lib/libzfs/libzfs_sendrecv.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
  25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
  27  * All rights reserved
  28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
  29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
  30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
  31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
  32  * Copyright (c) 2019 Datto Inc.
  33  */
  34
  35 #include <assert.h>
  36 #include <ctype.h>
  37 #include <errno.h>
  38 #include <libintl.h>
  39 #include <stdio.h>
  40 #include <stdlib.h>
  41 #include <strings.h>
  42 #include <unistd.h>
  43 #include <stddef.h>
  44 #include <fcntl.h>
  45 #include <sys/mount.h>
  46 #include <sys/mntent.h>
  47 #include <sys/mnttab.h>
  48 #include <sys/avl.h>
  49 #include <sys/debug.h>
  50 #include <sys/stat.h>
  51 #include <pthread.h>
  52 #include <umem.h>
  53 #include <time.h>
  54
  55 #include <libzfs.h>
  56 #include <libzfs_core.h>
  57 #include <libzutil.h>
  58
  59 #include "zfs_namecheck.h"
  60 #include "zfs_prop.h"
  61 #include "zfs_fletcher.h"
  62 #include "libzfs_impl.h"
  63 #include <cityhash.h>
  64 #include <zlib.h>
  65 #include <sys/zio_checksum.h>
  66 #include <sys/dsl_crypt.h>
  67 #include <sys/ddt.h>
  68 #include <sys/socket.h>
  69 #include <sys/sha2.h>
  70
  71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
  72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
  73     const char *, nvlist_t *);
  74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
  75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
  76     uint64_t num_redact_snaps, char *name);
  77 static int guid_to_name(libzfs_handle_t *, const char *,
  78     uint64_t, boolean_t, char *);
  79
  80 typedef struct progress_arg {
  81         zfs_handle_t *pa_zhp;
  82         int pa_fd;
  83         boolean_t pa_parsable;
  84         boolean_t pa_estimate;
  85         int pa_verbosity;
  86 } progress_arg_t;
  87
  88 static int
  89 dump_record(dmu_replay_record_t *drr, void *payload, int payload_len,
  90     zio_cksum_t *zc, int outfd)
  91 {
  92         ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
  93             ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
  94         fletcher_4_incremental_native(drr,
  95             offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
  96         if (drr->drr_type != DRR_BEGIN) {
  97                 ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
  98                     drr_checksum.drr_checksum));
  99                 drr->drr_u.drr_checksum.drr_checksum = *zc;
 100         }
 101         fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
 102             sizeof (zio_cksum_t), zc);
 103         if (write(outfd, drr, sizeof (*drr)) == -1)
 104                 return (errno);
 105         if (payload_len != 0) {
 106                 fletcher_4_incremental_native(payload, payload_len, zc);
 107                 if (write(outfd, payload, payload_len) == -1)
 108                         return (errno);
 109         }
 110         return (0);
 111 }
 112
 113 /*
 114  * Routines for dealing with the AVL tree of fs-nvlists
 115  */
 116 typedef struct fsavl_node {
 117         avl_node_t fn_node;
 118         nvlist_t *fn_nvfs;
 119         char *fn_snapname;
 120         uint64_t fn_guid;
 121 } fsavl_node_t;
 122
 123 static int
 124 fsavl_compare(const void *arg1, const void *arg2)
 125 {
 126         const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
 127         const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
 128
 129         return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
 130 }
 131
 132 /*
 133  * Given the GUID of a snapshot, find its containing filesystem and
 134  * (optionally) name.
 135  */
 136 static nvlist_t *
 137 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
 138 {
 139         fsavl_node_t fn_find;
 140         fsavl_node_t *fn;
 141
 142         fn_find.fn_guid = snapguid;
 143
 144         fn = avl_find(avl, &fn_find, NULL);
 145         if (fn) {
 146                 if (snapname)
 147                         *snapname = fn->fn_snapname;
 148                 return (fn->fn_nvfs);
 149         }
 150         return (NULL);
 151 }
 152
 153 static void
 154 fsavl_destroy(avl_tree_t *avl)
 155 {
 156         fsavl_node_t *fn;
 157         void *cookie;
 158
 159         if (avl == NULL)
 160                 return;
 161
 162         cookie = NULL;
 163         while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
 164                 free(fn);
 165         avl_destroy(avl);
 166         free(avl);
 167 }
 168
 169 /*
 170  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
 171  */
 172 static avl_tree_t *
 173 fsavl_create(nvlist_t *fss)
 174 {
 175         avl_tree_t *fsavl;
 176         nvpair_t *fselem = NULL;
 177
 178         if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
 179                 return (NULL);
 180
 181         avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
 182             offsetof(fsavl_node_t, fn_node));
 183
 184         while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
 185                 nvlist_t *nvfs, *snaps;
 186                 nvpair_t *snapelem = NULL;
 187
 188                 nvfs = fnvpair_value_nvlist(fselem);
 189                 snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
 190
 191                 while ((snapelem =
 192                     nvlist_next_nvpair(snaps, snapelem)) != NULL) {
 193                         fsavl_node_t *fn;
 194                         uint64_t guid;
 195
 196                         guid = fnvpair_value_uint64(snapelem);
 197                         if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
 198                                 fsavl_destroy(fsavl);
 199                                 return (NULL);
 200                         }
 201                         fn->fn_nvfs = nvfs;
 202                         fn->fn_snapname = nvpair_name(snapelem);
 203                         fn->fn_guid = guid;
 204
 205                         /*
 206                          * Note: if there are multiple snaps with the
 207                          * same GUID, we ignore all but one.
 208                          */
 209                         if (avl_find(fsavl, fn, NULL) == NULL)
 210                                 avl_add(fsavl, fn);
 211                         else
 212                                 free(fn);
 213                 }
 214         }
 215
 216         return (fsavl);
 217 }
 218
 219 /*
 220  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
 221  */
 222 typedef struct send_data {
 223         /*
 224          * assigned inside every recursive call,
 225          * restored from *_save on return:
 226          *
 227          * guid of fromsnap snapshot in parent dataset
 228          * txg of fromsnap snapshot in current dataset
 229          * txg of tosnap snapshot in current dataset
 230          */
 231
 232         uint64_t parent_fromsnap_guid;
 233         uint64_t fromsnap_txg;
 234         uint64_t tosnap_txg;
 235
 236         /* the nvlists get accumulated during depth-first traversal */
 237         nvlist_t *parent_snaps;
 238         nvlist_t *fss;
 239         nvlist_t *snapprops;
 240         nvlist_t *snapholds;    /* user holds */
 241
 242         /* send-receive configuration, does not change during traversal */
 243         const char *fsname;
 244         const char *fromsnap;
 245         const char *tosnap;
 246         boolean_t recursive;
 247         boolean_t raw;
 248         boolean_t doall;
 249         boolean_t replicate;
 250         boolean_t skipmissing;
 251         boolean_t verbose;
 252         boolean_t backup;
 253         boolean_t seenfrom;
 254         boolean_t seento;
 255         boolean_t holds;        /* were holds requested with send -h */
 256         boolean_t props;
 257
 258         /*
 259          * The header nvlist is of the following format:
 260          * {
 261          *   "tosnap" -> string
 262          *   "fromsnap" -> string (if incremental)
 263          *   "fss" -> {
 264          *      id -> {
 265          *
 266          *       "name" -> string (full name; for debugging)
 267          *       "parentfromsnap" -> number (guid of fromsnap in parent)
 268          *
 269          *       "props" -> { name -> value (only if set here) }
 270          *       "snaps" -> { name (lastname) -> number (guid) }
 271          *       "snapprops" -> { name (lastname) -> { name -> value } }
 272          *       "snapholds" -> { name (lastname) -> { holdname -> crtime } }
 273          *
 274          *       "origin" -> number (guid) (if clone)
 275          *       "is_encroot" -> boolean
 276          *       "sent" -> boolean (not on-disk)
 277          *      }
 278          *   }
 279          * }
 280          *
 281          */
 282 } send_data_t;
 283
 284 static void
 285 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
 286
 287 static int
 288 send_iterate_snap(zfs_handle_t *zhp, void *arg)
 289 {
 290         send_data_t *sd = arg;
 291         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 292         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 293         char *snapname;
 294         nvlist_t *nv;
 295         boolean_t isfromsnap, istosnap, istosnapwithnofrom;
 296
 297         snapname = strrchr(zhp->zfs_name, '@')+1;
 298         isfromsnap = (sd->fromsnap != NULL &&
 299             strcmp(sd->fromsnap, snapname) == 0);
 300         istosnap = (sd->tosnap != NULL && (strcmp(sd->tosnap, snapname) == 0));
 301         istosnapwithnofrom = (istosnap && sd->fromsnap == NULL);
 302
 303         if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 304                 if (sd->verbose) {
 305                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 306                             "skipping snapshot %s because it was created "
 307                             "after the destination snapshot (%s)\n"),
 308                             zhp->zfs_name, sd->tosnap);
 309                 }
 310                 zfs_close(zhp);
 311                 return (0);
 312         }
 313
 314         fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
 315         /*
 316          * NB: if there is no fromsnap here (it's a newly created fs in
 317          * an incremental replication), we will substitute the tosnap.
 318          */
 319         if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap)) {
 320                 sd->parent_fromsnap_guid = guid;
 321         }
 322
 323         if (!sd->recursive) {
 324
 325                 /*
 326                  * To allow a doall stream to work properly
 327                  * with a NULL fromsnap
 328                  */
 329                 if (sd->doall && sd->fromsnap == NULL && !sd->seenfrom) {
 330                         sd->seenfrom = B_TRUE;
 331                 }
 332
 333                 if (!sd->seenfrom && isfromsnap) {
 334                         sd->seenfrom = B_TRUE;
 335                         zfs_close(zhp);
 336                         return (0);
 337                 }
 338
 339                 if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
 340                         zfs_close(zhp);
 341                         return (0);
 342                 }
 343
 344                 if (istosnap)
 345                         sd->seento = B_TRUE;
 346         }
 347
 348         nv = fnvlist_alloc();
 349         send_iterate_prop(zhp, sd->backup, nv);
 350         fnvlist_add_nvlist(sd->snapprops, snapname, nv);
 351         fnvlist_free(nv);
 352         if (sd->holds) {
 353                 nvlist_t *holds = fnvlist_alloc();
 354                 int err = lzc_get_holds(zhp->zfs_name, &holds);
 355                 if (err == 0) {
 356                         fnvlist_add_nvlist(sd->snapholds, snapname, holds);
 357                 }
 358                 fnvlist_free(holds);
 359         }
 360
 361         zfs_close(zhp);
 362         return (0);
 363 }
 364
 365 static void
 366 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
 367 {
 368         nvlist_t *props = NULL;
 369         nvpair_t *elem = NULL;
 370
 371         if (received_only)
 372                 props = zfs_get_recvd_props(zhp);
 373         else
 374                 props = zhp->zfs_props;
 375
 376         while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
 377                 char *propname = nvpair_name(elem);
 378                 zfs_prop_t prop = zfs_name_to_prop(propname);
 379                 nvlist_t *propnv;
 380
 381                 if (!zfs_prop_user(propname)) {
 382                         /*
 383                          * Realistically, this should never happen.  However,
 384                          * we want the ability to add DSL properties without
 385                          * needing to make incompatible version changes.  We
 386                          * need to ignore unknown properties to allow older
 387                          * software to still send datasets containing these
 388                          * properties, with the unknown properties elided.
 389                          */
 390                         if (prop == ZPROP_INVAL)
 391                                 continue;
 392
 393                         if (zfs_prop_readonly(prop))
 394                                 continue;
 395                 }
 396
 397                 verify(nvpair_value_nvlist(elem, &propnv) == 0);
 398                 if (prop == ZFS_PROP_QUOTA || prop == ZFS_PROP_RESERVATION ||
 399                     prop == ZFS_PROP_REFQUOTA ||
 400                     prop == ZFS_PROP_REFRESERVATION) {
 401                         char *source;
 402                         uint64_t value;
 403                         verify(nvlist_lookup_uint64(propnv,
 404                             ZPROP_VALUE, &value) == 0);
 405                         if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
 406                                 continue;
 407                         /*
 408                          * May have no source before SPA_VERSION_RECVD_PROPS,
 409                          * but is still modifiable.
 410                          */
 411                         if (nvlist_lookup_string(propnv,
 412                             ZPROP_SOURCE, &source) == 0) {
 413                                 if ((strcmp(source, zhp->zfs_name) != 0) &&
 414                                     (strcmp(source,
 415                                     ZPROP_SOURCE_VAL_RECVD) != 0))
 416                                         continue;
 417                         }
 418                 } else {
 419                         char *source;
 420                         if (nvlist_lookup_string(propnv,
 421                             ZPROP_SOURCE, &source) != 0)
 422                                 continue;
 423                         if ((strcmp(source, zhp->zfs_name) != 0) &&
 424                             (strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0))
 425                                 continue;
 426                 }
 427
 428                 if (zfs_prop_user(propname) ||
 429                     zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
 430                         char *value;
 431                         value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
 432                         fnvlist_add_string(nv, propname, value);
 433                 } else {
 434                         uint64_t value;
 435                         value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
 436                         fnvlist_add_uint64(nv, propname, value);
 437                 }
 438         }
 439 }
 440
 441 /*
 442  * returns snapshot creation txg
 443  * and returns 0 if the snapshot does not exist
 444  */
 445 static uint64_t
 446 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
 447 {
 448         char name[ZFS_MAX_DATASET_NAME_LEN];
 449         uint64_t txg = 0;
 450
 451         if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
 452                 return (txg);
 453
 454         (void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
 455         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
 456                 zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
 457                 if (zhp != NULL) {
 458                         txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
 459                         zfs_close(zhp);
 460                 }
 461         }
 462
 463         return (txg);
 464 }
 465
 466 /*
 467  * recursively generate nvlists describing datasets.  See comment
 468  * for the data structure send_data_t above for description of contents
 469  * of the nvlist.
 470  */
 471 static int
 472 send_iterate_fs(zfs_handle_t *zhp, void *arg)
 473 {
 474         send_data_t *sd = arg;
 475         nvlist_t *nvfs = NULL, *nv = NULL;
 476         int rv = 0;
 477         uint64_t min_txg = 0, max_txg = 0;
 478         uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
 479         uint64_t fromsnap_txg_save = sd->fromsnap_txg;
 480         uint64_t tosnap_txg_save = sd->tosnap_txg;
 481         uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
 482         uint64_t guid = zhp->zfs_dmustats.dds_guid;
 483         uint64_t fromsnap_txg, tosnap_txg;
 484         char guidstring[64];
 485
 486         fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
 487         if (fromsnap_txg != 0)
 488                 sd->fromsnap_txg = fromsnap_txg;
 489
 490         tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
 491         if (tosnap_txg != 0)
 492                 sd->tosnap_txg = tosnap_txg;
 493
 494         /*
 495          * on the send side, if the current dataset does not have tosnap,
 496          * perform two additional checks:
 497          *
 498          * - skip sending the current dataset if it was created later than
 499          *   the parent tosnap
 500          * - return error if the current dataset was created earlier than
 501          *   the parent tosnap, unless --skip-missing specified. Then
 502          *   just print a warning
 503          */
 504         if (sd->tosnap != NULL && tosnap_txg == 0) {
 505                 if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
 506                         if (sd->verbose) {
 507                                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 508                                     "skipping dataset %s: snapshot %s does "
 509                                     "not exist\n"), zhp->zfs_name, sd->tosnap);
 510                         }
 511                 } else if (sd->skipmissing) {
 512                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 513                             "WARNING: skipping dataset %s and its children:"
 514                             " snapshot %s does not exist\n"),
 515                             zhp->zfs_name, sd->tosnap);
 516                 } else {
 517                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 518                             "cannot send %s@%s%s: snapshot %s@%s does not "
 519                             "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
 520                             dgettext(TEXT_DOMAIN, " recursively") : "",
 521                             zhp->zfs_name, sd->tosnap);
 522                         rv = EZFS_NOENT;
 523                 }
 524                 goto out;
 525         }
 526
 527         nvfs = fnvlist_alloc();
 528         fnvlist_add_string(nvfs, "name", zhp->zfs_name);
 529         fnvlist_add_uint64(nvfs, "parentfromsnap",
 530             sd->parent_fromsnap_guid);
 531
 532         if (zhp->zfs_dmustats.dds_origin[0]) {
 533                 zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
 534                     zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
 535                 if (origin == NULL) {
 536                         rv = -1;
 537                         goto out;
 538                 }
 539                 fnvlist_add_uint64(nvfs, "origin",
 540                     origin->zfs_dmustats.dds_guid);
 541
 542                 zfs_close(origin);
 543         }
 544
 545         /* iterate over props */
 546         if (sd->props || sd->backup || sd->recursive) {
 547                 nv = fnvlist_alloc();
 548                 send_iterate_prop(zhp, sd->backup, nv);
 549         }
 550         if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
 551                 boolean_t encroot;
 552
 553                 /* determine if this dataset is an encryption root */
 554                 if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
 555                         rv = -1;
 556                         goto out;
 557                 }
 558
 559                 if (encroot)
 560                         fnvlist_add_boolean(nvfs, "is_encroot");
 561
 562                 /*
 563                  * Encrypted datasets can only be sent with properties if
 564                  * the raw flag is specified because the receive side doesn't
 565                  * currently have a mechanism for recursively asking the user
 566                  * for new encryption parameters.
 567                  */
 568                 if (!sd->raw) {
 569                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 570                             "cannot send %s@%s: encrypted dataset %s may not "
 571                             "be sent with properties without the raw flag\n"),
 572                             sd->fsname, sd->tosnap, zhp->zfs_name);
 573                         rv = -1;
 574                         goto out;
 575                 }
 576
 577         }
 578
 579         if (nv != NULL)
 580                 fnvlist_add_nvlist(nvfs, "props", nv);
 581
 582         /* iterate over snaps, and set sd->parent_fromsnap_guid */
 583         sd->parent_fromsnap_guid = 0;
 584         sd->parent_snaps = fnvlist_alloc();
 585         sd->snapprops = fnvlist_alloc();
 586         if (sd->holds)
 587                 sd->snapholds = fnvlist_alloc();
 588
 589         /*
 590          * If this is a "doall" send, a replicate send or we're just trying
 591          * to gather a list of previous snapshots, iterate through all the
 592          * snaps in the txg range. Otherwise just look at the one we're
 593          * interested in.
 594          */
 595         if (sd->doall || sd->replicate || sd->tosnap == NULL) {
 596                 if (!sd->replicate && fromsnap_txg != 0)
 597                         min_txg = fromsnap_txg;
 598                 if (!sd->replicate && tosnap_txg != 0)
 599                         max_txg = tosnap_txg;
 600                 (void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
 601                     min_txg, max_txg);
 602         } else {
 603                 char snapname[MAXPATHLEN] = { 0 };
 604                 zfs_handle_t *snap;
 605
 606                 (void) snprintf(snapname, sizeof (snapname), "%s@%s",
 607                     zhp->zfs_name, sd->tosnap);
 608                 if (sd->fromsnap != NULL)
 609                         sd->seenfrom = B_TRUE;
 610                 snap = zfs_open(zhp->zfs_hdl, snapname,
 611                     ZFS_TYPE_SNAPSHOT);
 612                 if (snap != NULL)
 613                         (void) send_iterate_snap(snap, sd);
 614         }
 615
 616         fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
 617         fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
 618         if (sd->holds)
 619                 fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
 620         fnvlist_free(sd->parent_snaps);
 621         fnvlist_free(sd->snapprops);
 622         fnvlist_free(sd->snapholds);
 623
 624         /* Do not allow the size of the properties list to exceed the limit */
 625         if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
 626             zhp->zfs_hdl->libzfs_max_nvlist) {
 627                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
 628                     "warning: cannot send %s@%s: the size of the list of "
 629                     "snapshots and properties is too large to be received "
 630                     "successfully.\n"
 631                     "Select a smaller number of snapshots to send.\n"),
 632                     zhp->zfs_name, sd->tosnap);
 633                 rv = EZFS_NOSPC;
 634                 goto out;
 635         }
 636         /* add this fs to nvlist */
 637         (void) snprintf(guidstring, sizeof (guidstring),
 638             "0x%llx", (longlong_t)guid);
 639         fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
 640
 641         /* iterate over children */
 642         if (sd->recursive)
 643                 rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
 644
 645 out:
 646         sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
 647         sd->fromsnap_txg = fromsnap_txg_save;
 648         sd->tosnap_txg = tosnap_txg_save;
 649         fnvlist_free(nv);
 650         fnvlist_free(nvfs);
 651
 652         zfs_close(zhp);
 653         return (rv);
 654 }
 655
 656 static int
 657 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
 658     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
 659     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
 660     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
 661     avl_tree_t **avlp)
 662 {
 663         zfs_handle_t *zhp;
 664         send_data_t sd = { 0 };
 665         int error;
 666
 667         zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
 668         if (zhp == NULL)
 669                 return (EZFS_BADTYPE);
 670
 671         sd.fss = fnvlist_alloc();
 672         sd.fsname = fsname;
 673         sd.fromsnap = fromsnap;
 674         sd.tosnap = tosnap;
 675         sd.recursive = recursive;
 676         sd.raw = raw;
 677         sd.doall = doall;
 678         sd.replicate = replicate;
 679         sd.skipmissing = skipmissing;
 680         sd.verbose = verbose;
 681         sd.backup = backup;
 682         sd.holds = holds;
 683         sd.props = props;
 684
 685         if ((error = send_iterate_fs(zhp, &sd)) != 0) {
 686                 fnvlist_free(sd.fss);
 687                 if (avlp != NULL)
 688                         *avlp = NULL;
 689                 *nvlp = NULL;
 690                 return (error);
 691         }
 692
 693         if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
 694                 fnvlist_free(sd.fss);
 695                 *nvlp = NULL;
 696                 return (EZFS_NOMEM);
 697         }
 698
 699         *nvlp = sd.fss;
 700         return (0);
 701 }
 702
 703 /*
 704  * Routines specific to "zfs send"
 705  */
 706 typedef struct send_dump_data {
 707         /* these are all just the short snapname (the part after the @) */
 708         const char *fromsnap;
 709         const char *tosnap;
 710         char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
 711         uint64_t prevsnap_obj;
 712         boolean_t seenfrom, seento, replicate, doall, fromorigin;
 713         boolean_t dryrun, parsable, progress, embed_data, std_out;
 714         boolean_t large_block, compress, raw, holds;
 715         int outfd;
 716         boolean_t err;
 717         nvlist_t *fss;
 718         nvlist_t *snapholds;
 719         avl_tree_t *fsavl;
 720         snapfilter_cb_t *filter_cb;
 721         void *filter_cb_arg;
 722         nvlist_t *debugnv;
 723         char holdtag[ZFS_MAX_DATASET_NAME_LEN];
 724         int cleanup_fd;
 725         int verbosity;
 726         uint64_t size;
 727 } send_dump_data_t;
 728
 729 static int
 730 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
 731     enum lzc_send_flags flags, uint64_t *spacep)
 732 {
 733         libzfs_handle_t *hdl = zhp->zfs_hdl;
 734         int error;
 735
 736         assert(snapname != NULL);
 737         error = lzc_send_space(snapname, from, flags, spacep);
 738
 739         if (error != 0) {
 740                 char errbuf[1024];
 741                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 742                     "warning: cannot estimate space for '%s'"), snapname);
 743
 744                 switch (error) {
 745                 case EXDEV:
 746                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 747                             "not an earlier snapshot from the same fs"));
 748                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 749
 750                 case ENOENT:
 751                         if (zfs_dataset_exists(hdl, snapname,
 752                             ZFS_TYPE_SNAPSHOT)) {
 753                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 754                                     "incremental source (%s) does not exist"),
 755                                     snapname);
 756                         }
 757                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
 758
 759                 case EDQUOT:
 760                 case EFBIG:
 761                 case EIO:
 762                 case ENOLINK:
 763                 case ENOSPC:
 764                 case ENOSTR:
 765                 case ENXIO:
 766                 case EPIPE:
 767                 case ERANGE:
 768                 case EFAULT:
 769                 case EROFS:
 770                 case EINVAL:
 771                         zfs_error_aux(hdl, "%s", strerror(error));
 772                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 773
 774                 default:
 775                         return (zfs_standard_error(hdl, error, errbuf));
 776                 }
 777         }
 778
 779         return (0);
 780 }
 781
 782 /*
 783  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
 784  * NULL) to the file descriptor specified by outfd.
 785  */
 786 static int
 787 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
 788     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
 789     nvlist_t *debugnv)
 790 {
 791         zfs_cmd_t zc = {"\0"};
 792         libzfs_handle_t *hdl = zhp->zfs_hdl;
 793         nvlist_t *thisdbg;
 794
 795         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 796         assert(fromsnap_obj == 0 || !fromorigin);
 797
 798         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 799         zc.zc_cookie = outfd;
 800         zc.zc_obj = fromorigin;
 801         zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
 802         zc.zc_fromobj = fromsnap_obj;
 803         zc.zc_flags = flags;
 804
 805         thisdbg = fnvlist_alloc();
 806         if (fromsnap && fromsnap[0] != '\0') {
 807                 fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
 808         }
 809
 810         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
 811                 char errbuf[1024];
 812                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
 813                     "warning: cannot send '%s'"), zhp->zfs_name);
 814
 815                 fnvlist_add_uint64(thisdbg, "error", errno);
 816                 if (debugnv) {
 817                         fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
 818                 }
 819                 fnvlist_free(thisdbg);
 820
 821                 switch (errno) {
 822                 case EXDEV:
 823                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 824                             "not an earlier snapshot from the same fs"));
 825                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
 826
 827                 case EACCES:
 828                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 829                             "source key must be loaded"));
 830                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
 831
 832                 case ENOENT:
 833                         if (zfs_dataset_exists(hdl, zc.zc_name,
 834                             ZFS_TYPE_SNAPSHOT)) {
 835                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
 836                                     "incremental source (@%s) does not exist"),
 837                                     zc.zc_value);
 838                         }
 839                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
 840
 841                 case EDQUOT:
 842                 case EFBIG:
 843                 case EIO:
 844                 case ENOLINK:
 845                 case ENOSPC:
 846                 case ENOSTR:
 847                 case ENXIO:
 848                 case EPIPE:
 849                 case ERANGE:
 850                 case EFAULT:
 851                 case EROFS:
 852                 case EINVAL:
 853                         zfs_error_aux(hdl, "%s", strerror(errno));
 854                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
 855
 856                 default:
 857                         return (zfs_standard_error(hdl, errno, errbuf));
 858                 }
 859         }
 860
 861         if (debugnv)
 862                 fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
 863         fnvlist_free(thisdbg);
 864
 865         return (0);
 866 }
 867
 868 static void
 869 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
 870 {
 871         assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
 872
 873         /*
 874          * zfs_send() only sets snapholds for sends that need them,
 875          * e.g. replication and doall.
 876          */
 877         if (sdd->snapholds == NULL)
 878                 return;
 879
 880         fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
 881 }
 882
 883 int
 884 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
 885     uint64_t *blocks_visited)
 886 {
 887         zfs_cmd_t zc = {"\0"};
 888
 889         (void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
 890         zc.zc_cookie = fd;
 891         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
 892                 return (errno);
 893         if (bytes_written != NULL)
 894                 *bytes_written = zc.zc_cookie;
 895         if (blocks_visited != NULL)
 896                 *blocks_visited = zc.zc_objset_type;
 897         return (0);
 898 }
 899
 900 static void *
 901 send_progress_thread(void *arg)
 902 {
 903         progress_arg_t *pa = arg;
 904         zfs_handle_t *zhp = pa->pa_zhp;
 905         uint64_t bytes;
 906         uint64_t blocks;
 907         char buf[16];
 908         time_t t;
 909         struct tm *tm;
 910         boolean_t firstloop = B_TRUE;
 911
 912         /*
 913          * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
 914          */
 915         for (;;) {
 916                 int err;
 917                 (void) sleep(1);
 918                 if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
 919                     &blocks)) != 0) {
 920                         if (err == EINTR || err == ENOENT)
 921                                 return ((void *)0);
 922                         return ((void *)(uintptr_t)err);
 923                 }
 924
 925                 if (firstloop && !pa->pa_parsable) {
 926                         (void) fprintf(stderr,
 927                             "TIME       %s   %sSNAPSHOT %s\n",
 928                             pa->pa_estimate ? "BYTES" : " SENT",
 929                             pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
 930                             zhp->zfs_name);
 931                         firstloop = B_FALSE;
 932                 }
 933
 934                 (void) time(&t);
 935                 tm = localtime(&t);
 936
 937                 if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
 938                         (void) fprintf(stderr,
 939                             "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
 940                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 941                             (u_longlong_t)bytes, (u_longlong_t)blocks,
 942                             zhp->zfs_name);
 943                 } else if (pa->pa_verbosity >= 2) {
 944                         zfs_nicenum(bytes, buf, sizeof (buf));
 945                         (void) fprintf(stderr,
 946                             "%02d:%02d:%02d   %5s    %8llu    %s\n",
 947                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 948                             buf, (u_longlong_t)blocks, zhp->zfs_name);
 949                 } else if (pa->pa_parsable) {
 950                         (void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
 951                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 952                             (u_longlong_t)bytes, zhp->zfs_name);
 953                 } else {
 954                         zfs_nicebytes(bytes, buf, sizeof (buf));
 955                         (void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
 956                             tm->tm_hour, tm->tm_min, tm->tm_sec,
 957                             buf, zhp->zfs_name);
 958                 }
 959         }
 960 }
 961
 962 static void
 963 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
 964     uint64_t size, boolean_t parsable)
 965 {
 966         if (parsable) {
 967                 if (fromsnap != NULL) {
 968                         (void) fprintf(fout, "incremental\t%s\t%s",
 969                             fromsnap, tosnap);
 970                 } else {
 971                         (void) fprintf(fout, "full\t%s",
 972                             tosnap);
 973                 }
 974         } else {
 975                 if (fromsnap != NULL) {
 976                         if (strchr(fromsnap, '@') == NULL &&
 977                             strchr(fromsnap, '#') == NULL) {
 978                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 979                                     "send from @%s to %s"),
 980                                     fromsnap, tosnap);
 981                         } else {
 982                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 983                                     "send from %s to %s"),
 984                                     fromsnap, tosnap);
 985                         }
 986                 } else {
 987                         (void) fprintf(fout, dgettext(TEXT_DOMAIN,
 988                             "full send of %s"),
 989                             tosnap);
 990                 }
 991         }
 992
 993         if (parsable) {
 994                 (void) fprintf(fout, "\t%llu",
 995                     (longlong_t)size);
 996         } else if (size != 0) {
 997                 char buf[16];
 998                 zfs_nicebytes(size, buf, sizeof (buf));
 999                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1000                     " estimated size is %s"), buf);
1001         }
1002         (void) fprintf(fout, "\n");
1003 }
1004
1005 static int
1006 dump_snapshot(zfs_handle_t *zhp, void *arg)
1007 {
1008         send_dump_data_t *sdd = arg;
1009         progress_arg_t pa = { 0 };
1010         pthread_t tid;
1011         char *thissnap;
1012         enum lzc_send_flags flags = 0;
1013         int err;
1014         boolean_t isfromsnap, istosnap, fromorigin;
1015         boolean_t exclude = B_FALSE;
1016         FILE *fout = sdd->std_out ? stdout : stderr;
1017
1018         err = 0;
1019         thissnap = strchr(zhp->zfs_name, '@') + 1;
1020         isfromsnap = (sdd->fromsnap != NULL &&
1021             strcmp(sdd->fromsnap, thissnap) == 0);
1022
1023         if (!sdd->seenfrom && isfromsnap) {
1024                 gather_holds(zhp, sdd);
1025                 sdd->seenfrom = B_TRUE;
1026                 (void) strlcpy(sdd->prevsnap, thissnap,
1027                     sizeof (sdd->prevsnap));
1028                 sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1029                 zfs_close(zhp);
1030                 return (0);
1031         }
1032
1033         if (sdd->seento || !sdd->seenfrom) {
1034                 zfs_close(zhp);
1035                 return (0);
1036         }
1037
1038         istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1039         if (istosnap)
1040                 sdd->seento = B_TRUE;
1041
1042         if (sdd->large_block)
1043                 flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1044         if (sdd->embed_data)
1045                 flags |= LZC_SEND_FLAG_EMBED_DATA;
1046         if (sdd->compress)
1047                 flags |= LZC_SEND_FLAG_COMPRESS;
1048         if (sdd->raw)
1049                 flags |= LZC_SEND_FLAG_RAW;
1050
1051         if (!sdd->doall && !isfromsnap && !istosnap) {
1052                 if (sdd->replicate) {
1053                         char *snapname;
1054                         nvlist_t *snapprops;
1055                         /*
1056                          * Filter out all intermediate snapshots except origin
1057                          * snapshots needed to replicate clones.
1058                          */
1059                         nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1060                             zhp->zfs_dmustats.dds_guid, &snapname);
1061
1062                         if (nvfs != NULL) {
1063                                 snapprops = fnvlist_lookup_nvlist(nvfs,
1064                                     "snapprops");
1065                                 snapprops = fnvlist_lookup_nvlist(snapprops,
1066                                     thissnap);
1067                                 exclude = !nvlist_exists(snapprops,
1068                                     "is_clone_origin");
1069                         }
1070                 } else {
1071                         exclude = B_TRUE;
1072                 }
1073         }
1074
1075         /*
1076          * If a filter function exists, call it to determine whether
1077          * this snapshot will be sent.
1078          */
1079         if (exclude || (sdd->filter_cb != NULL &&
1080             sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1081                 /*
1082                  * This snapshot is filtered out.  Don't send it, and don't
1083                  * set prevsnap_obj, so it will be as if this snapshot didn't
1084                  * exist, and the next accepted snapshot will be sent as
1085                  * an incremental from the last accepted one, or as the
1086                  * first (and full) snapshot in the case of a replication,
1087                  * non-incremental send.
1088                  */
1089                 zfs_close(zhp);
1090                 return (0);
1091         }
1092
1093         gather_holds(zhp, sdd);
1094         fromorigin = sdd->prevsnap[0] == '\0' &&
1095             (sdd->fromorigin || sdd->replicate);
1096
1097         if (sdd->verbosity != 0) {
1098                 uint64_t size = 0;
1099                 char fromds[ZFS_MAX_DATASET_NAME_LEN];
1100
1101                 if (sdd->prevsnap[0] != '\0') {
1102                         (void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1103                         *(strchr(fromds, '@') + 1) = '\0';
1104                         (void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1105                 }
1106                 if (zfs_send_space(zhp, zhp->zfs_name,
1107                     sdd->prevsnap[0] ? fromds : NULL, flags, &size) != 0) {
1108                         size = 0; /* cannot estimate send space */
1109                 } else {
1110                         send_print_verbose(fout, zhp->zfs_name,
1111                             sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1112                             size, sdd->parsable);
1113                 }
1114                 sdd->size += size;
1115         }
1116
1117         if (!sdd->dryrun) {
1118                 /*
1119                  * If progress reporting is requested, spawn a new thread to
1120                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1121                  */
1122                 if (sdd->progress) {
1123                         pa.pa_zhp = zhp;
1124                         pa.pa_fd = sdd->outfd;
1125                         pa.pa_parsable = sdd->parsable;
1126                         pa.pa_estimate = B_FALSE;
1127                         pa.pa_verbosity = sdd->verbosity;
1128
1129                         if ((err = pthread_create(&tid, NULL,
1130                             send_progress_thread, &pa)) != 0) {
1131                                 zfs_close(zhp);
1132                                 return (err);
1133                         }
1134                 }
1135
1136                 err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1137                     fromorigin, sdd->outfd, flags, sdd->debugnv);
1138
1139                 if (sdd->progress) {
1140                         void *status = NULL;
1141                         (void) pthread_cancel(tid);
1142                         (void) pthread_join(tid, &status);
1143                         int error = (int)(uintptr_t)status;
1144                         if (error != 0 && status != PTHREAD_CANCELED) {
1145                                 char errbuf[1024];
1146                                 (void) snprintf(errbuf, sizeof (errbuf),
1147                                     dgettext(TEXT_DOMAIN,
1148                                     "progress thread exited nonzero"));
1149                                 return (zfs_standard_error(zhp->zfs_hdl, error,
1150                                     errbuf));
1151                         }
1152                 }
1153         }
1154
1155         (void) strcpy(sdd->prevsnap, thissnap);
1156         sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1157         zfs_close(zhp);
1158         return (err);
1159 }
1160
1161 static int
1162 dump_filesystem(zfs_handle_t *zhp, void *arg)
1163 {
1164         int rv = 0;
1165         send_dump_data_t *sdd = arg;
1166         boolean_t missingfrom = B_FALSE;
1167         zfs_cmd_t zc = {"\0"};
1168         uint64_t min_txg = 0, max_txg = 0;
1169
1170         (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1171             zhp->zfs_name, sdd->tosnap);
1172         if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1173                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1174                     "WARNING: could not send %s@%s: does not exist\n"),
1175                     zhp->zfs_name, sdd->tosnap);
1176                 sdd->err = B_TRUE;
1177                 return (0);
1178         }
1179
1180         if (sdd->replicate && sdd->fromsnap) {
1181                 /*
1182                  * If this fs does not have fromsnap, and we're doing
1183                  * recursive, we need to send a full stream from the
1184                  * beginning (or an incremental from the origin if this
1185                  * is a clone).  If we're doing non-recursive, then let
1186                  * them get the error.
1187                  */
1188                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1189                     zhp->zfs_name, sdd->fromsnap);
1190                 if (zfs_ioctl(zhp->zfs_hdl,
1191                     ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1192                         missingfrom = B_TRUE;
1193                 }
1194         }
1195
1196         sdd->seenfrom = sdd->seento = sdd->prevsnap[0] = 0;
1197         sdd->prevsnap_obj = 0;
1198         if (sdd->fromsnap == NULL || missingfrom)
1199                 sdd->seenfrom = B_TRUE;
1200
1201
1202
1203         /*
1204          * Iterate through all snapshots and process the ones we will be
1205          * sending. If we only have a "from" and "to" snapshot to deal
1206          * with, we can avoid iterating through all the other snapshots.
1207          */
1208         if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1209                 if (!sdd->replicate && sdd->fromsnap != NULL)
1210                         min_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1211                             sdd->fromsnap);
1212                 if (!sdd->replicate && sdd->tosnap != NULL)
1213                         max_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1214                             sdd->tosnap);
1215                 rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, arg,
1216                     min_txg, max_txg);
1217         } else {
1218                 char snapname[MAXPATHLEN] = { 0 };
1219                 zfs_handle_t *snap;
1220
1221                 if (!sdd->seenfrom) {
1222                         (void) snprintf(snapname, sizeof (snapname),
1223                             "%s@%s", zhp->zfs_name, sdd->fromsnap);
1224                         snap = zfs_open(zhp->zfs_hdl, snapname,
1225                             ZFS_TYPE_SNAPSHOT);
1226                         if (snap != NULL)
1227                                 rv = dump_snapshot(snap, sdd);
1228                         else
1229                                 rv = -1;
1230                 }
1231
1232                 if (rv == 0) {
1233                         (void) snprintf(snapname, sizeof (snapname),
1234                             "%s@%s", zhp->zfs_name, sdd->tosnap);
1235                         snap = zfs_open(zhp->zfs_hdl, snapname,
1236                             ZFS_TYPE_SNAPSHOT);
1237                         if (snap != NULL)
1238                                 rv = dump_snapshot(snap, sdd);
1239                         else
1240                                 rv = -1;
1241                 }
1242         }
1243
1244         if (!sdd->seenfrom) {
1245                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1246                     "WARNING: could not send %s@%s:\n"
1247                     "incremental source (%s@%s) does not exist\n"),
1248                     zhp->zfs_name, sdd->tosnap,
1249                     zhp->zfs_name, sdd->fromsnap);
1250                 sdd->err = B_TRUE;
1251         } else if (!sdd->seento) {
1252                 if (sdd->fromsnap) {
1253                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1254                             "WARNING: could not send %s@%s:\n"
1255                             "incremental source (%s@%s) "
1256                             "is not earlier than it\n"),
1257                             zhp->zfs_name, sdd->tosnap,
1258                             zhp->zfs_name, sdd->fromsnap);
1259                 } else {
1260                         (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1261                             "WARNING: "
1262                             "could not send %s@%s: does not exist\n"),
1263                             zhp->zfs_name, sdd->tosnap);
1264                 }
1265                 sdd->err = B_TRUE;
1266         }
1267
1268         return (rv);
1269 }
1270
1271 static int
1272 dump_filesystems(zfs_handle_t *rzhp, void *arg)
1273 {
1274         send_dump_data_t *sdd = arg;
1275         nvpair_t *fspair;
1276         boolean_t needagain, progress;
1277
1278         if (!sdd->replicate)
1279                 return (dump_filesystem(rzhp, sdd));
1280
1281         /* Mark the clone origin snapshots. */
1282         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1283             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1284                 nvlist_t *nvfs;
1285                 uint64_t origin_guid = 0;
1286
1287                 nvfs = fnvpair_value_nvlist(fspair);
1288                 (void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1289                 if (origin_guid != 0) {
1290                         char *snapname;
1291                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1292                             origin_guid, &snapname);
1293                         if (origin_nv != NULL) {
1294                                 nvlist_t *snapprops;
1295                                 snapprops = fnvlist_lookup_nvlist(origin_nv,
1296                                     "snapprops");
1297                                 snapprops = fnvlist_lookup_nvlist(snapprops,
1298                                     snapname);
1299                                 fnvlist_add_boolean(snapprops,
1300                                     "is_clone_origin");
1301                         }
1302                 }
1303         }
1304 again:
1305         needagain = progress = B_FALSE;
1306         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1307             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1308                 nvlist_t *fslist, *parent_nv;
1309                 char *fsname;
1310                 zfs_handle_t *zhp;
1311                 int err;
1312                 uint64_t origin_guid = 0;
1313                 uint64_t parent_guid = 0;
1314
1315                 fslist = fnvpair_value_nvlist(fspair);
1316                 if (nvlist_lookup_boolean(fslist, "sent") == 0)
1317                         continue;
1318
1319                 fsname = fnvlist_lookup_string(fslist, "name");
1320                 (void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1321                 (void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1322                     &parent_guid);
1323
1324                 if (parent_guid != 0) {
1325                         parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1326                         if (!nvlist_exists(parent_nv, "sent")) {
1327                                 /* parent has not been sent; skip this one */
1328                                 needagain = B_TRUE;
1329                                 continue;
1330                         }
1331                 }
1332
1333                 if (origin_guid != 0) {
1334                         nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1335                             origin_guid, NULL);
1336                         if (origin_nv != NULL &&
1337                             !nvlist_exists(origin_nv, "sent")) {
1338                                 /*
1339                                  * origin has not been sent yet;
1340                                  * skip this clone.
1341                                  */
1342                                 needagain = B_TRUE;
1343                                 continue;
1344                         }
1345                 }
1346
1347                 zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1348                 if (zhp == NULL)
1349                         return (-1);
1350                 err = dump_filesystem(zhp, sdd);
1351                 fnvlist_add_boolean(fslist, "sent");
1352                 progress = B_TRUE;
1353                 zfs_close(zhp);
1354                 if (err)
1355                         return (err);
1356         }
1357         if (needagain) {
1358                 assert(progress);
1359                 goto again;
1360         }
1361
1362         /* clean out the sent flags in case we reuse this fss */
1363         for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1364             fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1365                 nvlist_t *fslist;
1366
1367                 fslist = fnvpair_value_nvlist(fspair);
1368                 (void) nvlist_remove_all(fslist, "sent");
1369         }
1370
1371         return (0);
1372 }
1373
1374 nvlist_t *
1375 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1376 {
1377         unsigned int version;
1378         int nread, i;
1379         unsigned long long checksum, packed_len;
1380
1381         /*
1382          * Decode token header, which is:
1383          *   <token version>-<checksum of payload>-<uncompressed payload length>
1384          * Note that the only supported token version is 1.
1385          */
1386         nread = sscanf(token, "%u-%llx-%llx-",
1387             &version, &checksum, &packed_len);
1388         if (nread != 3) {
1389                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1390                     "resume token is corrupt (invalid format)"));
1391                 return (NULL);
1392         }
1393
1394         if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1395                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1396                     "resume token is corrupt (invalid version %u)"),
1397                     version);
1398                 return (NULL);
1399         }
1400
1401         /* convert hexadecimal representation to binary */
1402         token = strrchr(token, '-') + 1;
1403         int len = strlen(token) / 2;
1404         unsigned char *compressed = zfs_alloc(hdl, len);
1405         for (i = 0; i < len; i++) {
1406                 nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1407                 if (nread != 1) {
1408                         free(compressed);
1409                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1410                             "resume token is corrupt "
1411                             "(payload is not hex-encoded)"));
1412                         return (NULL);
1413                 }
1414         }
1415
1416         /* verify checksum */
1417         zio_cksum_t cksum;
1418         fletcher_4_native_varsize(compressed, len, &cksum);
1419         if (cksum.zc_word[0] != checksum) {
1420                 free(compressed);
1421                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1422                     "resume token is corrupt (incorrect checksum)"));
1423                 return (NULL);
1424         }
1425
1426         /* uncompress */
1427         void *packed = zfs_alloc(hdl, packed_len);
1428         uLongf packed_len_long = packed_len;
1429         if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1430             packed_len_long != packed_len) {
1431                 free(packed);
1432                 free(compressed);
1433                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1434                     "resume token is corrupt (decompression failed)"));
1435                 return (NULL);
1436         }
1437
1438         /* unpack nvlist */
1439         nvlist_t *nv;
1440         int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1441         free(packed);
1442         free(compressed);
1443         if (error != 0) {
1444                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1445                     "resume token is corrupt (nvlist_unpack failed)"));
1446                 return (NULL);
1447         }
1448         return (nv);
1449 }
1450 static enum lzc_send_flags
1451 lzc_flags_from_sendflags(const sendflags_t *flags)
1452 {
1453         enum lzc_send_flags lzc_flags = 0;
1454         if (flags->largeblock)
1455                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1456         if (flags->embed_data)
1457                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1458         if (flags->compress)
1459                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1460         if (flags->raw)
1461                 lzc_flags |= LZC_SEND_FLAG_RAW;
1462         if (flags->saved)
1463                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1464         return (lzc_flags);
1465 }
1466
1467 static int
1468 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1469     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1470     const char *redactbook, char *errbuf)
1471 {
1472         uint64_t size;
1473         FILE *fout = flags->dryrun ? stdout : stderr;
1474         progress_arg_t pa = { 0 };
1475         int err = 0;
1476         pthread_t ptid;
1477
1478         if (flags->progress) {
1479                 pa.pa_zhp = zhp;
1480                 pa.pa_fd = fd;
1481                 pa.pa_parsable = flags->parsable;
1482                 pa.pa_estimate = B_TRUE;
1483                 pa.pa_verbosity = flags->verbosity;
1484
1485                 err = pthread_create(&ptid, NULL,
1486                     send_progress_thread, &pa);
1487                 if (err != 0) {
1488                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1489                         return (zfs_error(zhp->zfs_hdl,
1490                             EZFS_THREADCREATEFAILED, errbuf));
1491                 }
1492         }
1493
1494         err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1495             lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1496             redactbook, fd, &size);
1497
1498         if (flags->progress) {
1499                 void *status = NULL;
1500                 (void) pthread_cancel(ptid);
1501                 (void) pthread_join(ptid, &status);
1502                 int error = (int)(uintptr_t)status;
1503                 if (error != 0 && status != PTHREAD_CANCELED) {
1504                         char errbuf[1024];
1505                         (void) snprintf(errbuf, sizeof (errbuf),
1506                             dgettext(TEXT_DOMAIN, "progress thread exited "
1507                             "nonzero"));
1508                         return (zfs_standard_error(zhp->zfs_hdl, error,
1509                             errbuf));
1510                 }
1511         }
1512
1513         if (err != 0) {
1514                 zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1515                 return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1516                     errbuf));
1517         }
1518         send_print_verbose(fout, zhp->zfs_name, from, size,
1519             flags->parsable);
1520
1521         if (flags->parsable) {
1522                 (void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1523         } else {
1524                 char buf[16];
1525                 zfs_nicenum(size, buf, sizeof (buf));
1526                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1527                     "total estimated size is %s\n"), buf);
1528         }
1529         return (0);
1530 }
1531
1532 static boolean_t
1533 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1534 {
1535         for (int i = 0; i < num_snaps; i++) {
1536                 if (snaps[i] == guid)
1537                         return (B_TRUE);
1538         }
1539         return (B_FALSE);
1540 }
1541
1542 static boolean_t
1543 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1544     const uint64_t *snaps2, uint64_t num_snaps2)
1545 {
1546         if (num_snaps1 != num_snaps2)
1547                 return (B_FALSE);
1548         for (int i = 0; i < num_snaps1; i++) {
1549                 if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1550                         return (B_FALSE);
1551         }
1552         return (B_TRUE);
1553 }
1554
1555 /*
1556  * Check that the list of redaction snapshots in the bookmark matches the send
1557  * we're resuming, and return whether or not it's complete.
1558  *
1559  * Note that the caller needs to free the contents of *bookname with free() if
1560  * this function returns successfully.
1561  */
1562 static int
1563 find_redact_book(libzfs_handle_t *hdl, const char *path,
1564     const uint64_t *redact_snap_guids, int num_redact_snaps,
1565     char **bookname)
1566 {
1567         char errbuf[1024];
1568         int error = 0;
1569         nvlist_t *props = fnvlist_alloc();
1570         nvlist_t *bmarks;
1571
1572         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1573             "cannot resume send"));
1574
1575         fnvlist_add_boolean(props, "redact_complete");
1576         fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1577         error = lzc_get_bookmarks(path, props, &bmarks);
1578         fnvlist_free(props);
1579         if (error != 0) {
1580                 if (error == ESRCH) {
1581                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1582                             "nonexistent redaction bookmark provided"));
1583                 } else if (error == ENOENT) {
1584                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1585                             "dataset to be sent no longer exists"));
1586                 } else {
1587                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1588                             "unknown error: %s"), strerror(error));
1589                 }
1590                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1591         }
1592         nvpair_t *pair;
1593         for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1594             pair = nvlist_next_nvpair(bmarks, pair)) {
1595
1596                 nvlist_t *bmark = fnvpair_value_nvlist(pair);
1597                 nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1598                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1599                 uint_t len = 0;
1600                 uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1601                     ZPROP_VALUE, &len);
1602                 if (redact_snaps_equal(redact_snap_guids,
1603                     num_redact_snaps, bmarksnaps, len)) {
1604                         break;
1605                 }
1606         }
1607         if (pair == NULL)  {
1608                 fnvlist_free(bmarks);
1609                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1610                     "no appropriate redaction bookmark exists"));
1611                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1612         }
1613         char *name = nvpair_name(pair);
1614         nvlist_t *bmark = fnvpair_value_nvlist(pair);
1615         nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1616         boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1617             ZPROP_VALUE);
1618         if (!complete) {
1619                 fnvlist_free(bmarks);
1620                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1621                     "incomplete redaction bookmark provided"));
1622                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1623         }
1624         *bookname = strndup(name, ZFS_MAX_DATASET_NAME_LEN);
1625         ASSERT3P(*bookname, !=, NULL);
1626         fnvlist_free(bmarks);
1627         return (0);
1628 }
1629
1630 static int
1631 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1632     nvlist_t *resume_nvl)
1633 {
1634         char errbuf[1024];
1635         char *toname;
1636         char *fromname = NULL;
1637         uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1638         zfs_handle_t *zhp;
1639         int error = 0;
1640         char name[ZFS_MAX_DATASET_NAME_LEN];
1641         enum lzc_send_flags lzc_flags = 0;
1642         FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1643         uint64_t *redact_snap_guids = NULL;
1644         int num_redact_snaps = 0;
1645         char *redact_book = NULL;
1646
1647         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1648             "cannot resume send"));
1649
1650         if (flags->verbosity != 0) {
1651                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
1652                     "resume token contents:\n"));
1653                 nvlist_print(fout, resume_nvl);
1654         }
1655
1656         if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1657             nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1658             nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1659             nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1660             nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1661                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1662                     "resume token is corrupt"));
1663                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1664         }
1665         fromguid = 0;
1666         (void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1667
1668         if (flags->largeblock || nvlist_exists(resume_nvl, "largeblockok"))
1669                 lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1670         if (flags->embed_data || nvlist_exists(resume_nvl, "embedok"))
1671                 lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1672         if (flags->compress || nvlist_exists(resume_nvl, "compressok"))
1673                 lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1674         if (flags->raw || nvlist_exists(resume_nvl, "rawok"))
1675                 lzc_flags |= LZC_SEND_FLAG_RAW;
1676         if (flags->saved || nvlist_exists(resume_nvl, "savedok"))
1677                 lzc_flags |= LZC_SEND_FLAG_SAVED;
1678
1679         if (flags->saved) {
1680                 (void) strcpy(name, toname);
1681         } else {
1682                 error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1683                 if (error != 0) {
1684                         if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1685                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1686                                     "'%s' is no longer the same snapshot "
1687                                     "used in the initial send"), toname);
1688                         } else {
1689                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1690                                     "'%s' used in the initial send no "
1691                                     "longer exists"), toname);
1692                         }
1693                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1694                 }
1695         }
1696
1697         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1698         if (zhp == NULL) {
1699                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1700                     "unable to access '%s'"), name);
1701                 return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1702         }
1703
1704         if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1705             &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1706                 num_redact_snaps = -1;
1707         }
1708
1709         if (fromguid != 0) {
1710                 if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1711                     redact_snap_guids, num_redact_snaps, name) != 0) {
1712                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1713                             "incremental source %#llx no longer exists"),
1714                             (longlong_t)fromguid);
1715                         return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1716                 }
1717                 fromname = name;
1718         }
1719
1720         redact_snap_guids = NULL;
1721
1722         if (nvlist_lookup_uint64_array(resume_nvl,
1723             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1724             (uint_t *)&num_redact_snaps) == 0) {
1725                 char path[ZFS_MAX_DATASET_NAME_LEN];
1726
1727                 (void) strlcpy(path, toname, sizeof (path));
1728                 char *at = strchr(path, '@');
1729                 ASSERT3P(at, !=, NULL);
1730
1731                 *at = '\0';
1732
1733                 if ((error = find_redact_book(hdl, path, redact_snap_guids,
1734                     num_redact_snaps, &redact_book)) != 0) {
1735                         return (error);
1736                 }
1737         }
1738
1739         if (flags->verbosity != 0) {
1740                 /*
1741                  * Some of these may have come from the resume token, set them
1742                  * here for size estimate purposes.
1743                  */
1744                 sendflags_t tmpflags = *flags;
1745                 if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1746                         tmpflags.largeblock = B_TRUE;
1747                 if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1748                         tmpflags.compress = B_TRUE;
1749                 if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1750                         tmpflags.embed_data = B_TRUE;
1751                 if (lzc_flags & LZC_SEND_FLAG_RAW)
1752                         tmpflags.raw = B_TRUE;
1753                 if (lzc_flags & LZC_SEND_FLAG_SAVED)
1754                         tmpflags.saved = B_TRUE;
1755                 error = estimate_size(zhp, fromname, outfd, &tmpflags,
1756                     resumeobj, resumeoff, bytes, redact_book, errbuf);
1757         }
1758
1759         if (!flags->dryrun) {
1760                 progress_arg_t pa = { 0 };
1761                 pthread_t tid;
1762                 /*
1763                  * If progress reporting is requested, spawn a new thread to
1764                  * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1765                  */
1766                 if (flags->progress) {
1767                         pa.pa_zhp = zhp;
1768                         pa.pa_fd = outfd;
1769                         pa.pa_parsable = flags->parsable;
1770                         pa.pa_estimate = B_FALSE;
1771                         pa.pa_verbosity = flags->verbosity;
1772
1773                         error = pthread_create(&tid, NULL,
1774                             send_progress_thread, &pa);
1775                         if (error != 0) {
1776                                 if (redact_book != NULL)
1777                                         free(redact_book);
1778                                 zfs_close(zhp);
1779                                 return (error);
1780                         }
1781                 }
1782
1783                 error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1784                     lzc_flags, resumeobj, resumeoff, redact_book);
1785                 if (redact_book != NULL)
1786                         free(redact_book);
1787
1788                 if (flags->progress) {
1789                         void *status = NULL;
1790                         (void) pthread_cancel(tid);
1791                         (void) pthread_join(tid, &status);
1792                         int error = (int)(uintptr_t)status;
1793                         if (error != 0 && status != PTHREAD_CANCELED) {
1794                                 char errbuf[1024];
1795                                 (void) snprintf(errbuf, sizeof (errbuf),
1796                                     dgettext(TEXT_DOMAIN,
1797                                     "progress thread exited nonzero"));
1798                                 return (zfs_standard_error(hdl, error, errbuf));
1799                         }
1800                 }
1801
1802                 char errbuf[1024];
1803                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1804                     "warning: cannot send '%s'"), zhp->zfs_name);
1805
1806                 zfs_close(zhp);
1807
1808                 switch (error) {
1809                 case 0:
1810                         return (0);
1811                 case EACCES:
1812                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1813                             "source key must be loaded"));
1814                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1815                 case ESRCH:
1816                         if (lzc_exists(zhp->zfs_name)) {
1817                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1818                                     "incremental source could not be found"));
1819                         }
1820                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
1821
1822                 case EXDEV:
1823                 case ENOENT:
1824                 case EDQUOT:
1825                 case EFBIG:
1826                 case EIO:
1827                 case ENOLINK:
1828                 case ENOSPC:
1829                 case ENOSTR:
1830                 case ENXIO:
1831                 case EPIPE:
1832                 case ERANGE:
1833                 case EFAULT:
1834                 case EROFS:
1835                         zfs_error_aux(hdl, "%s", strerror(errno));
1836                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1837
1838                 default:
1839                         return (zfs_standard_error(hdl, errno, errbuf));
1840                 }
1841         } else {
1842                 if (redact_book != NULL)
1843                         free(redact_book);
1844         }
1845
1846         zfs_close(zhp);
1847
1848         return (error);
1849 }
1850
1851 int
1852 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1853     const char *resume_token)
1854 {
1855         int ret;
1856         char errbuf[1024];
1857         nvlist_t *resume_nvl;
1858
1859         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1860             "cannot resume send"));
1861
1862         resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1863         if (resume_nvl == NULL) {
1864                 /*
1865                  * zfs_error_aux has already been set by
1866                  * zfs_send_resume_token_to_nvlist()
1867                  */
1868                 return (zfs_error(hdl, EZFS_FAULT, errbuf));
1869         }
1870
1871         ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1872         fnvlist_free(resume_nvl);
1873
1874         return (ret);
1875 }
1876
1877 int
1878 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1879     const char *resume_token)
1880 {
1881         int ret;
1882         libzfs_handle_t *hdl = zhp->zfs_hdl;
1883         nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1884         uint64_t saved_guid = 0, resume_guid = 0;
1885         uint64_t obj = 0, off = 0, bytes = 0;
1886         char token_buf[ZFS_MAXPROPLEN];
1887         char errbuf[1024];
1888
1889         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1890             "saved send failed"));
1891
1892         ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1893             token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1894         if (ret != 0)
1895                 goto out;
1896
1897         saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1898         if (saved_nvl == NULL) {
1899                 /*
1900                  * zfs_error_aux has already been set by
1901                  * zfs_send_resume_token_to_nvlist()
1902                  */
1903                 ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1904                 goto out;
1905         }
1906
1907         /*
1908          * If a resume token is provided we use the object and offset
1909          * from that instead of the default, which starts from the
1910          * beginning.
1911          */
1912         if (resume_token != NULL) {
1913                 resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1914                     resume_token);
1915                 if (resume_nvl == NULL) {
1916                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1917                         goto out;
1918                 }
1919
1920                 if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1921                     nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1922                     nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1923                     nvlist_lookup_uint64(resume_nvl, "toguid",
1924                     &resume_guid) != 0) {
1925                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1926                             "provided resume token is corrupt"));
1927                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1928                         goto out;
1929                 }
1930
1931                 if (nvlist_lookup_uint64(saved_nvl, "toguid",
1932                     &saved_guid)) {
1933                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1934                             "dataset's resume token is corrupt"));
1935                         ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1936                         goto out;
1937                 }
1938
1939                 if (resume_guid != saved_guid) {
1940                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1941                             "provided resume token does not match dataset"));
1942                         ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
1943                         goto out;
1944                 }
1945         }
1946
1947         (void) nvlist_remove_all(saved_nvl, "object");
1948         fnvlist_add_uint64(saved_nvl, "object", obj);
1949
1950         (void) nvlist_remove_all(saved_nvl, "offset");
1951         fnvlist_add_uint64(saved_nvl, "offset", off);
1952
1953         (void) nvlist_remove_all(saved_nvl, "bytes");
1954         fnvlist_add_uint64(saved_nvl, "bytes", bytes);
1955
1956         (void) nvlist_remove_all(saved_nvl, "toname");
1957         fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
1958
1959         ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
1960
1961 out:
1962         fnvlist_free(saved_nvl);
1963         fnvlist_free(resume_nvl);
1964         return (ret);
1965 }
1966
1967 /*
1968  * This function informs the target system that the recursive send is complete.
1969  * The record is also expected in the case of a send -p.
1970  */
1971 static int
1972 send_conclusion_record(int fd, zio_cksum_t *zc)
1973 {
1974         dmu_replay_record_t drr = { 0 };
1975         drr.drr_type = DRR_END;
1976         if (zc != NULL)
1977                 drr.drr_u.drr_end.drr_checksum = *zc;
1978         if (write(fd, &drr, sizeof (drr)) == -1) {
1979                 return (errno);
1980         }
1981         return (0);
1982 }
1983
1984 /*
1985  * This function is responsible for sending the records that contain the
1986  * necessary information for the target system's libzfs to be able to set the
1987  * properties of the filesystem being received, or to be able to prepare for
1988  * a recursive receive.
1989  *
1990  * The "zhp" argument is the handle of the snapshot we are sending
1991  * (the "tosnap").  The "from" argument is the short snapshot name (the part
1992  * after the @) of the incremental source.
1993  */
1994 static int
1995 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
1996     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
1997     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
1998     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
1999     nvlist_t **fssp, avl_tree_t **fsavlp)
2000 {
2001         int err = 0;
2002         char *packbuf = NULL;
2003         size_t buflen = 0;
2004         zio_cksum_t zc = { {0} };
2005         int featureflags = 0;
2006         /* name of filesystem/volume that contains snapshot we are sending */
2007         char tofs[ZFS_MAX_DATASET_NAME_LEN];
2008         /* short name of snap we are sending */
2009         char *tosnap = "";
2010
2011         char errbuf[1024];
2012         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2013             "warning: cannot send '%s'"), zhp->zfs_name);
2014         if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2015             ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2016                 featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2017         }
2018
2019         if (holds)
2020                 featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2021
2022         (void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2023         char *at = strchr(tofs, '@');
2024         if (at != NULL) {
2025                 *at = '\0';
2026                 tosnap = at + 1;
2027         }
2028
2029         if (gather_props) {
2030                 nvlist_t *hdrnv = fnvlist_alloc();
2031                 nvlist_t *fss = NULL;
2032
2033                 if (from != NULL)
2034                         fnvlist_add_string(hdrnv, "fromsnap", from);
2035                 fnvlist_add_string(hdrnv, "tosnap", tosnap);
2036                 if (!recursive)
2037                         fnvlist_add_boolean(hdrnv, "not_recursive");
2038
2039                 if (raw) {
2040                         fnvlist_add_boolean(hdrnv, "raw");
2041                 }
2042
2043                 if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2044                     from, tosnap, recursive, raw, doall, replicate, skipmissing,
2045                     verbose, backup, holds, props, &fss, fsavlp)) != 0) {
2046                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2047                             errbuf));
2048                 }
2049                 /*
2050                  * Do not allow the size of the properties list to exceed
2051                  * the limit
2052                  */
2053                 if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2054                     zhp->zfs_hdl->libzfs_max_nvlist) {
2055                         (void) snprintf(errbuf, sizeof (errbuf),
2056                             dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2057                             "the size of the list of snapshots and properties "
2058                             "is too large to be received successfully.\n"
2059                             "Select a smaller number of snapshots to send.\n"),
2060                             zhp->zfs_name);
2061                         return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2062                             errbuf));
2063                 }
2064                 fnvlist_add_nvlist(hdrnv, "fss", fss);
2065                 VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2066                     0));
2067                 if (fssp != NULL) {
2068                         *fssp = fss;
2069                 } else {
2070                         fnvlist_free(fss);
2071                 }
2072                 fnvlist_free(hdrnv);
2073         }
2074
2075         if (!dryrun) {
2076                 dmu_replay_record_t drr = { 0 };
2077                 /* write first begin record */
2078                 drr.drr_type = DRR_BEGIN;
2079                 drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2080                 DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2081                     drr_versioninfo, DMU_COMPOUNDSTREAM);
2082                 DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2083                     drr_versioninfo, featureflags);
2084                 if (snprintf(drr.drr_u.drr_begin.drr_toname,
2085                     sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2086                     tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2087                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2088                             errbuf));
2089                 }
2090                 drr.drr_payloadlen = buflen;
2091
2092                 err = dump_record(&drr, packbuf, buflen, &zc, fd);
2093                 free(packbuf);
2094                 if (err != 0) {
2095                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2096                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2097                             errbuf));
2098                 }
2099                 err = send_conclusion_record(fd, &zc);
2100                 if (err != 0) {
2101                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2102                         return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2103                             errbuf));
2104                 }
2105         }
2106         return (0);
2107 }
2108
2109 /*
2110  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2111  * that contains the snapshot to send.  The "fromsnap" argument is the
2112  * short name (the part after the '@') of the snapshot that is the
2113  * incremental source to send from (if non-NULL).  The "tosnap" argument
2114  * is the short name of the snapshot to send.
2115  *
2116  * The content of the send stream is the snapshot identified by
2117  * 'tosnap'.  Incremental streams are requested in two ways:
2118  *     - from the snapshot identified by "fromsnap" (if non-null) or
2119  *     - from the origin of the dataset identified by zhp, which must
2120  *       be a clone.  In this case, "fromsnap" is null and "fromorigin"
2121  *       is TRUE.
2122  *
2123  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2124  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2125  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2126  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2127  * case too. If "props" is set, send properties.
2128  */
2129 int
2130 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2131     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2132     void *cb_arg, nvlist_t **debugnvp)
2133 {
2134         char errbuf[1024];
2135         send_dump_data_t sdd = { 0 };
2136         int err = 0;
2137         nvlist_t *fss = NULL;
2138         avl_tree_t *fsavl = NULL;
2139         static uint64_t holdseq;
2140         int spa_version;
2141         FILE *fout;
2142
2143         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2144             "cannot send '%s'"), zhp->zfs_name);
2145
2146         if (fromsnap && fromsnap[0] == '\0') {
2147                 zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2148                     "zero-length incremental source"));
2149                 return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2150         }
2151
2152         if (fromsnap) {
2153                 char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2154                 if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2155                     "%s@%s", zhp->zfs_name, fromsnap) >=
2156                     sizeof (full_fromsnap_name)) {
2157                         err = EINVAL;
2158                         goto stderr_out;
2159                 }
2160                 zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2161                     full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2162                 if (fromsnapn == NULL) {
2163                         err = -1;
2164                         goto err_out;
2165                 }
2166                 zfs_close(fromsnapn);
2167         }
2168
2169         if (flags->replicate || flags->doall || flags->props ||
2170             flags->holds || flags->backup) {
2171                 char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2172                 if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2173                     "%s@%s", zhp->zfs_name, tosnap) >=
2174                     sizeof (full_tosnap_name)) {
2175                         err = EINVAL;
2176                         goto stderr_out;
2177                 }
2178                 zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2179                     full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2180                 if (tosnap == NULL) {
2181                         err = -1;
2182                         goto err_out;
2183                 }
2184                 err = send_prelim_records(tosnap, fromsnap, outfd,
2185                     flags->replicate || flags->props || flags->holds,
2186                     flags->replicate, flags->verbosity > 0, flags->dryrun,
2187                     flags->raw, flags->replicate, flags->skipmissing,
2188                     flags->backup, flags->holds, flags->props, flags->doall,
2189                     &fss, &fsavl);
2190                 zfs_close(tosnap);
2191                 if (err != 0)
2192                         goto err_out;
2193         }
2194
2195         /* dump each stream */
2196         sdd.fromsnap = fromsnap;
2197         sdd.tosnap = tosnap;
2198         sdd.outfd = outfd;
2199         sdd.replicate = flags->replicate;
2200         sdd.doall = flags->doall;
2201         sdd.fromorigin = flags->fromorigin;
2202         sdd.fss = fss;
2203         sdd.fsavl = fsavl;
2204         sdd.verbosity = flags->verbosity;
2205         sdd.parsable = flags->parsable;
2206         sdd.progress = flags->progress;
2207         sdd.dryrun = flags->dryrun;
2208         sdd.large_block = flags->largeblock;
2209         sdd.embed_data = flags->embed_data;
2210         sdd.compress = flags->compress;
2211         sdd.raw = flags->raw;
2212         sdd.holds = flags->holds;
2213         sdd.filter_cb = filter_func;
2214         sdd.filter_cb_arg = cb_arg;
2215         if (debugnvp)
2216                 sdd.debugnv = *debugnvp;
2217         if (sdd.verbosity != 0 && sdd.dryrun)
2218                 sdd.std_out = B_TRUE;
2219         fout = sdd.std_out ? stdout : stderr;
2220
2221         /*
2222          * Some flags require that we place user holds on the datasets that are
2223          * being sent so they don't get destroyed during the send. We can skip
2224          * this step if the pool is imported read-only since the datasets cannot
2225          * be destroyed.
2226          */
2227         if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2228             ZPOOL_PROP_READONLY, NULL) &&
2229             zfs_spa_version(zhp, &spa_version) == 0 &&
2230             spa_version >= SPA_VERSION_USERREFS &&
2231             (flags->doall || flags->replicate)) {
2232                 ++holdseq;
2233                 (void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2234                     ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2235                 sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2236                 if (sdd.cleanup_fd < 0) {
2237                         err = errno;
2238                         goto stderr_out;
2239                 }
2240                 sdd.snapholds = fnvlist_alloc();
2241         } else {
2242                 sdd.cleanup_fd = -1;
2243                 sdd.snapholds = NULL;
2244         }
2245
2246         if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2247                 /*
2248                  * Do a verbose no-op dry run to get all the verbose output
2249                  * or to gather snapshot hold's before generating any data,
2250                  * then do a non-verbose real run to generate the streams.
2251                  */
2252                 sdd.dryrun = B_TRUE;
2253                 err = dump_filesystems(zhp, &sdd);
2254
2255                 if (err != 0)
2256                         goto stderr_out;
2257
2258                 if (flags->verbosity != 0) {
2259                         if (flags->parsable) {
2260                                 (void) fprintf(fout, "size\t%llu\n",
2261                                     (longlong_t)sdd.size);
2262                         } else {
2263                                 char buf[16];
2264                                 zfs_nicebytes(sdd.size, buf, sizeof (buf));
2265                                 (void) fprintf(fout, dgettext(TEXT_DOMAIN,
2266                                     "total estimated size is %s\n"), buf);
2267                         }
2268                 }
2269
2270                 /* Ensure no snaps found is treated as an error. */
2271                 if (!sdd.seento) {
2272                         err = ENOENT;
2273                         goto err_out;
2274                 }
2275
2276                 /* Skip the second run if dryrun was requested. */
2277                 if (flags->dryrun)
2278                         goto err_out;
2279
2280                 if (sdd.snapholds != NULL) {
2281                         err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2282                         if (err != 0)
2283                                 goto stderr_out;
2284
2285                         fnvlist_free(sdd.snapholds);
2286                         sdd.snapholds = NULL;
2287                 }
2288
2289                 sdd.dryrun = B_FALSE;
2290                 sdd.verbosity = 0;
2291         }
2292
2293         err = dump_filesystems(zhp, &sdd);
2294         fsavl_destroy(fsavl);
2295         fnvlist_free(fss);
2296
2297         /* Ensure no snaps found is treated as an error. */
2298         if (err == 0 && !sdd.seento)
2299                 err = ENOENT;
2300
2301         if (sdd.cleanup_fd != -1) {
2302                 VERIFY(0 == close(sdd.cleanup_fd));
2303                 sdd.cleanup_fd = -1;
2304         }
2305
2306         if (!flags->dryrun && (flags->replicate || flags->doall ||
2307             flags->props || flags->backup || flags->holds)) {
2308                 /*
2309                  * write final end record.  NB: want to do this even if
2310                  * there was some error, because it might not be totally
2311                  * failed.
2312                  */
2313                 err = send_conclusion_record(outfd, NULL);
2314                 if (err != 0)
2315                         return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
2316         }
2317
2318         return (err || sdd.err);
2319
2320 stderr_out:
2321         err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2322 err_out:
2323         fsavl_destroy(fsavl);
2324         fnvlist_free(fss);
2325         fnvlist_free(sdd.snapholds);
2326
2327         if (sdd.cleanup_fd != -1)
2328                 VERIFY(0 == close(sdd.cleanup_fd));
2329         return (err);
2330 }
2331
2332 static zfs_handle_t *
2333 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2334 {
2335         char dirname[ZFS_MAX_DATASET_NAME_LEN];
2336         (void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2337         char *c = strchr(dirname, '@');
2338         if (c != NULL)
2339                 *c = '\0';
2340         return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2341 }
2342
2343 /*
2344  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2345  * an earlier snapshot in the same filesystem, or a snapshot before later's
2346  * origin, or it's origin's origin, etc.
2347  */
2348 static boolean_t
2349 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2350 {
2351         boolean_t ret;
2352         uint64_t later_txg =
2353             (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2354             later->zfs_type == ZFS_TYPE_VOLUME ?
2355             UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2356         uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2357
2358         if (earlier_txg >= later_txg)
2359                 return (B_FALSE);
2360
2361         zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2362             earlier->zfs_name);
2363         zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2364             later->zfs_name);
2365
2366         if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2367                 zfs_close(earlier_dir);
2368                 zfs_close(later_dir);
2369                 return (B_TRUE);
2370         }
2371
2372         char clonename[ZFS_MAX_DATASET_NAME_LEN];
2373         if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2374             ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2375                 zfs_close(earlier_dir);
2376                 zfs_close(later_dir);
2377                 return (B_FALSE);
2378         }
2379
2380         zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2381             ZFS_TYPE_DATASET);
2382         uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2383
2384         /*
2385          * If "earlier" is exactly the origin, then
2386          * snapshot_is_before(earlier, origin) will return false (because
2387          * they're the same).
2388          */
2389         if (origin_txg == earlier_txg &&
2390             strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2391                 zfs_close(earlier_dir);
2392                 zfs_close(later_dir);
2393                 zfs_close(origin);
2394                 return (B_TRUE);
2395         }
2396         zfs_close(earlier_dir);
2397         zfs_close(later_dir);
2398
2399         ret = snapshot_is_before(earlier, origin);
2400         zfs_close(origin);
2401         return (ret);
2402 }
2403
2404 /*
2405  * The "zhp" argument is the handle of the dataset to send (typically a
2406  * snapshot).  The "from" argument is the full name of the snapshot or
2407  * bookmark that is the incremental source.
2408  */
2409 int
2410 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2411     const char *redactbook)
2412 {
2413         int err;
2414         libzfs_handle_t *hdl = zhp->zfs_hdl;
2415         char *name = zhp->zfs_name;
2416         pthread_t ptid;
2417         progress_arg_t pa = { 0 };
2418
2419         char errbuf[1024];
2420         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2421             "warning: cannot send '%s'"), name);
2422
2423         if (from != NULL && strchr(from, '@')) {
2424                 zfs_handle_t *from_zhp = zfs_open(hdl, from,
2425                     ZFS_TYPE_DATASET);
2426                 if (from_zhp == NULL)
2427                         return (-1);
2428                 if (!snapshot_is_before(from_zhp, zhp)) {
2429                         zfs_close(from_zhp);
2430                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2431                             "not an earlier snapshot from the same fs"));
2432                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2433                 }
2434                 zfs_close(from_zhp);
2435         }
2436
2437         if (redactbook != NULL) {
2438                 char bookname[ZFS_MAX_DATASET_NAME_LEN];
2439                 nvlist_t *redact_snaps;
2440                 zfs_handle_t *book_zhp;
2441                 char *at, *pound;
2442                 int dsnamelen;
2443
2444                 pound = strchr(redactbook, '#');
2445                 if (pound != NULL)
2446                         redactbook = pound + 1;
2447                 at = strchr(name, '@');
2448                 if (at == NULL) {
2449                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2450                             "cannot do a redacted send to a filesystem"));
2451                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2452                 }
2453                 dsnamelen = at - name;
2454                 if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2455                     dsnamelen, name, redactbook)
2456                     >= sizeof (bookname)) {
2457                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2458                             "invalid bookmark name"));
2459                         return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2460                 }
2461                 book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2462                 if (book_zhp == NULL)
2463                         return (-1);
2464                 if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2465                     zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2466                     &redact_snaps) != 0 || redact_snaps == NULL) {
2467                         zfs_close(book_zhp);
2468                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2469                             "not a redaction bookmark"));
2470                         return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2471                 }
2472                 zfs_close(book_zhp);
2473         }
2474
2475         /*
2476          * Send fs properties
2477          */
2478         if (flags->props || flags->holds || flags->backup) {
2479                 /*
2480                  * Note: the header generated by send_prelim_records()
2481                  * assumes that the incremental source is in the same
2482                  * filesystem/volume as the target (which is a requirement
2483                  * when doing "zfs send -R").  But that isn't always the
2484                  * case here (e.g. send from snap in origin, or send from
2485                  * bookmark).  We pass from=NULL, which will omit this
2486                  * information from the prelim records; it isn't used
2487                  * when receiving this type of stream.
2488                  */
2489                 err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2490                     flags->verbosity > 0, flags->dryrun, flags->raw,
2491                     flags->replicate, B_FALSE, flags->backup, flags->holds,
2492                     flags->props, flags->doall, NULL, NULL);
2493                 if (err != 0)
2494                         return (err);
2495         }
2496
2497         /*
2498          * Perform size estimate if verbose was specified.
2499          */
2500         if (flags->verbosity != 0) {
2501                 err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2502                     errbuf);
2503                 if (err != 0)
2504                         return (err);
2505         }
2506
2507         if (flags->dryrun)
2508                 return (0);
2509
2510         /*
2511          * If progress reporting is requested, spawn a new thread to poll
2512          * ZFS_IOC_SEND_PROGRESS at a regular interval.
2513          */
2514         if (flags->progress) {
2515                 pa.pa_zhp = zhp;
2516                 pa.pa_fd = fd;
2517                 pa.pa_parsable = flags->parsable;
2518                 pa.pa_estimate = B_FALSE;
2519                 pa.pa_verbosity = flags->verbosity;
2520
2521                 err = pthread_create(&ptid, NULL,
2522                     send_progress_thread, &pa);
2523                 if (err != 0) {
2524                         zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2525                         return (zfs_error(zhp->zfs_hdl,
2526                             EZFS_THREADCREATEFAILED, errbuf));
2527                 }
2528         }
2529
2530         err = lzc_send_redacted(name, from, fd,
2531             lzc_flags_from_sendflags(flags), redactbook);
2532
2533         if (flags->progress) {
2534                 void *status = NULL;
2535                 if (err != 0)
2536                         (void) pthread_cancel(ptid);
2537                 (void) pthread_join(ptid, &status);
2538                 int error = (int)(uintptr_t)status;
2539                 if (error != 0 && status != PTHREAD_CANCELED)
2540                         return (zfs_standard_error_fmt(hdl, error,
2541                             dgettext(TEXT_DOMAIN,
2542                             "progress thread exited nonzero")));
2543         }
2544
2545         if (flags->props || flags->holds || flags->backup) {
2546                 /* Write the final end record. */
2547                 err = send_conclusion_record(fd, NULL);
2548                 if (err != 0)
2549                         return (zfs_standard_error(hdl, err, errbuf));
2550         }
2551         if (err != 0) {
2552                 switch (errno) {
2553                 case EXDEV:
2554                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2555                             "not an earlier snapshot from the same fs"));
2556                         return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2557
2558                 case ENOENT:
2559                 case ESRCH:
2560                         if (lzc_exists(name)) {
2561                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2562                                     "incremental source (%s) does not exist"),
2563                                     from);
2564                         }
2565                         return (zfs_error(hdl, EZFS_NOENT, errbuf));
2566
2567                 case EACCES:
2568                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2569                             "dataset key must be loaded"));
2570                         return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2571
2572                 case EBUSY:
2573                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2574                             "target is busy; if a filesystem, "
2575                             "it must not be mounted"));
2576                         return (zfs_error(hdl, EZFS_BUSY, errbuf));
2577
2578                 case EDQUOT:
2579                 case EFAULT:
2580                 case EFBIG:
2581                 case EINVAL:
2582                 case EIO:
2583                 case ENOLINK:
2584                 case ENOSPC:
2585                 case ENOSTR:
2586                 case ENXIO:
2587                 case EPIPE:
2588                 case ERANGE:
2589                 case EROFS:
2590                         zfs_error_aux(hdl, "%s", strerror(errno));
2591                         return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2592
2593                 default:
2594                         return (zfs_standard_error(hdl, errno, errbuf));
2595                 }
2596         }
2597         return (err != 0);
2598 }
2599
2600 /*
2601  * Routines specific to "zfs recv"
2602  */
2603
2604 static int
2605 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2606     boolean_t byteswap, zio_cksum_t *zc)
2607 {
2608         char *cp = buf;
2609         int rv;
2610         int len = ilen;
2611
2612         do {
2613                 rv = read(fd, cp, len);
2614                 cp += rv;
2615                 len -= rv;
2616         } while (rv > 0);
2617
2618         if (rv < 0 || len != 0) {
2619                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2620                     "failed to read from stream"));
2621                 return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2622                     "cannot receive")));
2623         }
2624
2625         if (zc) {
2626                 if (byteswap)
2627                         fletcher_4_incremental_byteswap(buf, ilen, zc);
2628                 else
2629                         fletcher_4_incremental_native(buf, ilen, zc);
2630         }
2631         return (0);
2632 }
2633
2634 static int
2635 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2636     boolean_t byteswap, zio_cksum_t *zc)
2637 {
2638         char *buf;
2639         int err;
2640
2641         buf = zfs_alloc(hdl, len);
2642         if (buf == NULL)
2643                 return (ENOMEM);
2644
2645         if (len > hdl->libzfs_max_nvlist) {
2646                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2647                 free(buf);
2648                 return (ENOMEM);
2649         }
2650
2651         err = recv_read(hdl, fd, buf, len, byteswap, zc);
2652         if (err != 0) {
2653                 free(buf);
2654                 return (err);
2655         }
2656
2657         err = nvlist_unpack(buf, len, nvp, 0);
2658         free(buf);
2659         if (err != 0) {
2660                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2661                     "stream (malformed nvlist)"));
2662                 return (EINVAL);
2663         }
2664         return (0);
2665 }
2666
2667 /*
2668  * Returns the grand origin (origin of origin of origin...) of a given handle.
2669  * If this dataset is not a clone, it simply returns a copy of the original
2670  * handle.
2671  */
2672 static zfs_handle_t *
2673 recv_open_grand_origin(zfs_handle_t *zhp)
2674 {
2675         char origin[ZFS_MAX_DATASET_NAME_LEN];
2676         zprop_source_t src;
2677         zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2678
2679         while (ozhp != NULL) {
2680                 if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2681                     sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2682                         break;
2683
2684                 (void) zfs_close(ozhp);
2685                 ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2686         }
2687
2688         return (ozhp);
2689 }
2690
2691 static int
2692 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2693 {
2694         int err;
2695         zfs_handle_t *ozhp = NULL;
2696
2697         /*
2698          * Attempt to rename the dataset. If it fails with EACCES we have
2699          * attempted to rename the dataset outside of its encryption root.
2700          * Force the dataset to become an encryption root and try again.
2701          */
2702         err = lzc_rename(name, newname);
2703         if (err == EACCES) {
2704                 ozhp = recv_open_grand_origin(zhp);
2705                 if (ozhp == NULL) {
2706                         err = ENOENT;
2707                         goto out;
2708                 }
2709
2710                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2711                     NULL, NULL, 0);
2712                 if (err != 0)
2713                         goto out;
2714
2715                 err = lzc_rename(name, newname);
2716         }
2717
2718 out:
2719         if (ozhp != NULL)
2720                 zfs_close(ozhp);
2721         return (err);
2722 }
2723
2724 static int
2725 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2726     int baselen, char *newname, recvflags_t *flags)
2727 {
2728         static int seq;
2729         int err;
2730         prop_changelist_t *clp = NULL;
2731         zfs_handle_t *zhp = NULL;
2732
2733         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2734         if (zhp == NULL) {
2735                 err = -1;
2736                 goto out;
2737         }
2738         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2739             flags->force ? MS_FORCE : 0);
2740         if (clp == NULL) {
2741                 err = -1;
2742                 goto out;
2743         }
2744         err = changelist_prefix(clp);
2745         if (err)
2746                 goto out;
2747
2748         if (tryname) {
2749                 (void) strcpy(newname, tryname);
2750                 if (flags->verbose) {
2751                         (void) printf("attempting rename %s to %s\n",
2752                             name, newname);
2753                 }
2754                 err = recv_rename_impl(zhp, name, newname);
2755                 if (err == 0)
2756                         changelist_rename(clp, name, tryname);
2757         } else {
2758                 err = ENOENT;
2759         }
2760
2761         if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2762                 seq++;
2763
2764                 (void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2765                     "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2766
2767                 if (flags->verbose) {
2768                         (void) printf("failed - trying rename %s to %s\n",
2769                             name, newname);
2770                 }
2771                 err = recv_rename_impl(zhp, name, newname);
2772                 if (err == 0)
2773                         changelist_rename(clp, name, newname);
2774                 if (err && flags->verbose) {
2775                         (void) printf("failed (%u) - "
2776                             "will try again on next pass\n", errno);
2777                 }
2778                 err = EAGAIN;
2779         } else if (flags->verbose) {
2780                 if (err == 0)
2781                         (void) printf("success\n");
2782                 else
2783                         (void) printf("failed (%u)\n", errno);
2784         }
2785
2786         (void) changelist_postfix(clp);
2787
2788 out:
2789         if (clp != NULL)
2790                 changelist_free(clp);
2791         if (zhp != NULL)
2792                 zfs_close(zhp);
2793
2794         return (err);
2795 }
2796
2797 static int
2798 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2799     const char *origin_fsname, recvflags_t *flags)
2800 {
2801         int err;
2802         zfs_cmd_t zc = {"\0"};
2803         zfs_handle_t *zhp = NULL, *ozhp = NULL;
2804
2805         if (flags->verbose)
2806                 (void) printf("promoting %s\n", fsname);
2807
2808         (void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2809         (void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2810
2811         /*
2812          * Attempt to promote the dataset. If it fails with EACCES the
2813          * promotion would cause this dataset to leave its encryption root.
2814          * Force the origin to become an encryption root and try again.
2815          */
2816         err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2817         if (err == EACCES) {
2818                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2819                 if (zhp == NULL) {
2820                         err = -1;
2821                         goto out;
2822                 }
2823
2824                 ozhp = recv_open_grand_origin(zhp);
2825                 if (ozhp == NULL) {
2826                         err = -1;
2827                         goto out;
2828                 }
2829
2830                 err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2831                     NULL, NULL, 0);
2832                 if (err != 0)
2833                         goto out;
2834
2835                 err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2836         }
2837
2838 out:
2839         if (zhp != NULL)
2840                 zfs_close(zhp);
2841         if (ozhp != NULL)
2842                 zfs_close(ozhp);
2843
2844         return (err);
2845 }
2846
2847 static int
2848 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2849     char *newname, recvflags_t *flags)
2850 {
2851         int err = 0;
2852         prop_changelist_t *clp;
2853         zfs_handle_t *zhp;
2854         boolean_t defer = B_FALSE;
2855         int spa_version;
2856
2857         zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2858         if (zhp == NULL)
2859                 return (-1);
2860         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2861             flags->force ? MS_FORCE : 0);
2862         if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT &&
2863             zfs_spa_version(zhp, &spa_version) == 0 &&
2864             spa_version >= SPA_VERSION_USERREFS)
2865                 defer = B_TRUE;
2866         zfs_close(zhp);
2867         if (clp == NULL)
2868                 return (-1);
2869         err = changelist_prefix(clp);
2870         if (err)
2871                 return (err);
2872
2873         if (flags->verbose)
2874                 (void) printf("attempting destroy %s\n", name);
2875         if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
2876                 nvlist_t *nv = fnvlist_alloc();
2877                 fnvlist_add_boolean(nv, name);
2878                 err = lzc_destroy_snaps(nv, defer, NULL);
2879                 fnvlist_free(nv);
2880         } else {
2881                 err = lzc_destroy(name);
2882         }
2883         if (err == 0) {
2884                 if (flags->verbose)
2885                         (void) printf("success\n");
2886                 changelist_remove(clp, name);
2887         }
2888
2889         (void) changelist_postfix(clp);
2890         changelist_free(clp);
2891
2892         /*
2893          * Deferred destroy might destroy the snapshot or only mark it to be
2894          * destroyed later, and it returns success in either case.
2895          */
2896         if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
2897             ZFS_TYPE_SNAPSHOT))) {
2898                 err = recv_rename(hdl, name, NULL, baselen, newname, flags);
2899         }
2900
2901         return (err);
2902 }
2903
2904 typedef struct guid_to_name_data {
2905         uint64_t guid;
2906         boolean_t bookmark_ok;
2907         char *name;
2908         char *skip;
2909         uint64_t *redact_snap_guids;
2910         uint64_t num_redact_snaps;
2911 } guid_to_name_data_t;
2912
2913 static boolean_t
2914 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
2915 {
2916         uint64_t *bmark_snaps;
2917         uint_t bmark_num_snaps;
2918         nvlist_t *nvl;
2919         if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
2920                 return (B_FALSE);
2921
2922         nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
2923             zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
2924         bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
2925             &bmark_num_snaps);
2926         if (bmark_num_snaps != gtnd->num_redact_snaps)
2927                 return (B_FALSE);
2928         int i = 0;
2929         for (; i < bmark_num_snaps; i++) {
2930                 int j = 0;
2931                 for (; j < bmark_num_snaps; j++) {
2932                         if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
2933                                 break;
2934                 }
2935                 if (j == bmark_num_snaps)
2936                         break;
2937         }
2938         return (i == bmark_num_snaps);
2939 }
2940
2941 static int
2942 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
2943 {
2944         guid_to_name_data_t *gtnd = arg;
2945         const char *slash;
2946         int err;
2947
2948         if (gtnd->skip != NULL &&
2949             (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
2950             strcmp(slash + 1, gtnd->skip) == 0) {
2951                 zfs_close(zhp);
2952                 return (0);
2953         }
2954
2955         if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
2956             (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
2957                 (void) strcpy(gtnd->name, zhp->zfs_name);
2958                 zfs_close(zhp);
2959                 return (EEXIST);
2960         }
2961
2962         err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
2963         if (err != EEXIST && gtnd->bookmark_ok)
2964                 err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
2965         zfs_close(zhp);
2966         return (err);
2967 }
2968
2969 /*
2970  * Attempt to find the local dataset associated with this guid.  In the case of
2971  * multiple matches, we attempt to find the "best" match by searching
2972  * progressively larger portions of the hierarchy.  This allows one to send a
2973  * tree of datasets individually and guarantee that we will find the source
2974  * guid within that hierarchy, even if there are multiple matches elsewhere.
2975  *
2976  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
2977  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
2978  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
2979  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
2980  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
2981  * given guid.  Note that a redaction bookmark can be returned if
2982  * num_redact_snaps == -1.
2983  */
2984 static int
2985 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
2986     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
2987     uint64_t num_redact_snaps, char *name)
2988 {
2989         char pname[ZFS_MAX_DATASET_NAME_LEN];
2990         guid_to_name_data_t gtnd;
2991
2992         gtnd.guid = guid;
2993         gtnd.bookmark_ok = bookmark_ok;
2994         gtnd.name = name;
2995         gtnd.skip = NULL;
2996         gtnd.redact_snap_guids = redact_snap_guids;
2997         gtnd.num_redact_snaps = num_redact_snaps;
2998
2999         /*
3000          * Search progressively larger portions of the hierarchy, starting
3001          * with the filesystem specified by 'parent'.  This will
3002          * select the "most local" version of the origin snapshot in the case
3003          * that there are multiple matching snapshots in the system.
3004          */
3005         (void) strlcpy(pname, parent, sizeof (pname));
3006         char *cp = strrchr(pname, '@');
3007         if (cp == NULL)
3008                 cp = strchr(pname, '\0');
3009         for (; cp != NULL; cp = strrchr(pname, '/')) {
3010                 /* Chop off the last component and open the parent */
3011                 *cp = '\0';
3012                 zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3013
3014                 if (zhp == NULL)
3015                         continue;
3016                 int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3017                 if (err != EEXIST)
3018                         err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3019                 if (err != EEXIST && bookmark_ok)
3020                         err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3021                 zfs_close(zhp);
3022                 if (err == EEXIST)
3023                         return (0);
3024
3025                 /*
3026                  * Remember the last portion of the dataset so we skip it next
3027                  * time through (as we've already searched that portion of the
3028                  * hierarchy).
3029                  */
3030                 gtnd.skip = strrchr(pname, '/') + 1;
3031         }
3032
3033         return (ENOENT);
3034 }
3035
3036 static int
3037 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3038     boolean_t bookmark_ok, char *name)
3039 {
3040         return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3041             -1, name));
3042 }
3043
3044 /*
3045  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3046  * guid1 is after guid2.
3047  */
3048 static int
3049 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3050     uint64_t guid1, uint64_t guid2)
3051 {
3052         nvlist_t *nvfs;
3053         char *fsname = NULL, *snapname = NULL;
3054         char buf[ZFS_MAX_DATASET_NAME_LEN];
3055         int rv;
3056         zfs_handle_t *guid1hdl, *guid2hdl;
3057         uint64_t create1, create2;
3058
3059         if (guid2 == 0)
3060                 return (0);
3061         if (guid1 == 0)
3062                 return (1);
3063
3064         nvfs = fsavl_find(avl, guid1, &snapname);
3065         fsname = fnvlist_lookup_string(nvfs, "name");
3066         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3067         guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3068         if (guid1hdl == NULL)
3069                 return (-1);
3070
3071         nvfs = fsavl_find(avl, guid2, &snapname);
3072         fsname = fnvlist_lookup_string(nvfs, "name");
3073         (void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3074         guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3075         if (guid2hdl == NULL) {
3076                 zfs_close(guid1hdl);
3077                 return (-1);
3078         }
3079
3080         create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3081         create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3082
3083         if (create1 < create2)
3084                 rv = -1;
3085         else if (create1 > create2)
3086                 rv = +1;
3087         else
3088                 rv = 0;
3089
3090         zfs_close(guid1hdl);
3091         zfs_close(guid2hdl);
3092
3093         return (rv);
3094 }
3095
3096 /*
3097  * This function reestablishes the hierarchy of encryption roots after a
3098  * recursive incremental receive has completed. This must be done after the
3099  * second call to recv_incremental_replication() has renamed and promoted all
3100  * sent datasets to their final locations in the dataset hierarchy.
3101  */
3102 static int
3103 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3104     nvlist_t *stream_nv, avl_tree_t *stream_avl)
3105 {
3106         int err;
3107         nvpair_t *fselem = NULL;
3108         nvlist_t *stream_fss;
3109
3110         stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3111
3112         while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3113                 zfs_handle_t *zhp = NULL;
3114                 uint64_t crypt;
3115                 nvlist_t *snaps, *props, *stream_nvfs = NULL;
3116                 nvpair_t *snapel = NULL;
3117                 boolean_t is_encroot, is_clone, stream_encroot;
3118                 char *cp;
3119                 char *stream_keylocation = NULL;
3120                 char keylocation[MAXNAMELEN];
3121                 char fsname[ZFS_MAX_DATASET_NAME_LEN];
3122
3123                 keylocation[0] = '\0';
3124                 stream_nvfs = fnvpair_value_nvlist(fselem);
3125                 snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3126                 props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3127                 stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3128
3129                 /* find a snapshot from the stream that exists locally */
3130                 err = ENOENT;
3131                 while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3132                         uint64_t guid;
3133
3134                         guid = fnvpair_value_uint64(snapel);
3135                         err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3136                             fsname);
3137                         if (err == 0)
3138                                 break;
3139                 }
3140
3141                 if (err != 0)
3142                         continue;
3143
3144                 cp = strchr(fsname, '@');
3145                 if (cp != NULL)
3146                         *cp = '\0';
3147
3148                 zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3149                 if (zhp == NULL) {
3150                         err = ENOENT;
3151                         goto error;
3152                 }
3153
3154                 crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3155                 is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3156                 (void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3157
3158                 /* we don't need to do anything for unencrypted datasets */
3159                 if (crypt == ZIO_CRYPT_OFF) {
3160                         zfs_close(zhp);
3161                         continue;
3162                 }
3163
3164                 /*
3165                  * If the dataset is flagged as an encryption root, was not
3166                  * received as a clone and is not currently an encryption root,
3167                  * force it to become one. Fixup the keylocation if necessary.
3168                  */
3169                 if (stream_encroot) {
3170                         if (!is_clone && !is_encroot) {
3171                                 err = lzc_change_key(fsname,
3172                                     DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3173                                 if (err != 0) {
3174                                         zfs_close(zhp);
3175                                         goto error;
3176                                 }
3177                         }
3178
3179                         stream_keylocation = fnvlist_lookup_string(props,
3180                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3181
3182                         /*
3183                          * Refresh the properties in case the call to
3184                          * lzc_change_key() changed the value.
3185                          */
3186                         zfs_refresh_properties(zhp);
3187                         err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3188                             keylocation, sizeof (keylocation), NULL, NULL,
3189                             0, B_TRUE);
3190                         if (err != 0) {
3191                                 zfs_close(zhp);
3192                                 goto error;
3193                         }
3194
3195                         if (strcmp(keylocation, stream_keylocation) != 0) {
3196                                 err = zfs_prop_set(zhp,
3197                                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3198                                     stream_keylocation);
3199                                 if (err != 0) {
3200                                         zfs_close(zhp);
3201                                         goto error;
3202                                 }
3203                         }
3204                 }
3205
3206                 /*
3207                  * If the dataset is not flagged as an encryption root and is
3208                  * currently an encryption root, force it to inherit from its
3209                  * parent. The root of a raw send should never be
3210                  * force-inherited.
3211                  */
3212                 if (!stream_encroot && is_encroot &&
3213                     strcmp(top_zfs, fsname) != 0) {
3214                         err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3215                             NULL, NULL, 0);
3216                         if (err != 0) {
3217                                 zfs_close(zhp);
3218                                 goto error;
3219                         }
3220                 }
3221
3222                 zfs_close(zhp);
3223         }
3224
3225         return (0);
3226
3227 error:
3228         return (err);
3229 }
3230
3231 static int
3232 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3233     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3234     nvlist_t *renamed)
3235 {
3236         nvlist_t *local_nv, *deleted = NULL;
3237         avl_tree_t *local_avl;
3238         nvpair_t *fselem, *nextfselem;
3239         char *fromsnap;
3240         char newname[ZFS_MAX_DATASET_NAME_LEN];
3241         char guidname[32];
3242         int error;
3243         boolean_t needagain, progress, recursive;
3244         char *s1, *s2;
3245
3246         fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3247
3248         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3249             ENOENT);
3250
3251         if (flags->dryrun)
3252                 return (0);
3253
3254 again:
3255         needagain = progress = B_FALSE;
3256
3257         deleted = fnvlist_alloc();
3258
3259         if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3260             recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3261             B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3262                 return (error);
3263
3264         /*
3265          * Process deletes and renames
3266          */
3267         for (fselem = nvlist_next_nvpair(local_nv, NULL);
3268             fselem; fselem = nextfselem) {
3269                 nvlist_t *nvfs, *snaps;
3270                 nvlist_t *stream_nvfs = NULL;
3271                 nvpair_t *snapelem, *nextsnapelem;
3272                 uint64_t fromguid = 0;
3273                 uint64_t originguid = 0;
3274                 uint64_t stream_originguid = 0;
3275                 uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3276                 char *fsname, *stream_fsname;
3277
3278                 nextfselem = nvlist_next_nvpair(local_nv, fselem);
3279
3280                 nvfs = fnvpair_value_nvlist(fselem);
3281                 snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3282                 fsname = fnvlist_lookup_string(nvfs, "name");
3283                 parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3284                     "parentfromsnap");
3285                 (void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3286
3287                 /*
3288                  * First find the stream's fs, so we can check for
3289                  * a different origin (due to "zfs promote")
3290                  */
3291                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3292                     snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3293                         uint64_t thisguid;
3294
3295                         thisguid = fnvpair_value_uint64(snapelem);
3296                         stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3297
3298                         if (stream_nvfs != NULL)
3299                                 break;
3300                 }
3301
3302                 /* check for promote */
3303                 (void) nvlist_lookup_uint64(stream_nvfs, "origin",
3304                     &stream_originguid);
3305                 if (stream_nvfs && originguid != stream_originguid) {
3306                         switch (created_before(hdl, local_avl,
3307                             stream_originguid, originguid)) {
3308                         case 1: {
3309                                 /* promote it! */
3310                                 nvlist_t *origin_nvfs;
3311                                 char *origin_fsname;
3312
3313                                 origin_nvfs = fsavl_find(local_avl, originguid,
3314                                     NULL);
3315                                 origin_fsname = fnvlist_lookup_string(
3316                                     origin_nvfs, "name");
3317                                 error = recv_promote(hdl, fsname, origin_fsname,
3318                                     flags);
3319                                 if (error == 0)
3320                                         progress = B_TRUE;
3321                                 break;
3322                         }
3323                         default:
3324                                 break;
3325                         case -1:
3326                                 fsavl_destroy(local_avl);
3327                                 fnvlist_free(local_nv);
3328                                 return (-1);
3329                         }
3330                         /*
3331                          * We had/have the wrong origin, therefore our
3332                          * list of snapshots is wrong.  Need to handle
3333                          * them on the next pass.
3334                          */
3335                         needagain = B_TRUE;
3336                         continue;
3337                 }
3338
3339                 for (snapelem = nvlist_next_nvpair(snaps, NULL);
3340                     snapelem; snapelem = nextsnapelem) {
3341                         uint64_t thisguid;
3342                         char *stream_snapname;
3343                         nvlist_t *found, *props;
3344
3345                         nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3346
3347                         thisguid = fnvpair_value_uint64(snapelem);
3348                         found = fsavl_find(stream_avl, thisguid,
3349                             &stream_snapname);
3350
3351                         /* check for delete */
3352                         if (found == NULL) {
3353                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3354
3355                                 if (!flags->force)
3356                                         continue;
3357
3358                                 (void) snprintf(name, sizeof (name), "%s@%s",
3359                                     fsname, nvpair_name(snapelem));
3360
3361                                 error = recv_destroy(hdl, name,
3362                                     strlen(fsname)+1, newname, flags);
3363                                 if (error)
3364                                         needagain = B_TRUE;
3365                                 else
3366                                         progress = B_TRUE;
3367                                 sprintf(guidname, "%llu",
3368                                     (u_longlong_t)thisguid);
3369                                 nvlist_add_boolean(deleted, guidname);
3370                                 continue;
3371                         }
3372
3373                         stream_nvfs = found;
3374
3375                         if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3376                             &props) && 0 == nvlist_lookup_nvlist(props,
3377                             stream_snapname, &props)) {
3378                                 zfs_cmd_t zc = {"\0"};
3379
3380                                 zc.zc_cookie = B_TRUE; /* received */
3381                                 (void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3382                                     "%s@%s", fsname, nvpair_name(snapelem));
3383                                 if (zcmd_write_src_nvlist(hdl, &zc,
3384                                     props) == 0) {
3385                                         (void) zfs_ioctl(hdl,
3386                                             ZFS_IOC_SET_PROP, &zc);
3387                                         zcmd_free_nvlists(&zc);
3388                                 }
3389                         }
3390
3391                         /* check for different snapname */
3392                         if (strcmp(nvpair_name(snapelem),
3393                             stream_snapname) != 0) {
3394                                 char name[ZFS_MAX_DATASET_NAME_LEN];
3395                                 char tryname[ZFS_MAX_DATASET_NAME_LEN];
3396
3397                                 (void) snprintf(name, sizeof (name), "%s@%s",
3398                                     fsname, nvpair_name(snapelem));
3399                                 (void) snprintf(tryname, sizeof (name), "%s@%s",
3400                                     fsname, stream_snapname);
3401
3402                                 error = recv_rename(hdl, name, tryname,
3403                                     strlen(fsname)+1, newname, flags);
3404                                 if (error)
3405                                         needagain = B_TRUE;
3406                                 else
3407                                         progress = B_TRUE;
3408                         }
3409
3410                         if (strcmp(stream_snapname, fromsnap) == 0)
3411                                 fromguid = thisguid;
3412                 }
3413
3414                 /* check for delete */
3415                 if (stream_nvfs == NULL) {
3416                         if (!flags->force)
3417                                 continue;
3418
3419                         error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3420                             newname, flags);
3421                         if (error)
3422                                 needagain = B_TRUE;
3423                         else
3424                                 progress = B_TRUE;
3425                         sprintf(guidname, "%llu",
3426                             (u_longlong_t)parent_fromsnap_guid);
3427                         nvlist_add_boolean(deleted, guidname);
3428                         continue;
3429                 }
3430
3431                 if (fromguid == 0) {
3432                         if (flags->verbose) {
3433                                 (void) printf("local fs %s does not have "
3434                                     "fromsnap (%s in stream); must have "
3435                                     "been deleted locally; ignoring\n",
3436                                     fsname, fromsnap);
3437                         }
3438                         continue;
3439                 }
3440
3441                 stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3442                 stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3443                     stream_nvfs, "parentfromsnap");
3444
3445                 s1 = strrchr(fsname, '/');
3446                 s2 = strrchr(stream_fsname, '/');
3447
3448                 /*
3449                  * Check if we're going to rename based on parent guid change
3450                  * and the current parent guid was also deleted. If it was then
3451                  * rename will fail and is likely unneeded, so avoid this and
3452                  * force an early retry to determine the new
3453                  * parent_fromsnap_guid.
3454                  */
3455                 if (stream_parent_fromsnap_guid != 0 &&
3456                     parent_fromsnap_guid != 0 &&
3457                     stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3458                         sprintf(guidname, "%llu",
3459                             (u_longlong_t)parent_fromsnap_guid);
3460                         if (nvlist_exists(deleted, guidname)) {
3461                                 progress = B_TRUE;
3462                                 needagain = B_TRUE;
3463                                 goto doagain;
3464                         }
3465                 }
3466
3467                 /*
3468                  * Check for rename. If the exact receive path is specified, it
3469                  * does not count as a rename, but we still need to check the
3470                  * datasets beneath it.
3471                  */
3472                 if ((stream_parent_fromsnap_guid != 0 &&
3473                     parent_fromsnap_guid != 0 &&
3474                     stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3475                     ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3476                     (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3477                         nvlist_t *parent;
3478                         char tryname[ZFS_MAX_DATASET_NAME_LEN];
3479
3480                         parent = fsavl_find(local_avl,
3481                             stream_parent_fromsnap_guid, NULL);
3482                         /*
3483                          * NB: parent might not be found if we used the
3484                          * tosnap for stream_parent_fromsnap_guid,
3485                          * because the parent is a newly-created fs;
3486                          * we'll be able to rename it after we recv the
3487                          * new fs.
3488                          */
3489                         if (parent != NULL) {
3490                                 char *pname;
3491
3492                                 pname = fnvlist_lookup_string(parent, "name");
3493                                 (void) snprintf(tryname, sizeof (tryname),
3494                                     "%s%s", pname, strrchr(stream_fsname, '/'));
3495                         } else {
3496                                 tryname[0] = '\0';
3497                                 if (flags->verbose) {
3498                                         (void) printf("local fs %s new parent "
3499                                             "not found\n", fsname);
3500                                 }
3501                         }
3502
3503                         newname[0] = '\0';
3504
3505                         error = recv_rename(hdl, fsname, tryname,
3506                             strlen(tofs)+1, newname, flags);
3507
3508                         if (renamed != NULL && newname[0] != '\0') {
3509                                 fnvlist_add_boolean(renamed, newname);
3510                         }
3511
3512                         if (error)
3513                                 needagain = B_TRUE;
3514                         else
3515                                 progress = B_TRUE;
3516                 }
3517         }
3518
3519 doagain:
3520         fsavl_destroy(local_avl);
3521         fnvlist_free(local_nv);
3522         fnvlist_free(deleted);
3523
3524         if (needagain && progress) {
3525                 /* do another pass to fix up temporary names */
3526                 if (flags->verbose)
3527                         (void) printf("another pass:\n");
3528                 goto again;
3529         }
3530
3531         return (needagain || error != 0);
3532 }
3533
3534 static int
3535 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3536     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3537     char **top_zfs, nvlist_t *cmdprops)
3538 {
3539         nvlist_t *stream_nv = NULL;
3540         avl_tree_t *stream_avl = NULL;
3541         char *fromsnap = NULL;
3542         char *sendsnap = NULL;
3543         char *cp;
3544         char tofs[ZFS_MAX_DATASET_NAME_LEN];
3545         char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3546         char errbuf[1024];
3547         dmu_replay_record_t drre;
3548         int error;
3549         boolean_t anyerr = B_FALSE;
3550         boolean_t softerr = B_FALSE;
3551         boolean_t recursive, raw;
3552
3553         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3554             "cannot receive"));
3555
3556         assert(drr->drr_type == DRR_BEGIN);
3557         assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3558         assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3559             DMU_COMPOUNDSTREAM);
3560
3561         /*
3562          * Read in the nvlist from the stream.
3563          */
3564         if (drr->drr_payloadlen != 0) {
3565                 error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3566                     &stream_nv, flags->byteswap, zc);
3567                 if (error) {
3568                         error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3569                         goto out;
3570                 }
3571         }
3572
3573         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3574             ENOENT);
3575         raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3576
3577         if (recursive && strchr(destname, '@')) {
3578                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3579                     "cannot specify snapshot name for multi-snapshot stream"));
3580                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3581                 goto out;
3582         }
3583
3584         /*
3585          * Read in the end record and verify checksum.
3586          */
3587         if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3588             flags->byteswap, NULL)))
3589                 goto out;
3590         if (flags->byteswap) {
3591                 drre.drr_type = BSWAP_32(drre.drr_type);
3592                 drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3593                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3594                 drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3595                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3596                 drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3597                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3598                 drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3599                     BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3600         }
3601         if (drre.drr_type != DRR_END) {
3602                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3603                 goto out;
3604         }
3605         if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3606                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3607                     "incorrect header checksum"));
3608                 error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3609                 goto out;
3610         }
3611
3612         (void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3613
3614         if (drr->drr_payloadlen != 0) {
3615                 nvlist_t *stream_fss;
3616
3617                 stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3618                 if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3619                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3620                             "couldn't allocate avl tree"));
3621                         error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3622                         goto out;
3623                 }
3624
3625                 if (fromsnap != NULL && recursive) {
3626                         nvlist_t *renamed = NULL;
3627                         nvpair_t *pair = NULL;
3628
3629                         (void) strlcpy(tofs, destname, sizeof (tofs));
3630                         if (flags->isprefix) {
3631                                 struct drr_begin *drrb = &drr->drr_u.drr_begin;
3632                                 int i;
3633
3634                                 if (flags->istail) {
3635                                         cp = strrchr(drrb->drr_toname, '/');
3636                                         if (cp == NULL) {
3637                                                 (void) strlcat(tofs, "/",
3638                                                     sizeof (tofs));
3639                                                 i = 0;
3640                                         } else {
3641                                                 i = (cp - drrb->drr_toname);
3642                                         }
3643                                 } else {
3644                                         i = strcspn(drrb->drr_toname, "/@");
3645                                 }
3646                                 /* zfs_receive_one() will create_parents() */
3647                                 (void) strlcat(tofs, &drrb->drr_toname[i],
3648                                     sizeof (tofs));
3649                                 *strchr(tofs, '@') = '\0';
3650                         }
3651
3652                         if (!flags->dryrun && !flags->nomount) {
3653                                 renamed = fnvlist_alloc();
3654                         }
3655
3656                         softerr = recv_incremental_replication(hdl, tofs, flags,
3657                             stream_nv, stream_avl, renamed);
3658
3659                         /* Unmount renamed filesystems before receiving. */
3660                         while ((pair = nvlist_next_nvpair(renamed,
3661                             pair)) != NULL) {
3662                                 zfs_handle_t *zhp;
3663                                 prop_changelist_t *clp = NULL;
3664
3665                                 zhp = zfs_open(hdl, nvpair_name(pair),
3666                                     ZFS_TYPE_FILESYSTEM);
3667                                 if (zhp != NULL) {
3668                                         clp = changelist_gather(zhp,
3669                                             ZFS_PROP_MOUNTPOINT, 0,
3670                                             flags->forceunmount ? MS_FORCE : 0);
3671                                         zfs_close(zhp);
3672                                         if (clp != NULL) {
3673                                                 softerr |=
3674                                                     changelist_prefix(clp);
3675                                                 changelist_free(clp);
3676                                         }
3677                                 }
3678                         }
3679
3680                         fnvlist_free(renamed);
3681                 }
3682         }
3683
3684         /*
3685          * Get the fs specified by the first path in the stream (the top level
3686          * specified by 'zfs send') and pass it to each invocation of
3687          * zfs_receive_one().
3688          */
3689         (void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3690             sizeof (sendfs));
3691         if ((cp = strchr(sendfs, '@')) != NULL) {
3692                 *cp = '\0';
3693                 /*
3694                  * Find the "sendsnap", the final snapshot in a replication
3695                  * stream.  zfs_receive_one() handles certain errors
3696                  * differently, depending on if the contained stream is the
3697                  * last one or not.
3698                  */
3699                 sendsnap = (cp + 1);
3700         }
3701
3702         /* Finally, receive each contained stream */
3703         do {
3704                 /*
3705                  * we should figure out if it has a recoverable
3706                  * error, in which case do a recv_skip() and drive on.
3707                  * Note, if we fail due to already having this guid,
3708                  * zfs_receive_one() will take care of it (ie,
3709                  * recv_skip() and return 0).
3710                  */
3711                 error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3712                     sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3713                 if (error == ENODATA) {
3714                         error = 0;
3715                         break;
3716                 }
3717                 anyerr |= error;
3718         } while (error == 0);
3719
3720         if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3721                 /*
3722                  * Now that we have the fs's they sent us, try the
3723                  * renames again.
3724                  */
3725                 softerr = recv_incremental_replication(hdl, tofs, flags,
3726                     stream_nv, stream_avl, NULL);
3727         }
3728
3729         if (raw && softerr == 0 && *top_zfs != NULL) {
3730                 softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3731                     stream_nv, stream_avl);
3732         }
3733
3734 out:
3735         fsavl_destroy(stream_avl);
3736         fnvlist_free(stream_nv);
3737         if (softerr)
3738                 error = -2;
3739         if (anyerr)
3740                 error = -1;
3741         return (error);
3742 }
3743
3744 static void
3745 trunc_prop_errs(int truncated)
3746 {
3747         ASSERT(truncated != 0);
3748
3749         if (truncated == 1)
3750                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3751                     "1 more property could not be set\n"));
3752         else
3753                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3754                     "%d more properties could not be set\n"), truncated);
3755 }
3756
3757 static int
3758 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3759 {
3760         dmu_replay_record_t *drr;
3761         void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3762         uint64_t payload_size;
3763         char errbuf[1024];
3764
3765         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3766             "cannot receive"));
3767
3768         /* XXX would be great to use lseek if possible... */
3769         drr = buf;
3770
3771         while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3772             byteswap, NULL) == 0) {
3773                 if (byteswap)
3774                         drr->drr_type = BSWAP_32(drr->drr_type);
3775
3776                 switch (drr->drr_type) {
3777                 case DRR_BEGIN:
3778                         if (drr->drr_payloadlen != 0) {
3779                                 (void) recv_read(hdl, fd, buf,
3780                                     drr->drr_payloadlen, B_FALSE, NULL);
3781                         }
3782                         break;
3783
3784                 case DRR_END:
3785                         free(buf);
3786                         return (0);
3787
3788                 case DRR_OBJECT:
3789                         if (byteswap) {
3790                                 drr->drr_u.drr_object.drr_bonuslen =
3791                                     BSWAP_32(drr->drr_u.drr_object.
3792                                     drr_bonuslen);
3793                                 drr->drr_u.drr_object.drr_raw_bonuslen =
3794                                     BSWAP_32(drr->drr_u.drr_object.
3795                                     drr_raw_bonuslen);
3796                         }
3797
3798                         payload_size =
3799                             DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3800                         (void) recv_read(hdl, fd, buf, payload_size,
3801                             B_FALSE, NULL);
3802                         break;
3803
3804                 case DRR_WRITE:
3805                         if (byteswap) {
3806                                 drr->drr_u.drr_write.drr_logical_size =
3807                                     BSWAP_64(
3808                                     drr->drr_u.drr_write.drr_logical_size);
3809                                 drr->drr_u.drr_write.drr_compressed_size =
3810                                     BSWAP_64(
3811                                     drr->drr_u.drr_write.drr_compressed_size);
3812                         }
3813                         payload_size =
3814                             DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3815                         assert(payload_size <= SPA_MAXBLOCKSIZE);
3816                         (void) recv_read(hdl, fd, buf,
3817                             payload_size, B_FALSE, NULL);
3818                         break;
3819                 case DRR_SPILL:
3820                         if (byteswap) {
3821                                 drr->drr_u.drr_spill.drr_length =
3822                                     BSWAP_64(drr->drr_u.drr_spill.drr_length);
3823                                 drr->drr_u.drr_spill.drr_compressed_size =
3824                                     BSWAP_64(drr->drr_u.drr_spill.
3825                                     drr_compressed_size);
3826                         }
3827
3828                         payload_size =
3829                             DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3830                         (void) recv_read(hdl, fd, buf, payload_size,
3831                             B_FALSE, NULL);
3832                         break;
3833                 case DRR_WRITE_EMBEDDED:
3834                         if (byteswap) {
3835                                 drr->drr_u.drr_write_embedded.drr_psize =
3836                                     BSWAP_32(drr->drr_u.drr_write_embedded.
3837                                     drr_psize);
3838                         }
3839                         (void) recv_read(hdl, fd, buf,
3840                             P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3841                             8), B_FALSE, NULL);
3842                         break;
3843                 case DRR_OBJECT_RANGE:
3844                 case DRR_WRITE_BYREF:
3845                 case DRR_FREEOBJECTS:
3846                 case DRR_FREE:
3847                         break;
3848
3849                 default:
3850                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3851                             "invalid record type"));
3852                         free(buf);
3853                         return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3854                 }
3855         }
3856
3857         free(buf);
3858         return (-1);
3859 }
3860
3861 static void
3862 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
3863     boolean_t resumable, boolean_t checksum)
3864 {
3865         char target_fs[ZFS_MAX_DATASET_NAME_LEN];
3866
3867         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
3868             "checksum mismatch" : "incomplete stream")));
3869
3870         if (!resumable)
3871                 return;
3872         (void) strlcpy(target_fs, target_snap, sizeof (target_fs));
3873         *strchr(target_fs, '@') = '\0';
3874         zfs_handle_t *zhp = zfs_open(hdl, target_fs,
3875             ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
3876         if (zhp == NULL)
3877                 return;
3878
3879         char token_buf[ZFS_MAXPROPLEN];
3880         int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
3881             token_buf, sizeof (token_buf),
3882             NULL, NULL, 0, B_TRUE);
3883         if (error == 0) {
3884                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3885                     "checksum mismatch or incomplete stream.\n"
3886                     "Partially received snapshot is saved.\n"
3887                     "A resuming stream can be generated on the sending "
3888                     "system by running:\n"
3889                     "    zfs send -t %s"),
3890                     token_buf);
3891         }
3892         zfs_close(zhp);
3893 }
3894
3895 /*
3896  * Prepare a new nvlist of properties that are to override (-o) or be excluded
3897  * (-x) from the received dataset
3898  * recvprops: received properties from the send stream
3899  * cmdprops: raw input properties from command line
3900  * origprops: properties, both locally-set and received, currently set on the
3901  *            target dataset if it exists, NULL otherwise.
3902  * oxprops: valid output override (-o) and excluded (-x) properties
3903  */
3904 static int
3905 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
3906     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
3907     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
3908     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
3909     uint_t *wkeylen_out, const char *errbuf)
3910 {
3911         nvpair_t *nvp;
3912         nvlist_t *oprops, *voprops;
3913         zfs_handle_t *zhp = NULL;
3914         zpool_handle_t *zpool_hdl = NULL;
3915         char *cp;
3916         int ret = 0;
3917         char namebuf[ZFS_MAX_DATASET_NAME_LEN];
3918
3919         if (nvlist_empty(cmdprops))
3920                 return (0); /* No properties to override or exclude */
3921
3922         *oxprops = fnvlist_alloc();
3923         oprops = fnvlist_alloc();
3924
3925         strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
3926
3927         /*
3928          * Get our dataset handle. The target dataset may not exist yet.
3929          */
3930         if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
3931                 zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
3932                 if (zhp == NULL) {
3933                         ret = -1;
3934                         goto error;
3935                 }
3936         }
3937
3938         /* open the zpool handle */
3939         cp = strchr(namebuf, '/');
3940         if (cp != NULL)
3941                 *cp = '\0';
3942         zpool_hdl = zpool_open(hdl, namebuf);
3943         if (zpool_hdl == NULL) {
3944                 ret = -1;
3945                 goto error;
3946         }
3947
3948         /* restore namebuf to match fsname for later use */
3949         if (cp != NULL)
3950                 *cp = '/';
3951
3952         /*
3953          * first iteration: process excluded (-x) properties now and gather
3954          * added (-o) properties to be later processed by zfs_valid_proplist()
3955          */
3956         nvp = NULL;
3957         while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
3958                 const char *name = nvpair_name(nvp);
3959                 zfs_prop_t prop = zfs_name_to_prop(name);
3960
3961                 /*
3962                  * It turns out, if we don't normalize "aliased" names
3963                  * e.g. compress= against the "real" names (e.g. compression)
3964                  * here, then setting/excluding them does not work as
3965                  * intended.
3966                  *
3967                  * But since user-defined properties wouldn't have a valid
3968                  * mapping here, we do this conditional dance.
3969                  */
3970                 const char *newname = name;
3971                 if (prop >= ZFS_PROP_TYPE)
3972                         newname = zfs_prop_to_name(prop);
3973
3974                 /* "origin" is processed separately, don't handle it here */
3975                 if (prop == ZFS_PROP_ORIGIN)
3976                         continue;
3977
3978                 /* raw streams can't override encryption properties */
3979                 if ((zfs_prop_encryption_key_param(prop) ||
3980                     prop == ZFS_PROP_ENCRYPTION) && raw) {
3981                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3982                             "encryption property '%s' cannot "
3983                             "be set or excluded for raw streams."), name);
3984                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3985                         goto error;
3986                 }
3987
3988                 /* incremental streams can only exclude encryption properties */
3989                 if ((zfs_prop_encryption_key_param(prop) ||
3990                     prop == ZFS_PROP_ENCRYPTION) && !newfs &&
3991                     nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
3992                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3993                             "encryption property '%s' cannot "
3994                             "be set for incremental streams."), name);
3995                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3996                         goto error;
3997                 }
3998
3999                 switch (nvpair_type(nvp)) {
4000                 case DATA_TYPE_BOOLEAN: /* -x property */
4001                         /*
4002                          * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4003                          * a property: this is done by forcing an explicit
4004                          * inherit on the destination so the effective value is
4005                          * not the one we received from the send stream.
4006                          */
4007                         if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4008                             !zfs_prop_user(name)) {
4009                                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4010                                     "Warning: %s: property '%s' does not "
4011                                     "apply to datasets of this type\n"),
4012                                     fsname, name);
4013                                 continue;
4014                         }
4015                         /*
4016                          * We do this only if the property is not already
4017                          * locally-set, in which case its value will take
4018                          * priority over the received anyway.
4019                          */
4020                         if (nvlist_exists(origprops, newname)) {
4021                                 nvlist_t *attrs;
4022                                 char *source = NULL;
4023
4024                                 attrs = fnvlist_lookup_nvlist(origprops,
4025                                     newname);
4026                                 if (nvlist_lookup_string(attrs,
4027                                     ZPROP_SOURCE, &source) == 0 &&
4028                                     strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4029                                         continue;
4030                         }
4031                         /*
4032                          * We can't force an explicit inherit on non-inheritable
4033                          * properties: if we're asked to exclude this kind of
4034                          * values we remove them from "recvprops" input nvlist.
4035                          */
4036                         if (!zfs_prop_inheritable(prop) &&
4037                             !zfs_prop_user(name) && /* can be inherited too */
4038                             nvlist_exists(recvprops, newname))
4039                                 fnvlist_remove(recvprops, newname);
4040                         else
4041                                 fnvlist_add_boolean(*oxprops, newname);
4042                         break;
4043                 case DATA_TYPE_STRING: /* -o property=value */
4044                         /*
4045                          * we're trying to override a property that does not
4046                          * make sense for this type of dataset, but we don't
4047                          * want to fail if the receive is recursive: this comes
4048                          * in handy when the send stream contains, for
4049                          * instance, a child ZVOL and we're trying to receive
4050                          * it with "-o atime=on"
4051                          */
4052                         if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4053                             !zfs_prop_user(name)) {
4054                                 if (recursive)
4055                                         continue;
4056                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4057                                     "property '%s' does not apply to datasets "
4058                                     "of this type"), name);
4059                                 ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4060                                 goto error;
4061                         }
4062                         fnvlist_add_string(oprops, newname,
4063                             fnvpair_value_string(nvp));
4064                         break;
4065                 default:
4066                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4067                             "property '%s' must be a string or boolean"), name);
4068                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4069                         goto error;
4070                 }
4071         }
4072
4073         if (toplevel) {
4074                 /* convert override strings properties to native */
4075                 if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4076                     oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4077                         ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4078                         goto error;
4079                 }
4080
4081                 /*
4082                  * zfs_crypto_create() requires the parent name. Get it
4083                  * by truncating the fsname copy stored in namebuf.
4084                  */
4085                 cp = strrchr(namebuf, '/');
4086                 if (cp != NULL)
4087                         *cp = '\0';
4088
4089                 if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4090                     B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4091                         fnvlist_free(voprops);
4092                         ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4093                         goto error;
4094                 }
4095
4096                 /* second pass: process "-o" properties */
4097                 fnvlist_merge(*oxprops, voprops);
4098                 fnvlist_free(voprops);
4099         } else {
4100                 /* override props on child dataset are inherited */
4101                 nvp = NULL;
4102                 while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4103                         const char *name = nvpair_name(nvp);
4104                         fnvlist_add_boolean(*oxprops, name);
4105                 }
4106         }
4107
4108 error:
4109         if (zhp != NULL)
4110                 zfs_close(zhp);
4111         if (zpool_hdl != NULL)
4112                 zpool_close(zpool_hdl);
4113         fnvlist_free(oprops);
4114         return (ret);
4115 }
4116
4117 /*
4118  * Restores a backup of tosnap from the file descriptor specified by infd.
4119  */
4120 static int
4121 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4122     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4123     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4124     avl_tree_t *stream_avl, char **top_zfs,
4125     const char *finalsnap, nvlist_t *cmdprops)
4126 {
4127         time_t begin_time;
4128         int ioctl_err, ioctl_errno, err;
4129         char *cp;
4130         struct drr_begin *drrb = &drr->drr_u.drr_begin;
4131         char errbuf[1024];
4132         const char *chopprefix;
4133         boolean_t newfs = B_FALSE;
4134         boolean_t stream_wantsnewfs, stream_resumingnewfs;
4135         boolean_t newprops = B_FALSE;
4136         uint64_t read_bytes = 0;
4137         uint64_t errflags = 0;
4138         uint64_t parent_snapguid = 0;
4139         prop_changelist_t *clp = NULL;
4140         nvlist_t *snapprops_nvlist = NULL;
4141         nvlist_t *snapholds_nvlist = NULL;
4142         zprop_errflags_t prop_errflags;
4143         nvlist_t *prop_errors = NULL;
4144         boolean_t recursive;
4145         char *snapname = NULL;
4146         char destsnap[MAXPATHLEN * 2];
4147         char origin[MAXNAMELEN];
4148         char name[MAXPATHLEN];
4149         char tmp_keylocation[MAXNAMELEN];
4150         nvlist_t *rcvprops = NULL; /* props received from the send stream */
4151         nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4152         nvlist_t *origprops = NULL; /* original props (if destination exists) */
4153         zfs_type_t type;
4154         boolean_t toplevel = B_FALSE;
4155         boolean_t zoned = B_FALSE;
4156         boolean_t hastoken = B_FALSE;
4157         boolean_t redacted;
4158         uint8_t *wkeydata = NULL;
4159         uint_t wkeylen = 0;
4160
4161         begin_time = time(NULL);
4162         bzero(origin, MAXNAMELEN);
4163         bzero(tmp_keylocation, MAXNAMELEN);
4164
4165         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4166             "cannot receive"));
4167
4168         recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4169             ENOENT);
4170
4171         /* Did the user request holds be skipped via zfs recv -k? */
4172         boolean_t holds = flags->holds && !flags->skipholds;
4173
4174         if (stream_avl != NULL) {
4175                 char *keylocation = NULL;
4176                 nvlist_t *lookup = NULL;
4177                 nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4178                     &snapname);
4179
4180                 (void) nvlist_lookup_uint64(fs, "parentfromsnap",
4181                     &parent_snapguid);
4182                 err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4183                 if (err) {
4184                         rcvprops = fnvlist_alloc();
4185                         newprops = B_TRUE;
4186                 }
4187
4188                 /*
4189                  * The keylocation property may only be set on encryption roots,
4190                  * but this dataset might not become an encryption root until
4191                  * recv_fix_encryption_hierarchy() is called. That function
4192                  * will fixup the keylocation anyway, so we temporarily unset
4193                  * the keylocation for now to avoid any errors from the receive
4194                  * ioctl.
4195                  */
4196                 err = nvlist_lookup_string(rcvprops,
4197                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4198                 if (err == 0) {
4199                         strcpy(tmp_keylocation, keylocation);
4200                         (void) nvlist_remove_all(rcvprops,
4201                             zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4202                 }
4203
4204                 if (flags->canmountoff) {
4205                         fnvlist_add_uint64(rcvprops,
4206                             zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4207                 } else if (newprops) {  /* nothing in rcvprops, eliminate it */
4208                         fnvlist_free(rcvprops);
4209                         rcvprops = NULL;
4210                         newprops = B_FALSE;
4211                 }
4212                 if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4213                         snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4214                             snapname);
4215                 }
4216                 if (holds) {
4217                         if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4218                             &lookup)) {
4219                                 snapholds_nvlist = fnvlist_lookup_nvlist(
4220                                     lookup, snapname);
4221                         }
4222                 }
4223         }
4224
4225         cp = NULL;
4226
4227         /*
4228          * Determine how much of the snapshot name stored in the stream
4229          * we are going to tack on to the name they specified on the
4230          * command line, and how much we are going to chop off.
4231          *
4232          * If they specified a snapshot, chop the entire name stored in
4233          * the stream.
4234          */
4235         if (flags->istail) {
4236                 /*
4237                  * A filesystem was specified with -e. We want to tack on only
4238                  * the tail of the sent snapshot path.
4239                  */
4240                 if (strchr(tosnap, '@')) {
4241                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4242                             "argument - snapshot not allowed with -e"));
4243                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4244                         goto out;
4245                 }
4246
4247                 chopprefix = strrchr(sendfs, '/');
4248
4249                 if (chopprefix == NULL) {
4250                         /*
4251                          * The tail is the poolname, so we need to
4252                          * prepend a path separator.
4253                          */
4254                         int len = strlen(drrb->drr_toname);
4255                         cp = malloc(len + 2);
4256                         cp[0] = '/';
4257                         (void) strcpy(&cp[1], drrb->drr_toname);
4258                         chopprefix = cp;
4259                 } else {
4260                         chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4261                 }
4262         } else if (flags->isprefix) {
4263                 /*
4264                  * A filesystem was specified with -d. We want to tack on
4265                  * everything but the first element of the sent snapshot path
4266                  * (all but the pool name).
4267                  */
4268                 if (strchr(tosnap, '@')) {
4269                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4270                             "argument - snapshot not allowed with -d"));
4271                         err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4272                         goto out;
4273                 }
4274
4275                 chopprefix = strchr(drrb->drr_toname, '/');
4276                 if (chopprefix == NULL)
4277                         chopprefix = strchr(drrb->drr_toname, '@');
4278         } else if (strchr(tosnap, '@') == NULL) {
4279                 /*
4280                  * If a filesystem was specified without -d or -e, we want to
4281                  * tack on everything after the fs specified by 'zfs send'.
4282                  */
4283                 chopprefix = drrb->drr_toname + strlen(sendfs);
4284         } else {
4285                 /* A snapshot was specified as an exact path (no -d or -e). */
4286                 if (recursive) {
4287                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4288                             "cannot specify snapshot name for multi-snapshot "
4289                             "stream"));
4290                         err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4291                         goto out;
4292                 }
4293                 chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4294         }
4295
4296         ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4297         ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4298         ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4299             strchr(sendfs, '/') == NULL);
4300         ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4301             chopprefix[0] == '\0');
4302
4303         /*
4304          * Determine name of destination snapshot.
4305          */
4306         (void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4307         (void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4308         free(cp);
4309         if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4310                 err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4311                 goto out;
4312         }
4313
4314         /*
4315          * Determine the name of the origin snapshot.
4316          */
4317         if (originsnap) {
4318                 (void) strlcpy(origin, originsnap, sizeof (origin));
4319                 if (flags->verbose)
4320                         (void) printf("using provided clone origin %s\n",
4321                             origin);
4322         } else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4323                 if (guid_to_name(hdl, destsnap,
4324                     drrb->drr_fromguid, B_FALSE, origin) != 0) {
4325                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4326                             "local origin for clone %s does not exist"),
4327                             destsnap);
4328                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4329                         goto out;
4330                 }
4331                 if (flags->verbose)
4332                         (void) printf("found clone origin %s\n", origin);
4333         }
4334
4335         if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4336             DMU_BACKUP_FEATURE_DEDUP)) {
4337                 (void) fprintf(stderr,
4338                     gettext("ERROR: \"zfs receive\" no longer supports "
4339                     "deduplicated send streams.  Use\n"
4340                     "the \"zstream redup\" command to convert this stream "
4341                     "to a regular,\n"
4342                     "non-deduplicated stream.\n"));
4343                 err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4344                 goto out;
4345         }
4346
4347         boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4348             DMU_BACKUP_FEATURE_RESUMING;
4349         boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4350             DMU_BACKUP_FEATURE_RAW;
4351         boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4352             DMU_BACKUP_FEATURE_EMBED_DATA;
4353         stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4354             (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4355         stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4356             (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4357
4358         if (stream_wantsnewfs) {
4359                 /*
4360                  * if the parent fs does not exist, look for it based on
4361                  * the parent snap GUID
4362                  */
4363                 (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4364                     "cannot receive new filesystem stream"));
4365
4366                 (void) strcpy(name, destsnap);
4367                 cp = strrchr(name, '/');
4368                 if (cp)
4369                         *cp = '\0';
4370                 if (cp &&
4371                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4372                         char suffix[ZFS_MAX_DATASET_NAME_LEN];
4373                         (void) strcpy(suffix, strrchr(destsnap, '/'));
4374                         if (guid_to_name(hdl, name, parent_snapguid,
4375                             B_FALSE, destsnap) == 0) {
4376                                 *strchr(destsnap, '@') = '\0';
4377                                 (void) strcat(destsnap, suffix);
4378                         }
4379                 }
4380         } else {
4381                 /*
4382                  * If the fs does not exist, look for it based on the
4383                  * fromsnap GUID.
4384                  */
4385                 if (resuming) {
4386                         (void) snprintf(errbuf, sizeof (errbuf),
4387                             dgettext(TEXT_DOMAIN,
4388                             "cannot receive resume stream"));
4389                 } else {
4390                         (void) snprintf(errbuf, sizeof (errbuf),
4391                             dgettext(TEXT_DOMAIN,
4392                             "cannot receive incremental stream"));
4393                 }
4394
4395                 (void) strcpy(name, destsnap);
4396                 *strchr(name, '@') = '\0';
4397
4398                 /*
4399                  * If the exact receive path was specified and this is the
4400                  * topmost path in the stream, then if the fs does not exist we
4401                  * should look no further.
4402                  */
4403                 if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4404                     strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4405                     !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4406                         char snap[ZFS_MAX_DATASET_NAME_LEN];
4407                         (void) strcpy(snap, strchr(destsnap, '@'));
4408                         if (guid_to_name(hdl, name, drrb->drr_fromguid,
4409                             B_FALSE, destsnap) == 0) {
4410                                 *strchr(destsnap, '@') = '\0';
4411                                 (void) strcat(destsnap, snap);
4412                         }
4413                 }
4414         }
4415
4416         (void) strcpy(name, destsnap);
4417         *strchr(name, '@') = '\0';
4418
4419         redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4420             DMU_BACKUP_FEATURE_REDACTED;
4421
4422         if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4423                 zfs_cmd_t zc = {"\0"};
4424                 zfs_handle_t *zhp;
4425                 boolean_t encrypted;
4426
4427                 (void) strcpy(zc.zc_name, name);
4428
4429                 /*
4430                  * Destination fs exists.  It must be one of these cases:
4431                  *  - an incremental send stream
4432                  *  - the stream specifies a new fs (full stream or clone)
4433                  *    and they want us to blow away the existing fs (and
4434                  *    have therefore specified -F and removed any snapshots)
4435                  *  - we are resuming a failed receive.
4436                  */
4437                 if (stream_wantsnewfs) {
4438                         boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4439                         if (!flags->force) {
4440                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4441                                     "destination '%s' exists\n"
4442                                     "must specify -F to overwrite it"), name);
4443                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4444                                 goto out;
4445                         }
4446                         if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4447                             &zc) == 0) {
4448                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4449                                     "destination has snapshots (eg. %s)\n"
4450                                     "must destroy them to overwrite it"),
4451                                     zc.zc_name);
4452                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4453                                 goto out;
4454                         }
4455                         if (is_volume && strrchr(name, '/') == NULL) {
4456                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4457                                     "destination %s is the root dataset\n"
4458                                     "cannot overwrite with a ZVOL"),
4459                                     name);
4460                                 err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4461                                 goto out;
4462                         }
4463                         if (is_volume &&
4464                             zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4465                             &zc) == 0) {
4466                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4467                                     "destination has children (eg. %s)\n"
4468                                     "cannot overwrite with a ZVOL"),
4469                                     zc.zc_name);
4470                                 err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4471                                 goto out;
4472                         }
4473                 }
4474
4475                 if ((zhp = zfs_open(hdl, name,
4476                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4477                         err = -1;
4478                         goto out;
4479                 }
4480
4481                 if (stream_wantsnewfs &&
4482                     zhp->zfs_dmustats.dds_origin[0]) {
4483                         zfs_close(zhp);
4484                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4485                             "destination '%s' is a clone\n"
4486                             "must destroy it to overwrite it"), name);
4487                         err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4488                         goto out;
4489                 }
4490
4491                 /*
4492                  * Raw sends can not be performed as an incremental on top
4493                  * of existing unencrypted datasets. zfs recv -F can't be
4494                  * used to blow away an existing encrypted filesystem. This
4495                  * is because it would require the dsl dir to point to the
4496                  * new key (or lack of a key) and the old key at the same
4497                  * time. The -F flag may still be used for deleting
4498                  * intermediate snapshots that would otherwise prevent the
4499                  * receive from working.
4500                  */
4501                 encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4502                     ZIO_CRYPT_OFF;
4503                 if (!stream_wantsnewfs && !encrypted && raw) {
4504                         zfs_close(zhp);
4505                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4506                             "cannot perform raw receive on top of "
4507                             "existing unencrypted dataset"));
4508                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4509                         goto out;
4510                 }
4511
4512                 if (stream_wantsnewfs && flags->force &&
4513                     ((raw && !encrypted) || encrypted)) {
4514                         zfs_close(zhp);
4515                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4516                             "zfs receive -F cannot be used to destroy an "
4517                             "encrypted filesystem or overwrite an "
4518                             "unencrypted one with an encrypted one"));
4519                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4520                         goto out;
4521                 }
4522
4523                 if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4524                     (stream_wantsnewfs || stream_resumingnewfs)) {
4525                         /* We can't do online recv in this case */
4526                         clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4527                             flags->forceunmount ? MS_FORCE : 0);
4528                         if (clp == NULL) {
4529                                 zfs_close(zhp);
4530                                 err = -1;
4531                                 goto out;
4532                         }
4533                         if (changelist_prefix(clp) != 0) {
4534                                 changelist_free(clp);
4535                                 zfs_close(zhp);
4536                                 err = -1;
4537                                 goto out;
4538                         }
4539                 }
4540
4541                 /*
4542                  * If we are resuming a newfs, set newfs here so that we will
4543                  * mount it if the recv succeeds this time.  We can tell
4544                  * that it was a newfs on the first recv because the fs
4545                  * itself will be inconsistent (if the fs existed when we
4546                  * did the first recv, we would have received it into
4547                  * .../%recv).
4548                  */
4549                 if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4550                         newfs = B_TRUE;
4551
4552                 /* we want to know if we're zoned when validating -o|-x props */
4553                 zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4554
4555                 /* may need this info later, get it now we have zhp around */
4556                 if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4557                     NULL, NULL, 0, B_TRUE) == 0)
4558                         hastoken = B_TRUE;
4559
4560                 /* gather existing properties on destination */
4561                 origprops = fnvlist_alloc();
4562                 fnvlist_merge(origprops, zhp->zfs_props);
4563                 fnvlist_merge(origprops, zhp->zfs_user_props);
4564
4565                 zfs_close(zhp);
4566         } else {
4567                 zfs_handle_t *zhp;
4568
4569                 /*
4570                  * Destination filesystem does not exist.  Therefore we better
4571                  * be creating a new filesystem (either from a full backup, or
4572                  * a clone).  It would therefore be invalid if the user
4573                  * specified only the pool name (i.e. if the destination name
4574                  * contained no slash character).
4575                  */
4576                 cp = strrchr(name, '/');
4577
4578                 if (!stream_wantsnewfs || cp == NULL) {
4579                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4580                             "destination '%s' does not exist"), name);
4581                         err = zfs_error(hdl, EZFS_NOENT, errbuf);
4582                         goto out;
4583                 }
4584
4585                 /*
4586                  * Trim off the final dataset component so we perform the
4587                  * recvbackup ioctl to the filesystems's parent.
4588                  */
4589                 *cp = '\0';
4590
4591                 if (flags->isprefix && !flags->istail && !flags->dryrun &&
4592                     create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4593                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4594                         goto out;
4595                 }
4596
4597                 /* validate parent */
4598                 zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4599                 if (zhp == NULL) {
4600                         err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4601                         goto out;
4602                 }
4603                 if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4604                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4605                             "parent '%s' is not a filesystem"), name);
4606                         err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4607                         zfs_close(zhp);
4608                         goto out;
4609                 }
4610
4611                 zfs_close(zhp);
4612
4613                 newfs = B_TRUE;
4614                 *cp = '/';
4615         }
4616
4617         if (flags->verbose) {
4618                 (void) printf("%s %s stream of %s into %s\n",
4619                     flags->dryrun ? "would receive" : "receiving",
4620                     drrb->drr_fromguid ? "incremental" : "full",
4621                     drrb->drr_toname, destsnap);
4622                 (void) fflush(stdout);
4623         }
4624
4625         /*
4626          * If this is the top-level dataset, record it so we can use it
4627          * for recursive operations later.
4628          */
4629         if (top_zfs != NULL &&
4630             (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4631                 toplevel = B_TRUE;
4632                 if (*top_zfs == NULL)
4633                         *top_zfs = zfs_strdup(hdl, name);
4634         }
4635
4636         if (drrb->drr_type == DMU_OST_ZVOL) {
4637                 type = ZFS_TYPE_VOLUME;
4638         } else if (drrb->drr_type == DMU_OST_ZFS) {
4639                 type = ZFS_TYPE_FILESYSTEM;
4640         } else {
4641                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4642                     "invalid record type: 0x%d"), drrb->drr_type);
4643                 err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4644                 goto out;
4645         }
4646         if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4647             stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4648             &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4649                 goto out;
4650
4651         /*
4652          * When sending with properties (zfs send -p), the encryption property
4653          * is not included because it is a SETONCE property and therefore
4654          * treated as read only. However, we are always able to determine its
4655          * value because raw sends will include it in the DRR_BDEGIN payload
4656          * and non-raw sends with properties are not allowed for encrypted
4657          * datasets. Therefore, if this is a non-raw properties stream, we can
4658          * infer that the value should be ZIO_CRYPT_OFF and manually add that
4659          * to the received properties.
4660          */
4661         if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4662             !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4663                 if (oxprops == NULL)
4664                         oxprops = fnvlist_alloc();
4665                 fnvlist_add_uint64(oxprops,
4666                     zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4667         }
4668
4669         if (flags->dryrun) {
4670                 void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4671
4672                 /*
4673                  * We have read the DRR_BEGIN record, but we have
4674                  * not yet read the payload. For non-dryrun sends
4675                  * this will be done by the kernel, so we must
4676                  * emulate that here, before attempting to read
4677                  * more records.
4678                  */
4679                 err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4680                     flags->byteswap, NULL);
4681                 free(buf);
4682                 if (err != 0)
4683                         goto out;
4684
4685                 err = recv_skip(hdl, infd, flags->byteswap);
4686                 goto out;
4687         }
4688
4689         err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4690             oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4691             raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4692             NULL, &prop_errors);
4693         ioctl_errno = ioctl_err;
4694         prop_errflags = errflags;
4695
4696         if (err == 0) {
4697                 nvpair_t *prop_err = NULL;
4698
4699                 while ((prop_err = nvlist_next_nvpair(prop_errors,
4700                     prop_err)) != NULL) {
4701                         char tbuf[1024];
4702                         zfs_prop_t prop;
4703                         int intval;
4704
4705                         prop = zfs_name_to_prop(nvpair_name(prop_err));
4706                         (void) nvpair_value_int32(prop_err, &intval);
4707                         if (strcmp(nvpair_name(prop_err),
4708                             ZPROP_N_MORE_ERRORS) == 0) {
4709                                 trunc_prop_errs(intval);
4710                                 break;
4711                         } else if (snapname == NULL || finalsnap == NULL ||
4712                             strcmp(finalsnap, snapname) == 0 ||
4713                             strcmp(nvpair_name(prop_err),
4714                             zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4715                                 /*
4716                                  * Skip the special case of, for example,
4717                                  * "refquota", errors on intermediate
4718                                  * snapshots leading up to a final one.
4719                                  * That's why we have all of the checks above.
4720                                  *
4721                                  * See zfs_ioctl.c's extract_delay_props() for
4722                                  * a list of props which can fail on
4723                                  * intermediate snapshots, but shouldn't
4724                                  * affect the overall receive.
4725                                  */
4726                                 (void) snprintf(tbuf, sizeof (tbuf),
4727                                     dgettext(TEXT_DOMAIN,
4728                                     "cannot receive %s property on %s"),
4729                                     nvpair_name(prop_err), name);
4730                                 zfs_setprop_error(hdl, prop, intval, tbuf);
4731                         }
4732                 }
4733         }
4734
4735         if (err == 0 && snapprops_nvlist) {
4736                 zfs_cmd_t zc = {"\0"};
4737
4738                 (void) strcpy(zc.zc_name, destsnap);
4739                 zc.zc_cookie = B_TRUE; /* received */
4740                 if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
4741                         (void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4742                         zcmd_free_nvlists(&zc);
4743                 }
4744         }
4745         if (err == 0 && snapholds_nvlist) {
4746                 nvpair_t *pair;
4747                 nvlist_t *holds, *errors = NULL;
4748                 int cleanup_fd = -1;
4749
4750                 VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4751                 for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4752                     pair != NULL;
4753                     pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4754                         fnvlist_add_string(holds, destsnap, nvpair_name(pair));
4755                 }
4756                 (void) lzc_hold(holds, cleanup_fd, &errors);
4757                 fnvlist_free(snapholds_nvlist);
4758                 fnvlist_free(holds);
4759         }
4760
4761         if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4762                 /*
4763                  * It may be that this snapshot already exists,
4764                  * in which case we want to consume & ignore it
4765                  * rather than failing.
4766                  */
4767                 avl_tree_t *local_avl;
4768                 nvlist_t *local_nv, *fs;
4769                 cp = strchr(destsnap, '@');
4770
4771                 /*
4772                  * XXX Do this faster by just iterating over snaps in
4773                  * this fs.  Also if zc_value does not exist, we will
4774                  * get a strange "does not exist" error message.
4775                  */
4776                 *cp = '\0';
4777                 if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4778                     B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
4779                     B_TRUE, &local_nv, &local_avl) == 0) {
4780                         *cp = '@';
4781                         fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4782                         fsavl_destroy(local_avl);
4783                         fnvlist_free(local_nv);
4784
4785                         if (fs != NULL) {
4786                                 if (flags->verbose) {
4787                                         (void) printf("snap %s already exists; "
4788                                             "ignoring\n", destsnap);
4789                                 }
4790                                 err = ioctl_err = recv_skip(hdl, infd,
4791                                     flags->byteswap);
4792                         }
4793                 }
4794                 *cp = '@';
4795         }
4796
4797         if (ioctl_err != 0) {
4798                 switch (ioctl_errno) {
4799                 case ENODEV:
4800                         cp = strchr(destsnap, '@');
4801                         *cp = '\0';
4802                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4803                             "most recent snapshot of %s does not\n"
4804                             "match incremental source"), destsnap);
4805                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4806                         *cp = '@';
4807                         break;
4808                 case ETXTBSY:
4809                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4810                             "destination %s has been modified\n"
4811                             "since most recent snapshot"), name);
4812                         (void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4813                         break;
4814                 case EACCES:
4815                         if (raw && stream_wantsnewfs) {
4816                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4817                                     "failed to create encryption key"));
4818                         } else if (raw && !stream_wantsnewfs) {
4819                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4820                                     "encryption key does not match "
4821                                     "existing key"));
4822                         } else {
4823                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4824                                     "inherited key must be loaded"));
4825                         }
4826                         (void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4827                         break;
4828                 case EEXIST:
4829                         cp = strchr(destsnap, '@');
4830                         if (newfs) {
4831                                 /* it's the containing fs that exists */
4832                                 *cp = '\0';
4833                         }
4834                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4835                             "destination already exists"));
4836                         (void) zfs_error_fmt(hdl, EZFS_EXISTS,
4837                             dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4838                             destsnap);
4839                         *cp = '@';
4840                         break;
4841                 case EINVAL:
4842                         if (flags->resumable) {
4843                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4844                                     "kernel modules must be upgraded to "
4845                                     "receive this stream."));
4846                         } else if (embedded && !raw) {
4847                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4848                                     "incompatible embedded data stream "
4849                                     "feature with encrypted receive."));
4850                         }
4851                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4852                         break;
4853                 case ECKSUM:
4854                 case ZFS_ERR_STREAM_TRUNCATED:
4855                         recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4856                             ioctl_err == ECKSUM);
4857                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4858                         break;
4859                 case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
4860                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4861                             "incremental send stream requires -L "
4862                             "(--large-block), to match previous receive."));
4863                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4864                         break;
4865                 case ENOTSUP:
4866                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4867                             "pool must be upgraded to receive this stream."));
4868                         (void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
4869                         break;
4870                 case EDQUOT:
4871                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4872                             "destination %s space quota exceeded."), name);
4873                         (void) zfs_error(hdl, EZFS_NOSPC, errbuf);
4874                         break;
4875                 case ZFS_ERR_FROM_IVSET_GUID_MISSING:
4876                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4877                             "IV set guid missing. See errata %u at "
4878                             "https://openzfs.github.io/openzfs-docs/msg/"
4879                             "ZFS-8000-ER."),
4880                             ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
4881                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4882                         break;
4883                 case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
4884                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4885                             "IV set guid mismatch. See the 'zfs receive' "
4886                             "man page section\n discussing the limitations "
4887                             "of raw encrypted send streams."));
4888                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4889                         break;
4890                 case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
4891                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4892                             "Spill block flag missing for raw send.\n"
4893                             "The zfs software on the sending system must "
4894                             "be updated."));
4895                         (void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4896                         break;
4897                 case EBUSY:
4898                         if (hastoken) {
4899                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4900                                     "destination %s contains "
4901                                     "partially-complete state from "
4902                                     "\"zfs receive -s\"."), name);
4903                                 (void) zfs_error(hdl, EZFS_BUSY, errbuf);
4904                                 break;
4905                         }
4906                         fallthrough;
4907                 default:
4908                         (void) zfs_standard_error(hdl, ioctl_errno, errbuf);
4909                 }
4910         }
4911
4912         /*
4913          * Mount the target filesystem (if created).  Also mount any
4914          * children of the target filesystem if we did a replication
4915          * receive (indicated by stream_avl being non-NULL).
4916          */
4917         if (clp) {
4918                 if (!flags->nomount)
4919                         err |= changelist_postfix(clp);
4920                 changelist_free(clp);
4921         }
4922
4923         if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
4924                 flags->domount = B_TRUE;
4925
4926         if (prop_errflags & ZPROP_ERR_NOCLEAR) {
4927                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4928                     "failed to clear unreceived properties on %s"), name);
4929                 (void) fprintf(stderr, "\n");
4930         }
4931         if (prop_errflags & ZPROP_ERR_NORESTORE) {
4932                 (void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4933                     "failed to restore original properties on %s"), name);
4934                 (void) fprintf(stderr, "\n");
4935         }
4936
4937         if (err || ioctl_err) {
4938                 err = -1;
4939                 goto out;
4940         }
4941
4942         if (flags->verbose) {
4943                 char buf1[64];
4944                 char buf2[64];
4945                 uint64_t bytes = read_bytes;
4946                 time_t delta = time(NULL) - begin_time;
4947                 if (delta == 0)
4948                         delta = 1;
4949                 zfs_nicebytes(bytes, buf1, sizeof (buf1));
4950                 zfs_nicebytes(bytes/delta, buf2, sizeof (buf1));
4951
4952                 (void) printf("received %s stream in %lld seconds (%s/sec)\n",
4953                     buf1, (longlong_t)delta, buf2);
4954         }
4955
4956         err = 0;
4957 out:
4958         if (prop_errors != NULL)
4959                 fnvlist_free(prop_errors);
4960
4961         if (tmp_keylocation[0] != '\0') {
4962                 fnvlist_add_string(rcvprops,
4963                     zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
4964         }
4965
4966         if (newprops)
4967                 fnvlist_free(rcvprops);
4968
4969         fnvlist_free(oxprops);
4970         fnvlist_free(origprops);
4971
4972         return (err);
4973 }
4974
4975 /*
4976  * Check properties we were asked to override (both -o|-x)
4977  */
4978 static boolean_t
4979 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
4980     const char *errbuf)
4981 {
4982         nvpair_t *nvp;
4983         zfs_prop_t prop;
4984         const char *name;
4985
4986         nvp = NULL;
4987         while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
4988                 name = nvpair_name(nvp);
4989                 prop = zfs_name_to_prop(name);
4990
4991                 if (prop == ZPROP_INVAL) {
4992                         if (!zfs_prop_user(name)) {
4993                                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4994                                     "invalid property '%s'"), name);
4995                                 return (B_FALSE);
4996                         }
4997                         continue;
4998                 }
4999                 /*
5000                  * "origin" is readonly but is used to receive datasets as
5001                  * clones so we don't raise an error here
5002                  */
5003                 if (prop == ZFS_PROP_ORIGIN)
5004                         continue;
5005
5006                 /* encryption params have their own verification later */
5007                 if (prop == ZFS_PROP_ENCRYPTION ||
5008                     zfs_prop_encryption_key_param(prop))
5009                         continue;
5010
5011                 /*
5012                  * cannot override readonly, set-once and other specific
5013                  * settable properties
5014                  */
5015                 if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5016                     prop == ZFS_PROP_VOLSIZE) {
5017                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5018                             "invalid property '%s'"), name);
5019                         return (B_FALSE);
5020                 }
5021         }
5022
5023         return (B_TRUE);
5024 }
5025
5026 static int
5027 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5028     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5029     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5030     const char *finalsnap, nvlist_t *cmdprops)
5031 {
5032         int err;
5033         dmu_replay_record_t drr, drr_noswap;
5034         struct drr_begin *drrb = &drr.drr_u.drr_begin;
5035         char errbuf[1024];
5036         zio_cksum_t zcksum = { { 0 } };
5037         uint64_t featureflags;
5038         int hdrtype;
5039
5040         (void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5041             "cannot receive"));
5042
5043         /* check cmdline props, raise an error if they cannot be received */
5044         if (!zfs_receive_checkprops(hdl, cmdprops, errbuf)) {
5045                 return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5046         }
5047
5048         if (flags->isprefix &&
5049             !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5050                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5051                     "(%s) does not exist"), tosnap);
5052                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5053         }
5054         if (originsnap &&
5055             !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5056                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5057                     "(%s) does not exist"), originsnap);
5058                 return (zfs_error(hdl, EZFS_NOENT, errbuf));
5059         }
5060
5061         /* read in the BEGIN record */
5062         if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5063             &zcksum)))
5064                 return (err);
5065
5066         if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5067                 /* It's the double end record at the end of a package */
5068                 return (ENODATA);
5069         }
5070
5071         /* the kernel needs the non-byteswapped begin record */
5072         drr_noswap = drr;
5073
5074         flags->byteswap = B_FALSE;
5075         if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5076                 /*
5077                  * We computed the checksum in the wrong byteorder in
5078                  * recv_read() above; do it again correctly.
5079                  */
5080                 bzero(&zcksum, sizeof (zio_cksum_t));
5081                 fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5082                 flags->byteswap = B_TRUE;
5083
5084                 drr.drr_type = BSWAP_32(drr.drr_type);
5085                 drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5086                 drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5087                 drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5088                 drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5089                 drrb->drr_type = BSWAP_32(drrb->drr_type);
5090                 drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5091                 drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5092                 drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5093         }
5094
5095         if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5096                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5097                     "stream (bad magic number)"));
5098                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5099         }
5100
5101         featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5102         hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5103
5104         if (!DMU_STREAM_SUPPORTED(featureflags) ||
5105             (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5106                 /*
5107                  * Let's be explicit about this one, since rather than
5108                  * being a new feature we can't know, it's an old
5109                  * feature we dropped.
5110                  */
5111                 if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5112                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5113                             "stream has deprecated feature: dedup, try "
5114                             "'zstream redup [send in a file] | zfs recv "
5115                             "[...]'"));
5116                 } else {
5117                         zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5118                             "stream has unsupported feature, feature flags = "
5119                             "%llx (unknown flags = %llx)"),
5120                             (u_longlong_t)featureflags,
5121                             (u_longlong_t)((featureflags) &
5122                             ~DMU_BACKUP_FEATURE_MASK));
5123                 }
5124                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5125         }
5126
5127         /* Holds feature is set once in the compound stream header. */
5128         if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5129                 flags->holds = B_TRUE;
5130
5131         if (strchr(drrb->drr_toname, '@') == NULL) {
5132                 zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5133                     "stream (bad snapshot name)"));
5134                 return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5135         }
5136
5137         if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5138                 char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5139                 if (sendfs == NULL) {
5140                         /*
5141                          * We were not called from zfs_receive_package(). Get
5142                          * the fs specified by 'zfs send'.
5143                          */
5144                         char *cp;
5145                         (void) strlcpy(nonpackage_sendfs,
5146                             drr.drr_u.drr_begin.drr_toname,
5147                             sizeof (nonpackage_sendfs));
5148                         if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5149                                 *cp = '\0';
5150                         sendfs = nonpackage_sendfs;
5151                         VERIFY(finalsnap == NULL);
5152                 }
5153                 return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5154                     &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5155                     finalsnap, cmdprops));
5156         } else {
5157                 assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5158                     DMU_COMPOUNDSTREAM);
5159                 return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5160                     &zcksum, top_zfs, cmdprops));
5161         }
5162 }
5163
5164 /*
5165  * Restores a backup of tosnap from the file descriptor specified by infd.
5166  * Return 0 on total success, -2 if some things couldn't be
5167  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5168  * (-1 will override -2, if -1 and the resumable flag was specified the
5169  * transfer can be resumed if the sending side supports it).
5170  */
5171 int
5172 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5173     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5174 {
5175         char *top_zfs = NULL;
5176         int err;
5177         struct stat sb;
5178         char *originsnap = NULL;
5179
5180         /*
5181          * The only way fstat can fail is if we do not have a valid file
5182          * descriptor.
5183          */
5184         if (fstat(infd, &sb) == -1) {
5185                 perror("fstat");
5186                 return (-2);
5187         }
5188
5189         /*
5190          * It is not uncommon for gigabytes to be processed in zfs receive.
5191          * Speculatively increase the buffer size if supported by the platform.
5192          */
5193         if (S_ISFIFO(sb.st_mode))
5194                 libzfs_set_pipe_max(infd);
5195
5196         if (props) {
5197                 err = nvlist_lookup_string(props, "origin", &originsnap);
5198                 if (err && err != ENOENT)
5199                         return (err);
5200         }
5201
5202         err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5203             stream_avl, &top_zfs, NULL, props);
5204
5205         if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5206                 zfs_handle_t *zhp = NULL;
5207                 prop_changelist_t *clp = NULL;
5208
5209                 zhp = zfs_open(hdl, top_zfs,
5210                     ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5211                 if (zhp == NULL) {
5212                         err = -1;
5213                         goto out;
5214                 } else {
5215                         if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5216                                 zfs_close(zhp);
5217                                 goto out;
5218                         }
5219
5220                         clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5221                             CL_GATHER_MOUNT_ALWAYS,
5222                             flags->forceunmount ? MS_FORCE : 0);
5223                         zfs_close(zhp);
5224                         if (clp == NULL) {
5225                                 err = -1;
5226                                 goto out;
5227                         }
5228
5229                         /* mount and share received datasets */
5230                         err = changelist_postfix(clp);
5231                         changelist_free(clp);
5232                         if (err != 0)
5233                                 err = -1;
5234                 }
5235         }
5236
5237 out:
5238         if (top_zfs)
5239                 free(top_zfs);
5240
5241         return (err);
5242 }