xref: /illumos-gate/usr/src/cmd/cmd-inet/usr.lib/ilbd/ilbd_rules.c (revision 95c74518)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <stdlib.h>
#include <strings.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/list.h>
#include <net/if.h>
#include <assert.h>
#include <errno.h>
#include <libintl.h>
#include <libilb.h>
#include <inet/ilb.h>
#include "libilb_impl.h"
#include "ilbd.h"

/* until we all use AF_* macros ... */
#define	AF_2_IPPROTO(_af)	(_af == AF_INET)?IPPROTO_IP:IPPROTO_IPV6
#define	IPPROTO_2_AF(_i)	(_i == IPPROTO_IP)?AF_INET:AF_INET6

#define	PROTOCOL_LEN	16				/* protocol type */
#define	ADDR_LEN	(2 * INET6_ADDRSTRLEN + 1)	/* prxy src range */
#define	PORT_LEN	6			/* hcport:1-65535 or "ANY" */

static ilb_status_t ilbd_disable_one_rule(ilbd_rule_t *, boolean_t);
static uint32_t i_flags_d2k(int);

#define	ILB_SGSRV_2_KSRV(s, k)			\
	(k)->addr  = (s)->sgs_addr;		\
	(k)->min_port = (s)->sgs_minport;	\
	(k)->max_port = (s)->sgs_maxport;	\
	(k)->flags = i_flags_d2k((s)->sgs_flags);	\
	(k)->err = 0;				\
	(void) strlcpy((k)->name, (s)->sgs_srvID, sizeof ((k)->name))

list_t		ilbd_rule_hlist;

static ilb_algo_t
algo_impl2lib(ilb_algo_impl_t a)
{
	switch (a) {
	case ILB_ALG_IMPL_ROUNDROBIN:
		return (ILB_ALG_ROUNDROBIN);
	case ILB_ALG_IMPL_HASH_IP:
		return (ILB_ALG_HASH_IP);
	case ILB_ALG_IMPL_HASH_IP_SPORT:
		return (ILB_ALG_HASH_IP_SPORT);
	case ILB_ALG_IMPL_HASH_IP_VIP:
		return (ILB_ALG_HASH_IP_VIP);
	}
	return (0);
}

static ilb_topo_t
topo_impl2lib(ilb_topo_impl_t t)
{
	switch (t) {
	case ILB_TOPO_IMPL_DSR:
		return (ILB_TOPO_DSR);
	case ILB_TOPO_IMPL_NAT:
		return (ILB_TOPO_NAT);
	case ILB_TOPO_IMPL_HALF_NAT:
		return (ILB_TOPO_HALF_NAT);
	}
	return (0);
}

ilb_algo_impl_t
algo_lib2impl(ilb_algo_t a)
{
	switch (a) {
	case ILB_ALG_ROUNDROBIN:
		return (ILB_ALG_IMPL_ROUNDROBIN);
	case ILB_ALG_HASH_IP:
		return (ILB_ALG_IMPL_HASH_IP);
	case ILB_ALG_HASH_IP_SPORT:
		return (ILB_ALG_IMPL_HASH_IP_SPORT);
	case ILB_ALG_HASH_IP_VIP:
		return (ILB_ALG_IMPL_HASH_IP_VIP);
	}
	return (0);
}

ilb_topo_impl_t
topo_lib2impl(ilb_topo_t t)
{
	switch (t) {
	case ILB_TOPO_DSR:
		return (ILB_TOPO_IMPL_DSR);
	case ILB_TOPO_NAT:
		return (ILB_TOPO_IMPL_NAT);
	case ILB_TOPO_HALF_NAT:
		return (ILB_TOPO_IMPL_HALF_NAT);
	}
	return (0);
}

/*
 * Walk the list of rules and check if its safe to add the
 * the server to the rule (this is a list of rules hanging
 * off of a server group)
 */
ilb_status_t
i_check_srv2rules(list_t *rlist, ilb_sg_srv_t *srv)
{
	ilb_status_t	rc = ILB_STATUS_OK;
	ilbd_rule_t	*rl;
	int		server_portrange, rule_portrange;
	int		srv_minport, srv_maxport;
	int		r_minport, r_maxport;

	if (srv == NULL)
		return (ILB_STATUS_OK);

	srv_minport = ntohs(srv->sgs_minport);
	srv_maxport = ntohs(srv->sgs_maxport);

	for (rl = list_head(rlist); rl != NULL; rl = list_next(rlist, rl)) {
		r_minport = ntohs(rl->irl_minport);
		r_maxport = ntohs(rl->irl_maxport);

		if ((srv_minport != 0) && (srv_minport == srv_maxport)) {
			/* server has single port */
			if (rl->irl_topo == ILB_TOPO_DSR) {
				/*
				 * either we have a DSR rule with a port
				 * range, or both server and rule
				 * have single ports but their values
				 * don't match - this is incompatible
				 */
				if (r_maxport > r_minport) {
					rc = ILB_STATUS_INVAL_SRVR;
					break;
				} else if (srv_minport != r_minport) {
					rc = ILB_STATUS_BADPORT;
					break;
				}
			}
			if (rl->irl_hcpflag == ILB_HCI_PROBE_FIX &&
			    rl->irl_hcport != srv_minport) {
				rc = ILB_STATUS_BADPORT;
				break;
			}
		} else if (srv_maxport > srv_minport) {
			/* server has a port range */
			if ((rl->irl_topo == ILB_TOPO_DSR) &&
			    (r_maxport > r_minport)) {
				if ((r_minport != srv_minport) ||
				    (r_maxport != srv_maxport)) {
					/*
					 * we have a DSR rule with a port range
					 * and its min and max port values
					 * does not meet that of server's
					 * - this is incompatible
					 */
					rc = ILB_STATUS_BADPORT;
					break;
				}
			} else if ((rl->irl_topo == ILB_TOPO_DSR) &&
			    (r_maxport == r_minport)) {
					/*
					 * we have a DSR rule with a single
					 * port and a server with a port range
					 * - this is incompatible
					 */
					rc = ILB_STATUS_INVAL_SRVR;
					break;
			} else if (((rl->irl_topo == ILB_TOPO_NAT) ||
			    (rl->irl_topo == ILB_TOPO_HALF_NAT)) &&
			    (r_maxport > r_minport)) {
				server_portrange = srv_maxport - srv_minport;
				rule_portrange = r_maxport - r_minport;
				if (rule_portrange != server_portrange) {
					/*
					 * we have a NAT/Half-NAT rule with
					 * a port range and server with a port
					 * range and there is a mismatch in the
					 * sizes of the port ranges - this is
					 * incompatible
					 */
					rc = ILB_STATUS_INVAL_SRVR;
					break;
				}
			}
			if (rl->irl_hcpflag == ILB_HCI_PROBE_FIX &&
			    (rl->irl_hcport > srv_maxport ||
			    rl->irl_hcport < srv_minport)) {
				rc = ILB_STATUS_BADPORT;
				break;
			}
		}
	}

	return (rc);
}

void
i_setup_rule_hlist(void)
{
	list_create(&ilbd_rule_hlist, sizeof (ilbd_rule_t),
	    offsetof(ilbd_rule_t, irl_link));
}

ilb_status_t
i_ilbd_save_rule(ilbd_rule_t *irl, ilbd_scf_cmd_t scf_cmd)
{
	boolean_t enable = irl->irl_flags & ILB_FLAGS_RULE_ENABLED;

	switch (scf_cmd) {
	case ILBD_SCF_CREATE:
		return (ilbd_create_pg(ILBD_SCF_RULE, (void *)irl));
	case ILBD_SCF_DESTROY:
		return (ilbd_destroy_pg(ILBD_SCF_RULE, irl->irl_name));
	case ILBD_SCF_ENABLE_DISABLE:
		return (ilbd_change_prop(ILBD_SCF_RULE, irl->irl_name,
		    "status", &enable));
	default:
		logdebug("i_ilbd_save_rule: invalid scf cmd %d", scf_cmd);
		return (ILB_STATUS_INVAL_CMD);
	}
}

/*
 * allocate a new daemon-specific rule from the "template" passed
 * in in *r
 */
static ilbd_rule_t *
i_alloc_ilbd_rule(ilb_rule_info_t *r)
{
	ilbd_rule_t	*rl;

	rl = calloc(sizeof (*rl), 1);
	if (rl != NULL && r != NULL)
		bcopy(r, &rl->irl_info, sizeof (*r));

	return (rl);
}

static ilbd_rule_t *
i_find_rule_byname(const char *name)
{
	ilbd_rule_t	*rl;

	/* find position of rule in list */
	rl = list_head(&ilbd_rule_hlist);
	while (rl != NULL &&
	    strncmp(rl->irl_name, name, sizeof (rl->irl_name)) != 0) {
		rl = list_next(&ilbd_rule_hlist, rl);
	}

	return (rl);
}

/*
 * get exactly one rule (named in rl->irl_name) data from kernel
 */
static ilb_status_t
ilb_get_krule(ilb_rule_info_t *rl)
{
	ilb_status_t	rc;
	ilb_rule_cmd_t	kcmd;

	kcmd.cmd = ILB_LIST_RULE;
	(void) strlcpy(kcmd.name, rl->rl_name, sizeof (kcmd.name));
	kcmd.flags = 0;

	rc = do_ioctl(&kcmd, 0);
	if (rc != ILB_STATUS_OK)
		return (rc);

	rl->rl_flags = kcmd.flags;
	rl->rl_ipversion = IPPROTO_2_AF(kcmd.ip_ver);
	rl->rl_vip = kcmd.vip;
	rl->rl_proto = kcmd.proto;
	rl->rl_minport = kcmd.min_port;
	rl->rl_maxport = kcmd.max_port;
	rl->rl_algo = algo_impl2lib(kcmd.algo);
	rl->rl_topo = topo_impl2lib(kcmd.topo);
	rl->rl_stickymask = kcmd.sticky_mask;
	rl->rl_nat_src_start = kcmd.nat_src_start;
	rl->rl_nat_src_end = kcmd.nat_src_end;
	(void) strlcpy(rl->rl_name, kcmd.name, sizeof (rl->rl_name));
	rl->rl_conndrain = kcmd.conn_drain_timeout;
	rl->rl_nat_timeout = kcmd.nat_expiry;
	rl->rl_sticky_timeout = kcmd.sticky_expiry;

	return (ILB_STATUS_OK);
}

ilb_status_t
ilbd_retrieve_rule(ilbd_name_t rl_name, uint32_t *rbuf, size_t *rbufsz)
{
	ilbd_rule_t	*irl = NULL;
	ilb_status_t	rc;
	ilb_rule_info_t	*rinfo;

	irl = i_find_rule_byname(rl_name);
	if (irl == NULL)
		return (ILB_STATUS_ENOENT);

	ilbd_reply_ok(rbuf, rbufsz);
	rinfo = (ilb_rule_info_t *)&((ilb_comm_t *)rbuf)->ic_data;
	bcopy(&irl->irl_info, rinfo, sizeof (*rinfo));

	/*
	 * Check if the various timeout values are 0.  If one is, get the
	 * default values from kernel.
	 */
	if (rinfo->rl_conndrain == 0 || rinfo->rl_nat_timeout == 0 ||
	    rinfo->rl_sticky_timeout == 0) {
		ilb_rule_info_t tmp_info;

		(void) strcpy(tmp_info.rl_name, rinfo->rl_name);
		rc = ilb_get_krule(&tmp_info);
		if (rc != ILB_STATUS_OK)
			return (rc);
		if (rinfo->rl_conndrain == 0)
			rinfo->rl_conndrain = tmp_info.rl_conndrain;
		if ((rinfo->rl_topo == ILB_TOPO_NAT ||
		    rinfo->rl_topo == ILB_TOPO_HALF_NAT) &&
		    rinfo->rl_nat_timeout == 0) {
			rinfo->rl_nat_timeout = tmp_info.rl_nat_timeout;
		}
		if ((rinfo->rl_flags & ILB_FLAGS_RULE_STICKY) &&
		    rinfo->rl_sticky_timeout == 0) {
			rinfo->rl_sticky_timeout = tmp_info.rl_sticky_timeout;
		}
	}
	*rbufsz += sizeof (ilb_rule_info_t);

	return (ILB_STATUS_OK);
}

static ilb_status_t
ilbd_destroy_one_rule(ilbd_rule_t *irl)
{
	ilb_status_t	rc;
	ilb_name_cmd_t	kcmd;

	/*
	 * as far as talking to the kernel is concerned, "all rules"
	 * is handled in one go somewhere else, so we only
	 * tell the kernel about single rules here.
	 */
	if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
		kcmd.cmd = ILB_DESTROY_RULE;
		(void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
		kcmd.flags = 0;

		rc = do_ioctl(&kcmd, 0);
		if (rc != ILB_STATUS_OK)
			return (rc);

	}
	list_remove(&irl->irl_sg->isg_rulelist, irl);
	list_remove(&ilbd_rule_hlist, irl);

	/*
	 * When dissociating a rule, only two errors can happen.  The hc
	 * name is incorrect or the rule is not associated with the hc
	 * object.  Both should not happen....  The check is for debugging
	 * purpose.
	 */
	if (RULE_HAS_HC(irl) && (rc = ilbd_hc_dissociate_rule(irl)) !=
	    ILB_STATUS_OK) {
		logerr("ilbd_destroy_one_rule: cannot "
		    "dissociate %s from hc object %s: %d",
		    irl->irl_name, irl->irl_hcname, rc);
	}

	rc = i_ilbd_save_rule(irl, ILBD_SCF_DESTROY);
	if (rc != ILB_STATUS_OK)
		logdebug("ilbd_destroy_rule: save rule failed");

	free(irl);
	return (rc);
}

/*
 * the following two functions are the other's opposite, and can
 * call into each other for roll back purposes in case of error.
 * To avoid endless recursion, the 'is_rollback' parameter must be
 * set to B_TRUE in the roll back case.
 */
static ilb_status_t
ilbd_enable_one_rule(ilbd_rule_t *irl, boolean_t is_rollback)
{
	ilb_status_t	rc = ILB_STATUS_OK;
	ilb_name_cmd_t	kcmd;

	/* no use sending a no-op to the kernel */
	if ((irl->irl_flags & ILB_FLAGS_RULE_ENABLED) != 0)
		return (ILB_STATUS_OK);

	irl->irl_flags |= ILB_FLAGS_RULE_ENABLED;

	/* "all rules" is handled in one go somewhere else, not here */
	if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
		kcmd.cmd = ILB_ENABLE_RULE;
		(void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
		kcmd.flags = 0;

		rc = do_ioctl(&kcmd, 0);
		if (rc != ILB_STATUS_OK)
			return (rc);
	}
	if (RULE_HAS_HC(irl) && (rc = ilbd_hc_enable_rule(irl)) !=
	    ILB_STATUS_OK) {
		/* Undo the kernel work */
		kcmd.cmd = ILB_DISABLE_RULE;
		/* Cannot do much if ioctl fails... */
		(void) do_ioctl(&kcmd, 0);
		return (rc);
	}

	if (!is_rollback) {
		if (rc == ILB_STATUS_OK)
			rc = i_ilbd_save_rule(irl, ILBD_SCF_ENABLE_DISABLE);
		if (rc != ILB_STATUS_OK)
			/* ignore rollback return code */
			(void) ilbd_disable_one_rule(irl, B_TRUE);
	}

	return (rc);
}

static ilb_status_t
ilbd_disable_one_rule(ilbd_rule_t *irl, boolean_t is_rollback)
{
	ilb_status_t	rc = ILB_STATUS_OK;
	ilb_name_cmd_t	kcmd;

	/* no use sending a no-op to the kernel */
	if ((irl->irl_flags & ILB_FLAGS_RULE_ENABLED) == 0)
		return (ILB_STATUS_OK);

	irl->irl_flags &= ~ILB_FLAGS_RULE_ENABLED;

	/* "all rules" is handled in one go somewhere else, not here */
	if ((irl->irl_flags & ILB_FLAGS_RULE_ALLRULES) == 0) {
		kcmd.cmd = ILB_DISABLE_RULE;
		(void) strlcpy(kcmd.name, irl->irl_name, sizeof (kcmd.name));
		kcmd.flags = 0;

		rc = do_ioctl(&kcmd, 0);
		if (rc != ILB_STATUS_OK)
			return (rc);
	}

	if (RULE_HAS_HC(irl) && (rc = ilbd_hc_disable_rule(irl)) !=
	    ILB_STATUS_OK) {
		/* Undo the kernel work */
		kcmd.cmd = ILB_ENABLE_RULE;
		/* Cannot do much if ioctl fails... */
		(void) do_ioctl(&kcmd, 0);
		return (rc);
	}

	if (!is_rollback) {
		if (rc == ILB_STATUS_OK)
			rc = i_ilbd_save_rule(irl, ILBD_SCF_ENABLE_DISABLE);
		if (rc != ILB_STATUS_OK)
			/* ignore rollback return code */
			(void) ilbd_enable_one_rule(irl, B_TRUE);
	}

	return (rc);
}

/*
 * Generates an audit record for a supplied rule name
 * Used for enable_rule, disable_rule, delete_rule,
 * and create_rule subcommands
 */
static void
ilbd_audit_rule_event(const char *audit_rule_name,
    ilb_rule_info_t *rlinfo, ilbd_cmd_t cmd, ilb_status_t rc,
    ucred_t *ucredp)
{
	adt_session_data_t	*ah;
	adt_event_data_t	*event;
	au_event_t		flag;
	int			scf_val_len = ILBD_MAX_VALUE_LEN;
	char			*aobuf = NULL; /* algo:topo */
	char			*valstr1 = NULL;
	char			*valstr2 = NULL;
	char			pbuf[PROTOCOL_LEN]; /* protocol */
	char			hcpbuf[PORT_LEN]; /* hcport */
	int			audit_error;

	if ((ucredp == NULL) && (cmd == ILBD_CREATE_RULE))  {
		/*
		 * we came here from the path where ilbd incorporates
		 * the configuration that is listed in SCF :
		 * i_ilbd_read_config->ilbd_walk_rule_pgs->
		 *    ->ilbd_scf_instance_walk_pg->ilbd_create_rule
		 * We skip auditing in that case
		 */
		return;
	}
	if (adt_start_session(&ah, NULL, 0) != 0) {
		logerr("ilbd_audit_rule_event: adt_start_session failed");
		exit(EXIT_FAILURE);
	}
	if (adt_set_from_ucred(ah, ucredp, ADT_NEW) != 0) {
		(void) adt_end_session(ah);
		logerr("ilbd_audit_rule_event: adt_set_from_ucred failed");
		exit(EXIT_FAILURE);
	}
	if (cmd == ILBD_ENABLE_RULE)
		flag = ADT_ilb_enable_rule;
	else if (cmd == ILBD_DISABLE_RULE)
		flag = ADT_ilb_disable_rule;
	else if (cmd == ILBD_DESTROY_RULE)
		flag = ADT_ilb_delete_rule;
	else if (cmd == ILBD_CREATE_RULE)
		flag = ADT_ilb_create_rule;

	if ((event = adt_alloc_event(ah, flag)) == NULL) {
		logerr("ilbd_audit_rule_event: adt_alloc_event failed");
		exit(EXIT_FAILURE);
	}

	(void) memset((char *)event, 0, sizeof (adt_event_data_t));

	switch (cmd) {
	case ILBD_DESTROY_RULE:
		event->adt_ilb_delete_rule.auth_used = NET_ILB_CONFIG_AUTH;
		event->adt_ilb_delete_rule.rule_name = (char *)audit_rule_name;
		break;
	case ILBD_ENABLE_RULE:
		event->adt_ilb_enable_rule.auth_used = NET_ILB_ENABLE_AUTH;
		event->adt_ilb_enable_rule.rule_name = (char *)audit_rule_name;
		break;
	case ILBD_DISABLE_RULE:
		event->adt_ilb_disable_rule.auth_used = NET_ILB_ENABLE_AUTH;
		event->adt_ilb_disable_rule.rule_name = (char *)audit_rule_name;
		break;
	case ILBD_CREATE_RULE:
		if (((aobuf = malloc(scf_val_len)) == NULL) ||
		    ((valstr1 = malloc(scf_val_len)) == NULL) ||
		    ((valstr2 = malloc(scf_val_len)) == NULL)) {
			logerr("ilbd_audit_rule_event: could not"
			    " allocate buffer");
			exit(EXIT_FAILURE);
		}

		event->adt_ilb_create_rule.auth_used = NET_ILB_CONFIG_AUTH;

		/* Fill in virtual IP address type */
		if (IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_vip)) {
			event->adt_ilb_create_rule.virtual_ipaddress_type =
			    ADT_IPv4;
			cvt_addr(event->adt_ilb_create_rule.virtual_ipaddress,
			    ADT_IPv4, rlinfo->rl_vip);
		} else {
			event->adt_ilb_create_rule.virtual_ipaddress_type =
			    ADT_IPv6;
			cvt_addr(event->adt_ilb_create_rule.virtual_ipaddress,
			    ADT_IPv6, rlinfo->rl_vip);
		}
		/* Fill in port - could be a single value or a range */
		event->adt_ilb_create_rule.min_port = ntohs(rlinfo->rl_minport);
		if (ntohs(rlinfo->rl_maxport) > ntohs(rlinfo->rl_minport)) {
			/* port range */
			event->adt_ilb_create_rule.max_port =
			    ntohs(rlinfo->rl_maxport);
		} else {
			/* in audit record, max=min when single port */
			event->adt_ilb_create_rule.max_port =
			    ntohs(rlinfo->rl_minport);
		}

		/*
		 * Fill in  protocol - if user does not specify it,
		 * its TCP by default
		 */
		if (rlinfo->rl_proto == IPPROTO_UDP)
			(void) snprintf(pbuf, PROTOCOL_LEN, "UDP");
		else
			(void) snprintf(pbuf, PROTOCOL_LEN, "TCP");
		event->adt_ilb_create_rule.protocol = pbuf;

		/* Fill in algorithm and operation type */
		ilbd_algo_to_str(rlinfo->rl_algo, valstr1);
		ilbd_topo_to_str(rlinfo->rl_topo, valstr2);
		(void) snprintf(aobuf, scf_val_len, "%s:%s",
		    valstr1, valstr2);
		event->adt_ilb_create_rule.algo_optype = aobuf;

		/* Fill in proxy-src for the NAT case */
		if (rlinfo->rl_topo == ILB_TOPO_NAT)  {
			/* copy starting proxy-src address */
			if (IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_nat_src_start)) {
				/* V4 case */
				event->adt_ilb_create_rule.proxy_src_min_type =
				    ADT_IPv4;
				cvt_addr(
				    event->adt_ilb_create_rule.proxy_src_min,
				    ADT_IPv4, rlinfo->rl_nat_src_start);
			} else {
				/* V6 case */
				event->adt_ilb_create_rule.proxy_src_min_type =
				    ADT_IPv6;
				cvt_addr(
				    event->adt_ilb_create_rule.proxy_src_min,
				    ADT_IPv6, rlinfo->rl_nat_src_start);
			}

			/* copy ending proxy-src address */
			if (&rlinfo->rl_nat_src_end == 0) {
				/* proxy-src is a single address */
				event->adt_ilb_create_rule.proxy_src_max_type =
				    event->
				    adt_ilb_create_rule.proxy_src_min_type;
				(void) memcpy(
				    event->adt_ilb_create_rule.proxy_src_max,
				    event->adt_ilb_create_rule.proxy_src_min,
				    (4 * sizeof (uint32_t)));
			} else if (
			    IN6_IS_ADDR_V4MAPPED(&rlinfo->rl_nat_src_end)) {
				/*
				 * proxy-src is a address range - copy ending
				 * proxy-src address
				 * V4 case
				 */
				event->adt_ilb_create_rule.proxy_src_max_type =
				    ADT_IPv4;
				cvt_addr(
				    event->adt_ilb_create_rule.proxy_src_max,
				    ADT_IPv4, rlinfo->rl_nat_src_end);
			} else {
				/* V6 case */
				event->adt_ilb_create_rule.proxy_src_max_type =
				    ADT_IPv6;
				cvt_addr(
				    event->adt_ilb_create_rule.proxy_src_max,
				    ADT_IPv6, rlinfo->rl_nat_src_end);
			}
		}

		/*
		 * Fill in pmask if user has specified one - 0 means
		 * no persistence
		 */
		valstr1[0] = '\0';
		ilbd_ip_to_str(rlinfo->rl_ipversion, &rlinfo->rl_stickymask,
		    valstr1);
			event->adt_ilb_create_rule.persist_mask = valstr1;

		/* If there is a hcname */
		if (rlinfo->rl_hcname[0] != '\0')
			event->adt_ilb_create_rule.hcname = rlinfo->rl_hcname;

		/* Fill in hcport */
		if (rlinfo->rl_hcpflag == ILB_HCI_PROBE_FIX) {
			/* hcport is specified by user */
			(void) snprintf(hcpbuf, PORT_LEN, "%d",
			    rlinfo->rl_hcport);
			event->adt_ilb_create_rule.hcport = hcpbuf;
		} else if (rlinfo->rl_hcpflag == ILB_HCI_PROBE_ANY) {
			/* user has specified "ANY" */
			(void) snprintf(hcpbuf, PORT_LEN, "ANY");
			event->adt_ilb_create_rule.hcport = hcpbuf;
		}
		/*
		 * Fill out the conndrain, nat_timeout and persist_timeout
		 * If the user does not specify them, the default value
		 * is set in the kernel. Userland does not know what
		 * the values are. So if the user
		 * does not specify these values they will show up as
		 * 0 in the audit record.
		 */
		event->adt_ilb_create_rule.conndrain_timeout =
		    rlinfo->rl_conndrain;
		event->adt_ilb_create_rule.nat_timeout =
		    rlinfo->rl_nat_timeout;
		event->adt_ilb_create_rule.persist_timeout =
		    rlinfo->rl_sticky_timeout;

		/* Fill out servergroup and rule name */
		event->adt_ilb_create_rule.server_group = rlinfo->rl_sgname;
		event->adt_ilb_create_rule.rule_name = rlinfo->rl_name;
		break;
	}
	if (rc == ILB_STATUS_OK) {
		if (adt_put_event(event, ADT_SUCCESS, ADT_SUCCESS) != 0) {
			logerr("ilbd_audit_rule_event:adt_put_event failed");
			exit(EXIT_FAILURE);
		}
	} else {
		audit_error = ilberror2auditerror(rc);
		if (adt_put_event(event, ADT_FAILURE, audit_error) != 0) {
			logerr("ilbd_audit_rule_event: adt_put_event failed");
			exit(EXIT_FAILURE);
		}
	}
	adt_free_event(event);
	free(aobuf);
	free(valstr1);
	free(valstr2);
	(void) adt_end_session(ah);
}
/*
 * converts IP address from in6_addr format to uint32_t[4]
 * This conversion is needed for recording IP address in
 * audit records.
 */
void
cvt_addr(uint32_t *audit, int32_t type, struct in6_addr address)
{

	if (type == ADT_IPv4)  {
		/* address is IPv4 */
		audit[0] = address._S6_un._S6_u32[3];
	} else {
		/* address is IPv6 */
		(void) memcpy(audit, address._S6_un._S6_u32,
		    (4 * sizeof (uint32_t)));
	}
}

static ilb_status_t
i_ilbd_action_switch(ilbd_rule_t *irl, ilbd_cmd_t cmd,
    boolean_t is_rollback, ucred_t *ucredp)
{
	ilb_status_t    rc;

	switch (cmd) {
	case ILBD_DESTROY_RULE:
		rc = ilbd_destroy_one_rule(irl);
		if (!is_rollback) {
			ilbd_audit_rule_event(irl->irl_name, NULL,
			    cmd, rc, ucredp);
		}
		return (rc);
	case ILBD_ENABLE_RULE:
		rc = ilbd_enable_one_rule(irl, is_rollback);
		if (!is_rollback) {
			ilbd_audit_rule_event(irl->irl_name, NULL, cmd,
			    rc, ucredp);
		}
		return (rc);
	case ILBD_DISABLE_RULE:
		rc = ilbd_disable_one_rule(irl, is_rollback);
		if (!is_rollback) {
			ilbd_audit_rule_event(irl->irl_name, NULL, cmd,
			    rc, ucredp);
		}
		return (rc);
	}
	return (ILB_STATUS_INVAL_CMD);
}

static ilb_cmd_t
i_ilbd2ilb_cmd(ilbd_cmd_t c)
{
	ilb_cmd_t	r;

	switch (c) {
	case ILBD_CREATE_RULE:
		r = ILB_CREATE_RULE;
		break;
	case ILBD_DESTROY_RULE:
		r = ILB_DESTROY_RULE;
		break;
	case ILBD_ENABLE_RULE:
		r = ILB_ENABLE_RULE;
		break;
	case ILBD_DISABLE_RULE:
		r = ILB_DISABLE_RULE;
		break;
	}
	return (r);
}

static ilbd_cmd_t
get_undo_cmd(ilbd_cmd_t cmd)
{
	ilbd_cmd_t	u_cmd;

	switch (cmd) {
	case ILBD_DESTROY_RULE:
		u_cmd = ILBD_BAD_CMD;
		break;
	case ILBD_ENABLE_RULE:
		u_cmd = ILBD_DISABLE_RULE;
		break;
	case ILBD_DISABLE_RULE:
		u_cmd = ILBD_ENABLE_RULE;
		break;
	}

	return (u_cmd);
}

static ilb_status_t
i_ilbd_rule_action(const char *rule_name, const struct passwd *ps,
    ilbd_cmd_t cmd, ucred_t *ucredp)
{
	ilbd_rule_t	*irl, *irl_next;
	boolean_t	is_all_rules = B_FALSE;
	ilb_status_t	rc = ILB_STATUS_OK;
	ilb_name_cmd_t	kcmd;
	ilbd_cmd_t	u_cmd;
	char    rulename[ILB_NAMESZ];

	if (ps != NULL) {