static scf_propertygroup_t *
add_property_group_to_instance(scf_handle_t *handle, scf_instance_t *instance,
    const char *pg_name, const char *pg_type)
{
	scf_propertygroup_t *pg;

	pg = scf_pg_create(handle);
	if (pg == NULL) {
		KSSL_DEBUG("scf_pg_create failed: %s\n",
		    scf_strerror(scf_error()));
		(void) fprintf(stderr, gettext(
		    "Unexpected fatal libscf error: %s. Exiting.\n"),
		    scf_strerror(scf_error()));
		return (NULL);
	}

	if (scf_instance_add_pg(instance, pg_name, pg_type, 0, pg) != 0) {
		KSSL_DEBUG("ERROR: scf_instance_add_pg failed: %s\n",
		    scf_strerror(scf_error()));
		if (scf_error() == SCF_ERROR_EXISTS)
			(void) fprintf(stderr, gettext(
			    "Error: another process is modifying this instance."
			    " Exiting.\n"));
		else
			(void) fprintf(stderr, gettext(
			    "Unexpected fatal libscf error: %s. Exiting.\n"),
			    scf_strerror(scf_error()));
		scf_pg_destroy(pg);
		return (NULL);
	} else {
		KSSL_DEBUG("property group created\n");
	}

	return (pg);
}

static void
repository_notify_setup(scf_handle_t *h)
{
	for (;;) {
		if (_scf_notify_add_pgtype(h, SCF_GROUP_FRAMEWORK) ==
		    SCF_SUCCESS)
			break;

		switch (scf_error()) {
		case SCF_ERROR_CONNECTION_BROKEN:
			repository_rebind(h);
			break;

		case SCF_ERROR_NO_RESOURCES:
			(void) sleep(1);
			break;

		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "Abort: Couldn't set up repository notification "
			    "for pg type %s: %s\n", SCF_GROUP_FRAMEWORK,
			    scf_strerror(scf_error()));
			abort();
		}
	}
}

/*
 * retrieve_inetd_hash retrieves inetd's configuration file hash from the
 * repository. On success, hash is modified to point to the hash string and
 * SCF_ERROR_NONE is returned. Otherwise, the scf_error value is returned.
 * The space for the hash string is obtained using malloc(3C) and should be
 * freed by the caller.
 */
scf_error_t
retrieve_inetd_hash(char **hash)
{
	scf_simple_prop_t *sp;
	char *hashstr, *s;
	scf_error_t scf_err;

	if ((sp = scf_simple_prop_get(NULL, INETD_INSTANCE_FMRI, HASH_PG,
	    HASH_PROP)) == NULL)
		return (scf_error());

	if ((hashstr = scf_simple_prop_next_astring(sp)) == NULL) {
		scf_err = scf_error();
		scf_simple_prop_free(sp);
		return (scf_err);
	}

	if ((s = strdup(hashstr)) == NULL) {
		scf_simple_prop_free(sp);
		return (SCF_ERROR_NO_MEMORY);
	}
	*hash = s;
	scf_simple_prop_free(sp);
	return (SCF_ERROR_NONE);
}

static void
delete_prop(const scf_instance_t *inst, const char *pg, const char *prop)
{
	scf_transaction_t		*tx;
	scf_transaction_entry_t		*ent;
	scf_propertygroup_t		*gpg;
	scf_property_t			*eprop;
	int				ret;

	if ((gpg = scf_pg_create(h)) == NULL ||
	    (eprop = scf_property_create(h)) == NULL ||
	    (tx = scf_transaction_create(h)) == NULL ||
	    (ent = scf_entry_create(h)) == NULL)
		scfdie();

	if (scf_instance_get_pg(inst, pg, gpg) != SCF_SUCCESS) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		uu_die(gettext("Error: \"%s\" property group missing.\n"), pg);
	}

	do {
		if (scf_transaction_start(tx, gpg) != SCF_SUCCESS) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			uu_die(gettext("Error: Permission denied.\n"));
		}

		if (scf_transaction_property_delete(tx, ent,
		    prop) != SCF_SUCCESS) {
			if (scf_error() != SCF_ERROR_NOT_FOUND)
				scfdie();

			uu_die(
			    gettext("Error: \"%s\" property does not exist.\n"),
			    prop);
		}

		ret = scf_transaction_commit(tx);
		if (ret < 0) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			uu_die(gettext("Error: Permission denied.\n"));
		}
		if (ret == 0) {
			scf_transaction_reset(tx);
			if (scf_pg_update(gpg) == -1)
				scfdie();
		}
	} while (ret == 0);

	(void) scf_entry_destroy(ent);
	scf_transaction_destroy(tx);
	scf_property_destroy(eprop);
	scf_pg_destroy(gpg);
}

/*
 * Determine whether a given instance is a RPC service. Repository and
 * libscf errors are treated as if the service isn't an RPC service,
 * returning B_FALSE to indicate validation failure.
 */
static boolean_t
service_is_rpc(const scf_instance_t *inst)
{
	scf_snapshot_t *lsnap = NULL;
	uint8_t	isrpc;

	if (scf_instance_get_snapshot(inst, SCF_SNAPSHOT_RUNNING, snap) != 0) {
		syslog(LOG_DEBUG | LOG_DAEMON,
		    "Could not get running snapshot, using editing value\n");
	} else {
		lsnap = snap;
	}

	if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_INETD,
	    scratch_pg) == -1) {
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_DELETED:
			break;

		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_instance_get_pg_composed failed: %s\n",
			    scf_strerror(scf_error()));
			return (B_FALSE);
		}

		if (scf_instance_get_pg_composed(inst, lsnap,
		    SCF_PG_FW_CONTEXT, scratch_pg) == -1) {
			switch (scf_error()) {
			case SCF_ERROR_NOT_FOUND:
			case SCF_ERROR_DELETED:
				break;

			default:
				syslog(LOG_ERR | LOG_DAEMON,
				    "scf_instance_get_pg_composed failed: %s\n",
				    scf_strerror(scf_error()));
			}
			return (B_FALSE);
		}
	}

	if (pg_get_prop_value(scratch_pg, SCF_PROPERTY_ISRPC, scratch_v) == -1)
		return (B_FALSE);

	if (scf_value_get_boolean(scratch_v, &isrpc) == -1) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_value_get_boolean failed: "
		    "%s\n", scf_strerror(scf_error()));
		return (B_FALSE);
	}

	if (isrpc)
		return (B_TRUE);
	else
		return (B_FALSE);
}

/*
 * Get FMRI for the named process.
 */
isc_result_t
ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
	scf_handle_t *h = NULL;
	int namelen;
	char *instance;

	REQUIRE(ins_name != NULL && *ins_name == NULL);

	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
		if (debug)
			UNEXPECTED_ERROR(__FILE__, __LINE__,
					 "scf_handle_create() failed: %s",
					 scf_strerror(scf_error()));
		return (ISC_R_FAILURE);
	}

	if (scf_handle_bind(h) == -1) {
		if (debug)
			UNEXPECTED_ERROR(__FILE__, __LINE__,
					 "scf_handle_bind() failed: %s",
					 scf_strerror(scf_error()));
		scf_handle_destroy(h);
		return (ISC_R_FAILURE);
	}

	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
		if (debug)
			UNEXPECTED_ERROR(__FILE__, __LINE__,
					 "scf_myname() failed: %s",
					 scf_strerror(scf_error()));
		scf_handle_destroy(h);
		return (ISC_R_FAILURE);
	}

	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
		UNEXPECTED_ERROR(__FILE__, __LINE__,
				 "ns_smf_get_instance memory "
				 "allocation failed: %s",
				 isc_result_totext(ISC_R_NOMEMORY));
		scf_handle_destroy(h);
		return (ISC_R_FAILURE);
	}

	if (scf_myname(h, instance, namelen + 1) == -1) {
		if (debug)
			UNEXPECTED_ERROR(__FILE__, __LINE__,
					 "scf_myname() failed: %s",
					 scf_strerror(scf_error()));
		scf_handle_destroy(h);
		isc_mem_free(mctx, instance);
		return (ISC_R_FAILURE);
	}

	scf_handle_destroy(h);
	*ins_name = instance;
	return (ISC_R_SUCCESS);
}

/*
 * smb_smf_scf_log_error(msg)
 * Logs error messages from scf API's
 */
static void
smb_smf_scf_log_error(char *msg)
{
	if (!msg) {
		syslog(LOG_ERR, " SMBC SMF problem: %s\n",
		    scf_strerror(scf_error()));
	} else { /*LINTED E_SEC_PRINTF_E_VAR_FMT*/
		syslog(LOG_ERR, msg, scf_strerror(scf_error()));
	}
}

static int
add_new_property(scf_handle_t *handle, const char *prop_name,
    scf_type_t type, const char *val, scf_transaction_t *tx)
{
	scf_value_t *value = NULL;
	scf_transaction_entry_t *entry = NULL;
	int status = FAILURE;

	entry = scf_entry_create(handle);
	if (entry == NULL) {
		KSSL_DEBUG("scf_entry_create failed: %s\n",
		    scf_strerror(scf_error()));
		goto out;
	}
	KSSL_DEBUG("scf_entry_create succeeded\n");

	value = scf_value_create(handle);
	if (value == NULL) {
		goto out;
	}
	KSSL_DEBUG("scf_value_create succeeded\n");

	if (scf_transaction_property_new(tx, entry, prop_name, type) != 0) {
		goto out;
	}
	KSSL_DEBUG("scf_transaction_property_new succeeded\n");

	if (scf_value_set_from_string(value, type, val) != 0) {
		goto out;
	}
	KSSL_DEBUG("scf_value_set_from_string \'%s\' succeeded\n", val);

	if (scf_entry_add_value(entry, value) != 0) {
		KSSL_DEBUG(
		    "scf_entry_add_value failed: %s\n",
		    scf_strerror(scf_error()));
		goto out;
	}
	KSSL_DEBUG("scf_entry_add_value succeeded\n");

	status = SUCCESS;

out:
	if (status != SUCCESS)
		(void) fprintf(stderr, gettext(
		    "Unexpected fatal libscf error: %s. Exiting.\n"),
		    scf_strerror(scf_error()));
	return (status);
}

/*
 * Inputs:
 *   lpg is the property group to look up
 *   lprop is the property within that group to look up
 * Outputs:
 *   answer is a pointer to the property value
 * Returns:
 *    0 on success
 *   -1 on failure
 * If successful, the property value is retured in *answer.
 * Otherwise, *answer is undefined, and it is up to the caller to decide
 * how to handle that case.
 */
int
lookup_boolean_property(const char *lpg, const char *lprop, boolean_t *answer)
{
	int result = -1;
	scf_resources_t res;
	uint8_t prop_val;

	if (get_property_value(lpg, lprop, &res) != 0) {
		/*
		 * an error was already logged by get_property_value,
		 * and it released any resources assigned to res before
		 * returning.
		 */
		return (result);
	}
	if (scf_value_get_boolean(res.sr_val, &prop_val) != 0) {
		syslog(LOG_ERR, "scf_value_get_boolean() failed: %s",
		    scf_strerror(scf_error()));
		goto cleanup;
	}
	*answer = (boolean_t)prop_val;
	dprintf("lookup_boolean_property(%s, %s) returns %s", lpg, lprop,
	    *answer ? "TRUE" : "FALSE");
	result = 0;
cleanup:
	release_scf_resources(&res);
	return (result);
}

/*ARGSUSED*/
JNIEXPORT void JNICALL
Java_com_sun_dhcpmgr_bridge_Bridge_startup(
    JNIEnv *env,
    jobject obj)
{
	char *s;
	int ret;

	/*
	 * We first get the current state of the server according to
	 * svc.startd; if it's "disabled", we can just enable it.
	 * In any other case, we want to send a refresh so that
	 * dependencies are re-evaluated, which will be the case if the
	 * service was marked enabled by the profile, yet the
	 * config file didn't exist to allow it to run.
	 */
	if ((s = smf_get_state(DHCP_SERVER_INST)) != NULL) {
		if (strcmp(SCF_STATE_STRING_DISABLED, s) == 0)
			ret = smf_enable_instance(DHCP_SERVER_INST, 0);
		else
			ret = smf_refresh_instance(DHCP_SERVER_INST);
		free(s);
		if (ret == 0)
			return;
	}

	/* Something wasn't right, return exception with error from smf */
	throw_bridge_exception(env, scf_strerror(scf_error()));
}

/*
 * Inputs:
 *   lpg is the property group to look up
 *   lprop is the property within that group to look up
 * Outputs:
 *   answer is a pointer to the property value
 * Returns:
 *    0 on success
 *   -1 on failure
 * If successful, the property value is retured in *answer.
 * Otherwise, *answer is undefined, and it is up to the caller to decide
 * how to handle that case.
 */
int
lookup_count_property(const char *lpg, const char *lprop, uint64_t *answer)
{
	int result = -1;
	scf_resources_t res;

	if (get_property_value(lpg, lprop, &res) != 0) {
		/*
		 * an error was already logged by get_property_value,
		 * and it released any resources assigned to res before
		 * returning.
		 */
		return (result);
	}
	if (scf_value_get_count(res.sr_val, answer) != 0) {
		syslog(LOG_ERR, "scf_value_get_count() failed: %s",
		    scf_strerror(scf_error()));
		goto cleanup;
	}
	dprintf("lookup_count_property(%s, %s) returns %lld", lpg, lprop,
	    *answer);
	result = 0;
cleanup:
	release_scf_resources(&res);
	return (result);
}

/*
 * Return a snapshot for the supplied instance and snapshot name.
 */
static scf_snapshot_t *
get_snapshot(const scf_instance_t *inst, const char *snapshot)
{
	scf_snapshot_t *snap = scf_snapshot_create(hndl);

	if (snap == NULL)
		scfdie();

	if (scf_instance_get_snapshot(inst, snapshot, snap) == -1) {
		switch (scf_error()) {
		case SCF_ERROR_INVALID_ARGUMENT:
			die(gettext("Invalid snapshot name.\n"));
			/* NOTREACHED */

		case SCF_ERROR_NOT_FOUND:
			if (sflag == 0) {
				scf_snapshot_destroy(snap);
				snap = NULL;
			} else
				die(gettext("No such snapshot.\n"));
			break;

		default:
			scfdie();
		}
	}

	return (snap);
}

/*
 * Sets string property in current pg
 */
int
smb_smf_set_string_property(smb_scfhandle_t *handle,
    char *propname, char *valstr)
{
	int ret = SMBC_SMF_OK;
	scf_value_t *value = NULL;
	scf_transaction_entry_t *entry = NULL;

	if (handle == NULL) {
		return (SMBC_SMF_SYSTEM_ERR);
	}

	/*
	 * properties must be set in transactions and don't take
	 * effect until the transaction has been ended/committed.
	 */
	value = scf_value_create(handle->scf_handle);
	entry = scf_entry_create(handle->scf_handle);
	if (value != NULL && entry != NULL) {
		if (scf_transaction_property_change(handle->scf_trans, entry,
		    propname, SCF_TYPE_ASTRING) == 0 ||
		    scf_transaction_property_new(handle->scf_trans, entry,
		    propname, SCF_TYPE_ASTRING) == 0) {
			if (scf_value_set_astring(value, valstr) == 0) {
				if (scf_entry_add_value(entry, value) != 0) {
					ret = SMBC_SMF_SYSTEM_ERR;
					scf_value_destroy(value);
				}
				/* the value is in the transaction */
				value = NULL;
			} else {
				/* value couldn't be constructed */
				ret = SMBC_SMF_SYSTEM_ERR;
			}
			/* the entry is in the transaction */
			entry = NULL;
		} else {
			ret = SMBC_SMF_SYSTEM_ERR;
		}
	} else {
		ret = SMBC_SMF_SYSTEM_ERR;
	}
	if (ret == SMBC_SMF_SYSTEM_ERR) {
		switch (scf_error()) {
		case SCF_ERROR_PERMISSION_DENIED:
			ret = SMBC_SMF_NO_PERMISSION;
			break;
		}
	}

	/*
	 * cleanup if there were any errors that didn't leave these
	 * values where they would be cleaned up later.
	 */
	if (value != NULL)
		scf_value_destroy(value);
	if (entry != NULL)
		scf_entry_destroy(entry);
	return (ret);
}

/*
 * Start transaction on current pg in handle.
 * The pg could be service or instance level.
 * Must be called after pg handle is obtained
 * from create or get.
 */
int
smb_smf_start_transaction(smb_scfhandle_t *handle)
{
	int ret = SMBD_SMF_OK;

	if (!handle || (!handle->scf_pg))
		return (SMBD_SMF_SYSTEM_ERR);

	/*
	 * lookup the property group and create it if it doesn't already
	 * exist.
	 */
	if (handle->scf_state == SCH_STATE_INIT) {
		if (ret == SMBD_SMF_OK) {
			handle->scf_trans =
			    scf_transaction_create(handle->scf_handle);
			if (handle->scf_trans != NULL) {
				if (scf_transaction_start(handle->scf_trans,
				    handle->scf_pg) != 0) {
					ret = SMBD_SMF_SYSTEM_ERR;
					scf_transaction_destroy(
					    handle->scf_trans);
					handle->scf_trans = NULL;
				}
			} else {
				ret = SMBD_SMF_SYSTEM_ERR;
			}
		}
	}
	if (ret == SMBD_SMF_SYSTEM_ERR &&
	    scf_error() == SCF_ERROR_PERMISSION_DENIED)
		ret = SMBD_SMF_NO_PERMISSION;

	return (ret);
}

static int
set_svc_enable_cb(void *data, scf_walkinfo_t *wip)
{
	uint8_t			desired = *(uint8_t *)data;
	const char		*instname = wip->fmri;

	if (desired) {
		if (smf_enable_instance(instname, 0) == 0)
			return (0);
	} else {
		if (smf_disable_instance(instname, 0) == 0)
			return (0);
	}

	switch (scf_error()) {
	case SCF_ERROR_INVALID_ARGUMENT:
		uu_die(gettext("Error: \"%s\" is not a valid service "
		    "instance.\n"), instname);
		break;
	case SCF_ERROR_NOT_FOUND:
		uu_die(gettext("Error: Service instance \"%s\" not found.\n"),
		    instname);
		break;
	default:
		scfdie();
	}

	return (0);
}

/*
 * smb_smf_scf_log_error(msg)
 * Logs error messages from scf API's
 */
static void
smb_smf_scf_log_error(char *msg)
{
	if (msg == NULL)
		msg = "SMBD SMF problem";

	syslog(LOG_ERR, " %s: %s", msg, scf_strerror(scf_error()));
}

targ_scf_t *
mgmt_handle_init(void)
{
	targ_scf_t	*h;

	h = calloc(1, sizeof (targ_scf_t));
	if (h == NULL)
		return (NULL);

	h->t_handle = scf_handle_create(SCF_VERSION);
	if (h->t_handle != NULL) {
		if (scf_handle_bind(h->t_handle) == 0) {
			h->t_scope	= scf_scope_create(h->t_handle);
			h->t_service	= scf_service_create(h->t_handle);
			h->t_pg		= scf_pg_create(h->t_handle);
			h->t_instance	= scf_instance_create(h->t_handle);
			if (scf_handle_get_scope(h->t_handle, SCF_SCOPE_LOCAL,
			    h->t_scope) == 0) {
				if (scf_scope_get_service(h->t_scope,
				    SA_TARGET_SVC_NAME, h->t_service) != 0)
					goto error;

			} else {
				syslog(LOG_ERR,
				    "Got local scope which is wrong\n");
				goto error;
			}
		} else
			goto error;
	} else {
		free(h);
		h = NULL;
		syslog(LOG_ERR,
		    "iscsitgt could not access SMF repository: %s\n",
		    scf_strerror(scf_error()));
	}

	return (h);
error:
	mgmt_handle_fini(h);
	free(h);
	syslog(LOG_ERR, "iscsitgt SMF initialization problem: %s\n",
	    scf_strerror(scf_error()));
	return (NULL);
}

/*ARGSUSED*/
JNIEXPORT void JNICALL
Java_com_sun_dhcpmgr_bridge_Bridge_shutdown(
    JNIEnv *env,
    jobject obj)
{
	if (smf_disable_instance(DHCP_SERVER_INST, 0) != 0) {
		throw_bridge_exception(env, scf_strerror(scf_error()));
	}
}

static void *
scf_exception(const char *err, const char *value)
{
	int scferr = scf_error();
	const char *scfstrerr = scf_strerror(scferr);
	PyObject *obj = Py_BuildValue("(isss)", scferr, err, scfstrerr, value);
	PyErr_SetObject(scf_exc, obj);
	return (NULL);
}

/*
 * smb_smf_delete_instance_pgroup(handle, pgroup)
 *
 * remove the property group from the current instance.
 * but only if it actually exists.
 */
int
smb_smf_delete_instance_pgroup(smb_scfhandle_t *handle, char *pgroup)
{
	int ret = SMBC_SMF_OK;
	int err;

	if (handle == NULL) {
		return (SMBC_SMF_SYSTEM_ERR);
	}

	/*
	 * only create a handle if it doesn't exist. It is ok to exist
	 * since the pg handle will be set as a side effect.
	 */
	if (handle->scf_pg == NULL) {
		handle->scf_pg = scf_pg_create(handle->scf_handle);
	}

	/*
	 * only delete if it does exist.
	 */
	if (scf_instance_get_pg(handle->scf_instance,
	    pgroup, handle->scf_pg) == 0) {
		/* does exist so delete it */
		if (scf_pg_delete(handle->scf_pg) != 0) {
			ret = SMBC_SMF_SYSTEM_ERR;
			err = scf_error();
			if (err != SCF_ERROR_NONE) {
				smb_smf_scf_log_error("SMF delpg "
				    "problem: %s\n");
			}
		}
	} else {
		err = scf_error();
		if (err != SCF_ERROR_NONE)
			smb_smf_scf_log_error("SMF getpg problem: %s\n");
		ret = SMBC_SMF_SYSTEM_ERR;
	}
	if (ret == SMBC_SMF_SYSTEM_ERR &&
	    scf_error() == SCF_ERROR_PERMISSION_DENIED) {
		ret = SMBC_SMF_NO_PERMISSION;
	}
	return (ret);
}