lib/libzfs/libzfs_sendrecv.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
  25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
  27  * All rights reserved
  28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
  29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
  30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
  31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
  32  * Copyright (c) 2019 Datto Inc.
  33  */
  34
  35 #include <assert.h>
  36 #include <ctype.h>
  37 #include <errno.h>
  38 #include <libintl.h>
  39 #include <stdio.h>
  40 #include <stdlib.h>
  41 #include <strings.h>
  42 #include <unistd.h>
  43 #include <stddef.h>
  44 #include <fcntl.h>
  45 #include <sys/mount.h>
  46 #include <sys/mntent.h>
  47 #include <sys/mnttab.h>
  48 #include <sys/avl.h>
  49 #include <sys/debug.h>
  50 #include <sys/stat.h>
  51 #include <pthread.h>
  52 #include <umem.h>
  53 #include <time.h>
  54
  55 #include <libzfs.h>
  56 #include <libzfs_core.h>
  57 #include <libzutil.h>
  58
  59 #include "zfs_namecheck.h"
  60 #include "zfs_prop.h"
  61 #include "zfs_fletcher.h"
  62 #include "libzfs_impl.h"
  63 #include <cityhash.h>
  64 #include <zlib.h>
  65 #include <sys/zio_checksum.h>
  66 #include <sys/dsl_crypt.h>
  67 #include <sys/ddt.h>
  68 #include <sys/socket.h>
  69 #include <sys/sha2.h>
  70
  71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
  72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
  73     const char *, nvlist_t *);
  74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
  75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
  76     uint64_t num_redact_snaps, char *name);
  77 static int guid_to_name(libzfs_handle_t *, const char *,
  78     uint64_t, boolean_t, char *);
  79
  80 typedef struct progress_arg {
  81         zfs_handle_t *pa_zhp;
  82         int pa_fd;
  83         boolean_t pa_parsable;
  84         boolean_t pa_estimate;
  85         int pa_verbosity;
  86 } progress_arg_t;
  87
  88 static int
  89 dump_record(dmu_replay_record_t *drr, void *payload, size_t payload_len,
  90     zio_cksum_t *zc, int outfd)
  91 {
  92         ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
  93             ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
  94         fletcher_4_incremental_native(drr,
  95             offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
  96         if (drr->drr_type != DRR_BEGIN) {
  97                 ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
  98                     drr_checksum.drr_checksum));
  99                 drr->drr_u.drr_checksum.drr_checksum = *zc;
 100         }
 101         fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
 102             sizeof (zio_cksum_t), zc);
 103         if (write(outfd, drr, sizeof (*drr)) == -1)
 104                 return (errno);
 105         if (payload_len != 0) {
 106                 fletcher_4_incremental_native(payload, payload_len, zc);
 107                 if (write(outfd, payload, payload_len) == -1)
 108                         return (errno);
 109         }
 110         return (0);
 111 }
 112
 113 /*
 114  * Routines for dealing with the AVL tree of fs-nvlists
 115  */
 116 typedef struct fsavl_node {
 117         avl_node_t fn_node;
 118         nvlist_t *fn_nvfs;
 119         char *fn_snapname;
 120         uint64_t fn_guid;
 121 } fsavl_node_t;
 122
 123 static int
 124 fsavl_compare(const void *arg1, const void *arg2)
 125 {
 126         const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
 127         const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
 128
 129         return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
 130 }
 131
 132 /*
 133  * Given the GUID of a snapshot, find its containing filesystem and
 134  * (optionally) name.
 135  */
 136 static nvlist_t *
 137 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
 138 {
 139         fsavl_node_t fn_find;
 140         fsavl_node_t *fn;
 141
 142         fn_find.fn_guid = snapguid;
 143
 144         fn = avl_find(avl, &fn_find, NULL);
 145         if (fn) {
 146                 if (snapname)
 147                         *snapname = fn->fn_snapname;
 148                 return (fn->fn_nvfs);
 149         }
 150         return (NULL);
 151 }
 152
 153 static void
 154 fsavl_destroy(avl_tree_t *avl)
 155 {
 156         fsavl_node_t *fn;
 157         void *cookie;
 158
 159         if (avl == NULL)
 160                 return;
 161
 162         cookie = NULL;
 163         while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
 164                 free(fn);
 165         avl_destroy(avl);
 166         free(avl);
 167 }
 168
 169 /*
 170  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
 171  */
 172 static avl_tree_t *
 173 fsavl_create(nvlist_t *fss)
 174 {
 175         avl_tree_t *fsavl;
 176         nvpair_t *fselem = NULL;
 177
 178         if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
 179                 return (NULL);
 180
 181         avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
 182             offsetof(fsavl_node_t, fn_node));
 183
 184         while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
 185                 nvlist_t *nvfs, *snaps;
 186                 nvpair_t *snapelem = NULL;
 187
 188                 nvfs = fnvpair_value_nvlist(fselem);
 189                 snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
 190
 191                 while ((snapelem =
 192                     nvlist_next_nvpair(snaps, snapelem)) != NULL) {
 193                         fsavl_node_t *fn;
 194
 195                         if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
 196                                 fsavl_destroy(fsavl);
 197                                 return (NULL);
 198                         }
 199                         fn->fn_nvfs = nvfs;
 200                         fn->fn_snapname = nvpair_name(snapelem);
 201                         fn->fn_guid = fnvpair_value_uint64(snapelem);
 202
 203                         /*
 204                          * Note: if there are multiple snaps with the
 205                          * same GUID, we ignore all but one.
 206                          */
 207                         avl_index_t where = 0;
 208                         if (avl_find(fsavl, fn, &where) == NULL)
 209                                 avl_insert(fsavl, fn, where);
 210                         else
 211                                 free(fn);
 212                 }
 213         }
 214
 215         return (fsavl);
 216 }
 217
 218 /*
 219  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
 220  */
 221 typedef struct send_data {
 222         /*
 223          * assigned inside every recursive call,
 224          * restored from *_save on return:
 225          *
 226          * guid of fromsnap snapshot in parent dataset
 227          * txg of fromsnap snapshot in current dataset
 228          * txg of tosnap snapshot in current dataset
 229          */
 230
 231         uint64_t parent_fromsnap_guid;
 232         uint64_t fromsnap_txg;
 233         uint64_t tosnap_txg;
 234
 235         /* the nvlists get accumulated during depth-first traversal */
 236         nvlist_t *parent_snaps;
 237         nvlist_t *fss;
 238         nvlist_t *snapprops;
 239         nvlist_t *snapholds;    /* user holds */
 240
 241         /* send-receive configuration, does not change during traversal */
 242         const char *fsname;
 243         const char *fromsnap;
 244         const char *tosnap;
 245         boolean_t recursive;
 246         boolean_t raw;
 247         boolean_t doall;
 248         boolean_t replicate;
 249         boolean_t skipmissing;
 250         boolean_t verbose;
 251         boolean_t backup;
 252         boolean_t seenfrom;
 253         boolean_t seento;
 254         boolean_t holds;        /* were holds requested with send -h */
 255         boolean_t props;
 256
 257         /*
 258          * The header nvlist is of the following format:
 259          * {
 260          *   "tosnap" -> string
 261          *   "fromsnap" -> string (if incremental)
 262          *   "fss" -> {
 263          *      id -> {
 264          *
 265          *       "name" -> string (full name; for debugging)
 266          *       "parentfromsnap" -> number (guid of fromsnap in parent)
 267          *
 268          *       "props" -> { name -> value (only if set here) }
 269          *       "snaps" -> { name (lastname) -> number (guid) }
 270          *       "snapprops" -> { name (lastname) -> { name -> value } }
 271          *       "snapholds" -> { name (lastname) -> { holdname -> crtime } }
 272          *
 273          *       "origin" -> number (guid) (if clone)
 274          *       "is_encroot" -> boolean
 275          *       "sent" -> boolean (not on-disk)
 276          *      }
 277          *   }
 278          * }
 279          *
 280          */
 281 } send_data_t;
 282
 283 static void
 284 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
 285
 286 /*
 287  * Collect guid, valid props, optionally holds, etc. of a snapshot.
 288  * This interface is intended for use as a zfs_iter_snapshots_sorted visitor.
 289  */
 290 static int
 291 send_iterate_snap(zfs_handle_t *zhp, void *arg)
 292 {
 293         send_data_t *sd = arg;
 294         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 295         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 296         boolean_t isfromsnap, istosnap, istosnapwithnofrom;
 297         char *snapname = strrchr(zhp->zfs_name, '@') + 1;
 298         const char *from = sd->fromsnap;
 299         const char *to = sd->tosnap;
 300
 301         assert(snapname != (NULL + 1));
 302
 303         isfromsnap = (from != NULL && strcmp(from, snapname) == 0);
 304         istosnap = (to != NULL && strcmp(to, snapname) == 0);
 305         istosnapwithnofrom = (istosnap && from == NULL);
 306
 307         if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 308                 if (sd->verbose) {
 309                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 310                             "skipping snapshot %s because it was created "
 311                             "after the destination snapshot (%s)\n"),
 312                             zhp->zfs_name, to);
 313                 }
 314                 zfs_close(zhp);
 315                 return (0);
 316         }
 317
 318         fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
 319
 320         /*
 321          * NB: if there is no fromsnap here (it's a newly created fs in
 322          * an incremental replication), we will substitute the tosnap.
 323          */
 324         if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap))
 325                 sd->parent_fromsnap_guid = guid;
 326
 327         if (!sd->recursive) {
 328                 /*
 329                  * To allow a doall stream to work properly
 330                  * with a NULL fromsnap
 331                  */
 332                 if (sd->doall && from == NULL && !sd->seenfrom)
 333                         sd->seenfrom = B_TRUE;
 334
 335                 if (!sd->seenfrom && isfromsnap) {
 336                         sd->seenfrom = B_TRUE;
 337                         zfs_close(zhp);
 338                         return (0);
 339                 }
 340
 341                 if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
 342                         zfs_close(zhp);
 343                         return (0);
 344                 }
 345
 346                 if (istosnap)
 347                         sd->seento = B_TRUE;
 348         }
 349
 350         nvlist_t *nv = fnvlist_alloc();
 351         send_iterate_prop(zhp, sd->backup, nv);
 352         fnvlist_add_nvlist(sd->snapprops, snapname, nv);
 353         fnvlist_free(nv);
 354
 355         if (sd->holds) {
 356                 nvlist_t *holds;
 357                 if (lzc_get_holds(zhp->zfs_name, &holds) == 0) {
 358                         fnvlist_add_nvlist(sd->snapholds, snapname, holds);
 359                         fnvlist_free(holds);
 360                 }
 361         }
 362
 363         zfs_close(zhp);
 364         return (0);
 365 }
 366
 367 /*
 368  * Collect all valid props from the handle snap into an nvlist.
 369  */
 370 static void
 371 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
 372 {
 373         nvlist_t *props;
 374
 375         if (received_only)
 376                 props = zfs_get_recvd_props(zhp);
 377         else
 378                 props = zhp->zfs_props;
 379
 380         nvpair_t *elem = NULL;
 381         while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
 382                 char *propname = nvpair_name(elem);
 383                 zfs_prop_t prop = zfs_name_to_prop(propname);
 384
 385                 if (!zfs_prop_user(propname)) {
 386                         /*
 387                          * Realistically, this should never happen.  However,
 388                          * we want the ability to add DSL properties without
 389                          * needing to make incompatible version changes.  We
 390                          * need to ignore unknown properties to allow older
 391                          * software to still send datasets containing these
 392                          * properties, with the unknown properties elided.
 393                          */
 394                         if (prop == ZPROP_INVAL)
 395                                 continue;
 396
 397                         if (zfs_prop_readonly(prop))
 398                                 continue;
 399                 }
 400
 401                 nvlist_t *propnv = fnvpair_value_nvlist(elem);
 402
 403                 boolean_t isspacelimit = (prop == ZFS_PROP_QUOTA ||
 404                     prop == ZFS_PROP_RESERVATION ||
 405                     prop == ZFS_PROP_REFQUOTA ||
 406                     prop == ZFS_PROP_REFRESERVATION);
 407                 if (isspacelimit && zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
 408                         continue;
 409
 410                 char *source;
 411                 if (nvlist_lookup_string(propnv, ZPROP_SOURCE, &source) == 0) {
 412                         if (strcmp(source, zhp->zfs_name) != 0 &&
 413                             strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
 414                                 continue;
 415                 } else {
 416                         /*
 417                          * May have no source before SPA_VERSION_RECVD_PROPS,
 418                          * but is still modifiable.
 419                          */
 420                         if (!isspacelimit)
 421                                 continue;
 422                 }
 423
 424                 if (zfs_prop_user(propname) ||
 425                     zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
 426                         char *value;
 427                         value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
 428                         fnvlist_add_string(nv, propname, value);
 429                 } else {
 430                         uint64_t value;
 431                         value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
 432                         fnvlist_add_uint64(nv, propname, value);
 433                 }
 434         }
 435 }
 436
 437 /*
 438  * returns snapshot creation txg
 439  * and returns 0 if the snapshot does not exist
 440  */
 441 static uint64_t
 442 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
 443 {
 444         char name[ZFS_MAX_DATASET_NAME_LEN];
 445         uint64_t txg = 0;
 446
 447         if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
 448                 return (txg);
 449
 450         (void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
 451         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
 452                 zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
 453                 if (zhp != NULL) {
 454                         txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
 455                         zfs_close(zhp);
 456                 }
 457         }
 458
 459         return (txg);
 460 }
 461
 462 /*
 463  * Recursively generate nvlists describing datasets.  See comment
 464  * for the data structure send_data_t above for description of contents
 465  * of the nvlist.
 466  */
 467 static int
 468 send_iterate_fs(zfs_handle_t *zhp, void *arg)
 469 {
 470         send_data_t *sd = arg;
 471         nvlist_t *nvfs = NULL, *nv = NULL;
 472         int rv = 0;
 473         uint64_t min_txg = 0, max_txg = 0;
 474         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 475         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 476         uint64_t fromsnap_txg, tosnap_txg;
 477         char guidstring[64];
 478
 479         /* These fields are restored on return from a recursive call. */
 480         uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
 481         uint64_t fromsnap_txg_save = sd->fromsnap_txg;
 482         uint64_t tosnap_txg_save = sd->tosnap_txg;
 483
 484         fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
 485         if (fromsnap_txg != 0)
 486                 sd->fromsnap_txg = fromsnap_txg;
 487
 488         tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
 489         if (tosnap_txg != 0)
 490                 sd->tosnap_txg = tosnap_txg;
 491
 492         /*
 493          * On the send side, if the current dataset does not have tosnap,
 494          * perform two additional checks:
 495          *
 496          * - Skip sending the current dataset if it was created later than
 497          *   the parent tosnap.
 498          * - Return error if the current dataset was created earlier than
 499          *   the parent tosnap, unless --skip-missing specified. Then
 500          *   just print a warning.
 501          */
 502         if (sd->tosnap != NULL && tosnap_txg == 0) {
 503                 if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 504                         if (sd->verbose) {
 505                                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 506                                     "skipping dataset %s: snapshot %s does "
 507                                     "not exist\n"), zhp->zfs_name, sd->tosnap);
 508                         }
 509                 } else if (sd->skipmissing) {
 510                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 511                             "WARNING: skipping dataset %s and its children:"
 512                             " snapshot %s does not exist\n"),
 513                             zhp->zfs_name, sd->tosnap);
 514                 } else {
 515                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 516                             "cannot send %s@%s%s: snapshot %s@%s does not "
 517                             "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
 518                             dgettext(TEXT_DOMAIN, " recursively") : "",
 519                             zhp->zfs_name, sd->tosnap);
 520                         rv = EZFS_NOENT;
 521                 }
 522                 goto out;
 523         }
 524
 525         nvfs = fnvlist_alloc();
 526         fnvlist_add_string(nvfs, "name", zhp->zfs_name);
 527         fnvlist_add_uint64(nvfs, "parentfromsnap", sd->parent_fromsnap_guid);
 528
 529         if (zhp->zfs_dmustats.dds_origin[0] != '\0') {
 530                 zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
 531                     zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
 532                 if (origin == NULL) {
 533                         rv = -1;
 534                         goto out;
 535                 }
 536                 fnvlist_add_uint64(nvfs, "origin",
 537                     origin->zfs_dmustats.dds_guid);
 538                 zfs_close(origin);
 539         }
 540
 541         /* Iterate over props. */
 542         if (sd->props || sd->backup || sd->recursive) {
 543                 nv = fnvlist_alloc();
 544                 send_iterate_prop(zhp, sd->backup, nv);
 545                 fnvlist_add_nvlist(nvfs, "props", nv);
 546         }
 547         if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
 548                 boolean_t encroot;
 549
 550                 /* Determine if this dataset is an encryption root. */
 551                 if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
 552                         rv = -1;
 553                         goto out;
 554                 }
 555
 556                 if (encroot)
 557                         fnvlist_add_boolean(nvfs, "is_encroot");
 558
 559                 /*
 560                  * Encrypted datasets can only be sent with properties if
 561                  * the raw flag is specified because the receive side doesn't
 562                  * currently have a mechanism for recursively asking the user
 563                  * for new encryption parameters.
 564                  */
 565                 if (!sd->raw) {
 566                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 567                             "cannot send %s@%s: encrypted dataset %s may not "
 568                             "be sent with properties without the raw flag\n"),
 569                             sd->fsname, sd->tosnap, zhp->zfs_name);
 570                         rv = -1;
 571                         goto out;
 572                 }
 573
 574         }
 575
 576         /*
 577          * Iterate over snaps, and set sd->parent_fromsnap_guid.
 578          *
 579          * If this is a "doall" send, a replicate send or we're just trying
 580          * to gather a list of previous snapshots, iterate through all the
 581          * snaps in the txg range. Otherwise just look at the one we're
 582          * interested in.
 583          */
 584         sd->parent_fromsnap_guid = 0;
 585         sd->parent_snaps = fnvlist_alloc();
 586         sd->snapprops = fnvlist_alloc();
 587         if (sd->holds)
 588                 sd->snapholds = fnvlist_alloc();
 589         if (sd->doall || sd->replicate || sd->tosnap == NULL) {
 590                 if (!sd->replicate && fromsnap_txg != 0)
 591                         min_txg = fromsnap_txg;
 592                 if (!sd->replicate && tosnap_txg != 0)
 593                         max_txg = tosnap_txg;
 594                 (void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
 595                     min_txg, max_txg);
 596         } else {
 597                 char snapname[MAXPATHLEN];
 598                 zfs_handle_t *snap;
 599
 600                 (void) snprintf(snapname, sizeof (snapname), "%s@%s",
 601                     zhp->zfs_name, sd->tosnap);
 602                 if (sd->fromsnap != NULL)
 603                         sd->seenfrom = B_TRUE;
 604                 snap = zfs_open(zhp->zfs_hdl, snapname, ZFS_TYPE_SNAPSHOT);
 605                 if (snap != NULL)
 606                         (void) send_iterate_snap(snap, sd);
 607         }
 608
 609         fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
 610         fnvlist_free(sd->parent_snaps);
 611         fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
 612         fnvlist_free(sd->snapprops);
 613         if (sd->holds) {
 614                 fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
 615                 fnvlist_free(sd->snapholds);
 616         }
 617
 618         /* Do not allow the size of the properties list to exceed the limit */
 619         if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
 620             zhp->zfs_hdl->libzfs_max_nvlist) {
 621                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 622                     "warning: cannot send %s@%s: the size of the list of "
 623                     "snapshots and properties is too large to be received "
 624                     "successfully.\n"
 625                     "Select a smaller number of snapshots to send.\n"),
 626                     zhp->zfs_name, sd->tosnap);
 627                 rv = EZFS_NOSPC;
 628                 goto out;
 629         }
 630         /* Add this fs to nvlist. */
 631         (void) snprintf(guidstring, sizeof (guidstring),
 632             "0x%llx", (longlong_t)guid);
 633         fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
 634
 635         /* Iterate over children. */
 636         if (sd->recursive)
 637                 rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
 638
 639 out:
 640         /* Restore saved fields. */
 641         sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
 642         sd->fromsnap_txg = fromsnap_txg_save;
 643         sd->tosnap_txg = tosnap_txg_save;
 644
 645         fnvlist_free(nv);
 646         fnvlist_free(nvfs);
 647
 648         zfs_close(zhp);
 649         return (rv);
 650 }
 651
 652 static int
 653 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
 654     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
 655     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
 656     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
 657     avl_tree_t **avlp)
 658 {
 659         zfs_handle_t *zhp;
 660         send_data_t sd = { 0 };
 661         int error;
 662
 663         zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
 664         if (zhp == NULL)
 665                 return (EZFS_BADTYPE);
 666
 667         sd.fss = fnvlist_alloc();
 668         sd.fsname = fsname;
 669         sd.fromsnap = fromsnap;
 670         sd.tosnap = tosnap;
 671         sd.recursive = recursive;
 672         sd.raw = raw;
 673         sd.doall = doall;
 674         sd.replicate = replicate;
 675         sd.skipmissing = skipmissing;
 676         sd.verbose = verbose;
 677         sd.backup = backup;
 678         sd.holds = holds;
 679         sd.props = props;
 680
 681         if ((error = send_iterate_fs(zhp, &sd)) != 0) {
 682                 fnvlist_free(sd.fss);
 683                 if (avlp != NULL)
 684                         *avlp = NULL;
 685                 *nvlp = NULL;
 686                 return (error);
 687         }
 688
 689         if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
 690                 fnvlist_free(sd.fss);
 691                 *nvlp = NULL;
 692                 return (EZFS_NOMEM);
 693         }
 694
 695         *nvlp = sd.fss;
 696         return (0);
 697 }
 698
 699 /*
 700  * Routines specific to "zfs send"
 701  */
 702 typedef struct send_dump_data {
 703         /* these are all just the short snapname (the part after the @) */
 704         const char *fromsnap;
 705         const char *tosnap;
 706         char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
 707         uint64_t prevsnap_obj;
 708         boolean_t seenfrom, seento, replicate, doall, fromorigin;
 709         boolean_t dryrun, parsable, progress, embed_data, std_out;
 710         boolean_t large_block, compress, raw, holds;
 711         int outfd;
 712         boolean_t err;
 713         nvlist_t *fss;
 714         nvlist_t *snapholds;
 715         avl_tree_t *fsavl;
 716         snapfilter_cb_t *filter_cb;
 717         void *filter_cb_arg;
 718         nvlist_t *debugnv;
 719         char holdtag[ZFS_MAX_DATASET_NAME_LEN];
 720         int cleanup_fd;
 721         int verbosity;
 722         uint64_t size;
 723 } send_dump_data_t;
 724
 725 static int
 726 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
 727     enum lzc_send_flags flags, uint64_t *spacep)
 728 {
 729         assert(snapname != NULL);
 730
 731         int error = lzc_send_space(snapname, from, flags, spacep);
 732         if (error == 0)
 733                 return (0);
 734
 735         char errbuf[1024];
 736         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 737             "warning: cannot estimate space for '%s'"), snapname);
 738
 739         libzfs_handle_t *hdl = zhp->zfs_hdl;
 740         switch (error) {
 741         case EXDEV:
 742                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 743                     "not an earlier snapshot from the same fs"));
 744                 return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 745
 746         case ENOENT:
 747                 if (zfs_dataset_exists(hdl, snapname,
 748                     ZFS_TYPE_SNAPSHOT)) {
 749                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 750                             "incremental source (%s) does not exist"),
 751                             snapname);
 752                 }
 753                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
 754
 755         case EDQUOT:
 756         case EFBIG:
 757         case EIO:
 758         case ENOLINK:
 759         case ENOSPC:
 760         case ENOSTR:
 761         case ENXIO:
 762         case EPIPE:
 763         case ERANGE:
 764         case EFAULT:
 765         case EROFS:
 766         case EINVAL:
 767                 zfs_error_aux(hdl, "%s", strerror(error));
 768                 return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 769
 770         default:
 771                 return (zfs_standard_error(hdl, error, errbuf));
 772         }
 773 }
 774
 775 /*
 776  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
 777  * NULL) to the file descriptor specified by outfd.
 778  */
 779 static int
 780 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
 781     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
 782     nvlist_t *debugnv)
 783 {
 784         zfs_cmd_t zc = {"\0"};
 785         libzfs_handle_t *hdl = zhp->zfs_hdl;
 786         nvlist_t *thisdbg;
 787
 788         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 789         assert(fromsnap_obj == 0 || !fromorigin);
 790
 791         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 792         zc.zc_cookie = outfd;
 793         zc.zc_obj = fromorigin;
 794         zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
 795         zc.zc_fromobj = fromsnap_obj;
 796         zc.zc_flags = flags;
 797
 798         if (debugnv != NULL) {
 799                 thisdbg = fnvlist_alloc();
 800                 if (fromsnap != NULL && fromsnap[0] != '\0')
 801                         fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
 802         }
 803
 804         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
 805                 char errbuf[1024];
 806                 int error = errno;
 807
 808                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 809                     "warning: cannot send '%s'"), zhp->zfs_name);
 810
 811                 if (debugnv != NULL) {
 812                         fnvlist_add_uint64(thisdbg, "error", error);
 813                         fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
 814                         fnvlist_free(thisdbg);
 815                 }
 816
 817                 switch (error) {
 818                 case EXDEV:
 819                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 820                             "not an earlier snapshot from the same fs"));
 821                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 822
 823                 case EACCES:
 824                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 825                             "source key must be loaded"));
 826                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
 827
 828                 case ENOENT:
 829                         if (zfs_dataset_exists(hdl, zc.zc_name,
 830                             ZFS_TYPE_SNAPSHOT)) {
 831                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 832                                     "incremental source (@%s) does not exist"),
 833                                     zc.zc_value);
 834                         }
 835                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
 836
 837                 case EDQUOT:
 838                 case EFBIG:
 839                 case EIO:
 840                 case ENOLINK:
 841                 case ENOSPC:
 842                 case ENOSTR:
 843                 case ENXIO:
 844                 case EPIPE:
 845                 case ERANGE:
 846                 case EFAULT:
 847                 case EROFS:
 848                 case EINVAL:
 849                         zfs_error_aux(hdl, "%s", strerror(errno));
 850                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 851
 852                 default:
 853                         return (zfs_standard_error(hdl, errno, errbuf));
 854                 }
 855         }
 856
 857         if (debugnv != NULL) {
 858                 fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
 859                 fnvlist_free(thisdbg);
 860         }
 861
 862         return (0);
 863 }
 864
 865 static void
 866 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
 867 {
 868         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 869
 870         /*
 871          * zfs_send() only sets snapholds for sends that need them,
 872          * e.g. replication and doall.
 873          */
 874         if (sdd->snapholds == NULL)
 875                 return;
 876
 877         fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
 878 }
 879
 880 int
 881 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
 882     uint64_t *blocks_visited)
 883 {
 884         zfs_cmd_t zc = {"\0"};
 885
 886         if (bytes_written != NULL)
 887                 *bytes_written = 0;
 888         if (blocks_visited != NULL)
 889                 *blocks_visited = 0;
 890         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 891         zc.zc_cookie = fd;
 892         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
 893                 return (errno);
 894         if (bytes_written != NULL)
 895                 *bytes_written = zc.zc_cookie;
 896         if (blocks_visited != NULL)
 897                 *blocks_visited = zc.zc_objset_type;
 898         return (0);
 899 }
 900
 901 static void *
 902 send_progress_thread(void *arg)
 903 {
 904         progress_arg_t *pa = arg;
 905         zfs_handle_t *zhp = pa->pa_zhp;
 906         uint64_t bytes;
 907         uint64_t blocks;
 908         char buf[16];
 909         time_t t;
 910         struct tm *tm;
 911         int err;
 912
 913         if (!pa->pa_parsable) {
 914                 (void) fprintf(stderr,
 915                     "TIME       %s   %sSNAPSHOT %s\n",
 916                     pa->pa_estimate ? "BYTES" : " SENT",
 917                     pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
 918                     zhp->zfs_name);
 919         }
 920
 921         /*
 922          * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
 923          */
 924         for (;;) {
 925                 (void) sleep(1);
 926                 if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
 927                     &blocks)) != 0) {
 928                         if (err == EINTR || err == ENOENT)
 929                                 return ((void *)0);
 930                         return ((void *)(uintptr_t)err);
 931                 }
 932
 933                 (void) time(&t);
 934                 tm = localtime(&t);
 935
 936                 if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
 937                         (void) fprintf(stderr,
 938                             "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
 939                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 940                             (u_longlong_t)bytes, (u_longlong_t)blocks,
 941                             zhp->zfs_name);
 942                 } else if (pa->pa_verbosity >= 2) {
 943                         zfs_nicenum(bytes, buf, sizeof (buf));
 944                         (void) fprintf(stderr,
 945                             "%02d:%02d:%02d   %5s    %8llu    %s\n",
 946                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 947                             buf, (u_longlong_t)blocks, zhp->zfs_name);
 948                 } else if (pa->pa_parsable) {
 949                         (void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
 950                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 951                             (u_longlong_t)bytes, zhp->zfs_name);
 952                 } else {
 953                         zfs_nicebytes(bytes, buf, sizeof (buf));
 954                         (void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
 955                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 956                             buf, zhp->zfs_name);
 957                 }
 958         }
 959 }
 960
 961 static void
 962 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
 963     uint64_t size, boolean_t parsable)
 964 {
 965         if (parsable) {
 966                 if (fromsnap != NULL) {
 967                         (void) fprintf(fout, "incremental\t%s\t%s",
 968                             fromsnap, tosnap);
 969                 } else {
 970                         (void) fprintf(fout, "full\t%s",
 971                             tosnap);
 972                 }
 973         } else {
 974                 if (fromsnap != NULL) {
 975                         if (strchr(fromsnap, '@') == NULL &&
 976                             strchr(fromsnap, '#') == NULL) {
 977                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 978                                     "send from @%s to %s"),
 979                                     fromsnap, tosnap);
 980                         } else {
 981                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 982                                     "send from %s to %s"),
 983                                     fromsnap, tosnap);
 984                         }
 985                 } else {
 986                         (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 987                             "full send of %s"),
 988                             tosnap);
 989                 }
 990         }
 991
 992         if (parsable) {
 993                 (void) fprintf(fout, "\t%llu",
 994                     (longlong_t)size);
 995         } else if (size != 0) {
 996                 char buf[16];
 997                 zfs_nicebytes(size, buf, sizeof (buf));
 998                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 999                     " estimated size is %s"), buf);
1000         }
1001         (void) fprintf(fout, "\n");
1002 }
1003
1004 static int
1005 dump_snapshot(zfs_handle_t *zhp, void *arg)
1006 {
1007         send_dump_data_t *sdd = arg;
1008         progress_arg_t pa = { 0 };
1009         pthread_t tid;
1010         char *thissnap;
1011         enum lzc_send_flags flags = 0;
1012         int err;
1013         boolean_t isfromsnap, istosnap, fromorigin;
1014         boolean_t exclude = B_FALSE;
1015         FILE *fout = sdd->std_out ? stdout : stderr;
1016
1017         err = 0;
1018         thissnap = strchr(zhp->zfs_name, '@') + 1;
1019         isfromsnap = (sdd->fromsnap != NULL &&
1020             strcmp(sdd->fromsnap, thissnap) == 0);
1021
1022         if (!sdd->seenfrom && isfromsnap) {
1023                 gather_holds(zhp, sdd);
1024                 sdd->seenfrom = B_TRUE;
1025                 (void) strlcpy(sdd->prevsnap, thissnap,
1026                     sizeof (sdd->prevsnap));
1027                 sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1028                 zfs_close(zhp);
1029                 return (0);
1030         }
1031
1032         if (sdd->seento || !sdd->seenfrom) {
1033                 zfs_close(zhp);
1034                 return (0);
1035         }
1036
1037         istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1038         if (istosnap)
1039                 sdd->seento = B_TRUE;
1040
1041         if (sdd->large_block)
1042                 flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1043         if (sdd->embed_data)
1044                 flags |= LZC_SEND_FLAG_EMBED_DATA;
1045         if (sdd->compress)
1046                 flags |= LZC_SEND_FLAG_COMPRESS;
1047         if (sdd->raw)
1048                 flags |= LZC_SEND_FLAG_RAW;
1049
1050         if (!sdd->doall && !isfromsnap && !istosnap) {
1051                 if (sdd->replicate) {
1052                         char *snapname;
1053                         nvlist_t *snapprops;
1054                         /*
1055                          * Filter out all intermediate snapshots except origin
1056                          * snapshots needed to replicate clones.
1057                          */
1058                         nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1059                             zhp->zfs_dmustats.dds_guid, &snapname);
1060
1061                         if (nvfs != NULL) {
1062                                 snapprops = fnvlist_lookup_nvlist(nvfs,
1063                                     "snapprops");
1064                                 snapprops = fnvlist_lookup_nvlist(snapprops,
1065                                     thissnap);
1066                                 exclude = !nvlist_exists(snapprops,
1067                                     "is_clone_origin");
1068                         }
1069                 } else {
1070                         exclude = B_TRUE;
1071                 }
1072         }
1073
1074         /*
1075          * If a filter function exists, call it to determine whether
1076          * this snapshot will be sent.
1077          */
1078         if (exclude || (sdd->filter_cb != NULL &&
1079             sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1080                 /*
1081                  * This snapshot is filtered out.  Don't send it, and don't
1082                  * set prevsnap_obj, so it will be as if this snapshot didn't
1083                  * exist, and the next accepted snapshot will be sent as
1084                  * an incremental from the last accepted one, or as the
1085                  * first (and full) snapshot in the case of a replication,
1086                  * non-incremental send.
1087                  */
1088                 zfs_close(zhp);
1089                 return (0);
1090         }
1091
1092         gather_holds(zhp, sdd);
1093         fromorigin = sdd->prevsnap[0] == '\0' &&
1094             (sdd->fromorigin || sdd->replicate);
1095
1096         if (sdd->verbosity != 0) {
1097                 uint64_t size = 0;
1098                 char fromds[ZFS_MAX_DATASET_NAME_LEN];
1099
1100                 if (sdd->prevsnap[0] != '\0') {
1101                         (void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1102                         *(strchr(fromds, '@') + 1) = '\0';
1103                         (void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1104                 }
1105                 if (zfs_send_space(zhp, zhp->zfs_name,
1106                     sdd->prevsnap[0] ? fromds : NULL, flags, &size) != 0) {
1107                         size = 0; /* cannot estimate send space */
1108                 } else {
1109                         send_print_verbose(fout, zhp->zfs_name,
1110                             sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1111                             size, sdd->parsable);
1112                 }
1113                 sdd->size += size;
1114         }
1115
1116         if (!sdd->dryrun) {
1117                 /*
1118                  * If progress reporting is requested, spawn a new thread to
1119                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1120                  */
1121                 if (sdd->progress) {
1122                         pa.pa_zhp = zhp;
1123                         pa.pa_fd = sdd->outfd;
1124                         pa.pa_parsable = sdd->parsable;
1125                         pa.pa_estimate = B_FALSE;
1126                         pa.pa_verbosity = sdd->verbosity;
1127
1128                         if ((err = pthread_create(&tid, NULL,
1129                             send_progress_thread, &pa)) != 0) {
1130                                 zfs_close(zhp);
1131                                 return (err);
1132                         }
1133                 }
1134
1135                 err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1136                     fromorigin, sdd->outfd, flags, sdd->debugnv);
1137
1138                 if (sdd->progress) {
1139                         void *status = NULL;
1140                         (void) pthread_cancel(tid);
1141                         (void) pthread_join(tid, &status);
1142                         int error = (int)(uintptr_t)status;
1143                         if (error != 0 && status != PTHREAD_CANCELED) {
1144                                 char errbuf[1024];
1145                                 (void) snprintf(errbuf, sizeof (errbuf),
1146                                     dgettext(TEXT_DOMAIN,
1147                                     "progress thread exited nonzero"));
1148                                 return (zfs_standard_error(zhp->zfs_hdl, error,
1149                                     errbuf));
1150                         }
1151                 }
1152         }
1153
1154         (void) strcpy(sdd->prevsnap, thissnap);
1155         sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1156         zfs_close(zhp);
1157         return (err);
1158 }
1159
1160 static int
1161 dump_filesystem(zfs_handle_t *zhp, void *arg)
1162 {
1163         int rv = 0;
1164         send_dump_data_t *sdd = arg;
1165         boolean_t missingfrom = B_FALSE;
1166         zfs_cmd_t zc = {"\0"};
1167         uint64_t min_txg = 0, max_txg = 0;
1168
1169         (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1170             zhp->zfs_name, sdd->tosnap);
1171         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1172                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1173                     "WARNING: could not send %s@%s: does not exist\n"),
1174                     zhp->zfs_name, sdd->tosnap);
1175                 sdd->err = B_TRUE;
1176                 return (0);
1177         }
1178
1179         if (sdd->replicate && sdd->fromsnap) {
1180                 /*
1181                  * If this fs does not have fromsnap, and we're doing
1182                  * recursive, we need to send a full stream from the
1183                  * beginning (or an incremental from the origin if this
1184                  * is a clone).  If we're doing non-recursive, then let
1185                  * them get the error.
1186                  */
1187                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1188                     zhp->zfs_name, sdd->fromsnap);
1189                 if (zfs_ioctl(zhp->zfs_hdl,
1190                     ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1191                         missingfrom = B_TRUE;
1192                 }
1193         }
1194
1195         sdd->seenfrom = sdd->seento = sdd->prevsnap[0] = 0;
1196         sdd->prevsnap_obj = 0;
1197         if (sdd->fromsnap == NULL || missingfrom)
1198                 sdd->seenfrom = B_TRUE;
1199
1200
1201
1202         /*
1203          * Iterate through all snapshots and process the ones we will be
1204          * sending. If we only have a "from" and "to" snapshot to deal
1205          * with, we can avoid iterating through all the other snapshots.
1206          */
1207         if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1208                 if (!sdd->replicate && sdd->fromsnap != NULL)
1209                         min_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1210                             sdd->fromsnap);
1211                 if (!sdd->replicate && sdd->tosnap != NULL)
1212                         max_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1213                             sdd->tosnap);
1214                 rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, arg,
1215                     min_txg, max_txg);
1216         } else {
1217                 char snapname[MAXPATHLEN] = { 0 };
1218                 zfs_handle_t *snap;
1219
1220                 if (!sdd->seenfrom) {
1221                         (void) snprintf(snapname, sizeof (snapname),
1222                             "%s@%s", zhp->zfs_name, sdd->fromsnap);
1223                         snap = zfs_open(zhp->zfs_hdl, snapname,
1224                             ZFS_TYPE_SNAPSHOT);
1225                         if (snap != NULL)
1226                                 rv = dump_snapshot(snap, sdd);
1227                         else
1228                                 rv = -1;
1229                 }
1230
1231                 if (rv == 0) {
1232                         (void) snprintf(snapname, sizeof (snapname),
1233                             "%s@%s", zhp->zfs_name, sdd->tosnap);
1234                         snap = zfs_open(zhp->zfs_hdl, snapname,
1235                             ZFS_TYPE_SNAPSHOT);
1236                         if (snap != NULL)
1237                                 rv = dump_snapshot(snap, sdd);
1238                         else
1239                                 rv = -1;
1240                 }
1241         }
1242
1243         if (!sdd->seenfrom) {
1244                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1245                     "WARNING: could not send %s@%s:\n"
1246                     "incremental source (%s@%s) does not exist\n"),
1247                     zhp->zfs_name, sdd->tosnap,
1248                     zhp->zfs_name, sdd->fromsnap);
1249                 sdd->err = B_TRUE;
1250         } else if (!sdd->seento) {
1251                 if (sdd->fromsnap) {
1252                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1253                             "WARNING: could not send %s@%s:\n"
1254                             "incremental source (%s@%s) "
1255                             "is not earlier than it\n"),
1256                             zhp->zfs_name, sdd->tosnap,
1257                             zhp->zfs_name, sdd->fromsnap);
1258                 } else {
1259                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1260                             "WARNING: "
1261                             "could not send %s@%s: does not exist\n"),
1262                             zhp->zfs_name, sdd->tosnap);
1263                 }
1264                 sdd->err = B_TRUE;
1265         }
1266
1267         return (rv);
1268 }
1269
1270 static int
1271 dump_filesystems(zfs_handle_t *rzhp, void *arg)
1272 {
1273         send_dump_data_t *sdd = arg;
1274         nvpair_t *fspair;
1275         boolean_t needagain, progress;
1276
1277         if (!sdd->replicate)
1278                 return (dump_filesystem(rzhp, sdd));
1279
1280         /* Mark the clone origin snapshots. */
1281         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1282             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1283                 nvlist_t *nvfs;
1284                 uint64_t origin_guid = 0;
1285
1286                 nvfs = fnvpair_value_nvlist(fspair);
1287                 (void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1288                 if (origin_guid != 0) {
1289                         char *snapname;
1290                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1291                             origin_guid, &snapname);
1292                         if (origin_nv != NULL) {
1293                                 nvlist_t *snapprops;
1294                                 snapprops = fnvlist_lookup_nvlist(origin_nv,
1295                                     "snapprops");
1296                                 snapprops = fnvlist_lookup_nvlist(snapprops,
1297                                     snapname);
1298                                 fnvlist_add_boolean(snapprops,
1299                                     "is_clone_origin");
1300                         }
1301                 }
1302         }
1303 again:
1304         needagain = progress = B_FALSE;
1305         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1306             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1307                 nvlist_t *fslist, *parent_nv;
1308                 char *fsname;
1309                 zfs_handle_t *zhp;
1310                 int err;
1311                 uint64_t origin_guid = 0;
1312                 uint64_t parent_guid = 0;
1313
1314                 fslist = fnvpair_value_nvlist(fspair);
1315                 if (nvlist_lookup_boolean(fslist, "sent") == 0)
1316                         continue;
1317
1318                 fsname = fnvlist_lookup_string(fslist, "name");
1319                 (void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1320                 (void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1321                     &parent_guid);
1322
1323                 if (parent_guid != 0) {
1324                         parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1325                         if (!nvlist_exists(parent_nv, "sent")) {
1326                                 /* parent has not been sent; skip this one */
1327                                 needagain = B_TRUE;
1328                                 continue;
1329                         }
1330                 }
1331
1332                 if (origin_guid != 0) {
1333                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1334                             origin_guid, NULL);
1335                         if (origin_nv != NULL &&
1336                             !nvlist_exists(origin_nv, "sent")) {
1337                                 /*
1338                                  * origin has not been sent yet;
1339                                  * skip this clone.
1340                                  */
1341                                 needagain = B_TRUE;
1342                                 continue;
1343                         }
1344                 }
1345
1346                 zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1347                 if (zhp == NULL)
1348                         return (-1);
1349                 err = dump_filesystem(zhp, sdd);
1350                 fnvlist_add_boolean(fslist, "sent");
1351                 progress = B_TRUE;
1352                 zfs_close(zhp);
1353                 if (err)
1354                         return (err);
1355         }
1356         if (needagain) {
1357                 assert(progress);
1358                 goto again;
1359         }
1360
1361         /* clean out the sent flags in case we reuse this fss */
1362         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1363             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1364                 nvlist_t *fslist;
1365
1366                 fslist = fnvpair_value_nvlist(fspair);
1367                 (void) nvlist_remove_all(fslist, "sent");
1368         }
1369
1370         return (0);
1371 }
1372
1373 nvlist_t *
1374 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1375 {
1376         unsigned int version;
1377         int nread, i;
1378         unsigned long long checksum, packed_len;
1379
1380         /*
1381          * Decode token header, which is:
1382          *   <token version>-<checksum of payload>-<uncompressed payload length>
1383          * Note that the only supported token version is 1.
1384          */
1385         nread = sscanf(token, "%u-%llx-%llx-",
1386             &version, &checksum, &packed_len);
1387         if (nread != 3) {
1388                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1389                     "resume token is corrupt (invalid format)"));
1390                 return (NULL);
1391         }
1392
1393         if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1394                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1395                     "resume token is corrupt (invalid version %u)"),
1396                     version);
1397                 return (NULL);
1398         }
1399
1400         /* convert hexadecimal representation to binary */
1401         token = strrchr(token, '-') + 1;
1402         int len = strlen(token) / 2;
1403         unsigned char *compressed = zfs_alloc(hdl, len);
1404         for (i = 0; i < len; i++) {
1405                 nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1406                 if (nread != 1) {
1407                         free(compressed);
1408                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1409                             "resume token is corrupt "
1410                             "(payload is not hex-encoded)"));
1411                         return (NULL);
1412                 }
1413         }
1414
1415         /* verify checksum */
1416         zio_cksum_t cksum;
1417         fletcher_4_native_varsize(compressed, len, &cksum);
1418         if (cksum.zc_word[0] != checksum) {
1419                 free(compressed);
1420                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1421                     "resume token is corrupt (incorrect checksum)"));
1422                 return (NULL);
1423         }
1424
1425         /* uncompress */
1426         void *packed = zfs_alloc(hdl, packed_len);
1427         uLongf packed_len_long = packed_len;
1428         if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1429             packed_len_long != packed_len) {
1430                 free(packed);
1431                 free(compressed);
1432                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1433                     "resume token is corrupt (decompression failed)"));
1434                 return (NULL);
1435         }
1436
1437         /* unpack nvlist */
1438         nvlist_t *nv;
1439         int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1440         free(packed);
1441         free(compressed);
1442         if (error != 0) {
1443                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1444                     "resume token is corrupt (nvlist_unpack failed)"));
1445                 return (NULL);
1446         }
1447         return (nv);
1448 }
1449 static enum lzc_send_flags
1450 lzc_flags_from_sendflags(const sendflags_t *flags)
1451 {
1452         enum lzc_send_flags lzc_flags = 0;
1453         if (flags->largeblock)
1454                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1455         if (flags->embed_data)
1456                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1457         if (flags->compress)
1458                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1459         if (flags->raw)
1460                 lzc_flags |= LZC_SEND_FLAG_RAW;
1461         if (flags->saved)
1462                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1463         return (lzc_flags);
1464 }
1465
1466 static int
1467 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1468     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1469     const char *redactbook, char *errbuf)
1470 {
1471         uint64_t size;
1472         FILE *fout = flags->dryrun ? stdout : stderr;
1473         progress_arg_t pa = { 0 };
1474         int err = 0;
1475         pthread_t ptid;
1476
1477         if (flags->progress) {
1478                 pa.pa_zhp = zhp;
1479                 pa.pa_fd = fd;
1480                 pa.pa_parsable = flags->parsable;
1481                 pa.pa_estimate = B_TRUE;
1482                 pa.pa_verbosity = flags->verbosity;
1483
1484                 err = pthread_create(&ptid, NULL,
1485                     send_progress_thread, &pa);
1486                 if (err != 0) {
1487                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1488                         return (zfs_error(zhp->zfs_hdl,
1489                             EZFS_THREADCREATEFAILED, errbuf));
1490                 }
1491         }
1492
1493         err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1494             lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1495             redactbook, fd, &size);
1496
1497         if (flags->progress) {
1498                 void *status = NULL;
1499                 (void) pthread_cancel(ptid);
1500                 (void) pthread_join(ptid, &status);
1501                 int error = (int)(uintptr_t)status;
1502                 if (error != 0 && status != PTHREAD_CANCELED) {
1503                         char errbuf[1024];
1504                         (void) snprintf(errbuf, sizeof (errbuf),
1505                             dgettext(TEXT_DOMAIN, "progress thread exited "
1506                             "nonzero"));
1507                         return (zfs_standard_error(zhp->zfs_hdl, error,
1508                             errbuf));
1509                 }
1510         }
1511
1512         if (err != 0) {
1513                 zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1514                 return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1515                     errbuf));
1516         }
1517         send_print_verbose(fout, zhp->zfs_name, from, size,
1518             flags->parsable);
1519
1520         if (flags->parsable) {
1521                 (void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1522         } else {
1523                 char buf[16];
1524                 zfs_nicenum(size, buf, sizeof (buf));
1525                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1526                     "total estimated size is %s\n"), buf);
1527         }
1528         return (0);
1529 }
1530
1531 static boolean_t
1532 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1533 {
1534         for (int i = 0; i < num_snaps; i++) {
1535                 if (snaps[i] == guid)
1536                         return (B_TRUE);
1537         }
1538         return (B_FALSE);
1539 }
1540
1541 static boolean_t
1542 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1543     const uint64_t *snaps2, uint64_t num_snaps2)
1544 {
1545         if (num_snaps1 != num_snaps2)
1546                 return (B_FALSE);
1547         for (int i = 0; i < num_snaps1; i++) {
1548                 if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1549                         return (B_FALSE);
1550         }
1551         return (B_TRUE);
1552 }
1553
1554 /*
1555  * Check that the list of redaction snapshots in the bookmark matches the send
1556  * we're resuming, and return whether or not it's complete.
1557  *
1558  * Note that the caller needs to free the contents of *bookname with free() if
1559  * this function returns successfully.
1560  */
1561 static int
1562 find_redact_book(libzfs_handle_t *hdl, const char *path,
1563     const uint64_t *redact_snap_guids, int num_redact_snaps,
1564     char **bookname)
1565 {
1566         char errbuf[1024];
1567         int error = 0;
1568         nvlist_t *props = fnvlist_alloc();
1569         nvlist_t *bmarks;
1570
1571         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1572             "cannot resume send"));
1573
1574         fnvlist_add_boolean(props, "redact_complete");
1575         fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1576         error = lzc_get_bookmarks(path, props, &bmarks);
1577         fnvlist_free(props);
1578         if (error != 0) {
1579                 if (error == ESRCH) {
1580                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1581                             "nonexistent redaction bookmark provided"));
1582                 } else if (error == ENOENT) {
1583                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1584                             "dataset to be sent no longer exists"));
1585                 } else {
1586                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1587                             "unknown error: %s"), strerror(error));
1588                 }
1589                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1590         }
1591         nvpair_t *pair;
1592         for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1593             pair = nvlist_next_nvpair(bmarks, pair)) {
1594
1595                 nvlist_t *bmark = fnvpair_value_nvlist(pair);
1596                 nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1597                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1598                 uint_t len = 0;
1599                 uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1600                     ZPROP_VALUE, &len);
1601                 if (redact_snaps_equal(redact_snap_guids,
1602                     num_redact_snaps, bmarksnaps, len)) {
1603                         break;
1604                 }
1605         }
1606         if (pair == NULL)  {
1607                 fnvlist_free(bmarks);
1608                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1609                     "no appropriate redaction bookmark exists"));
1610                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1611         }
1612         char *name = nvpair_name(pair);
1613         nvlist_t *bmark = fnvpair_value_nvlist(pair);
1614         nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1615         boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1616             ZPROP_VALUE);
1617         if (!complete) {
1618                 fnvlist_free(bmarks);
1619                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1620                     "incomplete redaction bookmark provided"));
1621                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1622         }
1623         *bookname = strndup(name, ZFS_MAX_DATASET_NAME_LEN);
1624         ASSERT3P(*bookname, !=, NULL);
1625         fnvlist_free(bmarks);
1626         return (0);
1627 }
1628
1629 static int
1630 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1631     nvlist_t *resume_nvl)
1632 {
1633         char errbuf[1024];
1634         char *toname;
1635         char *fromname = NULL;
1636         uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1637         zfs_handle_t *zhp;
1638         int error = 0;
1639         char name[ZFS_MAX_DATASET_NAME_LEN];
1640         enum lzc_send_flags lzc_flags = 0;
1641         FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1642         uint64_t *redact_snap_guids = NULL;
1643         int num_redact_snaps = 0;
1644         char *redact_book = NULL;
1645
1646         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1647             "cannot resume send"));
1648
1649         if (flags->verbosity != 0) {
1650                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1651                     "resume token contents:\n"));
1652                 nvlist_print(fout, resume_nvl);
1653         }
1654
1655         if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1656             nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1657             nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1658             nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1659             nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1660                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1661                     "resume token is corrupt"));
1662                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1663         }
1664         fromguid = 0;
1665         (void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1666
1667         if (flags->largeblock || nvlist_exists(resume_nvl, "largeblockok"))
1668                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1669         if (flags->embed_data || nvlist_exists(resume_nvl, "embedok"))
1670                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1671         if (flags->compress || nvlist_exists(resume_nvl, "compressok"))
1672                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1673         if (flags->raw || nvlist_exists(resume_nvl, "rawok"))
1674                 lzc_flags |= LZC_SEND_FLAG_RAW;
1675         if (flags->saved || nvlist_exists(resume_nvl, "savedok"))
1676                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1677
1678         if (flags->saved) {
1679                 (void) strcpy(name, toname);
1680         } else {
1681                 error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1682                 if (error != 0) {
1683                         if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1684                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1685                                     "'%s' is no longer the same snapshot "
1686                                     "used in the initial send"), toname);
1687                         } else {
1688                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1689                                     "'%s' used in the initial send no "
1690                                     "longer exists"), toname);
1691                         }
1692                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1693                 }
1694         }
1695
1696         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1697         if (zhp == NULL) {
1698                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1699                     "unable to access '%s'"), name);
1700                 return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1701         }
1702
1703         if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1704             &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1705                 num_redact_snaps = -1;
1706         }
1707
1708         if (fromguid != 0) {
1709                 if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1710                     redact_snap_guids, num_redact_snaps, name) != 0) {
1711                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1712                             "incremental source %#llx no longer exists"),
1713                             (longlong_t)fromguid);
1714                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1715                 }
1716                 fromname = name;
1717         }
1718
1719         redact_snap_guids = NULL;
1720
1721         if (nvlist_lookup_uint64_array(resume_nvl,
1722             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1723             (uint_t *)&num_redact_snaps) == 0) {
1724                 char path[ZFS_MAX_DATASET_NAME_LEN];
1725
1726                 (void) strlcpy(path, toname, sizeof (path));
1727                 char *at = strchr(path, '@');
1728                 ASSERT3P(at, !=, NULL);
1729
1730                 *at = '\0';
1731
1732                 if ((error = find_redact_book(hdl, path, redact_snap_guids,
1733                     num_redact_snaps, &redact_book)) != 0) {
1734                         return (error);
1735                 }
1736         }
1737
1738         if (flags->verbosity != 0) {
1739                 /*
1740                  * Some of these may have come from the resume token, set them
1741                  * here for size estimate purposes.
1742                  */
1743                 sendflags_t tmpflags = *flags;
1744                 if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1745                         tmpflags.largeblock = B_TRUE;
1746                 if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1747                         tmpflags.compress = B_TRUE;
1748                 if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1749                         tmpflags.embed_data = B_TRUE;
1750                 if (lzc_flags & LZC_SEND_FLAG_RAW)
1751                         tmpflags.raw = B_TRUE;
1752                 if (lzc_flags & LZC_SEND_FLAG_SAVED)
1753                         tmpflags.saved = B_TRUE;
1754                 error = estimate_size(zhp, fromname, outfd, &tmpflags,
1755                     resumeobj, resumeoff, bytes, redact_book, errbuf);
1756         }
1757
1758         if (!flags->dryrun) {
1759                 progress_arg_t pa = { 0 };
1760                 pthread_t tid;
1761                 /*
1762                  * If progress reporting is requested, spawn a new thread to
1763                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1764                  */
1765                 if (flags->progress) {
1766                         pa.pa_zhp = zhp;
1767                         pa.pa_fd = outfd;
1768                         pa.pa_parsable = flags->parsable;
1769                         pa.pa_estimate = B_FALSE;
1770                         pa.pa_verbosity = flags->verbosity;
1771
1772                         error = pthread_create(&tid, NULL,
1773                             send_progress_thread, &pa);
1774                         if (error != 0) {
1775                                 if (redact_book != NULL)
1776                                         free(redact_book);
1777                                 zfs_close(zhp);
1778                                 return (error);
1779                         }
1780                 }
1781
1782                 error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1783                     lzc_flags, resumeobj, resumeoff, redact_book);
1784                 if (redact_book != NULL)
1785                         free(redact_book);
1786
1787                 if (flags->progress) {
1788                         void *status = NULL;
1789                         (void) pthread_cancel(tid);
1790                         (void) pthread_join(tid, &status);
1791                         int error = (int)(uintptr_t)status;
1792                         if (error != 0 && status != PTHREAD_CANCELED) {
1793                                 char errbuf[1024];
1794                                 (void) snprintf(errbuf, sizeof (errbuf),
1795                                     dgettext(TEXT_DOMAIN,
1796                                     "progress thread exited nonzero"));
1797                                 return (zfs_standard_error(hdl, error, errbuf));
1798                         }
1799                 }
1800
1801                 char errbuf[1024];
1802                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1803                     "warning: cannot send '%s'"), zhp->zfs_name);
1804
1805                 zfs_close(zhp);
1806
1807                 switch (error) {
1808                 case 0:
1809                         return (0);
1810                 case EACCES:
1811                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1812                             "source key must be loaded"));
1813                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1814                 case ESRCH:
1815                         if (lzc_exists(zhp->zfs_name)) {
1816                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1817                                     "incremental source could not be found"));
1818                         }
1819                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
1820
1821                 case EXDEV:
1822                 case ENOENT:
1823                 case EDQUOT:
1824                 case EFBIG:
1825                 case EIO:
1826                 case ENOLINK:
1827                 case ENOSPC:
1828                 case ENOSTR:
1829                 case ENXIO:
1830                 case EPIPE:
1831                 case ERANGE:
1832                 case EFAULT:
1833                 case EROFS:
1834                         zfs_error_aux(hdl, "%s", strerror(errno));
1835                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1836
1837                 default:
1838                         return (zfs_standard_error(hdl, errno, errbuf));
1839                 }
1840         } else {
1841                 if (redact_book != NULL)
1842                         free(redact_book);
1843         }
1844
1845         zfs_close(zhp);
1846
1847         return (error);
1848 }
1849
1850 int
1851 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1852     const char *resume_token)
1853 {
1854         int ret;
1855         char errbuf[1024];
1856         nvlist_t *resume_nvl;
1857
1858         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1859             "cannot resume send"));
1860
1861         resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1862         if (resume_nvl == NULL) {
1863                 /*
1864                  * zfs_error_aux has already been set by
1865                  * zfs_send_resume_token_to_nvlist()
1866                  */
1867                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1868         }
1869
1870         ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1871         fnvlist_free(resume_nvl);
1872
1873         return (ret);
1874 }
1875
1876 int
1877 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1878     const char *resume_token)
1879 {
1880         int ret;
1881         libzfs_handle_t *hdl = zhp->zfs_hdl;
1882         nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1883         uint64_t saved_guid = 0, resume_guid = 0;
1884         uint64_t obj = 0, off = 0, bytes = 0;
1885         char token_buf[ZFS_MAXPROPLEN];
1886         char errbuf[1024];
1887
1888         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1889             "saved send failed"));
1890
1891         ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1892             token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1893         if (ret != 0)
1894                 goto out;
1895
1896         saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1897         if (saved_nvl == NULL) {
1898                 /*
1899                  * zfs_error_aux has already been set by
1900                  * zfs_send_resume_token_to_nvlist()
1901                  */
1902                 ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1903                 goto out;
1904         }
1905
1906         /*
1907          * If a resume token is provided we use the object and offset
1908          * from that instead of the default, which starts from the
1909          * beginning.
1910          */
1911         if (resume_token != NULL) {
1912                 resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1913                     resume_token);
1914                 if (resume_nvl == NULL) {
1915                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1916                         goto out;
1917                 }
1918
1919                 if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1920                     nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1921                     nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1922                     nvlist_lookup_uint64(resume_nvl, "toguid",
1923                     &resume_guid) != 0) {
1924                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1925                             "provided resume token is corrupt"));
1926                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1927                         goto out;
1928                 }
1929
1930                 if (nvlist_lookup_uint64(saved_nvl, "toguid",
1931                     &saved_guid)) {
1932                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1933                             "dataset's resume token is corrupt"));
1934                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1935                         goto out;
1936                 }
1937
1938                 if (resume_guid != saved_guid) {
1939                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1940                             "provided resume token does not match dataset"));
1941                         ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
1942                         goto out;
1943                 }
1944         }
1945
1946         (void) nvlist_remove_all(saved_nvl, "object");
1947         fnvlist_add_uint64(saved_nvl, "object", obj);
1948
1949         (void) nvlist_remove_all(saved_nvl, "offset");
1950         fnvlist_add_uint64(saved_nvl, "offset", off);
1951
1952         (void) nvlist_remove_all(saved_nvl, "bytes");
1953         fnvlist_add_uint64(saved_nvl, "bytes", bytes);
1954
1955         (void) nvlist_remove_all(saved_nvl, "toname");
1956         fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
1957
1958         ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
1959
1960 out:
1961         fnvlist_free(saved_nvl);
1962         fnvlist_free(resume_nvl);
1963         return (ret);
1964 }
1965
1966 /*
1967  * This function informs the target system that the recursive send is complete.
1968  * The record is also expected in the case of a send -p.
1969  */
1970 static int
1971 send_conclusion_record(int fd, zio_cksum_t *zc)
1972 {
1973         dmu_replay_record_t drr = { 0 };
1974         drr.drr_type = DRR_END;
1975         if (zc != NULL)
1976                 drr.drr_u.drr_end.drr_checksum = *zc;
1977         if (write(fd, &drr, sizeof (drr)) == -1) {
1978                 return (errno);
1979         }
1980         return (0);
1981 }
1982
1983 /*
1984  * This function is responsible for sending the records that contain the
1985  * necessary information for the target system's libzfs to be able to set the
1986  * properties of the filesystem being received, or to be able to prepare for
1987  * a recursive receive.
1988  *
1989  * The "zhp" argument is the handle of the snapshot we are sending
1990  * (the "tosnap").  The "from" argument is the short snapshot name (the part
1991  * after the @) of the incremental source.
1992  */
1993 static int
1994 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
1995     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
1996     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
1997     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
1998     nvlist_t **fssp, avl_tree_t **fsavlp)
1999 {
2000         int err = 0;
2001         char *packbuf = NULL;
2002         size_t buflen = 0;
2003         zio_cksum_t zc = { {0} };
2004         int featureflags = 0;
2005         /* name of filesystem/volume that contains snapshot we are sending */
2006         char tofs[ZFS_MAX_DATASET_NAME_LEN];
2007         /* short name of snap we are sending */
2008         char *tosnap = "";
2009
2010         char errbuf[1024];
2011         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2012             "warning: cannot send '%s'"), zhp->zfs_name);
2013         if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2014             ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2015                 featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2016         }
2017
2018         if (holds)
2019                 featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2020
2021         (void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2022         char *at = strchr(tofs, '@');
2023         if (at != NULL) {
2024                 *at = '\0';
2025                 tosnap = at + 1;
2026         }
2027
2028         if (gather_props) {
2029                 nvlist_t *hdrnv = fnvlist_alloc();
2030                 nvlist_t *fss = NULL;
2031
2032                 if (from != NULL)
2033                         fnvlist_add_string(hdrnv, "fromsnap", from);
2034                 fnvlist_add_string(hdrnv, "tosnap", tosnap);
2035                 if (!recursive)
2036                         fnvlist_add_boolean(hdrnv, "not_recursive");
2037
2038                 if (raw) {
2039                         fnvlist_add_boolean(hdrnv, "raw");
2040                 }
2041
2042                 if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2043                     from, tosnap, recursive, raw, doall, replicate, skipmissing,
2044                     verbose, backup, holds, props, &fss, fsavlp)) != 0) {
2045                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2046                             errbuf));
2047                 }
2048                 /*
2049                  * Do not allow the size of the properties list to exceed
2050                  * the limit
2051                  */
2052                 if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2053                     zhp->zfs_hdl->libzfs_max_nvlist) {
2054                         (void) snprintf(errbuf, sizeof (errbuf),
2055                             dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2056                             "the size of the list of snapshots and properties "
2057                             "is too large to be received successfully.\n"
2058                             "Select a smaller number of snapshots to send.\n"),
2059                             zhp->zfs_name);
2060                         return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2061                             errbuf));
2062                 }
2063                 fnvlist_add_nvlist(hdrnv, "fss", fss);
2064                 VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2065                     0));
2066                 if (fssp != NULL) {
2067                         *fssp = fss;
2068                 } else {
2069                         fnvlist_free(fss);
2070                 }
2071                 fnvlist_free(hdrnv);
2072         }
2073
2074         if (!dryrun) {
2075                 dmu_replay_record_t drr = { 0 };
2076                 /* write first begin record */
2077                 drr.drr_type = DRR_BEGIN;
2078                 drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2079                 DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2080                     drr_versioninfo, DMU_COMPOUNDSTREAM);
2081                 DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2082                     drr_versioninfo, featureflags);
2083                 if (snprintf(drr.drr_u.drr_begin.drr_toname,
2084                     sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2085                     tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2086                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2087                             errbuf));
2088                 }
2089                 drr.drr_payloadlen = buflen;
2090
2091                 err = dump_record(&drr, packbuf, buflen, &zc, fd);
2092                 free(packbuf);
2093                 if (err != 0) {
2094                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2095                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2096                             errbuf));
2097                 }
2098                 err = send_conclusion_record(fd, &zc);
2099                 if (err != 0) {
2100                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2101                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2102                             errbuf));
2103                 }
2104         }
2105         return (0);
2106 }
2107
2108 /*
2109  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2110  * that contains the snapshot to send.  The "fromsnap" argument is the
2111  * short name (the part after the '@') of the snapshot that is the
2112  * incremental source to send from (if non-NULL).  The "tosnap" argument
2113  * is the short name of the snapshot to send.
2114  *
2115  * The content of the send stream is the snapshot identified by
2116  * 'tosnap'.  Incremental streams are requested in two ways:
2117  *     - from the snapshot identified by "fromsnap" (if non-null) or
2118  *     - from the origin of the dataset identified by zhp, which must
2119  *       be a clone.  In this case, "fromsnap" is null and "fromorigin"
2120  *       is TRUE.
2121  *
2122  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2123  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2124  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2125  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2126  * case too. If "props" is set, send properties.
2127  */
2128 int
2129 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2130     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2131     void *cb_arg, nvlist_t **debugnvp)
2132 {
2133         char errbuf[1024];
2134         send_dump_data_t sdd = { 0 };
2135         int err = 0;
2136         nvlist_t *fss = NULL;
2137         avl_tree_t *fsavl = NULL;
2138         static uint64_t holdseq;
2139         int spa_version;
2140         FILE *fout;
2141
2142         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2143             "cannot send '%s'"), zhp->zfs_name);
2144
2145         if (fromsnap && fromsnap[0] == '\0') {
2146                 zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2147                     "zero-length incremental source"));
2148                 return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2149         }
2150
2151         if (fromsnap) {
2152                 char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2153                 if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2154                     "%s@%s", zhp->zfs_name, fromsnap) >=
2155                     sizeof (full_fromsnap_name)) {
2156                         err = EINVAL;
2157                         goto stderr_out;
2158                 }
2159                 zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2160                     full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2161                 if (fromsnapn == NULL) {
2162                         err = -1;
2163                         goto err_out;
2164                 }
2165                 zfs_close(fromsnapn);
2166         }
2167
2168         if (flags->replicate || flags->doall || flags->props ||
2169             flags->holds || flags->backup) {
2170                 char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2171                 if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2172                     "%s@%s", zhp->zfs_name, tosnap) >=
2173                     sizeof (full_tosnap_name)) {
2174                         err = EINVAL;
2175                         goto stderr_out;
2176                 }
2177                 zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2178                     full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2179                 if (tosnap == NULL) {
2180                         err = -1;
2181                         goto err_out;
2182                 }
2183                 err = send_prelim_records(tosnap, fromsnap, outfd,
2184                     flags->replicate || flags->props || flags->holds,
2185                     flags->replicate, flags->verbosity > 0, flags->dryrun,
2186                     flags->raw, flags->replicate, flags->skipmissing,
2187                     flags->backup, flags->holds, flags->props, flags->doall,
2188                     &fss, &fsavl);
2189                 zfs_close(tosnap);
2190                 if (err != 0)
2191                         goto err_out;
2192         }
2193
2194         /* dump each stream */
2195         sdd.fromsnap = fromsnap;
2196         sdd.tosnap = tosnap;
2197         sdd.outfd = outfd;
2198         sdd.replicate = flags->replicate;
2199         sdd.doall = flags->doall;
2200         sdd.fromorigin = flags->fromorigin;
2201         sdd.fss = fss;
2202         sdd.fsavl = fsavl;
2203         sdd.verbosity = flags->verbosity;
2204         sdd.parsable = flags->parsable;
2205         sdd.progress = flags->progress;
2206         sdd.dryrun = flags->dryrun;
2207         sdd.large_block = flags->largeblock;
2208         sdd.embed_data = flags->embed_data;
2209         sdd.compress = flags->compress;
2210         sdd.raw = flags->raw;
2211         sdd.holds = flags->holds;
2212         sdd.filter_cb = filter_func;
2213         sdd.filter_cb_arg = cb_arg;
2214         if (debugnvp)
2215                 sdd.debugnv = *debugnvp;
2216         if (sdd.verbosity != 0 && sdd.dryrun)
2217                 sdd.std_out = B_TRUE;
2218         fout = sdd.std_out ? stdout : stderr;
2219
2220         /*
2221          * Some flags require that we place user holds on the datasets that are
2222          * being sent so they don't get destroyed during the send. We can skip
2223          * this step if the pool is imported read-only since the datasets cannot
2224          * be destroyed.
2225          */
2226         if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2227             ZPOOL_PROP_READONLY, NULL) &&
2228             zfs_spa_version(zhp, &spa_version) == 0 &&
2229             spa_version >= SPA_VERSION_USERREFS &&
2230             (flags->doall || flags->replicate)) {
2231                 ++holdseq;
2232                 (void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2233                     ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2234                 sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2235                 if (sdd.cleanup_fd < 0) {
2236                         err = errno;
2237                         goto stderr_out;
2238                 }
2239                 sdd.snapholds = fnvlist_alloc();
2240         } else {
2241                 sdd.cleanup_fd = -1;
2242                 sdd.snapholds = NULL;
2243         }
2244
2245         if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2246                 /*
2247                  * Do a verbose no-op dry run to get all the verbose output
2248                  * or to gather snapshot hold's before generating any data,
2249                  * then do a non-verbose real run to generate the streams.
2250                  */
2251                 sdd.dryrun = B_TRUE;
2252                 err = dump_filesystems(zhp, &sdd);
2253
2254                 if (err != 0)
2255                         goto stderr_out;
2256
2257                 if (flags->verbosity != 0) {
2258                         if (flags->parsable) {
2259                                 (void) fprintf(fout, "size\t%llu\n",
2260                                     (longlong_t)sdd.size);
2261                         } else {
2262                                 char buf[16];
2263                                 zfs_nicebytes(sdd.size, buf, sizeof (buf));
2264                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
2265                                     "total estimated size is %s\n"), buf);
2266                         }
2267                 }
2268
2269                 /* Ensure no snaps found is treated as an error. */
2270                 if (!sdd.seento) {
2271                         err = ENOENT;
2272                         goto err_out;
2273                 }
2274
2275                 /* Skip the second run if dryrun was requested. */
2276                 if (flags->dryrun)
2277                         goto err_out;
2278
2279                 if (sdd.snapholds != NULL) {
2280                         err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2281                         if (err != 0)
2282                                 goto stderr_out;
2283
2284                         fnvlist_free(sdd.snapholds);
2285                         sdd.snapholds = NULL;
2286                 }
2287
2288                 sdd.dryrun = B_FALSE;
2289                 sdd.verbosity = 0;
2290         }
2291
2292         err = dump_filesystems(zhp, &sdd);
2293         fsavl_destroy(fsavl);
2294         fnvlist_free(fss);
2295
2296         /* Ensure no snaps found is treated as an error. */
2297         if (err == 0 && !sdd.seento)
2298                 err = ENOENT;
2299
2300         if (sdd.cleanup_fd != -1) {
2301                 VERIFY(0 == close(sdd.cleanup_fd));
2302                 sdd.cleanup_fd = -1;
2303         }
2304
2305         if (!flags->dryrun && (flags->replicate || flags->doall ||
2306             flags->props || flags->backup || flags->holds)) {
2307                 /*
2308                  * write final end record.  NB: want to do this even if
2309                  * there was some error, because it might not be totally
2310                  * failed.
2311                  */
2312                 err = send_conclusion_record(outfd, NULL);
2313                 if (err != 0)
2314                         return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
2315         }
2316
2317         return (err || sdd.err);
2318
2319 stderr_out:
2320         err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2321 err_out:
2322         fsavl_destroy(fsavl);
2323         fnvlist_free(fss);
2324         fnvlist_free(sdd.snapholds);
2325
2326         if (sdd.cleanup_fd != -1)
2327                 VERIFY(0 == close(sdd.cleanup_fd));
2328         return (err);
2329 }
2330
2331 static zfs_handle_t *
2332 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2333 {
2334         char dirname[ZFS_MAX_DATASET_NAME_LEN];
2335         (void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2336         char *c = strchr(dirname, '@');
2337         if (c != NULL)
2338                 *c = '\0';
2339         return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2340 }
2341
2342 /*
2343  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2344  * an earlier snapshot in the same filesystem, or a snapshot before later's
2345  * origin, or it's origin's origin, etc.
2346  */
2347 static boolean_t
2348 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2349 {
2350         boolean_t ret;
2351         uint64_t later_txg =
2352             (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2353             later->zfs_type == ZFS_TYPE_VOLUME ?
2354             UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2355         uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2356
2357         if (earlier_txg >= later_txg)
2358                 return (B_FALSE);
2359
2360         zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2361             earlier->zfs_name);
2362         zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2363             later->zfs_name);
2364
2365         if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2366                 zfs_close(earlier_dir);
2367                 zfs_close(later_dir);
2368                 return (B_TRUE);
2369         }
2370
2371         char clonename[ZFS_MAX_DATASET_NAME_LEN];
2372         if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2373             ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2374                 zfs_close(earlier_dir);
2375                 zfs_close(later_dir);
2376                 return (B_FALSE);
2377         }
2378
2379         zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2380             ZFS_TYPE_DATASET);
2381         uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2382
2383         /*
2384          * If "earlier" is exactly the origin, then
2385          * snapshot_is_before(earlier, origin) will return false (because
2386          * they're the same).
2387          */
2388         if (origin_txg == earlier_txg &&
2389             strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2390                 zfs_close(earlier_dir);
2391                 zfs_close(later_dir);
2392                 zfs_close(origin);
2393                 return (B_TRUE);
2394         }
2395         zfs_close(earlier_dir);
2396         zfs_close(later_dir);
2397
2398         ret = snapshot_is_before(earlier, origin);
2399         zfs_close(origin);
2400         return (ret);
2401 }
2402
2403 /*
2404  * The "zhp" argument is the handle of the dataset to send (typically a
2405  * snapshot).  The "from" argument is the full name of the snapshot or
2406  * bookmark that is the incremental source.
2407  */
2408 int
2409 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2410     const char *redactbook)
2411 {
2412         int err;
2413         libzfs_handle_t *hdl = zhp->zfs_hdl;
2414         char *name = zhp->zfs_name;
2415         pthread_t ptid;
2416         progress_arg_t pa = { 0 };
2417
2418         char errbuf[1024];
2419         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2420             "warning: cannot send '%s'"), name);
2421
2422         if (from != NULL && strchr(from, '@')) {
2423                 zfs_handle_t *from_zhp = zfs_open(hdl, from,
2424                     ZFS_TYPE_DATASET);
2425                 if (from_zhp == NULL)
2426                         return (-1);
2427                 if (!snapshot_is_before(from_zhp, zhp)) {
2428                         zfs_close(from_zhp);
2429                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2430                             "not an earlier snapshot from the same fs"));
2431                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2432                 }
2433                 zfs_close(from_zhp);
2434         }
2435
2436         if (redactbook != NULL) {
2437                 char bookname[ZFS_MAX_DATASET_NAME_LEN];
2438                 nvlist_t *redact_snaps;
2439                 zfs_handle_t *book_zhp;
2440                 char *at, *pound;
2441                 int dsnamelen;
2442
2443                 pound = strchr(redactbook, '#');
2444                 if (pound != NULL)
2445                         redactbook = pound + 1;
2446                 at = strchr(name, '@');
2447                 if (at == NULL) {
2448                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2449                             "cannot do a redacted send to a filesystem"));
2450                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2451                 }
2452                 dsnamelen = at - name;
2453                 if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2454                     dsnamelen, name, redactbook)
2455                     >= sizeof (bookname)) {
2456                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2457                             "invalid bookmark name"));
2458                         return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2459                 }
2460                 book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2461                 if (book_zhp == NULL)
2462                         return (-1);
2463                 if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2464                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2465                     &redact_snaps) != 0 || redact_snaps == NULL) {
2466                         zfs_close(book_zhp);
2467                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2468                             "not a redaction bookmark"));
2469                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2470                 }
2471                 zfs_close(book_zhp);
2472         }
2473
2474         /*
2475          * Send fs properties
2476          */
2477         if (flags->props || flags->holds || flags->backup) {
2478                 /*
2479                  * Note: the header generated by send_prelim_records()
2480                  * assumes that the incremental source is in the same
2481                  * filesystem/volume as the target (which is a requirement
2482                  * when doing "zfs send -R").  But that isn't always the
2483                  * case here (e.g. send from snap in origin, or send from
2484                  * bookmark).  We pass from=NULL, which will omit this
2485                  * information from the prelim records; it isn't used
2486                  * when receiving this type of stream.
2487                  */
2488                 err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2489                     flags->verbosity > 0, flags->dryrun, flags->raw,
2490                     flags->replicate, B_FALSE, flags->backup, flags->holds,
2491                     flags->props, flags->doall, NULL, NULL);
2492                 if (err != 0)
2493                         return (err);
2494         }
2495
2496         /*
2497          * Perform size estimate if verbose was specified.
2498          */
2499         if (flags->verbosity != 0) {
2500                 err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2501                     errbuf);
2502                 if (err != 0)
2503                         return (err);
2504         }
2505
2506         if (flags->dryrun)
2507                 return (0);
2508
2509         /*
2510          * If progress reporting is requested, spawn a new thread to poll
2511          * ZFS_IOC_SEND_PROGRESS at a regular interval.
2512          */
2513         if (flags->progress) {
2514                 pa.pa_zhp = zhp;
2515                 pa.pa_fd = fd;
2516                 pa.pa_parsable = flags->parsable;
2517                 pa.pa_estimate = B_FALSE;
2518                 pa.pa_verbosity = flags->verbosity;
2519
2520                 err = pthread_create(&ptid, NULL,
2521                     send_progress_thread, &pa);
2522                 if (err != 0) {
2523                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2524                         return (zfs_error(zhp->zfs_hdl,
2525                             EZFS_THREADCREATEFAILED, errbuf));
2526                 }
2527         }
2528
2529         err = lzc_send_redacted(name, from, fd,
2530             lzc_flags_from_sendflags(flags), redactbook);
2531
2532         if (flags->progress) {
2533                 void *status = NULL;
2534                 if (err != 0)
2535                         (void) pthread_cancel(ptid);
2536                 (void) pthread_join(ptid, &status);
2537                 int error = (int)(uintptr_t)status;
2538                 if (error != 0 && status != PTHREAD_CANCELED)
2539                         return (zfs_standard_error_fmt(hdl, error,
2540                             dgettext(TEXT_DOMAIN,
2541                             "progress thread exited nonzero")));
2542         }
2543
2544         if (err == 0 && (flags->props || flags->holds || flags->backup)) {
2545                 /* Write the final end record. */
2546                 err = send_conclusion_record(fd, NULL);
2547                 if (err != 0)
2548                         return (zfs_standard_error(hdl, err, errbuf));
2549         }
2550         if (err != 0) {
2551                 switch (errno) {
2552                 case EXDEV:
2553                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2554                             "not an earlier snapshot from the same fs"));
2555                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2556
2557                 case ENOENT:
2558                 case ESRCH:
2559                         if (lzc_exists(name)) {
2560                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2561                                     "incremental source (%s) does not exist"),
2562                                     from);
2563                         }
2564                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
2565
2566                 case EACCES:
2567                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2568                             "dataset key must be loaded"));
2569                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2570
2571                 case EBUSY:
2572                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2573                             "target is busy; if a filesystem, "
2574                             "it must not be mounted"));
2575                         return (zfs_error(hdl, EZFS_BUSY, errbuf));
2576
2577                 case EDQUOT:
2578                 case EFAULT:
2579                 case EFBIG:
2580                 case EINVAL:
2581                 case EIO:
2582                 case ENOLINK:
2583                 case ENOSPC:
2584                 case ENOSTR:
2585                 case ENXIO:
2586                 case EPIPE:
2587                 case ERANGE:
2588                 case EROFS:
2589                         zfs_error_aux(hdl, "%s", strerror(errno));
2590                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2591
2592                 default:
2593                         return (zfs_standard_error(hdl, errno, errbuf));
2594                 }
2595         }
2596         return (err != 0);
2597 }
2598
2599 /*
2600  * Routines specific to "zfs recv"
2601  */
2602
2603 static int
2604 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2605     boolean_t byteswap, zio_cksum_t *zc)
2606 {
2607         char *cp = buf;
2608         int rv;
2609         int len = ilen;
2610
2611         do {
2612                 rv = read(fd, cp, len);
2613                 cp += rv;
2614                 len -= rv;
2615         } while (rv > 0);
2616
2617         if (rv < 0 || len != 0) {
2618                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2619                     "failed to read from stream"));
2620                 return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2621                     "cannot receive")));
2622         }
2623
2624         if (zc) {
2625                 if (byteswap)
2626                         fletcher_4_incremental_byteswap(buf, ilen, zc);
2627                 else
2628                         fletcher_4_incremental_native(buf, ilen, zc);
2629         }
2630         return (0);
2631 }
2632
2633 static int
2634 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2635     boolean_t byteswap, zio_cksum_t *zc)
2636 {
2637         char *buf;
2638         int err;
2639
2640         buf = zfs_alloc(hdl, len);
2641         if (buf == NULL)
2642                 return (ENOMEM);
2643
2644         if (len > hdl->libzfs_max_nvlist) {
2645                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2646                 free(buf);
2647                 return (ENOMEM);
2648         }
2649
2650         err = recv_read(hdl, fd, buf, len, byteswap, zc);
2651         if (err != 0) {
2652                 free(buf);
2653                 return (err);
2654         }
2655
2656         err = nvlist_unpack(buf, len, nvp, 0);
2657         free(buf);
2658         if (err != 0) {
2659                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2660                     "stream (malformed nvlist)"));
2661                 return (EINVAL);
2662         }
2663         return (0);
2664 }
2665
2666 /*
2667  * Returns the grand origin (origin of origin of origin...) of a given handle.
2668  * If this dataset is not a clone, it simply returns a copy of the original
2669  * handle.
2670  */
2671 static zfs_handle_t *
2672 recv_open_grand_origin(zfs_handle_t *zhp)
2673 {
2674         char origin[ZFS_MAX_DATASET_NAME_LEN];
2675         zprop_source_t src;
2676         zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2677
2678         while (ozhp != NULL) {
2679                 if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2680                     sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2681                         break;
2682
2683                 (void) zfs_close(ozhp);
2684                 ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2685         }
2686
2687         return (ozhp);
2688 }
2689
2690 static int
2691 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2692 {
2693         int err;
2694         zfs_handle_t *ozhp = NULL;
2695
2696         /*
2697          * Attempt to rename the dataset. If it fails with EACCES we have
2698          * attempted to rename the dataset outside of its encryption root.
2699          * Force the dataset to become an encryption root and try again.
2700          */
2701         err = lzc_rename(name, newname);
2702         if (err == EACCES) {
2703                 ozhp = recv_open_grand_origin(zhp);
2704                 if (ozhp == NULL) {
2705                         err = ENOENT;
2706                         goto out;
2707                 }
2708
2709                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2710                     NULL, NULL, 0);
2711                 if (err != 0)
2712                         goto out;
2713
2714                 err = lzc_rename(name, newname);
2715         }
2716
2717 out:
2718         if (ozhp != NULL)
2719                 zfs_close(ozhp);
2720         return (err);
2721 }
2722
2723 static int
2724 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2725     int baselen, char *newname, recvflags_t *flags)
2726 {
2727         static int seq;
2728         int err;
2729         prop_changelist_t *clp = NULL;
2730         zfs_handle_t *zhp = NULL;
2731
2732         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2733         if (zhp == NULL) {
2734                 err = -1;
2735                 goto out;
2736         }
2737         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2738             flags->force ? MS_FORCE : 0);
2739         if (clp == NULL) {
2740                 err = -1;
2741                 goto out;
2742         }
2743         err = changelist_prefix(clp);
2744         if (err)
2745                 goto out;
2746
2747         if (tryname) {
2748                 (void) strcpy(newname, tryname);
2749                 if (flags->verbose) {
2750                         (void) printf("attempting rename %s to %s\n",
2751                             name, newname);
2752                 }
2753                 err = recv_rename_impl(zhp, name, newname);
2754                 if (err == 0)
2755                         changelist_rename(clp, name, tryname);
2756         } else {
2757                 err = ENOENT;
2758         }
2759
2760         if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2761                 seq++;
2762
2763                 (void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2764                     "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2765
2766                 if (flags->verbose) {
2767                         (void) printf("failed - trying rename %s to %s\n",
2768                             name, newname);
2769                 }
2770                 err = recv_rename_impl(zhp, name, newname);
2771                 if (err == 0)
2772                         changelist_rename(clp, name, newname);
2773                 if (err && flags->verbose) {
2774                         (void) printf("failed (%u) - "
2775                             "will try again on next pass\n", errno);
2776                 }
2777                 err = EAGAIN;
2778         } else if (flags->verbose) {
2779                 if (err == 0)
2780                         (void) printf("success\n");
2781                 else
2782                         (void) printf("failed (%u)\n", errno);
2783         }
2784
2785         (void) changelist_postfix(clp);
2786
2787 out:
2788         if (clp != NULL)
2789                 changelist_free(clp);
2790         if (zhp != NULL)
2791                 zfs_close(zhp);
2792
2793         return (err);
2794 }
2795
2796 static int
2797 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2798     const char *origin_fsname, recvflags_t *flags)
2799 {
2800         int err;
2801         zfs_cmd_t zc = {"\0"};
2802         zfs_handle_t *zhp = NULL, *ozhp = NULL;
2803
2804         if (flags->verbose)
2805                 (void) printf("promoting %s\n", fsname);
2806
2807         (void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2808         (void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2809
2810         /*
2811          * Attempt to promote the dataset. If it fails with EACCES the
2812          * promotion would cause this dataset to leave its encryption root.
2813          * Force the origin to become an encryption root and try again.
2814          */
2815         err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2816         if (err == EACCES) {
2817                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2818                 if (zhp == NULL) {
2819                         err = -1;
2820                         goto out;
2821                 }
2822
2823                 ozhp = recv_open_grand_origin(zhp);
2824                 if (ozhp == NULL) {
2825                         err = -1;
2826                         goto out;
2827                 }
2828
2829                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2830                     NULL, NULL, 0);
2831                 if (err != 0)
2832                         goto out;
2833
2834                 err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2835         }
2836
2837 out:
2838         if (zhp != NULL)
2839                 zfs_close(zhp);
2840         if (ozhp != NULL)
2841                 zfs_close(ozhp);
2842
2843         return (err);
2844 }
2845
2846 static int
2847 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2848     char *newname, recvflags_t *flags)
2849 {
2850         int err = 0;
2851         prop_changelist_t *clp;
2852         zfs_handle_t *zhp;
2853         boolean_t defer = B_FALSE;
2854         int spa_version;
2855
2856         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2857         if (zhp == NULL)
2858                 return (-1);
2859         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2860             flags->force ? MS_FORCE : 0);
2861         if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT &&
2862             zfs_spa_version(zhp, &spa_version) == 0 &&
2863             spa_version >= SPA_VERSION_USERREFS)
2864                 defer = B_TRUE;
2865         zfs_close(zhp);
2866         if (clp == NULL)
2867                 return (-1);
2868         err = changelist_prefix(clp);
2869         if (err)
2870                 return (err);
2871
2872         if (flags->verbose)
2873                 (void) printf("attempting destroy %s\n", name);
2874         if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
2875                 nvlist_t *nv = fnvlist_alloc();
2876                 fnvlist_add_boolean(nv, name);
2877                 err = lzc_destroy_snaps(nv, defer, NULL);
2878                 fnvlist_free(nv);
2879         } else {
2880                 err = lzc_destroy(name);
2881         }
2882         if (err == 0) {
2883                 if (flags->verbose)
2884                         (void) printf("success\n");
2885                 changelist_remove(clp, name);
2886         }
2887
2888         (void) changelist_postfix(clp);
2889         changelist_free(clp);
2890
2891         /*
2892          * Deferred destroy might destroy the snapshot or only mark it to be
2893          * destroyed later, and it returns success in either case.
2894          */
2895         if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
2896             ZFS_TYPE_SNAPSHOT))) {
2897                 err = recv_rename(hdl, name, NULL, baselen, newname, flags);
2898         }
2899
2900         return (err);
2901 }
2902
2903 typedef struct guid_to_name_data {
2904         uint64_t guid;
2905         boolean_t bookmark_ok;
2906         char *name;
2907         char *skip;
2908         uint64_t *redact_snap_guids;
2909         uint64_t num_redact_snaps;
2910 } guid_to_name_data_t;
2911
2912 static boolean_t
2913 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
2914 {
2915         uint64_t *bmark_snaps;
2916         uint_t bmark_num_snaps;
2917         nvlist_t *nvl;
2918         if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
2919                 return (B_FALSE);
2920
2921         nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
2922             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
2923         bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
2924             &bmark_num_snaps);
2925         if (bmark_num_snaps != gtnd->num_redact_snaps)
2926                 return (B_FALSE);
2927         int i = 0;
2928         for (; i < bmark_num_snaps; i++) {
2929                 int j = 0;
2930                 for (; j < bmark_num_snaps; j++) {
2931                         if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
2932                                 break;
2933                 }
2934                 if (j == bmark_num_snaps)
2935                         break;
2936         }
2937         return (i == bmark_num_snaps);
2938 }
2939
2940 static int
2941 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
2942 {
2943         guid_to_name_data_t *gtnd = arg;
2944         const char *slash;
2945         int err;
2946
2947         if (gtnd->skip != NULL &&
2948             (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
2949             strcmp(slash + 1, gtnd->skip) == 0) {
2950                 zfs_close(zhp);
2951                 return (0);
2952         }
2953
2954         if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
2955             (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
2956                 (void) strcpy(gtnd->name, zhp->zfs_name);
2957                 zfs_close(zhp);
2958                 return (EEXIST);
2959         }
2960
2961         err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
2962         if (err != EEXIST && gtnd->bookmark_ok)
2963                 err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
2964         zfs_close(zhp);
2965         return (err);
2966 }
2967
2968 /*
2969  * Attempt to find the local dataset associated with this guid.  In the case of
2970  * multiple matches, we attempt to find the "best" match by searching
2971  * progressively larger portions of the hierarchy.  This allows one to send a
2972  * tree of datasets individually and guarantee that we will find the source
2973  * guid within that hierarchy, even if there are multiple matches elsewhere.
2974  *
2975  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
2976  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
2977  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
2978  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
2979  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
2980  * given guid.  Note that a redaction bookmark can be returned if
2981  * num_redact_snaps == -1.
2982  */
2983 static int
2984 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
2985     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
2986     uint64_t num_redact_snaps, char *name)
2987 {
2988         char pname[ZFS_MAX_DATASET_NAME_LEN];
2989         guid_to_name_data_t gtnd;
2990
2991         gtnd.guid = guid;
2992         gtnd.bookmark_ok = bookmark_ok;
2993         gtnd.name = name;
2994         gtnd.skip = NULL;
2995         gtnd.redact_snap_guids = redact_snap_guids;
2996         gtnd.num_redact_snaps = num_redact_snaps;
2997
2998         /*
2999          * Search progressively larger portions of the hierarchy, starting
3000          * with the filesystem specified by 'parent'.  This will
3001          * select the "most local" version of the origin snapshot in the case
3002          * that there are multiple matching snapshots in the system.
3003          */
3004         (void) strlcpy(pname, parent, sizeof (pname));
3005         char *cp = strrchr(pname, '@');
3006         if (cp == NULL)
3007                 cp = strchr(pname, '\0');
3008         for (; cp != NULL; cp = strrchr(pname, '/')) {
3009                 /* Chop off the last component and open the parent */
3010                 *cp = '\0';
3011                 zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3012
3013                 if (zhp == NULL)
3014                         continue;
3015                 int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3016                 if (err != EEXIST)
3017                         err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3018                 if (err != EEXIST && bookmark_ok)
3019                         err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3020                 zfs_close(zhp);
3021                 if (err == EEXIST)
3022                         return (0);
3023
3024                 /*
3025                  * Remember the last portion of the dataset so we skip it next
3026                  * time through (as we've already searched that portion of the
3027                  * hierarchy).
3028                  */
3029                 gtnd.skip = strrchr(pname, '/') + 1;
3030         }
3031
3032         return (ENOENT);
3033 }
3034
3035 static int
3036 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3037     boolean_t bookmark_ok, char *name)
3038 {
3039         return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3040             -1, name));
3041 }
3042
3043 /*
3044  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3045  * guid1 is after guid2.
3046  */
3047 static int
3048 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3049     uint64_t guid1, uint64_t guid2)
3050 {
3051         nvlist_t *nvfs;
3052         char *fsname = NULL, *snapname = NULL;
3053         char buf[ZFS_MAX_DATASET_NAME_LEN];
3054         int rv;
3055         zfs_handle_t *guid1hdl, *guid2hdl;
3056         uint64_t create1, create2;
3057
3058         if (guid2 == 0)
3059                 return (0);
3060         if (guid1 == 0)
3061                 return (1);
3062
3063         nvfs = fsavl_find(avl, guid1, &snapname);
3064         fsname = fnvlist_lookup_string(nvfs, "name");
3065         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3066         guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3067         if (guid1hdl == NULL)
3068                 return (-1);
3069
3070         nvfs = fsavl_find(avl, guid2, &snapname);
3071         fsname = fnvlist_lookup_string(nvfs, "name");
3072         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3073         guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3074         if (guid2hdl == NULL) {
3075                 zfs_close(guid1hdl);
3076                 return (-1);
3077         }
3078
3079         create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3080         create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3081
3082         if (create1 < create2)
3083                 rv = -1;
3084         else if (create1 > create2)
3085                 rv = +1;
3086         else
3087                 rv = 0;
3088
3089         zfs_close(guid1hdl);
3090         zfs_close(guid2hdl);
3091
3092         return (rv);
3093 }
3094
3095 /*
3096  * This function reestablishes the hierarchy of encryption roots after a
3097  * recursive incremental receive has completed. This must be done after the
3098  * second call to recv_incremental_replication() has renamed and promoted all
3099  * sent datasets to their final locations in the dataset hierarchy.
3100  */
3101 static int
3102 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3103     nvlist_t *stream_nv)
3104 {
3105         int err;
3106         nvpair_t *fselem = NULL;
3107         nvlist_t *stream_fss;
3108
3109         stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3110
3111         while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3112                 zfs_handle_t *zhp = NULL;
3113                 uint64_t crypt;
3114                 nvlist_t *snaps, *props, *stream_nvfs = NULL;
3115                 nvpair_t *snapel = NULL;
3116                 boolean_t is_encroot, is_clone, stream_encroot;
3117                 char *cp;
3118                 char *stream_keylocation = NULL;
3119                 char keylocation[MAXNAMELEN];
3120                 char fsname[ZFS_MAX_DATASET_NAME_LEN];
3121
3122                 keylocation[0] = '\0';
3123                 stream_nvfs = fnvpair_value_nvlist(fselem);
3124                 snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3125                 props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3126                 stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3127
3128                 /* find a snapshot from the stream that exists locally */
3129                 err = ENOENT;
3130                 while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3131                         uint64_t guid;
3132
3133                         guid = fnvpair_value_uint64(snapel);
3134                         err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3135                             fsname);
3136                         if (err == 0)
3137                                 break;
3138                 }
3139
3140                 if (err != 0)
3141                         continue;
3142
3143                 cp = strchr(fsname, '@');
3144                 if (cp != NULL)
3145                         *cp = '\0';
3146
3147                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3148                 if (zhp == NULL) {
3149                         err = ENOENT;
3150                         goto error;
3151                 }
3152
3153                 crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3154                 is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3155                 (void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3156
3157                 /* we don't need to do anything for unencrypted datasets */
3158                 if (crypt == ZIO_CRYPT_OFF) {
3159                         zfs_close(zhp);
3160                         continue;
3161                 }
3162
3163                 /*
3164                  * If the dataset is flagged as an encryption root, was not
3165                  * received as a clone and is not currently an encryption root,
3166                  * force it to become one. Fixup the keylocation if necessary.
3167                  */
3168                 if (stream_encroot) {
3169                         if (!is_clone && !is_encroot) {
3170                                 err = lzc_change_key(fsname,
3171                                     DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3172                                 if (err != 0) {
3173                                         zfs_close(zhp);
3174                                         goto error;
3175                                 }
3176                         }
3177
3178                         stream_keylocation = fnvlist_lookup_string(props,
3179                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3180
3181                         /*
3182                          * Refresh the properties in case the call to
3183                          * lzc_change_key() changed the value.
3184                          */
3185                         zfs_refresh_properties(zhp);
3186                         err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3187                             keylocation, sizeof (keylocation), NULL, NULL,
3188                             0, B_TRUE);
3189                         if (err != 0) {
3190                                 zfs_close(zhp);
3191                                 goto error;
3192                         }
3193
3194                         if (strcmp(keylocation, stream_keylocation) != 0) {
3195                                 err = zfs_prop_set(zhp,
3196                                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3197                                     stream_keylocation);
3198                                 if (err != 0) {
3199                                         zfs_close(zhp);
3200                                         goto error;
3201                                 }
3202                         }
3203                 }
3204
3205                 /*
3206                  * If the dataset is not flagged as an encryption root and is
3207                  * currently an encryption root, force it to inherit from its
3208                  * parent. The root of a raw send should never be
3209                  * force-inherited.
3210                  */
3211                 if (!stream_encroot && is_encroot &&
3212                     strcmp(top_zfs, fsname) != 0) {
3213                         err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3214                             NULL, NULL, 0);
3215                         if (err != 0) {
3216                                 zfs_close(zhp);
3217                                 goto error;
3218                         }
3219                 }
3220
3221                 zfs_close(zhp);
3222         }
3223
3224         return (0);
3225
3226 error:
3227         return (err);
3228 }
3229
3230 static int
3231 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3232     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3233     nvlist_t *renamed)
3234 {
3235         nvlist_t *local_nv, *deleted = NULL;
3236         avl_tree_t *local_avl;
3237         nvpair_t *fselem, *nextfselem;
3238         char *fromsnap;
3239         char newname[ZFS_MAX_DATASET_NAME_LEN];
3240         char guidname[32];
3241         int error;
3242         boolean_t needagain, progress, recursive;
3243         char *s1, *s2;
3244
3245         fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3246
3247         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3248             ENOENT);
3249
3250         if (flags->dryrun)
3251                 return (0);
3252
3253 again:
3254         needagain = progress = B_FALSE;
3255
3256         deleted = fnvlist_alloc();
3257
3258         if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3259             recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3260             B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3261                 return (error);
3262
3263         /*
3264          * Process deletes and renames
3265          */
3266         for (fselem = nvlist_next_nvpair(local_nv, NULL);
3267             fselem; fselem = nextfselem) {
3268                 nvlist_t *nvfs, *snaps;
3269                 nvlist_t *stream_nvfs = NULL;
3270                 nvpair_t *snapelem, *nextsnapelem;
3271                 uint64_t fromguid = 0;
3272                 uint64_t originguid = 0;
3273                 uint64_t stream_originguid = 0;
3274                 uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3275                 char *fsname, *stream_fsname;
3276
3277                 nextfselem = nvlist_next_nvpair(local_nv, fselem);
3278
3279                 nvfs = fnvpair_value_nvlist(fselem);
3280                 snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3281                 fsname = fnvlist_lookup_string(nvfs, "name");
3282                 parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3283                     "parentfromsnap");
3284                 (void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3285
3286                 /*
3287                  * First find the stream's fs, so we can check for
3288                  * a different origin (due to "zfs promote")
3289                  */
3290                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3291                     snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3292                         uint64_t thisguid;
3293
3294                         thisguid = fnvpair_value_uint64(snapelem);
3295                         stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3296
3297                         if (stream_nvfs != NULL)
3298                                 break;
3299                 }
3300
3301                 /* check for promote */
3302                 (void) nvlist_lookup_uint64(stream_nvfs, "origin",
3303                     &stream_originguid);
3304                 if (stream_nvfs && originguid != stream_originguid) {
3305                         switch (created_before(hdl, local_avl,
3306                             stream_originguid, originguid)) {
3307                         case 1: {
3308                                 /* promote it! */
3309                                 nvlist_t *origin_nvfs;
3310                                 char *origin_fsname;
3311
3312                                 origin_nvfs = fsavl_find(local_avl, originguid,
3313                                     NULL);
3314                                 origin_fsname = fnvlist_lookup_string(
3315                                     origin_nvfs, "name");
3316                                 error = recv_promote(hdl, fsname, origin_fsname,
3317                                     flags);
3318                                 if (error == 0)
3319                                         progress = B_TRUE;
3320                                 break;
3321                         }
3322                         default:
3323                                 break;
3324                         case -1:
3325                                 fsavl_destroy(local_avl);
3326                                 fnvlist_free(local_nv);
3327                                 return (-1);
3328                         }
3329                         /*
3330                          * We had/have the wrong origin, therefore our
3331                          * list of snapshots is wrong.  Need to handle
3332                          * them on the next pass.
3333                          */
3334                         needagain = B_TRUE;
3335                         continue;
3336                 }
3337
3338                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3339                     snapelem; snapelem = nextsnapelem) {
3340                         uint64_t thisguid;
3341                         char *stream_snapname;
3342                         nvlist_t *found, *props;
3343
3344                         nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3345
3346                         thisguid = fnvpair_value_uint64(snapelem);
3347                         found = fsavl_find(stream_avl, thisguid,
3348                             &stream_snapname);
3349
3350                         /* check for delete */
3351                         if (found == NULL) {
3352                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3353
3354                                 if (!flags->force)
3355                                         continue;
3356
3357                                 (void) snprintf(name, sizeof (name), "%s@%s",
3358                                     fsname, nvpair_name(snapelem));
3359
3360                                 error = recv_destroy(hdl, name,
3361                                     strlen(fsname)+1, newname, flags);
3362                                 if (error)
3363                                         needagain = B_TRUE;
3364                                 else
3365                                         progress = B_TRUE;
3366                                 sprintf(guidname, "%llu",
3367                                     (u_longlong_t)thisguid);
3368                                 nvlist_add_boolean(deleted, guidname);
3369                                 continue;
3370                         }
3371
3372                         stream_nvfs = found;
3373
3374                         if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3375                             &props) && 0 == nvlist_lookup_nvlist(props,
3376                             stream_snapname, &props)) {
3377                                 zfs_cmd_t zc = {"\0"};
3378
3379                                 zc.zc_cookie = B_TRUE; /* received */
3380                                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3381                                     "%s@%s", fsname, nvpair_name(snapelem));
3382                                 if (zcmd_write_src_nvlist(hdl, &zc,
3383                                     props) == 0) {
3384                                         (void) zfs_ioctl(hdl,
3385                                             ZFS_IOC_SET_PROP, &zc);
3386                                         zcmd_free_nvlists(&zc);
3387                                 }
3388                         }
3389
3390                         /* check for different snapname */
3391                         if (strcmp(nvpair_name(snapelem),
3392                             stream_snapname) != 0) {
3393                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3394                                 char tryname[ZFS_MAX_DATASET_NAME_LEN];
3395
3396                                 (void) snprintf(name, sizeof (name), "%s@%s",
3397                                     fsname, nvpair_name(snapelem));
3398                                 (void) snprintf(tryname, sizeof (name), "%s@%s",
3399                                     fsname, stream_snapname);
3400
3401                                 error = recv_rename(hdl, name, tryname,
3402                                     strlen(fsname)+1, newname, flags);
3403                                 if (error)
3404                                         needagain = B_TRUE;
3405                                 else
3406                                         progress = B_TRUE;
3407                         }
3408
3409                         if (strcmp(stream_snapname, fromsnap) == 0)
3410                                 fromguid = thisguid;
3411                 }
3412
3413                 /* check for delete */
3414                 if (stream_nvfs == NULL) {
3415                         if (!flags->force)
3416                                 continue;
3417
3418                         error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3419                             newname, flags);
3420                         if (error)
3421                                 needagain = B_TRUE;
3422                         else
3423                                 progress = B_TRUE;
3424                         sprintf(guidname, "%llu",
3425                             (u_longlong_t)parent_fromsnap_guid);
3426                         nvlist_add_boolean(deleted, guidname);
3427                         continue;
3428                 }
3429
3430                 if (fromguid == 0) {
3431                         if (flags->verbose) {
3432                                 (void) printf("local fs %s does not have "
3433                                     "fromsnap (%s in stream); must have "
3434                                     "been deleted locally; ignoring\n",
3435                                     fsname, fromsnap);
3436                         }
3437                         continue;
3438                 }
3439
3440                 stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3441                 stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3442                     stream_nvfs, "parentfromsnap");
3443
3444                 s1 = strrchr(fsname, '/');
3445                 s2 = strrchr(stream_fsname, '/');
3446
3447                 /*
3448                  * Check if we're going to rename based on parent guid change
3449                  * and the current parent guid was also deleted. If it was then
3450                  * rename will fail and is likely unneeded, so avoid this and
3451                  * force an early retry to determine the new
3452                  * parent_fromsnap_guid.
3453                  */
3454                 if (stream_parent_fromsnap_guid != 0 &&
3455                     parent_fromsnap_guid != 0 &&
3456                     stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3457                         sprintf(guidname, "%llu",
3458                             (u_longlong_t)parent_fromsnap_guid);
3459                         if (nvlist_exists(deleted, guidname)) {
3460                                 progress = B_TRUE;
3461                                 needagain = B_TRUE;
3462                                 goto doagain;
3463                         }
3464                 }
3465
3466                 /*
3467                  * Check for rename. If the exact receive path is specified, it
3468                  * does not count as a rename, but we still need to check the
3469                  * datasets beneath it.
3470                  */
3471                 if ((stream_parent_fromsnap_guid != 0 &&
3472                     parent_fromsnap_guid != 0 &&
3473                     stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3474                     ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3475                     (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3476                         nvlist_t *parent;
3477                         char tryname[ZFS_MAX_DATASET_NAME_LEN];
3478
3479                         parent = fsavl_find(local_avl,
3480                             stream_parent_fromsnap_guid, NULL);
3481                         /*
3482                          * NB: parent might not be found if we used the
3483                          * tosnap for stream_parent_fromsnap_guid,
3484                          * because the parent is a newly-created fs;
3485                          * we'll be able to rename it after we recv the
3486                          * new fs.
3487                          */
3488                         if (parent != NULL) {
3489                                 char *pname;
3490
3491                                 pname = fnvlist_lookup_string(parent, "name");
3492                                 (void) snprintf(tryname, sizeof (tryname),
3493                                     "%s%s", pname, strrchr(stream_fsname, '/'));
3494                         } else {
3495                                 tryname[0] = '\0';
3496                                 if (flags->verbose) {
3497                                         (void) printf("local fs %s new parent "
3498                                             "not found\n", fsname);
3499                                 }
3500                         }
3501
3502                         newname[0] = '\0';
3503
3504                         error = recv_rename(hdl, fsname, tryname,
3505                             strlen(tofs)+1, newname, flags);
3506
3507                         if (renamed != NULL && newname[0] != '\0') {
3508                                 fnvlist_add_boolean(renamed, newname);
3509                         }
3510
3511                         if (error)
3512                                 needagain = B_TRUE;
3513                         else
3514                                 progress = B_TRUE;
3515                 }
3516         }
3517
3518 doagain:
3519         fsavl_destroy(local_avl);
3520         fnvlist_free(local_nv);
3521         fnvlist_free(deleted);
3522
3523         if (needagain && progress) {
3524                 /* do another pass to fix up temporary names */
3525                 if (flags->verbose)
3526                         (void) printf("another pass:\n");
3527                 goto again;
3528         }
3529
3530         return (needagain || error != 0);
3531 }
3532
3533 static int
3534 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3535     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3536     char **top_zfs, nvlist_t *cmdprops)
3537 {
3538         nvlist_t *stream_nv = NULL;
3539         avl_tree_t *stream_avl = NULL;
3540         char *fromsnap = NULL;
3541         char *sendsnap = NULL;
3542         char *cp;
3543         char tofs[ZFS_MAX_DATASET_NAME_LEN];
3544         char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3545         char errbuf[1024];
3546         dmu_replay_record_t drre;
3547         int error;
3548         boolean_t anyerr = B_FALSE;
3549         boolean_t softerr = B_FALSE;
3550         boolean_t recursive, raw;
3551
3552         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3553             "cannot receive"));
3554
3555         assert(drr->drr_type == DRR_BEGIN);
3556         assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3557         assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3558             DMU_COMPOUNDSTREAM);
3559
3560         /*
3561          * Read in the nvlist from the stream.
3562          */
3563         if (drr->drr_payloadlen != 0) {
3564                 error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3565                     &stream_nv, flags->byteswap, zc);
3566                 if (error) {
3567                         error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3568                         goto out;
3569                 }
3570         }
3571
3572         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3573             ENOENT);
3574         raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3575
3576         if (recursive && strchr(destname, '@')) {
3577                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3578                     "cannot specify snapshot name for multi-snapshot stream"));
3579                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3580                 goto out;
3581         }
3582
3583         /*
3584          * Read in the end record and verify checksum.
3585          */
3586         if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3587             flags->byteswap, NULL)))
3588                 goto out;
3589         if (flags->byteswap) {
3590                 drre.drr_type = BSWAP_32(drre.drr_type);
3591                 drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3592                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3593                 drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3594                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3595                 drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3596                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3597                 drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3598                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3599         }
3600         if (drre.drr_type != DRR_END) {
3601                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3602                 goto out;
3603         }
3604         if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3605                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3606                     "incorrect header checksum"));
3607                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3608                 goto out;
3609         }
3610
3611         (void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3612
3613         if (drr->drr_payloadlen != 0) {
3614                 nvlist_t *stream_fss;
3615
3616                 stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3617                 if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3618                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3619                             "couldn't allocate avl tree"));
3620                         error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3621                         goto out;
3622                 }
3623
3624                 if (fromsnap != NULL && recursive) {
3625                         nvlist_t *renamed = NULL;
3626                         nvpair_t *pair = NULL;
3627
3628                         (void) strlcpy(tofs, destname, sizeof (tofs));
3629                         if (flags->isprefix) {
3630                                 struct drr_begin *drrb = &drr->drr_u.drr_begin;
3631                                 int i;
3632
3633                                 if (flags->istail) {
3634                                         cp = strrchr(drrb->drr_toname, '/');
3635                                         if (cp == NULL) {
3636                                                 (void) strlcat(tofs, "/",
3637                                                     sizeof (tofs));
3638                                                 i = 0;
3639                                         } else {
3640                                                 i = (cp - drrb->drr_toname);
3641                                         }
3642                                 } else {
3643                                         i = strcspn(drrb->drr_toname, "/@");
3644                                 }
3645                                 /* zfs_receive_one() will create_parents() */
3646                                 (void) strlcat(tofs, &drrb->drr_toname[i],
3647                                     sizeof (tofs));
3648                                 *strchr(tofs, '@') = '\0';
3649                         }
3650
3651                         if (!flags->dryrun && !flags->nomount) {
3652                                 renamed = fnvlist_alloc();
3653                         }
3654
3655                         softerr = recv_incremental_replication(hdl, tofs, flags,
3656                             stream_nv, stream_avl, renamed);
3657
3658                         /* Unmount renamed filesystems before receiving. */
3659                         while ((pair = nvlist_next_nvpair(renamed,
3660                             pair)) != NULL) {
3661                                 zfs_handle_t *zhp;
3662                                 prop_changelist_t *clp = NULL;
3663
3664                                 zhp = zfs_open(hdl, nvpair_name(pair),
3665                                     ZFS_TYPE_FILESYSTEM);
3666                                 if (zhp != NULL) {
3667                                         clp = changelist_gather(zhp,
3668                                             ZFS_PROP_MOUNTPOINT, 0,
3669                                             flags->forceunmount ? MS_FORCE : 0);
3670                                         zfs_close(zhp);
3671                                         if (clp != NULL) {
3672                                                 softerr |=
3673                                                     changelist_prefix(clp);
3674                                                 changelist_free(clp);
3675                                         }
3676                                 }
3677                         }
3678
3679                         fnvlist_free(renamed);
3680                 }
3681         }
3682
3683         /*
3684          * Get the fs specified by the first path in the stream (the top level
3685          * specified by 'zfs send') and pass it to each invocation of
3686          * zfs_receive_one().
3687          */
3688         (void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3689             sizeof (sendfs));
3690         if ((cp = strchr(sendfs, '@')) != NULL) {
3691                 *cp = '\0';
3692                 /*
3693                  * Find the "sendsnap", the final snapshot in a replication
3694                  * stream.  zfs_receive_one() handles certain errors
3695                  * differently, depending on if the contained stream is the
3696                  * last one or not.
3697                  */
3698                 sendsnap = (cp + 1);
3699         }
3700
3701         /* Finally, receive each contained stream */
3702         do {
3703                 /*
3704                  * we should figure out if it has a recoverable
3705                  * error, in which case do a recv_skip() and drive on.
3706                  * Note, if we fail due to already having this guid,
3707                  * zfs_receive_one() will take care of it (ie,
3708                  * recv_skip() and return 0).
3709                  */
3710                 error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3711                     sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3712                 if (error == ENODATA) {
3713                         error = 0;
3714                         break;
3715                 }
3716                 anyerr |= error;
3717         } while (error == 0);
3718
3719         if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3720                 /*
3721                  * Now that we have the fs's they sent us, try the
3722                  * renames again.
3723                  */
3724                 softerr = recv_incremental_replication(hdl, tofs, flags,
3725                     stream_nv, stream_avl, NULL);
3726         }
3727
3728         if (raw && softerr == 0 && *top_zfs != NULL) {
3729                 softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3730                     stream_nv);
3731         }
3732
3733 out:
3734         fsavl_destroy(stream_avl);
3735         fnvlist_free(stream_nv);
3736         if (softerr)
3737                 error = -2;
3738         if (anyerr)
3739                 error = -1;
3740         return (error);
3741 }
3742
3743 static void
3744 trunc_prop_errs(int truncated)
3745 {
3746         ASSERT(truncated != 0);
3747
3748         if (truncated == 1)
3749                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3750                     "1 more property could not be set\n"));
3751         else
3752                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3753                     "%d more properties could not be set\n"), truncated);
3754 }
3755
3756 static int
3757 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3758 {
3759         dmu_replay_record_t *drr;
3760         void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3761         uint64_t payload_size;
3762         char errbuf[1024];
3763
3764         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3765             "cannot receive"));
3766
3767         /* XXX would be great to use lseek if possible... */
3768         drr = buf;
3769
3770         while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3771             byteswap, NULL) == 0) {
3772                 if (byteswap)
3773                         drr->drr_type = BSWAP_32(drr->drr_type);
3774
3775                 switch (drr->drr_type) {
3776                 case DRR_BEGIN:
3777                         if (drr->drr_payloadlen != 0) {
3778                                 (void) recv_read(hdl, fd, buf,
3779                                     drr->drr_payloadlen, B_FALSE, NULL);
3780                         }
3781                         break;
3782
3783                 case DRR_END:
3784                         free(buf);
3785                         return (0);
3786
3787                 case DRR_OBJECT:
3788                         if (byteswap) {
3789                                 drr->drr_u.drr_object.drr_bonuslen =
3790                                     BSWAP_32(drr->drr_u.drr_object.
3791                                     drr_bonuslen);
3792                                 drr->drr_u.drr_object.drr_raw_bonuslen =
3793                                     BSWAP_32(drr->drr_u.drr_object.
3794                                     drr_raw_bonuslen);
3795                         }
3796
3797                         payload_size =
3798                             DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3799                         (void) recv_read(hdl, fd, buf, payload_size,
3800                             B_FALSE, NULL);
3801                         break;
3802
3803                 case DRR_WRITE:
3804                         if (byteswap) {
3805                                 drr->drr_u.drr_write.drr_logical_size =
3806                                     BSWAP_64(
3807                                     drr->drr_u.drr_write.drr_logical_size);
3808                                 drr->drr_u.drr_write.drr_compressed_size =
3809                                     BSWAP_64(
3810                                     drr->drr_u.drr_write.drr_compressed_size);
3811                         }
3812                         payload_size =
3813                             DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3814                         assert(payload_size <= SPA_MAXBLOCKSIZE);
3815                         (void) recv_read(hdl, fd, buf,
3816                             payload_size, B_FALSE, NULL);
3817                         break;
3818                 case DRR_SPILL:
3819                         if (byteswap) {
3820                                 drr->drr_u.drr_spill.drr_length =
3821                                     BSWAP_64(drr->drr_u.drr_spill.drr_length);
3822                                 drr->drr_u.drr_spill.drr_compressed_size =
3823                                     BSWAP_64(drr->drr_u.drr_spill.
3824                                     drr_compressed_size);
3825                         }
3826
3827                         payload_size =
3828                             DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3829                         (void) recv_read(hdl, fd, buf, payload_size,
3830                             B_FALSE, NULL);
3831                         break;
3832                 case DRR_WRITE_EMBEDDED:
3833                         if (byteswap) {
3834                                 drr->drr_u.drr_write_embedded.drr_psize =
3835                                     BSWAP_32(drr->drr_u.drr_write_embedded.
3836                                     drr_psize);
3837                         }
3838                         (void) recv_read(hdl, fd, buf,
3839                             P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3840                             8), B_FALSE, NULL);
3841                         break;
3842                 case DRR_OBJECT_RANGE:
3843                 case DRR_WRITE_BYREF:
3844                 case DRR_FREEOBJECTS:
3845                 case DRR_FREE:
3846                         break;
3847
3848                 default:
3849                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3850                             "invalid record type"));
3851                         free(buf);
3852                         return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3853                 }
3854         }
3855
3856         free(buf);
3857         return (-1);
3858 }
3859
3860 static void
3861 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
3862     boolean_t resumable, boolean_t checksum)
3863 {
3864         char target_fs[ZFS_MAX_DATASET_NAME_LEN];
3865
3866         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
3867             "checksum mismatch" : "incomplete stream")));
3868
3869         if (!resumable)
3870                 return;
3871         (void) strlcpy(target_fs, target_snap, sizeof (target_fs));
3872         *strchr(target_fs, '@') = '\0';
3873         zfs_handle_t *zhp = zfs_open(hdl, target_fs,
3874             ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
3875         if (zhp == NULL)
3876                 return;
3877
3878         char token_buf[ZFS_MAXPROPLEN];
3879         int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
3880             token_buf, sizeof (token_buf),
3881             NULL, NULL, 0, B_TRUE);
3882         if (error == 0) {
3883                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3884                     "checksum mismatch or incomplete stream.\n"
3885                     "Partially received snapshot is saved.\n"
3886                     "A resuming stream can be generated on the sending "
3887                     "system by running:\n"
3888                     "    zfs send -t %s"),
3889                     token_buf);
3890         }
3891         zfs_close(zhp);
3892 }
3893
3894 /*
3895  * Prepare a new nvlist of properties that are to override (-o) or be excluded
3896  * (-x) from the received dataset
3897  * recvprops: received properties from the send stream
3898  * cmdprops: raw input properties from command line
3899  * origprops: properties, both locally-set and received, currently set on the
3900  *            target dataset if it exists, NULL otherwise.
3901  * oxprops: valid output override (-o) and excluded (-x) properties
3902  */
3903 static int
3904 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
3905     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
3906     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
3907     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
3908     uint_t *wkeylen_out, const char *errbuf)
3909 {
3910         nvpair_t *nvp;
3911         nvlist_t *oprops, *voprops;
3912         zfs_handle_t *zhp = NULL;
3913         zpool_handle_t *zpool_hdl = NULL;
3914         char *cp;
3915         int ret = 0;
3916         char namebuf[ZFS_MAX_DATASET_NAME_LEN];
3917
3918         if (nvlist_empty(cmdprops))
3919                 return (0); /* No properties to override or exclude */
3920
3921         *oxprops = fnvlist_alloc();
3922         oprops = fnvlist_alloc();
3923
3924         strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
3925
3926         /*
3927          * Get our dataset handle. The target dataset may not exist yet.
3928          */
3929         if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
3930                 zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
3931                 if (zhp == NULL) {
3932                         ret = -1;
3933                         goto error;
3934                 }
3935         }
3936
3937         /* open the zpool handle */
3938         cp = strchr(namebuf, '/');
3939         if (cp != NULL)
3940                 *cp = '\0';
3941         zpool_hdl = zpool_open(hdl, namebuf);
3942         if (zpool_hdl == NULL) {
3943                 ret = -1;
3944                 goto error;
3945         }
3946
3947         /* restore namebuf to match fsname for later use */
3948         if (cp != NULL)
3949                 *cp = '/';
3950
3951         /*
3952          * first iteration: process excluded (-x) properties now and gather
3953          * added (-o) properties to be later processed by zfs_valid_proplist()
3954          */
3955         nvp = NULL;
3956         while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
3957                 const char *name = nvpair_name(nvp);
3958                 zfs_prop_t prop = zfs_name_to_prop(name);
3959
3960                 /*
3961                  * It turns out, if we don't normalize "aliased" names
3962                  * e.g. compress= against the "real" names (e.g. compression)
3963                  * here, then setting/excluding them does not work as
3964                  * intended.
3965                  *
3966                  * But since user-defined properties wouldn't have a valid
3967                  * mapping here, we do this conditional dance.
3968                  */
3969                 const char *newname = name;
3970                 if (prop >= ZFS_PROP_TYPE)
3971                         newname = zfs_prop_to_name(prop);
3972
3973                 /* "origin" is processed separately, don't handle it here */
3974                 if (prop == ZFS_PROP_ORIGIN)
3975                         continue;
3976
3977                 /* raw streams can't override encryption properties */
3978                 if ((zfs_prop_encryption_key_param(prop) ||
3979                     prop == ZFS_PROP_ENCRYPTION) && raw) {
3980                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3981                             "encryption property '%s' cannot "
3982                             "be set or excluded for raw streams."), name);
3983                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3984                         goto error;
3985                 }
3986
3987                 /* incremental streams can only exclude encryption properties */
3988                 if ((zfs_prop_encryption_key_param(prop) ||
3989                     prop == ZFS_PROP_ENCRYPTION) && !newfs &&
3990                     nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
3991                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3992                             "encryption property '%s' cannot "
3993                             "be set for incremental streams."), name);
3994                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3995                         goto error;
3996                 }
3997
3998                 switch (nvpair_type(nvp)) {
3999                 case DATA_TYPE_BOOLEAN: /* -x property */
4000                         /*
4001                          * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4002                          * a property: this is done by forcing an explicit
4003                          * inherit on the destination so the effective value is
4004                          * not the one we received from the send stream.
4005                          */
4006                         if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4007                             !zfs_prop_user(name)) {
4008                                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4009                                     "Warning: %s: property '%s' does not "
4010                                     "apply to datasets of this type\n"),
4011                                     fsname, name);
4012                                 continue;
4013                         }
4014                         /*
4015                          * We do this only if the property is not already
4016                          * locally-set, in which case its value will take
4017                          * priority over the received anyway.
4018                          */
4019                         if (nvlist_exists(origprops, newname)) {
4020                                 nvlist_t *attrs;
4021                                 char *source = NULL;
4022
4023                                 attrs = fnvlist_lookup_nvlist(origprops,
4024                                     newname);
4025                                 if (nvlist_lookup_string(attrs,
4026                                     ZPROP_SOURCE, &source) == 0 &&
4027                                     strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4028                                         continue;
4029                         }
4030                         /*
4031                          * We can't force an explicit inherit on non-inheritable
4032                          * properties: if we're asked to exclude this kind of
4033                          * values we remove them from "recvprops" input nvlist.
4034                          */
4035                         if (!zfs_prop_inheritable(prop) &&
4036                             !zfs_prop_user(name) && /* can be inherited too */
4037                             nvlist_exists(recvprops, newname))
4038                                 fnvlist_remove(recvprops, newname);
4039                         else
4040                                 fnvlist_add_boolean(*oxprops, newname);
4041                         break;
4042                 case DATA_TYPE_STRING: /* -o property=value */
4043                         /*
4044                          * we're trying to override a property that does not
4045                          * make sense for this type of dataset, but we don't
4046                          * want to fail if the receive is recursive: this comes
4047                          * in handy when the send stream contains, for
4048                          * instance, a child ZVOL and we're trying to receive
4049                          * it with "-o atime=on"
4050                          */
4051                         if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4052                             !zfs_prop_user(name)) {
4053                                 if (recursive)
4054                                         continue;
4055                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4056                                     "property '%s' does not apply to datasets "
4057                                     "of this type"), name);
4058                                 ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4059                                 goto error;
4060                         }
4061                         fnvlist_add_string(oprops, newname,
4062                             fnvpair_value_string(nvp));
4063                         break;
4064                 default:
4065                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4066                             "property '%s' must be a string or boolean"), name);
4067                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4068                         goto error;
4069                 }
4070         }
4071
4072         if (toplevel) {
4073                 /* convert override strings properties to native */
4074                 if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4075                     oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4076                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4077                         goto error;
4078                 }
4079
4080                 /*
4081                  * zfs_crypto_create() requires the parent name. Get it
4082                  * by truncating the fsname copy stored in namebuf.
4083                  */
4084                 cp = strrchr(namebuf, '/');
4085                 if (cp != NULL)
4086                         *cp = '\0';
4087
4088                 if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4089                     B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4090                         fnvlist_free(voprops);
4091                         ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4092                         goto error;
4093                 }
4094
4095                 /* second pass: process "-o" properties */
4096                 fnvlist_merge(*oxprops, voprops);
4097                 fnvlist_free(voprops);
4098         } else {
4099                 /* override props on child dataset are inherited */
4100                 nvp = NULL;
4101                 while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4102                         const char *name = nvpair_name(nvp);
4103                         fnvlist_add_boolean(*oxprops, name);
4104                 }
4105         }
4106
4107 error:
4108         if (zhp != NULL)
4109                 zfs_close(zhp);
4110         if (zpool_hdl != NULL)
4111                 zpool_close(zpool_hdl);
4112         fnvlist_free(oprops);
4113         return (ret);
4114 }
4115
4116 /*
4117  * Restores a backup of tosnap from the file descriptor specified by infd.
4118  */
4119 static int
4120 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4121     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4122     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4123     avl_tree_t *stream_avl, char **top_zfs,
4124     const char *finalsnap, nvlist_t *cmdprops)
4125 {
4126         time_t begin_time;
4127         int ioctl_err, ioctl_errno, err;
4128         char *cp;
4129         struct drr_begin *drrb = &drr->drr_u.drr_begin;
4130         char errbuf[1024];
4131         const char *chopprefix;
4132         boolean_t newfs = B_FALSE;
4133         boolean_t stream_wantsnewfs, stream_resumingnewfs;
4134         boolean_t newprops = B_FALSE;
4135         uint64_t read_bytes = 0;
4136         uint64_t errflags = 0;
4137         uint64_t parent_snapguid = 0;
4138         prop_changelist_t *clp = NULL;
4139         nvlist_t *snapprops_nvlist = NULL;
4140         nvlist_t *snapholds_nvlist = NULL;
4141         zprop_errflags_t prop_errflags;
4142         nvlist_t *prop_errors = NULL;
4143         boolean_t recursive;
4144         char *snapname = NULL;
4145         char destsnap[MAXPATHLEN * 2];
4146         char origin[MAXNAMELEN];
4147         char name[MAXPATHLEN];
4148         char tmp_keylocation[MAXNAMELEN];
4149         nvlist_t *rcvprops = NULL; /* props received from the send stream */
4150         nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4151         nvlist_t *origprops = NULL; /* original props (if destination exists) */
4152         zfs_type_t type;
4153         boolean_t toplevel = B_FALSE;
4154         boolean_t zoned = B_FALSE;
4155         boolean_t hastoken = B_FALSE;
4156         boolean_t redacted;
4157         uint8_t *wkeydata = NULL;
4158         uint_t wkeylen = 0;
4159
4160         begin_time = time(NULL);
4161         bzero(origin, MAXNAMELEN);
4162         bzero(tmp_keylocation, MAXNAMELEN);
4163
4164         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4165             "cannot receive"));
4166
4167         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4168             ENOENT);
4169
4170         /* Did the user request holds be skipped via zfs recv -k? */
4171         boolean_t holds = flags->holds && !flags->skipholds;
4172
4173         if (stream_avl != NULL) {
4174                 char *keylocation = NULL;
4175                 nvlist_t *lookup = NULL;
4176                 nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4177                     &snapname);
4178
4179                 (void) nvlist_lookup_uint64(fs, "parentfromsnap",
4180                     &parent_snapguid);
4181                 err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4182                 if (err) {
4183                         rcvprops = fnvlist_alloc();
4184                         newprops = B_TRUE;
4185                 }
4186
4187                 /*
4188                  * The keylocation property may only be set on encryption roots,
4189                  * but this dataset might not become an encryption root until
4190                  * recv_fix_encryption_hierarchy() is called. That function
4191                  * will fixup the keylocation anyway, so we temporarily unset
4192                  * the keylocation for now to avoid any errors from the receive
4193                  * ioctl.
4194                  */
4195                 err = nvlist_lookup_string(rcvprops,
4196                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4197                 if (err == 0) {
4198                         strcpy(tmp_keylocation, keylocation);
4199                         (void) nvlist_remove_all(rcvprops,
4200                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4201                 }
4202
4203                 if (flags->canmountoff) {
4204                         fnvlist_add_uint64(rcvprops,
4205                             zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4206                 } else if (newprops) {  /* nothing in rcvprops, eliminate it */
4207                         fnvlist_free(rcvprops);
4208                         rcvprops = NULL;
4209                         newprops = B_FALSE;
4210                 }
4211                 if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4212                         snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4213                             snapname);
4214                 }
4215                 if (holds) {
4216                         if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4217                             &lookup)) {
4218                                 snapholds_nvlist = fnvlist_lookup_nvlist(
4219                                     lookup, snapname);
4220                         }
4221                 }
4222         }
4223
4224         cp = NULL;
4225
4226         /*
4227          * Determine how much of the snapshot name stored in the stream
4228          * we are going to tack on to the name they specified on the
4229          * command line, and how much we are going to chop off.
4230          *
4231          * If they specified a snapshot, chop the entire name stored in
4232          * the stream.
4233          */
4234         if (flags->istail) {
4235                 /*
4236                  * A filesystem was specified with -e. We want to tack on only
4237                  * the tail of the sent snapshot path.
4238                  */
4239                 if (strchr(tosnap, '@')) {
4240                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4241                             "argument - snapshot not allowed with -e"));
4242                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4243                         goto out;
4244                 }
4245
4246                 chopprefix = strrchr(sendfs, '/');
4247
4248                 if (chopprefix == NULL) {
4249                         /*
4250                          * The tail is the poolname, so we need to
4251                          * prepend a path separator.
4252                          */
4253                         int len = strlen(drrb->drr_toname);
4254                         cp = malloc(len + 2);
4255                         cp[0] = '/';
4256                         (void) strcpy(&cp[1], drrb->drr_toname);
4257                         chopprefix = cp;
4258                 } else {
4259                         chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4260                 }
4261         } else if (flags->isprefix) {
4262                 /*
4263                  * A filesystem was specified with -d. We want to tack on
4264                  * everything but the first element of the sent snapshot path
4265                  * (all but the pool name).
4266                  */
4267                 if (strchr(tosnap, '@')) {
4268                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4269                             "argument - snapshot not allowed with -d"));
4270                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4271                         goto out;
4272                 }
4273
4274                 chopprefix = strchr(drrb->drr_toname, '/');
4275                 if (chopprefix == NULL)
4276                         chopprefix = strchr(drrb->drr_toname, '@');
4277         } else if (strchr(tosnap, '@') == NULL) {
4278                 /*
4279                  * If a filesystem was specified without -d or -e, we want to
4280                  * tack on everything after the fs specified by 'zfs send'.
4281                  */
4282                 chopprefix = drrb->drr_toname + strlen(sendfs);
4283         } else {
4284                 /* A snapshot was specified as an exact path (no -d or -e). */
4285                 if (recursive) {
4286                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4287                             "cannot specify snapshot name for multi-snapshot "
4288                             "stream"));
4289                         err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4290                         goto out;
4291                 }
4292                 chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4293         }
4294
4295         ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4296         ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4297         ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4298             strchr(sendfs, '/') == NULL);
4299         ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4300             chopprefix[0] == '\0');
4301
4302         /*
4303          * Determine name of destination snapshot.
4304          */
4305         (void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4306         (void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4307         free(cp);
4308         if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4309                 err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4310                 goto out;
4311         }
4312
4313         /*
4314          * Determine the name of the origin snapshot.
4315          */
4316         if (originsnap) {
4317                 (void) strlcpy(origin, originsnap, sizeof (origin));
4318                 if (flags->verbose)
4319                         (void) printf("using provided clone origin %s\n",
4320                             origin);
4321         } else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4322                 if (guid_to_name(hdl, destsnap,
4323                     drrb->drr_fromguid, B_FALSE, origin) != 0) {
4324                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4325                             "local origin for clone %s does not exist"),
4326                             destsnap);
4327                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4328                         goto out;
4329                 }
4330                 if (flags->verbose)
4331                         (void) printf("found clone origin %s\n", origin);
4332         }
4333
4334         if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4335             DMU_BACKUP_FEATURE_DEDUP)) {
4336                 (void) fprintf(stderr,
4337                     gettext("ERROR: \"zfs receive\" no longer supports "
4338                     "deduplicated send streams.  Use\n"
4339                     "the \"zstream redup\" command to convert this stream "
4340                     "to a regular,\n"
4341                     "non-deduplicated stream.\n"));
4342                 err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4343                 goto out;
4344         }
4345
4346         boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4347             DMU_BACKUP_FEATURE_RESUMING;
4348         boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4349             DMU_BACKUP_FEATURE_RAW;
4350         boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4351             DMU_BACKUP_FEATURE_EMBED_DATA;
4352         stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4353             (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4354         stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4355             (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4356
4357         if (stream_wantsnewfs) {
4358                 /*
4359                  * if the parent fs does not exist, look for it based on
4360                  * the parent snap GUID
4361                  */
4362                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4363                     "cannot receive new filesystem stream"));
4364
4365                 (void) strcpy(name, destsnap);
4366                 cp = strrchr(name, '/');
4367                 if (cp)
4368                         *cp = '\0';
4369                 if (cp &&
4370                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4371                         char suffix[ZFS_MAX_DATASET_NAME_LEN];
4372                         (void) strcpy(suffix, strrchr(destsnap, '/'));
4373                         if (guid_to_name(hdl, name, parent_snapguid,
4374                             B_FALSE, destsnap) == 0) {
4375                                 *strchr(destsnap, '@') = '\0';
4376                                 (void) strcat(destsnap, suffix);
4377                         }
4378                 }
4379         } else {
4380                 /*
4381                  * If the fs does not exist, look for it based on the
4382                  * fromsnap GUID.
4383                  */
4384                 if (resuming) {
4385                         (void) snprintf(errbuf, sizeof (errbuf),
4386                             dgettext(TEXT_DOMAIN,
4387                             "cannot receive resume stream"));
4388                 } else {
4389                         (void) snprintf(errbuf, sizeof (errbuf),
4390                             dgettext(TEXT_DOMAIN,
4391                             "cannot receive incremental stream"));
4392                 }
4393
4394                 (void) strcpy(name, destsnap);
4395                 *strchr(name, '@') = '\0';
4396
4397                 /*
4398                  * If the exact receive path was specified and this is the
4399                  * topmost path in the stream, then if the fs does not exist we
4400                  * should look no further.
4401                  */
4402                 if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4403                     strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4404                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4405                         char snap[ZFS_MAX_DATASET_NAME_LEN];
4406                         (void) strcpy(snap, strchr(destsnap, '@'));
4407                         if (guid_to_name(hdl, name, drrb->drr_fromguid,
4408                             B_FALSE, destsnap) == 0) {
4409                                 *strchr(destsnap, '@') = '\0';
4410                                 (void) strcat(destsnap, snap);
4411                         }
4412                 }
4413         }
4414
4415         (void) strcpy(name, destsnap);
4416         *strchr(name, '@') = '\0';
4417
4418         redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4419             DMU_BACKUP_FEATURE_REDACTED;
4420
4421         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4422                 zfs_cmd_t zc = {"\0"};
4423                 zfs_handle_t *zhp;
4424                 boolean_t encrypted;
4425
4426                 (void) strcpy(zc.zc_name, name);
4427
4428                 /*
4429                  * Destination fs exists.  It must be one of these cases:
4430                  *  - an incremental send stream
4431                  *  - the stream specifies a new fs (full stream or clone)
4432                  *    and they want us to blow away the existing fs (and
4433                  *    have therefore specified -F and removed any snapshots)
4434                  *  - we are resuming a failed receive.
4435                  */
4436                 if (stream_wantsnewfs) {
4437                         boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4438                         if (!flags->force) {
4439                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4440                                     "destination '%s' exists\n"
4441                                     "must specify -F to overwrite it"), name);
4442                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4443                                 goto out;
4444                         }
4445                         if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4446                             &zc) == 0) {
4447                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4448                                     "destination has snapshots (eg. %s)\n"
4449                                     "must destroy them to overwrite it"),
4450                                     zc.zc_name);
4451                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4452                                 goto out;
4453                         }
4454                         if (is_volume && strrchr(name, '/') == NULL) {
4455                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4456                                     "destination %s is the root dataset\n"
4457                                     "cannot overwrite with a ZVOL"),
4458                                     name);
4459                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4460                                 goto out;
4461                         }
4462                         if (is_volume &&
4463                             zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4464                             &zc) == 0) {
4465                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4466                                     "destination has children (eg. %s)\n"
4467                                     "cannot overwrite with a ZVOL"),
4468                                     zc.zc_name);
4469                                 err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4470                                 goto out;
4471                         }
4472                 }
4473
4474                 if ((zhp = zfs_open(hdl, name,
4475                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4476                         err = -1;
4477                         goto out;
4478                 }
4479
4480                 if (stream_wantsnewfs &&
4481                     zhp->zfs_dmustats.dds_origin[0]) {
4482                         zfs_close(zhp);
4483                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4484                             "destination '%s' is a clone\n"
4485                             "must destroy it to overwrite it"), name);
4486                         err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4487                         goto out;
4488                 }
4489
4490                 /*
4491                  * Raw sends can not be performed as an incremental on top
4492                  * of existing unencrypted datasets. zfs recv -F can't be
4493                  * used to blow away an existing encrypted filesystem. This
4494                  * is because it would require the dsl dir to point to the
4495                  * new key (or lack of a key) and the old key at the same
4496                  * time. The -F flag may still be used for deleting
4497                  * intermediate snapshots that would otherwise prevent the
4498                  * receive from working.
4499                  */
4500                 encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4501                     ZIO_CRYPT_OFF;
4502                 if (!stream_wantsnewfs && !encrypted && raw) {
4503                         zfs_close(zhp);
4504                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4505                             "cannot perform raw receive on top of "
4506                             "existing unencrypted dataset"));
4507                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4508                         goto out;
4509                 }
4510
4511                 if (stream_wantsnewfs && flags->force &&
4512                     ((raw && !encrypted) || encrypted)) {
4513                         zfs_close(zhp);
4514                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4515                             "zfs receive -F cannot be used to destroy an "
4516                             "encrypted filesystem or overwrite an "
4517                             "unencrypted one with an encrypted one"));
4518                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4519                         goto out;
4520                 }
4521
4522                 if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4523                     (stream_wantsnewfs || stream_resumingnewfs)) {
4524                         /* We can't do online recv in this case */
4525                         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4526                             flags->forceunmount ? MS_FORCE : 0);
4527                         if (clp == NULL) {
4528                                 zfs_close(zhp);
4529                                 err = -1;
4530                                 goto out;
4531                         }
4532                         if (changelist_prefix(clp) != 0) {
4533                                 changelist_free(clp);
4534                                 zfs_close(zhp);
4535                                 err = -1;
4536                                 goto out;
4537                         }
4538                 }
4539
4540                 /*
4541                  * If we are resuming a newfs, set newfs here so that we will
4542                  * mount it if the recv succeeds this time.  We can tell
4543                  * that it was a newfs on the first recv because the fs
4544                  * itself will be inconsistent (if the fs existed when we
4545                  * did the first recv, we would have received it into
4546                  * .../%recv).
4547                  */
4548                 if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4549                         newfs = B_TRUE;
4550
4551                 /* we want to know if we're zoned when validating -o|-x props */
4552                 zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4553
4554                 /* may need this info later, get it now we have zhp around */
4555                 if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4556                     NULL, NULL, 0, B_TRUE) == 0)
4557                         hastoken = B_TRUE;
4558
4559                 /* gather existing properties on destination */
4560                 origprops = fnvlist_alloc();
4561                 fnvlist_merge(origprops, zhp->zfs_props);
4562                 fnvlist_merge(origprops, zhp->zfs_user_props);
4563
4564                 zfs_close(zhp);
4565         } else {
4566                 zfs_handle_t *zhp;
4567
4568                 /*
4569                  * Destination filesystem does not exist.  Therefore we better
4570                  * be creating a new filesystem (either from a full backup, or
4571                  * a clone).  It would therefore be invalid if the user
4572                  * specified only the pool name (i.e. if the destination name
4573                  * contained no slash character).
4574                  */
4575                 cp = strrchr(name, '/');
4576
4577                 if (!stream_wantsnewfs || cp == NULL) {
4578                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4579                             "destination '%s' does not exist"), name);
4580                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4581                         goto out;
4582                 }
4583
4584                 /*
4585                  * Trim off the final dataset component so we perform the
4586                  * recvbackup ioctl to the filesystems's parent.
4587                  */
4588                 *cp = '\0';
4589
4590                 if (flags->isprefix && !flags->istail && !flags->dryrun &&
4591                     create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4592                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4593                         goto out;
4594                 }
4595
4596                 /* validate parent */
4597                 zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4598                 if (zhp == NULL) {
4599                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4600                         goto out;
4601                 }
4602                 if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4603                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4604                             "parent '%s' is not a filesystem"), name);
4605                         err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4606                         zfs_close(zhp);
4607                         goto out;
4608                 }
4609
4610                 zfs_close(zhp);
4611
4612                 newfs = B_TRUE;
4613                 *cp = '/';
4614         }
4615
4616         if (flags->verbose) {
4617                 (void) printf("%s %s stream of %s into %s\n",
4618                     flags->dryrun ? "would receive" : "receiving",
4619                     drrb->drr_fromguid ? "incremental" : "full",
4620                     drrb->drr_toname, destsnap);
4621                 (void) fflush(stdout);
4622         }
4623
4624         /*
4625          * If this is the top-level dataset, record it so we can use it
4626          * for recursive operations later.
4627          */
4628         if (top_zfs != NULL &&
4629             (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4630                 toplevel = B_TRUE;
4631                 if (*top_zfs == NULL)
4632                         *top_zfs = zfs_strdup(hdl, name);
4633         }
4634
4635         if (drrb->drr_type == DMU_OST_ZVOL) {
4636                 type = ZFS_TYPE_VOLUME;
4637         } else if (drrb->drr_type == DMU_OST_ZFS) {
4638                 type = ZFS_TYPE_FILESYSTEM;
4639         } else {
4640                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4641                     "invalid record type: 0x%d"), drrb->drr_type);
4642                 err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4643                 goto out;
4644         }
4645         if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4646             stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4647             &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4648                 goto out;
4649
4650         /*
4651          * When sending with properties (zfs send -p), the encryption property
4652          * is not included because it is a SETONCE property and therefore
4653          * treated as read only. However, we are always able to determine its
4654          * value because raw sends will include it in the DRR_BDEGIN payload
4655          * and non-raw sends with properties are not allowed for encrypted
4656          * datasets. Therefore, if this is a non-raw properties stream, we can
4657          * infer that the value should be ZIO_CRYPT_OFF and manually add that
4658          * to the received properties.
4659          */
4660         if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4661             !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4662                 if (oxprops == NULL)
4663                         oxprops = fnvlist_alloc();
4664                 fnvlist_add_uint64(oxprops,
4665                     zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4666         }
4667
4668         if (flags->dryrun) {
4669                 void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4670
4671                 /*
4672                  * We have read the DRR_BEGIN record, but we have
4673                  * not yet read the payload. For non-dryrun sends
4674                  * this will be done by the kernel, so we must
4675                  * emulate that here, before attempting to read
4676                  * more records.
4677                  */
4678                 err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4679                     flags->byteswap, NULL);
4680                 free(buf);
4681                 if (err != 0)
4682                         goto out;
4683
4684                 err = recv_skip(hdl, infd, flags->byteswap);
4685                 goto out;
4686         }
4687
4688         err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4689             oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4690             raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4691             NULL, &prop_errors);
4692         ioctl_errno = ioctl_err;
4693         prop_errflags = errflags;
4694
4695         if (err == 0) {
4696                 nvpair_t *prop_err = NULL;
4697
4698                 while ((prop_err = nvlist_next_nvpair(prop_errors,
4699                     prop_err)) != NULL) {
4700                         char tbuf[1024];
4701                         zfs_prop_t prop;
4702                         int intval;
4703
4704                         prop = zfs_name_to_prop(nvpair_name(prop_err));
4705                         (void) nvpair_value_int32(prop_err, &intval);
4706                         if (strcmp(nvpair_name(prop_err),
4707                             ZPROP_N_MORE_ERRORS) == 0) {
4708                                 trunc_prop_errs(intval);
4709                                 break;
4710                         } else if (snapname == NULL || finalsnap == NULL ||
4711                             strcmp(finalsnap, snapname) == 0 ||
4712                             strcmp(nvpair_name(prop_err),
4713                             zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4714                                 /*
4715                                  * Skip the special case of, for example,
4716                                  * "refquota", errors on intermediate
4717                                  * snapshots leading up to a final one.
4718                                  * That's why we have all of the checks above.
4719                                  *
4720                                  * See zfs_ioctl.c's extract_delay_props() for
4721                                  * a list of props which can fail on
4722                                  * intermediate snapshots, but shouldn't
4723                                  * affect the overall receive.
4724                                  */
4725                                 (void) snprintf(tbuf, sizeof (tbuf),
4726                                     dgettext(TEXT_DOMAIN,
4727                                     "cannot receive %s property on %s"),
4728                                     nvpair_name(prop_err), name);
4729                                 zfs_setprop_error(hdl, prop, intval, tbuf);
4730                         }
4731                 }
4732         }
4733
4734         if (err == 0 && snapprops_nvlist) {
4735                 zfs_cmd_t zc = {"\0"};
4736
4737                 (void) strcpy(zc.zc_name, destsnap);
4738                 zc.zc_cookie = B_TRUE; /* received */
4739                 if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
4740                         (void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4741                         zcmd_free_nvlists(&zc);
4742                 }
4743         }
4744         if (err == 0 && snapholds_nvlist) {
4745                 nvpair_t *pair;
4746                 nvlist_t *holds, *errors = NULL;
4747                 int cleanup_fd = -1;
4748
4749                 VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4750                 for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4751                     pair != NULL;
4752                     pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4753                         fnvlist_add_string(holds, destsnap, nvpair_name(pair));
4754                 }
4755                 (void) lzc_hold(holds, cleanup_fd, &errors);
4756                 fnvlist_free(snapholds_nvlist);
4757                 fnvlist_free(holds);
4758         }
4759
4760         if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4761                 /*
4762                  * It may be that this snapshot already exists,
4763                  * in which case we want to consume & ignore it
4764                  * rather than failing.
4765                  */
4766                 avl_tree_t *local_avl;
4767                 nvlist_t *local_nv, *fs;
4768                 cp = strchr(destsnap, '@');
4769
4770                 /*
4771                  * XXX Do this faster by just iterating over snaps in
4772                  * this fs.  Also if zc_value does not exist, we will
4773                  * get a strange "does not exist" error message.
4774                  */
4775                 *cp = '\0';
4776                 if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4777                     B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
4778                     B_TRUE, &local_nv, &local_avl) == 0) {
4779                         *cp = '@';
4780                         fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4781                         fsavl_destroy(local_avl);
4782                         fnvlist_free(local_nv);
4783
4784                         if (fs != NULL) {
4785                                 if (flags->verbose) {
4786                                         (void) printf("snap %s already exists; "
4787                                             "ignoring\n", destsnap);
4788                                 }
4789                                 err = ioctl_err = recv_skip(hdl, infd,
4790                                     flags->byteswap);
4791                         }
4792                 }
4793                 *cp = '@';
4794         }
4795
4796         if (ioctl_err != 0) {
4797                 switch (ioctl_errno) {
4798                 case ENODEV:
4799                         cp = strchr(destsnap, '@');
4800                         *cp = '\0';
4801                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4802                             "most recent snapshot of %s does not\n"
4803                             "match incremental source"), destsnap);
4804                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4805                         *cp = '@';
4806                         break;
4807                 case ETXTBSY:
4808                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4809                             "destination %s has been modified\n"
4810                             "since most recent snapshot"), name);
4811                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4812                         break;
4813                 case EACCES:
4814                         if (raw && stream_wantsnewfs) {
4815                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4816                                     "failed to create encryption key"));
4817                         } else if (raw && !stream_wantsnewfs) {
4818                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4819                                     "encryption key does not match "
4820                                     "existing key"));
4821                         } else {
4822                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4823                                     "inherited key must be loaded"));
4824                         }
4825                         (void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4826                         break;
4827                 case EEXIST:
4828                         cp = strchr(destsnap, '@');
4829                         if (newfs) {
4830                                 /* it's the containing fs that exists */
4831                                 *cp = '\0';
4832                         }
4833                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4834                             "destination already exists"));
4835                         (void) zfs_error_fmt(hdl, EZFS_EXISTS,
4836                             dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4837                             destsnap);
4838                         *cp = '@';
4839                         break;
4840                 case EINVAL:
4841                         if (flags->resumable) {
4842                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4843                                     "kernel modules must be upgraded to "
4844                                     "receive this stream."));
4845                         } else if (embedded && !raw) {
4846                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4847                                     "incompatible embedded data stream "
4848                                     "feature with encrypted receive."));
4849                         }
4850                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4851                         break;
4852                 case ECKSUM:
4853                 case ZFS_ERR_STREAM_TRUNCATED:
4854                         recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4855                             ioctl_err == ECKSUM);
4856                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4857                         break;
4858                 case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
4859                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4860                             "incremental send stream requires -L "
4861                             "(--large-block), to match previous receive."));
4862                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4863                         break;
4864                 case ENOTSUP:
4865                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4866                             "pool must be upgraded to receive this stream."));
4867                         (void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
4868                         break;
4869                 case EDQUOT:
4870                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4871                             "destination %s space quota exceeded."), name);
4872                         (void) zfs_error(hdl, EZFS_NOSPC, errbuf);
4873                         break;
4874                 case ZFS_ERR_FROM_IVSET_GUID_MISSING:
4875                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4876                             "IV set guid missing. See errata %u at "
4877                             "https://openzfs.github.io/openzfs-docs/msg/"
4878                             "ZFS-8000-ER."),
4879                             ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
4880                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4881                         break;
4882                 case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
4883                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4884                             "IV set guid mismatch. See the 'zfs receive' "
4885                             "man page section\n discussing the limitations "
4886                             "of raw encrypted send streams."));
4887                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4888                         break;
4889                 case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
4890                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4891                             "Spill block flag missing for raw send.\n"
4892                             "The zfs software on the sending system must "
4893                             "be updated."));
4894                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4895                         break;
4896                 case EBUSY:
4897                         if (hastoken) {
4898                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4899                                     "destination %s contains "
4900                                     "partially-complete state from "
4901                                     "\"zfs receive -s\"."), name);
4902                                 (void) zfs_error(hdl, EZFS_BUSY, errbuf);
4903                                 break;
4904                         }
4905                         fallthrough;
4906                 default:
4907                         (void) zfs_standard_error(hdl, ioctl_errno, errbuf);
4908                 }
4909         }
4910
4911         /*
4912          * Mount the target filesystem (if created).  Also mount any
4913          * children of the target filesystem if we did a replication
4914          * receive (indicated by stream_avl being non-NULL).
4915          */
4916         if (clp) {
4917                 if (!flags->nomount)
4918                         err |= changelist_postfix(clp);
4919                 changelist_free(clp);
4920         }
4921
4922         if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
4923                 flags->domount = B_TRUE;
4924
4925         if (prop_errflags & ZPROP_ERR_NOCLEAR) {
4926                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4927                     "failed to clear unreceived properties on %s"), name);
4928                 (void) fprintf(stderr, "\n");
4929         }
4930         if (prop_errflags & ZPROP_ERR_NORESTORE) {
4931                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4932                     "failed to restore original properties on %s"), name);
4933                 (void) fprintf(stderr, "\n");
4934         }
4935
4936         if (err || ioctl_err) {
4937                 err = -1;
4938                 goto out;
4939         }
4940
4941         if (flags->verbose) {
4942                 char buf1[64];
4943                 char buf2[64];
4944                 uint64_t bytes = read_bytes;
4945                 time_t delta = time(NULL) - begin_time;
4946                 if (delta == 0)
4947                         delta = 1;
4948                 zfs_nicebytes(bytes, buf1, sizeof (buf1));
4949                 zfs_nicebytes(bytes/delta, buf2, sizeof (buf1));
4950
4951                 (void) printf("received %s stream in %lld seconds (%s/sec)\n",
4952                     buf1, (longlong_t)delta, buf2);
4953         }
4954
4955         err = 0;
4956 out:
4957         if (prop_errors != NULL)
4958                 fnvlist_free(prop_errors);
4959
4960         if (tmp_keylocation[0] != '\0') {
4961                 fnvlist_add_string(rcvprops,
4962                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
4963         }
4964
4965         if (newprops)
4966                 fnvlist_free(rcvprops);
4967
4968         fnvlist_free(oxprops);
4969         fnvlist_free(origprops);
4970
4971         return (err);
4972 }
4973
4974 /*
4975  * Check properties we were asked to override (both -o|-x)
4976  */
4977 static boolean_t
4978 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
4979     const char *errbuf)
4980 {
4981         nvpair_t *nvp;
4982         zfs_prop_t prop;
4983         const char *name;
4984
4985         nvp = NULL;
4986         while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
4987                 name = nvpair_name(nvp);
4988                 prop = zfs_name_to_prop(name);
4989
4990                 if (prop == ZPROP_INVAL) {
4991                         if (!zfs_prop_user(name)) {
4992                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4993                                     "%s: invalid property '%s'"), errbuf, name);
4994                                 return (B_FALSE);
4995                         }
4996                         continue;
4997                 }
4998                 /*
4999                  * "origin" is readonly but is used to receive datasets as
5000                  * clones so we don't raise an error here
5001                  */
5002                 if (prop == ZFS_PROP_ORIGIN)
5003                         continue;
5004
5005                 /* encryption params have their own verification later */
5006                 if (prop == ZFS_PROP_ENCRYPTION ||
5007                     zfs_prop_encryption_key_param(prop))
5008                         continue;
5009
5010                 /*
5011                  * cannot override readonly, set-once and other specific
5012                  * settable properties
5013                  */
5014                 if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5015                     prop == ZFS_PROP_VOLSIZE) {
5016                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5017                             "%s: invalid property '%s'"), errbuf, name);
5018                         return (B_FALSE);
5019                 }
5020         }
5021
5022         return (B_TRUE);
5023 }
5024
5025 static int
5026 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5027     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5028     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5029     const char *finalsnap, nvlist_t *cmdprops)
5030 {
5031         int err;
5032         dmu_replay_record_t drr, drr_noswap;
5033         struct drr_begin *drrb = &drr.drr_u.drr_begin;
5034         char errbuf[1024];
5035         zio_cksum_t zcksum = { { 0 } };
5036         uint64_t featureflags;
5037         int hdrtype;
5038
5039         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5040             "cannot receive"));
5041
5042         /* check cmdline props, raise an error if they cannot be received */
5043         if (!zfs_receive_checkprops(hdl, cmdprops, errbuf))
5044                 return (-1);
5045
5046         if (flags->isprefix &&
5047             !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5048                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5049                     "(%s) does not exist"), tosnap);
5050                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5051         }
5052         if (originsnap &&
5053             !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5054                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5055                     "(%s) does not exist"), originsnap);
5056                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5057         }
5058
5059         /* read in the BEGIN record */
5060         if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5061             &zcksum)))
5062                 return (err);
5063
5064         if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5065                 /* It's the double end record at the end of a package */
5066                 return (ENODATA);
5067         }
5068
5069         /* the kernel needs the non-byteswapped begin record */
5070         drr_noswap = drr;
5071
5072         flags->byteswap = B_FALSE;
5073         if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5074                 /*
5075                  * We computed the checksum in the wrong byteorder in
5076                  * recv_read() above; do it again correctly.
5077                  */
5078                 bzero(&zcksum, sizeof (zio_cksum_t));
5079                 fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5080                 flags->byteswap = B_TRUE;
5081
5082                 drr.drr_type = BSWAP_32(drr.drr_type);
5083                 drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5084                 drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5085                 drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5086                 drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5087                 drrb->drr_type = BSWAP_32(drrb->drr_type);
5088                 drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5089                 drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5090                 drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5091         }
5092
5093         if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5094                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5095                     "stream (bad magic number)"));
5096                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5097         }
5098
5099         featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5100         hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5101
5102         if (!DMU_STREAM_SUPPORTED(featureflags) ||
5103             (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5104                 /*
5105                  * Let's be explicit about this one, since rather than
5106                  * being a new feature we can't know, it's an old
5107                  * feature we dropped.
5108                  */
5109                 if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5110                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5111                             "stream has deprecated feature: dedup, try "
5112                             "'zstream redup [send in a file] | zfs recv "
5113                             "[...]'"));
5114                 } else {
5115                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5116                             "stream has unsupported feature, feature flags = "
5117                             "%llx (unknown flags = %llx)"),
5118                             (u_longlong_t)featureflags,
5119                             (u_longlong_t)((featureflags) &
5120                             ~DMU_BACKUP_FEATURE_MASK));
5121                 }
5122                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5123         }
5124
5125         /* Holds feature is set once in the compound stream header. */
5126         if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5127                 flags->holds = B_TRUE;
5128
5129         if (strchr(drrb->drr_toname, '@') == NULL) {
5130                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5131                     "stream (bad snapshot name)"));
5132                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5133         }
5134
5135         if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5136                 char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5137                 if (sendfs == NULL) {
5138                         /*
5139                          * We were not called from zfs_receive_package(). Get
5140                          * the fs specified by 'zfs send'.
5141                          */
5142                         char *cp;
5143                         (void) strlcpy(nonpackage_sendfs,
5144                             drr.drr_u.drr_begin.drr_toname,
5145                             sizeof (nonpackage_sendfs));
5146                         if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5147                                 *cp = '\0';
5148                         sendfs = nonpackage_sendfs;
5149                         VERIFY(finalsnap == NULL);
5150                 }
5151                 return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5152                     &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5153                     finalsnap, cmdprops));
5154         } else {
5155                 assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5156                     DMU_COMPOUNDSTREAM);
5157                 return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5158                     &zcksum, top_zfs, cmdprops));
5159         }
5160 }
5161
5162 /*
5163  * Restores a backup of tosnap from the file descriptor specified by infd.
5164  * Return 0 on total success, -2 if some things couldn't be
5165  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5166  * (-1 will override -2, if -1 and the resumable flag was specified the
5167  * transfer can be resumed if the sending side supports it).
5168  */
5169 int
5170 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5171     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5172 {
5173         char *top_zfs = NULL;
5174         int err;
5175         struct stat sb;
5176         char *originsnap = NULL;
5177
5178         /*
5179          * The only way fstat can fail is if we do not have a valid file
5180          * descriptor.
5181          */
5182         if (fstat(infd, &sb) == -1) {
5183                 perror("fstat");
5184                 return (-2);
5185         }
5186
5187         /*
5188          * It is not uncommon for gigabytes to be processed in zfs receive.
5189          * Speculatively increase the buffer size if supported by the platform.
5190          */
5191         if (S_ISFIFO(sb.st_mode))
5192                 libzfs_set_pipe_max(infd);
5193
5194         if (props) {
5195                 err = nvlist_lookup_string(props, "origin", &originsnap);
5196                 if (err && err != ENOENT)
5197                         return (err);
5198         }
5199
5200         err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5201             stream_avl, &top_zfs, NULL, props);
5202
5203         if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5204                 zfs_handle_t *zhp = NULL;
5205                 prop_changelist_t *clp = NULL;
5206
5207                 zhp = zfs_open(hdl, top_zfs,
5208                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5209                 if (zhp == NULL) {
5210                         err = -1;
5211                         goto out;
5212                 } else {
5213                         if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5214                                 zfs_close(zhp);
5215                                 goto out;
5216                         }
5217
5218                         clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5219                             CL_GATHER_MOUNT_ALWAYS,
5220                             flags->forceunmount ? MS_FORCE : 0);
5221                         zfs_close(zhp);
5222                         if (clp == NULL) {
5223                                 err = -1;
5224                                 goto out;
5225                         }
5226
5227                         /* mount and share received datasets */
5228                         err = changelist_postfix(clp);
5229                         changelist_free(clp);
5230                         if (err != 0)
5231                                 err = -1;
5232                 }
5233         }
5234
5235 out:
5236         if (top_zfs)
5237                 free(top_zfs);
5238
5239         return (err);
5240 }