sys/contrib/openzfs/lib/libzfs/libzfs_sendrecv.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
  25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
  27  * All rights reserved
  28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
  29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
  30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
  31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
  32  * Copyright (c) 2019 Datto Inc.
  33  */
  34
  35 #include <assert.h>
  36 #include <ctype.h>
  37 #include <errno.h>
  38 #include <libintl.h>
  39 #include <stdio.h>
  40 #include <stdlib.h>
  41 #include <strings.h>
  42 #include <unistd.h>
  43 #include <stddef.h>
  44 #include <fcntl.h>
  45 #include <sys/mount.h>
  46 #include <sys/mntent.h>
  47 #include <sys/mnttab.h>
  48 #include <sys/avl.h>
  49 #include <sys/debug.h>
  50 #include <sys/stat.h>
  51 #include <stddef.h>
  52 #include <pthread.h>
  53 #include <umem.h>
  54 #include <time.h>
  55
  56 #include <libzfs.h>
  57 #include <libzfs_core.h>
  58 #include <libzutil.h>
  59
  60 #include "zfs_namecheck.h"
  61 #include "zfs_prop.h"
  62 #include "zfs_fletcher.h"
  63 #include "libzfs_impl.h"
  64 #include <cityhash.h>
  65 #include <zlib.h>
  66 #include <sys/zio_checksum.h>
  67 #include <sys/dsl_crypt.h>
  68 #include <sys/ddt.h>
  69 #include <sys/socket.h>
  70 #include <sys/sha2.h>
  71
  72 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
  73     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
  74     const char *, nvlist_t *);
  75 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
  76     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
  77     uint64_t num_redact_snaps, char *name);
  78 static int guid_to_name(libzfs_handle_t *, const char *,
  79     uint64_t, boolean_t, char *);
  80
  81 typedef struct progress_arg {
  82         zfs_handle_t *pa_zhp;
  83         int pa_fd;
  84         boolean_t pa_parsable;
  85         boolean_t pa_estimate;
  86         int pa_verbosity;
  87 } progress_arg_t;
  88
  89 static int
  90 dump_record(dmu_replay_record_t *drr, void *payload, int payload_len,
  91     zio_cksum_t *zc, int outfd)
  92 {
  93         ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
  94             ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
  95         fletcher_4_incremental_native(drr,
  96             offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
  97         if (drr->drr_type != DRR_BEGIN) {
  98                 ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
  99                     drr_checksum.drr_checksum));
 100                 drr->drr_u.drr_checksum.drr_checksum = *zc;
 101         }
 102         fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
 103             sizeof (zio_cksum_t), zc);
 104         if (write(outfd, drr, sizeof (*drr)) == -1)
 105                 return (errno);
 106         if (payload_len != 0) {
 107                 fletcher_4_incremental_native(payload, payload_len, zc);
 108                 if (write(outfd, payload, payload_len) == -1)
 109                         return (errno);
 110         }
 111         return (0);
 112 }
 113
 114 /*
 115  * Routines for dealing with the AVL tree of fs-nvlists
 116  */
 117 typedef struct fsavl_node {
 118         avl_node_t fn_node;
 119         nvlist_t *fn_nvfs;
 120         char *fn_snapname;
 121         uint64_t fn_guid;
 122 } fsavl_node_t;
 123
 124 static int
 125 fsavl_compare(const void *arg1, const void *arg2)
 126 {
 127         const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
 128         const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
 129
 130         return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
 131 }
 132
 133 /*
 134  * Given the GUID of a snapshot, find its containing filesystem and
 135  * (optionally) name.
 136  */
 137 static nvlist_t *
 138 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
 139 {
 140         fsavl_node_t fn_find;
 141         fsavl_node_t *fn;
 142
 143         fn_find.fn_guid = snapguid;
 144
 145         fn = avl_find(avl, &fn_find, NULL);
 146         if (fn) {
 147                 if (snapname)
 148                         *snapname = fn->fn_snapname;
 149                 return (fn->fn_nvfs);
 150         }
 151         return (NULL);
 152 }
 153
 154 static void
 155 fsavl_destroy(avl_tree_t *avl)
 156 {
 157         fsavl_node_t *fn;
 158         void *cookie;
 159
 160         if (avl == NULL)
 161                 return;
 162
 163         cookie = NULL;
 164         while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
 165                 free(fn);
 166         avl_destroy(avl);
 167         free(avl);
 168 }
 169
 170 /*
 171  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
 172  */
 173 static avl_tree_t *
 174 fsavl_create(nvlist_t *fss)
 175 {
 176         avl_tree_t *fsavl;
 177         nvpair_t *fselem = NULL;
 178
 179         if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
 180                 return (NULL);
 181
 182         avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
 183             offsetof(fsavl_node_t, fn_node));
 184
 185         while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
 186                 nvlist_t *nvfs, *snaps;
 187                 nvpair_t *snapelem = NULL;
 188
 189                 VERIFY(0 == nvpair_value_nvlist(fselem, &nvfs));
 190                 VERIFY(0 == nvlist_lookup_nvlist(nvfs, "snaps", &snaps));
 191
 192                 while ((snapelem =
 193                     nvlist_next_nvpair(snaps, snapelem)) != NULL) {
 194                         fsavl_node_t *fn;
 195                         uint64_t guid;
 196
 197                         VERIFY(0 == nvpair_value_uint64(snapelem, &guid));
 198                         if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
 199                                 fsavl_destroy(fsavl);
 200                                 return (NULL);
 201                         }
 202                         fn->fn_nvfs = nvfs;
 203                         fn->fn_snapname = nvpair_name(snapelem);
 204                         fn->fn_guid = guid;
 205
 206                         /*
 207                          * Note: if there are multiple snaps with the
 208                          * same GUID, we ignore all but one.
 209                          */
 210                         if (avl_find(fsavl, fn, NULL) == NULL)
 211                                 avl_add(fsavl, fn);
 212                         else
 213                                 free(fn);
 214                 }
 215         }
 216
 217         return (fsavl);
 218 }
 219
 220 /*
 221  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
 222  */
 223 typedef struct send_data {
 224         /*
 225          * assigned inside every recursive call,
 226          * restored from *_save on return:
 227          *
 228          * guid of fromsnap snapshot in parent dataset
 229          * txg of fromsnap snapshot in current dataset
 230          * txg of tosnap snapshot in current dataset
 231          */
 232
 233         uint64_t parent_fromsnap_guid;
 234         uint64_t fromsnap_txg;
 235         uint64_t tosnap_txg;
 236
 237         /* the nvlists get accumulated during depth-first traversal */
 238         nvlist_t *parent_snaps;
 239         nvlist_t *fss;
 240         nvlist_t *snapprops;
 241         nvlist_t *snapholds;    /* user holds */
 242
 243         /* send-receive configuration, does not change during traversal */
 244         const char *fsname;
 245         const char *fromsnap;
 246         const char *tosnap;
 247         boolean_t recursive;
 248         boolean_t raw;
 249         boolean_t doall;
 250         boolean_t replicate;
 251         boolean_t verbose;
 252         boolean_t backup;
 253         boolean_t seenfrom;
 254         boolean_t seento;
 255         boolean_t holds;        /* were holds requested with send -h */
 256         boolean_t props;
 257
 258         /*
 259          * The header nvlist is of the following format:
 260          * {
 261          *   "tosnap" -> string
 262          *   "fromsnap" -> string (if incremental)
 263          *   "fss" -> {
 264          *      id -> {
 265          *
 266          *       "name" -> string (full name; for debugging)
 267          *       "parentfromsnap" -> number (guid of fromsnap in parent)
 268          *
 269          *       "props" -> { name -> value (only if set here) }
 270          *       "snaps" -> { name (lastname) -> number (guid) }
 271          *       "snapprops" -> { name (lastname) -> { name -> value } }
 272          *       "snapholds" -> { name (lastname) -> { holdname -> crtime } }
 273          *
 274          *       "origin" -> number (guid) (if clone)
 275          *       "is_encroot" -> boolean
 276          *       "sent" -> boolean (not on-disk)
 277          *      }
 278          *   }
 279          * }
 280          *
 281          */
 282 } send_data_t;
 283
 284 static void
 285 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
 286
 287 static int
 288 send_iterate_snap(zfs_handle_t *zhp, void *arg)
 289 {
 290         send_data_t *sd = arg;
 291         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 292         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 293         char *snapname;
 294         nvlist_t *nv;
 295         boolean_t isfromsnap, istosnap, istosnapwithnofrom;
 296
 297         snapname = strrchr(zhp->zfs_name, '@')+1;
 298         isfromsnap = (sd->fromsnap != NULL &&
 299             strcmp(sd->fromsnap, snapname) == 0);
 300         istosnap = (sd->tosnap != NULL && (strcmp(sd->tosnap, snapname) == 0));
 301         istosnapwithnofrom = (istosnap && sd->fromsnap == NULL);
 302
 303         if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 304                 if (sd->verbose) {
 305                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 306                             "skipping snapshot %s because it was created "
 307                             "after the destination snapshot (%s)\n"),
 308                             zhp->zfs_name, sd->tosnap);
 309                 }
 310                 zfs_close(zhp);
 311                 return (0);
 312         }
 313
 314         VERIFY(0 == nvlist_add_uint64(sd->parent_snaps, snapname, guid));
 315         /*
 316          * NB: if there is no fromsnap here (it's a newly created fs in
 317          * an incremental replication), we will substitute the tosnap.
 318          */
 319         if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap)) {
 320                 sd->parent_fromsnap_guid = guid;
 321         }
 322
 323         if (!sd->recursive) {
 324                 if (!sd->seenfrom && isfromsnap) {
 325                         sd->seenfrom = B_TRUE;
 326                         zfs_close(zhp);
 327                         return (0);
 328                 }
 329
 330                 if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
 331                         zfs_close(zhp);
 332                         return (0);
 333                 }
 334
 335                 if (istosnap)
 336                         sd->seento = B_TRUE;
 337         }
 338
 339         VERIFY(0 == nvlist_alloc(&nv, NV_UNIQUE_NAME, 0));
 340         send_iterate_prop(zhp, sd->backup, nv);
 341         VERIFY(0 == nvlist_add_nvlist(sd->snapprops, snapname, nv));
 342         nvlist_free(nv);
 343         if (sd->holds) {
 344                 nvlist_t *holds = fnvlist_alloc();
 345                 int err = lzc_get_holds(zhp->zfs_name, &holds);
 346                 if (err == 0) {
 347                         VERIFY(0 == nvlist_add_nvlist(sd->snapholds,
 348                             snapname, holds));
 349                 }
 350                 fnvlist_free(holds);
 351         }
 352
 353         zfs_close(zhp);
 354         return (0);
 355 }
 356
 357 static void
 358 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
 359 {
 360         nvlist_t *props = NULL;
 361         nvpair_t *elem = NULL;
 362
 363         if (received_only)
 364                 props = zfs_get_recvd_props(zhp);
 365         else
 366                 props = zhp->zfs_props;
 367
 368         while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
 369                 char *propname = nvpair_name(elem);
 370                 zfs_prop_t prop = zfs_name_to_prop(propname);
 371                 nvlist_t *propnv;
 372
 373                 if (!zfs_prop_user(propname)) {
 374                         /*
 375                          * Realistically, this should never happen.  However,
 376                          * we want the ability to add DSL properties without
 377                          * needing to make incompatible version changes.  We
 378                          * need to ignore unknown properties to allow older
 379                          * software to still send datasets containing these
 380                          * properties, with the unknown properties elided.
 381                          */
 382                         if (prop == ZPROP_INVAL)
 383                                 continue;
 384
 385                         if (zfs_prop_readonly(prop))
 386                                 continue;
 387                 }
 388
 389                 verify(nvpair_value_nvlist(elem, &propnv) == 0);
 390                 if (prop == ZFS_PROP_QUOTA || prop == ZFS_PROP_RESERVATION ||
 391                     prop == ZFS_PROP_REFQUOTA ||
 392                     prop == ZFS_PROP_REFRESERVATION) {
 393                         char *source;
 394                         uint64_t value;
 395                         verify(nvlist_lookup_uint64(propnv,
 396                             ZPROP_VALUE, &value) == 0);
 397                         if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
 398                                 continue;
 399                         /*
 400                          * May have no source before SPA_VERSION_RECVD_PROPS,
 401                          * but is still modifiable.
 402                          */
 403                         if (nvlist_lookup_string(propnv,
 404                             ZPROP_SOURCE, &source) == 0) {
 405                                 if ((strcmp(source, zhp->zfs_name) != 0) &&
 406                                     (strcmp(source,
 407                                     ZPROP_SOURCE_VAL_RECVD) != 0))
 408                                         continue;
 409                         }
 410                 } else {
 411                         char *source;
 412                         if (nvlist_lookup_string(propnv,
 413                             ZPROP_SOURCE, &source) != 0)
 414                                 continue;
 415                         if ((strcmp(source, zhp->zfs_name) != 0) &&
 416                             (strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0))
 417                                 continue;
 418                 }
 419
 420                 if (zfs_prop_user(propname) ||
 421                     zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
 422                         char *value;
 423                         verify(nvlist_lookup_string(propnv,
 424                             ZPROP_VALUE, &value) == 0);
 425                         VERIFY(0 == nvlist_add_string(nv, propname, value));
 426                 } else {
 427                         uint64_t value;
 428                         verify(nvlist_lookup_uint64(propnv,
 429                             ZPROP_VALUE, &value) == 0);
 430                         VERIFY(0 == nvlist_add_uint64(nv, propname, value));
 431                 }
 432         }
 433 }
 434
 435 /*
 436  * returns snapshot creation txg
 437  * and returns 0 if the snapshot does not exist
 438  */
 439 static uint64_t
 440 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
 441 {
 442         char name[ZFS_MAX_DATASET_NAME_LEN];
 443         uint64_t txg = 0;
 444
 445         if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
 446                 return (txg);
 447
 448         (void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
 449         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
 450                 zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
 451                 if (zhp != NULL) {
 452                         txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
 453                         zfs_close(zhp);
 454                 }
 455         }
 456
 457         return (txg);
 458 }
 459
 460 /*
 461  * recursively generate nvlists describing datasets.  See comment
 462  * for the data structure send_data_t above for description of contents
 463  * of the nvlist.
 464  */
 465 static int
 466 send_iterate_fs(zfs_handle_t *zhp, void *arg)
 467 {
 468         send_data_t *sd = arg;
 469         nvlist_t *nvfs = NULL, *nv = NULL;
 470         int rv = 0;
 471         uint64_t min_txg = 0, max_txg = 0;
 472         uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
 473         uint64_t fromsnap_txg_save = sd->fromsnap_txg;
 474         uint64_t tosnap_txg_save = sd->tosnap_txg;
 475         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 476         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 477         uint64_t fromsnap_txg, tosnap_txg;
 478         char guidstring[64];
 479
 480         fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
 481         if (fromsnap_txg != 0)
 482                 sd->fromsnap_txg = fromsnap_txg;
 483
 484         tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
 485         if (tosnap_txg != 0)
 486                 sd->tosnap_txg = tosnap_txg;
 487
 488         /*
 489          * on the send side, if the current dataset does not have tosnap,
 490          * perform two additional checks:
 491          *
 492          * - skip sending the current dataset if it was created later than
 493          *   the parent tosnap
 494          * - return error if the current dataset was created earlier than
 495          *   the parent tosnap
 496          */
 497         if (sd->tosnap != NULL && tosnap_txg == 0) {
 498                 if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 499                         if (sd->verbose) {
 500                                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 501                                     "skipping dataset %s: snapshot %s does "
 502                                     "not exist\n"), zhp->zfs_name, sd->tosnap);
 503                         }
 504                 } else {
 505                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 506                             "cannot send %s@%s%s: snapshot %s@%s does not "
 507                             "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
 508                             dgettext(TEXT_DOMAIN, " recursively") : "",
 509                             zhp->zfs_name, sd->tosnap);
 510                         rv = EZFS_NOENT;
 511                 }
 512                 goto out;
 513         }
 514
 515         nvfs = fnvlist_alloc();
 516         fnvlist_add_string(nvfs, "name", zhp->zfs_name);
 517         fnvlist_add_uint64(nvfs, "parentfromsnap",
 518             sd->parent_fromsnap_guid);
 519
 520         if (zhp->zfs_dmustats.dds_origin[0]) {
 521                 zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
 522                     zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
 523                 if (origin == NULL) {
 524                         rv = -1;
 525                         goto out;
 526                 }
 527                 fnvlist_add_uint64(nvfs, "origin",
 528                     origin->zfs_dmustats.dds_guid);
 529
 530                 zfs_close(origin);
 531         }
 532
 533         /* iterate over props */
 534         if (sd->props || sd->backup || sd->recursive) {
 535                 nv = fnvlist_alloc();
 536                 send_iterate_prop(zhp, sd->backup, nv);
 537         }
 538         if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
 539                 boolean_t encroot;
 540
 541                 /* determine if this dataset is an encryption root */
 542                 if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
 543                         rv = -1;
 544                         goto out;
 545                 }
 546
 547                 if (encroot)
 548                         fnvlist_add_boolean(nvfs, "is_encroot");
 549
 550                 /*
 551                  * Encrypted datasets can only be sent with properties if
 552                  * the raw flag is specified because the receive side doesn't
 553                  * currently have a mechanism for recursively asking the user
 554                  * for new encryption parameters.
 555                  */
 556                 if (!sd->raw) {
 557                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 558                             "cannot send %s@%s: encrypted dataset %s may not "
 559                             "be sent with properties without the raw flag\n"),
 560                             sd->fsname, sd->tosnap, zhp->zfs_name);
 561                         rv = -1;
 562                         goto out;
 563                 }
 564
 565         }
 566
 567         if (nv != NULL)
 568                 fnvlist_add_nvlist(nvfs, "props", nv);
 569
 570         /* iterate over snaps, and set sd->parent_fromsnap_guid */
 571         sd->parent_fromsnap_guid = 0;
 572         sd->parent_snaps = fnvlist_alloc();
 573         sd->snapprops = fnvlist_alloc();
 574         if (sd->holds)
 575                 VERIFY(0 == nvlist_alloc(&sd->snapholds, NV_UNIQUE_NAME, 0));
 576
 577
 578         /*
 579          * If this is a "doall" send, a replicate send or we're just trying
 580          * to gather a list of previous snapshots, iterate through all the
 581          * snaps in the txg range. Otherwise just look at the one we're
 582          * interested in.
 583          */
 584         if (sd->doall || sd->replicate || sd->tosnap == NULL) {
 585                 if (!sd->replicate && fromsnap_txg != 0)
 586                         min_txg = fromsnap_txg;
 587                 if (!sd->replicate && tosnap_txg != 0)
 588                         max_txg = tosnap_txg;
 589                 (void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
 590                     min_txg, max_txg);
 591         } else {
 592                 char snapname[MAXPATHLEN] = { 0 };
 593                 zfs_handle_t *snap;
 594
 595                 (void) snprintf(snapname, sizeof (snapname), "%s@%s",
 596                     zhp->zfs_name, sd->tosnap);
 597                 if (sd->fromsnap != NULL)
 598                         sd->seenfrom = B_TRUE;
 599                 snap = zfs_open(zhp->zfs_hdl, snapname,
 600                     ZFS_TYPE_SNAPSHOT);
 601                 if (snap != NULL)
 602                         (void) send_iterate_snap(snap, sd);
 603         }
 604
 605         fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
 606         fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
 607         if (sd->holds)
 608                 fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
 609         fnvlist_free(sd->parent_snaps);
 610         fnvlist_free(sd->snapprops);
 611         fnvlist_free(sd->snapholds);
 612
 613         /* Do not allow the size of the properties list to exceed the limit */
 614         if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
 615             zhp->zfs_hdl->libzfs_max_nvlist) {
 616                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 617                     "warning: cannot send %s@%s: the size of the list of "
 618                     "snapshots and properties is too large to be received "
 619                     "successfully.\n"
 620                     "Select a smaller number of snapshots to send.\n"),
 621                     zhp->zfs_name, sd->tosnap);
 622                 rv = EZFS_NOSPC;
 623                 goto out;
 624         }
 625         /* add this fs to nvlist */
 626         (void) snprintf(guidstring, sizeof (guidstring),
 627             "0x%llx", (longlong_t)guid);
 628         fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
 629
 630         /* iterate over children */
 631         if (sd->recursive)
 632                 rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
 633
 634 out:
 635         sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
 636         sd->fromsnap_txg = fromsnap_txg_save;
 637         sd->tosnap_txg = tosnap_txg_save;
 638         fnvlist_free(nv);
 639         fnvlist_free(nvfs);
 640
 641         zfs_close(zhp);
 642         return (rv);
 643 }
 644
 645 static int
 646 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
 647     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
 648     boolean_t replicate, boolean_t verbose, boolean_t backup, boolean_t holds,
 649     boolean_t props, nvlist_t **nvlp, avl_tree_t **avlp)
 650 {
 651         zfs_handle_t *zhp;
 652         send_data_t sd = { 0 };
 653         int error;
 654
 655         zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
 656         if (zhp == NULL)
 657                 return (EZFS_BADTYPE);
 658
 659         VERIFY(0 == nvlist_alloc(&sd.fss, NV_UNIQUE_NAME, 0));
 660         sd.fsname = fsname;
 661         sd.fromsnap = fromsnap;
 662         sd.tosnap = tosnap;
 663         sd.recursive = recursive;
 664         sd.raw = raw;
 665         sd.doall = doall;
 666         sd.replicate = replicate;
 667         sd.verbose = verbose;
 668         sd.backup = backup;
 669         sd.holds = holds;
 670         sd.props = props;
 671
 672         if ((error = send_iterate_fs(zhp, &sd)) != 0) {
 673                 nvlist_free(sd.fss);
 674                 if (avlp != NULL)
 675                         *avlp = NULL;
 676                 *nvlp = NULL;
 677                 return (error);
 678         }
 679
 680         if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
 681                 nvlist_free(sd.fss);
 682                 *nvlp = NULL;
 683                 return (EZFS_NOMEM);
 684         }
 685
 686         *nvlp = sd.fss;
 687         return (0);
 688 }
 689
 690 /*
 691  * Routines specific to "zfs send"
 692  */
 693 typedef struct send_dump_data {
 694         /* these are all just the short snapname (the part after the @) */
 695         const char *fromsnap;
 696         const char *tosnap;
 697         char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
 698         uint64_t prevsnap_obj;
 699         boolean_t seenfrom, seento, replicate, doall, fromorigin;
 700         boolean_t dryrun, parsable, progress, embed_data, std_out;
 701         boolean_t large_block, compress, raw, holds;
 702         int outfd;
 703         boolean_t err;
 704         nvlist_t *fss;
 705         nvlist_t *snapholds;
 706         avl_tree_t *fsavl;
 707         snapfilter_cb_t *filter_cb;
 708         void *filter_cb_arg;
 709         nvlist_t *debugnv;
 710         char holdtag[ZFS_MAX_DATASET_NAME_LEN];
 711         int cleanup_fd;
 712         int verbosity;
 713         uint64_t size;
 714 } send_dump_data_t;
 715
 716 static int
 717 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
 718     enum lzc_send_flags flags, uint64_t *spacep)
 719 {
 720         libzfs_handle_t *hdl = zhp->zfs_hdl;
 721         int error;
 722
 723         assert(snapname != NULL);
 724         error = lzc_send_space(snapname, from, flags, spacep);
 725
 726         if (error != 0) {
 727                 char errbuf[1024];
 728                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 729                     "warning: cannot estimate space for '%s'"), snapname);
 730
 731                 switch (error) {
 732                 case EXDEV:
 733                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 734                             "not an earlier snapshot from the same fs"));
 735                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 736
 737                 case ENOENT:
 738                         if (zfs_dataset_exists(hdl, snapname,
 739                             ZFS_TYPE_SNAPSHOT)) {
 740                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 741                                     "incremental source (%s) does not exist"),
 742                                     snapname);
 743                         }
 744                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
 745
 746                 case EDQUOT:
 747                 case EFBIG:
 748                 case EIO:
 749                 case ENOLINK:
 750                 case ENOSPC:
 751                 case ENOSTR:
 752                 case ENXIO:
 753                 case EPIPE:
 754                 case ERANGE:
 755                 case EFAULT:
 756                 case EROFS:
 757                 case EINVAL:
 758                         zfs_error_aux(hdl, strerror(error));
 759                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 760
 761                 default:
 762                         return (zfs_standard_error(hdl, error, errbuf));
 763                 }
 764         }
 765
 766         return (0);
 767 }
 768
 769 /*
 770  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
 771  * NULL) to the file descriptor specified by outfd.
 772  */
 773 static int
 774 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
 775     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
 776     nvlist_t *debugnv)
 777 {
 778         zfs_cmd_t zc = {"\0"};
 779         libzfs_handle_t *hdl = zhp->zfs_hdl;
 780         nvlist_t *thisdbg;
 781
 782         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 783         assert(fromsnap_obj == 0 || !fromorigin);
 784
 785         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 786         zc.zc_cookie = outfd;
 787         zc.zc_obj = fromorigin;
 788         zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
 789         zc.zc_fromobj = fromsnap_obj;
 790         zc.zc_flags = flags;
 791
 792         VERIFY(0 == nvlist_alloc(&thisdbg, NV_UNIQUE_NAME, 0));
 793         if (fromsnap && fromsnap[0] != '\0') {
 794                 VERIFY(0 == nvlist_add_string(thisdbg,
 795                     "fromsnap", fromsnap));
 796         }
 797
 798         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
 799                 char errbuf[1024];
 800                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 801                     "warning: cannot send '%s'"), zhp->zfs_name);
 802
 803                 VERIFY(0 == nvlist_add_uint64(thisdbg, "error", errno));
 804                 if (debugnv) {
 805                         VERIFY(0 == nvlist_add_nvlist(debugnv,
 806                             zhp->zfs_name, thisdbg));
 807                 }
 808                 nvlist_free(thisdbg);
 809
 810                 switch (errno) {
 811                 case EXDEV:
 812                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 813                             "not an earlier snapshot from the same fs"));
 814                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 815
 816                 case EACCES:
 817                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 818                             "source key must be loaded"));
 819                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
 820
 821                 case ENOENT:
 822                         if (zfs_dataset_exists(hdl, zc.zc_name,
 823                             ZFS_TYPE_SNAPSHOT)) {
 824                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 825                                     "incremental source (@%s) does not exist"),
 826                                     zc.zc_value);
 827                         }
 828                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
 829
 830                 case EDQUOT:
 831                 case EFBIG:
 832                 case EIO:
 833                 case ENOLINK:
 834                 case ENOSPC:
 835                 case ENOSTR:
 836                 case ENXIO:
 837                 case EPIPE:
 838                 case ERANGE:
 839                 case EFAULT:
 840                 case EROFS:
 841                         zfs_error_aux(hdl, strerror(errno));
 842                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 843
 844                 default:
 845                         return (zfs_standard_error(hdl, errno, errbuf));
 846                 }
 847         }
 848
 849         if (debugnv)
 850                 VERIFY(0 == nvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg));
 851         nvlist_free(thisdbg);
 852
 853         return (0);
 854 }
 855
 856 static void
 857 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
 858 {
 859         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 860
 861         /*
 862          * zfs_send() only sets snapholds for sends that need them,
 863          * e.g. replication and doall.
 864          */
 865         if (sdd->snapholds == NULL)
 866                 return;
 867
 868         fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
 869 }
 870
 871 int
 872 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
 873     uint64_t *blocks_visited)
 874 {
 875         zfs_cmd_t zc = {"\0"};
 876
 877         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 878         zc.zc_cookie = fd;
 879         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
 880                 return (errno);
 881         if (bytes_written != NULL)
 882                 *bytes_written = zc.zc_cookie;
 883         if (blocks_visited != NULL)
 884                 *blocks_visited = zc.zc_objset_type;
 885         return (0);
 886 }
 887
 888 static void *
 889 send_progress_thread(void *arg)
 890 {
 891         progress_arg_t *pa = arg;
 892         zfs_handle_t *zhp = pa->pa_zhp;
 893         uint64_t bytes;
 894         uint64_t blocks;
 895         char buf[16];
 896         time_t t;
 897         struct tm *tm;
 898         boolean_t firstloop = B_TRUE;
 899
 900         /*
 901          * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
 902          */
 903         for (;;) {
 904                 int err;
 905                 (void) sleep(1);
 906                 if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
 907                     &blocks)) != 0) {
 908                         if (err == EINTR || err == ENOENT)
 909                                 return ((void *)0);
 910                         return ((void *)(uintptr_t)err);
 911                 }
 912
 913                 if (firstloop && !pa->pa_parsable) {
 914                         (void) fprintf(stderr,
 915                             "TIME       %s   %sSNAPSHOT %s\n",
 916                             pa->pa_estimate ? "BYTES" : " SENT",
 917                             pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
 918                             zhp->zfs_name);
 919                         firstloop = B_FALSE;
 920                 }
 921
 922                 (void) time(&t);
 923                 tm = localtime(&t);
 924
 925                 if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
 926                         (void) fprintf(stderr,
 927                             "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
 928                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 929                             (u_longlong_t)bytes, (u_longlong_t)blocks,
 930                             zhp->zfs_name);
 931                 } else if (pa->pa_verbosity >= 2) {
 932                         zfs_nicenum(bytes, buf, sizeof (buf));
 933                         (void) fprintf(stderr,
 934                             "%02d:%02d:%02d   %5s    %8llu    %s\n",
 935                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 936                             buf, (u_longlong_t)blocks, zhp->zfs_name);
 937                 } else if (pa->pa_parsable) {
 938                         (void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
 939                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 940                             (u_longlong_t)bytes, zhp->zfs_name);
 941                 } else {
 942                         zfs_nicebytes(bytes, buf, sizeof (buf));
 943                         (void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
 944                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 945                             buf, zhp->zfs_name);
 946                 }
 947         }
 948 }
 949
 950 static void
 951 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
 952     uint64_t size, boolean_t parsable)
 953 {
 954         if (parsable) {
 955                 if (fromsnap != NULL) {
 956                         (void) fprintf(fout, "incremental\t%s\t%s",
 957                             fromsnap, tosnap);
 958                 } else {
 959                         (void) fprintf(fout, "full\t%s",
 960                             tosnap);
 961                 }
 962         } else {
 963                 if (fromsnap != NULL) {
 964                         if (strchr(fromsnap, '@') == NULL &&
 965                             strchr(fromsnap, '#') == NULL) {
 966                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 967                                     "send from @%s to %s"),
 968                                     fromsnap, tosnap);
 969                         } else {
 970                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 971                                     "send from %s to %s"),
 972                                     fromsnap, tosnap);
 973                         }
 974                 } else {
 975                         (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 976                             "full send of %s"),
 977                             tosnap);
 978                 }
 979         }
 980
 981         if (parsable) {
 982                 (void) fprintf(fout, "\t%llu",
 983                     (longlong_t)size);
 984         } else if (size != 0) {
 985                 char buf[16];
 986                 zfs_nicebytes(size, buf, sizeof (buf));
 987                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 988                     " estimated size is %s"), buf);
 989         }
 990         (void) fprintf(fout, "\n");
 991 }
 992
 993 static int
 994 dump_snapshot(zfs_handle_t *zhp, void *arg)
 995 {
 996         send_dump_data_t *sdd = arg;
 997         progress_arg_t pa = { 0 };
 998         pthread_t tid;
 999         char *thissnap;
1000         enum lzc_send_flags flags = 0;
1001         int err;
1002         boolean_t isfromsnap, istosnap, fromorigin;
1003         boolean_t exclude = B_FALSE;
1004         FILE *fout = sdd->std_out ? stdout : stderr;
1005
1006         err = 0;
1007         thissnap = strchr(zhp->zfs_name, '@') + 1;
1008         isfromsnap = (sdd->fromsnap != NULL &&
1009             strcmp(sdd->fromsnap, thissnap) == 0);
1010
1011         if (!sdd->seenfrom && isfromsnap) {
1012                 gather_holds(zhp, sdd);
1013                 sdd->seenfrom = B_TRUE;
1014                 (void) strlcpy(sdd->prevsnap, thissnap,
1015                     sizeof (sdd->prevsnap));
1016                 sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1017                 zfs_close(zhp);
1018                 return (0);
1019         }
1020
1021         if (sdd->seento || !sdd->seenfrom) {
1022                 zfs_close(zhp);
1023                 return (0);
1024         }
1025
1026         istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1027         if (istosnap)
1028                 sdd->seento = B_TRUE;
1029
1030         if (sdd->large_block)
1031                 flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1032         if (sdd->embed_data)
1033                 flags |= LZC_SEND_FLAG_EMBED_DATA;
1034         if (sdd->compress)
1035                 flags |= LZC_SEND_FLAG_COMPRESS;
1036         if (sdd->raw)
1037                 flags |= LZC_SEND_FLAG_RAW;
1038
1039         if (!sdd->doall && !isfromsnap && !istosnap) {
1040                 if (sdd->replicate) {
1041                         char *snapname;
1042                         nvlist_t *snapprops;
1043                         /*
1044                          * Filter out all intermediate snapshots except origin
1045                          * snapshots needed to replicate clones.
1046                          */
1047                         nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1048                             zhp->zfs_dmustats.dds_guid, &snapname);
1049
1050                         VERIFY(0 == nvlist_lookup_nvlist(nvfs,
1051                             "snapprops", &snapprops));
1052                         VERIFY(0 == nvlist_lookup_nvlist(snapprops,
1053                             thissnap, &snapprops));
1054                         exclude = !nvlist_exists(snapprops, "is_clone_origin");
1055                 } else {
1056                         exclude = B_TRUE;
1057                 }
1058         }
1059
1060         /*
1061          * If a filter function exists, call it to determine whether
1062          * this snapshot will be sent.
1063          */
1064         if (exclude || (sdd->filter_cb != NULL &&
1065             sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1066                 /*
1067                  * This snapshot is filtered out.  Don't send it, and don't
1068                  * set prevsnap_obj, so it will be as if this snapshot didn't
1069                  * exist, and the next accepted snapshot will be sent as
1070                  * an incremental from the last accepted one, or as the
1071                  * first (and full) snapshot in the case of a replication,
1072                  * non-incremental send.
1073                  */
1074                 zfs_close(zhp);
1075                 return (0);
1076         }
1077
1078         gather_holds(zhp, sdd);
1079         fromorigin = sdd->prevsnap[0] == '\0' &&
1080             (sdd->fromorigin || sdd->replicate);
1081
1082         if (sdd->verbosity != 0) {
1083                 uint64_t size = 0;
1084                 char fromds[ZFS_MAX_DATASET_NAME_LEN];
1085
1086                 if (sdd->prevsnap[0] != '\0') {
1087                         (void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1088                         *(strchr(fromds, '@') + 1) = '\0';
1089                         (void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1090                 }
1091                 if (zfs_send_space(zhp, zhp->zfs_name,
1092                     sdd->prevsnap[0] ? fromds : NULL, flags, &size) != 0) {
1093                         size = 0; /* cannot estimate send space */
1094                 } else {
1095                         send_print_verbose(fout, zhp->zfs_name,
1096                             sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1097                             size, sdd->parsable);
1098                 }
1099                 sdd->size += size;
1100         }
1101
1102         if (!sdd->dryrun) {
1103                 /*
1104                  * If progress reporting is requested, spawn a new thread to
1105                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1106                  */
1107                 if (sdd->progress) {
1108                         pa.pa_zhp = zhp;
1109                         pa.pa_fd = sdd->outfd;
1110                         pa.pa_parsable = sdd->parsable;
1111                         pa.pa_estimate = B_FALSE;
1112                         pa.pa_verbosity = sdd->verbosity;
1113
1114                         if ((err = pthread_create(&tid, NULL,
1115                             send_progress_thread, &pa)) != 0) {
1116                                 zfs_close(zhp);
1117                                 return (err);
1118                         }
1119                 }
1120
1121                 err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1122                     fromorigin, sdd->outfd, flags, sdd->debugnv);
1123
1124                 if (sdd->progress) {
1125                         void *status = NULL;
1126                         (void) pthread_cancel(tid);
1127                         (void) pthread_join(tid, &status);
1128                         int error = (int)(uintptr_t)status;
1129                         if (error != 0 && status != PTHREAD_CANCELED) {
1130                                 char errbuf[1024];
1131                                 (void) snprintf(errbuf, sizeof (errbuf),
1132                                     dgettext(TEXT_DOMAIN,
1133                                     "progress thread exited nonzero"));
1134                                 return (zfs_standard_error(zhp->zfs_hdl, error,
1135                                     errbuf));
1136                         }
1137                 }
1138         }
1139
1140         (void) strcpy(sdd->prevsnap, thissnap);
1141         sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1142         zfs_close(zhp);
1143         return (err);
1144 }
1145
1146 static int
1147 dump_filesystem(zfs_handle_t *zhp, void *arg)
1148 {
1149         int rv = 0;
1150         send_dump_data_t *sdd = arg;
1151         boolean_t missingfrom = B_FALSE;
1152         zfs_cmd_t zc = {"\0"};
1153         uint64_t min_txg = 0, max_txg = 0;
1154
1155         (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1156             zhp->zfs_name, sdd->tosnap);
1157         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1158                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1159                     "WARNING: could not send %s@%s: does not exist\n"),
1160                     zhp->zfs_name, sdd->tosnap);
1161                 sdd->err = B_TRUE;
1162                 return (0);
1163         }
1164
1165         if (sdd->replicate && sdd->fromsnap) {
1166                 /*
1167                  * If this fs does not have fromsnap, and we're doing
1168                  * recursive, we need to send a full stream from the
1169                  * beginning (or an incremental from the origin if this
1170                  * is a clone).  If we're doing non-recursive, then let
1171                  * them get the error.
1172                  */
1173                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1174                     zhp->zfs_name, sdd->fromsnap);
1175                 if (zfs_ioctl(zhp->zfs_hdl,
1176                     ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1177                         missingfrom = B_TRUE;
1178                 }
1179         }
1180
1181         sdd->seenfrom = sdd->seento = sdd->prevsnap[0] = 0;
1182         sdd->prevsnap_obj = 0;
1183         if (sdd->fromsnap == NULL || missingfrom)
1184                 sdd->seenfrom = B_TRUE;
1185
1186
1187
1188         /*
1189          * Iterate through all snapshots and process the ones we will be
1190          * sending. If we only have a "from" and "to" snapshot to deal
1191          * with, we can avoid iterating through all the other snapshots.
1192          */
1193         if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1194                 if (!sdd->replicate && sdd->fromsnap != NULL)
1195                         min_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1196                             sdd->fromsnap);
1197                 if (!sdd->replicate && sdd->tosnap != NULL)
1198                         max_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1199                             sdd->tosnap);
1200                 rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, arg,
1201                     min_txg, max_txg);
1202         } else {
1203                 char snapname[MAXPATHLEN] = { 0 };
1204                 zfs_handle_t *snap;
1205
1206                 if (!sdd->seenfrom) {
1207                         (void) snprintf(snapname, sizeof (snapname),
1208                             "%s@%s", zhp->zfs_name, sdd->fromsnap);
1209                         snap = zfs_open(zhp->zfs_hdl, snapname,
1210                             ZFS_TYPE_SNAPSHOT);
1211                         if (snap != NULL)
1212                                 rv = dump_snapshot(snap, sdd);
1213                         else
1214                                 rv = -1;
1215                 }
1216
1217                 if (rv == 0) {
1218                         (void) snprintf(snapname, sizeof (snapname),
1219                             "%s@%s", zhp->zfs_name, sdd->tosnap);
1220                         snap = zfs_open(zhp->zfs_hdl, snapname,
1221                             ZFS_TYPE_SNAPSHOT);
1222                         if (snap != NULL)
1223                                 rv = dump_snapshot(snap, sdd);
1224                         else
1225                                 rv = -1;
1226                 }
1227         }
1228
1229         if (!sdd->seenfrom) {
1230                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1231                     "WARNING: could not send %s@%s:\n"
1232                     "incremental source (%s@%s) does not exist\n"),
1233                     zhp->zfs_name, sdd->tosnap,
1234                     zhp->zfs_name, sdd->fromsnap);
1235                 sdd->err = B_TRUE;
1236         } else if (!sdd->seento) {
1237                 if (sdd->fromsnap) {
1238                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1239                             "WARNING: could not send %s@%s:\n"
1240                             "incremental source (%s@%s) "
1241                             "is not earlier than it\n"),
1242                             zhp->zfs_name, sdd->tosnap,
1243                             zhp->zfs_name, sdd->fromsnap);
1244                 } else {
1245                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1246                             "WARNING: "
1247                             "could not send %s@%s: does not exist\n"),
1248                             zhp->zfs_name, sdd->tosnap);
1249                 }
1250                 sdd->err = B_TRUE;
1251         }
1252
1253         return (rv);
1254 }
1255
1256 static int
1257 dump_filesystems(zfs_handle_t *rzhp, void *arg)
1258 {
1259         send_dump_data_t *sdd = arg;
1260         nvpair_t *fspair;
1261         boolean_t needagain, progress;
1262
1263         if (!sdd->replicate)
1264                 return (dump_filesystem(rzhp, sdd));
1265
1266         /* Mark the clone origin snapshots. */
1267         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1268             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1269                 nvlist_t *nvfs;
1270                 uint64_t origin_guid = 0;
1271
1272                 VERIFY(0 == nvpair_value_nvlist(fspair, &nvfs));
1273                 (void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1274                 if (origin_guid != 0) {
1275                         char *snapname;
1276                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1277                             origin_guid, &snapname);
1278                         if (origin_nv != NULL) {
1279                                 nvlist_t *snapprops;
1280                                 VERIFY(0 == nvlist_lookup_nvlist(origin_nv,
1281                                     "snapprops", &snapprops));
1282                                 VERIFY(0 == nvlist_lookup_nvlist(snapprops,
1283                                     snapname, &snapprops));
1284                                 VERIFY(0 == nvlist_add_boolean(
1285                                     snapprops, "is_clone_origin"));
1286                         }
1287                 }
1288         }
1289 again:
1290         needagain = progress = B_FALSE;
1291         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1292             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1293                 nvlist_t *fslist, *parent_nv;
1294                 char *fsname;
1295                 zfs_handle_t *zhp;
1296                 int err;
1297                 uint64_t origin_guid = 0;
1298                 uint64_t parent_guid = 0;
1299
1300                 VERIFY(nvpair_value_nvlist(fspair, &fslist) == 0);
1301                 if (nvlist_lookup_boolean(fslist, "sent") == 0)
1302                         continue;
1303
1304                 VERIFY(nvlist_lookup_string(fslist, "name", &fsname) == 0);
1305                 (void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1306                 (void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1307                     &parent_guid);
1308
1309                 if (parent_guid != 0) {
1310                         parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1311                         if (!nvlist_exists(parent_nv, "sent")) {
1312                                 /* parent has not been sent; skip this one */
1313                                 needagain = B_TRUE;
1314                                 continue;
1315                         }
1316                 }
1317
1318                 if (origin_guid != 0) {
1319                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1320                             origin_guid, NULL);
1321                         if (origin_nv != NULL &&
1322                             !nvlist_exists(origin_nv, "sent")) {
1323                                 /*
1324                                  * origin has not been sent yet;
1325                                  * skip this clone.
1326                                  */
1327                                 needagain = B_TRUE;
1328                                 continue;
1329                         }
1330                 }
1331
1332                 zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1333                 if (zhp == NULL)
1334                         return (-1);
1335                 err = dump_filesystem(zhp, sdd);
1336                 VERIFY(nvlist_add_boolean(fslist, "sent") == 0);
1337                 progress = B_TRUE;
1338                 zfs_close(zhp);
1339                 if (err)
1340                         return (err);
1341         }
1342         if (needagain) {
1343                 assert(progress);
1344                 goto again;
1345         }
1346
1347         /* clean out the sent flags in case we reuse this fss */
1348         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1349             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1350                 nvlist_t *fslist;
1351
1352                 VERIFY(nvpair_value_nvlist(fspair, &fslist) == 0);
1353                 (void) nvlist_remove_all(fslist, "sent");
1354         }
1355
1356         return (0);
1357 }
1358
1359 nvlist_t *
1360 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1361 {
1362         unsigned int version;
1363         int nread, i;
1364         unsigned long long checksum, packed_len;
1365
1366         /*
1367          * Decode token header, which is:
1368          *   <token version>-<checksum of payload>-<uncompressed payload length>
1369          * Note that the only supported token version is 1.
1370          */
1371         nread = sscanf(token, "%u-%llx-%llx-",
1372             &version, &checksum, &packed_len);
1373         if (nread != 3) {
1374                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1375                     "resume token is corrupt (invalid format)"));
1376                 return (NULL);
1377         }
1378
1379         if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1380                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1381                     "resume token is corrupt (invalid version %u)"),
1382                     version);
1383                 return (NULL);
1384         }
1385
1386         /* convert hexadecimal representation to binary */
1387         token = strrchr(token, '-') + 1;
1388         int len = strlen(token) / 2;
1389         unsigned char *compressed = zfs_alloc(hdl, len);
1390         for (i = 0; i < len; i++) {
1391                 nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1392                 if (nread != 1) {
1393                         free(compressed);
1394                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1395                             "resume token is corrupt "
1396                             "(payload is not hex-encoded)"));
1397                         return (NULL);
1398                 }
1399         }
1400
1401         /* verify checksum */
1402         zio_cksum_t cksum;
1403         fletcher_4_native_varsize(compressed, len, &cksum);
1404         if (cksum.zc_word[0] != checksum) {
1405                 free(compressed);
1406                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1407                     "resume token is corrupt (incorrect checksum)"));
1408                 return (NULL);
1409         }
1410
1411         /* uncompress */
1412         void *packed = zfs_alloc(hdl, packed_len);
1413         uLongf packed_len_long = packed_len;
1414         if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1415             packed_len_long != packed_len) {
1416                 free(packed);
1417                 free(compressed);
1418                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1419                     "resume token is corrupt (decompression failed)"));
1420                 return (NULL);
1421         }
1422
1423         /* unpack nvlist */
1424         nvlist_t *nv;
1425         int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1426         free(packed);
1427         free(compressed);
1428         if (error != 0) {
1429                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1430                     "resume token is corrupt (nvlist_unpack failed)"));
1431                 return (NULL);
1432         }
1433         return (nv);
1434 }
1435 static enum lzc_send_flags
1436 lzc_flags_from_sendflags(const sendflags_t *flags)
1437 {
1438         enum lzc_send_flags lzc_flags = 0;
1439         if (flags->largeblock)
1440                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1441         if (flags->embed_data)
1442                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1443         if (flags->compress)
1444                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1445         if (flags->raw)
1446                 lzc_flags |= LZC_SEND_FLAG_RAW;
1447         if (flags->saved)
1448                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1449         return (lzc_flags);
1450 }
1451
1452 static int
1453 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1454     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1455     const char *redactbook, char *errbuf)
1456 {
1457         uint64_t size;
1458         FILE *fout = flags->dryrun ? stdout : stderr;
1459         progress_arg_t pa = { 0 };
1460         int err = 0;
1461         pthread_t ptid;
1462
1463         if (flags->progress) {
1464                 pa.pa_zhp = zhp;
1465                 pa.pa_fd = fd;
1466                 pa.pa_parsable = flags->parsable;
1467                 pa.pa_estimate = B_TRUE;
1468                 pa.pa_verbosity = flags->verbosity;
1469
1470                 err = pthread_create(&ptid, NULL,
1471                     send_progress_thread, &pa);
1472                 if (err != 0) {
1473                         zfs_error_aux(zhp->zfs_hdl, strerror(errno));
1474                         return (zfs_error(zhp->zfs_hdl,
1475                             EZFS_THREADCREATEFAILED, errbuf));
1476                 }
1477         }
1478
1479         err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1480             lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1481             redactbook, fd, &size);
1482
1483         if (flags->progress) {
1484                 void *status = NULL;
1485                 (void) pthread_cancel(ptid);
1486                 (void) pthread_join(ptid, &status);
1487                 int error = (int)(uintptr_t)status;
1488                 if (error != 0 && status != PTHREAD_CANCELED) {
1489                         char errbuf[1024];
1490                         (void) snprintf(errbuf, sizeof (errbuf),
1491                             dgettext(TEXT_DOMAIN, "progress thread exited "
1492                             "nonzero"));
1493                         return (zfs_standard_error(zhp->zfs_hdl, error,
1494                             errbuf));
1495                 }
1496         }
1497
1498         if (err != 0) {
1499                 zfs_error_aux(zhp->zfs_hdl, strerror(err));
1500                 return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1501                     errbuf));
1502         }
1503         send_print_verbose(fout, zhp->zfs_name, from, size,
1504             flags->parsable);
1505
1506         if (flags->parsable) {
1507                 (void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1508         } else {
1509                 char buf[16];
1510                 zfs_nicenum(size, buf, sizeof (buf));
1511                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1512                     "total estimated size is %s\n"), buf);
1513         }
1514         return (0);
1515 }
1516
1517 static boolean_t
1518 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1519 {
1520         for (int i = 0; i < num_snaps; i++) {
1521                 if (snaps[i] == guid)
1522                         return (B_TRUE);
1523         }
1524         return (B_FALSE);
1525 }
1526
1527 static boolean_t
1528 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1529     const uint64_t *snaps2, uint64_t num_snaps2)
1530 {
1531         if (num_snaps1 != num_snaps2)
1532                 return (B_FALSE);
1533         for (int i = 0; i < num_snaps1; i++) {
1534                 if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1535                         return (B_FALSE);
1536         }
1537         return (B_TRUE);
1538 }
1539
1540 /*
1541  * Check that the list of redaction snapshots in the bookmark matches the send
1542  * we're resuming, and return whether or not it's complete.
1543  *
1544  * Note that the caller needs to free the contents of *bookname with free() if
1545  * this function returns successfully.
1546  */
1547 static int
1548 find_redact_book(libzfs_handle_t *hdl, const char *path,
1549     const uint64_t *redact_snap_guids, int num_redact_snaps,
1550     char **bookname)
1551 {
1552         char errbuf[1024];
1553         int error = 0;
1554         nvlist_t *props = fnvlist_alloc();
1555         nvlist_t *bmarks;
1556
1557         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1558             "cannot resume send"));
1559
1560         fnvlist_add_boolean(props, "redact_complete");
1561         fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1562         error = lzc_get_bookmarks(path, props, &bmarks);
1563         nvlist_free(props);
1564         if (error != 0) {
1565                 if (error == ESRCH) {
1566                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1567                             "nonexistent redaction bookmark provided"));
1568                 } else if (error == ENOENT) {
1569                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1570                             "dataset to be sent no longer exists"));
1571                 } else {
1572                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1573                             "unknown error: %s"), strerror(error));
1574                 }
1575                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1576         }
1577         nvpair_t *pair;
1578         for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1579             pair = nvlist_next_nvpair(bmarks, pair)) {
1580
1581                 nvlist_t *bmark = fnvpair_value_nvlist(pair);
1582                 nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1583                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1584                 uint_t len = 0;
1585                 uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1586                     ZPROP_VALUE, &len);
1587                 if (redact_snaps_equal(redact_snap_guids,
1588                     num_redact_snaps, bmarksnaps, len)) {
1589                         break;
1590                 }
1591         }
1592         if (pair == NULL)  {
1593                 fnvlist_free(bmarks);
1594                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1595                     "no appropriate redaction bookmark exists"));
1596                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1597         }
1598         char *name = nvpair_name(pair);
1599         nvlist_t *bmark = fnvpair_value_nvlist(pair);
1600         nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1601         boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1602             ZPROP_VALUE);
1603         if (!complete) {
1604                 fnvlist_free(bmarks);
1605                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1606                     "incomplete redaction bookmark provided"));
1607                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1608         }
1609         *bookname = strndup(name, ZFS_MAX_DATASET_NAME_LEN);
1610         ASSERT3P(*bookname, !=, NULL);
1611         fnvlist_free(bmarks);
1612         return (0);
1613 }
1614
1615 static int
1616 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1617     nvlist_t *resume_nvl)
1618 {
1619         char errbuf[1024];
1620         char *toname;
1621         char *fromname = NULL;
1622         uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1623         zfs_handle_t *zhp;
1624         int error = 0;
1625         char name[ZFS_MAX_DATASET_NAME_LEN];
1626         enum lzc_send_flags lzc_flags = 0;
1627         FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1628         uint64_t *redact_snap_guids = NULL;
1629         int num_redact_snaps = 0;
1630         char *redact_book = NULL;
1631
1632         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1633             "cannot resume send"));
1634
1635         if (flags->verbosity != 0) {
1636                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1637                     "resume token contents:\n"));
1638                 nvlist_print(fout, resume_nvl);
1639         }
1640
1641         if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1642             nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1643             nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1644             nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1645             nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1646                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1647                     "resume token is corrupt"));
1648                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1649         }
1650         fromguid = 0;
1651         (void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1652
1653         if (flags->largeblock || nvlist_exists(resume_nvl, "largeblockok"))
1654                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1655         if (flags->embed_data || nvlist_exists(resume_nvl, "embedok"))
1656                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1657         if (flags->compress || nvlist_exists(resume_nvl, "compressok"))
1658                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1659         if (flags->raw || nvlist_exists(resume_nvl, "rawok"))
1660                 lzc_flags |= LZC_SEND_FLAG_RAW;
1661         if (flags->saved || nvlist_exists(resume_nvl, "savedok"))
1662                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1663
1664         if (flags->saved) {
1665                 (void) strcpy(name, toname);
1666         } else {
1667                 error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1668                 if (error != 0) {
1669                         if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1670                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1671                                     "'%s' is no longer the same snapshot "
1672                                     "used in the initial send"), toname);
1673                         } else {
1674                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1675                                     "'%s' used in the initial send no "
1676                                     "longer exists"), toname);
1677                         }
1678                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1679                 }
1680         }
1681
1682         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1683         if (zhp == NULL) {
1684                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1685                     "unable to access '%s'"), name);
1686                 return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1687         }
1688
1689         if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1690             &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1691                 num_redact_snaps = -1;
1692         }
1693
1694         if (fromguid != 0) {
1695                 if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1696                     redact_snap_guids, num_redact_snaps, name) != 0) {
1697                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1698                             "incremental source %#llx no longer exists"),
1699                             (longlong_t)fromguid);
1700                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1701                 }
1702                 fromname = name;
1703         }
1704
1705         redact_snap_guids = NULL;
1706
1707         if (nvlist_lookup_uint64_array(resume_nvl,
1708             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1709             (uint_t *)&num_redact_snaps) == 0) {
1710                 char path[ZFS_MAX_DATASET_NAME_LEN];
1711
1712                 (void) strlcpy(path, toname, sizeof (path));
1713                 char *at = strchr(path, '@');
1714                 ASSERT3P(at, !=, NULL);
1715
1716                 *at = '\0';
1717
1718                 if ((error = find_redact_book(hdl, path, redact_snap_guids,
1719                     num_redact_snaps, &redact_book)) != 0) {
1720                         return (error);
1721                 }
1722         }
1723
1724         if (flags->verbosity != 0) {
1725                 /*
1726                  * Some of these may have come from the resume token, set them
1727                  * here for size estimate purposes.
1728                  */
1729                 sendflags_t tmpflags = *flags;
1730                 if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1731                         tmpflags.largeblock = B_TRUE;
1732                 if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1733                         tmpflags.compress = B_TRUE;
1734                 if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1735                         tmpflags.embed_data = B_TRUE;
1736                 error = estimate_size(zhp, fromname, outfd, &tmpflags,
1737                     resumeobj, resumeoff, bytes, redact_book, errbuf);
1738         }
1739
1740         if (!flags->dryrun) {
1741                 progress_arg_t pa = { 0 };
1742                 pthread_t tid;
1743                 /*
1744                  * If progress reporting is requested, spawn a new thread to
1745                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1746                  */
1747                 if (flags->progress) {
1748                         pa.pa_zhp = zhp;
1749                         pa.pa_fd = outfd;
1750                         pa.pa_parsable = flags->parsable;
1751                         pa.pa_estimate = B_FALSE;
1752                         pa.pa_verbosity = flags->verbosity;
1753
1754                         error = pthread_create(&tid, NULL,
1755                             send_progress_thread, &pa);
1756                         if (error != 0) {
1757                                 if (redact_book != NULL)
1758                                         free(redact_book);
1759                                 zfs_close(zhp);
1760                                 return (error);
1761                         }
1762                 }
1763
1764                 error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1765                     lzc_flags, resumeobj, resumeoff, redact_book);
1766                 if (redact_book != NULL)
1767                         free(redact_book);
1768
1769                 if (flags->progress) {
1770                         void *status = NULL;
1771                         (void) pthread_cancel(tid);
1772                         (void) pthread_join(tid, &status);
1773                         int error = (int)(uintptr_t)status;
1774                         if (error != 0 && status != PTHREAD_CANCELED) {
1775                                 char errbuf[1024];
1776                                 (void) snprintf(errbuf, sizeof (errbuf),
1777                                     dgettext(TEXT_DOMAIN,
1778                                     "progress thread exited nonzero"));
1779                                 return (zfs_standard_error(hdl, error, errbuf));
1780                         }
1781                 }
1782
1783                 char errbuf[1024];
1784                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1785                     "warning: cannot send '%s'"), zhp->zfs_name);
1786
1787                 zfs_close(zhp);
1788
1789                 switch (error) {
1790                 case 0:
1791                         return (0);
1792                 case EACCES:
1793                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1794                             "source key must be loaded"));
1795                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1796                 case ESRCH:
1797                         if (lzc_exists(zhp->zfs_name)) {
1798                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1799                                     "incremental source could not be found"));
1800                         }
1801                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
1802
1803                 case EXDEV:
1804                 case ENOENT:
1805                 case EDQUOT:
1806                 case EFBIG:
1807                 case EIO:
1808                 case ENOLINK:
1809                 case ENOSPC:
1810                 case ENOSTR:
1811                 case ENXIO:
1812                 case EPIPE:
1813                 case ERANGE:
1814                 case EFAULT:
1815                 case EROFS:
1816                         zfs_error_aux(hdl, strerror(errno));
1817                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1818
1819                 default:
1820                         return (zfs_standard_error(hdl, errno, errbuf));
1821                 }
1822         } else {
1823                 if (redact_book != NULL)
1824                         free(redact_book);
1825         }
1826
1827         zfs_close(zhp);
1828
1829         return (error);
1830 }
1831
1832 int
1833 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1834     const char *resume_token)
1835 {
1836         int ret;
1837         char errbuf[1024];
1838         nvlist_t *resume_nvl;
1839
1840         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1841             "cannot resume send"));
1842
1843         resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1844         if (resume_nvl == NULL) {
1845                 /*
1846                  * zfs_error_aux has already been set by
1847                  * zfs_send_resume_token_to_nvlist()
1848                  */
1849                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1850         }
1851
1852         ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1853         nvlist_free(resume_nvl);
1854
1855         return (ret);
1856 }
1857
1858 int
1859 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1860     const char *resume_token)
1861 {
1862         int ret;
1863         libzfs_handle_t *hdl = zhp->zfs_hdl;
1864         nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1865         uint64_t saved_guid = 0, resume_guid = 0;
1866         uint64_t obj = 0, off = 0, bytes = 0;
1867         char token_buf[ZFS_MAXPROPLEN];
1868         char errbuf[1024];
1869
1870         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1871             "saved send failed"));
1872
1873         ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1874             token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1875         if (ret != 0)
1876                 goto out;
1877
1878         saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1879         if (saved_nvl == NULL) {
1880                 /*
1881                  * zfs_error_aux has already been set by
1882                  * zfs_send_resume_token_to_nvlist()
1883                  */
1884                 ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1885                 goto out;
1886         }
1887
1888         /*
1889          * If a resume token is provided we use the object and offset
1890          * from that instead of the default, which starts from the
1891          * beginning.
1892          */
1893         if (resume_token != NULL) {
1894                 resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1895                     resume_token);
1896                 if (resume_nvl == NULL) {
1897                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1898                         goto out;
1899                 }
1900
1901                 if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1902                     nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1903                     nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1904                     nvlist_lookup_uint64(resume_nvl, "toguid",
1905                     &resume_guid) != 0) {
1906                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1907                             "provided resume token is corrupt"));
1908                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1909                         goto out;
1910                 }
1911
1912                 if (nvlist_lookup_uint64(saved_nvl, "toguid",
1913                     &saved_guid)) {
1914                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1915                             "dataset's resume token is corrupt"));
1916                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1917                         goto out;
1918                 }
1919
1920                 if (resume_guid != saved_guid) {
1921                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1922                             "provided resume token does not match dataset"));
1923                         ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
1924                         goto out;
1925                 }
1926         }
1927
1928         (void) nvlist_remove_all(saved_nvl, "object");
1929         fnvlist_add_uint64(saved_nvl, "object", obj);
1930
1931         (void) nvlist_remove_all(saved_nvl, "offset");
1932         fnvlist_add_uint64(saved_nvl, "offset", off);
1933
1934         (void) nvlist_remove_all(saved_nvl, "bytes");
1935         fnvlist_add_uint64(saved_nvl, "bytes", bytes);
1936
1937         (void) nvlist_remove_all(saved_nvl, "toname");
1938         fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
1939
1940         ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
1941
1942 out:
1943         nvlist_free(saved_nvl);
1944         nvlist_free(resume_nvl);
1945         return (ret);
1946 }
1947
1948 /*
1949  * This function informs the target system that the recursive send is complete.
1950  * The record is also expected in the case of a send -p.
1951  */
1952 static int
1953 send_conclusion_record(int fd, zio_cksum_t *zc)
1954 {
1955         dmu_replay_record_t drr = { 0 };
1956         drr.drr_type = DRR_END;
1957         if (zc != NULL)
1958                 drr.drr_u.drr_end.drr_checksum = *zc;
1959         if (write(fd, &drr, sizeof (drr)) == -1) {
1960                 return (errno);
1961         }
1962         return (0);
1963 }
1964
1965 /*
1966  * This function is responsible for sending the records that contain the
1967  * necessary information for the target system's libzfs to be able to set the
1968  * properties of the filesystem being received, or to be able to prepare for
1969  * a recursive receive.
1970  *
1971  * The "zhp" argument is the handle of the snapshot we are sending
1972  * (the "tosnap").  The "from" argument is the short snapshot name (the part
1973  * after the @) of the incremental source.
1974  */
1975 static int
1976 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
1977     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
1978     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t backup,
1979     boolean_t holds, boolean_t props, boolean_t doall,
1980     nvlist_t **fssp, avl_tree_t **fsavlp)
1981 {
1982         int err = 0;
1983         char *packbuf = NULL;
1984         size_t buflen = 0;
1985         zio_cksum_t zc = { {0} };
1986         int featureflags = 0;
1987         /* name of filesystem/volume that contains snapshot we are sending */
1988         char tofs[ZFS_MAX_DATASET_NAME_LEN];
1989         /* short name of snap we are sending */
1990         char *tosnap = "";
1991
1992         char errbuf[1024];
1993         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1994             "warning: cannot send '%s'"), zhp->zfs_name);
1995         if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
1996             ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
1997                 featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
1998         }
1999
2000         if (holds)
2001                 featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2002
2003         (void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2004         char *at = strchr(tofs, '@');
2005         if (at != NULL) {
2006                 *at = '\0';
2007                 tosnap = at + 1;
2008         }
2009
2010         if (gather_props) {
2011                 nvlist_t *hdrnv = fnvlist_alloc();
2012                 nvlist_t *fss = NULL;
2013
2014                 if (from != NULL)
2015                         fnvlist_add_string(hdrnv, "fromsnap", from);
2016                 fnvlist_add_string(hdrnv, "tosnap", tosnap);
2017                 if (!recursive)
2018                         fnvlist_add_boolean(hdrnv, "not_recursive");
2019
2020                 if (raw) {
2021                         VERIFY0(nvlist_add_boolean(hdrnv, "raw"));
2022                 }
2023
2024                 if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2025                     from, tosnap, recursive, raw, doall, replicate, verbose,
2026                     backup, holds, props, &fss, fsavlp)) != 0) {
2027                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2028                             errbuf));
2029                 }
2030                 /*
2031                  * Do not allow the size of the properties list to exceed
2032                  * the limit
2033                  */
2034                 if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2035                     zhp->zfs_hdl->libzfs_max_nvlist) {
2036                         (void) snprintf(errbuf, sizeof (errbuf),
2037                             dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2038                             "the size of the list of snapshots and properties "
2039                             "is too large to be received successfully.\n"
2040                             "Select a smaller number of snapshots to send.\n"),
2041                             zhp->zfs_name);
2042                         return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2043                             errbuf));
2044                 }
2045                 fnvlist_add_nvlist(hdrnv, "fss", fss);
2046                 VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2047                     0));
2048                 if (fssp != NULL) {
2049                         *fssp = fss;
2050                 } else {
2051                         nvlist_free(fss);
2052                 }
2053                 nvlist_free(hdrnv);
2054         }
2055
2056         if (!dryrun) {
2057                 dmu_replay_record_t drr = { 0 };
2058                 /* write first begin record */
2059                 drr.drr_type = DRR_BEGIN;
2060                 drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2061                 DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2062                     drr_versioninfo, DMU_COMPOUNDSTREAM);
2063                 DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2064                     drr_versioninfo, featureflags);
2065                 if (snprintf(drr.drr_u.drr_begin.drr_toname,
2066                     sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2067                     tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2068                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2069                             errbuf));
2070                 }
2071                 drr.drr_payloadlen = buflen;
2072
2073                 err = dump_record(&drr, packbuf, buflen, &zc, fd);
2074                 free(packbuf);
2075                 if (err != 0) {
2076                         zfs_error_aux(zhp->zfs_hdl, strerror(err));
2077                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2078                             errbuf));
2079                 }
2080                 err = send_conclusion_record(fd, &zc);
2081                 if (err != 0) {
2082                         zfs_error_aux(zhp->zfs_hdl, strerror(err));
2083                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2084                             errbuf));
2085                 }
2086         }
2087         return (0);
2088 }
2089
2090 /*
2091  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2092  * that contains the snapshot to send.  The "fromsnap" argument is the
2093  * short name (the part after the '@') of the snapshot that is the
2094  * incremental source to send from (if non-NULL).  The "tosnap" argument
2095  * is the short name of the snapshot to send.
2096  *
2097  * The content of the send stream is the snapshot identified by
2098  * 'tosnap'.  Incremental streams are requested in two ways:
2099  *     - from the snapshot identified by "fromsnap" (if non-null) or
2100  *     - from the origin of the dataset identified by zhp, which must
2101  *       be a clone.  In this case, "fromsnap" is null and "fromorigin"
2102  *       is TRUE.
2103  *
2104  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2105  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2106  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2107  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2108  * case too. If "props" is set, send properties.
2109  */
2110 int
2111 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2112     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2113     void *cb_arg, nvlist_t **debugnvp)
2114 {
2115         char errbuf[1024];
2116         send_dump_data_t sdd = { 0 };
2117         int err = 0;
2118         nvlist_t *fss = NULL;
2119         avl_tree_t *fsavl = NULL;
2120         static uint64_t holdseq;
2121         int spa_version;
2122         pthread_t tid = 0;
2123         int pipefd[2];
2124         int featureflags = 0;
2125         FILE *fout;
2126
2127         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2128             "cannot send '%s'"), zhp->zfs_name);
2129
2130         if (fromsnap && fromsnap[0] == '\0') {
2131                 zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2132                     "zero-length incremental source"));
2133                 return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2134         }
2135
2136         if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM) {
2137                 uint64_t version;
2138                 version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
2139                 if (version >= ZPL_VERSION_SA) {
2140                         featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2141                 }
2142         }
2143
2144         if (flags->holds)
2145                 featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2146
2147         if (flags->replicate || flags->doall || flags->props ||
2148             flags->holds || flags->backup) {
2149                 char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2150                 if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2151                     "%s@%s", zhp->zfs_name, tosnap) >=
2152                     sizeof (full_tosnap_name)) {
2153                         err = EINVAL;
2154                         goto stderr_out;
2155                 }
2156                 zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2157                     full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2158                 if (tosnap == NULL) {
2159                         err = -1;
2160                         goto err_out;
2161                 }
2162                 err = send_prelim_records(tosnap, fromsnap, outfd,
2163                     flags->replicate || flags->props || flags->holds,
2164                     flags->replicate, flags->verbosity > 0, flags->dryrun,
2165                     flags->raw, flags->replicate, flags->backup, flags->holds,
2166                     flags->props, flags->doall, &fss, &fsavl);
2167                 zfs_close(tosnap);
2168                 if (err != 0)
2169                         goto err_out;
2170         }
2171
2172         /* dump each stream */
2173         sdd.fromsnap = fromsnap;
2174         sdd.tosnap = tosnap;
2175         if (tid != 0)
2176                 sdd.outfd = pipefd[0];
2177         else
2178                 sdd.outfd = outfd;
2179         sdd.replicate = flags->replicate;
2180         sdd.doall = flags->doall;
2181         sdd.fromorigin = flags->fromorigin;
2182         sdd.fss = fss;
2183         sdd.fsavl = fsavl;
2184         sdd.verbosity = flags->verbosity;
2185         sdd.parsable = flags->parsable;
2186         sdd.progress = flags->progress;
2187         sdd.dryrun = flags->dryrun;
2188         sdd.large_block = flags->largeblock;
2189         sdd.embed_data = flags->embed_data;
2190         sdd.compress = flags->compress;
2191         sdd.raw = flags->raw;
2192         sdd.holds = flags->holds;
2193         sdd.filter_cb = filter_func;
2194         sdd.filter_cb_arg = cb_arg;
2195         if (debugnvp)
2196                 sdd.debugnv = *debugnvp;
2197         if (sdd.verbosity != 0 && sdd.dryrun)
2198                 sdd.std_out = B_TRUE;
2199         fout = sdd.std_out ? stdout : stderr;
2200
2201         /*
2202          * Some flags require that we place user holds on the datasets that are
2203          * being sent so they don't get destroyed during the send. We can skip
2204          * this step if the pool is imported read-only since the datasets cannot
2205          * be destroyed.
2206          */
2207         if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2208             ZPOOL_PROP_READONLY, NULL) &&
2209             zfs_spa_version(zhp, &spa_version) == 0 &&
2210             spa_version >= SPA_VERSION_USERREFS &&
2211             (flags->doall || flags->replicate)) {
2212                 ++holdseq;
2213                 (void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2214                     ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2215                 sdd.cleanup_fd = open(ZFS_DEV, O_RDWR);
2216                 if (sdd.cleanup_fd < 0) {
2217                         err = errno;
2218                         goto stderr_out;
2219                 }
2220                 sdd.snapholds = fnvlist_alloc();
2221         } else {
2222                 sdd.cleanup_fd = -1;
2223                 sdd.snapholds = NULL;
2224         }
2225
2226         if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2227                 /*
2228                  * Do a verbose no-op dry run to get all the verbose output
2229                  * or to gather snapshot hold's before generating any data,
2230                  * then do a non-verbose real run to generate the streams.
2231                  */
2232                 sdd.dryrun = B_TRUE;
2233                 err = dump_filesystems(zhp, &sdd);
2234
2235                 if (err != 0)
2236                         goto stderr_out;
2237
2238                 if (flags->verbosity != 0) {
2239                         if (flags->parsable) {
2240                                 (void) fprintf(fout, "size\t%llu\n",
2241                                     (longlong_t)sdd.size);
2242                         } else {
2243                                 char buf[16];
2244                                 zfs_nicebytes(sdd.size, buf, sizeof (buf));
2245                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
2246                                     "total estimated size is %s\n"), buf);
2247                         }
2248                 }
2249
2250                 /* Ensure no snaps found is treated as an error. */
2251                 if (!sdd.seento) {
2252                         err = ENOENT;
2253                         goto err_out;
2254                 }
2255
2256                 /* Skip the second run if dryrun was requested. */
2257                 if (flags->dryrun)
2258                         goto err_out;
2259
2260                 if (sdd.snapholds != NULL) {
2261                         err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2262                         if (err != 0)
2263                                 goto stderr_out;
2264
2265                         fnvlist_free(sdd.snapholds);
2266                         sdd.snapholds = NULL;
2267                 }
2268
2269                 sdd.dryrun = B_FALSE;
2270                 sdd.verbosity = 0;
2271         }
2272
2273         err = dump_filesystems(zhp, &sdd);
2274         fsavl_destroy(fsavl);
2275         nvlist_free(fss);
2276
2277         /* Ensure no snaps found is treated as an error. */
2278         if (err == 0 && !sdd.seento)
2279                 err = ENOENT;
2280
2281         if (tid != 0) {
2282                 if (err != 0)
2283                         (void) pthread_cancel(tid);
2284                 (void) close(pipefd[0]);
2285                 (void) pthread_join(tid, NULL);
2286         }
2287
2288         if (sdd.cleanup_fd != -1) {
2289                 VERIFY(0 == close(sdd.cleanup_fd));
2290                 sdd.cleanup_fd = -1;
2291         }
2292
2293         if (!flags->dryrun && (flags->replicate || flags->doall ||
2294             flags->props || flags->backup || flags->holds)) {
2295                 /*
2296                  * write final end record.  NB: want to do this even if
2297                  * there was some error, because it might not be totally
2298                  * failed.
2299                  */
2300                 err = send_conclusion_record(outfd, NULL);
2301                 if (err != 0)
2302                         return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
2303         }
2304
2305         return (err || sdd.err);
2306
2307 stderr_out:
2308         err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2309 err_out:
2310         fsavl_destroy(fsavl);
2311         nvlist_free(fss);
2312         fnvlist_free(sdd.snapholds);
2313
2314         if (sdd.cleanup_fd != -1)
2315                 VERIFY(0 == close(sdd.cleanup_fd));
2316         if (tid != 0) {
2317                 (void) pthread_cancel(tid);
2318                 (void) close(pipefd[0]);
2319                 (void) pthread_join(tid, NULL);
2320         }
2321         return (err);
2322 }
2323
2324 static zfs_handle_t *
2325 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2326 {
2327         char dirname[ZFS_MAX_DATASET_NAME_LEN];
2328         (void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2329         char *c = strchr(dirname, '@');
2330         if (c != NULL)
2331                 *c = '\0';
2332         return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2333 }
2334
2335 /*
2336  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2337  * an earlier snapshot in the same filesystem, or a snapshot before later's
2338  * origin, or it's origin's origin, etc.
2339  */
2340 static boolean_t
2341 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2342 {
2343         boolean_t ret;
2344         uint64_t later_txg =
2345             (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2346             later->zfs_type == ZFS_TYPE_VOLUME ?
2347             UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2348         uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2349
2350         if (earlier_txg >= later_txg)
2351                 return (B_FALSE);
2352
2353         zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2354             earlier->zfs_name);
2355         zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2356             later->zfs_name);
2357
2358         if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2359                 zfs_close(earlier_dir);
2360                 zfs_close(later_dir);
2361                 return (B_TRUE);
2362         }
2363
2364         char clonename[ZFS_MAX_DATASET_NAME_LEN];
2365         if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2366             ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2367                 zfs_close(earlier_dir);
2368                 zfs_close(later_dir);
2369                 return (B_FALSE);
2370         }
2371
2372         zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2373             ZFS_TYPE_DATASET);
2374         uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2375
2376         /*
2377          * If "earlier" is exactly the origin, then
2378          * snapshot_is_before(earlier, origin) will return false (because
2379          * they're the same).
2380          */
2381         if (origin_txg == earlier_txg &&
2382             strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2383                 zfs_close(earlier_dir);
2384                 zfs_close(later_dir);
2385                 zfs_close(origin);
2386                 return (B_TRUE);
2387         }
2388         zfs_close(earlier_dir);
2389         zfs_close(later_dir);
2390
2391         ret = snapshot_is_before(earlier, origin);
2392         zfs_close(origin);
2393         return (ret);
2394 }
2395
2396 /*
2397  * The "zhp" argument is the handle of the dataset to send (typically a
2398  * snapshot).  The "from" argument is the full name of the snapshot or
2399  * bookmark that is the incremental source.
2400  */
2401 int
2402 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2403     const char *redactbook)
2404 {
2405         int err;
2406         libzfs_handle_t *hdl = zhp->zfs_hdl;
2407         char *name = zhp->zfs_name;
2408         int orig_fd = fd;
2409         pthread_t ptid;
2410         progress_arg_t pa = { 0 };
2411
2412         char errbuf[1024];
2413         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2414             "warning: cannot send '%s'"), name);
2415
2416         if (from != NULL && strchr(from, '@')) {
2417                 zfs_handle_t *from_zhp = zfs_open(hdl, from,
2418                     ZFS_TYPE_DATASET);
2419                 if (from_zhp == NULL)
2420                         return (-1);
2421                 if (!snapshot_is_before(from_zhp, zhp)) {
2422                         zfs_close(from_zhp);
2423                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2424                             "not an earlier snapshot from the same fs"));
2425                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2426                 }
2427                 zfs_close(from_zhp);
2428         }
2429
2430         if (redactbook != NULL) {
2431                 char bookname[ZFS_MAX_DATASET_NAME_LEN];
2432                 nvlist_t *redact_snaps;
2433                 zfs_handle_t *book_zhp;
2434                 char *at, *pound;
2435                 int dsnamelen;
2436
2437                 pound = strchr(redactbook, '#');
2438                 if (pound != NULL)
2439                         redactbook = pound + 1;
2440                 at = strchr(name, '@');
2441                 if (at == NULL) {
2442                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2443                             "cannot do a redacted send to a filesystem"));
2444                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2445                 }
2446                 dsnamelen = at - name;
2447                 if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2448                     dsnamelen, name, redactbook)
2449                     >= sizeof (bookname)) {
2450                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2451                             "invalid bookmark name"));
2452                         return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2453                 }
2454                 book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2455                 if (book_zhp == NULL)
2456                         return (-1);
2457                 if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2458                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2459                     &redact_snaps) != 0 || redact_snaps == NULL) {
2460                         zfs_close(book_zhp);
2461                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2462                             "not a redaction bookmark"));
2463                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2464                 }
2465                 zfs_close(book_zhp);
2466         }
2467
2468         /*
2469          * Send fs properties
2470          */
2471         if (flags->props || flags->holds || flags->backup) {
2472                 /*
2473                  * Note: the header generated by send_prelim_records()
2474                  * assumes that the incremental source is in the same
2475                  * filesystem/volume as the target (which is a requirement
2476                  * when doing "zfs send -R").  But that isn't always the
2477                  * case here (e.g. send from snap in origin, or send from
2478                  * bookmark).  We pass from=NULL, which will omit this
2479                  * information from the prelim records; it isn't used
2480                  * when receiving this type of stream.
2481                  */
2482                 err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2483                     flags->verbosity > 0, flags->dryrun, flags->raw,
2484                     flags->replicate, flags->backup, flags->holds,
2485                     flags->props, flags->doall, NULL, NULL);
2486                 if (err != 0)
2487                         return (err);
2488         }
2489
2490         /*
2491          * Perform size estimate if verbose was specified.
2492          */
2493         if (flags->verbosity != 0) {
2494                 err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2495                     errbuf);
2496                 if (err != 0)
2497                         return (err);
2498         }
2499
2500         if (flags->dryrun)
2501                 return (0);
2502
2503         /*
2504          * If progress reporting is requested, spawn a new thread to poll
2505          * ZFS_IOC_SEND_PROGRESS at a regular interval.
2506          */
2507         if (flags->progress) {
2508                 pa.pa_zhp = zhp;
2509                 pa.pa_fd = fd;
2510                 pa.pa_parsable = flags->parsable;
2511                 pa.pa_estimate = B_FALSE;
2512                 pa.pa_verbosity = flags->verbosity;
2513
2514                 err = pthread_create(&ptid, NULL,
2515                     send_progress_thread, &pa);
2516                 if (err != 0) {
2517                         zfs_error_aux(zhp->zfs_hdl, strerror(errno));
2518                         return (zfs_error(zhp->zfs_hdl,
2519                             EZFS_THREADCREATEFAILED, errbuf));
2520                 }
2521         }
2522
2523         err = lzc_send_redacted(name, from, fd,
2524             lzc_flags_from_sendflags(flags), redactbook);
2525
2526         if (flags->progress) {
2527                 void *status = NULL;
2528                 if (err != 0)
2529                         (void) pthread_cancel(ptid);
2530                 (void) pthread_join(ptid, &status);
2531                 int error = (int)(uintptr_t)status;
2532                 if (error != 0 && status != PTHREAD_CANCELED) {
2533                         char errbuf[1024];
2534                         (void) snprintf(errbuf, sizeof (errbuf),
2535                             dgettext(TEXT_DOMAIN, "progress thread exited "
2536                             "nonzero"));
2537                         return (zfs_standard_error(hdl, error, errbuf));
2538                 }
2539         }
2540
2541         if (flags->props || flags->holds || flags->backup) {
2542                 /* Write the final end record. */
2543                 err = send_conclusion_record(orig_fd, NULL);
2544                 if (err != 0)
2545                         return (zfs_standard_error(hdl, err, errbuf));
2546         }
2547         if (err != 0) {
2548                 switch (errno) {
2549                 case EXDEV:
2550                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2551                             "not an earlier snapshot from the same fs"));
2552                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2553
2554                 case ENOENT:
2555                 case ESRCH:
2556                         if (lzc_exists(name)) {
2557                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2558                                     "incremental source (%s) does not exist"),
2559                                     from);
2560                         }
2561                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
2562
2563                 case EACCES:
2564                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2565                             "dataset key must be loaded"));
2566                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2567
2568                 case EBUSY:
2569                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2570                             "target is busy; if a filesystem, "
2571                             "it must not be mounted"));
2572                         return (zfs_error(hdl, EZFS_BUSY, errbuf));
2573
2574                 case EDQUOT:
2575                 case EFAULT:
2576                 case EFBIG:
2577                 case EINVAL:
2578                 case EIO:
2579                 case ENOLINK:
2580                 case ENOSPC:
2581                 case ENOSTR:
2582                 case ENXIO:
2583                 case EPIPE:
2584                 case ERANGE:
2585                 case EROFS:
2586                         zfs_error_aux(hdl, strerror(errno));
2587                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2588
2589                 default:
2590                         return (zfs_standard_error(hdl, errno, errbuf));
2591                 }
2592         }
2593         return (err != 0);
2594 }
2595
2596 /*
2597  * Routines specific to "zfs recv"
2598  */
2599
2600 static int
2601 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2602     boolean_t byteswap, zio_cksum_t *zc)
2603 {
2604         char *cp = buf;
2605         int rv;
2606         int len = ilen;
2607
2608         do {
2609                 rv = read(fd, cp, len);
2610                 cp += rv;
2611                 len -= rv;
2612         } while (rv > 0);
2613
2614         if (rv < 0 || len != 0) {
2615                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2616                     "failed to read from stream"));
2617                 return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2618                     "cannot receive")));
2619         }
2620
2621         if (zc) {
2622                 if (byteswap)
2623                         fletcher_4_incremental_byteswap(buf, ilen, zc);
2624                 else
2625                         fletcher_4_incremental_native(buf, ilen, zc);
2626         }
2627         return (0);
2628 }
2629
2630 static int
2631 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2632     boolean_t byteswap, zio_cksum_t *zc)
2633 {
2634         char *buf;
2635         int err;
2636
2637         buf = zfs_alloc(hdl, len);
2638         if (buf == NULL)
2639                 return (ENOMEM);
2640
2641         if (len > hdl->libzfs_max_nvlist) {
2642                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2643                 free(buf);
2644                 return (ENOMEM);
2645         }
2646
2647         err = recv_read(hdl, fd, buf, len, byteswap, zc);
2648         if (err != 0) {
2649                 free(buf);
2650                 return (err);
2651         }
2652
2653         err = nvlist_unpack(buf, len, nvp, 0);
2654         free(buf);
2655         if (err != 0) {
2656                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2657                     "stream (malformed nvlist)"));
2658                 return (EINVAL);
2659         }
2660         return (0);
2661 }
2662
2663 /*
2664  * Returns the grand origin (origin of origin of origin...) of a given handle.
2665  * If this dataset is not a clone, it simply returns a copy of the original
2666  * handle.
2667  */
2668 static zfs_handle_t *
2669 recv_open_grand_origin(zfs_handle_t *zhp)
2670 {
2671         char origin[ZFS_MAX_DATASET_NAME_LEN];
2672         zprop_source_t src;
2673         zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2674
2675         while (ozhp != NULL) {
2676                 if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2677                     sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2678                         break;
2679
2680                 (void) zfs_close(ozhp);
2681                 ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2682         }
2683
2684         return (ozhp);
2685 }
2686
2687 static int
2688 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2689 {
2690         int err;
2691         zfs_handle_t *ozhp = NULL;
2692
2693         /*
2694          * Attempt to rename the dataset. If it fails with EACCES we have
2695          * attempted to rename the dataset outside of its encryption root.
2696          * Force the dataset to become an encryption root and try again.
2697          */
2698         err = lzc_rename(name, newname);
2699         if (err == EACCES) {
2700                 ozhp = recv_open_grand_origin(zhp);
2701                 if (ozhp == NULL) {
2702                         err = ENOENT;
2703                         goto out;
2704                 }
2705
2706                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2707                     NULL, NULL, 0);
2708                 if (err != 0)
2709                         goto out;
2710
2711                 err = lzc_rename(name, newname);
2712         }
2713
2714 out:
2715         if (ozhp != NULL)
2716                 zfs_close(ozhp);
2717         return (err);
2718 }
2719
2720 static int
2721 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2722     int baselen, char *newname, recvflags_t *flags)
2723 {
2724         static int seq;
2725         int err;
2726         prop_changelist_t *clp = NULL;
2727         zfs_handle_t *zhp = NULL;
2728
2729         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2730         if (zhp == NULL) {
2731                 err = -1;
2732                 goto out;
2733         }
2734         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2735             flags->force ? MS_FORCE : 0);
2736         if (clp == NULL) {
2737                 err = -1;
2738                 goto out;
2739         }
2740         err = changelist_prefix(clp);
2741         if (err)
2742                 goto out;
2743
2744         if (tryname) {
2745                 (void) strcpy(newname, tryname);
2746                 if (flags->verbose) {
2747                         (void) printf("attempting rename %s to %s\n",
2748                             name, newname);
2749                 }
2750                 err = recv_rename_impl(zhp, name, newname);
2751                 if (err == 0)
2752                         changelist_rename(clp, name, tryname);
2753         } else {
2754                 err = ENOENT;
2755         }
2756
2757         if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2758                 seq++;
2759
2760                 (void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2761                     "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2762
2763                 if (flags->verbose) {
2764                         (void) printf("failed - trying rename %s to %s\n",
2765                             name, newname);
2766                 }
2767                 err = recv_rename_impl(zhp, name, newname);
2768                 if (err == 0)
2769                         changelist_rename(clp, name, newname);
2770                 if (err && flags->verbose) {
2771                         (void) printf("failed (%u) - "
2772                             "will try again on next pass\n", errno);
2773                 }
2774                 err = EAGAIN;
2775         } else if (flags->verbose) {
2776                 if (err == 0)
2777                         (void) printf("success\n");
2778                 else
2779                         (void) printf("failed (%u)\n", errno);
2780         }
2781
2782         (void) changelist_postfix(clp);
2783
2784 out:
2785         if (clp != NULL)
2786                 changelist_free(clp);
2787         if (zhp != NULL)
2788                 zfs_close(zhp);
2789
2790         return (err);
2791 }
2792
2793 static int
2794 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2795     const char *origin_fsname, recvflags_t *flags)
2796 {
2797         int err;
2798         zfs_cmd_t zc = {"\0"};
2799         zfs_handle_t *zhp = NULL, *ozhp = NULL;
2800
2801         if (flags->verbose)
2802                 (void) printf("promoting %s\n", fsname);
2803
2804         (void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2805         (void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2806
2807         /*
2808          * Attempt to promote the dataset. If it fails with EACCES the
2809          * promotion would cause this dataset to leave its encryption root.
2810          * Force the origin to become an encryption root and try again.
2811          */
2812         err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2813         if (err == EACCES) {
2814                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2815                 if (zhp == NULL) {
2816                         err = -1;
2817                         goto out;
2818                 }
2819
2820                 ozhp = recv_open_grand_origin(zhp);
2821                 if (ozhp == NULL) {
2822                         err = -1;
2823                         goto out;
2824                 }
2825
2826                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2827                     NULL, NULL, 0);
2828                 if (err != 0)
2829                         goto out;
2830
2831                 err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2832         }
2833
2834 out:
2835         if (zhp != NULL)
2836                 zfs_close(zhp);
2837         if (ozhp != NULL)
2838                 zfs_close(ozhp);
2839
2840         return (err);
2841 }
2842
2843 static int
2844 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2845     char *newname, recvflags_t *flags)
2846 {
2847         int err = 0;
2848         prop_changelist_t *clp;
2849         zfs_handle_t *zhp;
2850         boolean_t defer = B_FALSE;
2851         int spa_version;
2852
2853         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2854         if (zhp == NULL)
2855                 return (-1);
2856         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2857             flags->force ? MS_FORCE : 0);
2858         if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT &&
2859             zfs_spa_version(zhp, &spa_version) == 0 &&
2860             spa_version >= SPA_VERSION_USERREFS)
2861                 defer = B_TRUE;
2862         zfs_close(zhp);
2863         if (clp == NULL)
2864                 return (-1);
2865         err = changelist_prefix(clp);
2866         if (err)
2867                 return (err);
2868
2869         if (flags->verbose)
2870                 (void) printf("attempting destroy %s\n", name);
2871         if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
2872                 nvlist_t *nv = fnvlist_alloc();
2873                 fnvlist_add_boolean(nv, name);
2874                 err = lzc_destroy_snaps(nv, defer, NULL);
2875                 fnvlist_free(nv);
2876         } else {
2877                 err = lzc_destroy(name);
2878         }
2879         if (err == 0) {
2880                 if (flags->verbose)
2881                         (void) printf("success\n");
2882                 changelist_remove(clp, name);
2883         }
2884
2885         (void) changelist_postfix(clp);
2886         changelist_free(clp);
2887
2888         /*
2889          * Deferred destroy might destroy the snapshot or only mark it to be
2890          * destroyed later, and it returns success in either case.
2891          */
2892         if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
2893             ZFS_TYPE_SNAPSHOT))) {
2894                 err = recv_rename(hdl, name, NULL, baselen, newname, flags);
2895         }
2896
2897         return (err);
2898 }
2899
2900 typedef struct guid_to_name_data {
2901         uint64_t guid;
2902         boolean_t bookmark_ok;
2903         char *name;
2904         char *skip;
2905         uint64_t *redact_snap_guids;
2906         uint64_t num_redact_snaps;
2907 } guid_to_name_data_t;
2908
2909 static boolean_t
2910 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
2911 {
2912         uint64_t *bmark_snaps;
2913         uint_t bmark_num_snaps;
2914         nvlist_t *nvl;
2915         if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
2916                 return (B_FALSE);
2917
2918         nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
2919             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
2920         bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
2921             &bmark_num_snaps);
2922         if (bmark_num_snaps != gtnd->num_redact_snaps)
2923                 return (B_FALSE);
2924         int i = 0;
2925         for (; i < bmark_num_snaps; i++) {
2926                 int j = 0;
2927                 for (; j < bmark_num_snaps; j++) {
2928                         if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
2929                                 break;
2930                 }
2931                 if (j == bmark_num_snaps)
2932                         break;
2933         }
2934         return (i == bmark_num_snaps);
2935 }
2936
2937 static int
2938 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
2939 {
2940         guid_to_name_data_t *gtnd = arg;
2941         const char *slash;
2942         int err;
2943
2944         if (gtnd->skip != NULL &&
2945             (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
2946             strcmp(slash + 1, gtnd->skip) == 0) {
2947                 zfs_close(zhp);
2948                 return (0);
2949         }
2950
2951         if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
2952             (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
2953                 (void) strcpy(gtnd->name, zhp->zfs_name);
2954                 zfs_close(zhp);
2955                 return (EEXIST);
2956         }
2957
2958         err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
2959         if (err != EEXIST && gtnd->bookmark_ok)
2960                 err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
2961         zfs_close(zhp);
2962         return (err);
2963 }
2964
2965 /*
2966  * Attempt to find the local dataset associated with this guid.  In the case of
2967  * multiple matches, we attempt to find the "best" match by searching
2968  * progressively larger portions of the hierarchy.  This allows one to send a
2969  * tree of datasets individually and guarantee that we will find the source
2970  * guid within that hierarchy, even if there are multiple matches elsewhere.
2971  *
2972  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
2973  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
2974  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
2975  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
2976  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
2977  * given guid.  Note that a redaction bookmark can be returned if
2978  * num_redact_snaps == -1.
2979  */
2980 static int
2981 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
2982     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
2983     uint64_t num_redact_snaps, char *name)
2984 {
2985         char pname[ZFS_MAX_DATASET_NAME_LEN];
2986         guid_to_name_data_t gtnd;
2987
2988         gtnd.guid = guid;
2989         gtnd.bookmark_ok = bookmark_ok;
2990         gtnd.name = name;
2991         gtnd.skip = NULL;
2992         gtnd.redact_snap_guids = redact_snap_guids;
2993         gtnd.num_redact_snaps = num_redact_snaps;
2994
2995         /*
2996          * Search progressively larger portions of the hierarchy, starting
2997          * with the filesystem specified by 'parent'.  This will
2998          * select the "most local" version of the origin snapshot in the case
2999          * that there are multiple matching snapshots in the system.
3000          */
3001         (void) strlcpy(pname, parent, sizeof (pname));
3002         char *cp = strrchr(pname, '@');
3003         if (cp == NULL)
3004                 cp = strchr(pname, '\0');
3005         for (; cp != NULL; cp = strrchr(pname, '/')) {
3006                 /* Chop off the last component and open the parent */
3007                 *cp = '\0';
3008                 zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3009
3010                 if (zhp == NULL)
3011                         continue;
3012                 int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3013                 if (err != EEXIST)
3014                         err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3015                 if (err != EEXIST && bookmark_ok)
3016                         err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3017                 zfs_close(zhp);
3018                 if (err == EEXIST)
3019                         return (0);
3020
3021                 /*
3022                  * Remember the last portion of the dataset so we skip it next
3023                  * time through (as we've already searched that portion of the
3024                  * hierarchy).
3025                  */
3026                 gtnd.skip = strrchr(pname, '/') + 1;
3027         }
3028
3029         return (ENOENT);
3030 }
3031
3032 static int
3033 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3034     boolean_t bookmark_ok, char *name)
3035 {
3036         return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3037             -1, name));
3038 }
3039
3040 /*
3041  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3042  * guid1 is after guid2.
3043  */
3044 static int
3045 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3046     uint64_t guid1, uint64_t guid2)
3047 {
3048         nvlist_t *nvfs;
3049         char *fsname = NULL, *snapname = NULL;
3050         char buf[ZFS_MAX_DATASET_NAME_LEN];
3051         int rv;
3052         zfs_handle_t *guid1hdl, *guid2hdl;
3053         uint64_t create1, create2;
3054
3055         if (guid2 == 0)
3056                 return (0);
3057         if (guid1 == 0)
3058                 return (1);
3059
3060         nvfs = fsavl_find(avl, guid1, &snapname);
3061         VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
3062         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3063         guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3064         if (guid1hdl == NULL)
3065                 return (-1);
3066
3067         nvfs = fsavl_find(avl, guid2, &snapname);
3068         VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
3069         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3070         guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3071         if (guid2hdl == NULL) {
3072                 zfs_close(guid1hdl);
3073                 return (-1);
3074         }
3075
3076         create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3077         create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3078
3079         if (create1 < create2)
3080                 rv = -1;
3081         else if (create1 > create2)
3082                 rv = +1;
3083         else
3084                 rv = 0;
3085
3086         zfs_close(guid1hdl);
3087         zfs_close(guid2hdl);
3088
3089         return (rv);
3090 }
3091
3092 /*
3093  * This function reestablishes the hierarchy of encryption roots after a
3094  * recursive incremental receive has completed. This must be done after the
3095  * second call to recv_incremental_replication() has renamed and promoted all
3096  * sent datasets to their final locations in the dataset hierarchy.
3097  */
3098 static int
3099 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3100     nvlist_t *stream_nv, avl_tree_t *stream_avl)
3101 {
3102         int err;
3103         nvpair_t *fselem = NULL;
3104         nvlist_t *stream_fss;
3105
3106         VERIFY(0 == nvlist_lookup_nvlist(stream_nv, "fss", &stream_fss));
3107
3108         while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3109                 zfs_handle_t *zhp = NULL;
3110                 uint64_t crypt;
3111                 nvlist_t *snaps, *props, *stream_nvfs = NULL;
3112                 nvpair_t *snapel = NULL;
3113                 boolean_t is_encroot, is_clone, stream_encroot;
3114                 char *cp;
3115                 char *stream_keylocation = NULL;
3116                 char keylocation[MAXNAMELEN];
3117                 char fsname[ZFS_MAX_DATASET_NAME_LEN];
3118
3119                 keylocation[0] = '\0';
3120                 VERIFY(0 == nvpair_value_nvlist(fselem, &stream_nvfs));
3121                 VERIFY(0 == nvlist_lookup_nvlist(stream_nvfs, "snaps", &snaps));
3122                 VERIFY(0 == nvlist_lookup_nvlist(stream_nvfs, "props", &props));
3123                 stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3124
3125                 /* find a snapshot from the stream that exists locally */
3126                 err = ENOENT;
3127                 while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3128                         uint64_t guid;
3129
3130                         VERIFY(0 == nvpair_value_uint64(snapel, &guid));
3131                         err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3132                             fsname);
3133                         if (err == 0)
3134                                 break;
3135                 }
3136
3137                 if (err != 0)
3138                         continue;
3139
3140                 cp = strchr(fsname, '@');
3141                 if (cp != NULL)
3142                         *cp = '\0';
3143
3144                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3145                 if (zhp == NULL) {
3146                         err = ENOENT;
3147                         goto error;
3148                 }
3149
3150                 crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3151                 is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3152                 (void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3153
3154                 /* we don't need to do anything for unencrypted datasets */
3155                 if (crypt == ZIO_CRYPT_OFF) {
3156                         zfs_close(zhp);
3157                         continue;
3158                 }
3159
3160                 /*
3161                  * If the dataset is flagged as an encryption root, was not
3162                  * received as a clone and is not currently an encryption root,
3163                  * force it to become one. Fixup the keylocation if necessary.
3164                  */
3165                 if (stream_encroot) {
3166                         if (!is_clone && !is_encroot) {
3167                                 err = lzc_change_key(fsname,
3168                                     DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3169                                 if (err != 0) {
3170                                         zfs_close(zhp);
3171                                         goto error;
3172                                 }
3173                         }
3174
3175                         VERIFY(0 == nvlist_lookup_string(props,
3176                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3177                             &stream_keylocation));
3178
3179                         /*
3180                          * Refresh the properties in case the call to
3181                          * lzc_change_key() changed the value.
3182                          */
3183                         zfs_refresh_properties(zhp);
3184                         err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3185                             keylocation, sizeof (keylocation), NULL, NULL,
3186                             0, B_TRUE);
3187                         if (err != 0) {
3188                                 zfs_close(zhp);
3189                                 goto error;
3190                         }
3191
3192                         if (strcmp(keylocation, stream_keylocation) != 0) {
3193                                 err = zfs_prop_set(zhp,
3194                                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3195                                     stream_keylocation);
3196                                 if (err != 0) {
3197                                         zfs_close(zhp);
3198                                         goto error;
3199                                 }
3200                         }
3201                 }
3202
3203                 /*
3204                  * If the dataset is not flagged as an encryption root and is
3205                  * currently an encryption root, force it to inherit from its
3206                  * parent. The root of a raw send should never be
3207                  * force-inherited.
3208                  */
3209                 if (!stream_encroot && is_encroot &&
3210                     strcmp(top_zfs, fsname) != 0) {
3211                         err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3212                             NULL, NULL, 0);
3213                         if (err != 0) {
3214                                 zfs_close(zhp);
3215                                 goto error;
3216                         }
3217                 }
3218
3219                 zfs_close(zhp);
3220         }
3221
3222         return (0);
3223
3224 error:
3225         return (err);
3226 }
3227
3228 static int
3229 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3230     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3231     nvlist_t *renamed)
3232 {
3233         nvlist_t *local_nv, *deleted = NULL;
3234         avl_tree_t *local_avl;
3235         nvpair_t *fselem, *nextfselem;
3236         char *fromsnap;
3237         char newname[ZFS_MAX_DATASET_NAME_LEN];
3238         char guidname[32];
3239         int error;
3240         boolean_t needagain, progress, recursive;
3241         char *s1, *s2;
3242
3243         VERIFY(0 == nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap));
3244
3245         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3246             ENOENT);
3247
3248         if (flags->dryrun)
3249                 return (0);
3250
3251 again:
3252         needagain = progress = B_FALSE;
3253
3254         VERIFY(0 == nvlist_alloc(&deleted, NV_UNIQUE_NAME, 0));
3255
3256         if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3257             recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE,
3258             B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3259                 return (error);
3260
3261         /*
3262          * Process deletes and renames
3263          */
3264         for (fselem = nvlist_next_nvpair(local_nv, NULL);
3265             fselem; fselem = nextfselem) {
3266                 nvlist_t *nvfs, *snaps;
3267                 nvlist_t *stream_nvfs = NULL;
3268                 nvpair_t *snapelem, *nextsnapelem;
3269                 uint64_t fromguid = 0;
3270                 uint64_t originguid = 0;
3271                 uint64_t stream_originguid = 0;
3272                 uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3273                 char *fsname, *stream_fsname;
3274
3275                 nextfselem = nvlist_next_nvpair(local_nv, fselem);
3276
3277                 VERIFY(0 == nvpair_value_nvlist(fselem, &nvfs));
3278                 VERIFY(0 == nvlist_lookup_nvlist(nvfs, "snaps", &snaps));
3279                 VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
3280                 VERIFY(0 == nvlist_lookup_uint64(nvfs, "parentfromsnap",
3281                     &parent_fromsnap_guid));
3282                 (void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3283
3284                 /*
3285                  * First find the stream's fs, so we can check for
3286                  * a different origin (due to "zfs promote")
3287                  */
3288                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3289                     snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3290                         uint64_t thisguid;
3291
3292                         VERIFY(0 == nvpair_value_uint64(snapelem, &thisguid));
3293                         stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3294
3295                         if (stream_nvfs != NULL)
3296                                 break;
3297                 }
3298
3299                 /* check for promote */
3300                 (void) nvlist_lookup_uint64(stream_nvfs, "origin",
3301                     &stream_originguid);
3302                 if (stream_nvfs && originguid != stream_originguid) {
3303                         switch (created_before(hdl, local_avl,
3304                             stream_originguid, originguid)) {
3305                         case 1: {
3306                                 /* promote it! */
3307                                 nvlist_t *origin_nvfs;
3308                                 char *origin_fsname;
3309
3310                                 origin_nvfs = fsavl_find(local_avl, originguid,
3311                                     NULL);
3312                                 VERIFY(0 == nvlist_lookup_string(origin_nvfs,
3313                                     "name", &origin_fsname));
3314                                 error = recv_promote(hdl, fsname, origin_fsname,
3315                                     flags);
3316                                 if (error == 0)
3317                                         progress = B_TRUE;
3318                                 break;
3319                         }
3320                         default:
3321                                 break;
3322                         case -1:
3323                                 fsavl_destroy(local_avl);
3324                                 nvlist_free(local_nv);
3325                                 return (-1);
3326                         }
3327                         /*
3328                          * We had/have the wrong origin, therefore our
3329                          * list of snapshots is wrong.  Need to handle
3330                          * them on the next pass.
3331                          */
3332                         needagain = B_TRUE;
3333                         continue;
3334                 }
3335
3336                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3337                     snapelem; snapelem = nextsnapelem) {
3338                         uint64_t thisguid;
3339                         char *stream_snapname;
3340                         nvlist_t *found, *props;
3341
3342                         nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3343
3344                         VERIFY(0 == nvpair_value_uint64(snapelem, &thisguid));
3345                         found = fsavl_find(stream_avl, thisguid,
3346                             &stream_snapname);
3347
3348                         /* check for delete */
3349                         if (found == NULL) {
3350                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3351
3352                                 if (!flags->force)
3353                                         continue;
3354
3355                                 (void) snprintf(name, sizeof (name), "%s@%s",
3356                                     fsname, nvpair_name(snapelem));
3357
3358                                 error = recv_destroy(hdl, name,
3359                                     strlen(fsname)+1, newname, flags);
3360                                 if (error)
3361                                         needagain = B_TRUE;
3362                                 else
3363                                         progress = B_TRUE;
3364                                 sprintf(guidname, "%llu",
3365                                     (u_longlong_t)thisguid);
3366                                 nvlist_add_boolean(deleted, guidname);
3367                                 continue;
3368                         }
3369
3370                         stream_nvfs = found;
3371
3372                         if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3373                             &props) && 0 == nvlist_lookup_nvlist(props,
3374                             stream_snapname, &props)) {
3375                                 zfs_cmd_t zc = {"\0"};
3376
3377                                 zc.zc_cookie = B_TRUE; /* received */
3378                                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3379                                     "%s@%s", fsname, nvpair_name(snapelem));
3380                                 if (zcmd_write_src_nvlist(hdl, &zc,
3381                                     props) == 0) {
3382                                         (void) zfs_ioctl(hdl,
3383                                             ZFS_IOC_SET_PROP, &zc);
3384                                         zcmd_free_nvlists(&zc);
3385                                 }
3386                         }
3387
3388                         /* check for different snapname */
3389                         if (strcmp(nvpair_name(snapelem),
3390                             stream_snapname) != 0) {
3391                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3392                                 char tryname[ZFS_MAX_DATASET_NAME_LEN];
3393
3394                                 (void) snprintf(name, sizeof (name), "%s@%s",
3395                                     fsname, nvpair_name(snapelem));
3396                                 (void) snprintf(tryname, sizeof (name), "%s@%s",
3397                                     fsname, stream_snapname);
3398
3399                                 error = recv_rename(hdl, name, tryname,
3400                                     strlen(fsname)+1, newname, flags);
3401                                 if (error)
3402                                         needagain = B_TRUE;
3403                                 else
3404                                         progress = B_TRUE;
3405                         }
3406
3407                         if (strcmp(stream_snapname, fromsnap) == 0)
3408                                 fromguid = thisguid;
3409                 }
3410
3411                 /* check for delete */
3412                 if (stream_nvfs == NULL) {
3413                         if (!flags->force)
3414                                 continue;
3415
3416                         error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3417                             newname, flags);
3418                         if (error)
3419                                 needagain = B_TRUE;
3420                         else
3421                                 progress = B_TRUE;
3422                         sprintf(guidname, "%llu",
3423                             (u_longlong_t)parent_fromsnap_guid);
3424                         nvlist_add_boolean(deleted, guidname);
3425                         continue;
3426                 }
3427
3428                 if (fromguid == 0) {
3429                         if (flags->verbose) {
3430                                 (void) printf("local fs %s does not have "
3431                                     "fromsnap (%s in stream); must have "
3432                                     "been deleted locally; ignoring\n",
3433                                     fsname, fromsnap);
3434                         }
3435                         continue;
3436                 }
3437
3438                 VERIFY(0 == nvlist_lookup_string(stream_nvfs,
3439                     "name", &stream_fsname));
3440                 VERIFY(0 == nvlist_lookup_uint64(stream_nvfs,
3441                     "parentfromsnap", &stream_parent_fromsnap_guid));
3442
3443                 s1 = strrchr(fsname, '/');
3444                 s2 = strrchr(stream_fsname, '/');
3445
3446                 /*
3447                  * Check if we're going to rename based on parent guid change
3448                  * and the current parent guid was also deleted. If it was then
3449                  * rename will fail and is likely unneeded, so avoid this and
3450                  * force an early retry to determine the new
3451                  * parent_fromsnap_guid.
3452                  */
3453                 if (stream_parent_fromsnap_guid != 0 &&
3454                     parent_fromsnap_guid != 0 &&
3455                     stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3456                         sprintf(guidname, "%llu",
3457                             (u_longlong_t)parent_fromsnap_guid);
3458                         if (nvlist_exists(deleted, guidname)) {
3459                                 progress = B_TRUE;
3460                                 needagain = B_TRUE;
3461                                 goto doagain;
3462                         }
3463                 }
3464
3465                 /*
3466                  * Check for rename. If the exact receive path is specified, it
3467                  * does not count as a rename, but we still need to check the
3468                  * datasets beneath it.
3469                  */
3470                 if ((stream_parent_fromsnap_guid != 0 &&
3471                     parent_fromsnap_guid != 0 &&
3472                     stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3473                     ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3474                     (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3475                         nvlist_t *parent;
3476                         char tryname[ZFS_MAX_DATASET_NAME_LEN];
3477
3478                         parent = fsavl_find(local_avl,
3479                             stream_parent_fromsnap_guid, NULL);
3480                         /*
3481                          * NB: parent might not be found if we used the
3482                          * tosnap for stream_parent_fromsnap_guid,
3483                          * because the parent is a newly-created fs;
3484                          * we'll be able to rename it after we recv the
3485                          * new fs.
3486                          */
3487                         if (parent != NULL) {
3488                                 char *pname;
3489
3490                                 VERIFY(0 == nvlist_lookup_string(parent, "name",
3491                                     &pname));
3492                                 (void) snprintf(tryname, sizeof (tryname),
3493                                     "%s%s", pname, strrchr(stream_fsname, '/'));
3494                         } else {
3495                                 tryname[0] = '\0';
3496                                 if (flags->verbose) {
3497                                         (void) printf("local fs %s new parent "
3498                                             "not found\n", fsname);
3499                                 }
3500                         }
3501
3502                         newname[0] = '\0';
3503
3504                         error = recv_rename(hdl, fsname, tryname,
3505                             strlen(tofs)+1, newname, flags);
3506
3507                         if (renamed != NULL && newname[0] != '\0') {
3508                                 VERIFY(0 == nvlist_add_boolean(renamed,
3509                                     newname));
3510                         }
3511
3512                         if (error)
3513                                 needagain = B_TRUE;
3514                         else
3515                                 progress = B_TRUE;
3516                 }
3517         }
3518
3519 doagain:
3520         fsavl_destroy(local_avl);
3521         nvlist_free(local_nv);
3522         nvlist_free(deleted);
3523
3524         if (needagain && progress) {
3525                 /* do another pass to fix up temporary names */
3526                 if (flags->verbose)
3527                         (void) printf("another pass:\n");
3528                 goto again;
3529         }
3530
3531         return (needagain || error != 0);
3532 }
3533
3534 static int
3535 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3536     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3537     char **top_zfs, nvlist_t *cmdprops)
3538 {
3539         nvlist_t *stream_nv = NULL;
3540         avl_tree_t *stream_avl = NULL;
3541         char *fromsnap = NULL;
3542         char *sendsnap = NULL;
3543         char *cp;
3544         char tofs[ZFS_MAX_DATASET_NAME_LEN];
3545         char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3546         char errbuf[1024];
3547         dmu_replay_record_t drre;
3548         int error;
3549         boolean_t anyerr = B_FALSE;
3550         boolean_t softerr = B_FALSE;
3551         boolean_t recursive, raw;
3552
3553         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3554             "cannot receive"));
3555
3556         assert(drr->drr_type == DRR_BEGIN);
3557         assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3558         assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3559             DMU_COMPOUNDSTREAM);
3560
3561         /*
3562          * Read in the nvlist from the stream.
3563          */
3564         if (drr->drr_payloadlen != 0) {
3565                 error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3566                     &stream_nv, flags->byteswap, zc);
3567                 if (error) {
3568                         error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3569                         goto out;
3570                 }
3571         }
3572
3573         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3574             ENOENT);
3575         raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3576
3577         if (recursive && strchr(destname, '@')) {
3578                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3579                     "cannot specify snapshot name for multi-snapshot stream"));
3580                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3581                 goto out;
3582         }
3583
3584         /*
3585          * Read in the end record and verify checksum.
3586          */
3587         if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3588             flags->byteswap, NULL)))
3589                 goto out;
3590         if (flags->byteswap) {
3591                 drre.drr_type = BSWAP_32(drre.drr_type);
3592                 drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3593                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3594                 drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3595                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3596                 drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3597                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3598                 drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3599                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3600         }
3601         if (drre.drr_type != DRR_END) {
3602                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3603                 goto out;
3604         }
3605         if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3606                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3607                     "incorrect header checksum"));
3608                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3609                 goto out;
3610         }
3611
3612         (void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3613
3614         if (drr->drr_payloadlen != 0) {
3615                 nvlist_t *stream_fss;
3616
3617                 VERIFY(0 == nvlist_lookup_nvlist(stream_nv, "fss",
3618                     &stream_fss));
3619                 if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3620                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3621                             "couldn't allocate avl tree"));
3622                         error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3623                         goto out;
3624                 }
3625
3626                 if (fromsnap != NULL && recursive) {
3627                         nvlist_t *renamed = NULL;
3628                         nvpair_t *pair = NULL;
3629
3630                         (void) strlcpy(tofs, destname, sizeof (tofs));
3631                         if (flags->isprefix) {
3632                                 struct drr_begin *drrb = &drr->drr_u.drr_begin;
3633                                 int i;
3634
3635                                 if (flags->istail) {
3636                                         cp = strrchr(drrb->drr_toname, '/');
3637                                         if (cp == NULL) {
3638                                                 (void) strlcat(tofs, "/",
3639                                                     sizeof (tofs));
3640                                                 i = 0;
3641                                         } else {
3642                                                 i = (cp - drrb->drr_toname);
3643                                         }
3644                                 } else {
3645                                         i = strcspn(drrb->drr_toname, "/@");
3646                                 }
3647                                 /* zfs_receive_one() will create_parents() */
3648                                 (void) strlcat(tofs, &drrb->drr_toname[i],
3649                                     sizeof (tofs));
3650                                 *strchr(tofs, '@') = '\0';
3651                         }
3652
3653                         if (!flags->dryrun && !flags->nomount) {
3654                                 VERIFY(0 == nvlist_alloc(&renamed,
3655                                     NV_UNIQUE_NAME, 0));
3656                         }
3657
3658                         softerr = recv_incremental_replication(hdl, tofs, flags,
3659                             stream_nv, stream_avl, renamed);
3660
3661                         /* Unmount renamed filesystems before receiving. */
3662                         while ((pair = nvlist_next_nvpair(renamed,
3663                             pair)) != NULL) {
3664                                 zfs_handle_t *zhp;
3665                                 prop_changelist_t *clp = NULL;
3666
3667                                 zhp = zfs_open(hdl, nvpair_name(pair),
3668                                     ZFS_TYPE_FILESYSTEM);
3669                                 if (zhp != NULL) {
3670                                         clp = changelist_gather(zhp,
3671                                             ZFS_PROP_MOUNTPOINT, 0,
3672                                             flags->forceunmount ? MS_FORCE : 0);
3673                                         zfs_close(zhp);
3674                                         if (clp != NULL) {
3675                                                 softerr |=
3676                                                     changelist_prefix(clp);
3677                                                 changelist_free(clp);
3678                                         }
3679                                 }
3680                         }
3681
3682                         nvlist_free(renamed);
3683                 }
3684         }
3685
3686         /*
3687          * Get the fs specified by the first path in the stream (the top level
3688          * specified by 'zfs send') and pass it to each invocation of
3689          * zfs_receive_one().
3690          */
3691         (void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3692             sizeof (sendfs));
3693         if ((cp = strchr(sendfs, '@')) != NULL) {
3694                 *cp = '\0';
3695                 /*
3696                  * Find the "sendsnap", the final snapshot in a replication
3697                  * stream.  zfs_receive_one() handles certain errors
3698                  * differently, depending on if the contained stream is the
3699                  * last one or not.
3700                  */
3701                 sendsnap = (cp + 1);
3702         }
3703
3704         /* Finally, receive each contained stream */
3705         do {
3706                 /*
3707                  * we should figure out if it has a recoverable
3708                  * error, in which case do a recv_skip() and drive on.
3709                  * Note, if we fail due to already having this guid,
3710                  * zfs_receive_one() will take care of it (ie,
3711                  * recv_skip() and return 0).
3712                  */
3713                 error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3714                     sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3715                 if (error == ENODATA) {
3716                         error = 0;
3717                         break;
3718                 }
3719                 anyerr |= error;
3720         } while (error == 0);
3721
3722         if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3723                 /*
3724                  * Now that we have the fs's they sent us, try the
3725                  * renames again.
3726                  */
3727                 softerr = recv_incremental_replication(hdl, tofs, flags,
3728                     stream_nv, stream_avl, NULL);
3729         }
3730
3731         if (raw && softerr == 0 && *top_zfs != NULL) {
3732                 softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3733                     stream_nv, stream_avl);
3734         }
3735
3736 out:
3737         fsavl_destroy(stream_avl);
3738         nvlist_free(stream_nv);
3739         if (softerr)
3740                 error = -2;
3741         if (anyerr)
3742                 error = -1;
3743         return (error);
3744 }
3745
3746 static void
3747 trunc_prop_errs(int truncated)
3748 {
3749         ASSERT(truncated != 0);
3750
3751         if (truncated == 1)
3752                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3753                     "1 more property could not be set\n"));
3754         else
3755                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3756                     "%d more properties could not be set\n"), truncated);
3757 }
3758
3759 static int
3760 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3761 {
3762         dmu_replay_record_t *drr;
3763         void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3764         uint64_t payload_size;
3765         char errbuf[1024];
3766
3767         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3768             "cannot receive"));
3769
3770         /* XXX would be great to use lseek if possible... */
3771         drr = buf;
3772
3773         while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3774             byteswap, NULL) == 0) {
3775                 if (byteswap)
3776                         drr->drr_type = BSWAP_32(drr->drr_type);
3777
3778                 switch (drr->drr_type) {
3779                 case DRR_BEGIN:
3780                         if (drr->drr_payloadlen != 0) {
3781                                 (void) recv_read(hdl, fd, buf,
3782                                     drr->drr_payloadlen, B_FALSE, NULL);
3783                         }
3784                         break;
3785
3786                 case DRR_END:
3787                         free(buf);
3788                         return (0);
3789
3790                 case DRR_OBJECT:
3791                         if (byteswap) {
3792                                 drr->drr_u.drr_object.drr_bonuslen =
3793                                     BSWAP_32(drr->drr_u.drr_object.
3794                                     drr_bonuslen);
3795                                 drr->drr_u.drr_object.drr_raw_bonuslen =
3796                                     BSWAP_32(drr->drr_u.drr_object.
3797                                     drr_raw_bonuslen);
3798                         }
3799
3800                         payload_size =
3801                             DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3802                         (void) recv_read(hdl, fd, buf, payload_size,
3803                             B_FALSE, NULL);
3804                         break;
3805
3806                 case DRR_WRITE:
3807                         if (byteswap) {
3808                                 drr->drr_u.drr_write.drr_logical_size =
3809                                     BSWAP_64(
3810                                     drr->drr_u.drr_write.drr_logical_size);
3811                                 drr->drr_u.drr_write.drr_compressed_size =
3812                                     BSWAP_64(
3813                                     drr->drr_u.drr_write.drr_compressed_size);
3814                         }
3815                         payload_size =
3816                             DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3817                         assert(payload_size <= SPA_MAXBLOCKSIZE);
3818                         (void) recv_read(hdl, fd, buf,
3819                             payload_size, B_FALSE, NULL);
3820                         break;
3821                 case DRR_SPILL:
3822                         if (byteswap) {
3823                                 drr->drr_u.drr_spill.drr_length =
3824                                     BSWAP_64(drr->drr_u.drr_spill.drr_length);
3825                                 drr->drr_u.drr_spill.drr_compressed_size =
3826                                     BSWAP_64(drr->drr_u.drr_spill.
3827                                     drr_compressed_size);
3828                         }
3829
3830                         payload_size =
3831                             DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3832                         (void) recv_read(hdl, fd, buf, payload_size,
3833                             B_FALSE, NULL);
3834                         break;
3835                 case DRR_WRITE_EMBEDDED:
3836                         if (byteswap) {
3837                                 drr->drr_u.drr_write_embedded.drr_psize =
3838                                     BSWAP_32(drr->drr_u.drr_write_embedded.
3839                                     drr_psize);
3840                         }
3841                         (void) recv_read(hdl, fd, buf,
3842                             P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3843                             8), B_FALSE, NULL);
3844                         break;
3845                 case DRR_OBJECT_RANGE:
3846                 case DRR_WRITE_BYREF:
3847                 case DRR_FREEOBJECTS:
3848                 case DRR_FREE:
3849                         break;
3850
3851                 default:
3852                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3853                             "invalid record type"));
3854                         free(buf);
3855                         return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3856                 }
3857         }
3858
3859         free(buf);
3860         return (-1);
3861 }
3862
3863 static void
3864 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
3865     boolean_t resumable, boolean_t checksum)
3866 {
3867         char target_fs[ZFS_MAX_DATASET_NAME_LEN];
3868
3869         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
3870             "checksum mismatch" : "incomplete stream")));
3871
3872         if (!resumable)
3873                 return;
3874         (void) strlcpy(target_fs, target_snap, sizeof (target_fs));
3875         *strchr(target_fs, '@') = '\0';
3876         zfs_handle_t *zhp = zfs_open(hdl, target_fs,
3877             ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
3878         if (zhp == NULL)
3879                 return;
3880
3881         char token_buf[ZFS_MAXPROPLEN];
3882         int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
3883             token_buf, sizeof (token_buf),
3884             NULL, NULL, 0, B_TRUE);
3885         if (error == 0) {
3886                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3887                     "checksum mismatch or incomplete stream.\n"
3888                     "Partially received snapshot is saved.\n"
3889                     "A resuming stream can be generated on the sending "
3890                     "system by running:\n"
3891                     "    zfs send -t %s"),
3892                     token_buf);
3893         }
3894         zfs_close(zhp);
3895 }
3896
3897 /*
3898  * Prepare a new nvlist of properties that are to override (-o) or be excluded
3899  * (-x) from the received dataset
3900  * recvprops: received properties from the send stream
3901  * cmdprops: raw input properties from command line
3902  * origprops: properties, both locally-set and received, currently set on the
3903  *            target dataset if it exists, NULL otherwise.
3904  * oxprops: valid output override (-o) and excluded (-x) properties
3905  */
3906 static int
3907 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
3908     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
3909     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
3910     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
3911     uint_t *wkeylen_out, const char *errbuf)
3912 {
3913         nvpair_t *nvp;
3914         nvlist_t *oprops, *voprops;
3915         zfs_handle_t *zhp = NULL;
3916         zpool_handle_t *zpool_hdl = NULL;
3917         char *cp;
3918         int ret = 0;
3919         char namebuf[ZFS_MAX_DATASET_NAME_LEN];
3920
3921         if (nvlist_empty(cmdprops))
3922                 return (0); /* No properties to override or exclude */
3923
3924         *oxprops = fnvlist_alloc();
3925         oprops = fnvlist_alloc();
3926
3927         strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
3928
3929         /*
3930          * Get our dataset handle. The target dataset may not exist yet.
3931          */
3932         if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
3933                 zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
3934                 if (zhp == NULL) {
3935                         ret = -1;
3936                         goto error;
3937                 }
3938         }
3939
3940         /* open the zpool handle */
3941         cp = strchr(namebuf, '/');
3942         if (cp != NULL)
3943                 *cp = '\0';
3944         zpool_hdl = zpool_open(hdl, namebuf);
3945         if (zpool_hdl == NULL) {
3946                 ret = -1;
3947                 goto error;
3948         }
3949
3950         /* restore namebuf to match fsname for later use */
3951         if (cp != NULL)
3952                 *cp = '/';
3953
3954         /*
3955          * first iteration: process excluded (-x) properties now and gather
3956          * added (-o) properties to be later processed by zfs_valid_proplist()
3957          */
3958         nvp = NULL;
3959         while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
3960                 const char *name = nvpair_name(nvp);
3961                 zfs_prop_t prop = zfs_name_to_prop(name);
3962
3963                 /* "origin" is processed separately, don't handle it here */
3964                 if (prop == ZFS_PROP_ORIGIN)
3965                         continue;
3966
3967                 /*
3968                  * we're trying to override or exclude a property that does not
3969                  * make sense for this type of dataset, but we don't want to
3970                  * fail if the receive is recursive: this comes in handy when
3971                  * the send stream contains, for instance, a child ZVOL and
3972                  * we're trying to receive it with "-o atime=on"
3973                  */
3974                 if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
3975                     !zfs_prop_user(name)) {
3976                         if (recursive)
3977                                 continue;
3978                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3979                             "property '%s' does not apply to datasets of this "
3980                             "type"), name);
3981                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3982                         goto error;
3983                 }
3984
3985                 /* raw streams can't override encryption properties */
3986                 if ((zfs_prop_encryption_key_param(prop) ||
3987                     prop == ZFS_PROP_ENCRYPTION) && raw) {
3988                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3989                             "encryption property '%s' cannot "
3990                             "be set or excluded for raw streams."), name);
3991                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3992                         goto error;
3993                 }
3994
3995                 /* incremental streams can only exclude encryption properties */
3996                 if ((zfs_prop_encryption_key_param(prop) ||
3997                     prop == ZFS_PROP_ENCRYPTION) && !newfs &&
3998                     nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
3999                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4000                             "encryption property '%s' cannot "
4001                             "be set for incremental streams."), name);
4002                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4003                         goto error;
4004                 }
4005
4006                 switch (nvpair_type(nvp)) {
4007                 case DATA_TYPE_BOOLEAN: /* -x property */
4008                         /*
4009                          * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4010                          * a property: this is done by forcing an explicit
4011                          * inherit on the destination so the effective value is
4012                          * not the one we received from the send stream.
4013                          * We do this only if the property is not already
4014                          * locally-set, in which case its value will take
4015                          * priority over the received anyway.
4016                          */
4017                         if (nvlist_exists(origprops, name)) {
4018                                 nvlist_t *attrs;
4019                                 char *source = NULL;
4020
4021                                 attrs = fnvlist_lookup_nvlist(origprops, name);
4022                                 if (nvlist_lookup_string(attrs,
4023                                     ZPROP_SOURCE, &source) == 0 &&
4024                                     strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4025                                         continue;
4026                         }
4027                         /*
4028                          * We can't force an explicit inherit on non-inheritable
4029                          * properties: if we're asked to exclude this kind of
4030                          * values we remove them from "recvprops" input nvlist.
4031                          */
4032                         if (!zfs_prop_inheritable(prop) &&
4033                             !zfs_prop_user(name) && /* can be inherited too */
4034                             nvlist_exists(recvprops, name))
4035                                 fnvlist_remove(recvprops, name);
4036                         else
4037                                 fnvlist_add_nvpair(*oxprops, nvp);
4038                         break;
4039                 case DATA_TYPE_STRING: /* -o property=value */
4040                         fnvlist_add_nvpair(oprops, nvp);
4041                         break;
4042                 default:
4043                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4044                             "property '%s' must be a string or boolean"), name);
4045                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4046                         goto error;
4047                 }
4048         }
4049
4050         if (toplevel) {
4051                 /* convert override strings properties to native */
4052                 if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4053                     oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4054                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4055                         goto error;
4056                 }
4057
4058                 /*
4059                  * zfs_crypto_create() requires the parent name. Get it
4060                  * by truncating the fsname copy stored in namebuf.
4061                  */
4062                 cp = strrchr(namebuf, '/');
4063                 if (cp != NULL)
4064                         *cp = '\0';
4065
4066                 if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4067                     B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4068                         fnvlist_free(voprops);
4069                         ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4070                         goto error;
4071                 }
4072
4073                 /* second pass: process "-o" properties */
4074                 fnvlist_merge(*oxprops, voprops);
4075                 fnvlist_free(voprops);
4076         } else {
4077                 /* override props on child dataset are inherited */
4078                 nvp = NULL;
4079                 while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4080                         const char *name = nvpair_name(nvp);
4081                         fnvlist_add_boolean(*oxprops, name);
4082                 }
4083         }
4084
4085 error:
4086         if (zhp != NULL)
4087                 zfs_close(zhp);
4088         if (zpool_hdl != NULL)
4089                 zpool_close(zpool_hdl);
4090         fnvlist_free(oprops);
4091         return (ret);
4092 }
4093
4094 /*
4095  * Restores a backup of tosnap from the file descriptor specified by infd.
4096  */
4097 static int
4098 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4099     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4100     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4101     avl_tree_t *stream_avl, char **top_zfs,
4102     const char *finalsnap, nvlist_t *cmdprops)
4103 {
4104         time_t begin_time;
4105         int ioctl_err, ioctl_errno, err;
4106         char *cp;
4107         struct drr_begin *drrb = &drr->drr_u.drr_begin;
4108         char errbuf[1024];
4109         const char *chopprefix;
4110         boolean_t newfs = B_FALSE;
4111         boolean_t stream_wantsnewfs;
4112         boolean_t newprops = B_FALSE;
4113         uint64_t read_bytes = 0;
4114         uint64_t errflags = 0;
4115         uint64_t parent_snapguid = 0;
4116         prop_changelist_t *clp = NULL;
4117         nvlist_t *snapprops_nvlist = NULL;
4118         nvlist_t *snapholds_nvlist = NULL;
4119         zprop_errflags_t prop_errflags;
4120         nvlist_t *prop_errors = NULL;
4121         boolean_t recursive;
4122         char *snapname = NULL;
4123         char destsnap[MAXPATHLEN * 2];
4124         char origin[MAXNAMELEN];
4125         char name[MAXPATHLEN];
4126         char tmp_keylocation[MAXNAMELEN];
4127         nvlist_t *rcvprops = NULL; /* props received from the send stream */
4128         nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4129         nvlist_t *origprops = NULL; /* original props (if destination exists) */
4130         zfs_type_t type;
4131         boolean_t toplevel = B_FALSE;
4132         boolean_t zoned = B_FALSE;
4133         boolean_t hastoken = B_FALSE;
4134         boolean_t redacted;
4135         uint8_t *wkeydata = NULL;
4136         uint_t wkeylen = 0;
4137
4138         begin_time = time(NULL);
4139         bzero(origin, MAXNAMELEN);
4140         bzero(tmp_keylocation, MAXNAMELEN);
4141
4142         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4143             "cannot receive"));
4144
4145         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4146             ENOENT);
4147
4148         /* Did the user request holds be skipped via zfs recv -k? */
4149         boolean_t holds = flags->holds && !flags->skipholds;
4150
4151         if (stream_avl != NULL) {
4152                 char *keylocation = NULL;
4153                 nvlist_t *lookup = NULL;
4154                 nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4155                     &snapname);
4156
4157                 (void) nvlist_lookup_uint64(fs, "parentfromsnap",
4158                     &parent_snapguid);
4159                 err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4160                 if (err) {
4161                         VERIFY(0 == nvlist_alloc(&rcvprops, NV_UNIQUE_NAME, 0));
4162                         newprops = B_TRUE;
4163                 }
4164
4165                 /*
4166                  * The keylocation property may only be set on encryption roots,
4167                  * but this dataset might not become an encryption root until
4168                  * recv_fix_encryption_hierarchy() is called. That function
4169                  * will fixup the keylocation anyway, so we temporarily unset
4170                  * the keylocation for now to avoid any errors from the receive
4171                  * ioctl.
4172                  */
4173                 err = nvlist_lookup_string(rcvprops,
4174                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4175                 if (err == 0) {
4176                         strcpy(tmp_keylocation, keylocation);
4177                         (void) nvlist_remove_all(rcvprops,
4178                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4179                 }
4180
4181                 if (flags->canmountoff) {
4182                         VERIFY(0 == nvlist_add_uint64(rcvprops,
4183                             zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0));
4184                 } else if (newprops) {  /* nothing in rcvprops, eliminate it */
4185                         nvlist_free(rcvprops);
4186                         rcvprops = NULL;
4187                         newprops = B_FALSE;
4188                 }
4189                 if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4190                         VERIFY(0 == nvlist_lookup_nvlist(lookup,
4191                             snapname, &snapprops_nvlist));
4192                 }
4193                 if (holds) {
4194                         if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4195                             &lookup)) {
4196                                 VERIFY(0 == nvlist_lookup_nvlist(lookup,
4197                                     snapname, &snapholds_nvlist));
4198                         }
4199                 }
4200         }
4201
4202         cp = NULL;
4203
4204         /*
4205          * Determine how much of the snapshot name stored in the stream
4206          * we are going to tack on to the name they specified on the
4207          * command line, and how much we are going to chop off.
4208          *
4209          * If they specified a snapshot, chop the entire name stored in
4210          * the stream.
4211          */
4212         if (flags->istail) {
4213                 /*
4214                  * A filesystem was specified with -e. We want to tack on only
4215                  * the tail of the sent snapshot path.
4216                  */
4217                 if (strchr(tosnap, '@')) {
4218                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4219                             "argument - snapshot not allowed with -e"));
4220                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4221                         goto out;
4222                 }
4223
4224                 chopprefix = strrchr(sendfs, '/');
4225
4226                 if (chopprefix == NULL) {
4227                         /*
4228                          * The tail is the poolname, so we need to
4229                          * prepend a path separator.
4230                          */
4231                         int len = strlen(drrb->drr_toname);
4232                         cp = malloc(len + 2);
4233                         cp[0] = '/';
4234                         (void) strcpy(&cp[1], drrb->drr_toname);
4235                         chopprefix = cp;
4236                 } else {
4237                         chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4238                 }
4239         } else if (flags->isprefix) {
4240                 /*
4241                  * A filesystem was specified with -d. We want to tack on
4242                  * everything but the first element of the sent snapshot path
4243                  * (all but the pool name).
4244                  */
4245                 if (strchr(tosnap, '@')) {
4246                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4247                             "argument - snapshot not allowed with -d"));
4248                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4249                         goto out;
4250                 }
4251
4252                 chopprefix = strchr(drrb->drr_toname, '/');
4253                 if (chopprefix == NULL)
4254                         chopprefix = strchr(drrb->drr_toname, '@');
4255         } else if (strchr(tosnap, '@') == NULL) {
4256                 /*
4257                  * If a filesystem was specified without -d or -e, we want to
4258                  * tack on everything after the fs specified by 'zfs send'.
4259                  */
4260                 chopprefix = drrb->drr_toname + strlen(sendfs);
4261         } else {
4262                 /* A snapshot was specified as an exact path (no -d or -e). */
4263                 if (recursive) {
4264                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4265                             "cannot specify snapshot name for multi-snapshot "
4266                             "stream"));
4267                         err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4268                         goto out;
4269                 }
4270                 chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4271         }
4272
4273         ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4274         ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4275         ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4276             strchr(sendfs, '/') == NULL);
4277         ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4278             chopprefix[0] == '\0');
4279
4280         /*
4281          * Determine name of destination snapshot.
4282          */
4283         (void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4284         (void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4285         free(cp);
4286         if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4287                 err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4288                 goto out;
4289         }
4290
4291         /*
4292          * Determine the name of the origin snapshot.
4293          */
4294         if (originsnap) {
4295                 (void) strlcpy(origin, originsnap, sizeof (origin));
4296                 if (flags->verbose)
4297                         (void) printf("using provided clone origin %s\n",
4298                             origin);
4299         } else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4300                 if (guid_to_name(hdl, destsnap,
4301                     drrb->drr_fromguid, B_FALSE, origin) != 0) {
4302                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4303                             "local origin for clone %s does not exist"),
4304                             destsnap);
4305                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4306                         goto out;
4307                 }
4308                 if (flags->verbose)
4309                         (void) printf("found clone origin %s\n", origin);
4310         }
4311
4312         if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4313             DMU_BACKUP_FEATURE_DEDUP)) {
4314                 (void) fprintf(stderr,
4315                     gettext("ERROR: \"zfs receive\" no longer supports "
4316                     "deduplicated send streams.  Use\n"
4317                     "the \"zstream redup\" command to convert this stream "
4318                     "to a regular,\n"
4319                     "non-deduplicated stream.\n"));
4320                 err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4321                 goto out;
4322         }
4323
4324         boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4325             DMU_BACKUP_FEATURE_RESUMING;
4326         boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4327             DMU_BACKUP_FEATURE_RAW;
4328         boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4329             DMU_BACKUP_FEATURE_EMBED_DATA;
4330         stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4331             (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4332
4333         if (stream_wantsnewfs) {
4334                 /*
4335                  * if the parent fs does not exist, look for it based on
4336                  * the parent snap GUID
4337                  */
4338                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4339                     "cannot receive new filesystem stream"));
4340
4341                 (void) strcpy(name, destsnap);
4342                 cp = strrchr(name, '/');
4343                 if (cp)
4344                         *cp = '\0';
4345                 if (cp &&
4346                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4347                         char suffix[ZFS_MAX_DATASET_NAME_LEN];
4348                         (void) strcpy(suffix, strrchr(destsnap, '/'));
4349                         if (guid_to_name(hdl, name, parent_snapguid,
4350                             B_FALSE, destsnap) == 0) {
4351                                 *strchr(destsnap, '@') = '\0';
4352                                 (void) strcat(destsnap, suffix);
4353                         }
4354                 }
4355         } else {
4356                 /*
4357                  * If the fs does not exist, look for it based on the
4358                  * fromsnap GUID.
4359                  */
4360                 if (resuming) {
4361                         (void) snprintf(errbuf, sizeof (errbuf),
4362                             dgettext(TEXT_DOMAIN,
4363                             "cannot receive resume stream"));
4364                 } else {
4365                         (void) snprintf(errbuf, sizeof (errbuf),
4366                             dgettext(TEXT_DOMAIN,
4367                             "cannot receive incremental stream"));
4368                 }
4369
4370                 (void) strcpy(name, destsnap);
4371                 *strchr(name, '@') = '\0';
4372
4373                 /*
4374                  * If the exact receive path was specified and this is the
4375                  * topmost path in the stream, then if the fs does not exist we
4376                  * should look no further.
4377                  */
4378                 if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4379                     strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4380                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4381                         char snap[ZFS_MAX_DATASET_NAME_LEN];
4382                         (void) strcpy(snap, strchr(destsnap, '@'));
4383                         if (guid_to_name(hdl, name, drrb->drr_fromguid,
4384                             B_FALSE, destsnap) == 0) {
4385                                 *strchr(destsnap, '@') = '\0';
4386                                 (void) strcat(destsnap, snap);
4387                         }
4388                 }
4389         }
4390
4391         (void) strcpy(name, destsnap);
4392         *strchr(name, '@') = '\0';
4393
4394         redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4395             DMU_BACKUP_FEATURE_REDACTED;
4396
4397         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4398                 zfs_cmd_t zc = {"\0"};
4399                 zfs_handle_t *zhp;
4400                 boolean_t encrypted;
4401
4402                 (void) strcpy(zc.zc_name, name);
4403
4404                 /*
4405                  * Destination fs exists.  It must be one of these cases:
4406                  *  - an incremental send stream
4407                  *  - the stream specifies a new fs (full stream or clone)
4408                  *    and they want us to blow away the existing fs (and
4409                  *    have therefore specified -F and removed any snapshots)
4410                  *  - we are resuming a failed receive.
4411                  */
4412                 if (stream_wantsnewfs) {
4413                         boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4414                         if (!flags->force) {
4415                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4416                                     "destination '%s' exists\n"
4417                                     "must specify -F to overwrite it"), name);
4418                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4419                                 goto out;
4420                         }
4421                         if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4422                             &zc) == 0) {
4423                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4424                                     "destination has snapshots (eg. %s)\n"
4425                                     "must destroy them to overwrite it"),
4426                                     zc.zc_name);
4427                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4428                                 goto out;
4429                         }
4430                         if (is_volume && strrchr(name, '/') == NULL) {
4431                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4432                                     "destination %s is the root dataset\n"
4433                                     "cannot overwrite with a ZVOL"),
4434                                     name);
4435                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4436                                 goto out;
4437                         }
4438                         if (is_volume &&
4439                             zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4440                             &zc) == 0) {
4441                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4442                                     "destination has children (eg. %s)\n"
4443                                     "cannot overwrite with a ZVOL"),
4444                                     zc.zc_name);
4445                                 err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4446                                 goto out;
4447                         }
4448                 }
4449
4450                 if ((zhp = zfs_open(hdl, name,
4451                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4452                         err = -1;
4453                         goto out;
4454                 }
4455
4456                 if (stream_wantsnewfs &&
4457                     zhp->zfs_dmustats.dds_origin[0]) {
4458                         zfs_close(zhp);
4459                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4460                             "destination '%s' is a clone\n"
4461                             "must destroy it to overwrite it"), name);
4462                         err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4463                         goto out;
4464                 }
4465
4466                 /*
4467                  * Raw sends can not be performed as an incremental on top
4468                  * of existing unencrypted datasets. zfs recv -F can't be
4469                  * used to blow away an existing encrypted filesystem. This
4470                  * is because it would require the dsl dir to point to the
4471                  * new key (or lack of a key) and the old key at the same
4472                  * time. The -F flag may still be used for deleting
4473                  * intermediate snapshots that would otherwise prevent the
4474                  * receive from working.
4475                  */
4476                 encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4477                     ZIO_CRYPT_OFF;
4478                 if (!stream_wantsnewfs && !encrypted && raw) {
4479                         zfs_close(zhp);
4480                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4481                             "cannot perform raw receive on top of "
4482                             "existing unencrypted dataset"));
4483                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4484                         goto out;
4485                 }
4486
4487                 if (stream_wantsnewfs && flags->force &&
4488                     ((raw && !encrypted) || encrypted)) {
4489                         zfs_close(zhp);
4490                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4491                             "zfs receive -F cannot be used to destroy an "
4492                             "encrypted filesystem or overwrite an "
4493                             "unencrypted one with an encrypted one"));
4494                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4495                         goto out;
4496                 }
4497
4498                 if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4499                     stream_wantsnewfs) {
4500                         /* We can't do online recv in this case */
4501                         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4502                             flags->forceunmount ? MS_FORCE : 0);
4503                         if (clp == NULL) {
4504                                 zfs_close(zhp);
4505                                 err = -1;
4506                                 goto out;
4507                         }
4508                         if (changelist_prefix(clp) != 0) {
4509                                 changelist_free(clp);
4510                                 zfs_close(zhp);
4511                                 err = -1;
4512                                 goto out;
4513                         }
4514                 }
4515
4516                 /*
4517                  * If we are resuming a newfs, set newfs here so that we will
4518                  * mount it if the recv succeeds this time.  We can tell
4519                  * that it was a newfs on the first recv because the fs
4520                  * itself will be inconsistent (if the fs existed when we
4521                  * did the first recv, we would have received it into
4522                  * .../%recv).
4523                  */
4524                 if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4525                         newfs = B_TRUE;
4526
4527                 /* we want to know if we're zoned when validating -o|-x props */
4528                 zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4529
4530                 /* may need this info later, get it now we have zhp around */
4531                 if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4532                     NULL, NULL, 0, B_TRUE) == 0)
4533                         hastoken = B_TRUE;
4534
4535                 /* gather existing properties on destination */
4536                 origprops = fnvlist_alloc();
4537                 fnvlist_merge(origprops, zhp->zfs_props);
4538                 fnvlist_merge(origprops, zhp->zfs_user_props);
4539
4540                 zfs_close(zhp);
4541         } else {
4542                 zfs_handle_t *zhp;
4543
4544                 /*
4545                  * Destination filesystem does not exist.  Therefore we better
4546                  * be creating a new filesystem (either from a full backup, or
4547                  * a clone).  It would therefore be invalid if the user
4548                  * specified only the pool name (i.e. if the destination name
4549                  * contained no slash character).
4550                  */
4551                 cp = strrchr(name, '/');
4552
4553                 if (!stream_wantsnewfs || cp == NULL) {
4554                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4555                             "destination '%s' does not exist"), name);
4556                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4557                         goto out;
4558                 }
4559
4560                 /*
4561                  * Trim off the final dataset component so we perform the
4562                  * recvbackup ioctl to the filesystems's parent.
4563                  */
4564                 *cp = '\0';
4565
4566                 if (flags->isprefix && !flags->istail && !flags->dryrun &&
4567                     create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4568                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4569                         goto out;
4570                 }
4571
4572                 /* validate parent */
4573                 zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4574                 if (zhp == NULL) {
4575                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4576                         goto out;
4577                 }
4578                 if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4579                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4580                             "parent '%s' is not a filesystem"), name);
4581                         err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4582                         zfs_close(zhp);
4583                         goto out;
4584                 }
4585
4586                 zfs_close(zhp);
4587
4588                 newfs = B_TRUE;
4589                 *cp = '/';
4590         }
4591
4592         if (flags->verbose) {
4593                 (void) printf("%s %s stream of %s into %s\n",
4594                     flags->dryrun ? "would receive" : "receiving",
4595                     drrb->drr_fromguid ? "incremental" : "full",
4596                     drrb->drr_toname, destsnap);
4597                 (void) fflush(stdout);
4598         }
4599
4600         if (flags->dryrun) {
4601                 void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4602
4603                 /*
4604                  * We have read the DRR_BEGIN record, but we have
4605                  * not yet read the payload. For non-dryrun sends
4606                  * this will be done by the kernel, so we must
4607                  * emulate that here, before attempting to read
4608                  * more records.
4609                  */
4610                 err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4611                     flags->byteswap, NULL);
4612                 free(buf);
4613                 if (err != 0)
4614                         goto out;
4615
4616                 err = recv_skip(hdl, infd, flags->byteswap);
4617                 goto out;
4618         }
4619
4620         /*
4621          * If this is the top-level dataset, record it so we can use it
4622          * for recursive operations later.
4623          */
4624         if (top_zfs != NULL &&
4625             (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4626                 toplevel = B_TRUE;
4627                 if (*top_zfs == NULL)
4628                         *top_zfs = zfs_strdup(hdl, name);
4629         }
4630
4631         if (drrb->drr_type == DMU_OST_ZVOL) {
4632                 type = ZFS_TYPE_VOLUME;
4633         } else if (drrb->drr_type == DMU_OST_ZFS) {
4634                 type = ZFS_TYPE_FILESYSTEM;
4635         } else {
4636                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4637                     "invalid record type: 0x%d"), drrb->drr_type);
4638                 err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4639                 goto out;
4640         }
4641         if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4642             stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4643             &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4644                 goto out;
4645
4646         /*
4647          * When sending with properties (zfs send -p), the encryption property
4648          * is not included because it is a SETONCE property and therefore
4649          * treated as read only. However, we are always able to determine its
4650          * value because raw sends will include it in the DRR_BDEGIN payload
4651          * and non-raw sends with properties are not allowed for encrypted
4652          * datasets. Therefore, if this is a non-raw properties stream, we can
4653          * infer that the value should be ZIO_CRYPT_OFF and manually add that
4654          * to the received properties.
4655          */
4656         if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4657             !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4658                 if (oxprops == NULL)
4659                         oxprops = fnvlist_alloc();
4660                 fnvlist_add_uint64(oxprops,
4661                     zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4662         }
4663
4664         err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4665             oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4666             raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4667             NULL, &prop_errors);
4668         ioctl_errno = ioctl_err;
4669         prop_errflags = errflags;
4670
4671         if (err == 0) {
4672                 nvpair_t *prop_err = NULL;
4673
4674                 while ((prop_err = nvlist_next_nvpair(prop_errors,
4675                     prop_err)) != NULL) {
4676                         char tbuf[1024];
4677                         zfs_prop_t prop;
4678                         int intval;
4679
4680                         prop = zfs_name_to_prop(nvpair_name(prop_err));
4681                         (void) nvpair_value_int32(prop_err, &intval);
4682                         if (strcmp(nvpair_name(prop_err),
4683                             ZPROP_N_MORE_ERRORS) == 0) {
4684                                 trunc_prop_errs(intval);
4685                                 break;
4686                         } else if (snapname == NULL || finalsnap == NULL ||
4687                             strcmp(finalsnap, snapname) == 0 ||
4688                             strcmp(nvpair_name(prop_err),
4689                             zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4690                                 /*
4691                                  * Skip the special case of, for example,
4692                                  * "refquota", errors on intermediate
4693                                  * snapshots leading up to a final one.
4694                                  * That's why we have all of the checks above.
4695                                  *
4696                                  * See zfs_ioctl.c's extract_delay_props() for
4697                                  * a list of props which can fail on
4698                                  * intermediate snapshots, but shouldn't
4699                                  * affect the overall receive.
4700                                  */
4701                                 (void) snprintf(tbuf, sizeof (tbuf),
4702                                     dgettext(TEXT_DOMAIN,
4703                                     "cannot receive %s property on %s"),
4704                                     nvpair_name(prop_err), name);
4705                                 zfs_setprop_error(hdl, prop, intval, tbuf);
4706                         }
4707                 }
4708         }
4709
4710         if (err == 0 && snapprops_nvlist) {
4711                 zfs_cmd_t zc = {"\0"};
4712
4713                 (void) strcpy(zc.zc_name, destsnap);
4714                 zc.zc_cookie = B_TRUE; /* received */
4715                 if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
4716                         (void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4717                         zcmd_free_nvlists(&zc);
4718                 }
4719         }
4720         if (err == 0 && snapholds_nvlist) {
4721                 nvpair_t *pair;
4722                 nvlist_t *holds, *errors = NULL;
4723                 int cleanup_fd = -1;
4724
4725                 VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4726                 for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4727                     pair != NULL;
4728                     pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4729                         VERIFY(0 == nvlist_add_string(holds, destsnap,
4730                             nvpair_name(pair)));
4731                 }
4732                 (void) lzc_hold(holds, cleanup_fd, &errors);
4733                 nvlist_free(snapholds_nvlist);
4734                 nvlist_free(holds);
4735         }
4736
4737         if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4738                 /*
4739                  * It may be that this snapshot already exists,
4740                  * in which case we want to consume & ignore it
4741                  * rather than failing.
4742                  */
4743                 avl_tree_t *local_avl;
4744                 nvlist_t *local_nv, *fs;
4745                 cp = strchr(destsnap, '@');
4746
4747                 /*
4748                  * XXX Do this faster by just iterating over snaps in
4749                  * this fs.  Also if zc_value does not exist, we will
4750                  * get a strange "does not exist" error message.
4751                  */
4752                 *cp = '\0';
4753                 if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4754                     B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_TRUE,
4755                     &local_nv, &local_avl) == 0) {
4756                         *cp = '@';
4757                         fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4758                         fsavl_destroy(local_avl);
4759                         nvlist_free(local_nv);
4760
4761                         if (fs != NULL) {
4762                                 if (flags->verbose) {
4763                                         (void) printf("snap %s already exists; "
4764                                             "ignoring\n", destsnap);
4765                                 }
4766                                 err = ioctl_err = recv_skip(hdl, infd,
4767                                     flags->byteswap);
4768                         }
4769                 }
4770                 *cp = '@';
4771         }
4772
4773         if (ioctl_err != 0) {
4774                 switch (ioctl_errno) {
4775                 case ENODEV:
4776                         cp = strchr(destsnap, '@');
4777                         *cp = '\0';
4778                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4779                             "most recent snapshot of %s does not\n"
4780                             "match incremental source"), destsnap);
4781                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4782                         *cp = '@';
4783                         break;
4784                 case ETXTBSY:
4785                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4786                             "destination %s has been modified\n"
4787                             "since most recent snapshot"), name);
4788                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4789                         break;
4790                 case EACCES:
4791                         if (raw && stream_wantsnewfs) {
4792                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4793                                     "failed to create encryption key"));
4794                         } else if (raw && !stream_wantsnewfs) {
4795                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4796                                     "encryption key does not match "
4797                                     "existing key"));
4798                         } else {
4799                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4800                                     "inherited key must be loaded"));
4801                         }
4802                         (void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4803                         break;
4804                 case EEXIST:
4805                         cp = strchr(destsnap, '@');
4806                         if (newfs) {
4807                                 /* it's the containing fs that exists */
4808                                 *cp = '\0';
4809                         }
4810                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4811                             "destination already exists"));
4812                         (void) zfs_error_fmt(hdl, EZFS_EXISTS,
4813                             dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4814                             destsnap);
4815                         *cp = '@';
4816                         break;
4817                 case EINVAL:
4818                         if (flags->resumable) {
4819                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4820                                     "kernel modules must be upgraded to "
4821                                     "receive this stream."));
4822                         } else if (embedded && !raw) {
4823                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4824                                     "incompatible embedded data stream "
4825                                     "feature with encrypted receive."));
4826                         }
4827                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4828                         break;
4829                 case ECKSUM:
4830                 case ZFS_ERR_STREAM_TRUNCATED:
4831                         recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4832                             ioctl_err == ECKSUM);
4833                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4834                         break;
4835                 case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
4836                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4837                             "incremental send stream requires -L "
4838                             "(--large-block), to match previous receive."));
4839                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4840                         break;
4841                 case ENOTSUP:
4842                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4843                             "pool must be upgraded to receive this stream."));
4844                         (void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
4845                         break;
4846                 case EDQUOT:
4847                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4848                             "destination %s space quota exceeded."), name);
4849                         (void) zfs_error(hdl, EZFS_NOSPC, errbuf);
4850                         break;
4851                 case ZFS_ERR_FROM_IVSET_GUID_MISSING:
4852                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4853                             "IV set guid missing. See errata %u at "
4854                             "https://openzfs.github.io/openzfs-docs/msg/"
4855                             "ZFS-8000-ER."),
4856                             ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
4857                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4858                         break;
4859                 case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
4860                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4861                             "IV set guid mismatch. See the 'zfs receive' "
4862                             "man page section\n discussing the limitations "
4863                             "of raw encrypted send streams."));
4864                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4865                         break;
4866                 case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
4867                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4868                             "Spill block flag missing for raw send.\n"
4869                             "The zfs software on the sending system must "
4870                             "be updated."));
4871                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4872                         break;
4873                 case EBUSY:
4874                         if (hastoken) {
4875                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4876                                     "destination %s contains "
4877                                     "partially-complete state from "
4878                                     "\"zfs receive -s\"."), name);
4879                                 (void) zfs_error(hdl, EZFS_BUSY, errbuf);
4880                                 break;
4881                         }
4882                         /* fallthru */
4883                 default:
4884                         (void) zfs_standard_error(hdl, ioctl_errno, errbuf);
4885                 }
4886         }
4887
4888         /*
4889          * Mount the target filesystem (if created).  Also mount any
4890          * children of the target filesystem if we did a replication
4891          * receive (indicated by stream_avl being non-NULL).
4892          */
4893         if (clp) {
4894                 if (!flags->nomount)
4895                         err |= changelist_postfix(clp);
4896                 changelist_free(clp);
4897         }
4898
4899         if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
4900                 flags->domount = B_TRUE;
4901
4902         if (prop_errflags & ZPROP_ERR_NOCLEAR) {
4903                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4904                     "failed to clear unreceived properties on %s"), name);
4905                 (void) fprintf(stderr, "\n");
4906         }
4907         if (prop_errflags & ZPROP_ERR_NORESTORE) {
4908                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4909                     "failed to restore original properties on %s"), name);
4910                 (void) fprintf(stderr, "\n");
4911         }
4912
4913         if (err || ioctl_err) {
4914                 err = -1;
4915                 goto out;
4916         }
4917
4918         if (flags->verbose) {
4919                 char buf1[64];
4920                 char buf2[64];
4921                 uint64_t bytes = read_bytes;
4922                 time_t delta = time(NULL) - begin_time;
4923                 if (delta == 0)
4924                         delta = 1;
4925                 zfs_nicebytes(bytes, buf1, sizeof (buf1));
4926                 zfs_nicebytes(bytes/delta, buf2, sizeof (buf1));
4927
4928                 (void) printf("received %s stream in %lld seconds (%s/sec)\n",
4929                     buf1, (longlong_t)delta, buf2);
4930         }
4931
4932         err = 0;
4933 out:
4934         if (prop_errors != NULL)
4935                 nvlist_free(prop_errors);
4936
4937         if (tmp_keylocation[0] != '\0') {
4938                 VERIFY(0 == nvlist_add_string(rcvprops,
4939                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation));
4940         }
4941
4942         if (newprops)
4943                 nvlist_free(rcvprops);
4944
4945         nvlist_free(oxprops);
4946         nvlist_free(origprops);
4947
4948         return (err);
4949 }
4950
4951 /*
4952  * Check properties we were asked to override (both -o|-x)
4953  */
4954 static boolean_t
4955 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
4956     const char *errbuf)
4957 {
4958         nvpair_t *nvp;
4959         zfs_prop_t prop;
4960         const char *name;
4961
4962         nvp = NULL;
4963         while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
4964                 name = nvpair_name(nvp);
4965                 prop = zfs_name_to_prop(name);
4966
4967                 if (prop == ZPROP_INVAL) {
4968                         if (!zfs_prop_user(name)) {
4969                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4970                                     "invalid property '%s'"), name);
4971                                 return (B_FALSE);
4972                         }
4973                         continue;
4974                 }
4975                 /*
4976                  * "origin" is readonly but is used to receive datasets as
4977                  * clones so we don't raise an error here
4978                  */
4979                 if (prop == ZFS_PROP_ORIGIN)
4980                         continue;
4981
4982                 /* encryption params have their own verification later */
4983                 if (prop == ZFS_PROP_ENCRYPTION ||
4984                     zfs_prop_encryption_key_param(prop))
4985                         continue;
4986
4987                 /*
4988                  * cannot override readonly, set-once and other specific
4989                  * settable properties
4990                  */
4991                 if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
4992                     prop == ZFS_PROP_VOLSIZE) {
4993                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4994                             "invalid property '%s'"), name);
4995                         return (B_FALSE);
4996                 }
4997         }
4998
4999         return (B_TRUE);
5000 }
5001
5002 static int
5003 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5004     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5005     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5006     const char *finalsnap, nvlist_t *cmdprops)
5007 {
5008         int err;
5009         dmu_replay_record_t drr, drr_noswap;
5010         struct drr_begin *drrb = &drr.drr_u.drr_begin;
5011         char errbuf[1024];
5012         zio_cksum_t zcksum = { { 0 } };
5013         uint64_t featureflags;
5014         int hdrtype;
5015
5016         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5017             "cannot receive"));
5018
5019         /* check cmdline props, raise an error if they cannot be received */
5020         if (!zfs_receive_checkprops(hdl, cmdprops, errbuf)) {
5021                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5022         }
5023
5024         if (flags->isprefix &&
5025             !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5026                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5027                     "(%s) does not exist"), tosnap);
5028                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5029         }
5030         if (originsnap &&
5031             !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5032                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5033                     "(%s) does not exist"), originsnap);
5034                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5035         }
5036
5037         /* read in the BEGIN record */
5038         if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5039             &zcksum)))
5040                 return (err);
5041
5042         if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5043                 /* It's the double end record at the end of a package */
5044                 return (ENODATA);
5045         }
5046
5047         /* the kernel needs the non-byteswapped begin record */
5048         drr_noswap = drr;
5049
5050         flags->byteswap = B_FALSE;
5051         if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5052                 /*
5053                  * We computed the checksum in the wrong byteorder in
5054                  * recv_read() above; do it again correctly.
5055                  */
5056                 bzero(&zcksum, sizeof (zio_cksum_t));
5057                 fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5058                 flags->byteswap = B_TRUE;
5059
5060                 drr.drr_type = BSWAP_32(drr.drr_type);
5061                 drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5062                 drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5063                 drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5064                 drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5065                 drrb->drr_type = BSWAP_32(drrb->drr_type);
5066                 drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5067                 drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5068                 drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5069         }
5070
5071         if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5072                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5073                     "stream (bad magic number)"));
5074                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5075         }
5076
5077         featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5078         hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5079
5080         if (!DMU_STREAM_SUPPORTED(featureflags) ||
5081             (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5082                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5083                     "stream has unsupported feature, feature flags = %lx"),
5084                     featureflags);
5085                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5086         }
5087
5088         /* Holds feature is set once in the compound stream header. */
5089         if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5090                 flags->holds = B_TRUE;
5091
5092         if (strchr(drrb->drr_toname, '@') == NULL) {
5093                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5094                     "stream (bad snapshot name)"));
5095                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5096         }
5097
5098         if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5099                 char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5100                 if (sendfs == NULL) {
5101                         /*
5102                          * We were not called from zfs_receive_package(). Get
5103                          * the fs specified by 'zfs send'.
5104                          */
5105                         char *cp;
5106                         (void) strlcpy(nonpackage_sendfs,
5107                             drr.drr_u.drr_begin.drr_toname,
5108                             sizeof (nonpackage_sendfs));
5109                         if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5110                                 *cp = '\0';
5111                         sendfs = nonpackage_sendfs;
5112                         VERIFY(finalsnap == NULL);
5113                 }
5114                 return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5115                     &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5116                     finalsnap, cmdprops));
5117         } else {
5118                 assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5119                     DMU_COMPOUNDSTREAM);
5120                 return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5121                     &zcksum, top_zfs, cmdprops));
5122         }
5123 }
5124
5125 /*
5126  * Restores a backup of tosnap from the file descriptor specified by infd.
5127  * Return 0 on total success, -2 if some things couldn't be
5128  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5129  * (-1 will override -2, if -1 and the resumable flag was specified the
5130  * transfer can be resumed if the sending side supports it).
5131  */
5132 int
5133 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5134     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5135 {
5136         char *top_zfs = NULL;
5137         int err;
5138         struct stat sb;
5139         char *originsnap = NULL;
5140
5141         /*
5142          * The only way fstat can fail is if we do not have a valid file
5143          * descriptor.
5144          */
5145         if (fstat(infd, &sb) == -1) {
5146                 perror("fstat");
5147                 return (-2);
5148         }
5149
5150         /*
5151          * It is not uncommon for gigabytes to be processed in zfs receive.
5152          * Speculatively increase the buffer size if supported by the platform.
5153          */
5154         if (S_ISFIFO(sb.st_mode))
5155                 libzfs_set_pipe_max(infd);
5156
5157         if (props) {
5158                 err = nvlist_lookup_string(props, "origin", &originsnap);
5159                 if (err && err != ENOENT)
5160                         return (err);
5161         }
5162
5163         err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5164             stream_avl, &top_zfs, NULL, props);
5165
5166         if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5167                 zfs_handle_t *zhp = NULL;
5168                 prop_changelist_t *clp = NULL;
5169
5170                 zhp = zfs_open(hdl, top_zfs,
5171                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5172                 if (zhp == NULL) {
5173                         err = -1;
5174                         goto out;
5175                 } else {
5176                         if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5177                                 zfs_close(zhp);
5178                                 goto out;
5179                         }
5180
5181                         clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5182                             CL_GATHER_MOUNT_ALWAYS,
5183                             flags->forceunmount ? MS_FORCE : 0);
5184                         zfs_close(zhp);
5185                         if (clp == NULL) {
5186                                 err = -1;
5187                                 goto out;
5188                         }
5189
5190                         /* mount and share received datasets */
5191                         err = changelist_postfix(clp);
5192                         changelist_free(clp);
5193                         if (err != 0)
5194                                 err = -1;
5195                 }
5196         }
5197
5198 out:
5199         if (top_zfs)
5200                 free(top_zfs);
5201
5202         return (err);
5203 }