[illumos-gate merge]

commit b7070b7dbcc2758a7f87cefb69ad42887a287152
    5427 memory leak in libzfs when doing rollback
commit 94bdecd9e84ae1042607002db3e64a6849da5874
    5198 Want alternate global zone rule set for each ipf netstack
    5197 Global zone should be able to manage NGZ ipf state
commit c67987612cd8324e1f3d1b5110086552d19a2d89
    5200 ipf_stack_destroy error messages when halting zones
commit 2f443e27e5988131d8b57bec58ee15f9227e0899
    5096 getaddrinfo doesn't properly handle AI_ADDRCONFIG | AI_V4MAPPED
commit e48cae6f8c603e9a18cdb49fdf939cd4e1753e62
    4643 nss_dns fails to obtain dns ttls

Conflicts:
	usr/src/uts/intel/ipf/ipf.global-objs.debug64
	usr/src/uts/common/inet/ipf/solaris.c
	usr/src/uts/common/inet/ipf/netinet/ipf_stack.h
	usr/src/uts/common/inet/ipf/netinet/ip_fil.h
	usr/src/uts/common/inet/ipf/ip_log.c
	usr/src/uts/common/inet/ipf/ip_fil_solaris.c
	usr/src/uts/common/inet/ipf/fil.c
	usr/src/man/man1m/ippool.1m
	usr/src/man/man1m/ipnat.1m
	usr/src/man/man1m/ipf.1m
	usr/src/lib/nsswitch/dns/common/dns_common.c
	usr/src/lib/nsswitch/dns/Makefile.com
	usr/src/lib/libzfs/common/libzfs_iter.c
	usr/src/cmd/ipf/tools/ippool.c
	usr/src/cmd/ipf/tools/ipnat.c
	usr/src/cmd/ipf/tools/ipmon.c
	usr/src/cmd/ipf/tools/ipfzone.c
	usr/src/cmd/ipf/tools/ipfstat.c
	usr/src/cmd/ipf/tools/ipfs.c
	usr/src/cmd/ipf/tools/ipf.c
	usr/src/cmd/ipf/lib/common/load_poolnode.c
	usr/src/cmd/ipf/lib/common/load_pool.c
	usr/src/cmd/ipf/lib/common/load_hashnode.c
	usr/src/cmd/ipf/lib/common/load_hash.c

6 files changed, 6 insertions, 38 deletions

diff --git a/usr/src/man/man1m/ipf.1m b/usr/src/man/man1m/ipf.1m
index 93267db577..57a3f4bb9a 100644
--- a/usr/src/man/man1m/ipf.1m
+++ b/usr/src/man/man1m/ipf.1m
@@ -2,8 +2,8 @@
 .\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
 .\" location.
 .\" Portions Copyright (c) 2009, Sun Microsystems Inc. All Rights Reserved.
-.\" Portions Copyright (c) 2013, Joyent, Inc. All Rights Reserved.
-.TH IPF 1M "Oct 30, 2013"
+.\" Portions Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
+.TH IPF 1M "Oct 7, 2014"
 .SH NAME
 ipf \- alter packet filtering lists for IP packet input and output
 .SH SYNOPSIS
@@ -15,7 +15,6 @@ ipf \- alter packet filtering lists for IP packet input and output
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBipf\fR utility is part of a suite of commands associated with the
 Solaris IP Filter feature. See \fBipfilter\fR(5).
@@ -35,7 +34,6 @@ matching the order in which they appear when given to \fBipf\fR.
 \fB/dev/ipl\fR, and \fB/dev/ipstate\fR. The default permissions of these files
 require \fBipf\fR to be run as root for all operations.
 .SS "Enabling Solaris IP Filter Feature"
-.sp
 .LP
 Solaris IP Filter is installed with the Solaris operating system. However,
 packet filtering is not enabled by default. Use the following procedure to
@@ -160,7 +158,6 @@ If you reboot your system, the IPfilter configuration is automatically
 activated.
 .RE
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -472,7 +469,6 @@ affect fragment or state statistics.
 .RE
 
 .SH ZONES
-.sp
 .LP
 Each non-global zone has two ipfilter instances: the in-zone ipfilter, which
 can be controlled from both the zone itself and the global zone, and the
@@ -485,10 +481,12 @@ ipfilter settings for that zone, rather than the current one. The zonename
 option is only available in the Global Zone. Using it in any other zone will
 return an error. If the \fB-G\fR option is specified with this argument, the
 Global Zone-controlled ipfilter is operated on. If \fB-G\fR is not specified,
-the in-zone ipfilter is operated on.
+the in-zone ipfilter is operated on. Note that ipf differs from the other
+ipfilter tools in how the zone name is specified. It takes the zone name as the
+last argument, while all of the other tools take the zone name as an argument
+to the \fB-G\fR and \fB-z\fR options.
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/dev/ipauth\fR\fR
@@ -527,7 +525,6 @@ Contains numerous IP Filter examples.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -543,7 +540,6 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipfstat\fR(1M), \fBipmon\fR(1M), \fBipnat\fR(1M), \fBippool\fR(1M),
 \fBsvcadm\fR(1M), \fBsvc.ipfd\fR(1M), \fBipf\fR(4), \fBipnat.conf\fR(4),
@@ -552,7 +548,6 @@ Interface Stability	Committed
 .LP
 \fI\fR
 .SH DIAGNOSTICS
-.sp
 .LP
 Needs to be run as root for the packet filtering lists to actually be affected
 inside the kernel.
diff --git a/usr/src/man/man1m/ipfs.1m b/usr/src/man/man1m/ipfs.1m
index 5514e96ea9..38a7f50c7b 100644
--- a/usr/src/man/man1m/ipfs.1m
+++ b/usr/src/man/man1m/ipfs.1m
@@ -43,7 +43,6 @@ ipfs \- saves and restores information for NAT and state tables
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBipfs\fR utility enables the saving of state information across reboots.
 Specifically, the utility allows state information created for NAT entries and
@@ -51,7 +50,6 @@ rules using "keep state" to be locked (modification prevented) and then saved
 to disk. Then, after a reboot, that information is restored. The result of this
 state-saving is that connections are not interrupted.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -221,7 +219,6 @@ used. This command is only available in the Global Zone. See \fBZONES\fR in
 \fB/dev/ipnat\fR
 .RE
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -237,12 +234,10 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipf\fR(1M), \fBipmon\fR(1M), \fBipnat\fR(1M), \fBattributes\fR(5),
 \fBzones(5)\fR
 .SH DIAGNOSTICS
-.sp
 .LP
 Arguably, the \fB-W\fR and \fB-R\fR operations should set the locking and,
 rather than undo it, restore it to what it was previously.
diff --git a/usr/src/man/man1m/ipfstat.1m b/usr/src/man/man1m/ipfstat.1m
index ba46c2c44b..ba47f78725 100644
--- a/usr/src/man/man1m/ipfstat.1m
+++ b/usr/src/man/man1m/ipfstat.1m
@@ -19,7 +19,6 @@ ipfstat \- reports on packet filter statistics and filter list
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBipfstat\fR command is part of a suite of commands associated with the
 Solaris IP Filter feature. See \fBipfilter\fR(5).
@@ -133,7 +132,6 @@ Only the first \fIX\fR-5 entries that match the sort and filter criteria are
 displayed (where \fIX\fR is the number of rows on the display). There is no way
 to see additional entries.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -402,7 +400,6 @@ for more information.
 \fB/dev/ipstate\fR
 .RE
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -418,7 +415,6 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipf\fR(1M), \fBkstat\fR(1M), \fBkstat\fR(3KSTAT), \fBattributes\fR(5),
 \fBipfilter\fR(5), \fBzones(5)\fR
diff --git a/usr/src/man/man1m/ipmon.1m b/usr/src/man/man1m/ipmon.1m
index 07574790b9..8873fe41c1 100644
--- a/usr/src/man/man1m/ipmon.1m
+++ b/usr/src/man/man1m/ipmon.1m
@@ -14,7 +14,6 @@ ipmon \- monitors /dev/ipl for logged packets
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBipmon\fR command is part of a suite of commands associated with the
 Solaris IP Filter feature. See \fBipfilter\fR(5).
@@ -103,7 +102,6 @@ always being \fBicmp\fR, the next being the ICMP message and submessage type,
 separated by a slash. For example, \fBicmp 3/3\fR for a port unreachable
 message.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -390,7 +388,6 @@ for more information.
 \fB/dev/ipstate\fR
 .RE
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -406,7 +403,6 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipf\fR(1M), \fBipfstat\fR(1M), \fBipnat\fR(1M), \fBattributes\fR(5),
 \fBipfilter\fR(5), \fBzones(5)\fR
@@ -414,7 +410,6 @@ Interface Stability	Committed
 .LP
 \fI\fR
 .SH DIAGNOSTICS
-.sp
 .LP
 \fBipmon\fR expects data that it reads to be consistent with how it should be
 saved and aborts if it fails an assertion which detects an anomaly in the
diff --git a/usr/src/man/man1m/ipnat.1m b/usr/src/man/man1m/ipnat.1m
index ed382fa7a9..e800988bb3 100644
--- a/usr/src/man/man1m/ipnat.1m
+++ b/usr/src/man/man1m/ipnat.1m
@@ -13,7 +13,6 @@ ipnat \- user interface to the NAT subsystem
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBipnat\fR utility opens a specified file (treating \fB-\fR as stdin) and
 parses it for a set of rules that are to be added or removed from the IP NAT.
@@ -33,7 +32,6 @@ require \fBipnat\fR to be run as root for all operations.
 permissions of \fB/dev/ipnat\fR require \fBipnat\fR to be run as root for all
 operations.
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -166,7 +164,6 @@ for more information.
 .RE
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/dev/ipnat\fR\fR
@@ -207,7 +204,6 @@ Contains numerous IP Filter examples.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -223,7 +219,6 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipf\fR(1M), \fBipfstat\fR(1M), \fBipnat\fR(4), \fBattributes\fR(5),
 \fBzones(5)\fR
diff --git a/usr/src/man/man1m/ippool.1m b/usr/src/man/man1m/ippool.1m
index c7cae2029e..b32e8355a6 100644
--- a/usr/src/man/man1m/ippool.1m
+++ b/usr/src/man/man1m/ippool.1m
@@ -56,7 +56,6 @@ ippool \- user interface to the IP Filter pools
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 The \fBippool\fR utility is used to manage information stored in the IP pools
 subsystem of IP Filter software. Configuration file information can be parsed
@@ -77,11 +76,9 @@ and the instance-specific options.
 \fB/dev/ipl\fR, and \fB/dev/ipstate\fR. The default permissions of these files
 require \fBippool\fR to be run as root for all operations.
 .SH OPTIONS
-.sp
 .LP
 \fBippool\fR supports the option categories described below.
 .SS "Global Options"
-.sp
 .LP
 The following global options are supported:
 .sp
@@ -137,7 +134,6 @@ information.
 .RE
 
 .SS "Instance-Specific Options"
-.sp
 .LP
 The following instance-specific options are supported:
 .sp
@@ -223,7 +219,6 @@ Display IP pool statistical information.
 .RE
 
 .SS "Other Options"
-.sp
 .LP
 The following, additional options are supported:
 .sp
@@ -307,7 +302,6 @@ kernel, unload it.
 .RE
 
 .SH FILES
-.sp
 .ne 2
 .na
 \fB\fB/dev/ippool\fR\fR
@@ -335,7 +329,6 @@ Location of \fBippool\fR startup configuration file.
 .RE
 
 .SH ATTRIBUTES
-.sp
 .LP
 See \fBattributes\fR(5) for descriptions of the following attributes:
 .sp
@@ -351,7 +344,6 @@ Interface Stability	Committed
 .TE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBipf\fR(1M), \fBipfstat\fR(1M), \fBippool\fR(4), \fBattributes\fR(5),
 \fBzones(5)\fR