usr.lib/ilbd/ilbd_scf.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <stdlib.h>
#include <stdio.h>
#include <strings.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/list.h>
#include <libilb.h>
#include <assert.h>
#include <libscf.h>
#include "libilb_impl.h"
#include "ilbd.h"

#define	ILBD_PG_NAME_RULE "rule_"
#define	ILBD_PG_NAME_SG "sg_"
#define	ILBD_PG_NAME_HC "hc_"
#define	ILBD_SVC_FMRI "svc:/network/loadbalancer/ilb"
#define	ILBD_INST_NAME "default"

typedef enum {
	ILBD_RULE_STATUS,
	ILBD_RULE_VIP,
	ILBD_RULE_PROTO,
	ILBD_RULE_PORT,
	ILBD_RULE_ALGO,
	ILBD_RULE_TOPO,
	ILBD_RULE_NAT_STR,
	ILBD_RULE_NAT_END,
	ILBD_RULE_STI_MASK,
	ILBD_RULE_SGNAME,
	ILBD_RULE_HCNAME,
	ILBD_RULE_HCPORT,
	ILBD_RULE_HCPFLAG,
	ILBD_RULE_DRAINTIME,
	ILBD_RULE_NAT_TO,
	ILBD_RULE_PERS_TO,

	ILBD_SG_SERVER,

	ILBD_HC_TEST,
	ILBD_HC_TIMEOUT,
	ILBD_HC_INTERVAL,
	ILBD_HC_DEF_PING,
	ILBD_HC_COUNT,

	ILBD_VAR_INVALID
} ilbd_var_type_t;

typedef struct prop_tbl_entry {
	ilbd_var_type_t val_type;
	const char *scf_propname;
	scf_type_t scf_proptype;
} prop_tbl_entry_t;

/*
 * this table contains a map of all SCF properties, including rules,
 * servergroups and health checks. The place to add new property needs to be
 * watched carefully. When new properties are added, corresponding *VAR_NUM
 * needs to be adjusted to reflect the correct index of the table
 */
prop_tbl_entry_t prop_tbl[] = {
	/* entried for rule */
	{ILBD_RULE_STATUS, "status", SCF_TYPE_BOOLEAN},
	/* SCF_TYPE_NET_ADDR_V4 or SCF_TYPE_NET_ADDR_V6 */
	{ILBD_RULE_VIP, "vip", SCF_TYPE_INVALID},
	{ILBD_RULE_PROTO, "protocol", SCF_TYPE_ASTRING},
	{ILBD_RULE_PORT, "port", SCF_TYPE_ASTRING},
	{ILBD_RULE_ALGO, "ilb-algo", SCF_TYPE_ASTRING},
	{ILBD_RULE_TOPO, "ilb-type", SCF_TYPE_ASTRING},
	{ILBD_RULE_NAT_STR, "ilb-nat-start", SCF_TYPE_INVALID},
	{ILBD_RULE_NAT_END, "ilb-nat-end", SCF_TYPE_INVALID},
	{ILBD_RULE_STI_MASK, "ilb-sti-mask", SCF_TYPE_INVALID},
	{ILBD_RULE_SGNAME, "servergroup", SCF_TYPE_ASTRING},
	{ILBD_RULE_HCNAME, "healthcheck", SCF_TYPE_ASTRING},
	{ILBD_RULE_HCPORT, "hc-port", SCF_TYPE_INTEGER},
	{ILBD_RULE_HCPFLAG, "hcp-flag", SCF_TYPE_INTEGER},
	{ILBD_RULE_DRAINTIME, "drain-time", SCF_TYPE_INTEGER},
	{ILBD_RULE_NAT_TO, "nat-timeout", SCF_TYPE_INTEGER},
	{ILBD_RULE_PERS_TO, "pers-timeout", SCF_TYPE_INTEGER},
	/* add new rule related prop here */
	/* entries for sg */
	{ILBD_SG_SERVER, "server", SCF_TYPE_ASTRING},
	/* add new sg related prop here */
	/* entries for hc */
	{ILBD_HC_TEST, "test", SCF_TYPE_ASTRING},
	{ILBD_HC_TIMEOUT, "timeout", SCF_TYPE_INTEGER},
	{ILBD_HC_INTERVAL, "interval", SCF_TYPE_INTEGER},
	{ILBD_HC_DEF_PING, "ping", SCF_TYPE_BOOLEAN},
	/* add new hc related prop here */
	{ILBD_HC_COUNT, "count", SCF_TYPE_INTEGER}
};

#define	ILBD_PROP_VAR_NUM (ILBD_HC_COUNT + 1)
#define	ILBD_RULE_VAR_NUM (ILBD_SG_SERVER)
#define	ILBD_SG_VAR_NUM (ILBD_HC_TEST - ILBD_SG_SERVER)
#define	ILBD_HC_VAR_NUM (ILBD_PROP_VAR_NUM - ILBD_HC_TEST)

static ilb_status_t ilbd_scf_set_prop(scf_propertygroup_t *, const char *,
    scf_type_t, scf_value_t *);
static ilb_status_t ilbd_scf_retrieve_pg(const char *, scf_propertygroup_t **,
    boolean_t);
static ilb_status_t ilbd_scf_delete_pg(scf_propertygroup_t *);
static ilb_status_t ilbd_scf_get_prop_val(scf_propertygroup_t *, const char *,
    scf_value_t **);

#define	MIN(a, b)	((a) < (b) ? (a) : (b))

int
ilbd_scf_limit(int type)
{
	return (MIN(scf_limit(type), 120));
}

/*
 * Translate libscf error to libilb status
 */
ilb_status_t
ilbd_scf_err_to_ilb_err()
{
	switch (scf_error()) {
	case SCF_ERROR_NONE:
		return (ILB_STATUS_OK);
	case SCF_ERROR_HANDLE_MISMATCH:
	case SCF_ERROR_HANDLE_DESTROYED:
	case SCF_ERROR_VERSION_MISMATCH:
	case SCF_ERROR_NOT_BOUND:
	case SCF_ERROR_CONSTRAINT_VIOLATED:
	case SCF_ERROR_NOT_SET:
	case SCF_ERROR_TYPE_MISMATCH:
	case SCF_ERROR_INVALID_ARGUMENT:
		return (ILB_STATUS_EINVAL);
	case SCF_ERROR_NO_MEMORY:
	case SCF_ERROR_NO_RESOURCES:
		return (ILB_STATUS_ENOMEM);
	case SCF_ERROR_NOT_FOUND:
	case SCF_ERROR_DELETED:
		return (ILB_STATUS_ENOENT);
	case SCF_ERROR_EXISTS:
		return (ILB_STATUS_EEXIST);
	case SCF_ERROR_PERMISSION_DENIED:
		return (ILB_STATUS_PERMIT);
	case SCF_ERROR_CALLBACK_FAILED:
		return (ILB_STATUS_CALLBACK);
	case SCF_ERROR_IN_USE:
		return (ILB_STATUS_INUSE);
	default:
		return (ILB_STATUS_INTERNAL);
	}
}

static void
ilbd_name_to_scfpgname(ilbd_scf_pg_type_t pg_type, const char *pgname,
    char *scf_pgname)
{
	switch (pg_type) {
	case ILBD_SCF_RULE:
		(void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
		    ILBD_PG_NAME_RULE "%s", pgname);
		return;
	case ILBD_SCF_SG:
		(void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
		    ILBD_PG_NAME_SG "%s", pgname);
		return;
	case ILBD_SCF_HC:
		(void) snprintf(scf_pgname, ILBD_MAX_NAME_LEN,
		    ILBD_PG_NAME_HC "%s", pgname);
		return;
	/* Should not happen.  Log it and put ILB service in maintenance. */
	default:
		logerr("ilbd_name_to_scfpgname: invalid pg type %d for pg %s",
		    pg_type, pgname);
		(void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
		exit(EXIT_FAILURE);
		return;
	}
}

static void
ilbd_scf_destroy(scf_handle_t *h, scf_service_t *s, scf_instance_t *inst,
    scf_propertygroup_t *pg)
{
	if (pg != NULL)
		scf_pg_destroy(pg);
	if (inst != NULL)
		scf_instance_destroy(inst);
	if (s != NULL)
		scf_service_destroy(s);
	if (h != NULL)
		scf_handle_destroy(h);
}


static ilb_status_t
ilbd_scf_get_inst(scf_handle_t **h, scf_service_t **svc, scf_instance_t **inst)
{
	if ((*h = scf_handle_create(SCF_VERSION)) == NULL)
		return (ILB_STATUS_INTERNAL);

	if (scf_handle_bind(*h) != 0) {
		ilbd_scf_destroy(*h, NULL, NULL, NULL);
		return (ilbd_scf_err_to_ilb_err());
	}

	if ((*svc = scf_service_create(*h)) == NULL) {
		ilbd_scf_destroy(*h, NULL, NULL, NULL);
		return (ilbd_scf_err_to_ilb_err());
	}

	if (scf_handle_decode_fmri(*h, ILBD_SVC_FMRI, NULL, *svc, NULL, NULL,
	    NULL, SCF_DECODE_FMRI_EXACT) != 0) {
		ilbd_scf_destroy(*h, *svc, NULL, NULL);
		return (ilbd_scf_err_to_ilb_err());
	}

	if ((*inst = scf_instance_create(*h)) == NULL) {
		ilbd_scf_destroy(*h, *svc, NULL, NULL);
		return (ilbd_scf_err_to_ilb_err());
	}

	if (scf_service_get_instance(*svc, ILBD_INST_NAME, *inst) != 0) {
		ilbd_scf_destroy(*h, *svc, *inst, NULL);
		return (ilbd_scf_err_to_ilb_err());
	}
	return (ILB_STATUS_OK);
}

/*
 * If create is set, create a new prop group, destroy the old one if exists.
 * If create not set, try to find the prop group with given name.
 * The created or found entry is returned as *pg.
 * Caller frees *pg and its handle scf_pg_handle(pg)
 */
static ilb_status_t
ilbd_scf_retrieve_pg(const char *pgname, scf_propertygroup_t **pg,
    boolean_t create)
{
	scf_instance_t *inst;
	scf_handle_t *h;
	scf_service_t *svc;
	ilb_status_t ret;

	ret = ilbd_scf_get_inst(&h, &svc, &inst);
	if (ret != ILB_STATUS_OK)
		return (ret);

	*pg = scf_pg_create(h);
	if (*pg == NULL)
		return (ILB_STATUS_INTERNAL);

	if (scf_instance_get_pg(inst, pgname, *pg) != 0) {
		if (scf_error() != SCF_ERROR_NOT_FOUND ||
		    (scf_error() == SCF_ERROR_NOT_FOUND && (!create))) {
			ilbd_scf_destroy(h, svc, inst, *pg);
			*pg = NULL;
			return (ilbd_scf_err_to_ilb_err());
		}
	} else {
		/*
		 * Found pg, don't want to create, return EEXIST.  Note that
		 * h cannot be destroyed here since the caller needs to use it.
		 * The caller gets it by calling scf_pg_handle().
		 */
		if (!create) {
			ilbd_scf_destroy(NULL, svc, inst, NULL);
			return (ILB_STATUS_EEXIST);
		}
		/* found pg, need to create, destroy the existing one */
		else
			(void) ilbd_scf_delete_pg(*pg);
	}

	if (create) {
		if (scf_instance_add_pg(inst, pgname,
		    SCF_GROUP_APPLICATION, 0, *pg) != 0) {
			ilbd_scf_destroy(h, svc, inst, *pg);
			*pg = NULL;
			return (ilbd_scf_err_to_ilb_err());
		}
	}

	/*
	 * Note that handle cannot be destroyed here, caller sometimes needs
	 * to use it.  It gets the handle by calling scf_pg_handle().
	 */
	ilbd_scf_destroy(NULL, svc, inst, NULL);
	return (ILB_STATUS_OK);
}

struct algo_tbl_entry {
	ilb_algo_t algo_type;
	const char *algo_str;
} algo_tbl[] = {
	{ILB_ALG_ROUNDROBIN, "ROUNDROBIN"},
	{ILB_ALG_HASH_IP, "HASH-IP"},
	{ILB_ALG_HASH_IP_SPORT, "HASH-IP-PORT"},
	{ILB_ALG_HASH_IP_VIP, "HASH-IP-VIP"}
};

#define	ILBD_ALGO_TBL_SIZE (sizeof (algo_tbl) / \
	sizeof (*algo_tbl))

void
ilbd_algo_to_str(ilb_algo_t algo_type, char *valstr)
{
	int i;

	for (i = 0; i < ILBD_ALGO_TBL_SIZE; i++) {
		if (algo_type == algo_tbl[i].algo_type) {
			(void) strlcpy(valstr, algo_tbl[i].algo_str,
			    ILBD_MAX_VALUE_LEN);
			return;
		}
	}
	logerr("ilbd_algo_to_str: algo not found");
}

static void
ilbd_scf_str_to_algo(ilb_algo_t *algo_type, char *valstr)
{
	int i;

	for (i = 0; i < ILBD_ALGO_TBL_SIZE; i++) {
		if (strcmp(valstr, algo_tbl[i].algo_str) == 0) {
			*algo_type = algo_tbl[i].algo_type;
			return;
		}
	}
	logerr("ilbd_scf_str_to_algo: algo not found");
}

struct topo_tbl_entry {
	ilb_topo_t topo_type;
	const char *topo_str;
} topo_tbl[] = {
	{ILB_TOPO_DSR, "DSR"},
	{ILB_TOPO_NAT, "NAT"},
	{ILB_TOPO_HALF_NAT, "HALF-NAT"}
};

#define	ILBD_TOPO_TBL_SIZE (sizeof (topo_tbl) / \
	sizeof (*topo_tbl))

void
ilbd_topo_to_str(ilb_topo_t topo_type, char *valstr)
{
	int i;

	for (i = 0; i < ILBD_TOPO_TBL_SIZE; i++) {
		if (topo_type == topo_tbl[i].topo_type) {
			(void) strlcpy(valstr, topo_tbl[i].topo_str,
			    ILBD_MAX_VALUE_LEN);
			return;
		}
	}
	logerr("ilbd_scf_topo_to_str: topo not found");
}

static void
ilbd_scf_str_to_topo(ilb_topo_t *topo_type, char *valstr)
{
	int i;

	for (i = 0; i < ILBD_TOPO_TBL_SIZE; i++) {
		if (strcmp(valstr, topo_tbl[i].topo_str) == 0) {
			*topo_type = topo_tbl[i].topo_type;
			return;
		}
	}
	logerr("ilbd_scf_str_to_topo: topo not found");
}

static void
ilbd_get_svr_field(char *valstr, struct in6_addr *sgs_addr,
    int32_t *min_port, int32_t *max_port, int32_t *sgs_flags)
{
	char *ipaddr, *ipverstr, *portstr, *flagstr;
	int ip_ver;
	ilb_ip_addr_t temp_ip;
	void *addrptr;
	char *max_portstr;

	ipaddr = strtok(valstr, ";");
	ipverstr = strtok(NULL, ";");
	portstr = strtok(NULL, ";");
	flagstr = strtok(NULL, ";");

	if (ipaddr == NULL || ipverstr == NULL || portstr == NULL ||
	    flagstr == NULL) {
		logerr("%s: invalid server fields", __func__);
		(void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
		exit(EXIT_FAILURE);
	}
	ip_ver = atoi(ipverstr);
	addrptr = (ip_ver == AF_INET) ? (void *)&temp_ip.ia_v4 :
	    (void *)&temp_ip.ia_v6;
	if (inet_pton(ip_ver, ipaddr, addrptr) == NULL) {
		logerr("ilbd_get_svr_field: inet_pton failed");
		return;
	}

	if (ip_ver == AF_INET) {
		IN6_INADDR_TO_V4MAPPED(&(temp_ip.ia_v4), sgs_addr);
	} else {
		(void) memcpy(sgs_addr, &(temp_ip.ia_v6),
		    sizeof (struct in6_addr));
	}

	*sgs_flags = atoi(flagstr);
	*min_port = atoi(strtok(portstr, "-"));
	*min_port = ntohs(*min_port);
	max_portstr = strtok(NULL, "-");
	if (max_portstr != NULL) {
		*max_port = atoi(max_portstr);
		*max_port = ntohs(*max_port);
	}
}

/*
 * Convert the info of a server to its SCF string value representation.
 * Argument value is assumed to be of size ILBD_MAX_VALUE_LEN.
 */
static void
ilbd_srv_scf_val(ilbd_srv_t *srv, char *value)
{
	char ipstr[INET6_ADDRSTRLEN];
	int ipver;

	if (GET_AF(&srv->isv_addr) == AF_INET) {
		struct in_addr v4_addr;

		IN6_V4MAPPED_TO_INADDR(&srv->isv_addr, &v4_addr);
		(void) inet_ntop(AF_INET, &v4_addr, ipstr, sizeof (ipstr));
		ipver = AF_INET;
	} else {
		(void) inet_ntop(AF_INET6, &srv->isv_addr, ipstr,
		    sizeof (ipstr));
		ipver = AF_INET6;
	}
	(void) snprintf(value, ILBD_MAX_VALUE_LEN, "%s;%d;%d-%d;%d",
	    ipstr, ipver, ntohs(srv->isv_minport), ntohs(srv->isv_maxport),
	    srv->isv_flags);
}

/* get the "ip:port:status" str of the #num server in the servergroup */
ilb_status_t
ilbd_get_svr_info(ilbd_sg_t *sg, int num, char *valstr, char *svrname)
{
	int i;
	ilbd_srv_t *tmp_srv = NULL;

	tmp_srv = list_head(&sg->isg_srvlist);
	if (tmp_srv == NULL)
		return (ILB_STATUS_ENOENT);

	for (i = 0; i < num; i++)
		tmp_srv = list_next(&sg->isg_srvlist, tmp_srv);

	assert(tmp_srv != NULL);
	if (valstr != NULL)
		ilbd_srv_scf_val(tmp_srv, valstr);

	if (svrname != NULL) {
		(void) snprintf(svrname, ILBD_MAX_NAME_LEN, "server%d",
		    tmp_srv->isv_id);
	}

	return (ILB_STATUS_OK);
}

/* convert a struct in6_addr to valstr */
ilb_status_t
ilbd_scf_ip_to_str(uint16_t ipversion, struct in6_addr *addr,
    scf_type_t *scftype, char *valstr)
{
	size_t vallen;
	ilb_ip_addr_t ipaddr;
	void *addrptr;

	vallen = (ipversion == AF_INET) ? INET_ADDRSTRLEN :
	    INET6_ADDRSTRLEN;
	if (scftype != NULL)
		*scftype = (ipversion == AF_INET) ? SCF_TYPE_NET_ADDR_V4 :
		    SCF_TYPE_NET_ADDR_V6;

	IP_COPY_IMPL_2_CLI(addr, &ipaddr);
	addrptr = (ipversion == AF_INET) ?
	    (void *)&ipaddr.ia_v4 : (void *)&ipaddr.ia_v6;
	(void) inet_ntop(ipversion, (void *)addrptr, valstr, vallen);
	return (ILB_STATUS_OK);
}

/*
 * This function takes a ilbd internal data struct and translate its value to
 * scf value. The data struct is passed in within "data".
 * Upon successful return, the scf val will be stored in "val" and the scf type
 * will be returned in "scftype" if scftype != NULL, the number of values
 * translated will be in "numval"
 * If it failed, no data will be written to SCF
 */
static ilb_status_t
ilbd_data_to_scfval(ilbd_scf_pg_type_t pg_type, ilbd_var_type_t type,
    scf_handle_t *h, void *data, scf_value_t ***val, scf_type_t *scftype,
    int *numval)
{
	scf_value_t *v, **varray = NULL;
	int ret = ILB_STATUS_OK;
	int i;
	int scf_val_len = ILBD_MAX_VALUE_LEN;
	char *valstr = NULL;
	int valint;
	uint8_t valbool = 0;
	ilbd_rule_t *r_ent = NULL;
	ilbd_sg_t *s_ent = NULL;
	ilbd_hc_t *h_ent = NULL;

	switch (pg_type) {
	case ILBD_SCF_RULE:
		r_ent = (ilbd_rule_t *)data;
		break;
	case ILBD_SCF_SG:
		s_ent = (ilbd_sg_t *)data;
		break;
	case ILBD_SCF_HC:
		h_ent = (ilbd_hc_t *)data;
		break;
	}

	v = scf_value_create(h);
	if (v == NULL)
		return (ILB_STATUS_INTERNAL);

	if ((valstr = malloc(scf_val_len)) == NULL)
			return (ILB_STATUS_ENOMEM);
	switch (type) {
	case ILBD_RULE_STATUS:
		valbool = r_ent->irl_flags & ILB_FLAGS_RULE_ENABLED;
		break;
	case ILBD_RULE_VIP:
		ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion, &r_ent->irl_vip,
		    scftype, valstr);
		if (ret != ILB_STATUS_OK) {
			free(valstr);
			scf_value_destroy(v);
			return (ret);
		}
		break;
	case ILBD_RULE_PROTO: {
		struct protoent *protoent;

		protoent = getprotobynumber(r_ent->irl_proto);
		(void) strlcpy(valstr, protoent->p_name, scf_val_len);
		break;
	}
	case ILBD_RULE_PORT:
		(void) snprintf(valstr, scf_val_len, "%d-%d",
		    r_ent->irl_minport, r_ent->irl_maxport);
		break;
	case ILBD_RULE_ALGO:
		ilbd_algo_to_str(r_ent->irl_algo, valstr);
		break;
	case ILBD_RULE_TOPO:
		ilbd_topo_to_str(r_ent->irl_topo, valstr);
		break;
	case ILBD_RULE_NAT_STR:
		ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
		    &r_ent->irl_nat_src_start, scftype, valstr);
		if (ret != ILB_STATUS_OK) {
			free(valstr);
			scf_value_destroy(v);
			return (ret);
		}
		break;
	case ILBD_RULE_NAT_END:
		ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
		    &r_ent->irl_nat_src_end, scftype, valstr);
		if (ret != ILB_STATUS_OK) {
			free(valstr);
			scf_value_destroy(v);
			return (ret);
		}
		break;
	case ILBD_RULE_STI_MASK:
		ret = ilbd_scf_ip_to_str(r_ent->irl_ipversion,
		    &r_ent->irl_stickymask, scftype, valstr);
		if (ret != ILB_STATUS_OK) {
			free(valstr);
			scf_value_destroy(v);
			return (ret);
		}
		break;
	case ILBD_RULE_SGNAME:
		(void) strlcpy(valstr, r_ent->irl_sgname, scf_val_len);
		break;
	case ILBD_RULE_HCNAME:
		if (r_ent->irl_hcname[0] != '\0')
			(void) strlcpy(valstr, r_ent->irl_hcname,
			    scf_val_len);
		else
			bzero(valstr, ILBD_MAX_VALUE_LEN);
		break;
	case ILBD_RULE_HCPORT:
		valint = r_ent->irl_hcport;
		break;
	case ILBD_RULE_HCPFLAG:
		valint = r_ent->irl_hcpflag;
		break;
	case ILBD_RULE_DRAINTIME:
		valint = r_ent->irl_conndrain;
		break;
	case ILBD_RULE_NAT_TO:
		valint = r_ent->irl_nat_timeout;
		break;
	case ILBD_RULE_PERS_TO:
		valint = r_ent->irl_sticky_timeout;
		break;

	case ILBD_SG_SERVER:
		if (s_ent->isg_srvcount == 0) {
			(void) strlcpy(valstr, "EMPTY_SERVERGROUP",
			    scf_val_len);
			break;
		}

		varray = calloc(sizeof (*varray), s_ent->isg_srvcount);
		if (varray == NULL) {
			scf_value_destroy(v);
			free(valstr);
			return (ILB_STATUS_ENOMEM);
		}

		for (i = 0; i < s_ent->isg_srvcount; i++) {
			if (v == NULL) {
				for (i--; i >= 0; i--)
					scf_value_destroy(varray[i]);
				free(valstr);
				return (ILB_STATUS_ENOMEM);
			}

			ret = ilbd_get_svr_info(s_ent, i, valstr, NULL);
			if (ret != ILB_STATUS_OK) {
				scf_value_destroy(v);
				for (i--; i >= 0; i--)
					scf_value_destroy(varray[i]);
				free(valstr);
				free(varray);
				return (ret);
			}
			(void) scf_value_set_astring(v, valstr);
			varray[i] = v;
			v = scf_value_create(h);
		}
		/* the last 'v' we created will go unused, so drop it */
		scf_value_destroy(v);
		*numval = s_ent->isg_srvcount;
		*val = varray;
		free(valstr);
		return (ret);
	case ILBD_HC_TEST:
		(void) strlcpy(valstr, h_ent->ihc_test, scf_val_len);
		break;
	case ILBD_HC_TIMEOUT:
		valint = h_ent->ihc_timeout;
		break;
	case ILBD_HC_INTERVAL:
		valint = h_ent->ihc_interval;
		break;
	case ILBD_HC_DEF_PING:
		valbool = h_ent->ihc_def_ping;
		break;
	case ILBD_HC_COUNT:
		valint = h_ent->ihc_count;
		break;
	}

	switch (*scftype) {
	case SCF_TYPE_BOOLEAN:
		scf_value_set_boolean(v, valbool);
		break;
	case SCF_TYPE_ASTRING:
		(void) scf_value_set_astring(v, valstr);
		break;
	case SCF_TYPE_INTEGER:
		scf_value_set_integer(v, valint);
		break;
	case SCF_TYPE_NET_ADDR_V4:
		(void) scf_value_set_from_string(v, SCF_TYPE_NET_ADDR_V4,
		    valstr);
		break;
	case SCF_TYPE_NET_ADDR_V6:
		(void) scf_value_set_from_string(v, SCF_TYPE_NET_ADDR_V6,
		    valstr);
		break;
	}
	free(valstr);

	varray = calloc(1, sizeof (*varray));
	if (varray == NULL) {
		scf_value_destroy(v);
		return (ILB_STATUS_ENOMEM);
	}
	varray[0] = v;
	*val = varray;
	*numval = 1;
	return (ret);
}

/*
 * create a scf property group
 */
ilb_status_t
ilbd_create_pg(ilbd_scf_pg_type_t pg_type, void *data)
{
	ilb_status_t ret;
	char *pgname;
	scf_propertygroup_t *pg = NULL;
	scf_value_t **val;
	scf_handle_t *h;
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char  *scfpgbuf; /* property group name or group type */
	int i, i_st, i_end;

	switch (pg_type) {
	case ILBD_SCF_RULE: {
		ilbd_rule_t *r_ent = (ilbd_rule_t *)data;

		pgname = r_ent->irl_name;
		i_st = 0;
		i_end = ILBD_RULE_VAR_NUM;
		break;
	}
	case ILBD_SCF_SG: {
		ilbd_sg_t *s_ent = (ilbd_sg_t *)data;

		pgname = s_ent->isg_name;
		i_st = ILBD_RULE_VAR_NUM;
		i_end = ILBD_RULE_VAR_NUM + ILBD_SG_VAR_NUM;
		break;
	}
	case ILBD_SCF_HC: {
		ilbd_hc_t *h_ent = (ilbd_hc_t *)data;

		pgname = h_ent->ihc_name;
		i_st = ILBD_RULE_VAR_NUM + ILBD_SG_VAR_NUM;
		i_end = ILBD_PROP_VAR_NUM;
		break;
	}
	default:
		logdebug("ilbd_create_pg: invalid pg type %d for pg %s",
		    pg_type, pgname);
		return (ILB_STATUS_EINVAL);
	}
	if ((scfpgbuf = malloc(scf_name_len)) == NULL)
		return (ILB_STATUS_ENOMEM);

	ilbd_name_to_scfpgname(pg_type, pgname, scfpgbuf);

	ret = ilbd_scf_retrieve_pg(scfpgbuf, &pg, B_TRUE);
	if (ret != ILB_STATUS_OK) {
		free(scfpgbuf);
		return (ret);
	}
	h = scf_pg_handle(pg);

	/* fill in props */
	for (i = i_st; i < i_end; i++) {
		int num, j;
		scf_type_t scftype = prop_tbl[i].scf_proptype;

		ret = ilbd_data_to_scfval(pg_type, prop_tbl[i].val_type, h,
		    data, &val, &scftype, &num);
		if (ret != ILB_STATUS_OK)
			goto done;

		for (j = 0; j < num; j++) {
			if (pg_type == ILBD_SCF_SG) {
				ret = ilbd_get_svr_info(data, j, NULL,
				    scfpgbuf);
				if (ret == ILB_STATUS_ENOENT) {
					(void) strlcpy(scfpgbuf,
					    "EMPTY_SERVER", scf_name_len);
				}
				ret = ilbd_scf_set_prop(pg, scfpgbuf,
				    scftype, val[j]);
			} else {
				ret = ilbd_scf_set_prop(pg,
				    prop_tbl[i].scf_propname, scftype, val[j]);
			}
			scf_value_destroy(val[j]);
		}
		free(val);
	}

done:
	free(scfpgbuf);
	ilbd_scf_destroy(h, NULL, NULL, pg);
	return (ret);
}

/*
 * destroy a scf property group
 */
static ilb_status_t
ilbd_scf_delete_pg(scf_propertygroup_t *pg)
{
	if (scf_pg_delete(pg) != 0)
		return (ilbd_scf_err_to_ilb_err());
	return (ILB_STATUS_OK);
}

/* sg can have same name as rule */
ilb_status_t
ilbd_destroy_pg(ilbd_scf_pg_type_t pg_t, const char *pgname)
{
	ilb_status_t ret;
	scf_propertygroup_t *pg;
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char *scfname;

	if ((scfname = malloc(scf_name_len)) == NULL)
		return (ILB_STATUS_ENOMEM);
	ilbd_name_to_scfpgname(pg_t, pgname, scfname);

	ret = ilbd_scf_retrieve_pg(scfname, &pg, B_FALSE);
	free(scfname);
	if (ret != ILB_STATUS_EEXIST)
		return (ret);
	ret = ilbd_scf_delete_pg(pg);
	ilbd_scf_destroy(scf_pg_handle(pg), NULL, NULL, pg);
	return (ret);
}

/*
 * Set named property to scf value specified.  If property is new,
 * create it.
 */
static ilb_status_t
ilbd_scf_set_prop(scf_propertygroup_t *pg, const char *propname,
    scf_type_t proptype, scf_value_t *val)
{
	scf_handle_t *h = NULL;
	scf_property_t *prop = NULL;
	scf_value_t *oldval = NULL;
	scf_transaction_t *tx = NULL;
	scf_transaction_entry_t *ent = NULL;
	boolean_t new = B_FALSE;
	ilb_status_t ret = ILB_STATUS_OK;
	int commit_ret;

	h = scf_pg_handle(pg);
	if (h == NULL || propname == NULL)
		return (ILB_STATUS_EINVAL);

	ret = ilbd_scf_get_prop_val(pg, propname, &oldval);
	if (oldval != NULL)
		scf_value_destroy(oldval);
	if (ret == ILB_STATUS_ENOENT)
		new = B_TRUE;
	else if (ret != ILB_STATUS_OK)
		return (ret);

	if ((prop = scf_property_create(h)) == NULL)
		return (ilbd_scf_err_to_ilb_err());
	if ((tx = scf_transaction_create(h)) == NULL ||
	    (ent = scf_entry_create(h)) == NULL) {
		ret = ilbd_scf_err_to_ilb_err();
		logdebug("ilbd_scf_set_prop: create scf transaction failed\n");
		goto out;
	}

	if (scf_transaction_start(tx, pg) == -1) {
		ret = ilbd_scf_err_to_ilb_err();
		logdebug("ilbd_scf_set_prop: start scf transaction failed\n");
		goto out;
	}

	if (new) {
		if (scf_transaction_property_new(tx, ent, propname,
		    proptype) == -1) {
			ret = ilbd_scf_err_to_ilb_err();
			logdebug("ilbd_scf_set_prop: create scf prop failed\n");
			goto out;
		}
	} else {
		if (scf_transaction_property_change(tx, ent, propname, proptype)
		    == -1) {
			ret = ilbd_scf_err_to_ilb_err();
			logdebug("ilbd_scf_set_prop: change scf prop failed\n");
			goto out;
		}
	}

	if (scf_entry_add_value(ent, val) != 0) {
		logdebug("ilbd_scf_set_prop: add scf entry failed\n");
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}

	commit_ret = scf_transaction_commit(tx);
	switch (commit_ret) {
	case 1:
		ret = ILB_STATUS_OK;
		/* update pg here, so subsequent property setting  succeeds */
		(void) scf_pg_update(pg);
		break;
	case 0:
		/* transaction failed due to not having most recent pg */
		ret = ILB_STATUS_INUSE;
		break;
	default:
		ret = ilbd_scf_err_to_ilb_err();
		break;
	}
out:
	if (tx != NULL)
		scf_transaction_destroy(tx);
	if (ent != NULL)
		scf_entry_destroy(ent);
	if (prop != NULL)
		scf_property_destroy(prop);

	return (ret);
}

/*
 * get a prop's scf val
 */
static ilb_status_t
ilbd_scf_get_prop_val(scf_propertygroup_t *pg, const char *propname,
    scf_value_t **val)
{
	scf_handle_t *h = NULL;
	scf_property_t *prop = NULL;
	scf_value_t *value = NULL;
	ilb_status_t ret = ILB_STATUS_OK;

	h = scf_pg_handle(pg);
	if (h == NULL || propname == NULL)
		return (ILB_STATUS_EINVAL);

	if ((prop = scf_property_create(h)) == NULL)
		return (ilbd_scf_err_to_ilb_err());

	if (scf_pg_get_property(pg, propname, prop) != 0) {
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}

	if ((value = scf_value_create(h)) == NULL) {
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}

	if (scf_property_get_value(prop, value) != 0) {
		scf_value_destroy(value);
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}

	*val = value;
out:
	if (prop != NULL)
		scf_property_destroy(prop);

	return (ret);
}

typedef struct ilbd_data
{
	union {
		ilb_sg_info_t *sg_info;
		ilb_hc_info_t *hc_info;
		ilb_rule_info_t *rule_info;
	} data;
	ilbd_scf_pg_type_t pg_type;	/* type of data */
#define	sg_data data.sg_info
#define	hc_data data.hc_info
#define	rule_data data.rule_info
} ilbd_data_t;

void
ilbd_scf_str_to_ip(int ipversion, char *ipstr, struct in6_addr *addr)
{
	ilb_ip_addr_t ipaddr;
	void *addrptr;

	addrptr = (ipversion == AF_INET) ?
	    (void *)&ipaddr.ia_v4 : (void *)&ipaddr.ia_v6;
	(void) inet_pton(ipversion, ipstr, addrptr);
	if (ipversion == AF_INET) {
		IN6_INADDR_TO_V4MAPPED(&(ipaddr.ia_v4), addr);
	} else {
		(void) memcpy(addr, &(ipaddr.ia_v6),
		    sizeof (struct in6_addr));
	}
}

/*
 * This function takes a scf value and writes it to the correct field of the
 * corresponding data struct.
 */
static ilb_status_t
ilbd_scfval_to_data(const char *propname, ilbd_var_type_t ilb_type,
    scf_value_t *val, ilbd_data_t *ilb_data)
{

	scf_type_t scf_type = scf_value_type(val);
	ilbd_scf_pg_type_t pg_type = ilb_data->pg_type;
	int ret = 0;
	ilb_rule_info_t *r_ent = NULL;
	ilb_sg_info_t *s_ent = NULL;
	ilb_hc_info_t *h_ent = NULL;
	char ipstr[INET6_ADDRSTRLEN];
	char *valstr;
	int64_t valint;
	uint8_t valbool;
	int ipversion;

	switch (pg_type) {
	case ILBD_SCF_RULE:
		r_ent = ilb_data->rule_data;
		break;
	case ILBD_SCF_HC:
		h_ent = ilb_data->hc_data;
		break;
	case ILBD_SCF_SG:
		s_ent = ilb_data->sg_data;
		break;
	}

	/* get scf value out */
	if ((valstr = malloc(ILBD_MAX_VALUE_LEN)) == NULL)
		return (ILB_STATUS_ENOMEM);
	switch (scf_type) {
		case SCF_TYPE_NET_ADDR_V4:
			if (scf_value_get_as_string_typed(val,
			    SCF_TYPE_NET_ADDR_V4, ipstr, INET_ADDRSTRLEN) < 0) {
				free(valstr);
				return (ILB_STATUS_INTERNAL);
			}
			ipversion = AF_INET;
			break;
		case SCF_TYPE_NET_ADDR_V6:
			if (scf_value_get_as_string_typed(val,
			    SCF_TYPE_NET_ADDR_V6, ipstr,
			    INET6_ADDRSTRLEN) < 0) {
				free(valstr);
				return (ILB_STATUS_INTERNAL);
			}
			ipversion = AF_INET6;
			break;
		case SCF_TYPE_BOOLEAN:
			if (scf_value_get_boolean(val, &valbool) < 0) {
				free(valstr);
				return (ILB_STATUS_INTERNAL);
			}
			break;
		case SCF_TYPE_ASTRING:
			if (scf_value_get_astring(val, valstr,
			    ILBD_MAX_VALUE_LEN) < 0) {
				free(valstr);
				return (ILB_STATUS_INTERNAL);
			}
			break;
		case SCF_TYPE_INTEGER:
			if (scf_value_get_integer(val, &valint) < 0) {
				free(valstr);
				return (ILB_STATUS_INTERNAL);
			}
			break;
		default:
			free(valstr);
			return (ILB_STATUS_INTERNAL);
	}

	ret = ILB_STATUS_OK;
	switch (ilb_type) {
	case ILBD_RULE_STATUS:
		if (valbool)
			r_ent->rl_flags |= ILB_FLAGS_RULE_ENABLED;
		break;
	case ILBD_RULE_VIP:
		r_ent->rl_ipversion = ipversion;
		ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_vip);
		break;
	case ILBD_RULE_PROTO: {
		struct protoent *protoent;

		protoent = getprotobyname(valstr);
		r_ent->rl_proto = protoent->p_proto;
		break;
	}
	case ILBD_RULE_PORT: {
		char *token1, *token2;

		token1 = strtok(valstr, "-");
		token2 = strtok(NULL, "-");
		r_ent->rl_minport = atoi(token1);
		r_ent->rl_maxport = atoi(token2);
		break;
	}
	case ILBD_RULE_ALGO:
		ilbd_scf_str_to_algo(&(r_ent->rl_algo), valstr);
		break;
	case ILBD_RULE_TOPO:
		ilbd_scf_str_to_topo(&(r_ent->rl_topo), valstr);
		break;
	case ILBD_RULE_NAT_STR:
		ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_nat_src_start);
		break;
	case ILBD_RULE_NAT_END:
		ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_nat_src_end);
		break;
	case ILBD_RULE_STI_MASK:
		ilbd_scf_str_to_ip(ipversion, ipstr, &r_ent->rl_stickymask);
		if (ipversion == AF_INET) {
			if (!IN6_IS_ADDR_V4MAPPED_ANY(&r_ent->rl_stickymask))
				r_ent->rl_flags |= ILB_FLAGS_RULE_STICKY;
		} else {
			if (!IN6_IS_ADDR_UNSPECIFIED(&r_ent->rl_stickymask))
				r_ent->rl_flags |= ILB_FLAGS_RULE_STICKY;
		}
		break;
	case ILBD_RULE_SGNAME:
		(void) strlcpy(r_ent->rl_sgname, valstr,
		    sizeof (r_ent->rl_sgname));
		break;
	case ILBD_RULE_HCNAME:
		(void) strlcpy(r_ent->rl_hcname, valstr,
		    sizeof (r_ent->rl_hcname));
		break;
	case ILBD_RULE_HCPORT:
		r_ent->rl_hcport = valint;
		break;
	case ILBD_RULE_HCPFLAG:
		r_ent->rl_hcpflag = valint;
		break;
	case ILBD_RULE_DRAINTIME:
		r_ent->rl_conndrain = valint;
		break;
	case ILBD_RULE_NAT_TO:
		r_ent->rl_nat_timeout = valint;
		break;
	case ILBD_RULE_PERS_TO:
		r_ent->rl_sticky_timeout = valint;
		break;

	case ILBD_SG_SERVER: {
		int svr_cnt = s_ent->sg_srvcount;

		/* found a new server, increase the svr count of this sg */
		s_ent->sg_srvcount++;

		/*
		 * valstr contains information of one server in the servergroup
		 * valstr is in the format of "ip:minport-maxport:enable"
		 */
		s_ent = realloc(s_ent, sizeof (ilb_sg_info_t) +
		    s_ent->sg_srvcount * sizeof (ilb_sg_srv_t));

		/* sgs_srvID is the sg name, leave it blank */
		/*
		 * sgs_id is the digit in propname, propname is in a format of
		 * "server" + the digital serverID. We get the serverID by
		 * reading from the 7th char of propname.
		 */
		s_ent->sg_servers[svr_cnt].sgs_id = atoi(&propname[6]);

		ilbd_get_svr_field(valstr,
		    &s_ent->sg_servers[svr_cnt].sgs_addr,
		    &s_ent->sg_servers[svr_cnt].sgs_minport,
		    &s_ent->sg_servers[svr_cnt].sgs_maxport,
		    &s_ent->sg_servers[svr_cnt].sgs_flags);
		ilb_data->sg_data = s_ent;

		break;
	}
	case ILBD_HC_TEST:
		(void) strlcpy(h_ent->hci_test, valstr,
		    sizeof (h_ent->hci_test));
		break;
	case ILBD_HC_TIMEOUT:
		h_ent->hci_timeout = valint;
		break;
	case ILBD_HC_INTERVAL:
		h_ent->hci_interval = valint;
		break;
	case ILBD_HC_DEF_PING:
		h_ent->hci_def_ping = valbool;
		break;
	case ILBD_HC_COUNT:
		h_ent->hci_count = valint;
		break;
	case ILBD_VAR_INVALID:
		/*
		 * An empty server group is represented by an invalid
		 * SCF property.  So when loading a server group, this
		 * case can be hit.  But it should happen only for this
		 * single case.  So if it happens in another case, move
		 * the service into maintenance mode.
		 */
		if (pg_type != ILBD_SCF_SG || scf_type != SCF_TYPE_ASTRING) {
			logerr("%s: invalid ilb type", __func__);
			(void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
		} else {
			logdebug("%s: invalid ilb type", __func__);
		}
		break;
	}

	free(valstr);
	return (ret);
}

static ilbd_var_type_t
ilbd_name_to_valtype(const char *prop_name)
{
	int i;

	for (i = 0; i < ILBD_PROP_VAR_NUM; i++)
		if (strncmp(prop_name, prop_tbl[i].scf_propname,
		    strlen(prop_tbl[i].scf_propname)) == 0)
			return (prop_tbl[i].val_type);

	logdebug("ilbd_name_to_valtype: couldn't find prop %s", prop_name);
	return (ILBD_VAR_INVALID);
}

/* callback for pg_walk_prop, arg is ilbd_data_t */
static ilb_status_t
ilbd_scf_load_prop(scf_propertygroup_t *pg, const char *prop_name, void *arg)
{
	scf_handle_t *h;
	scf_value_t *val;
	ilb_status_t ret;
	ilbd_data_t *ilb_data = (ilbd_data_t *)arg;
	ilbd_var_type_t val_type = ilbd_name_to_valtype(prop_name);

	h = scf_pg_handle(pg);
	if (h == NULL)
		return (ILB_STATUS_EINVAL);

	ret = ilbd_scf_get_prop_val(pg, prop_name, &val);
	if (ret == ILB_STATUS_ENOENT)
		return (ILB_STATUS_OK);
	else if (ret != ILB_STATUS_OK)
		return (ret);

	/*
	 * Load value to ilb_data.
	 */
	ret = ilbd_scfval_to_data(prop_name, val_type, val, ilb_data);

out:
	if (val != NULL)
		scf_value_destroy(val);

	return (ret);
}

/*
 * walk properties in one prop group, arg is ilbd_data
 * cb is ilbd_scf_load_prop()
 */
static ilb_status_t
ilbd_scf_pg_walk_props(scf_propertygroup_t *pg,
    ilb_status_t (*cb)(scf_propertygroup_t *, const char *, void *),
    void *arg)
{
	scf_handle_t *h;
	scf_iter_t *propiter;
	scf_property_t *prop;
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char *prop_name = NULL;
	ilb_status_t ret = ILB_STATUS_OK;
	int scf_ret = -1;

	h = scf_pg_handle(pg);
	if (h == NULL)
		return (ILB_STATUS_EINVAL);

	prop = scf_property_create(h);
	propiter = scf_iter_create(h);
	if (prop == NULL || propiter == NULL)
		goto out;

	if (scf_iter_pg_properties(propiter, pg) != 0)
		goto out;

	if ((prop_name = malloc(scf_name_len)) == NULL) {
		ret = ILB_STATUS_ENOMEM;
		goto out;
	}
	while ((scf_ret = scf_iter_next_property(propiter, prop)) == 1) {
		if (scf_property_get_name(prop, prop_name, scf_name_len)
		    < 0) {
			ret = ilbd_scf_err_to_ilb_err();
			goto out;
		}
		ret = cb(pg, prop_name, arg);
		if (ret != ILB_STATUS_OK)
			break;
	}
out:
	if (prop_name != NULL)
		free(prop_name);
	if (scf_ret == -1)
		ret = ilbd_scf_err_to_ilb_err();
	if (prop != NULL)
		scf_property_destroy(prop);
	if (propiter != NULL)
		scf_iter_destroy(propiter);

	return (ret);
}

/* cbs are libd_create_X */
static ilb_status_t
ilbd_scf_instance_walk_pg(scf_instance_t *inst,
    ilbd_scf_pg_type_t pg_type,
    ilb_status_t (*cb)(void *, int, struct passwd *, ucred_t *),
    void *arg1, void *arg2)
{
	int			scf_ret;
	ilb_status_t		ret;
	scf_handle_t		*h;
	scf_iter_t		*pgiter;
	scf_propertygroup_t	*newpg;
	int			port = *((int *)arg1);
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char *pg_name = NULL;

	if (inst == NULL)
		return (ILB_STATUS_EINVAL);

	h = scf_instance_handle(inst);
	if (h == NULL)
		return (ILB_STATUS_EINVAL);

	if ((newpg = scf_pg_create(h)) == NULL)
		return (ilbd_scf_err_to_ilb_err());

	if ((pgiter = scf_iter_create(h)) == NULL) {
		scf_pg_destroy(newpg);
		return (ilbd_scf_err_to_ilb_err());
	}

	if ((scf_ret = scf_iter_instance_pgs(pgiter, inst)) < 0)
		goto out;

	if ((pg_name = malloc(scf_name_len)) == NULL) {
		ret = ILB_STATUS_ENOMEM;
		goto out;
	}
	while ((scf_ret = scf_iter_next_pg(pgiter, newpg)) > 0) {
		ilbd_data_t data;

		if (scf_pg_get_name(newpg, pg_name, scf_name_len) < 0) {
			ret = ilbd_scf_err_to_ilb_err();
			goto out;
		}

		/*
		 * if pg name indicates it's a ilb configuration, walk its prop
		 */
		data.pg_type = pg_type;
		data.hc_data = NULL;
		data.sg_data = NULL;
		data.rule_data = NULL;

		switch (pg_type) {
		case ILBD_SCF_RULE:
			if (strncmp(ILBD_PG_NAME_RULE, pg_name,
			    strlen(ILBD_PG_NAME_RULE)) == 0) {
				data.rule_data = calloc(1,
				    sizeof (ilb_rule_info_t));
				if (data.rule_data == NULL) {
					ret = ILB_STATUS_ENOMEM;
					goto out;
				}
				ret = ilbd_scf_pg_walk_props(newpg,
				    ilbd_scf_load_prop, &data);
				if (ret != ILB_STATUS_OK)
					goto out;
				assert(data.rule_data != NULL);
				/* set rule name */
				(void) strlcpy(data.rule_data->rl_name,
				    &pg_name[strlen(ILBD_PG_NAME_RULE)],
				    sizeof (data.rule_data->rl_name));

				ret = cb(data.rule_data, port, arg2, NULL);
				free(data.rule_data);
				if (ret != ILB_STATUS_OK)
					goto out;
			}
			break;
		case ILBD_SCF_SG:
			if (strncmp(ILBD_PG_NAME_SG, pg_name,
			    strlen(ILBD_PG_NAME_SG)) == 0) {
				data.sg_data = calloc(1,
				    sizeof (ilb_sg_info_t));
				if (data.sg_data == NULL) {
					ret = ILB_STATUS_ENOMEM;
					goto out;
				}
				ret = ilbd_scf_pg_walk_props(newpg,
				    ilbd_scf_load_prop, &data);
				if (ret != ILB_STATUS_OK) {
					free(data.sg_data);
					goto out;
				}
				assert(data.sg_data != NULL);
				/* set sg name */
				(void) strlcpy(data.sg_data->sg_name,
				    &pg_name[strlen(ILBD_PG_NAME_SG)],
				    sizeof (data.sg_data->sg_name));
				ret = cb(data.sg_data, port, arg2, NULL);
				if (ret != ILB_STATUS_OK) {
					free(data.sg_data);
					goto out;
				}
				/*
				 * create a servergroup is two-step operation.
				 * 1. create an empty servergroup.
				 * 2. add server(s) to the group.
				 *
				 * since we are here from:
				 * main_loop()->ilbd_read_config()->
				 * ilbd_walk_sg_pgs()
				 * there is no cli to send. So in this
				 * path auditing will skip the
				 * adt_set_from_ucred() check
				 */
				if (data.sg_data->sg_srvcount > 0) {
					ret = ilbd_add_server_to_group(
					    data.sg_data, port, NULL, NULL);
					if (ret != ILB_STATUS_OK) {
						free(data.sg_data);
						goto out;
					}
					free(data.sg_data);
				}
			}
			break;
		case ILBD_SCF_HC:
			if (strncmp(ILBD_PG_NAME_HC, pg_name,
			    strlen(ILBD_PG_NAME_HC)) == 0) {
				data.hc_data = calloc(1,
				    sizeof (ilb_hc_info_t));
				if (data.hc_data == NULL) {
					ret = ILB_STATUS_ENOMEM;
					goto out;
				}
				ret = ilbd_scf_pg_walk_props(newpg,
				    ilbd_scf_load_prop, &data);
				if (ret != ILB_STATUS_OK)
					goto out;
				assert(data.hc_data != NULL);
				/* set hc name */
				(void) strlcpy(data.hc_data->hci_name,
				    &pg_name[strlen(ILBD_PG_NAME_HC)],
				    sizeof (data.hc_data->hci_name));
				ret = cb(data.hc_data, port, arg2, NULL);
				free(data.hc_data);
				if (ret != ILB_STATUS_OK)
					goto out;
			}
			break;
		}
	}

out:
	if (pg_name != NULL)
		free(pg_name);
	if (scf_ret < 0)
		ret = ilbd_scf_err_to_ilb_err();
	scf_pg_destroy(newpg);
	scf_iter_destroy(pgiter);
	return (ret);
}

typedef ilb_status_t (*ilbd_scf_walker_fn)(void *, int, struct passwd *,
    ucred_t *);

ilb_status_t
ilbd_walk_rule_pgs(ilb_status_t (*func)(ilb_rule_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
	scf_instance_t *inst;
	scf_handle_t *h;
	scf_service_t *svc;
	ilb_status_t ret;

	ret = ilbd_scf_get_inst(&h, &svc, &inst);
	if (ret != ILB_STATUS_OK)
		return (ret);

	/* get rule prop group, transfer it to ilb_lrule_info_t */
	ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_RULE,
	    (ilbd_scf_walker_fn)func, arg1, arg2);
	ilbd_scf_destroy(h, svc, inst, NULL);
	return (ret);
}

ilb_status_t
ilbd_walk_sg_pgs(ilb_status_t (*func)(ilb_sg_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
	scf_instance_t *inst;
	scf_handle_t *h;
	scf_service_t *svc;
	ilb_status_t ret;

	ret = ilbd_scf_get_inst(&h, &svc, &inst);
	if (ret != ILB_STATUS_OK)
		return (ret);

	ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_SG,
	    (ilbd_scf_walker_fn)func, arg1, arg2);
	ilbd_scf_destroy(h, svc, inst, NULL);
	return (ret);
}

ilb_status_t
ilbd_walk_hc_pgs(ilb_status_t (*func)(const ilb_hc_info_t *, int,
    const struct passwd *, ucred_t *), void *arg1, void *arg2)
{
	scf_instance_t *inst;
	scf_handle_t *h;
	scf_service_t *svc;
	ilb_status_t ret;

	ret = ilbd_scf_get_inst(&h, &svc, &inst);
	if (ret != ILB_STATUS_OK)
		return (ret);

	ret = ilbd_scf_instance_walk_pg(inst, ILBD_SCF_HC,
	    (ilbd_scf_walker_fn)func, arg1, arg2);
	ilbd_scf_destroy(h, svc, inst, NULL);
	return (ret);
}

ilb_status_t
ilbd_change_prop(ilbd_scf_pg_type_t pg_type, const char *pg_name,
    const char *prop_name, void *new_val)
{
	int ret;
	scf_propertygroup_t *scfpg = NULL;
	char *scf_pgname = NULL;
	scf_type_t scftype;
	scf_value_t *scfval;
	scf_handle_t *h;

	if ((scf_pgname = malloc(ILBD_MAX_NAME_LEN)) == NULL)
		return (ILB_STATUS_ENOMEM);
	ilbd_name_to_scfpgname(pg_type, pg_name, scf_pgname);
	ret = ilbd_scf_retrieve_pg(scf_pgname, &scfpg, B_FALSE);
	free(scf_pgname);

	if (ret != ILB_STATUS_EEXIST)
		return (ret);

	assert(scfpg != NULL);

	h = scf_pg_handle(scfpg);
	if (h == NULL) {
		ret = ILB_STATUS_EINVAL;
		goto done;
	}

	if ((scfval = scf_value_create(h)) == NULL) {
		ret = ILB_STATUS_ENOMEM;
		goto done;
	}

	if (pg_type == ILBD_SCF_RULE) {
		scftype = SCF_TYPE_BOOLEAN;
		scf_value_set_boolean(scfval, *(boolean_t *)new_val);
	} else if (pg_type == ILBD_SCF_SG) {
		scftype = SCF_TYPE_ASTRING;
		(void) scf_value_set_astring(scfval, (char *)new_val);
	}
	ret = ilbd_scf_set_prop(scfpg, prop_name, scftype, scfval);

done:
	if (scf_pg_handle(scfpg) != NULL)
		scf_handle_destroy(scf_pg_handle(scfpg));
	if (scfpg != NULL)
		scf_pg_destroy(scfpg);
	if (scfval != NULL)
		scf_value_destroy(scfval);
	return (ret);
}

/*
 * Update the persistent configuration with a new server, srv, added to a
 * server group, sg.
 */
ilb_status_t
ilbd_scf_add_srv(ilbd_sg_t *sg, ilbd_srv_t *srv)
{
	scf_propertygroup_t *pg;
	scf_handle_t *h;
	scf_value_t *val;
	ilb_status_t ret;
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char *buf = NULL;

	if ((buf = malloc(scf_name_len)) == NULL)
		return (ILB_STATUS_ENOMEM);

	ilbd_name_to_scfpgname(ILBD_SCF_SG, sg->isg_name, buf);
	ret = ilbd_scf_retrieve_pg(buf, &pg, B_FALSE);
	/*
	 * The server group does not exist in persistent storage.  This
	 * cannot happen.  Should probably transition the service to
	 * maintenance since it should be there.
	 */
	if (ret != ILB_STATUS_EEXIST) {
		logerr("ilbd_scf_add_srv: SCF update failed - entering"
		    " maintenance mode");
		(void) smf_maintain_instance(ILB_FMRI, SMF_IMMEDIATE);
		free(buf);
		return (ILB_STATUS_INTERNAL);
	}

	if ((h = scf_pg_handle(pg)) == NULL) {
		ilbd_scf_destroy(NULL, NULL, NULL, pg);
		free(buf);
		return (ilbd_scf_err_to_ilb_err());
	}

	if ((val = scf_value_create(h)) == NULL) {
		ilbd_scf_destroy(h, NULL, NULL, pg);
		free(buf);
		return (ILB_STATUS_ENOMEM);
	}
	ilbd_srv_scf_val(srv, buf);
	(void) scf_value_set_astring(val, buf);

	(void) snprintf(buf, scf_name_len, "server%d", srv->isv_id);
	ret = ilbd_scf_set_prop(pg, buf, SCF_TYPE_ASTRING, val);
	free(buf);
	ilbd_scf_destroy(h, NULL, NULL, pg);
	scf_value_destroy(val);

	return (ret);
}

/*
 * Delete a server, srv, of a server group, sg, from the persistent
 * configuration.
 */
ilb_status_t
ilbd_scf_del_srv(ilbd_sg_t *sg, ilbd_srv_t *srv)
{
	ilb_status_t ret;
	scf_propertygroup_t *pg;
	scf_handle_t *h;
	int scf_name_len = ILBD_MAX_NAME_LEN;
	char *buf;
	scf_transaction_t *tx = NULL;
	scf_transaction_entry_t *entry = NULL;

	if ((buf = malloc(scf_name_len)) == NULL)
		return (ILB_STATUS_ENOMEM);
	ilbd_name_to_scfpgname(ILBD_SCF_SG, sg->isg_name, buf);
	ret = ilbd_scf_retrieve_pg(buf, &pg, B_FALSE);
	/*
	 * The server group does not exist in persistent storage.  This
	 * cannot happen. THe caller of this function puts service in
	 * maintenance mode.
	 */
	if (ret != ILB_STATUS_EEXIST) {
		free(buf);
		return (ILB_STATUS_INTERNAL);
	}
	ret = ILB_STATUS_OK;

	if ((h = scf_pg_handle(pg)) == NULL) {
		logdebug("ilbd_scf_del_srv: scf_pg_handle: %s\n",
		    scf_strerror(scf_error()));
		ilbd_scf_destroy(NULL, NULL, NULL, pg);
		free(buf);
		return (ilbd_scf_err_to_ilb_err());
	}

	if ((tx = scf_transaction_create(h)) == NULL ||
	    (entry = scf_entry_create(h)) == NULL) {
		logdebug("ilbd_scf_del_srv: create scf transaction failed: "
		    "%s\n", scf_strerror(scf_error()));
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}

	(void) snprintf(buf, scf_name_len, "server%d", srv->isv_id);

	if (scf_transaction_start(tx, pg) == -1) {
		logdebug("ilbd_scf_set_prop: start scf transaction failed: "
		    "%s\n", scf_strerror(scf_error()));
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}
	if (scf_transaction_property_delete(tx, entry, buf) == -1) {
		logdebug("ilbd_scf_set_prop: delete property failed: %s\n",
		    scf_strerror(scf_error()));
		ret = ilbd_scf_err_to_ilb_err();
		goto out;
	}
	if (scf_transaction_commit(tx) != 1) {
		logdebug("ilbd_scf_set_prop: commit transaction failed: %s\n",
		    scf_strerror(scf_error()));
		ret = ilbd_scf_err_to_ilb_err();
	}

out:
	free(buf);
	if (entry != NULL)
		scf_entry_destroy(entry);
	if (tx != NULL)
		scf_transaction_destroy(tx);
	ilbd_scf_destroy(h, NULL, NULL, pg);

	return (ret);
}