Add recursive option to container delete
## Problem
A container whose dataset has dependents could not be deleted at all, and the attempt was not free: the libvirt domain was torn down before ZFS refused the destroy, killing a running container and discarding a suspended one's state for a delete that was never going to succeed.
## Solution
Validate the dataset up front, before any libvirt state is touched, so a delete that cannot succeed is refused cleanly and the container is left exactly as it was. Adds a `recursive` delete option that destroys the dataset together with its dependents for callers who do want it gone. Both refusals are now validation errors naming the option that lifts them, which means deleting a running container without `force` returns a validation error where it previously returned a call error.
[libc] Add __isoc99_fscanf alias. (#213125)
- Add LLVM_LIBC_ADD_FUNCTION_C_ALIAS macro to add another C alias public
symbol to a function.
- Add LIBC_CONF_SCANF_PROVIDE_ISOC99_ALIASES config
- Add __isoc99_fscanf for generic fscanf target if
LIBC_CONF_SCANF_PROVIDE_ISOC99_ALIASES is set.
- Similarly: scanf, vfscanf, vscanf.
Pull up following revision(s) (requested by skrll in ticket #410):
sys/dev/usb/motg.c: revision 1.44
motg: support control transfers (endpoint zero) aborts.
Tested by Brook Milligan.
[Clang][OpenMP] Skip Sema actions for invalid assumption clauses (#212822)
Do not call the Sema actions for absent, contains, and nullary assumption
clauses after the parser has diagnosed that the clause is not allowed on the
current directive.
Add assertions documenting that these Sema actions must only receive clauses
allowed on the current directive, and add tests covering all affected clause
kinds.
Fixes #212780.
Pull up the following, requested by kre in ticket #2044:
external/public-domain/tz/dist/Makefile up to 1.6
external/public-domain/tz/dist/NEWS up to 1.8
external/public-domain/tz/dist/TZDATA_VERSION up to 1.46
external/public-domain/tz/dist/africa up to 1.4
external/public-domain/tz/dist/australasia up to 1.13
external/public-domain/tz/dist/europe up to 1.6
external/public-domain/tz/dist/leap-seconds.list up to 1.12
external/public-domain/tz/dist/leapseconds up to 1.12
external/public-domain/tz/dist/northamerica up to 1.7
external/public-domain/tz/dist/theory.html up to 1.6
external/public-domain/tz/dist/version up to 1.19
external/public-domain/tz/dist/ziguard.awk up to 1.1.1.12
external/public-domain/tz/dist/zone.tab up to 1.6
external/public-domain/tz/dist/zone1970.tab up to 1.7
external/public-domain/tz/dist/zonenow.tab up to 1.8
doc/3RDPARTY (apply patch)
Updates tzdata to 2023cgtz
Pull up the following, requested by kre in ticket #1322
external/public-domain/tz/dist/Makefile up to 1.6
external/public-domain/tz/dist/NEWS up to 1.8
external/public-domain/tz/dist/TZDATA_VERSION up to 1.46
external/public-domain/tz/dist/africa up to 1.4
external/public-domain/tz/dist/australasia up to 1.13
external/public-domain/tz/dist/europe up to 1.6
external/public-domain/tz/dist/leap-seconds.list up to 1.12
external/public-domain/tz/dist/leapseconds up to 1.12
external/public-domain/tz/dist/northamerica up to 1.7
external/public-domain/tz/dist/theory.html up to 1.6
external/public-domain/tz/dist/version up to 1.19
external/public-domain/tz/dist/ziguard.awk up to 1.1.1.12
external/public-domain/tz/dist/zone.tab up to 1.6
external/public-domain/tz/dist/zone1970.tab up to 1.7
external/public-domain/tz/dist/zonenow.tab up to 1.8
doc/3RDPARTY (apply patch)
Update tzdata to 2023c (gtc).
Pull up following revision(s) (requested by he in ticket #2043):
sys/netinet/raw_ip.c: revision 1.187 (patch)
inet: respect IP_TOS and IP_TTL for raw sockets
Pull up following revision(s) (requested by hannken in ticket #2042):
sys/dev/fss.c: revision 1.116
Bracket I/O from or to the backing store with fstrans_start_lazy()
so the fss device doesn't block before the file system is suspended.
Should fix some deadlocks with revokation of ttys.
PR kern/59663 (ffs_snapshot_read -> uvm_fault (or pool page empty)
Pull up following revision(s) (requested by hannken in ticket #1320):
sys/dev/fss.c: revision 1.116
Bracket I/O from or to the backing store with fstrans_start_lazy()
so the fss device doesn't block before the file system is suspended.
Should fix some deadlocks with revokation of ttys.
PR kern/59663 (ffs_snapshot_read -> uvm_fault (or pool page empty)
Pull up following revision(s) (requested by hannken in ticket #409):
sys/dev/fss.c: revision 1.116
Bracket I/O from or to the backing store with fstrans_start_lazy()
so the fss device doesn't block before the file system is suspended.
Should fix some deadlocks with revokation of ttys.
PR kern/59663 (ffs_snapshot_read -> uvm_fault (or pool page empty)
Pull up following revision(s) (requested by rin in ticket #404):
crypto/external/bsd/openssh/dist/gss-genr.c: revision 1.17
crypto/external/bsd/openssh/dist/kexgen.c: revision 1.10
openssh: Fix up NetBSD RCSID. Otherwise, NFC
Pull up following revision(s) (requested by thorpej in ticket #403):
sys/dev/pci/isp_pci.c: revision 1.123
sys/dev/ic/isp_netbsd.h: revision 1.77
It has been observed in the wild that some individual instances of
ISP10[24]0 controllers don't seem to like getting a 64-bit DMA address
from our driver (at least, there seems to be some sort of incorrect
handling vis a vis the RQSTYPE_A64 message in isp_intr()).
Upon inspection, it was noted that in isp_pci_dmasetup(), the decision
to use RQSTYPE_T3RQS vs RQSTYPE_T2RQS was conditional on sizeof(bus_addr_t)
being larger than sizeof(uint32_t).
However, this isn't the correct predicate; instead, the choice should
be dependent on what the largest value that bus_addr_t will have. As
it happans, the PCI layer makes a distinction between 32-bit and 64-bit
DMA windows, and isp_pci's use of the regular "pa->pa_dmat" would ensure
that the DMA address always fits within 32-bits. Therefore, there was
[9 lines not shown]
Pull up following revision(s) (requested by thorpej in ticket #402):
sys/dev/ic/tulip.c: revision 1.215
Support for the 21142/21143 internal NWay block is structured like a
PHY driver, but it was overlooked when the ifmedia/mii layer gained a
locking protocol. Update it to avoid a recursive mutex acquisition
that can occur if the autonegotiation completes (very) quickly.
PR kern/60494
configd: further restrict configd actions to root and wwwonly for more sensitive actions (stopping services, reading certain data, ..) that won't be scheduled anyway and should have no other consumers.
addition to https://github.com/opnsense/core/commit/a313cbd5bdcfc3c9d4a55704fcdb8bbcf7182069
In the long run we might consider swapping the defaults, but since the chance of regressions is rather larger and most callouts aren't that problematic anyway, opt for explicit elevated rights for now.
Firewall: Rules and NAT: Group invalid rules to the end of the ruleset. These rules are skipped by PF processing because they do not have a valid interface. (#10550)
---------
Co-authored-by: Stephan de Wit <stephan.de.wit at deciso.com>
Firewall: NAT: Destination NAT - fix missing "well-known" in local-port, closes https://github.com/opnsense/core/issues/10612
While here, also suppress a php warning for an non-existing entry.
