	cleanup_string_table(modnames, nmods);
	return (IPQOS_CONF_SUCCESS);
fail:
	free_actions(*conf);
	*conf = NULL;
	cleanup_string_table(modnames, nmods);
	cleanup_string_table(actnames, nacts);
	return (IPQOS_CONF_ERR);
}

/*
 * This is passed as a parameter to ipp_action_info() in readkaction and
 * is called back one for each configuration element within the action
 * specified. This results in filters and classes being created and chained
 * off of action, and action having its params set.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCESS.
 */
static int
parse_kaction(
nvlist_t *nvl,
ipqos_actinfo_prm_t *ai_prm)
{

	int ret;
	uint8_t cfgtype;
	ipqos_conf_filter_t *filter = NULL;
	ipqos_conf_class_t *class = NULL;
	ipqos_conf_action_t *action = ai_prm->action;


	IPQOSCDBG1(KRET, "In parse_kaction: action_name: %s\n", action->name);

	/* get config type */

	(void) nvlist_lookup_byte(nvl, IPP_CONFIG_TYPE, &cfgtype);
	(void) nvlist_remove_all(nvl, IPP_CONFIG_TYPE);

	switch (cfgtype) {
		case CLASSIFIER_ADD_FILTER: {
			/*
			 * parse the passed filter nvlist
			 * and add result to action's filter list.
			 */
			filter = alloc_filter();
			if (filter == NULL) {
				ai_prm->intl_ret = IPQOS_CONF_ERR;
				return (IPQOS_CONF_ERR);
			}

			ret = parse_kfilter(filter, nvl);
			if (ret != IPQOS_CONF_SUCCESS) {
				free_filter(filter);
				ai_prm->intl_ret = IPQOS_CONF_ERR;
				return (ret);
			}

			ADD_TO_LIST(&action->filters, filter);
			break;
		}
		case CLASSIFIER_ADD_CLASS:
		case CLASSIFIER_MODIFY_CLASS: {
			/*
			 * parse the passed class nvlist
			 * and add result to action's class list.
			 */
			class = alloc_class();
			if (class == NULL) {
				ai_prm->intl_ret = IPQOS_CONF_ERR;
				return (IPQOS_CONF_ERR);
			}

			ret = parse_kclass(class, nvl);
			if (ret != IPQOS_CONF_SUCCESS) {
				free_class(class);
				ai_prm->intl_ret = IPQOS_CONF_ERR;
				return (ret);
			}

			ADD_TO_LIST(&action->classes, class);
			break;
		}
		case IPP_SET: {
			/*
			 * we don't alloc a params struct as it is created
			 * as part of an action.
			 */

			/* parse the passed params nvlist */

			ret = parse_kparams(action->module, action->params,
			    nvl);
			if (ret != IPQOS_CONF_SUCCESS) {
				ai_prm->intl_ret = IPQOS_CONF_ERR;
				return (ret);
			}
		}
	}

	ai_prm->intl_ret = IPQOS_CONF_SUCCESS;
	return (IPQOS_CONF_SUCCESS);
}

/*
 * parses a params nvlist returned from the kernel.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
int
parse_kparams(
char *module,
ipqos_conf_params_t *params,
nvlist_t *nvl) {

	int ret;
	ipqos_nvtype_t type;
	str_val_nd_t *tmp;
	char *act;
	uint32_t u32;
	nvpair_t *nvp;
	FILE *tfp;
	char dfltst[IPQOS_VALST_MAXLEN];
	char *param;
	nvlist_t *nvlcp;
	int openerr;
	place_t place;

	IPQOSCDBG0(KRET, "In parse_kparams:\n");

	/* get stream to module types file */

	tfp = validmod(module, &openerr);
	if (tfp == NULL) {
		if (openerr) {
			ipqos_msg(MT_ENOSTR, "fopen");
		}
		return (IPQOS_CONF_ERR);
	}

	/* make copy of passed in nvlist as it is freed by the caller */

	ret = nvlist_dup(nvl, &nvlcp, 0);
	if (ret != 0) {
		return (IPQOS_CONF_ERR);
	}

	/*
	 * get config originator and remove from nvlist. If no owner we
	 * assume ownership.
	 */
	ret = nvlist_lookup_uint32(nvlcp, IPP_CONFIG_ORIGINATOR, &u32);
	if (ret == 0) {
		params->originator = u32;
		(void) nvlist_remove_all(nvlcp, IPP_CONFIG_ORIGINATOR);
	} else {
		params->originator = IPP_CONFIG_IPQOSCONF;
	}

	/* get action stats and remove from nvlist */

	ret = nvlist_lookup_uint32(nvlcp, IPP_ACTION_STATS_ENABLE, &u32);
	if (ret == 0) {
		params->stats_enable = *(boolean_t *)&u32;
		(void) nvlist_remove_all(nvlcp, IPP_ACTION_STATS_ENABLE);
	}

	/*
	 * loop throught nvlist elements and for those that are actions create
	 * action ref entrys for them.
	 */
	nvp = nvlist_next_nvpair(nvlcp, NULL);
	while (nvp != NULL) {
		param = SHORT_NAME(nvpair_name(nvp));
		place = PL_ANY;
		ret = readtype(tfp, module, param, &type, &tmp, dfltst,
		    B_FALSE, &place);
		if (ret != IPQOS_CONF_SUCCESS) {
			goto fail;
		}

		if ((place == PL_PARAMS) &&	/* avoid map entries */
		    (type == IPQOS_DATA_TYPE_ACTION)) {
			(void) nvpair_value_string(nvp, &act);
			ret = add_aref(&params->actions, nvpair_name(nvp), act);
			if (ret != IPQOS_CONF_SUCCESS) {
				goto fail;
			}
		}

		nvp = nvlist_next_nvpair(nvlcp, nvp);
	}

	/* assign copied nvlist to params struct */

	params->nvlist = nvlcp;

	(void) fclose(tfp);
	return (IPQOS_CONF_SUCCESS);
fail:
	(void) fclose(tfp);
	free_arefs(params->actions);
	params->actions = NULL;
	nvlist_free(nvlcp);
	return (IPQOS_CONF_ERR);
}

/*
 * parses a classes nvlist returned from the kernel.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
parse_kclass(
ipqos_conf_class_t *class,
nvlist_t *nvl)
{

	int ret;
	uint32_t u32;
	char *str;

	IPQOSCDBG0(KRET, "In parse_kclass:\n");

	/* lookup object originator */

	ret = nvlist_lookup_uint32(nvl, IPP_CONFIG_ORIGINATOR, &u32);
	if (ret == 0) {
		class->originator = u32;
	} else {
		class->originator = IPP_CONFIG_IPQOSCONF;
	}

	/* lookup name */

	(void) nvlist_lookup_string(nvl, CLASSIFIER_CLASS_NAME, &str);
	(void) strlcpy(class->name, str, IPQOS_CONF_NAME_LEN);
	IPQOSCDBG1(KRET, "reading class %s\n", class->name);

	/* lookup next action */

	(void) nvlist_lookup_string(nvl, CLASSIFIER_NEXT_ACTION, &str);
	ret = add_aref(&class->alist, NULL, str);
	if (ret != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* lookup stats enable */

	ret = nvlist_lookup_uint32(nvl, CLASSIFIER_CLASS_STATS_ENABLE, &u32);
	if (ret == 0) {
		class->stats_enable = *(boolean_t *)&u32;
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * parses a filters nvlist returned from the kernel.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
parse_kfilter(
ipqos_conf_filter_t *filter,
nvlist_t *nvl)
{

	int ret;
	char *str;
	uint32_t u32;
	nvlist_t *nvlcp;
	char *end;

	IPQOSCDBG0(KRET, "In parse_kfilter:\n");

	/* make copy of passed in nvlist as it is freed by the caller */

	ret = nvlist_dup(nvl, &nvlcp, 0);
	if (ret != 0) {
		return (IPQOS_CONF_ERR);
	}

	/* lookup originator */

	ret = nvlist_lookup_uint32(nvlcp, IPP_CONFIG_ORIGINATOR, &u32);
	if (ret == 0) {
		filter->originator = u32;
		(void) nvlist_remove_all(nvlcp, IPP_CONFIG_ORIGINATOR);
	} else {
		filter->originator = IPP_CONFIG_IPQOSCONF;
	}

	/* lookup filter name */

	(void) nvlist_lookup_string(nvlcp, CLASSIFIER_FILTER_NAME, &str);
	(void) strlcpy(filter->name, str, IPQOS_CONF_NAME_LEN);
	(void) nvlist_remove_all(nvlcp, CLASSIFIER_FILTER_NAME);

	/* lookup class name */

	(void) nvlist_lookup_string(nvlcp, CLASSIFIER_CLASS_NAME, &str);
	(void) strlcpy(filter->class_name, str, IPQOS_CONF_NAME_LEN);
	(void) nvlist_remove_all(nvlcp, CLASSIFIER_CLASS_NAME);

	/* lookup src and dst host names if present */

	if (nvlist_lookup_string(nvlcp, IPGPC_SADDR_HOSTNAME, &str) == 0) {
		filter->src_nd_name = malloc(strlen(str) + 1);
		if (filter->src_nd_name) {
			(void) strcpy(filter->src_nd_name, str);
			(void) nvlist_remove_all(nvlcp, IPGPC_SADDR_HOSTNAME);
		} else {
			ipqos_msg(MT_ENOSTR, "malloc");
			nvlist_free(nvlcp);
			return (IPQOS_CONF_ERR);
		}
	}
	if (nvlist_lookup_string(nvlcp, IPGPC_DADDR_HOSTNAME, &str) == 0) {
		filter->dst_nd_name = malloc(strlen(str) + 1);
		if (filter->dst_nd_name) {
			(void) strcpy(filter->dst_nd_name, str);
			(void) nvlist_remove_all(nvlcp, IPGPC_DADDR_HOSTNAME);
		} else {
			ipqos_msg(MT_ENOSTR, "malloc");
			nvlist_free(nvlcp);
			return (IPQOS_CONF_ERR);
		}
	}

	/* lookup ip_version if present */

	if (nvlist_lookup_string(nvlcp, IPGPC_FILTER_PRIVATE, &str) == 0) {
		filter->ip_versions = (uint32_t)strtol(str, &end, 0);
		if (end != str) {
			(void) nvlist_remove_all(nvlcp, IPGPC_FILTER_PRIVATE);
		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Corrupted ip_version returned from "
			    "kernel.\n"));
			nvlist_free(nvlcp);
			return (IPQOS_CONF_ERR);
		}
	}

	/* lookup filter instance if present */

	ret = nvlist_lookup_int32(nvlcp, IPGPC_FILTER_INSTANCE,
	    &filter->instance);
	if (ret != 0) {
		filter->instance = -1;
	} else {
		(void) nvlist_remove_all(nvlcp, IPGPC_FILTER_INSTANCE);
	}

	/* attach new trimmed nvlist to filter */
	filter->nvlist = nvlcp;

	return (IPQOS_CONF_SUCCESS);
}


/*
 * determines whether action_name is a virtual action name.
 * RETURNS: if virtual action 1, else 0.
 */
static int
virtual_action(char *action_name)
{

	if (strcmp(action_name, IPP_ANAME_CONT) == 0 ||
	    strcmp(action_name, IPP_ANAME_DEFER) == 0 ||
	    strcmp(action_name, IPP_ANAME_DROP) == 0) {
		return (1);
	}

	return (0);
}

/*
 * remove all the actions within the kernel. If there is a failure
 * modified is set to represent whether the attempt to flush modified
 * the configuration in any way.
 * RETURNS: IPQOS_CONF_ERR if the ipp_* functions return any errors,
 * else IPQOS_CONF_SUCCESS.
 */
static int
flush(
boolean_t *modified)
{

	int res;
	char **modnames = NULL;
	int nmods;
	char **actnames = NULL;
	int nacts;
	int x, y;

	IPQOSCDBG0(L0, "In flush\n");

	*modified = B_FALSE;

	/*
	 * get list of modules currently loaded.
	 */
	res = ipp_list_mods(&modnames, &nmods);
	if (res != 0) {
		ipqos_msg(MT_ENOSTR, "ipp_list_mods");
		return (IPQOS_CONF_ERR);
	}

	/*
	 * iterate through all the modules listing their actions and
	 * deleting all of them.
	 */
	for (x = 0; x < nmods; x++) {
		IPQOSCDBG1(APPLY, "Getting actions of module %s.\n",
		    modnames[x]);
		res = ipp_mod_list_actions(modnames[x], &actnames, &nacts);
		if (res != 0) {
			ipqos_msg(MT_ENOSTR, "ipp_mod_list_actions");
			cleanup_string_table(modnames, nmods);
			return (IPQOS_CONF_ERR);
		}

		for (y = 0; y < nacts; y++) {
			IPQOSCDBG1(APPLY, "deleting action %s\n", actnames[y]);
			res = ipp_action_destroy(actnames[y], IPP_DESTROY_REF);
			/*
			 * if fails for reason other than action doesn't
			 * exist or action has dependency.
			 */
			if (res != 0 && errno != ENOENT && errno != EBUSY) {
				ipqos_msg(MT_ENOSTR, "ipp_action_destroy");
				cleanup_string_table(modnames, nmods);
				cleanup_string_table(actnames, nacts);
				return (IPQOS_CONF_ERR);
			}

			if (res == 0)
				*modified = B_TRUE;
		}
		cleanup_string_table(actnames, nacts);
	}
	cleanup_string_table(modnames, nmods);

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Trys to flush the configuration. If it fails and nothing has been modified
 * and force_flush is false just return an error, otherwise persist trying to
 * completion.
 * RETURNS: IPQOS_CONF_ERR if flush attempt failed without modifying anything
 * and force_flush was set to false, otherwise IPQOS_CONF_SUCCESS.
 */
static int
atomic_flush(
boolean_t force_flush)
{
	int x = 0;
	int res;
	boolean_t modified = B_FALSE;

	/*
	 * attempt first flush of config.
	 */
	res = flush(&modified);
	if ((force_flush == B_FALSE) && (res != IPQOS_CONF_SUCCESS) &&
	    (modified == B_FALSE)) {
		return (IPQOS_CONF_ERR);
	} else if (res == IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_SUCCESS);
	}

	/*
	 * failed flush that modified config, or force flush set; loop till
	 * successful flush.
	 */
	while (res != IPQOS_CONF_SUCCESS) {
		if (x == 5) {	/* 10 secs since start/last message. */
			ipqos_msg(MT_ERROR,
			    gettext("Retrying configuration flush.\n"));
			x = 0;
		}
		(void) sleep(2);
		x++;
		res = flush(&modified);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Performs a flush of the configuration within a signal blocking region
 * so that there's minimal chance of it being killed and the flush only
 * partially completing.
 * RETURNS: IPQOS_CONF_SUCCESS (for symmetry with the other main functions).
 */
static int
flushconf()
{
	int res;

	/*
	 * make sure that flush is as atomic as possible.
	 */
	if ((res = block_all_signals()) == -1)
		return (IPQOS_CONF_ERR);

	res = atomic_flush(B_FALSE);

	/*
	 * restore signals.
	 */
	(void) restore_all_signals();

	if (res == IPQOS_CONF_SUCCESS) {
		ipqos_msg(MT_LOG, gettext("Configuration flushed.\n"));
	} else {
		ipqos_msg(MT_ENOSTR, "atomic_flush");
	}

	return (res);
}

static int
in_string_table(char *stable[], int size, char *string)
{

	IPQOSCDBG1(L1, "In in_string_table: search string %s\n", string);

	for (--size; size >= 0; size--) {
		if (strcmp(stable[size], string) == 0) {
			IPQOSCDBG1(L1, "Found %s in string table\n", string);
			return (1);
		}
	}

	return (0);
}

/* free the memory occupied by the string table ctable and its contents. */
static void
cleanup_string_table(char *ctable[], int size)
{

	int x;

	if (ctable) {
		for (x = 0; x < size; x++) {
			free(ctable[x]);
		}
		free(ctable);
	}
}

#if 0

/*
 * makes a copy of a string table and returns a ptr to it.
 * RETURNS: NULL on error or if size was 0, else ptr to copied table.
 */
static char **
copy_string_table(char *stable1[], int size)
{

	char **st = NULL;
	int pos;

	/* create char ptr array */

	st = malloc(size * sizeof (char *));
	if (st == NULL) {
		ipqos_msg(MT_ENOSTR, "malloc");
		return (st);
	}

	/* create copy of each string from stable1 in array */

	for (pos = size - 1; pos >= 0; pos--) {
		st[pos] = malloc(strlen(stable1[pos] + 1));
		if (st[pos] == NULL) {
			for (pos++; pos < size; pos++)
				free(st[pos]);
			free(st);
			ipqos_msg(MT_ENOSTR, "malloc");
			return (NULL);
		}

		(void) strcpy(st[pos], stable1[pos]);
	}

	return (st);
}
#endif	/* 0 */

/*
 * retry lookups on filters that soft failed a previous lookup and
 * were put on the retry list.
 * RETURNS: IPQOS_CONF_ERR on any errors, else IPQOS_CONF_SUCCESS.
 */
static int
retry_name_lookups(
ipqos_conf_action_t *actions)
{

	ipqos_conf_action_t *act;
	ipqos_conf_filter_t **new_filters;
	ipqos_conf_filter_t *flt;

	IPQOSCDBG0(APPLY, "In retry_name_lookups:\n");

	for (act = actions; act != NULL; act = act->next) {

		/* store start of new resolved filters */
		GET_LIST_END(&act->filters, &new_filters);

		/*
		 * do name resolution on retry list adding resolved filters
		 * to end of actions filters.
		 */
		for (flt = act->retry_filters; flt != NULL; flt = flt->next) {

			if (domultihome(flt, new_filters, B_TRUE) !=
			    IPQOS_CONF_SUCCESS) {

				/* if resource failure */

				if (flt->nlerr == 0) {
					return (IPQOS_CONF_ERR);
				}
			}
		}

		/* add the newly resolved filters to the kernel action */

		for (flt = *new_filters; flt != NULL; flt = flt->next) {
			if (add_filter(act->name, flt, act->module_version) !=
			    IPQOS_CONF_SUCCESS) {
				return (IPQOS_CONF_ERR);
			}
		}
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * write the configuration in conf to the file given in dstpath. This
 * is done by writing first to a temporary file and then renaming that
 * file to dstpath. This assures an atomic write.
 * RETURNS: IPQOS_CONF_ERR on any errors, else IPQOS_CONF_SUCCESS.
 */
static int
writeconf(
ipqos_conf_action_t *conf,
char *dstpath)
{

	FILE *tmpfp;
	char *tmppath;
	char *pathend;
	ipqos_conf_action_t *act;
	int res;

	IPQOSCDBG0(L0, "in writeconf\n");

	/* construct tmp file path so we can use rename() */

	pathend = strrchr(dstpath, '/');

	/* dstpath in current dir */

	if (pathend == NULL) {
		tmppath = malloc(strlen("ipqosconf.tmp") + 1);
		if (tmppath == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			return (IPQOS_CONF_ERR);
		}
		(void) strcpy(tmppath, "ipqosconf.tmp");

	/* dstpath in root dir */

	} else if (pathend == dstpath) {
		tmppath = malloc(strlen("/ipqosconf.tmp") + 1);
		if (tmppath == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			return (IPQOS_CONF_ERR);
		}
		(void) strcpy(tmppath, "/ipqosconf.tmp");

	/* not pwd or root */

	} else {
		*pathend = NULL;
		tmppath = malloc(strlen(dstpath) + strlen("/ipqosconf.tmp") +
		    1);
		if (tmppath == NULL) {
			ipqos_msg(MT_ENOSTR, "malloc");
			return (IPQOS_CONF_ERR);
		}
		(void) strcpy(tmppath, dstpath);
		(void) strcat(tmppath, "/ipqosconf.tmp");
		*pathend = '/';
	}


	/* open tmp file */

	tmpfp = fopen(tmppath, "w");
	if (tmpfp == NULL) {
		ipqos_msg(MT_ENOSTR, "fopen");
		free(tmppath);
		return (IPQOS_CONF_ERR);
	}

	/* write out format version */

	(void) fprintf(tmpfp, "%s %d.%d\n\n", IPQOS_FMT_VERSION_STR,
	    IPQOS_CUR_FMT_MAJOR_VER, IPQOS_CUR_FMT_MINOR_VER);

	/*
	 * loop through actions in list writing ipqosconf originated
	 * ones out to the tmp file.
	 */
	for (act = conf; act != NULL; act = act->next) {
		if (act->params->originator == IPP_CONFIG_IPQOSCONF) {
			res = printaction(tmpfp, act, 0, 0);
			if (res != IPQOS_CONF_SUCCESS) {
				free(tmppath);
				(void) fclose(tmpfp);
				return (res);
			}
		}
	}
	(void) fclose(tmpfp);

	/* rename tmp file to dst file */

	if (rename(tmppath, dstpath) != 0) {
		ipqos_msg(MT_ENOSTR, "rename");
		free(tmppath);
		return (IPQOS_CONF_ERR);
	}
	free(tmppath);

	return (IPQOS_CONF_SUCCESS);
}

/*
 * read the configuration back from the kernel and then write each of the
 * actions read to IPQOS_CONF_INIT_PATH.
 * RETURNS: IPQOS_CONF_ERR if error, else IPQOS_CONF_SUCCESS.
 */
static int
commitconf()
{

	int ret;
	ipqos_conf_action_t *conf;

	IPQOSCDBG0(L0, "In commitconf\n");

	/* read the configuration from the kernel */

	ret = readkconf(&conf);
	if (ret != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* dissallow a null config to be stored (we can't read one in) */

	if (conf == NULL) {
		ipqos_msg(MT_ERROR,
		    gettext("Can't commit a null configuration.\n"));
		return (IPQOS_CONF_ERR);
	}

	/* make sure if we create file that perms are 644 */

	(void) umask(S_IXUSR | S_IWGRP | S_IXGRP | S_IWOTH | S_IXOTH);

	/* write the configuration to the init file */

	ret = writeconf(conf, IPQOS_CONF_INIT_PATH);
	if (ret != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	ipqos_msg(MT_LOG,
	    gettext("Current configuration saved to init file.\n"));

	return (IPQOS_CONF_SUCCESS);
}

/*
 * Called in the event of a failed rollback. It first flushes the
 * current configuration, then attempts to apply the oconf (the old
 * one), and if that fails flushes again.
 *
 * RETURNS: IPQOS_CONF_ERR if the application of old config fails,
 * else IPQOS_CONF_SUCCESS.
 */
static int
rollback_recover(
ipqos_conf_action_t *oconf)
{
	int res;

	IPQOSCDBG0(RBK, "In rollback_recover\n");

	/*
	 * flush configuration.
	 */
	(void) atomic_flush(B_TRUE);

	/*
	 * mark all elements of old config for application.
	 */
	mark_config_new(oconf);

	/*
	 * attempt to apply old config.
	 */
	res = applydiff(oconf, NULL);
	/*
	 * if failed force flush of config.
	 */
	if (res != IPQOS_CONF_SUCCESS) {
		(void) atomic_flush(B_TRUE);
		return (IPQOS_CONF_ERR);
	}

	return (IPQOS_CONF_SUCCESS);
}

/*
 * read and apply the configuration contained if file ifile to the kernel.
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */
static int
applyconf(char *ifile)
{

	FILE *ifp;
	ipqos_conf_action_t *conf = NULL;
	ipqos_conf_action_t *oconf = NULL;
	ipqos_conf_action_t *act, *oact;
	int res;

	IPQOSCDBG0(L0, "In applyconf:\n");


	/* if filename '-' read from stdin */

	if (strcmp(ifile, "-") == 0) {
		ifp = stdin;
	} else {
		ifp = fopen(ifile, "r");
		if (ifp == NULL) {
			ipqos_msg(MT_ERROR,
			    gettext("Opening file %s for read: %s.\n"),
			    ifile, strerror(errno));
			return (IPQOS_CONF_ERR);
		}
	}

	/* read in new configuration */

	res = readconf(ifp, &conf);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* check configuration is valid */

	res = validconf(conf, 1);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* read in kernel configuration */

	res = readkconf(&oconf);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/*
	 * check there are no same named actions in both config file and the
	 * the kernel that are for a different module. The application
	 * system can't handle these as we would try to add the new
	 * action before we deleted the old one and because actions
	 * in the kernel are indexed solely on their name (their module
	 * isn't included) the kernel would return an error. We want
	 * to avoid this error and the resulting rollback.
	 */
	for (act = conf; act != NULL; act = act->next) {
		for (oact = oconf; oact != NULL; oact = oact->next) {
			/* found action */
			if (strcmp(act->name, oact->name) == 0) {
				/* different module */
				if (strcmp(act->module, oact->module) != 0) {
					ipqos_msg(MT_ERROR,
					    gettext("Action at line %u has "
					    "same name as currently "
					    "installed action, but is for a "
					    "different module.\n"),
					    act->lineno);
					goto fail;
				/* same module - stop search */
				} else {
					break;
				}
			}
		}
	}


	/* create links between actions for use with deletions etc.. */

	res = validconf(oconf, 0);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* diff conf file against kernel */

	res = diffconf(oconf, conf);
	if (res != IPQOS_CONF_SUCCESS) {
		goto fail;
	}

	/* make kernel mods as atomic as possible */

	if ((res = block_all_signals()) == -1) {
		res = IPQOS_CONF_ERR;
		goto fail;
	}

	/* apply difference to kernel */

	res = applydiff(conf, oconf);
#ifdef	_IPQOS_CONF_DEBUG
	if (force_rback || res != IPQOS_CONF_SUCCESS) {
#else
	if (res != IPQOS_CONF_SUCCESS) {
#endif	/* _IPQOS_CONF_DEBUG */

		res = rollback(conf, oconf);
		if (res != IPQOS_CONF_SUCCESS) {
			res = rollback_recover(oconf);
			if (res != IPQOS_CONF_SUCCESS) {
				/* system left flushed */
				ipqos_msg(MT_ERROR,
				    gettext("Failed to rollback from failed "
				    "configuration, configuration flushed.\n"));
				res = IPQOS_CONF_RECOVER_ERR;
			} else {	/* old config re-applied */
				ipqos_msg(MT_ERROR,
				    gettext("Configuration failed, system "
				    "state unchanged.\n"));
				res = IPQOS_CONF_ERR;
			}
		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Configuration failed, system "
			    "state unchanged.\n"));
			res = IPQOS_CONF_ERR;
		}
		goto fail;
	}

	/* retry any soft name lookup failures */

	res = retry_name_lookups(conf);
	if (res != IPQOS_CONF_SUCCESS) {
		res = rollback(conf, oconf);
		if (res != IPQOS_CONF_SUCCESS) {
			res = rollback_recover(oconf);
			if (res != IPQOS_CONF_SUCCESS) {
			/* system left flushed */
				ipqos_msg(MT_ERROR,
				    gettext("Failed to rollback from failed "
				    "configuration, configuration flushed.\n"));
				res = IPQOS_CONF_RECOVER_ERR;
			} else {	/* old config re-applied */
				ipqos_msg(MT_ERROR,
				    gettext("Configuration failed, system "
				    "state unchanged.\n"));
				res = IPQOS_CONF_ERR;
			}
		} else {
			ipqos_msg(MT_ERROR,
			    gettext("Configuration failed, system "
			    "state unchanged.\n"));
			res = IPQOS_CONF_ERR;
		}
		goto fail;

	}

	ipqos_msg(MT_LOG, gettext("IPQoS configuration applied.\n"));

	/* re-enable signals */
	(void) restore_all_signals();

	(void) fclose(ifp);
	free_actions(conf);
	free_actions(oconf);
	return (IPQOS_CONF_SUCCESS);
fail:
	(void) fclose(ifp);
	(void) restore_all_signals();
	if (conf)
		free_actions(conf);
	if (oconf)
		free_actions(oconf);
	if (res == IPQOS_CONF_RECOVER_ERR)
		ipqos_msg(MT_LOG, gettext("Configuration flushed.\n"));
	return (res);
}

static sigset_t set, oset;

static int
block_all_signals()
{
	if (sigfillset(&set) == -1) {
		ipqos_msg(MT_ENOSTR, "sigfillset");
		return (-1);
	}
	if (sigprocmask(SIG_SETMASK, &set, &oset) == -1) {
		ipqos_msg(MT_ENOSTR, "sigprocmask");
		return (-1);
	}
	return (0);
}

static int
restore_all_signals()
{
	if (sigprocmask(SIG_SETMASK, &oset, NULL) == -1) {
		ipqos_msg(MT_ENOSTR, "sigprocmask");
		return (-1);
	}
	return (0);
}

static int
unlock(int fd)
{
	if (lockf(fd, F_ULOCK, 0) == -1) {
		ipqos_msg(MT_ENOSTR, "lockf");
		return (-1);
	}
	return (0);
}

static int
lock()
{
	int fd;
	struct stat sbuf1;
	struct stat sbuf2;

	/*
	 * Open the file with O_CREAT|O_EXCL. If it exists already, it
	 * will fail. If it already exists, check whether it looks like
	 * the one we created.
	 */
	(void) umask(0077);
	if ((fd = open(IPQOS_CONF_LOCK_FILE, O_EXCL|O_CREAT|O_RDWR,
	    S_IRUSR|S_IWUSR)) == -1) {
		if (errno != EEXIST) {
			/* Some other problem. */
			ipqos_msg(MT_ENOSTR,
			    gettext("Cannot open lock file %s"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}

		/*
		 * open() returned an EEXIST error. We don't fail yet
		 * as it could be a residual from a previous
		 * execution. However, we need to clear errno here.
		 * If we don't and print_cmd_buf() is later invoked
		 * as the result of a parsing error, it
		 * will assume that the current error is EEXIST and
		 * that a corresponding error message has already been
		 * printed, which results in an incomplete error
		 * message. If errno is zero, print_cmd_buf() will
		 * assume that it is called as a result of a
		 * parsing error and will print the appropriate
		 * error message.
		 */
		errno = 0;

		/*
		 * File exists. make sure it is OK. We need to lstat()
		 * as fstat() stats the file pointed to by the symbolic
		 * link.
		 */
		if (lstat(IPQOS_CONF_LOCK_FILE, &sbuf1) == -1) {
			ipqos_msg(MT_ENOSTR,
			    gettext("Cannot lstat lock file %s\n"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}
		/*
		 * Check whether it is a regular file and not a symbolic
		 * link. Its link count should be 1. The owner should be
		 * root and the file should be empty.
		 */
		if (!S_ISREG(sbuf1.st_mode) ||
		    sbuf1.st_nlink != 1 ||
		    sbuf1.st_uid != 0 ||
		    sbuf1.st_size != 0) {
			ipqos_msg(MT_ERROR, gettext("Bad lock file %s.\n"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}
		if ((fd = open(IPQOS_CONF_LOCK_FILE, O_CREAT|O_RDWR,
		    S_IRUSR|S_IWUSR)) == -1) {
			ipqos_msg(MT_ENOSTR,
			    gettext("Cannot open lock file %s"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}

		/* Check whether we opened the file that we lstat()ed. */
		if (fstat(fd, &sbuf2) == -1) {
			ipqos_msg(MT_ENOSTR,
			    gettext("Cannot fstat lock file %s\n"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}
		if (sbuf1.st_dev != sbuf2.st_dev ||
		    sbuf1.st_ino != sbuf2.st_ino) {
			/* File changed after we did the lstat() above */
			ipqos_msg(MT_ERROR, gettext("Bad lock file %s.\n"),
			    IPQOS_CONF_LOCK_FILE);
			return (-1);
		}
	}
	if (lockf(fd, F_LOCK, 0) == -1) {
		ipqos_msg(MT_ENOSTR, "lockf");
		return (-1);
	}
	return (fd);
}

/*
 * print the current kernel configuration out to stdout. If viewall
 * is set this causes more verbose configuration listing including
 * showing objects we didn't create, each instance of a mhome filter,
 * etc.. see printaction().
 * RETURNS: IPQOS_CONF_ERR on error, else IPQOS_CONF_SUCCES.
 */

static int
viewconf(int viewall)
{

	ipqos_conf_action_t *conf = NULL;
	ipqos_conf_action_t *act;
	int ret;

	IPQOSCDBG0(L0, "In viewconf\n");

	/* get kernel configuration */

	ret = readkconf(&conf);
	if (ret != IPQOS_CONF_SUCCESS) {
		return (IPQOS_CONF_ERR);
	}

	/* write out format version */

	if (conf != NULL) {
		(void) fprintf(stdout, "%s %d.%d\n\n", IPQOS_FMT_VERSION_STR,
		    IPQOS_CUR_FMT_MAJOR_VER, IPQOS_CUR_FMT_MINOR_VER);
	}

	/* print each of the actions in the kernel config to stdout */

	for (act = conf; act != NULL; act = act->next) {
		ret = printaction(stdout, act, viewall, 0);
		if (ret != IPQOS_CONF_SUCCESS) {
			free_actions(conf);
			return (ret);
		}
		(void) fprintf(stdout, "\n");
	}

	free_actions(conf);

	return (IPQOS_CONF_SUCCESS);
}


/*
 * debug function that reads the config file and prints it out after
 * interpreting to stdout.
 */
#ifdef	_IPQOS_CONF_DEBUG
static int
viewcfile(char *cfile)
{

	ipqos_conf_action_t *conf;
	ipqos_conf_action_t *act;
	int res;
	FILE *ifp;
	int viewall = 1;

	IPQOSCDBG0(L0, "In viewcfile\n");
	ifp = fopen(cfile, "r");
	if (ifp == NULL) {
		ipqos_msg(MT_ERROR, gettext("Opening file %s for read: %s.\n"),
		    cfile, strerror(errno));
		return (IPQOS_CONF_ERR);
	}

	res = readconf(ifp, &conf);
	if (res != IPQOS_CONF_SUCCESS) {
		free(ifp);
		return (IPQOS_CONF_ERR);
	}

	/* print each of the actions in the kernel config to stdout */
	for (act = conf; act != NULL; act = act->next) {
		res = printaction(stdout, act, viewall, 0);
		if (res != IPQOS_CONF_SUCCESS) {
			free(ifp);
			return (res);
		}

		(void) fprintf(stdout, "\n");
	}

	(void) fprintf(stdout, "\n");


	return (IPQOS_CONF_SUCCESS);
}
#endif	/* _IPQOS_CONF_DEBUG */

static void
usage(void)
{
	(void) fprintf(stderr, gettext("usage:\n"
	    "\tipqosconf [-sv] -a file|-\n"
	    "\tipqosconf -c\n"
	    "\tipqosconf -l\n"
	    "\tipqosconf -L\n"
	    "\tipqosconf -f\n"));
}

int
main(int argc, char *argv[])
{

	int c;
	char *ifile = NULL;
	int args;
	int ret;
	int cmd;
	int viewall = 0;
	int lfp;

	/* init global flags */
	use_syslog = verbose = 0;

	/* init current line number */
	lineno = 0;

	/* setup internationalisation */

	(void) setlocale(LC_ALL, "");
#if	!defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN "SYS_TEST"
#endif
	(void) textdomain(TEXT_DOMAIN);

	/* setup syslog parameters */
	openlog("ipqosconf", 0, LOG_USER);

	args = 0;

/* enable debug options */

#ifdef	_IPQOS_CONF_DEBUG
#define	DBGOPTS	"rz:"
#else
#define	DBGOPTS
#endif	/* _IPQOS_CONF_DEBUG */

	while ((c = getopt(argc, argv, "sca:vflL" DBGOPTS)) != EOF) {
		switch (c) {
#ifdef	_IPQOS_CONF_DEBUG
			case 'z':
				cmd = -1;
				ifile = optarg;
				if (*ifile == '\0') {
					usage();
					exit(1);
				}
				args++;
				break;
			case 'r':
				force_rback++;
				break;
#endif	/* _IPQOS_CONF_DEBUG */
			case 'c':
				cmd = IPQOS_CONF_COMMIT;
				args++;
				break;
			case 'a':
				cmd = IPQOS_CONF_APPLY;
				ifile = optarg;
				if (*ifile == '\0') {
					usage();
					exit(1);
				}
				args++;
				break;
			case 'f':
				cmd = IPQOS_CONF_FLUSH;
				args++;
				break;
			case 'l':
				cmd = IPQOS_CONF_VIEW;
				args++;
				break;
			case 'L':
				cmd = IPQOS_CONF_VIEW;
				viewall++;
				args++;
				break;
			case 'v':
				verbose++;
				break;
			case 's':
				use_syslog++;
				break;
			case '?':
				usage();
				return (1);
		}
	}

	/*
	 * dissallow non-option args, > 1 cmd args and syslog/verbose flags set
	 * for anything but apply.
	 */
	if (optind != argc || args > 1 ||
	    use_syslog && cmd != IPQOS_CONF_APPLY ||
	    verbose && cmd != IPQOS_CONF_APPLY) {
		usage();
		exit(1);
	}

	/* if no cmd option then show config */

	if (args == 0) {
		cmd = IPQOS_CONF_VIEW;
	}

	/* stop concurrent ipqosconf invocations */
	lfp = lock();
	if (lfp == -1) {
		exit(1);
	}

	switch (cmd) {
#ifdef	_IPQOS_CONF_DEBUG
		case -1:
			ret = viewcfile(ifile);
			break;
#endif	/* _IPQOS_CONF_DEBUG */
		case IPQOS_CONF_APPLY:
			ret = applyconf(ifile);
			break;
		case IPQOS_CONF_COMMIT:
			ret = commitconf();
			break;
		case IPQOS_CONF_VIEW:
			ret = viewconf(viewall);
			break;
		case IPQOS_CONF_FLUSH:
			ret = flushconf();
			break;
	}

	(void) unlock(lfp);

	return (ret);

}