xref: /freebsd/sys/contrib/openzfs/lib/libzfs/libzfs_sendrecv.c (revision 7ef62cebc2f965b0f640263e179276928885e33d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
27  * All rights reserved
28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
32  * Copyright (c) 2019 Datto Inc.
33  */
34 
35 #include <assert.h>
36 #include <ctype.h>
37 #include <errno.h>
38 #include <libintl.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <unistd.h>
43 #include <stddef.h>
44 #include <fcntl.h>
45 #include <sys/mount.h>
46 #include <sys/mntent.h>
47 #include <sys/mnttab.h>
48 #include <sys/avl.h>
49 #include <sys/debug.h>
50 #include <sys/stat.h>
51 #include <pthread.h>
52 #include <umem.h>
53 #include <time.h>
54 
55 #include <libzfs.h>
56 #include <libzfs_core.h>
57 #include <libzutil.h>
58 
59 #include "zfs_namecheck.h"
60 #include "zfs_prop.h"
61 #include "zfs_fletcher.h"
62 #include "libzfs_impl.h"
63 #include <cityhash.h>
64 #include <zlib.h>
65 #include <sys/zio_checksum.h>
66 #include <sys/dsl_crypt.h>
67 #include <sys/ddt.h>
68 #include <sys/socket.h>
69 #include <sys/sha2.h>
70 
71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
73     const char *, nvlist_t *);
74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
76     uint64_t num_redact_snaps, char *name);
77 static int guid_to_name(libzfs_handle_t *, const char *,
78     uint64_t, boolean_t, char *);
79 
80 typedef struct progress_arg {
81 	zfs_handle_t *pa_zhp;
82 	int pa_fd;
83 	boolean_t pa_parsable;
84 	boolean_t pa_estimate;
85 	int pa_verbosity;
86 	boolean_t pa_astitle;
87 	boolean_t pa_progress;
88 	uint64_t pa_size;
89 } progress_arg_t;
90 
91 static int
92 dump_record(dmu_replay_record_t *drr, void *payload, size_t payload_len,
93     zio_cksum_t *zc, int outfd)
94 {
95 	ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
96 	    ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
97 	fletcher_4_incremental_native(drr,
98 	    offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
99 	if (drr->drr_type != DRR_BEGIN) {
100 		ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
101 		    drr_checksum.drr_checksum));
102 		drr->drr_u.drr_checksum.drr_checksum = *zc;
103 	}
104 	fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
105 	    sizeof (zio_cksum_t), zc);
106 	if (write(outfd, drr, sizeof (*drr)) == -1)
107 		return (errno);
108 	if (payload_len != 0) {
109 		fletcher_4_incremental_native(payload, payload_len, zc);
110 		if (write(outfd, payload, payload_len) == -1)
111 			return (errno);
112 	}
113 	return (0);
114 }
115 
116 /*
117  * Routines for dealing with the AVL tree of fs-nvlists
118  */
119 typedef struct fsavl_node {
120 	avl_node_t fn_node;
121 	nvlist_t *fn_nvfs;
122 	const char *fn_snapname;
123 	uint64_t fn_guid;
124 } fsavl_node_t;
125 
126 static int
127 fsavl_compare(const void *arg1, const void *arg2)
128 {
129 	const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
130 	const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
131 
132 	return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
133 }
134 
135 /*
136  * Given the GUID of a snapshot, find its containing filesystem and
137  * (optionally) name.
138  */
139 static nvlist_t *
140 fsavl_find(avl_tree_t *avl, uint64_t snapguid, const char **snapname)
141 {
142 	fsavl_node_t fn_find;
143 	fsavl_node_t *fn;
144 
145 	fn_find.fn_guid = snapguid;
146 
147 	fn = avl_find(avl, &fn_find, NULL);
148 	if (fn) {
149 		if (snapname)
150 			*snapname = fn->fn_snapname;
151 		return (fn->fn_nvfs);
152 	}
153 	return (NULL);
154 }
155 
156 static void
157 fsavl_destroy(avl_tree_t *avl)
158 {
159 	fsavl_node_t *fn;
160 	void *cookie;
161 
162 	if (avl == NULL)
163 		return;
164 
165 	cookie = NULL;
166 	while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
167 		free(fn);
168 	avl_destroy(avl);
169 	free(avl);
170 }
171 
172 /*
173  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
174  */
175 static avl_tree_t *
176 fsavl_create(nvlist_t *fss)
177 {
178 	avl_tree_t *fsavl;
179 	nvpair_t *fselem = NULL;
180 
181 	if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
182 		return (NULL);
183 
184 	avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
185 	    offsetof(fsavl_node_t, fn_node));
186 
187 	while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
188 		nvlist_t *nvfs, *snaps;
189 		nvpair_t *snapelem = NULL;
190 
191 		nvfs = fnvpair_value_nvlist(fselem);
192 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
193 
194 		while ((snapelem =
195 		    nvlist_next_nvpair(snaps, snapelem)) != NULL) {
196 			fsavl_node_t *fn;
197 
198 			if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
199 				fsavl_destroy(fsavl);
200 				return (NULL);
201 			}
202 			fn->fn_nvfs = nvfs;
203 			fn->fn_snapname = nvpair_name(snapelem);
204 			fn->fn_guid = fnvpair_value_uint64(snapelem);
205 
206 			/*
207 			 * Note: if there are multiple snaps with the
208 			 * same GUID, we ignore all but one.
209 			 */
210 			avl_index_t where = 0;
211 			if (avl_find(fsavl, fn, &where) == NULL)
212 				avl_insert(fsavl, fn, where);
213 			else
214 				free(fn);
215 		}
216 	}
217 
218 	return (fsavl);
219 }
220 
221 /*
222  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
223  */
224 typedef struct send_data {
225 	/*
226 	 * assigned inside every recursive call,
227 	 * restored from *_save on return:
228 	 *
229 	 * guid of fromsnap snapshot in parent dataset
230 	 * txg of fromsnap snapshot in current dataset
231 	 * txg of tosnap snapshot in current dataset
232 	 */
233 
234 	uint64_t parent_fromsnap_guid;
235 	uint64_t fromsnap_txg;
236 	uint64_t tosnap_txg;
237 
238 	/* the nvlists get accumulated during depth-first traversal */
239 	nvlist_t *parent_snaps;
240 	nvlist_t *fss;
241 	nvlist_t *snapprops;
242 	nvlist_t *snapholds;	/* user holds */
243 
244 	/* send-receive configuration, does not change during traversal */
245 	const char *fsname;
246 	const char *fromsnap;
247 	const char *tosnap;
248 	boolean_t recursive;
249 	boolean_t raw;
250 	boolean_t doall;
251 	boolean_t replicate;
252 	boolean_t skipmissing;
253 	boolean_t verbose;
254 	boolean_t backup;
255 	boolean_t seenfrom;
256 	boolean_t seento;
257 	boolean_t holds;	/* were holds requested with send -h */
258 	boolean_t props;
259 
260 	/*
261 	 * The header nvlist is of the following format:
262 	 * {
263 	 *   "tosnap" -> string
264 	 *   "fromsnap" -> string (if incremental)
265 	 *   "fss" -> {
266 	 *	id -> {
267 	 *
268 	 *	 "name" -> string (full name; for debugging)
269 	 *	 "parentfromsnap" -> number (guid of fromsnap in parent)
270 	 *
271 	 *	 "props" -> { name -> value (only if set here) }
272 	 *	 "snaps" -> { name (lastname) -> number (guid) }
273 	 *	 "snapprops" -> { name (lastname) -> { name -> value } }
274 	 *	 "snapholds" -> { name (lastname) -> { holdname -> crtime } }
275 	 *
276 	 *	 "origin" -> number (guid) (if clone)
277 	 *	 "is_encroot" -> boolean
278 	 *	 "sent" -> boolean (not on-disk)
279 	 *	}
280 	 *   }
281 	 * }
282 	 *
283 	 */
284 } send_data_t;
285 
286 static void
287 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
288 
289 /*
290  * Collect guid, valid props, optionally holds, etc. of a snapshot.
291  * This interface is intended for use as a zfs_iter_snapshots_v2_sorted visitor.
292  */
293 static int
294 send_iterate_snap(zfs_handle_t *zhp, void *arg)
295 {
296 	send_data_t *sd = arg;
297 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
298 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
299 	boolean_t isfromsnap, istosnap, istosnapwithnofrom;
300 	char *snapname;
301 	const char *from = sd->fromsnap;
302 	const char *to = sd->tosnap;
303 
304 	snapname = strrchr(zhp->zfs_name, '@');
305 	assert(snapname != NULL);
306 	++snapname;
307 
308 	isfromsnap = (from != NULL && strcmp(from, snapname) == 0);
309 	istosnap = (to != NULL && strcmp(to, snapname) == 0);
310 	istosnapwithnofrom = (istosnap && from == NULL);
311 
312 	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
313 		if (sd->verbose) {
314 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
315 			    "skipping snapshot %s because it was created "
316 			    "after the destination snapshot (%s)\n"),
317 			    zhp->zfs_name, to);
318 		}
319 		zfs_close(zhp);
320 		return (0);
321 	}
322 
323 	fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
324 
325 	/*
326 	 * NB: if there is no fromsnap here (it's a newly created fs in
327 	 * an incremental replication), we will substitute the tosnap.
328 	 */
329 	if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap))
330 		sd->parent_fromsnap_guid = guid;
331 
332 	if (!sd->recursive) {
333 		/*
334 		 * To allow a doall stream to work properly
335 		 * with a NULL fromsnap
336 		 */
337 		if (sd->doall && from == NULL && !sd->seenfrom)
338 			sd->seenfrom = B_TRUE;
339 
340 		if (!sd->seenfrom && isfromsnap) {
341 			sd->seenfrom = B_TRUE;
342 			zfs_close(zhp);
343 			return (0);
344 		}
345 
346 		if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
347 			zfs_close(zhp);
348 			return (0);
349 		}
350 
351 		if (istosnap)
352 			sd->seento = B_TRUE;
353 	}
354 
355 	nvlist_t *nv = fnvlist_alloc();
356 	send_iterate_prop(zhp, sd->backup, nv);
357 	fnvlist_add_nvlist(sd->snapprops, snapname, nv);
358 	fnvlist_free(nv);
359 
360 	if (sd->holds) {
361 		nvlist_t *holds;
362 		if (lzc_get_holds(zhp->zfs_name, &holds) == 0) {
363 			fnvlist_add_nvlist(sd->snapholds, snapname, holds);
364 			fnvlist_free(holds);
365 		}
366 	}
367 
368 	zfs_close(zhp);
369 	return (0);
370 }
371 
372 /*
373  * Collect all valid props from the handle snap into an nvlist.
374  */
375 static void
376 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
377 {
378 	nvlist_t *props;
379 
380 	if (received_only)
381 		props = zfs_get_recvd_props(zhp);
382 	else
383 		props = zhp->zfs_props;
384 
385 	nvpair_t *elem = NULL;
386 	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
387 		const char *propname = nvpair_name(elem);
388 		zfs_prop_t prop = zfs_name_to_prop(propname);
389 
390 		if (!zfs_prop_user(propname)) {
391 			/*
392 			 * Realistically, this should never happen.  However,
393 			 * we want the ability to add DSL properties without
394 			 * needing to make incompatible version changes.  We
395 			 * need to ignore unknown properties to allow older
396 			 * software to still send datasets containing these
397 			 * properties, with the unknown properties elided.
398 			 */
399 			if (prop == ZPROP_INVAL)
400 				continue;
401 
402 			if (zfs_prop_readonly(prop))
403 				continue;
404 		}
405 
406 		nvlist_t *propnv = fnvpair_value_nvlist(elem);
407 
408 		boolean_t isspacelimit = (prop == ZFS_PROP_QUOTA ||
409 		    prop == ZFS_PROP_RESERVATION ||
410 		    prop == ZFS_PROP_REFQUOTA ||
411 		    prop == ZFS_PROP_REFRESERVATION);
412 		if (isspacelimit && zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
413 			continue;
414 
415 		const char *source;
416 		if (nvlist_lookup_string(propnv, ZPROP_SOURCE, &source) == 0) {
417 			if (strcmp(source, zhp->zfs_name) != 0 &&
418 			    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
419 				continue;
420 		} else {
421 			/*
422 			 * May have no source before SPA_VERSION_RECVD_PROPS,
423 			 * but is still modifiable.
424 			 */
425 			if (!isspacelimit)
426 				continue;
427 		}
428 
429 		if (zfs_prop_user(propname) ||
430 		    zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
431 			const char *value;
432 			value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
433 			fnvlist_add_string(nv, propname, value);
434 		} else {
435 			uint64_t value;
436 			value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
437 			fnvlist_add_uint64(nv, propname, value);
438 		}
439 	}
440 }
441 
442 /*
443  * returns snapshot guid
444  * and returns 0 if the snapshot does not exist
445  */
446 static uint64_t
447 get_snap_guid(libzfs_handle_t *hdl, const char *fs, const char *snap)
448 {
449 	char name[MAXPATHLEN + 1];
450 	uint64_t guid = 0;
451 
452 	if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
453 		return (guid);
454 
455 	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
456 	zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
457 	if (zhp != NULL) {
458 		guid = zfs_prop_get_int(zhp, ZFS_PROP_GUID);
459 		zfs_close(zhp);
460 	}
461 
462 	return (guid);
463 }
464 
465 /*
466  * returns snapshot creation txg
467  * and returns 0 if the snapshot does not exist
468  */
469 static uint64_t
470 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
471 {
472 	char name[ZFS_MAX_DATASET_NAME_LEN];
473 	uint64_t txg = 0;
474 
475 	if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
476 		return (txg);
477 
478 	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
479 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
480 		zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
481 		if (zhp != NULL) {
482 			txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
483 			zfs_close(zhp);
484 		}
485 	}
486 
487 	return (txg);
488 }
489 
490 /*
491  * Recursively generate nvlists describing datasets.  See comment
492  * for the data structure send_data_t above for description of contents
493  * of the nvlist.
494  */
495 static int
496 send_iterate_fs(zfs_handle_t *zhp, void *arg)
497 {
498 	send_data_t *sd = arg;
499 	nvlist_t *nvfs = NULL, *nv = NULL;
500 	int rv = 0;
501 	uint64_t min_txg = 0, max_txg = 0;
502 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
503 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
504 	uint64_t fromsnap_txg, tosnap_txg;
505 	char guidstring[64];
506 
507 	/* These fields are restored on return from a recursive call. */
508 	uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
509 	uint64_t fromsnap_txg_save = sd->fromsnap_txg;
510 	uint64_t tosnap_txg_save = sd->tosnap_txg;
511 
512 	fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
513 	if (fromsnap_txg != 0)
514 		sd->fromsnap_txg = fromsnap_txg;
515 
516 	tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
517 	if (tosnap_txg != 0)
518 		sd->tosnap_txg = tosnap_txg;
519 
520 	/*
521 	 * On the send side, if the current dataset does not have tosnap,
522 	 * perform two additional checks:
523 	 *
524 	 * - Skip sending the current dataset if it was created later than
525 	 *   the parent tosnap.
526 	 * - Return error if the current dataset was created earlier than
527 	 *   the parent tosnap, unless --skip-missing specified. Then
528 	 *   just print a warning.
529 	 */
530 	if (sd->tosnap != NULL && tosnap_txg == 0) {
531 		if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
532 			if (sd->verbose) {
533 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
534 				    "skipping dataset %s: snapshot %s does "
535 				    "not exist\n"), zhp->zfs_name, sd->tosnap);
536 			}
537 		} else if (sd->skipmissing) {
538 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
539 			    "WARNING: skipping dataset %s and its children:"
540 			    " snapshot %s does not exist\n"),
541 			    zhp->zfs_name, sd->tosnap);
542 		} else {
543 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
544 			    "cannot send %s@%s%s: snapshot %s@%s does not "
545 			    "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
546 			    dgettext(TEXT_DOMAIN, " recursively") : "",
547 			    zhp->zfs_name, sd->tosnap);
548 			rv = EZFS_NOENT;
549 		}
550 		goto out;
551 	}
552 
553 	nvfs = fnvlist_alloc();
554 	fnvlist_add_string(nvfs, "name", zhp->zfs_name);
555 	fnvlist_add_uint64(nvfs, "parentfromsnap", sd->parent_fromsnap_guid);
556 
557 	if (zhp->zfs_dmustats.dds_origin[0] != '\0') {
558 		zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
559 		    zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
560 		if (origin == NULL) {
561 			rv = -1;
562 			goto out;
563 		}
564 		fnvlist_add_uint64(nvfs, "origin",
565 		    origin->zfs_dmustats.dds_guid);
566 		zfs_close(origin);
567 	}
568 
569 	/* Iterate over props. */
570 	if (sd->props || sd->backup || sd->recursive) {
571 		nv = fnvlist_alloc();
572 		send_iterate_prop(zhp, sd->backup, nv);
573 		fnvlist_add_nvlist(nvfs, "props", nv);
574 	}
575 	if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
576 		boolean_t encroot;
577 
578 		/* Determine if this dataset is an encryption root. */
579 		if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
580 			rv = -1;
581 			goto out;
582 		}
583 
584 		if (encroot)
585 			fnvlist_add_boolean(nvfs, "is_encroot");
586 
587 		/*
588 		 * Encrypted datasets can only be sent with properties if
589 		 * the raw flag is specified because the receive side doesn't
590 		 * currently have a mechanism for recursively asking the user
591 		 * for new encryption parameters.
592 		 */
593 		if (!sd->raw) {
594 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
595 			    "cannot send %s@%s: encrypted dataset %s may not "
596 			    "be sent with properties without the raw flag\n"),
597 			    sd->fsname, sd->tosnap, zhp->zfs_name);
598 			rv = -1;
599 			goto out;
600 		}
601 
602 	}
603 
604 	/*
605 	 * Iterate over snaps, and set sd->parent_fromsnap_guid.
606 	 *
607 	 * If this is a "doall" send, a replicate send or we're just trying
608 	 * to gather a list of previous snapshots, iterate through all the
609 	 * snaps in the txg range. Otherwise just look at the one we're
610 	 * interested in.
611 	 */
612 	sd->parent_fromsnap_guid = 0;
613 	sd->parent_snaps = fnvlist_alloc();
614 	sd->snapprops = fnvlist_alloc();
615 	if (sd->holds)
616 		sd->snapholds = fnvlist_alloc();
617 	if (sd->doall || sd->replicate || sd->tosnap == NULL) {
618 		if (!sd->replicate && fromsnap_txg != 0)
619 			min_txg = fromsnap_txg;
620 		if (!sd->replicate && tosnap_txg != 0)
621 			max_txg = tosnap_txg;
622 		(void) zfs_iter_snapshots_sorted_v2(zhp, 0, send_iterate_snap,
623 		    sd, min_txg, max_txg);
624 	} else {
625 		char snapname[MAXPATHLEN] = { 0 };
626 		zfs_handle_t *snap;
627 
628 		(void) snprintf(snapname, sizeof (snapname), "%s@%s",
629 		    zhp->zfs_name, sd->tosnap);
630 		if (sd->fromsnap != NULL)
631 			sd->seenfrom = B_TRUE;
632 		snap = zfs_open(zhp->zfs_hdl, snapname, ZFS_TYPE_SNAPSHOT);
633 		if (snap != NULL)
634 			(void) send_iterate_snap(snap, sd);
635 	}
636 
637 	fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
638 	fnvlist_free(sd->parent_snaps);
639 	fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
640 	fnvlist_free(sd->snapprops);
641 	if (sd->holds) {
642 		fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
643 		fnvlist_free(sd->snapholds);
644 	}
645 
646 	/* Do not allow the size of the properties list to exceed the limit */
647 	if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
648 	    zhp->zfs_hdl->libzfs_max_nvlist) {
649 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
650 		    "warning: cannot send %s@%s: the size of the list of "
651 		    "snapshots and properties is too large to be received "
652 		    "successfully.\n"
653 		    "Select a smaller number of snapshots to send.\n"),
654 		    zhp->zfs_name, sd->tosnap);
655 		rv = EZFS_NOSPC;
656 		goto out;
657 	}
658 	/* Add this fs to nvlist. */
659 	(void) snprintf(guidstring, sizeof (guidstring),
660 	    "0x%llx", (longlong_t)guid);
661 	fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
662 
663 	/* Iterate over children. */
664 	if (sd->recursive)
665 		rv = zfs_iter_filesystems_v2(zhp, 0, send_iterate_fs, sd);
666 
667 out:
668 	/* Restore saved fields. */
669 	sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
670 	sd->fromsnap_txg = fromsnap_txg_save;
671 	sd->tosnap_txg = tosnap_txg_save;
672 
673 	fnvlist_free(nv);
674 	fnvlist_free(nvfs);
675 
676 	zfs_close(zhp);
677 	return (rv);
678 }
679 
680 static int
681 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
682     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
683     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
684     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
685     avl_tree_t **avlp)
686 {
687 	zfs_handle_t *zhp;
688 	send_data_t sd = { 0 };
689 	int error;
690 
691 	zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
692 	if (zhp == NULL)
693 		return (EZFS_BADTYPE);
694 
695 	sd.fss = fnvlist_alloc();
696 	sd.fsname = fsname;
697 	sd.fromsnap = fromsnap;
698 	sd.tosnap = tosnap;
699 	sd.recursive = recursive;
700 	sd.raw = raw;
701 	sd.doall = doall;
702 	sd.replicate = replicate;
703 	sd.skipmissing = skipmissing;
704 	sd.verbose = verbose;
705 	sd.backup = backup;
706 	sd.holds = holds;
707 	sd.props = props;
708 
709 	if ((error = send_iterate_fs(zhp, &sd)) != 0) {
710 		fnvlist_free(sd.fss);
711 		if (avlp != NULL)
712 			*avlp = NULL;
713 		*nvlp = NULL;
714 		return (error);
715 	}
716 
717 	if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
718 		fnvlist_free(sd.fss);
719 		*nvlp = NULL;
720 		return (EZFS_NOMEM);
721 	}
722 
723 	*nvlp = sd.fss;
724 	return (0);
725 }
726 
727 /*
728  * Routines specific to "zfs send"
729  */
730 typedef struct send_dump_data {
731 	/* these are all just the short snapname (the part after the @) */
732 	const char *fromsnap;
733 	const char *tosnap;
734 	char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
735 	uint64_t prevsnap_obj;
736 	boolean_t seenfrom, seento, replicate, doall, fromorigin;
737 	boolean_t dryrun, parsable, progress, embed_data, std_out;
738 	boolean_t large_block, compress, raw, holds;
739 	boolean_t progressastitle;
740 	int outfd;
741 	boolean_t err;
742 	nvlist_t *fss;
743 	nvlist_t *snapholds;
744 	avl_tree_t *fsavl;
745 	snapfilter_cb_t *filter_cb;
746 	void *filter_cb_arg;
747 	nvlist_t *debugnv;
748 	char holdtag[ZFS_MAX_DATASET_NAME_LEN];
749 	int cleanup_fd;
750 	int verbosity;
751 	uint64_t size;
752 } send_dump_data_t;
753 
754 static int
755 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
756     enum lzc_send_flags flags, uint64_t *spacep)
757 {
758 	assert(snapname != NULL);
759 
760 	int error = lzc_send_space(snapname, from, flags, spacep);
761 	if (error == 0)
762 		return (0);
763 
764 	char errbuf[ERRBUFLEN];
765 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
766 	    "warning: cannot estimate space for '%s'"), snapname);
767 
768 	libzfs_handle_t *hdl = zhp->zfs_hdl;
769 	switch (error) {
770 	case EXDEV:
771 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
772 		    "not an earlier snapshot from the same fs"));
773 		return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
774 
775 	case ENOENT:
776 		if (zfs_dataset_exists(hdl, snapname,
777 		    ZFS_TYPE_SNAPSHOT)) {
778 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
779 			    "incremental source (%s) does not exist"),
780 			    snapname);
781 		}
782 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
783 
784 	case EDQUOT:
785 	case EFBIG:
786 	case EIO:
787 	case ENOLINK:
788 	case ENOSPC:
789 	case ENOSTR:
790 	case ENXIO:
791 	case EPIPE:
792 	case ERANGE:
793 	case EFAULT:
794 	case EROFS:
795 	case EINVAL:
796 		zfs_error_aux(hdl, "%s", strerror(error));
797 		return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
798 
799 	default:
800 		return (zfs_standard_error(hdl, error, errbuf));
801 	}
802 }
803 
804 /*
805  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
806  * NULL) to the file descriptor specified by outfd.
807  */
808 static int
809 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
810     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
811     nvlist_t *debugnv)
812 {
813 	zfs_cmd_t zc = {"\0"};
814 	libzfs_handle_t *hdl = zhp->zfs_hdl;
815 	nvlist_t *thisdbg;
816 
817 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
818 	assert(fromsnap_obj == 0 || !fromorigin);
819 
820 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
821 	zc.zc_cookie = outfd;
822 	zc.zc_obj = fromorigin;
823 	zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
824 	zc.zc_fromobj = fromsnap_obj;
825 	zc.zc_flags = flags;
826 
827 	if (debugnv != NULL) {
828 		thisdbg = fnvlist_alloc();
829 		if (fromsnap != NULL && fromsnap[0] != '\0')
830 			fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
831 	}
832 
833 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
834 		char errbuf[ERRBUFLEN];
835 		int error = errno;
836 
837 		(void) snprintf(errbuf, sizeof (errbuf), "%s '%s'",
838 		    dgettext(TEXT_DOMAIN, "warning: cannot send"),
839 		    zhp->zfs_name);
840 
841 		if (debugnv != NULL) {
842 			fnvlist_add_uint64(thisdbg, "error", error);
843 			fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
844 			fnvlist_free(thisdbg);
845 		}
846 
847 		switch (error) {
848 		case EXDEV:
849 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
850 			    "not an earlier snapshot from the same fs"));
851 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
852 
853 		case EACCES:
854 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
855 			    "source key must be loaded"));
856 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
857 
858 		case ENOENT:
859 			if (zfs_dataset_exists(hdl, zc.zc_name,
860 			    ZFS_TYPE_SNAPSHOT)) {
861 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
862 				    "incremental source (@%s) does not exist"),
863 				    zc.zc_value);
864 			}
865 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
866 
867 		case EDQUOT:
868 		case EFBIG:
869 		case EIO:
870 		case ENOLINK:
871 		case ENOSPC:
872 		case ENOSTR:
873 		case ENXIO:
874 		case EPIPE:
875 		case ERANGE:
876 		case EFAULT:
877 		case EROFS:
878 		case EINVAL:
879 			zfs_error_aux(hdl, "%s", strerror(errno));
880 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
881 
882 		default:
883 			return (zfs_standard_error(hdl, errno, errbuf));
884 		}
885 	}
886 
887 	if (debugnv != NULL) {
888 		fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
889 		fnvlist_free(thisdbg);
890 	}
891 
892 	return (0);
893 }
894 
895 static void
896 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
897 {
898 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
899 
900 	/*
901 	 * zfs_send() only sets snapholds for sends that need them,
902 	 * e.g. replication and doall.
903 	 */
904 	if (sdd->snapholds == NULL)
905 		return;
906 
907 	fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
908 }
909 
910 int
911 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
912     uint64_t *blocks_visited)
913 {
914 	zfs_cmd_t zc = {"\0"};
915 
916 	if (bytes_written != NULL)
917 		*bytes_written = 0;
918 	if (blocks_visited != NULL)
919 		*blocks_visited = 0;
920 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
921 	zc.zc_cookie = fd;
922 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
923 		return (errno);
924 	if (bytes_written != NULL)
925 		*bytes_written = zc.zc_cookie;
926 	if (blocks_visited != NULL)
927 		*blocks_visited = zc.zc_objset_type;
928 	return (0);
929 }
930 
931 static void *
932 send_progress_thread(void *arg)
933 {
934 	progress_arg_t *pa = arg;
935 	zfs_handle_t *zhp = pa->pa_zhp;
936 	uint64_t bytes;
937 	uint64_t blocks;
938 	uint64_t total = pa->pa_size / 100;
939 	char buf[16];
940 	time_t t;
941 	struct tm tm;
942 	int err;
943 
944 	if (!pa->pa_parsable && pa->pa_progress) {
945 		(void) fprintf(stderr,
946 		    "TIME       %s   %sSNAPSHOT %s\n",
947 		    pa->pa_estimate ? "BYTES" : " SENT",
948 		    pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
949 		    zhp->zfs_name);
950 	}
951 
952 	/*
953 	 * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
954 	 */
955 	for (;;) {
956 		(void) sleep(1);
957 		if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
958 		    &blocks)) != 0) {
959 			if (err == EINTR || err == ENOENT)
960 				return ((void *)0);
961 			return ((void *)(uintptr_t)err);
962 		}
963 
964 		(void) time(&t);
965 		localtime_r(&t, &tm);
966 
967 		if (pa->pa_astitle) {
968 			char buf_bytes[16];
969 			char buf_size[16];
970 			int pct;
971 			zfs_nicenum(bytes, buf_bytes, sizeof (buf_bytes));
972 			zfs_nicenum(pa->pa_size, buf_size, sizeof (buf_size));
973 			pct = (total > 0) ? bytes / total : 100;
974 			zfs_setproctitle("sending %s (%d%%: %s/%s)",
975 			    zhp->zfs_name, MIN(pct, 100), buf_bytes, buf_size);
976 		}
977 
978 		if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
979 			(void) fprintf(stderr,
980 			    "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
981 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
982 			    (u_longlong_t)bytes, (u_longlong_t)blocks,
983 			    zhp->zfs_name);
984 		} else if (pa->pa_verbosity >= 2) {
985 			zfs_nicenum(bytes, buf, sizeof (buf));
986 			(void) fprintf(stderr,
987 			    "%02d:%02d:%02d   %5s    %8llu    %s\n",
988 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
989 			    buf, (u_longlong_t)blocks, zhp->zfs_name);
990 		} else if (pa->pa_parsable) {
991 			(void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
992 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
993 			    (u_longlong_t)bytes, zhp->zfs_name);
994 		} else if (pa->pa_progress) {
995 			zfs_nicebytes(bytes, buf, sizeof (buf));
996 			(void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
997 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
998 			    buf, zhp->zfs_name);
999 		}
1000 	}
1001 }
1002 
1003 static boolean_t
1004 send_progress_thread_exit(libzfs_handle_t *hdl, pthread_t ptid)
1005 {
1006 	void *status = NULL;
1007 	(void) pthread_cancel(ptid);
1008 	(void) pthread_join(ptid, &status);
1009 	int error = (int)(uintptr_t)status;
1010 	if (error != 0 && status != PTHREAD_CANCELED)
1011 		return (zfs_standard_error(hdl, error,
1012 		    dgettext(TEXT_DOMAIN, "progress thread exited nonzero")));
1013 	else
1014 		return (B_FALSE);
1015 }
1016 
1017 static void
1018 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
1019     uint64_t size, boolean_t parsable)
1020 {
1021 	if (parsable) {
1022 		if (fromsnap != NULL) {
1023 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1024 			    "incremental\t%s\t%s"), fromsnap, tosnap);
1025 		} else {
1026 /*
1027  * Workaround for GCC 12+ with UBSan enabled deficencies.
1028  *
1029  * GCC 12+ invoked with -fsanitize=undefined incorrectly reports the code
1030  * below as violating -Wformat-overflow.
1031  */
1032 #if defined(__GNUC__) && !defined(__clang__) && \
1033 	defined(ZFS_UBSAN_ENABLED) && defined(HAVE_FORMAT_OVERFLOW)
1034 #pragma GCC diagnostic push
1035 #pragma GCC diagnostic ignored "-Wformat-overflow"
1036 #endif
1037 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1038 			    "full\t%s"), tosnap);
1039 #if defined(__GNUC__) && !defined(__clang__) && \
1040 	defined(ZFS_UBSAN_ENABLED) && defined(HAVE_FORMAT_OVERFLOW)
1041 #pragma GCC diagnostic pop
1042 #endif
1043 		}
1044 		(void) fprintf(fout, "\t%llu", (longlong_t)size);
1045 	} else {
1046 		if (fromsnap != NULL) {
1047 			if (strchr(fromsnap, '@') == NULL &&
1048 			    strchr(fromsnap, '#') == NULL) {
1049 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1050 				    "send from @%s to %s"), fromsnap, tosnap);
1051 			} else {
1052 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1053 				    "send from %s to %s"), fromsnap, tosnap);
1054 			}
1055 		} else {
1056 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1057 			    "full send of %s"), tosnap);
1058 		}
1059 		if (size != 0) {
1060 			char buf[16];
1061 			zfs_nicebytes(size, buf, sizeof (buf));
1062 /*
1063  * Workaround for GCC 12+ with UBSan enabled deficencies.
1064  *
1065  * GCC 12+ invoked with -fsanitize=undefined incorrectly reports the code
1066  * below as violating -Wformat-overflow.
1067  */
1068 #if defined(__GNUC__) && !defined(__clang__) && \
1069 	defined(ZFS_UBSAN_ENABLED) && defined(HAVE_FORMAT_OVERFLOW)
1070 #pragma GCC diagnostic push
1071 #pragma GCC diagnostic ignored "-Wformat-overflow"
1072 #endif
1073 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1074 			    " estimated size is %s"), buf);
1075 #if defined(__GNUC__) && !defined(__clang__) && \
1076 	defined(ZFS_UBSAN_ENABLED) && defined(HAVE_FORMAT_OVERFLOW)
1077 #pragma GCC diagnostic pop
1078 #endif
1079 		}
1080 	}
1081 	(void) fprintf(fout, "\n");
1082 }
1083 
1084 /*
1085  * Send a single filesystem snapshot, updating the send dump data.
1086  * This interface is intended for use as a zfs_iter_snapshots_v2_sorted visitor.
1087  */
1088 static int
1089 dump_snapshot(zfs_handle_t *zhp, void *arg)
1090 {
1091 	send_dump_data_t *sdd = arg;
1092 	progress_arg_t pa = { 0 };
1093 	pthread_t tid;
1094 	char *thissnap;
1095 	enum lzc_send_flags flags = 0;
1096 	int err;
1097 	boolean_t isfromsnap, istosnap, fromorigin;
1098 	boolean_t exclude = B_FALSE;
1099 	FILE *fout = sdd->std_out ? stdout : stderr;
1100 
1101 	err = 0;
1102 	thissnap = strchr(zhp->zfs_name, '@') + 1;
1103 	isfromsnap = (sdd->fromsnap != NULL &&
1104 	    strcmp(sdd->fromsnap, thissnap) == 0);
1105 
1106 	if (!sdd->seenfrom && isfromsnap) {
1107 		gather_holds(zhp, sdd);
1108 		sdd->seenfrom = B_TRUE;
1109 		(void) strlcpy(sdd->prevsnap, thissnap, sizeof (sdd->prevsnap));
1110 		sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1111 		zfs_close(zhp);
1112 		return (0);
1113 	}
1114 
1115 	if (sdd->seento || !sdd->seenfrom) {
1116 		zfs_close(zhp);
1117 		return (0);
1118 	}
1119 
1120 	istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1121 	if (istosnap)
1122 		sdd->seento = B_TRUE;
1123 
1124 	if (sdd->large_block)
1125 		flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1126 	if (sdd->embed_data)
1127 		flags |= LZC_SEND_FLAG_EMBED_DATA;
1128 	if (sdd->compress)
1129 		flags |= LZC_SEND_FLAG_COMPRESS;
1130 	if (sdd->raw)
1131 		flags |= LZC_SEND_FLAG_RAW;
1132 
1133 	if (!sdd->doall && !isfromsnap && !istosnap) {
1134 		if (sdd->replicate) {
1135 			const char *snapname;
1136 			nvlist_t *snapprops;
1137 			/*
1138 			 * Filter out all intermediate snapshots except origin
1139 			 * snapshots needed to replicate clones.
1140 			 */
1141 			nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1142 			    zhp->zfs_dmustats.dds_guid, &snapname);
1143 
1144 			if (nvfs != NULL) {
1145 				snapprops = fnvlist_lookup_nvlist(nvfs,
1146 				    "snapprops");
1147 				snapprops = fnvlist_lookup_nvlist(snapprops,
1148 				    thissnap);
1149 				exclude = !nvlist_exists(snapprops,
1150 				    "is_clone_origin");
1151 			}
1152 		} else {
1153 			exclude = B_TRUE;
1154 		}
1155 	}
1156 
1157 	/*
1158 	 * If a filter function exists, call it to determine whether
1159 	 * this snapshot will be sent.
1160 	 */
1161 	if (exclude || (sdd->filter_cb != NULL &&
1162 	    sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1163 		/*
1164 		 * This snapshot is filtered out.  Don't send it, and don't
1165 		 * set prevsnap_obj, so it will be as if this snapshot didn't
1166 		 * exist, and the next accepted snapshot will be sent as
1167 		 * an incremental from the last accepted one, or as the
1168 		 * first (and full) snapshot in the case of a replication,
1169 		 * non-incremental send.
1170 		 */
1171 		zfs_close(zhp);
1172 		return (0);
1173 	}
1174 
1175 	gather_holds(zhp, sdd);
1176 	fromorigin = sdd->prevsnap[0] == '\0' &&
1177 	    (sdd->fromorigin || sdd->replicate);
1178 
1179 	if (sdd->verbosity != 0) {
1180 		uint64_t size = 0;
1181 		char fromds[ZFS_MAX_DATASET_NAME_LEN];
1182 
1183 		if (sdd->prevsnap[0] != '\0') {
1184 			(void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1185 			*(strchr(fromds, '@') + 1) = '\0';
1186 			(void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1187 		}
1188 		if (zfs_send_space(zhp, zhp->zfs_name,
1189 		    sdd->prevsnap[0] ? fromds : NULL, flags, &size) == 0) {
1190 			send_print_verbose(fout, zhp->zfs_name,
1191 			    sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1192 			    size, sdd->parsable);
1193 			sdd->size += size;
1194 		}
1195 	}
1196 
1197 	if (!sdd->dryrun) {
1198 		/*
1199 		 * If progress reporting is requested, spawn a new thread to
1200 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1201 		 */
1202 		if (sdd->progress || sdd->progressastitle) {
1203 			pa.pa_zhp = zhp;
1204 			pa.pa_fd = sdd->outfd;
1205 			pa.pa_parsable = sdd->parsable;
1206 			pa.pa_estimate = B_FALSE;
1207 			pa.pa_verbosity = sdd->verbosity;
1208 			pa.pa_size = sdd->size;
1209 			pa.pa_astitle = sdd->progressastitle;
1210 			pa.pa_progress = sdd->progress;
1211 
1212 			if ((err = pthread_create(&tid, NULL,
1213 			    send_progress_thread, &pa)) != 0) {
1214 				zfs_close(zhp);
1215 				return (err);
1216 			}
1217 		}
1218 
1219 		err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1220 		    fromorigin, sdd->outfd, flags, sdd->debugnv);
1221 
1222 		if ((sdd->progress || sdd->progressastitle) &&
1223 		    send_progress_thread_exit(zhp->zfs_hdl, tid))
1224 			return (-1);
1225 	}
1226 
1227 	(void) strlcpy(sdd->prevsnap, thissnap, sizeof (sdd->prevsnap));
1228 	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1229 	zfs_close(zhp);
1230 	return (err);
1231 }
1232 
1233 /*
1234  * Send all snapshots for a filesystem, updating the send dump data.
1235  */
1236 static int
1237 dump_filesystem(zfs_handle_t *zhp, send_dump_data_t *sdd)
1238 {
1239 	int rv = 0;
1240 	boolean_t missingfrom = B_FALSE;
1241 	zfs_cmd_t zc = {"\0"};
1242 	uint64_t min_txg = 0, max_txg = 0;
1243 
1244 	/*
1245 	 * Make sure the tosnap exists.
1246 	 */
1247 	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1248 	    zhp->zfs_name, sdd->tosnap);
1249 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1250 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1251 		    "WARNING: could not send %s@%s: does not exist\n"),
1252 		    zhp->zfs_name, sdd->tosnap);
1253 		sdd->err = B_TRUE;
1254 		return (0);
1255 	}
1256 
1257 	/*
1258 	 * If this fs does not have fromsnap, and we're doing
1259 	 * recursive, we need to send a full stream from the
1260 	 * beginning (or an incremental from the origin if this
1261 	 * is a clone).  If we're doing non-recursive, then let
1262 	 * them get the error.
1263 	 */
1264 	if (sdd->replicate && sdd->fromsnap) {
1265 		/*
1266 		 * Make sure the fromsnap exists.
1267 		 */
1268 		(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1269 		    zhp->zfs_name, sdd->fromsnap);
1270 		if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0)
1271 			missingfrom = B_TRUE;
1272 	}
1273 
1274 	sdd->seenfrom = sdd->seento = B_FALSE;
1275 	sdd->prevsnap[0] = '\0';
1276 	sdd->prevsnap_obj = 0;
1277 	if (sdd->fromsnap == NULL || missingfrom)
1278 		sdd->seenfrom = B_TRUE;
1279 
1280 	/*
1281 	 * Iterate through all snapshots and process the ones we will be
1282 	 * sending. If we only have a "from" and "to" snapshot to deal
1283 	 * with, we can avoid iterating through all the other snapshots.
1284 	 */
1285 	if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1286 		if (!sdd->replicate) {
1287 			if (sdd->fromsnap != NULL) {
1288 				min_txg = get_snap_txg(zhp->zfs_hdl,
1289 				    zhp->zfs_name, sdd->fromsnap);
1290 			}
1291 			if (sdd->tosnap != NULL) {
1292 				max_txg = get_snap_txg(zhp->zfs_hdl,
1293 				    zhp->zfs_name, sdd->tosnap);
1294 			}
1295 		}
1296 		rv = zfs_iter_snapshots_sorted_v2(zhp, 0, dump_snapshot, sdd,
1297 		    min_txg, max_txg);
1298 	} else {
1299 		char snapname[MAXPATHLEN] = { 0 };
1300 		zfs_handle_t *snap;
1301 
1302 		/* Dump fromsnap. */
1303 		if (!sdd->seenfrom) {
1304 			(void) snprintf(snapname, sizeof (snapname),
1305 			    "%s@%s", zhp->zfs_name, sdd->fromsnap);
1306 			snap = zfs_open(zhp->zfs_hdl, snapname,
1307 			    ZFS_TYPE_SNAPSHOT);
1308 			if (snap != NULL)
1309 				rv = dump_snapshot(snap, sdd);
1310 			else
1311 				rv = errno;
1312 		}
1313 
1314 		/* Dump tosnap. */
1315 		if (rv == 0) {
1316 			(void) snprintf(snapname, sizeof (snapname),
1317 			    "%s@%s", zhp->zfs_name, sdd->tosnap);
1318 			snap = zfs_open(zhp->zfs_hdl, snapname,
1319 			    ZFS_TYPE_SNAPSHOT);
1320 			if (snap != NULL)
1321 				rv = dump_snapshot(snap, sdd);
1322 			else
1323 				rv = errno;
1324 		}
1325 	}
1326 
1327 	if (!sdd->seenfrom) {
1328 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1329 		    "WARNING: could not send %s@%s:\n"
1330 		    "incremental source (%s@%s) does not exist\n"),
1331 		    zhp->zfs_name, sdd->tosnap,
1332 		    zhp->zfs_name, sdd->fromsnap);
1333 		sdd->err = B_TRUE;
1334 	} else if (!sdd->seento) {
1335 		if (sdd->fromsnap) {
1336 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1337 			    "WARNING: could not send %s@%s:\n"
1338 			    "incremental source (%s@%s) "
1339 			    "is not earlier than it\n"),
1340 			    zhp->zfs_name, sdd->tosnap,
1341 			    zhp->zfs_name, sdd->fromsnap);
1342 		} else {
1343 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1344 			    "WARNING: "
1345 			    "could not send %s@%s: does not exist\n"),
1346 			    zhp->zfs_name, sdd->tosnap);
1347 		}
1348 		sdd->err = B_TRUE;
1349 	}
1350 
1351 	return (rv);
1352 }
1353 
1354 /*
1355  * Send all snapshots for all filesystems in sdd.
1356  */
1357 static int
1358 dump_filesystems(zfs_handle_t *rzhp, send_dump_data_t *sdd)
1359 {
1360 	nvpair_t *fspair;
1361 	boolean_t needagain, progress;
1362 
1363 	if (!sdd->replicate)
1364 		return (dump_filesystem(rzhp, sdd));
1365 
1366 	/* Mark the clone origin snapshots. */
1367 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1368 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1369 		nvlist_t *nvfs;
1370 		uint64_t origin_guid = 0;
1371 
1372 		nvfs = fnvpair_value_nvlist(fspair);
1373 		(void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1374 		if (origin_guid != 0) {
1375 			const char *snapname;
1376 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1377 			    origin_guid, &snapname);
1378 			if (origin_nv != NULL) {
1379 				nvlist_t *snapprops;
1380 				snapprops = fnvlist_lookup_nvlist(origin_nv,
1381 				    "snapprops");
1382 				snapprops = fnvlist_lookup_nvlist(snapprops,
1383 				    snapname);
1384 				fnvlist_add_boolean(snapprops,
1385 				    "is_clone_origin");
1386 			}
1387 		}
1388 	}
1389 again:
1390 	needagain = progress = B_FALSE;
1391 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1392 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1393 		nvlist_t *fslist, *parent_nv;
1394 		const char *fsname;
1395 		zfs_handle_t *zhp;
1396 		int err;
1397 		uint64_t origin_guid = 0;
1398 		uint64_t parent_guid = 0;
1399 
1400 		fslist = fnvpair_value_nvlist(fspair);
1401 		if (nvlist_lookup_boolean(fslist, "sent") == 0)
1402 			continue;
1403 
1404 		fsname = fnvlist_lookup_string(fslist, "name");
1405 		(void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1406 		(void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1407 		    &parent_guid);
1408 
1409 		if (parent_guid != 0) {
1410 			parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1411 			if (!nvlist_exists(parent_nv, "sent")) {
1412 				/* Parent has not been sent; skip this one. */
1413 				needagain = B_TRUE;
1414 				continue;
1415 			}
1416 		}
1417 
1418 		if (origin_guid != 0) {
1419 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1420 			    origin_guid, NULL);
1421 			if (origin_nv != NULL &&
1422 			    !nvlist_exists(origin_nv, "sent")) {
1423 				/*
1424 				 * Origin has not been sent yet;
1425 				 * skip this clone.
1426 				 */
1427 				needagain = B_TRUE;
1428 				continue;
1429 			}
1430 		}
1431 
1432 		zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1433 		if (zhp == NULL)
1434 			return (-1);
1435 		err = dump_filesystem(zhp, sdd);
1436 		fnvlist_add_boolean(fslist, "sent");
1437 		progress = B_TRUE;
1438 		zfs_close(zhp);
1439 		if (err)
1440 			return (err);
1441 	}
1442 	if (needagain) {
1443 		assert(progress);
1444 		goto again;
1445 	}
1446 
1447 	/* Clean out the sent flags in case we reuse this fss. */
1448 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1449 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1450 		nvlist_t *fslist;
1451 
1452 		fslist = fnvpair_value_nvlist(fspair);
1453 		(void) nvlist_remove_all(fslist, "sent");
1454 	}
1455 
1456 	return (0);
1457 }
1458 
1459 nvlist_t *
1460 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1461 {
1462 	unsigned int version;
1463 	int nread, i;
1464 	unsigned long long checksum, packed_len;
1465 
1466 	/*
1467 	 * Decode token header, which is:
1468 	 *   <token version>-<checksum of payload>-<uncompressed payload length>
1469 	 * Note that the only supported token version is 1.
1470 	 */
1471 	nread = sscanf(token, "%u-%llx-%llx-",
1472 	    &version, &checksum, &packed_len);
1473 	if (nread != 3) {
1474 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1475 		    "resume token is corrupt (invalid format)"));
1476 		return (NULL);
1477 	}
1478 
1479 	if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1480 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1481 		    "resume token is corrupt (invalid version %u)"),
1482 		    version);
1483 		return (NULL);
1484 	}
1485 
1486 	/* Convert hexadecimal representation to binary. */
1487 	token = strrchr(token, '-') + 1;
1488 	int len = strlen(token) / 2;
1489 	unsigned char *compressed = zfs_alloc(hdl, len);
1490 	for (i = 0; i < len; i++) {
1491 		nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1492 		if (nread != 1) {
1493 			free(compressed);
1494 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1495 			    "resume token is corrupt "
1496 			    "(payload is not hex-encoded)"));
1497 			return (NULL);
1498 		}
1499 	}
1500 
1501 	/* Verify checksum. */
1502 	zio_cksum_t cksum;
1503 	fletcher_4_native_varsize(compressed, len, &cksum);
1504 	if (cksum.zc_word[0] != checksum) {
1505 		free(compressed);
1506 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1507 		    "resume token is corrupt (incorrect checksum)"));
1508 		return (NULL);
1509 	}
1510 
1511 	/* Uncompress. */
1512 	void *packed = zfs_alloc(hdl, packed_len);
1513 	uLongf packed_len_long = packed_len;
1514 	if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1515 	    packed_len_long != packed_len) {
1516 		free(packed);
1517 		free(compressed);
1518 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1519 		    "resume token is corrupt (decompression failed)"));
1520 		return (NULL);
1521 	}
1522 
1523 	/* Unpack nvlist. */
1524 	nvlist_t *nv;
1525 	int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1526 	free(packed);
1527 	free(compressed);
1528 	if (error != 0) {
1529 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1530 		    "resume token is corrupt (nvlist_unpack failed)"));
1531 		return (NULL);
1532 	}
1533 	return (nv);
1534 }
1535 
1536 static enum lzc_send_flags
1537 lzc_flags_from_sendflags(const sendflags_t *flags)
1538 {
1539 	enum lzc_send_flags lzc_flags = 0;
1540 
1541 	if (flags->largeblock)
1542 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1543 	if (flags->embed_data)
1544 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1545 	if (flags->compress)
1546 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1547 	if (flags->raw)
1548 		lzc_flags |= LZC_SEND_FLAG_RAW;
1549 	if (flags->saved)
1550 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1551 
1552 	return (lzc_flags);
1553 }
1554 
1555 static int
1556 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1557     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1558     const char *redactbook, char *errbuf, uint64_t *sizep)
1559 {
1560 	uint64_t size;
1561 	FILE *fout = flags->dryrun ? stdout : stderr;
1562 	progress_arg_t pa = { 0 };
1563 	int err = 0;
1564 	pthread_t ptid;
1565 
1566 	if (flags->progress || flags->progressastitle) {
1567 		pa.pa_zhp = zhp;
1568 		pa.pa_fd = fd;
1569 		pa.pa_parsable = flags->parsable;
1570 		pa.pa_estimate = B_TRUE;
1571 		pa.pa_verbosity = flags->verbosity;
1572 
1573 		err = pthread_create(&ptid, NULL,
1574 		    send_progress_thread, &pa);
1575 		if (err != 0) {
1576 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1577 			return (zfs_error(zhp->zfs_hdl,
1578 			    EZFS_THREADCREATEFAILED, errbuf));
1579 		}
1580 	}
1581 
1582 	err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1583 	    lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1584 	    redactbook, fd, &size);
1585 	*sizep = size;
1586 
1587 	if ((flags->progress || flags->progressastitle) &&
1588 	    send_progress_thread_exit(zhp->zfs_hdl, ptid))
1589 		return (-1);
1590 
1591 	if (!flags->progress && !flags->parsable)
1592 		return (err);
1593 
1594 	if (err != 0) {
1595 		zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1596 		return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1597 		    errbuf));
1598 	}
1599 	send_print_verbose(fout, zhp->zfs_name, from, size,
1600 	    flags->parsable);
1601 
1602 	if (flags->parsable) {
1603 		(void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1604 	} else {
1605 		char buf[16];
1606 		zfs_nicenum(size, buf, sizeof (buf));
1607 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1608 		    "total estimated size is %s\n"), buf);
1609 	}
1610 	return (0);
1611 }
1612 
1613 static boolean_t
1614 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1615 {
1616 	for (int i = 0; i < num_snaps; i++) {
1617 		if (snaps[i] == guid)
1618 			return (B_TRUE);
1619 	}
1620 	return (B_FALSE);
1621 }
1622 
1623 static boolean_t
1624 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1625     const uint64_t *snaps2, uint64_t num_snaps2)
1626 {
1627 	if (num_snaps1 != num_snaps2)
1628 		return (B_FALSE);
1629 	for (int i = 0; i < num_snaps1; i++) {
1630 		if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1631 			return (B_FALSE);
1632 	}
1633 	return (B_TRUE);
1634 }
1635 
1636 static int
1637 get_bookmarks(const char *path, nvlist_t **bmarksp)
1638 {
1639 	nvlist_t *props = fnvlist_alloc();
1640 	int error;
1641 
1642 	fnvlist_add_boolean(props, "redact_complete");
1643 	fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1644 	error = lzc_get_bookmarks(path, props, bmarksp);
1645 	fnvlist_free(props);
1646 	return (error);
1647 }
1648 
1649 static nvpair_t *
1650 find_redact_pair(nvlist_t *bmarks, const uint64_t *redact_snap_guids,
1651     int num_redact_snaps)
1652 {
1653 	nvpair_t *pair;
1654 
1655 	for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1656 	    pair = nvlist_next_nvpair(bmarks, pair)) {
1657 
1658 		nvlist_t *bmark = fnvpair_value_nvlist(pair);
1659 		nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1660 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1661 		uint_t len = 0;
1662 		uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1663 		    ZPROP_VALUE, &len);
1664 		if (redact_snaps_equal(redact_snap_guids,
1665 		    num_redact_snaps, bmarksnaps, len)) {
1666 			break;
1667 		}
1668 	}
1669 	return (pair);
1670 }
1671 
1672 static boolean_t
1673 get_redact_complete(nvpair_t *pair)
1674 {
1675 	nvlist_t *bmark = fnvpair_value_nvlist(pair);
1676 	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1677 	boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1678 	    ZPROP_VALUE);
1679 
1680 	return (complete);
1681 }
1682 
1683 /*
1684  * Check that the list of redaction snapshots in the bookmark matches the send
1685  * we're resuming, and return whether or not it's complete.
1686  *
1687  * Note that the caller needs to free the contents of *bookname with free() if
1688  * this function returns successfully.
1689  */
1690 static int
1691 find_redact_book(libzfs_handle_t *hdl, const char *path,
1692     const uint64_t *redact_snap_guids, int num_redact_snaps,
1693     char **bookname)
1694 {
1695 	char errbuf[ERRBUFLEN];
1696 	nvlist_t *bmarks;
1697 
1698 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1699 	    "cannot resume send"));
1700 
1701 	int error = get_bookmarks(path, &bmarks);
1702 	if (error != 0) {
1703 		if (error == ESRCH) {
1704 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1705 			    "nonexistent redaction bookmark provided"));
1706 		} else if (error == ENOENT) {
1707 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1708 			    "dataset to be sent no longer exists"));
1709 		} else {
1710 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1711 			    "unknown error: %s"), strerror(error));
1712 		}
1713 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1714 	}
1715 	nvpair_t *pair = find_redact_pair(bmarks, redact_snap_guids,
1716 	    num_redact_snaps);
1717 	if (pair == NULL)  {
1718 		fnvlist_free(bmarks);
1719 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1720 		    "no appropriate redaction bookmark exists"));
1721 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1722 	}
1723 	boolean_t complete = get_redact_complete(pair);
1724 	if (!complete) {
1725 		fnvlist_free(bmarks);
1726 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1727 		    "incomplete redaction bookmark provided"));
1728 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1729 	}
1730 	*bookname = strndup(nvpair_name(pair), ZFS_MAX_DATASET_NAME_LEN);
1731 	ASSERT3P(*bookname, !=, NULL);
1732 	fnvlist_free(bmarks);
1733 	return (0);
1734 }
1735 
1736 static enum lzc_send_flags
1737 lzc_flags_from_resume_nvl(nvlist_t *resume_nvl)
1738 {
1739 	enum lzc_send_flags lzc_flags = 0;
1740 
1741 	if (nvlist_exists(resume_nvl, "largeblockok"))
1742 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1743 	if (nvlist_exists(resume_nvl, "embedok"))
1744 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1745 	if (nvlist_exists(resume_nvl, "compressok"))
1746 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1747 	if (nvlist_exists(resume_nvl, "rawok"))
1748 		lzc_flags |= LZC_SEND_FLAG_RAW;
1749 	if (nvlist_exists(resume_nvl, "savedok"))
1750 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1751 
1752 	return (lzc_flags);
1753 }
1754 
1755 static int
1756 zfs_send_resume_impl_cb_impl(libzfs_handle_t *hdl, sendflags_t *flags,
1757     int outfd, nvlist_t *resume_nvl)
1758 {
1759 	char errbuf[ERRBUFLEN];
1760 	const char *toname;
1761 	const char *fromname = NULL;
1762 	uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1763 	zfs_handle_t *zhp;
1764 	int error = 0;
1765 	char name[ZFS_MAX_DATASET_NAME_LEN];
1766 	FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1767 	uint64_t *redact_snap_guids = NULL;
1768 	int num_redact_snaps = 0;
1769 	char *redact_book = NULL;
1770 	uint64_t size = 0;
1771 
1772 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1773 	    "cannot resume send"));
1774 
1775 	if (flags->verbosity != 0) {
1776 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1777 		    "resume token contents:\n"));
1778 		nvlist_print(fout, resume_nvl);
1779 	}
1780 
1781 	if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1782 	    nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1783 	    nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1784 	    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1785 	    nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1786 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1787 		    "resume token is corrupt"));
1788 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1789 	}
1790 	fromguid = 0;
1791 	(void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1792 
1793 	if (flags->saved) {
1794 		(void) strlcpy(name, toname, sizeof (name));
1795 	} else {
1796 		error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1797 		if (error != 0) {
1798 			if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1799 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1800 				    "'%s' is no longer the same snapshot "
1801 				    "used in the initial send"), toname);
1802 			} else {
1803 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1804 				    "'%s' used in the initial send no "
1805 				    "longer exists"), toname);
1806 			}
1807 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1808 		}
1809 	}
1810 
1811 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1812 	if (zhp == NULL) {
1813 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1814 		    "unable to access '%s'"), name);
1815 		return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1816 	}
1817 
1818 	if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1819 	    &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1820 		num_redact_snaps = -1;
1821 	}
1822 
1823 	if (fromguid != 0) {
1824 		if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1825 		    redact_snap_guids, num_redact_snaps, name) != 0) {
1826 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1827 			    "incremental source %#llx no longer exists"),
1828 			    (longlong_t)fromguid);
1829 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1830 		}
1831 		fromname = name;
1832 	}
1833 
1834 	redact_snap_guids = NULL;
1835 
1836 	if (nvlist_lookup_uint64_array(resume_nvl,
1837 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1838 	    (uint_t *)&num_redact_snaps) == 0) {
1839 		char path[ZFS_MAX_DATASET_NAME_LEN];
1840 
1841 		(void) strlcpy(path, toname, sizeof (path));
1842 		char *at = strchr(path, '@');
1843 		ASSERT3P(at, !=, NULL);
1844 
1845 		*at = '\0';
1846 
1847 		if ((error = find_redact_book(hdl, path, redact_snap_guids,
1848 		    num_redact_snaps, &redact_book)) != 0) {
1849 			return (error);
1850 		}
1851 	}
1852 
1853 	enum lzc_send_flags lzc_flags = lzc_flags_from_sendflags(flags) |
1854 	    lzc_flags_from_resume_nvl(resume_nvl);
1855 
1856 	if (flags->verbosity != 0 || flags->progressastitle) {
1857 		/*
1858 		 * Some of these may have come from the resume token, set them
1859 		 * here for size estimate purposes.
1860 		 */
1861 		sendflags_t tmpflags = *flags;
1862 		if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1863 			tmpflags.largeblock = B_TRUE;
1864 		if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1865 			tmpflags.compress = B_TRUE;
1866 		if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1867 			tmpflags.embed_data = B_TRUE;
1868 		if (lzc_flags & LZC_SEND_FLAG_RAW)
1869 			tmpflags.raw = B_TRUE;
1870 		if (lzc_flags & LZC_SEND_FLAG_SAVED)
1871 			tmpflags.saved = B_TRUE;
1872 		error = estimate_size(zhp, fromname, outfd, &tmpflags,
1873 		    resumeobj, resumeoff, bytes, redact_book, errbuf, &size);
1874 	}
1875 
1876 	if (!flags->dryrun) {
1877 		progress_arg_t pa = { 0 };
1878 		pthread_t tid;
1879 		/*
1880 		 * If progress reporting is requested, spawn a new thread to
1881 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1882 		 */
1883 		if (flags->progress || flags->progressastitle) {
1884 			pa.pa_zhp = zhp;
1885 			pa.pa_fd = outfd;
1886 			pa.pa_parsable = flags->parsable;
1887 			pa.pa_estimate = B_FALSE;
1888 			pa.pa_verbosity = flags->verbosity;
1889 			pa.pa_size = size;
1890 			pa.pa_astitle = flags->progressastitle;
1891 			pa.pa_progress = flags->progress;
1892 
1893 			error = pthread_create(&tid, NULL,
1894 			    send_progress_thread, &pa);
1895 			if (error != 0) {
1896 				if (redact_book != NULL)
1897 					free(redact_book);
1898 				zfs_close(zhp);
1899 				return (error);
1900 			}
1901 		}
1902 
1903 		error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1904 		    lzc_flags, resumeobj, resumeoff, redact_book);
1905 		if (redact_book != NULL)
1906 			free(redact_book);
1907 
1908 		if ((flags->progressastitle || flags->progress) &&
1909 		    send_progress_thread_exit(hdl, tid)) {
1910 			zfs_close(zhp);
1911 			return (-1);
1912 		}
1913 
1914 		char errbuf[ERRBUFLEN];
1915 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1916 		    "warning: cannot send '%s'"), zhp->zfs_name);
1917 
1918 		zfs_close(zhp);
1919 
1920 		switch (error) {
1921 		case 0:
1922 			return (0);
1923 		case EACCES:
1924 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1925 			    "source key must be loaded"));
1926 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1927 		case ESRCH:
1928 			if (lzc_exists(zhp->zfs_name)) {
1929 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1930 				    "incremental source could not be found"));
1931 			}
1932 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
1933 
1934 		case EXDEV:
1935 		case ENOENT:
1936 		case EDQUOT:
1937 		case EFBIG:
1938 		case EIO:
1939 		case ENOLINK:
1940 		case ENOSPC:
1941 		case ENOSTR:
1942 		case ENXIO:
1943 		case EPIPE:
1944 		case ERANGE:
1945 		case EFAULT:
1946 		case EROFS:
1947 			zfs_error_aux(hdl, "%s", strerror(errno));
1948 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1949 
1950 		default:
1951 			return (zfs_standard_error(hdl, errno, errbuf));
1952 		}
1953 	} else {
1954 		if (redact_book != NULL)
1955 			free(redact_book);
1956 	}
1957 
1958 	zfs_close(zhp);
1959 
1960 	return (error);
1961 }
1962 
1963 struct zfs_send_resume_impl {
1964 	libzfs_handle_t *hdl;
1965 	sendflags_t *flags;
1966 	nvlist_t *resume_nvl;
1967 };
1968 
1969 static int
1970 zfs_send_resume_impl_cb(int outfd, void *arg)
1971 {
1972 	struct zfs_send_resume_impl *zsri = arg;
1973 	return (zfs_send_resume_impl_cb_impl(zsri->hdl, zsri->flags, outfd,
1974 	    zsri->resume_nvl));
1975 }
1976 
1977 static int
1978 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1979     nvlist_t *resume_nvl)
1980 {
1981 	struct zfs_send_resume_impl zsri = {
1982 		.hdl = hdl,
1983 		.flags = flags,
1984 		.resume_nvl = resume_nvl,
1985 	};
1986 	return (lzc_send_wrapper(zfs_send_resume_impl_cb, outfd, &zsri));
1987 }
1988 
1989 int
1990 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1991     const char *resume_token)
1992 {
1993 	int ret;
1994 	char errbuf[ERRBUFLEN];
1995 	nvlist_t *resume_nvl;
1996 
1997 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1998 	    "cannot resume send"));
1999 
2000 	resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
2001 	if (resume_nvl == NULL) {
2002 		/*
2003 		 * zfs_error_aux has already been set by
2004 		 * zfs_send_resume_token_to_nvlist()
2005 		 */
2006 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
2007 	}
2008 
2009 	ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
2010 	fnvlist_free(resume_nvl);
2011 
2012 	return (ret);
2013 }
2014 
2015 int
2016 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
2017     const char *resume_token)
2018 {
2019 	int ret;
2020 	libzfs_handle_t *hdl = zhp->zfs_hdl;
2021 	nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
2022 	uint64_t saved_guid = 0, resume_guid = 0;
2023 	uint64_t obj = 0, off = 0, bytes = 0;
2024 	char token_buf[ZFS_MAXPROPLEN];
2025 	char errbuf[ERRBUFLEN];
2026 
2027 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2028 	    "saved send failed"));
2029 
2030 	ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
2031 	    token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
2032 	if (ret != 0)
2033 		goto out;
2034 
2035 	saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
2036 	if (saved_nvl == NULL) {
2037 		/*
2038 		 * zfs_error_aux has already been set by
2039 		 * zfs_send_resume_token_to_nvlist()
2040 		 */
2041 		ret = zfs_error(hdl, EZFS_FAULT, errbuf);
2042 		goto out;
2043 	}
2044 
2045 	/*
2046 	 * If a resume token is provided we use the object and offset
2047 	 * from that instead of the default, which starts from the
2048 	 * beginning.
2049 	 */
2050 	if (resume_token != NULL) {
2051 		resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
2052 		    resume_token);
2053 		if (resume_nvl == NULL) {
2054 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
2055 			goto out;
2056 		}
2057 
2058 		if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
2059 		    nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
2060 		    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
2061 		    nvlist_lookup_uint64(resume_nvl, "toguid",
2062 		    &resume_guid) != 0) {
2063 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2064 			    "provided resume token is corrupt"));
2065 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
2066 			goto out;
2067 		}
2068 
2069 		if (nvlist_lookup_uint64(saved_nvl, "toguid",
2070 		    &saved_guid)) {
2071 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2072 			    "dataset's resume token is corrupt"));
2073 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
2074 			goto out;
2075 		}
2076 
2077 		if (resume_guid != saved_guid) {
2078 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2079 			    "provided resume token does not match dataset"));
2080 			ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
2081 			goto out;
2082 		}
2083 	}
2084 
2085 	(void) nvlist_remove_all(saved_nvl, "object");
2086 	fnvlist_add_uint64(saved_nvl, "object", obj);
2087 
2088 	(void) nvlist_remove_all(saved_nvl, "offset");
2089 	fnvlist_add_uint64(saved_nvl, "offset", off);
2090 
2091 	(void) nvlist_remove_all(saved_nvl, "bytes");
2092 	fnvlist_add_uint64(saved_nvl, "bytes", bytes);
2093 
2094 	(void) nvlist_remove_all(saved_nvl, "toname");
2095 	fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
2096 
2097 	ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
2098 
2099 out:
2100 	fnvlist_free(saved_nvl);
2101 	fnvlist_free(resume_nvl);
2102 	return (ret);
2103 }
2104 
2105 /*
2106  * This function informs the target system that the recursive send is complete.
2107  * The record is also expected in the case of a send -p.
2108  */
2109 static int
2110 send_conclusion_record(int fd, zio_cksum_t *zc)
2111 {
2112 	dmu_replay_record_t drr = { 0 };
2113 	drr.drr_type = DRR_END;
2114 	if (zc != NULL)
2115 		drr.drr_u.drr_end.drr_checksum = *zc;
2116 	if (write(fd, &drr, sizeof (drr)) == -1) {
2117 		return (errno);
2118 	}
2119 	return (0);
2120 }
2121 
2122 /*
2123  * This function is responsible for sending the records that contain the
2124  * necessary information for the target system's libzfs to be able to set the
2125  * properties of the filesystem being received, or to be able to prepare for
2126  * a recursive receive.
2127  *
2128  * The "zhp" argument is the handle of the snapshot we are sending
2129  * (the "tosnap").  The "from" argument is the short snapshot name (the part
2130  * after the @) of the incremental source.
2131  */
2132 static int
2133 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
2134     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
2135     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
2136     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
2137     nvlist_t **fssp, avl_tree_t **fsavlp)
2138 {
2139 	int err = 0;
2140 	char *packbuf = NULL;
2141 	size_t buflen = 0;
2142 	zio_cksum_t zc = { {0} };
2143 	int featureflags = 0;
2144 	/* name of filesystem/volume that contains snapshot we are sending */
2145 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
2146 	/* short name of snap we are sending */
2147 	const char *tosnap = "";
2148 
2149 	char errbuf[ERRBUFLEN];
2150 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2151 	    "warning: cannot send '%s'"), zhp->zfs_name);
2152 	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2153 	    ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2154 		featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2155 	}
2156 
2157 	if (holds)
2158 		featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2159 
2160 	(void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2161 	char *at = strchr(tofs, '@');
2162 	if (at != NULL) {
2163 		*at = '\0';
2164 		tosnap = at + 1;
2165 	}
2166 
2167 	if (gather_props) {
2168 		nvlist_t *hdrnv = fnvlist_alloc();
2169 		nvlist_t *fss = NULL;
2170 
2171 		if (from != NULL)
2172 			fnvlist_add_string(hdrnv, "fromsnap", from);
2173 		fnvlist_add_string(hdrnv, "tosnap", tosnap);
2174 		if (!recursive)
2175 			fnvlist_add_boolean(hdrnv, "not_recursive");
2176 
2177 		if (raw) {
2178 			fnvlist_add_boolean(hdrnv, "raw");
2179 		}
2180 
2181 		if (gather_nvlist(zhp->zfs_hdl, tofs,
2182 		    from, tosnap, recursive, raw, doall, replicate, skipmissing,
2183 		    verbose, backup, holds, props, &fss, fsavlp) != 0) {
2184 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2185 			    errbuf));
2186 		}
2187 		/*
2188 		 * Do not allow the size of the properties list to exceed
2189 		 * the limit
2190 		 */
2191 		if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2192 		    zhp->zfs_hdl->libzfs_max_nvlist) {
2193 			(void) snprintf(errbuf, sizeof (errbuf),
2194 			    dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2195 			    "the size of the list of snapshots and properties "
2196 			    "is too large to be received successfully.\n"
2197 			    "Select a smaller number of snapshots to send.\n"),
2198 			    zhp->zfs_name);
2199 			return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2200 			    errbuf));
2201 		}
2202 		fnvlist_add_nvlist(hdrnv, "fss", fss);
2203 		VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2204 		    0));
2205 		if (fssp != NULL) {
2206 			*fssp = fss;
2207 		} else {
2208 			fnvlist_free(fss);
2209 		}
2210 		fnvlist_free(hdrnv);
2211 	}
2212 
2213 	if (!dryrun) {
2214 		dmu_replay_record_t drr = { 0 };
2215 		/* write first begin record */
2216 		drr.drr_type = DRR_BEGIN;
2217 		drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2218 		DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2219 		    drr_versioninfo, DMU_COMPOUNDSTREAM);
2220 		DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2221 		    drr_versioninfo, featureflags);
2222 		if (snprintf(drr.drr_u.drr_begin.drr_toname,
2223 		    sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2224 		    tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2225 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2226 			    errbuf));
2227 		}
2228 		drr.drr_payloadlen = buflen;
2229 
2230 		err = dump_record(&drr, packbuf, buflen, &zc, fd);
2231 		free(packbuf);
2232 		if (err != 0) {
2233 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2234 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2235 			    errbuf));
2236 		}
2237 		err = send_conclusion_record(fd, &zc);
2238 		if (err != 0) {
2239 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2240 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2241 			    errbuf));
2242 		}
2243 	}
2244 	return (0);
2245 }
2246 
2247 /*
2248  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2249  * that contains the snapshot to send.  The "fromsnap" argument is the
2250  * short name (the part after the '@') of the snapshot that is the
2251  * incremental source to send from (if non-NULL).  The "tosnap" argument
2252  * is the short name of the snapshot to send.
2253  *
2254  * The content of the send stream is the snapshot identified by
2255  * 'tosnap'.  Incremental streams are requested in two ways:
2256  *     - from the snapshot identified by "fromsnap" (if non-null) or
2257  *     - from the origin of the dataset identified by zhp, which must
2258  *	 be a clone.  In this case, "fromsnap" is null and "fromorigin"
2259  *	 is TRUE.
2260  *
2261  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2262  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2263  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2264  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2265  * case too. If "props" is set, send properties.
2266  *
2267  * Pre-wrapped (cf. lzc_send_wrapper()).
2268  */
2269 static int
2270 zfs_send_cb_impl(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2271     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2272     void *cb_arg, nvlist_t **debugnvp)
2273 {
2274 	char errbuf[ERRBUFLEN];
2275 	send_dump_data_t sdd = { 0 };
2276 	int err = 0;
2277 	nvlist_t *fss = NULL;
2278 	avl_tree_t *fsavl = NULL;
2279 	static uint64_t holdseq;
2280 	int spa_version;
2281 	FILE *fout;
2282 
2283 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2284 	    "cannot send '%s'"), zhp->zfs_name);
2285 
2286 	if (fromsnap && fromsnap[0] == '\0') {
2287 		zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2288 		    "zero-length incremental source"));
2289 		return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2290 	}
2291 
2292 	if (fromsnap) {
2293 		char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2294 		if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2295 		    "%s@%s", zhp->zfs_name, fromsnap) >=
2296 		    sizeof (full_fromsnap_name)) {
2297 			err = EINVAL;
2298 			goto stderr_out;
2299 		}
2300 		zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2301 		    full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2302 		if (fromsnapn == NULL) {
2303 			err = -1;
2304 			goto err_out;
2305 		}
2306 		zfs_close(fromsnapn);
2307 	}
2308 
2309 	if (flags->replicate || flags->doall || flags->props ||
2310 	    flags->holds || flags->backup) {
2311 		char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2312 		if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2313 		    "%s@%s", zhp->zfs_name, tosnap) >=
2314 		    sizeof (full_tosnap_name)) {
2315 			err = EINVAL;
2316 			goto stderr_out;
2317 		}
2318 		zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2319 		    full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2320 		if (tosnap == NULL) {
2321 			err = -1;
2322 			goto err_out;
2323 		}
2324 		err = send_prelim_records(tosnap, fromsnap, outfd,
2325 		    flags->replicate || flags->props || flags->holds,
2326 		    flags->replicate, flags->verbosity > 0, flags->dryrun,
2327 		    flags->raw, flags->replicate, flags->skipmissing,
2328 		    flags->backup, flags->holds, flags->props, flags->doall,
2329 		    &fss, &fsavl);
2330 		zfs_close(tosnap);
2331 		if (err != 0)
2332 			goto err_out;
2333 	}
2334 
2335 	/* dump each stream */
2336 	sdd.fromsnap = fromsnap;
2337 	sdd.tosnap = tosnap;
2338 	sdd.outfd = outfd;
2339 	sdd.replicate = flags->replicate;
2340 	sdd.doall = flags->doall;
2341 	sdd.fromorigin = flags->fromorigin;
2342 	sdd.fss = fss;
2343 	sdd.fsavl = fsavl;
2344 	sdd.verbosity = flags->verbosity;
2345 	sdd.parsable = flags->parsable;
2346 	sdd.progress = flags->progress;
2347 	sdd.progressastitle = flags->progressastitle;
2348 	sdd.dryrun = flags->dryrun;
2349 	sdd.large_block = flags->largeblock;
2350 	sdd.embed_data = flags->embed_data;
2351 	sdd.compress = flags->compress;
2352 	sdd.raw = flags->raw;
2353 	sdd.holds = flags->holds;
2354 	sdd.filter_cb = filter_func;
2355 	sdd.filter_cb_arg = cb_arg;
2356 	if (debugnvp)
2357 		sdd.debugnv = *debugnvp;
2358 	if (sdd.verbosity != 0 && sdd.dryrun)
2359 		sdd.std_out = B_TRUE;
2360 	fout = sdd.std_out ? stdout : stderr;
2361 
2362 	/*
2363 	 * Some flags require that we place user holds on the datasets that are
2364 	 * being sent so they don't get destroyed during the send. We can skip
2365 	 * this step if the pool is imported read-only since the datasets cannot
2366 	 * be destroyed.
2367 	 */
2368 	if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2369 	    ZPOOL_PROP_READONLY, NULL) &&
2370 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2371 	    spa_version >= SPA_VERSION_USERREFS &&
2372 	    (flags->doall || flags->replicate)) {
2373 		++holdseq;
2374 		(void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2375 		    ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2376 		sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2377 		if (sdd.cleanup_fd < 0) {
2378 			err = errno;
2379 			goto stderr_out;
2380 		}
2381 		sdd.snapholds = fnvlist_alloc();
2382 	} else {
2383 		sdd.cleanup_fd = -1;
2384 		sdd.snapholds = NULL;
2385 	}
2386 
2387 	if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2388 		/*
2389 		 * Do a verbose no-op dry run to get all the verbose output
2390 		 * or to gather snapshot hold's before generating any data,
2391 		 * then do a non-verbose real run to generate the streams.
2392 		 */
2393 		sdd.dryrun = B_TRUE;
2394 		err = dump_filesystems(zhp, &sdd);
2395 
2396 		if (err != 0)
2397 			goto stderr_out;
2398 
2399 		if (flags->verbosity != 0) {
2400 			if (flags->parsable) {
2401 				(void) fprintf(fout, "size\t%llu\n",
2402 				    (longlong_t)sdd.size);
2403 			} else {
2404 				char buf[16];
2405 				zfs_nicebytes(sdd.size, buf, sizeof (buf));
2406 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
2407 				    "total estimated size is %s\n"), buf);
2408 			}
2409 		}
2410 
2411 		/* Ensure no snaps found is treated as an error. */
2412 		if (!sdd.seento) {
2413 			err = ENOENT;
2414 			goto err_out;
2415 		}
2416 
2417 		/* Skip the second run if dryrun was requested. */
2418 		if (flags->dryrun)
2419 			goto err_out;
2420 
2421 		if (sdd.snapholds != NULL) {
2422 			err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2423 			if (err != 0)
2424 				goto stderr_out;
2425 
2426 			fnvlist_free(sdd.snapholds);
2427 			sdd.snapholds = NULL;
2428 		}
2429 
2430 		sdd.dryrun = B_FALSE;
2431 		sdd.verbosity = 0;
2432 	}
2433 
2434 	err = dump_filesystems(zhp, &sdd);
2435 	fsavl_destroy(fsavl);
2436 	fnvlist_free(fss);
2437 
2438 	/* Ensure no snaps found is treated as an error. */
2439 	if (err == 0 && !sdd.seento)
2440 		err = ENOENT;
2441 
2442 	if (sdd.cleanup_fd != -1) {
2443 		VERIFY(0 == close(sdd.cleanup_fd));
2444 		sdd.cleanup_fd = -1;
2445 	}
2446 
2447 	if (!flags->dryrun && (flags->replicate || flags->doall ||
2448 	    flags->props || flags->backup || flags->holds)) {
2449 		/*
2450 		 * write final end record.  NB: want to do this even if
2451 		 * there was some error, because it might not be totally
2452 		 * failed.
2453 		 */
2454 		int err2 = send_conclusion_record(outfd, NULL);
2455 		if (err2 != 0)
2456 			return (zfs_standard_error(zhp->zfs_hdl, err2, errbuf));
2457 	}
2458 
2459 	return (err || sdd.err);
2460 
2461 stderr_out:
2462 	err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2463 err_out:
2464 	fsavl_destroy(fsavl);
2465 	fnvlist_free(fss);
2466 	fnvlist_free(sdd.snapholds);
2467 
2468 	if (sdd.cleanup_fd != -1)
2469 		VERIFY(0 == close(sdd.cleanup_fd));
2470 	return (err);
2471 }
2472 
2473 struct zfs_send {
2474 	zfs_handle_t *zhp;
2475 	const char *fromsnap;
2476 	const char *tosnap;
2477 	sendflags_t *flags;
2478 	snapfilter_cb_t *filter_func;
2479 	void *cb_arg;
2480 	nvlist_t **debugnvp;
2481 };
2482 
2483 static int
2484 zfs_send_cb(int outfd, void *arg)
2485 {
2486 	struct zfs_send *zs = arg;
2487 	return (zfs_send_cb_impl(zs->zhp, zs->fromsnap, zs->tosnap, zs->flags,
2488 	    outfd, zs->filter_func, zs->cb_arg, zs->debugnvp));
2489 }
2490 
2491 int
2492 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2493     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2494     void *cb_arg, nvlist_t **debugnvp)
2495 {
2496 	struct zfs_send arg = {
2497 		.zhp = zhp,
2498 		.fromsnap = fromsnap,
2499 		.tosnap = tosnap,
2500 		.flags = flags,
2501 		.filter_func = filter_func,
2502 		.cb_arg = cb_arg,
2503 		.debugnvp = debugnvp,
2504 	};
2505 	return (lzc_send_wrapper(zfs_send_cb, outfd, &arg));
2506 }
2507 
2508 
2509 static zfs_handle_t *
2510 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2511 {
2512 	char dirname[ZFS_MAX_DATASET_NAME_LEN];
2513 	(void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2514 	char *c = strchr(dirname, '@');
2515 	if (c != NULL)
2516 		*c = '\0';
2517 	return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2518 }
2519 
2520 /*
2521  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2522  * an earlier snapshot in the same filesystem, or a snapshot before later's
2523  * origin, or it's origin's origin, etc.
2524  */
2525 static boolean_t
2526 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2527 {
2528 	boolean_t ret;
2529 	uint64_t later_txg =
2530 	    (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2531 	    later->zfs_type == ZFS_TYPE_VOLUME ?
2532 	    UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2533 	uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2534 
2535 	if (earlier_txg >= later_txg)
2536 		return (B_FALSE);
2537 
2538 	zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2539 	    earlier->zfs_name);
2540 	zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2541 	    later->zfs_name);
2542 
2543 	if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2544 		zfs_close(earlier_dir);
2545 		zfs_close(later_dir);
2546 		return (B_TRUE);
2547 	}
2548 
2549 	char clonename[ZFS_MAX_DATASET_NAME_LEN];
2550 	if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2551 	    ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2552 		zfs_close(earlier_dir);
2553 		zfs_close(later_dir);
2554 		return (B_FALSE);
2555 	}
2556 
2557 	zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2558 	    ZFS_TYPE_DATASET);
2559 	uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2560 
2561 	/*
2562 	 * If "earlier" is exactly the origin, then
2563 	 * snapshot_is_before(earlier, origin) will return false (because
2564 	 * they're the same).
2565 	 */
2566 	if (origin_txg == earlier_txg &&
2567 	    strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2568 		zfs_close(earlier_dir);
2569 		zfs_close(later_dir);
2570 		zfs_close(origin);
2571 		return (B_TRUE);
2572 	}
2573 	zfs_close(earlier_dir);
2574 	zfs_close(later_dir);
2575 
2576 	ret = snapshot_is_before(earlier, origin);
2577 	zfs_close(origin);
2578 	return (ret);
2579 }
2580 
2581 /*
2582  * The "zhp" argument is the handle of the dataset to send (typically a
2583  * snapshot).  The "from" argument is the full name of the snapshot or
2584  * bookmark that is the incremental source.
2585  *
2586  * Pre-wrapped (cf. lzc_send_wrapper()).
2587  */
2588 static int
2589 zfs_send_one_cb_impl(zfs_handle_t *zhp, const char *from, int fd,
2590     sendflags_t *flags, const char *redactbook)
2591 {
2592 	int err;
2593 	libzfs_handle_t *hdl = zhp->zfs_hdl;
2594 	char *name = zhp->zfs_name;
2595 	pthread_t ptid;
2596 	progress_arg_t pa = { 0 };
2597 	uint64_t size = 0;
2598 
2599 	char errbuf[ERRBUFLEN];
2600 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2601 	    "warning: cannot send '%s'"), name);
2602 
2603 	if (from != NULL && strchr(from, '@')) {
2604 		zfs_handle_t *from_zhp = zfs_open(hdl, from,
2605 		    ZFS_TYPE_DATASET);
2606 		if (from_zhp == NULL)
2607 			return (-1);
2608 		if (!snapshot_is_before(from_zhp, zhp)) {
2609 			zfs_close(from_zhp);
2610 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2611 			    "not an earlier snapshot from the same fs"));
2612 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2613 		}
2614 		zfs_close(from_zhp);
2615 	}
2616 
2617 	if (redactbook != NULL) {
2618 		char bookname[ZFS_MAX_DATASET_NAME_LEN];
2619 		nvlist_t *redact_snaps;
2620 		zfs_handle_t *book_zhp;
2621 		char *at, *pound;
2622 		int dsnamelen;
2623 
2624 		pound = strchr(redactbook, '#');
2625 		if (pound != NULL)
2626 			redactbook = pound + 1;
2627 		at = strchr(name, '@');
2628 		if (at == NULL) {
2629 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2630 			    "cannot do a redacted send to a filesystem"));
2631 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2632 		}
2633 		dsnamelen = at - name;
2634 		if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2635 		    dsnamelen, name, redactbook)
2636 		    >= sizeof (bookname)) {
2637 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2638 			    "invalid bookmark name"));
2639 			return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2640 		}
2641 		book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2642 		if (book_zhp == NULL)
2643 			return (-1);
2644 		if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2645 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2646 		    &redact_snaps) != 0 || redact_snaps == NULL) {
2647 			zfs_close(book_zhp);
2648 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2649 			    "not a redaction bookmark"));
2650 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2651 		}
2652 		zfs_close(book_zhp);
2653 	}
2654 
2655 	/*
2656 	 * Send fs properties
2657 	 */
2658 	if (flags->props || flags->holds || flags->backup) {
2659 		/*
2660 		 * Note: the header generated by send_prelim_records()
2661 		 * assumes that the incremental source is in the same
2662 		 * filesystem/volume as the target (which is a requirement
2663 		 * when doing "zfs send -R").  But that isn't always the
2664 		 * case here (e.g. send from snap in origin, or send from
2665 		 * bookmark).  We pass from=NULL, which will omit this
2666 		 * information from the prelim records; it isn't used
2667 		 * when receiving this type of stream.
2668 		 */
2669 		err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2670 		    flags->verbosity > 0, flags->dryrun, flags->raw,
2671 		    flags->replicate, B_FALSE, flags->backup, flags->holds,
2672 		    flags->props, flags->doall, NULL, NULL);
2673 		if (err != 0)
2674 			return (err);
2675 	}
2676 
2677 	/*
2678 	 * Perform size estimate if verbose was specified.
2679 	 */
2680 	if (flags->verbosity != 0 || flags->progressastitle) {
2681 		err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2682 		    errbuf, &size);
2683 		if (err != 0)
2684 			return (err);
2685 	}
2686 
2687 	if (flags->dryrun)
2688 		return (0);
2689 
2690 	/*
2691 	 * If progress reporting is requested, spawn a new thread to poll
2692 	 * ZFS_IOC_SEND_PROGRESS at a regular interval.
2693 	 */
2694 	if (flags->progress || flags->progressastitle) {
2695 		pa.pa_zhp = zhp;
2696 		pa.pa_fd = fd;
2697 		pa.pa_parsable = flags->parsable;
2698 		pa.pa_estimate = B_FALSE;
2699 		pa.pa_verbosity = flags->verbosity;
2700 		pa.pa_size = size;
2701 		pa.pa_astitle = flags->progressastitle;
2702 		pa.pa_progress = flags->progress;
2703 
2704 		err = pthread_create(&ptid, NULL,
2705 		    send_progress_thread, &pa);
2706 		if (err != 0) {
2707 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2708 			return (zfs_error(zhp->zfs_hdl,
2709 			    EZFS_THREADCREATEFAILED, errbuf));
2710 		}
2711 	}
2712 
2713 	err = lzc_send_redacted(name, from, fd,
2714 	    lzc_flags_from_sendflags(flags), redactbook);
2715 
2716 	if ((flags->progress || flags->progressastitle) &&
2717 	    send_progress_thread_exit(hdl, ptid))
2718 			return (-1);
2719 
2720 	if (err == 0 && (flags->props || flags->holds || flags->backup)) {
2721 		/* Write the final end record. */
2722 		err = send_conclusion_record(fd, NULL);
2723 		if (err != 0)
2724 			return (zfs_standard_error(hdl, err, errbuf));
2725 	}
2726 	if (err != 0) {
2727 		switch (errno) {
2728 		case EXDEV:
2729 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2730 			    "not an earlier snapshot from the same fs"));
2731 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2732 
2733 		case ENOENT:
2734 		case ESRCH:
2735 			if (lzc_exists(name)) {
2736 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2737 				    "incremental source (%s) does not exist"),
2738 				    from);
2739 			}
2740 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
2741 
2742 		case EACCES:
2743 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2744 			    "dataset key must be loaded"));
2745 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2746 
2747 		case EBUSY:
2748 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2749 			    "target is busy; if a filesystem, "
2750 			    "it must not be mounted"));
2751 			return (zfs_error(hdl, EZFS_BUSY, errbuf));
2752 
2753 		case EDQUOT:
2754 		case EFAULT:
2755 		case EFBIG:
2756 		case EINVAL:
2757 		case EIO:
2758 		case ENOLINK:
2759 		case ENOSPC:
2760 		case ENOSTR:
2761 		case ENXIO:
2762 		case EPIPE:
2763 		case ERANGE:
2764 		case EROFS:
2765 			zfs_error_aux(hdl, "%s", strerror(errno));
2766 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2767 
2768 		default:
2769 			return (zfs_standard_error(hdl, errno, errbuf));
2770 		}
2771 	}
2772 	return (err != 0);
2773 }
2774 
2775 struct zfs_send_one {
2776 	zfs_handle_t *zhp;
2777 	const char *from;
2778 	sendflags_t *flags;
2779 	const char *redactbook;
2780 };
2781 
2782 static int
2783 zfs_send_one_cb(int fd, void *arg)
2784 {
2785 	struct zfs_send_one *zso = arg;
2786 	return (zfs_send_one_cb_impl(zso->zhp, zso->from, fd, zso->flags,
2787 	    zso->redactbook));
2788 }
2789 
2790 int
2791 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2792     const char *redactbook)
2793 {
2794 	struct zfs_send_one zso = {
2795 		.zhp = zhp,
2796 		.from = from,
2797 		.flags = flags,
2798 		.redactbook = redactbook,
2799 	};
2800 	return (lzc_send_wrapper(zfs_send_one_cb, fd, &zso));
2801 }
2802 
2803 /*
2804  * Routines specific to "zfs recv"
2805  */
2806 
2807 static int
2808 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2809     boolean_t byteswap, zio_cksum_t *zc)
2810 {
2811 	char *cp = buf;
2812 	int rv;
2813 	int len = ilen;
2814 
2815 	do {
2816 		rv = read(fd, cp, len);
2817 		cp += rv;
2818 		len -= rv;
2819 	} while (rv > 0);
2820 
2821 	if (rv < 0 || len != 0) {
2822 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2823 		    "failed to read from stream"));
2824 		return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2825 		    "cannot receive")));
2826 	}
2827 
2828 	if (zc) {
2829 		if (byteswap)
2830 			fletcher_4_incremental_byteswap(buf, ilen, zc);
2831 		else
2832 			fletcher_4_incremental_native(buf, ilen, zc);
2833 	}
2834 	return (0);
2835 }
2836 
2837 static int
2838 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2839     boolean_t byteswap, zio_cksum_t *zc)
2840 {
2841 	char *buf;
2842 	int err;
2843 
2844 	buf = zfs_alloc(hdl, len);
2845 
2846 	if (len > hdl->libzfs_max_nvlist) {
2847 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2848 		free(buf);
2849 		return (ENOMEM);
2850 	}
2851 
2852 	err = recv_read(hdl, fd, buf, len, byteswap, zc);
2853 	if (err != 0) {
2854 		free(buf);
2855 		return (err);
2856 	}
2857 
2858 	err = nvlist_unpack(buf, len, nvp, 0);
2859 	free(buf);
2860 	if (err != 0) {
2861 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2862 		    "stream (malformed nvlist)"));
2863 		return (EINVAL);
2864 	}
2865 	return (0);
2866 }
2867 
2868 /*
2869  * Returns the grand origin (origin of origin of origin...) of a given handle.
2870  * If this dataset is not a clone, it simply returns a copy of the original
2871  * handle.
2872  */
2873 static zfs_handle_t *
2874 recv_open_grand_origin(zfs_handle_t *zhp)
2875 {
2876 	char origin[ZFS_MAX_DATASET_NAME_LEN];
2877 	zprop_source_t src;
2878 	zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2879 
2880 	while (ozhp != NULL) {
2881 		if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2882 		    sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2883 			break;
2884 
2885 		(void) zfs_close(ozhp);
2886 		ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2887 	}
2888 
2889 	return (ozhp);
2890 }
2891 
2892 static int
2893 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2894 {
2895 	int err;
2896 	zfs_handle_t *ozhp = NULL;
2897 
2898 	/*
2899 	 * Attempt to rename the dataset. If it fails with EACCES we have
2900 	 * attempted to rename the dataset outside of its encryption root.
2901 	 * Force the dataset to become an encryption root and try again.
2902 	 */
2903 	err = lzc_rename(name, newname);
2904 	if (err == EACCES) {
2905 		ozhp = recv_open_grand_origin(zhp);
2906 		if (ozhp == NULL) {
2907 			err = ENOENT;
2908 			goto out;
2909 		}
2910 
2911 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2912 		    NULL, NULL, 0);
2913 		if (err != 0)
2914 			goto out;
2915 
2916 		err = lzc_rename(name, newname);
2917 	}
2918 
2919 out:
2920 	if (ozhp != NULL)
2921 		zfs_close(ozhp);
2922 	return (err);
2923 }
2924 
2925 static int
2926 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2927     int baselen, char *newname, recvflags_t *flags)
2928 {
2929 	static int seq;
2930 	int err;
2931 	prop_changelist_t *clp = NULL;
2932 	zfs_handle_t *zhp = NULL;
2933 
2934 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2935 	if (zhp == NULL) {
2936 		err = -1;
2937 		goto out;
2938 	}
2939 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2940 	    flags->force ? MS_FORCE : 0);
2941 	if (clp == NULL) {
2942 		err = -1;
2943 		goto out;
2944 	}
2945 	err = changelist_prefix(clp);
2946 	if (err)
2947 		goto out;
2948 
2949 	if (tryname) {
2950 		(void) strlcpy(newname, tryname, ZFS_MAX_DATASET_NAME_LEN);
2951 		if (flags->verbose) {
2952 			(void) printf("attempting rename %s to %s\n",
2953 			    name, newname);
2954 		}
2955 		err = recv_rename_impl(zhp, name, newname);
2956 		if (err == 0)
2957 			changelist_rename(clp, name, tryname);
2958 	} else {
2959 		err = ENOENT;
2960 	}
2961 
2962 	if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2963 		seq++;
2964 
2965 		(void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2966 		    "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2967 
2968 		if (flags->verbose) {
2969 			(void) printf("failed - trying rename %s to %s\n",
2970 			    name, newname);
2971 		}
2972 		err = recv_rename_impl(zhp, name, newname);
2973 		if (err == 0)
2974 			changelist_rename(clp, name, newname);
2975 		if (err && flags->verbose) {
2976 			(void) printf("failed (%u) - "
2977 			    "will try again on next pass\n", errno);
2978 		}
2979 		err = EAGAIN;
2980 	} else if (flags->verbose) {
2981 		if (err == 0)
2982 			(void) printf("success\n");
2983 		else
2984 			(void) printf("failed (%u)\n", errno);
2985 	}
2986 
2987 	(void) changelist_postfix(clp);
2988 
2989 out:
2990 	if (clp != NULL)
2991 		changelist_free(clp);
2992 	if (zhp != NULL)
2993 		zfs_close(zhp);
2994 
2995 	return (err);
2996 }
2997 
2998 static int
2999 recv_promote(libzfs_handle_t *hdl, const char *fsname,
3000     const char *origin_fsname, recvflags_t *flags)
3001 {
3002 	int err;
3003 	zfs_cmd_t zc = {"\0"};
3004 	zfs_handle_t *zhp = NULL, *ozhp = NULL;
3005 
3006 	if (flags->verbose)
3007 		(void) printf("promoting %s\n", fsname);
3008 
3009 	(void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
3010 	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
3011 
3012 	/*
3013 	 * Attempt to promote the dataset. If it fails with EACCES the
3014 	 * promotion would cause this dataset to leave its encryption root.
3015 	 * Force the origin to become an encryption root and try again.
3016 	 */
3017 	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
3018 	if (err == EACCES) {
3019 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3020 		if (zhp == NULL) {
3021 			err = -1;
3022 			goto out;
3023 		}
3024 
3025 		ozhp = recv_open_grand_origin(zhp);
3026 		if (ozhp == NULL) {
3027 			err = -1;
3028 			goto out;
3029 		}
3030 
3031 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
3032 		    NULL, NULL, 0);
3033 		if (err != 0)
3034 			goto out;
3035 
3036 		err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
3037 	}
3038 
3039 out:
3040 	if (zhp != NULL)
3041 		zfs_close(zhp);
3042 	if (ozhp != NULL)
3043 		zfs_close(ozhp);
3044 
3045 	return (err);
3046 }
3047 
3048 static int
3049 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
3050     char *newname, recvflags_t *flags)
3051 {
3052 	int err = 0;
3053 	prop_changelist_t *clp;
3054 	zfs_handle_t *zhp;
3055 	boolean_t defer = B_FALSE;
3056 	int spa_version;
3057 
3058 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
3059 	if (zhp == NULL)
3060 		return (-1);
3061 	zfs_type_t type = zfs_get_type(zhp);
3062 	if (type == ZFS_TYPE_SNAPSHOT &&
3063 	    zfs_spa_version(zhp, &spa_version) == 0 &&
3064 	    spa_version >= SPA_VERSION_USERREFS)
3065 		defer = B_TRUE;
3066 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
3067 	    flags->force ? MS_FORCE : 0);
3068 	zfs_close(zhp);
3069 	if (clp == NULL)
3070 		return (-1);
3071 
3072 	err = changelist_prefix(clp);
3073 	if (err)
3074 		return (err);
3075 
3076 	if (flags->verbose)
3077 		(void) printf("attempting destroy %s\n", name);
3078 	if (type == ZFS_TYPE_SNAPSHOT) {
3079 		nvlist_t *nv = fnvlist_alloc();
3080 		fnvlist_add_boolean(nv, name);
3081 		err = lzc_destroy_snaps(nv, defer, NULL);
3082 		fnvlist_free(nv);
3083 	} else {
3084 		err = lzc_destroy(name);
3085 	}
3086 	if (err == 0) {
3087 		if (flags->verbose)
3088 			(void) printf("success\n");
3089 		changelist_remove(clp, name);
3090 	}
3091 
3092 	(void) changelist_postfix(clp);
3093 	changelist_free(clp);
3094 
3095 	/*
3096 	 * Deferred destroy might destroy the snapshot or only mark it to be
3097 	 * destroyed later, and it returns success in either case.
3098 	 */
3099 	if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
3100 	    ZFS_TYPE_SNAPSHOT))) {
3101 		err = recv_rename(hdl, name, NULL, baselen, newname, flags);
3102 	}
3103 
3104 	return (err);
3105 }
3106 
3107 typedef struct guid_to_name_data {
3108 	uint64_t guid;
3109 	boolean_t bookmark_ok;
3110 	char *name;
3111 	char *skip;
3112 	uint64_t *redact_snap_guids;
3113 	uint64_t num_redact_snaps;
3114 } guid_to_name_data_t;
3115 
3116 static boolean_t
3117 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
3118 {
3119 	uint64_t *bmark_snaps;
3120 	uint_t bmark_num_snaps;
3121 	nvlist_t *nvl;
3122 	if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
3123 		return (B_FALSE);
3124 
3125 	nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
3126 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
3127 	bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
3128 	    &bmark_num_snaps);
3129 	if (bmark_num_snaps != gtnd->num_redact_snaps)
3130 		return (B_FALSE);
3131 	int i = 0;
3132 	for (; i < bmark_num_snaps; i++) {
3133 		int j = 0;
3134 		for (; j < bmark_num_snaps; j++) {
3135 			if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
3136 				break;
3137 		}
3138 		if (j == bmark_num_snaps)
3139 			break;
3140 	}
3141 	return (i == bmark_num_snaps);
3142 }
3143 
3144 static int
3145 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
3146 {
3147 	guid_to_name_data_t *gtnd = arg;
3148 	const char *slash;
3149 	int err;
3150 
3151 	if (gtnd->skip != NULL &&
3152 	    (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
3153 	    strcmp(slash + 1, gtnd->skip) == 0) {
3154 		zfs_close(zhp);
3155 		return (0);
3156 	}
3157 
3158 	if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
3159 	    (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
3160 		(void) strcpy(gtnd->name, zhp->zfs_name);
3161 		zfs_close(zhp);
3162 		return (EEXIST);
3163 	}
3164 
3165 	err = zfs_iter_children_v2(zhp, 0, guid_to_name_cb, gtnd);
3166 	if (err != EEXIST && gtnd->bookmark_ok)
3167 		err = zfs_iter_bookmarks_v2(zhp, 0, guid_to_name_cb, gtnd);
3168 	zfs_close(zhp);
3169 	return (err);
3170 }
3171 
3172 /*
3173  * Attempt to find the local dataset associated with this guid.  In the case of
3174  * multiple matches, we attempt to find the "best" match by searching
3175  * progressively larger portions of the hierarchy.  This allows one to send a
3176  * tree of datasets individually and guarantee that we will find the source
3177  * guid within that hierarchy, even if there are multiple matches elsewhere.
3178  *
3179  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
3180  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
3181  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
3182  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
3183  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
3184  * given guid.  Note that a redaction bookmark can be returned if
3185  * num_redact_snaps == -1.
3186  */
3187 static int
3188 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
3189     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
3190     uint64_t num_redact_snaps, char *name)
3191 {
3192 	char pname[ZFS_MAX_DATASET_NAME_LEN];
3193 	guid_to_name_data_t gtnd;
3194 
3195 	gtnd.guid = guid;
3196 	gtnd.bookmark_ok = bookmark_ok;
3197 	gtnd.name = name;
3198 	gtnd.skip = NULL;
3199 	gtnd.redact_snap_guids = redact_snap_guids;
3200 	gtnd.num_redact_snaps = num_redact_snaps;
3201 
3202 	/*
3203 	 * Search progressively larger portions of the hierarchy, starting
3204 	 * with the filesystem specified by 'parent'.  This will
3205 	 * select the "most local" version of the origin snapshot in the case
3206 	 * that there are multiple matching snapshots in the system.
3207 	 */
3208 	(void) strlcpy(pname, parent, sizeof (pname));
3209 	char *cp = strrchr(pname, '@');
3210 	if (cp == NULL)
3211 		cp = strchr(pname, '\0');
3212 	for (; cp != NULL; cp = strrchr(pname, '/')) {
3213 		/* Chop off the last component and open the parent */
3214 		*cp = '\0';
3215 		zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3216 
3217 		if (zhp == NULL)
3218 			continue;
3219 		int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3220 		if (err != EEXIST)
3221 			err = zfs_iter_children_v2(zhp, 0, guid_to_name_cb,
3222 			    &gtnd);
3223 		if (err != EEXIST && bookmark_ok)
3224 			err = zfs_iter_bookmarks_v2(zhp, 0, guid_to_name_cb,
3225 			    &gtnd);
3226 		zfs_close(zhp);
3227 		if (err == EEXIST)
3228 			return (0);
3229 
3230 		/*
3231 		 * Remember the last portion of the dataset so we skip it next
3232 		 * time through (as we've already searched that portion of the
3233 		 * hierarchy).
3234 		 */
3235 		gtnd.skip = strrchr(pname, '/') + 1;
3236 	}
3237 
3238 	return (ENOENT);
3239 }
3240 
3241 static int
3242 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3243     boolean_t bookmark_ok, char *name)
3244 {
3245 	return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3246 	    -1, name));
3247 }
3248 
3249 /*
3250  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3251  * guid1 is after guid2.
3252  */
3253 static int
3254 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3255     uint64_t guid1, uint64_t guid2)
3256 {
3257 	nvlist_t *nvfs;
3258 	const char *fsname = NULL, *snapname = NULL;
3259 	char buf[ZFS_MAX_DATASET_NAME_LEN];
3260 	int rv;
3261 	zfs_handle_t *guid1hdl, *guid2hdl;
3262 	uint64_t create1, create2;
3263 
3264 	if (guid2 == 0)
3265 		return (0);
3266 	if (guid1 == 0)
3267 		return (1);
3268 
3269 	nvfs = fsavl_find(avl, guid1, &snapname);
3270 	fsname = fnvlist_lookup_string(nvfs, "name");
3271 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3272 	guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3273 	if (guid1hdl == NULL)
3274 		return (-1);
3275 
3276 	nvfs = fsavl_find(avl, guid2, &snapname);
3277 	fsname = fnvlist_lookup_string(nvfs, "name");
3278 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3279 	guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3280 	if (guid2hdl == NULL) {
3281 		zfs_close(guid1hdl);
3282 		return (-1);
3283 	}
3284 
3285 	create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3286 	create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3287 
3288 	if (create1 < create2)
3289 		rv = -1;
3290 	else if (create1 > create2)
3291 		rv = +1;
3292 	else
3293 		rv = 0;
3294 
3295 	zfs_close(guid1hdl);
3296 	zfs_close(guid2hdl);
3297 
3298 	return (rv);
3299 }
3300 
3301 /*
3302  * This function reestablishes the hierarchy of encryption roots after a
3303  * recursive incremental receive has completed. This must be done after the
3304  * second call to recv_incremental_replication() has renamed and promoted all
3305  * sent datasets to their final locations in the dataset hierarchy.
3306  */
3307 static int
3308 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3309     nvlist_t *stream_nv)
3310 {
3311 	int err;
3312 	nvpair_t *fselem = NULL;
3313 	nvlist_t *stream_fss;
3314 
3315 	stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3316 
3317 	while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3318 		zfs_handle_t *zhp = NULL;
3319 		uint64_t crypt;
3320 		nvlist_t *snaps, *props, *stream_nvfs = NULL;
3321 		nvpair_t *snapel = NULL;
3322 		boolean_t is_encroot, is_clone, stream_encroot;
3323 		char *cp;
3324 		const char *stream_keylocation = NULL;
3325 		char keylocation[MAXNAMELEN];
3326 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
3327 
3328 		keylocation[0] = '\0';
3329 		stream_nvfs = fnvpair_value_nvlist(fselem);
3330 		snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3331 		props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3332 		stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3333 
3334 		/* find a snapshot from the stream that exists locally */
3335 		err = ENOENT;
3336 		while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3337 			uint64_t guid;
3338 
3339 			guid = fnvpair_value_uint64(snapel);
3340 			err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3341 			    fsname);
3342 			if (err == 0)
3343 				break;
3344 		}
3345 
3346 		if (err != 0)
3347 			continue;
3348 
3349 		cp = strchr(fsname, '@');
3350 		if (cp != NULL)
3351 			*cp = '\0';
3352 
3353 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3354 		if (zhp == NULL) {
3355 			err = ENOENT;
3356 			goto error;
3357 		}
3358 
3359 		crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3360 		is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3361 		(void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3362 
3363 		/* we don't need to do anything for unencrypted datasets */
3364 		if (crypt == ZIO_CRYPT_OFF) {
3365 			zfs_close(zhp);
3366 			continue;
3367 		}
3368 
3369 		/*
3370 		 * If the dataset is flagged as an encryption root, was not
3371 		 * received as a clone and is not currently an encryption root,
3372 		 * force it to become one. Fixup the keylocation if necessary.
3373 		 */
3374 		if (stream_encroot) {
3375 			if (!is_clone && !is_encroot) {
3376 				err = lzc_change_key(fsname,
3377 				    DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3378 				if (err != 0) {
3379 					zfs_close(zhp);
3380 					goto error;
3381 				}
3382 			}
3383 
3384 			stream_keylocation = fnvlist_lookup_string(props,
3385 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3386 
3387 			/*
3388 			 * Refresh the properties in case the call to
3389 			 * lzc_change_key() changed the value.
3390 			 */
3391 			zfs_refresh_properties(zhp);
3392 			err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3393 			    keylocation, sizeof (keylocation), NULL, NULL,
3394 			    0, B_TRUE);
3395 			if (err != 0) {
3396 				zfs_close(zhp);
3397 				goto error;
3398 			}
3399 
3400 			if (strcmp(keylocation, stream_keylocation) != 0) {
3401 				err = zfs_prop_set(zhp,
3402 				    zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3403 				    stream_keylocation);
3404 				if (err != 0) {
3405 					zfs_close(zhp);
3406 					goto error;
3407 				}
3408 			}
3409 		}
3410 
3411 		/*
3412 		 * If the dataset is not flagged as an encryption root and is
3413 		 * currently an encryption root, force it to inherit from its
3414 		 * parent. The root of a raw send should never be
3415 		 * force-inherited.
3416 		 */
3417 		if (!stream_encroot && is_encroot &&
3418 		    strcmp(top_zfs, fsname) != 0) {
3419 			err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3420 			    NULL, NULL, 0);
3421 			if (err != 0) {
3422 				zfs_close(zhp);
3423 				goto error;
3424 			}
3425 		}
3426 
3427 		zfs_close(zhp);
3428 	}
3429 
3430 	return (0);
3431 
3432 error:
3433 	return (err);
3434 }
3435 
3436 static int
3437 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3438     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3439     nvlist_t *renamed)
3440 {
3441 	nvlist_t *local_nv, *deleted = NULL;
3442 	avl_tree_t *local_avl;
3443 	nvpair_t *fselem, *nextfselem;
3444 	const char *fromsnap;
3445 	char newname[ZFS_MAX_DATASET_NAME_LEN];
3446 	char guidname[32];
3447 	int error;
3448 	boolean_t needagain, progress, recursive;
3449 	const char *s1, *s2;
3450 
3451 	fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3452 
3453 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3454 	    ENOENT);
3455 
3456 	if (flags->dryrun)
3457 		return (0);
3458 
3459 again:
3460 	needagain = progress = B_FALSE;
3461 
3462 	deleted = fnvlist_alloc();
3463 
3464 	if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3465 	    recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3466 	    B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3467 		return (error);
3468 
3469 	/*
3470 	 * Process deletes and renames
3471 	 */
3472 	for (fselem = nvlist_next_nvpair(local_nv, NULL);
3473 	    fselem; fselem = nextfselem) {
3474 		nvlist_t *nvfs, *snaps;
3475 		nvlist_t *stream_nvfs = NULL;
3476 		nvpair_t *snapelem, *nextsnapelem;
3477 		uint64_t fromguid = 0;
3478 		uint64_t originguid = 0;
3479 		uint64_t stream_originguid = 0;
3480 		uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3481 		const char *fsname, *stream_fsname;
3482 
3483 		nextfselem = nvlist_next_nvpair(local_nv, fselem);
3484 
3485 		nvfs = fnvpair_value_nvlist(fselem);
3486 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3487 		fsname = fnvlist_lookup_string(nvfs, "name");
3488 		parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3489 		    "parentfromsnap");
3490 		(void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3491 
3492 		/*
3493 		 * First find the stream's fs, so we can check for
3494 		 * a different origin (due to "zfs promote")
3495 		 */
3496 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3497 		    snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3498 			uint64_t thisguid;
3499 
3500 			thisguid = fnvpair_value_uint64(snapelem);
3501 			stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3502 
3503 			if (stream_nvfs != NULL)
3504 				break;
3505 		}
3506 
3507 		/* check for promote */
3508 		(void) nvlist_lookup_uint64(stream_nvfs, "origin",
3509 		    &stream_originguid);
3510 		if (stream_nvfs && originguid != stream_originguid) {
3511 			switch (created_before(hdl, local_avl,
3512 			    stream_originguid, originguid)) {
3513 			case 1: {
3514 				/* promote it! */
3515 				nvlist_t *origin_nvfs;
3516 				const char *origin_fsname;
3517 
3518 				origin_nvfs = fsavl_find(local_avl, originguid,
3519 				    NULL);
3520 				origin_fsname = fnvlist_lookup_string(
3521 				    origin_nvfs, "name");
3522 				error = recv_promote(hdl, fsname, origin_fsname,
3523 				    flags);
3524 				if (error == 0)
3525 					progress = B_TRUE;
3526 				break;
3527 			}
3528 			default:
3529 				break;
3530 			case -1:
3531 				fsavl_destroy(local_avl);
3532 				fnvlist_free(local_nv);
3533 				return (-1);
3534 			}
3535 			/*
3536 			 * We had/have the wrong origin, therefore our
3537 			 * list of snapshots is wrong.  Need to handle
3538 			 * them on the next pass.
3539 			 */
3540 			needagain = B_TRUE;
3541 			continue;
3542 		}
3543 
3544 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3545 		    snapelem; snapelem = nextsnapelem) {
3546 			uint64_t thisguid;
3547 			const char *stream_snapname;
3548 			nvlist_t *found, *props;
3549 
3550 			nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3551 
3552 			thisguid = fnvpair_value_uint64(snapelem);
3553 			found = fsavl_find(stream_avl, thisguid,
3554 			    &stream_snapname);
3555 
3556 			/* check for delete */
3557 			if (found == NULL) {
3558 				char name[ZFS_MAX_DATASET_NAME_LEN];
3559 
3560 				if (!flags->force)
3561 					continue;
3562 
3563 				(void) snprintf(name, sizeof (name), "%s@%s",
3564 				    fsname, nvpair_name(snapelem));
3565 
3566 				error = recv_destroy(hdl, name,
3567 				    strlen(fsname)+1, newname, flags);
3568 				if (error)
3569 					needagain = B_TRUE;
3570 				else
3571 					progress = B_TRUE;
3572 				sprintf(guidname, "%llu",
3573 				    (u_longlong_t)thisguid);
3574 				nvlist_add_boolean(deleted, guidname);
3575 				continue;
3576 			}
3577 
3578 			stream_nvfs = found;
3579 
3580 			if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3581 			    &props) && 0 == nvlist_lookup_nvlist(props,
3582 			    stream_snapname, &props)) {
3583 				zfs_cmd_t zc = {"\0"};
3584 
3585 				zc.zc_cookie = B_TRUE; /* received */
3586 				(void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3587 				    "%s@%s", fsname, nvpair_name(snapelem));
3588 				zcmd_write_src_nvlist(hdl, &zc, props);
3589 				(void) zfs_ioctl(hdl,
3590 				    ZFS_IOC_SET_PROP, &zc);
3591 				zcmd_free_nvlists(&zc);
3592 			}
3593 
3594 			/* check for different snapname */
3595 			if (strcmp(nvpair_name(snapelem),
3596 			    stream_snapname) != 0) {
3597 				char name[ZFS_MAX_DATASET_NAME_LEN];
3598 				char tryname[ZFS_MAX_DATASET_NAME_LEN];
3599 
3600 				(void) snprintf(name, sizeof (name), "%s@%s",
3601 				    fsname, nvpair_name(snapelem));
3602 				(void) snprintf(tryname, sizeof (name), "%s@%s",
3603 				    fsname, stream_snapname);
3604 
3605 				error = recv_rename(hdl, name, tryname,
3606 				    strlen(fsname)+1, newname, flags);
3607 				if (error)
3608 					needagain = B_TRUE;
3609 				else
3610 					progress = B_TRUE;
3611 			}
3612 
3613 			if (strcmp(stream_snapname, fromsnap) == 0)
3614 				fromguid = thisguid;
3615 		}
3616 
3617 		/* check for delete */
3618 		if (stream_nvfs == NULL) {
3619 			if (!flags->force)
3620 				continue;
3621 
3622 			error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3623 			    newname, flags);
3624 			if (error)
3625 				needagain = B_TRUE;
3626 			else
3627 				progress = B_TRUE;
3628 			sprintf(guidname, "%llu",
3629 			    (u_longlong_t)parent_fromsnap_guid);
3630 			nvlist_add_boolean(deleted, guidname);
3631 			continue;
3632 		}
3633 
3634 		if (fromguid == 0) {
3635 			if (flags->verbose) {
3636 				(void) printf("local fs %s does not have "
3637 				    "fromsnap (%s in stream); must have "
3638 				    "been deleted locally; ignoring\n",
3639 				    fsname, fromsnap);
3640 			}
3641 			continue;
3642 		}
3643 
3644 		stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3645 		stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3646 		    stream_nvfs, "parentfromsnap");
3647 
3648 		s1 = strrchr(fsname, '/');
3649 		s2 = strrchr(stream_fsname, '/');
3650 
3651 		/*
3652 		 * Check if we're going to rename based on parent guid change
3653 		 * and the current parent guid was also deleted. If it was then
3654 		 * rename will fail and is likely unneeded, so avoid this and
3655 		 * force an early retry to determine the new
3656 		 * parent_fromsnap_guid.
3657 		 */
3658 		if (stream_parent_fromsnap_guid != 0 &&
3659 		    parent_fromsnap_guid != 0 &&
3660 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3661 			sprintf(guidname, "%llu",
3662 			    (u_longlong_t)parent_fromsnap_guid);
3663 			if (nvlist_exists(deleted, guidname)) {
3664 				progress = B_TRUE;
3665 				needagain = B_TRUE;
3666 				goto doagain;
3667 			}
3668 		}
3669 
3670 		/*
3671 		 * Check for rename. If the exact receive path is specified, it
3672 		 * does not count as a rename, but we still need to check the
3673 		 * datasets beneath it.
3674 		 */
3675 		if ((stream_parent_fromsnap_guid != 0 &&
3676 		    parent_fromsnap_guid != 0 &&
3677 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3678 		    ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3679 		    (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3680 			nvlist_t *parent;
3681 			char tryname[ZFS_MAX_DATASET_NAME_LEN];
3682 
3683 			parent = fsavl_find(local_avl,
3684 			    stream_parent_fromsnap_guid, NULL);
3685 			/*
3686 			 * NB: parent might not be found if we used the
3687 			 * tosnap for stream_parent_fromsnap_guid,
3688 			 * because the parent is a newly-created fs;
3689 			 * we'll be able to rename it after we recv the
3690 			 * new fs.
3691 			 */
3692 			if (parent != NULL) {
3693 				const char *pname;
3694 
3695 				pname = fnvlist_lookup_string(parent, "name");
3696 				(void) snprintf(tryname, sizeof (tryname),
3697 				    "%s%s", pname, strrchr(stream_fsname, '/'));
3698 			} else {
3699 				tryname[0] = '\0';
3700 				if (flags->verbose) {
3701 					(void) printf("local fs %s new parent "
3702 					    "not found\n", fsname);
3703 				}
3704 			}
3705 
3706 			newname[0] = '\0';
3707 
3708 			error = recv_rename(hdl, fsname, tryname,
3709 			    strlen(tofs)+1, newname, flags);
3710 
3711 			if (renamed != NULL && newname[0] != '\0') {
3712 				fnvlist_add_boolean(renamed, newname);
3713 			}
3714 
3715 			if (error)
3716 				needagain = B_TRUE;
3717 			else
3718 				progress = B_TRUE;
3719 		}
3720 	}
3721 
3722 doagain:
3723 	fsavl_destroy(local_avl);
3724 	fnvlist_free(local_nv);
3725 	fnvlist_free(deleted);
3726 
3727 	if (needagain && progress) {
3728 		/* do another pass to fix up temporary names */
3729 		if (flags->verbose)
3730 			(void) printf("another pass:\n");
3731 		goto again;
3732 	}
3733 
3734 	return (needagain || error != 0);
3735 }
3736 
3737 static int
3738 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3739     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3740     char **top_zfs, nvlist_t *cmdprops)
3741 {
3742 	nvlist_t *stream_nv = NULL;
3743 	avl_tree_t *stream_avl = NULL;
3744 	const char *fromsnap = NULL;
3745 	const char *sendsnap = NULL;
3746 	char *cp;
3747 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
3748 	char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3749 	char errbuf[ERRBUFLEN];
3750 	dmu_replay_record_t drre;
3751 	int error;
3752 	boolean_t anyerr = B_FALSE;
3753 	boolean_t softerr = B_FALSE;
3754 	boolean_t recursive, raw;
3755 
3756 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3757 	    "cannot receive"));
3758 
3759 	assert(drr->drr_type == DRR_BEGIN);
3760 	assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3761 	assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3762 	    DMU_COMPOUNDSTREAM);
3763 
3764 	/*
3765 	 * Read in the nvlist from the stream.
3766 	 */
3767 	if (drr->drr_payloadlen != 0) {
3768 		error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3769 		    &stream_nv, flags->byteswap, zc);
3770 		if (error) {
3771 			error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3772 			goto out;
3773 		}
3774 	}
3775 
3776 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3777 	    ENOENT);
3778 	raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3779 
3780 	if (recursive && strchr(destname, '@')) {
3781 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3782 		    "cannot specify snapshot name for multi-snapshot stream"));
3783 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3784 		goto out;
3785 	}
3786 
3787 	/*
3788 	 * Read in the end record and verify checksum.
3789 	 */
3790 	if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3791 	    flags->byteswap, NULL)))
3792 		goto out;
3793 	if (flags->byteswap) {
3794 		drre.drr_type = BSWAP_32(drre.drr_type);
3795 		drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3796 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3797 		drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3798 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3799 		drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3800 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3801 		drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3802 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3803 	}
3804 	if (drre.drr_type != DRR_END) {
3805 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3806 		goto out;
3807 	}
3808 	if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3809 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3810 		    "incorrect header checksum"));
3811 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3812 		goto out;
3813 	}
3814 
3815 	(void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3816 
3817 	if (drr->drr_payloadlen != 0) {
3818 		nvlist_t *stream_fss;
3819 
3820 		stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3821 		if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3822 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3823 			    "couldn't allocate avl tree"));
3824 			error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3825 			goto out;
3826 		}
3827 
3828 		if (fromsnap != NULL && recursive) {
3829 			nvlist_t *renamed = NULL;
3830 			nvpair_t *pair = NULL;
3831 
3832 			(void) strlcpy(tofs, destname, sizeof (tofs));
3833 			if (flags->isprefix) {
3834 				struct drr_begin *drrb = &drr->drr_u.drr_begin;
3835 				int i;
3836 
3837 				if (flags->istail) {
3838 					cp = strrchr(drrb->drr_toname, '/');
3839 					if (cp == NULL) {
3840 						(void) strlcat(tofs, "/",
3841 						    sizeof (tofs));
3842 						i = 0;
3843 					} else {
3844 						i = (cp - drrb->drr_toname);
3845 					}
3846 				} else {
3847 					i = strcspn(drrb->drr_toname, "/@");
3848 				}
3849 				/* zfs_receive_one() will create_parents() */
3850 				(void) strlcat(tofs, &drrb->drr_toname[i],
3851 				    sizeof (tofs));
3852 				*strchr(tofs, '@') = '\0';
3853 			}
3854 
3855 			if (!flags->dryrun && !flags->nomount) {
3856 				renamed = fnvlist_alloc();
3857 			}
3858 
3859 			softerr = recv_incremental_replication(hdl, tofs, flags,
3860 			    stream_nv, stream_avl, renamed);
3861 
3862 			/* Unmount renamed filesystems before receiving. */
3863 			while ((pair = nvlist_next_nvpair(renamed,
3864 			    pair)) != NULL) {
3865 				zfs_handle_t *zhp;
3866 				prop_changelist_t *clp = NULL;
3867 
3868 				zhp = zfs_open(hdl, nvpair_name(pair),
3869 				    ZFS_TYPE_FILESYSTEM);
3870 				if (zhp != NULL) {
3871 					clp = changelist_gather(zhp,
3872 					    ZFS_PROP_MOUNTPOINT, 0,
3873 					    flags->forceunmount ? MS_FORCE : 0);
3874 					zfs_close(zhp);
3875 					if (clp != NULL) {
3876 						softerr |=
3877 						    changelist_prefix(clp);
3878 						changelist_free(clp);
3879 					}
3880 				}
3881 			}
3882 
3883 			fnvlist_free(renamed);
3884 		}
3885 	}
3886 
3887 	/*
3888 	 * Get the fs specified by the first path in the stream (the top level
3889 	 * specified by 'zfs send') and pass it to each invocation of
3890 	 * zfs_receive_one().
3891 	 */
3892 	(void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3893 	    sizeof (sendfs));
3894 	if ((cp = strchr(sendfs, '@')) != NULL) {
3895 		*cp = '\0';
3896 		/*
3897 		 * Find the "sendsnap", the final snapshot in a replication
3898 		 * stream.  zfs_receive_one() handles certain errors
3899 		 * differently, depending on if the contained stream is the
3900 		 * last one or not.
3901 		 */
3902 		sendsnap = (cp + 1);
3903 	}
3904 
3905 	/* Finally, receive each contained stream */
3906 	do {
3907 		/*
3908 		 * we should figure out if it has a recoverable
3909 		 * error, in which case do a recv_skip() and drive on.
3910 		 * Note, if we fail due to already having this guid,
3911 		 * zfs_receive_one() will take care of it (ie,
3912 		 * recv_skip() and return 0).
3913 		 */
3914 		error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3915 		    sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3916 		if (error == ENODATA) {
3917 			error = 0;
3918 			break;
3919 		}
3920 		anyerr |= error;
3921 	} while (error == 0);
3922 
3923 	if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3924 		/*
3925 		 * Now that we have the fs's they sent us, try the
3926 		 * renames again.
3927 		 */
3928 		softerr = recv_incremental_replication(hdl, tofs, flags,
3929 		    stream_nv, stream_avl, NULL);
3930 	}
3931 
3932 	if (raw && softerr == 0 && *top_zfs != NULL) {
3933 		softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3934 		    stream_nv);
3935 	}
3936 
3937 out:
3938 	fsavl_destroy(stream_avl);
3939 	fnvlist_free(stream_nv);
3940 	if (softerr)
3941 		error = -2;
3942 	if (anyerr)
3943 		error = -1;
3944 	return (error);
3945 }
3946 
3947 static void
3948 trunc_prop_errs(int truncated)
3949 {
3950 	ASSERT(truncated != 0);
3951 
3952 	if (truncated == 1)
3953 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3954 		    "1 more property could not be set\n"));
3955 	else
3956 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3957 		    "%d more properties could not be set\n"), truncated);
3958 }
3959 
3960 static int
3961 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3962 {
3963 	dmu_replay_record_t *drr;
3964 	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3965 	uint64_t payload_size;
3966 	char errbuf[ERRBUFLEN];
3967 
3968 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3969 	    "cannot receive"));
3970 
3971 	/* XXX would be great to use lseek if possible... */
3972 	drr = buf;
3973 
3974 	while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3975 	    byteswap, NULL) == 0) {
3976 		if (byteswap)
3977 			drr->drr_type = BSWAP_32(drr->drr_type);
3978 
3979 		switch (drr->drr_type) {
3980 		case DRR_BEGIN:
3981 			if (drr->drr_payloadlen != 0) {
3982 				(void) recv_read(hdl, fd, buf,
3983 				    drr->drr_payloadlen, B_FALSE, NULL);
3984 			}
3985 			break;
3986 
3987 		case DRR_END:
3988 			free(buf);
3989 			return (0);
3990 
3991 		case DRR_OBJECT:
3992 			if (byteswap) {
3993 				drr->drr_u.drr_object.drr_bonuslen =
3994 				    BSWAP_32(drr->drr_u.drr_object.
3995 				    drr_bonuslen);
3996 				drr->drr_u.drr_object.drr_raw_bonuslen =
3997 				    BSWAP_32(drr->drr_u.drr_object.
3998 				    drr_raw_bonuslen);
3999 			}
4000 
4001 			payload_size =
4002 			    DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
4003 			(void) recv_read(hdl, fd, buf, payload_size,
4004 			    B_FALSE, NULL);
4005 			break;
4006 
4007 		case DRR_WRITE:
4008 			if (byteswap) {
4009 				drr->drr_u.drr_write.drr_logical_size =
4010 				    BSWAP_64(
4011 				    drr->drr_u.drr_write.drr_logical_size);
4012 				drr->drr_u.drr_write.drr_compressed_size =
4013 				    BSWAP_64(
4014 				    drr->drr_u.drr_write.drr_compressed_size);
4015 			}
4016 			payload_size =
4017 			    DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
4018 			assert(payload_size <= SPA_MAXBLOCKSIZE);
4019 			(void) recv_read(hdl, fd, buf,
4020 			    payload_size, B_FALSE, NULL);
4021 			break;
4022 		case DRR_SPILL:
4023 			if (byteswap) {
4024 				drr->drr_u.drr_spill.drr_length =
4025 				    BSWAP_64(drr->drr_u.drr_spill.drr_length);
4026 				drr->drr_u.drr_spill.drr_compressed_size =
4027 				    BSWAP_64(drr->drr_u.drr_spill.
4028 				    drr_compressed_size);
4029 			}
4030 
4031 			payload_size =
4032 			    DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
4033 			(void) recv_read(hdl, fd, buf, payload_size,
4034 			    B_FALSE, NULL);
4035 			break;
4036 		case DRR_WRITE_EMBEDDED:
4037 			if (byteswap) {
4038 				drr->drr_u.drr_write_embedded.drr_psize =
4039 				    BSWAP_32(drr->drr_u.drr_write_embedded.
4040 				    drr_psize);
4041 			}
4042 			(void) recv_read(hdl, fd, buf,
4043 			    P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
4044 			    8), B_FALSE, NULL);
4045 			break;
4046 		case DRR_OBJECT_RANGE:
4047 		case DRR_WRITE_BYREF:
4048 		case DRR_FREEOBJECTS:
4049 		case DRR_FREE:
4050 			break;
4051 
4052 		default:
4053 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4054 			    "invalid record type"));
4055 			free(buf);
4056 			return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
4057 		}
4058 	}
4059 
4060 	free(buf);
4061 	return (-1);
4062 }
4063 
4064 static void
4065 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
4066     boolean_t resumable, boolean_t checksum)
4067 {
4068 	char target_fs[ZFS_MAX_DATASET_NAME_LEN];
4069 
4070 	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
4071 	    "checksum mismatch" : "incomplete stream")));
4072 
4073 	if (!resumable)
4074 		return;
4075 	(void) strlcpy(target_fs, target_snap, sizeof (target_fs));
4076 	*strchr(target_fs, '@') = '\0';
4077 	zfs_handle_t *zhp = zfs_open(hdl, target_fs,
4078 	    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
4079 	if (zhp == NULL)
4080 		return;
4081 
4082 	char token_buf[ZFS_MAXPROPLEN];
4083 	int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
4084 	    token_buf, sizeof (token_buf),
4085 	    NULL, NULL, 0, B_TRUE);
4086 	if (error == 0) {
4087 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4088 		    "checksum mismatch or incomplete stream.\n"
4089 		    "Partially received snapshot is saved.\n"
4090 		    "A resuming stream can be generated on the sending "
4091 		    "system by running:\n"
4092 		    "    zfs send -t %s"),
4093 		    token_buf);
4094 	}
4095 	zfs_close(zhp);
4096 }
4097 
4098 /*
4099  * Prepare a new nvlist of properties that are to override (-o) or be excluded
4100  * (-x) from the received dataset
4101  * recvprops: received properties from the send stream
4102  * cmdprops: raw input properties from command line
4103  * origprops: properties, both locally-set and received, currently set on the
4104  *            target dataset if it exists, NULL otherwise.
4105  * oxprops: valid output override (-o) and excluded (-x) properties
4106  */
4107 static int
4108 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
4109     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
4110     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
4111     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
4112     uint_t *wkeylen_out, const char *errbuf)
4113 {
4114 	nvpair_t *nvp;
4115 	nvlist_t *oprops, *voprops;
4116 	zfs_handle_t *zhp = NULL;
4117 	zpool_handle_t *zpool_hdl = NULL;
4118 	char *cp;
4119 	int ret = 0;
4120 	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
4121 
4122 	if (nvlist_empty(cmdprops))
4123 		return (0); /* No properties to override or exclude */
4124 
4125 	*oxprops = fnvlist_alloc();
4126 	oprops = fnvlist_alloc();
4127 
4128 	strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
4129 
4130 	/*
4131 	 * Get our dataset handle. The target dataset may not exist yet.
4132 	 */
4133 	if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
4134 		zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
4135 		if (zhp == NULL) {
4136 			ret = -1;
4137 			goto error;
4138 		}
4139 	}
4140 
4141 	/* open the zpool handle */
4142 	cp = strchr(namebuf, '/');
4143 	if (cp != NULL)
4144 		*cp = '\0';
4145 	zpool_hdl = zpool_open(hdl, namebuf);
4146 	if (zpool_hdl == NULL) {
4147 		ret = -1;
4148 		goto error;
4149 	}
4150 
4151 	/* restore namebuf to match fsname for later use */
4152 	if (cp != NULL)
4153 		*cp = '/';
4154 
4155 	/*
4156 	 * first iteration: process excluded (-x) properties now and gather
4157 	 * added (-o) properties to be later processed by zfs_valid_proplist()
4158 	 */
4159 	nvp = NULL;
4160 	while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
4161 		const char *name = nvpair_name(nvp);
4162 		zfs_prop_t prop = zfs_name_to_prop(name);
4163 
4164 		/*
4165 		 * It turns out, if we don't normalize "aliased" names
4166 		 * e.g. compress= against the "real" names (e.g. compression)
4167 		 * here, then setting/excluding them does not work as
4168 		 * intended.
4169 		 *
4170 		 * But since user-defined properties wouldn't have a valid
4171 		 * mapping here, we do this conditional dance.
4172 		 */
4173 		const char *newname = name;
4174 		if (prop >= ZFS_PROP_TYPE)
4175 			newname = zfs_prop_to_name(prop);
4176 
4177 		/* "origin" is processed separately, don't handle it here */
4178 		if (prop == ZFS_PROP_ORIGIN)
4179 			continue;
4180 
4181 		/* raw streams can't override encryption properties */
4182 		if ((zfs_prop_encryption_key_param(prop) ||
4183 		    prop == ZFS_PROP_ENCRYPTION) && raw) {
4184 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4185 			    "encryption property '%s' cannot "
4186 			    "be set or excluded for raw streams."), name);
4187 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4188 			goto error;
4189 		}
4190 
4191 		/*
4192 		 * For plain replicated send, we can ignore encryption
4193 		 * properties other than first stream
4194 		 */
4195 		if ((zfs_prop_encryption_key_param(prop) || prop ==
4196 		    ZFS_PROP_ENCRYPTION) && !newfs && recursive && !raw) {
4197 			continue;
4198 		}
4199 
4200 		/* incremental streams can only exclude encryption properties */
4201 		if ((zfs_prop_encryption_key_param(prop) ||
4202 		    prop == ZFS_PROP_ENCRYPTION) && !newfs &&
4203 		    nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
4204 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4205 			    "encryption property '%s' cannot "
4206 			    "be set for incremental streams."), name);
4207 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4208 			goto error;
4209 		}
4210 
4211 		switch (nvpair_type(nvp)) {
4212 		case DATA_TYPE_BOOLEAN: /* -x property */
4213 			/*
4214 			 * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4215 			 * a property: this is done by forcing an explicit
4216 			 * inherit on the destination so the effective value is
4217 			 * not the one we received from the send stream.
4218 			 */
4219 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4220 			    !zfs_prop_user(name)) {
4221 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4222 				    "Warning: %s: property '%s' does not "
4223 				    "apply to datasets of this type\n"),
4224 				    fsname, name);
4225 				continue;
4226 			}
4227 			/*
4228 			 * We do this only if the property is not already
4229 			 * locally-set, in which case its value will take
4230 			 * priority over the received anyway.
4231 			 */
4232 			if (nvlist_exists(origprops, newname)) {
4233 				nvlist_t *attrs;
4234 				const char *source = NULL;
4235 
4236 				attrs = fnvlist_lookup_nvlist(origprops,
4237 				    newname);
4238 				if (nvlist_lookup_string(attrs,
4239 				    ZPROP_SOURCE, &source) == 0 &&
4240 				    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4241 					continue;
4242 			}
4243 			/*
4244 			 * We can't force an explicit inherit on non-inheritable
4245 			 * properties: if we're asked to exclude this kind of
4246 			 * values we remove them from "recvprops" input nvlist.
4247 			 */
4248 			if (!zfs_prop_user(name) && /* can be inherited too */
4249 			    !zfs_prop_inheritable(prop) &&
4250 			    nvlist_exists(recvprops, newname))
4251 				fnvlist_remove(recvprops, newname);
4252 			else
4253 				fnvlist_add_boolean(*oxprops, newname);
4254 			break;
4255 		case DATA_TYPE_STRING: /* -o property=value */
4256 			/*
4257 			 * we're trying to override a property that does not
4258 			 * make sense for this type of dataset, but we don't
4259 			 * want to fail if the receive is recursive: this comes
4260 			 * in handy when the send stream contains, for
4261 			 * instance, a child ZVOL and we're trying to receive
4262 			 * it with "-o atime=on"
4263 			 */
4264 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4265 			    !zfs_prop_user(name)) {
4266 				if (recursive)
4267 					continue;
4268 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4269 				    "property '%s' does not apply to datasets "
4270 				    "of this type"), name);
4271 				ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4272 				goto error;
4273 			}
4274 			fnvlist_add_string(oprops, newname,
4275 			    fnvpair_value_string(nvp));
4276 			break;
4277 		default:
4278 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4279 			    "property '%s' must be a string or boolean"), name);
4280 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4281 			goto error;
4282 		}
4283 	}
4284 
4285 	if (toplevel) {
4286 		/* convert override strings properties to native */
4287 		if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4288 		    oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4289 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4290 			goto error;
4291 		}
4292 
4293 		/*
4294 		 * zfs_crypto_create() requires the parent name. Get it
4295 		 * by truncating the fsname copy stored in namebuf.
4296 		 */
4297 		cp = strrchr(namebuf, '/');
4298 		if (cp != NULL)
4299 			*cp = '\0';
4300 
4301 		if (!raw && !(!newfs && recursive) &&
4302 		    zfs_crypto_create(hdl, namebuf, voprops, NULL,
4303 		    B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4304 			fnvlist_free(voprops);
4305 			ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4306 			goto error;
4307 		}
4308 
4309 		/* second pass: process "-o" properties */
4310 		fnvlist_merge(*oxprops, voprops);
4311 		fnvlist_free(voprops);
4312 	} else {
4313 		/* override props on child dataset are inherited */
4314 		nvp = NULL;
4315 		while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4316 			const char *name = nvpair_name(nvp);
4317 			fnvlist_add_boolean(*oxprops, name);
4318 		}
4319 	}
4320 
4321 error:
4322 	if (zhp != NULL)
4323 		zfs_close(zhp);
4324 	if (zpool_hdl != NULL)
4325 		zpool_close(zpool_hdl);
4326 	fnvlist_free(oprops);
4327 	return (ret);
4328 }
4329 
4330 /*
4331  * Restores a backup of tosnap from the file descriptor specified by infd.
4332  */
4333 static int
4334 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4335     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4336     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4337     avl_tree_t *stream_avl, char **top_zfs,
4338     const char *finalsnap, nvlist_t *cmdprops)
4339 {
4340 	struct timespec begin_time;
4341 	int ioctl_err, ioctl_errno, err;
4342 	char *cp;
4343 	struct drr_begin *drrb = &drr->drr_u.drr_begin;
4344 	char errbuf[ERRBUFLEN];
4345 	const char *chopprefix;
4346 	boolean_t newfs = B_FALSE;
4347 	boolean_t stream_wantsnewfs, stream_resumingnewfs;
4348 	boolean_t newprops = B_FALSE;
4349 	uint64_t read_bytes = 0;
4350 	uint64_t errflags = 0;
4351 	uint64_t parent_snapguid = 0;
4352 	prop_changelist_t *clp = NULL;
4353 	nvlist_t *snapprops_nvlist = NULL;
4354 	nvlist_t *snapholds_nvlist = NULL;
4355 	zprop_errflags_t prop_errflags;
4356 	nvlist_t *prop_errors = NULL;
4357 	boolean_t recursive;
4358 	const char *snapname = NULL;
4359 	char destsnap[MAXPATHLEN * 2];
4360 	char origin[MAXNAMELEN] = {0};
4361 	char name[MAXPATHLEN];
4362 	char tmp_keylocation[MAXNAMELEN] = {0};
4363 	nvlist_t *rcvprops = NULL; /* props received from the send stream */
4364 	nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4365 	nvlist_t *origprops = NULL; /* original props (if destination exists) */
4366 	zfs_type_t type = ZFS_TYPE_INVALID;
4367 	boolean_t toplevel = B_FALSE;
4368 	boolean_t zoned = B_FALSE;
4369 	boolean_t hastoken = B_FALSE;
4370 	boolean_t redacted;
4371 	uint8_t *wkeydata = NULL;
4372 	uint_t wkeylen = 0;
4373 
4374 #ifndef CLOCK_MONOTONIC_RAW
4375 #define	CLOCK_MONOTONIC_RAW CLOCK_MONOTONIC
4376 #endif
4377 	clock_gettime(CLOCK_MONOTONIC_RAW, &begin_time);
4378 
4379 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4380 	    "cannot receive"));
4381 
4382 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4383 	    ENOENT);
4384 
4385 	/* Did the user request holds be skipped via zfs recv -k? */
4386 	boolean_t holds = flags->holds && !flags->skipholds;
4387 
4388 	if (stream_avl != NULL) {
4389 		const char *keylocation = NULL;
4390 		nvlist_t *lookup = NULL;
4391 		nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4392 		    &snapname);
4393 
4394 		(void) nvlist_lookup_uint64(fs, "parentfromsnap",
4395 		    &parent_snapguid);
4396 		err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4397 		if (err) {
4398 			rcvprops = fnvlist_alloc();
4399 			newprops = B_TRUE;
4400 		}
4401 
4402 		/*
4403 		 * The keylocation property may only be set on encryption roots,
4404 		 * but this dataset might not become an encryption root until
4405 		 * recv_fix_encryption_hierarchy() is called. That function
4406 		 * will fixup the keylocation anyway, so we temporarily unset
4407 		 * the keylocation for now to avoid any errors from the receive
4408 		 * ioctl.
4409 		 */
4410 		err = nvlist_lookup_string(rcvprops,
4411 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4412 		if (err == 0) {
4413 			strlcpy(tmp_keylocation, keylocation, MAXNAMELEN);
4414 			(void) nvlist_remove_all(rcvprops,
4415 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4416 		}
4417 
4418 		if (flags->canmountoff) {
4419 			fnvlist_add_uint64(rcvprops,
4420 			    zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4421 		} else if (newprops) {	/* nothing in rcvprops, eliminate it */
4422 			fnvlist_free(rcvprops);
4423 			rcvprops = NULL;
4424 			newprops = B_FALSE;
4425 		}
4426 		if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4427 			snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4428 			    snapname);
4429 		}
4430 		if (holds) {
4431 			if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4432 			    &lookup)) {
4433 				snapholds_nvlist = fnvlist_lookup_nvlist(
4434 				    lookup, snapname);
4435 			}
4436 		}
4437 	}
4438 
4439 	cp = NULL;
4440 
4441 	/*
4442 	 * Determine how much of the snapshot name stored in the stream
4443 	 * we are going to tack on to the name they specified on the
4444 	 * command line, and how much we are going to chop off.
4445 	 *
4446 	 * If they specified a snapshot, chop the entire name stored in
4447 	 * the stream.
4448 	 */
4449 	if (flags->istail) {
4450 		/*
4451 		 * A filesystem was specified with -e. We want to tack on only
4452 		 * the tail of the sent snapshot path.
4453 		 */
4454 		if (strchr(tosnap, '@')) {
4455 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4456 			    "argument - snapshot not allowed with -e"));
4457 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4458 			goto out;
4459 		}
4460 
4461 		chopprefix = strrchr(sendfs, '/');
4462 
4463 		if (chopprefix == NULL) {
4464 			/*
4465 			 * The tail is the poolname, so we need to
4466 			 * prepend a path separator.
4467 			 */
4468 			int len = strlen(drrb->drr_toname);
4469 			cp = umem_alloc(len + 2, UMEM_NOFAIL);
4470 			cp[0] = '/';
4471 			(void) strcpy(&cp[1], drrb->drr_toname);
4472 			chopprefix = cp;
4473 		} else {
4474 			chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4475 		}
4476 	} else if (flags->isprefix) {
4477 		/*
4478 		 * A filesystem was specified with -d. We want to tack on
4479 		 * everything but the first element of the sent snapshot path
4480 		 * (all but the pool name).
4481 		 */
4482 		if (strchr(tosnap, '@')) {
4483 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4484 			    "argument - snapshot not allowed with -d"));
4485 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4486 			goto out;
4487 		}
4488 
4489 		chopprefix = strchr(drrb->drr_toname, '/');
4490 		if (chopprefix == NULL)
4491 			chopprefix = strchr(drrb->drr_toname, '@');
4492 	} else if (strchr(tosnap, '@') == NULL) {
4493 		/*
4494 		 * If a filesystem was specified without -d or -e, we want to
4495 		 * tack on everything after the fs specified by 'zfs send'.
4496 		 */
4497 		chopprefix = drrb->drr_toname + strlen(sendfs);
4498 	} else {
4499 		/* A snapshot was specified as an exact path (no -d or -e). */
4500 		if (recursive) {
4501 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4502 			    "cannot specify snapshot name for multi-snapshot "
4503 			    "stream"));
4504 			err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4505 			goto out;
4506 		}
4507 		chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4508 	}
4509 
4510 	ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4511 	ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4512 	ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4513 	    strchr(sendfs, '/') == NULL);
4514 	ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4515 	    chopprefix[0] == '\0');
4516 
4517 	/*
4518 	 * Determine name of destination snapshot.
4519 	 */
4520 	(void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4521 	(void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4522 	if (cp != NULL)
4523 		umem_free(cp, strlen(cp) + 1);
4524 	if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4525 		err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4526 		goto out;
4527 	}
4528 
4529 	/*
4530 	 * Determine the name of the origin snapshot.
4531 	 */
4532 	if (originsnap) {
4533 		(void) strlcpy(origin, originsnap, sizeof (origin));
4534 		if (flags->verbose)
4535 			(void) printf("using provided clone origin %s\n",
4536 			    origin);
4537 	} else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4538 		if (guid_to_name(hdl, destsnap,
4539 		    drrb->drr_fromguid, B_FALSE, origin) != 0) {
4540 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4541 			    "local origin for clone %s does not exist"),
4542 			    destsnap);
4543 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4544 			goto out;
4545 		}
4546 		if (flags->verbose)
4547 			(void) printf("found clone origin %s\n", origin);
4548 	}
4549 
4550 	if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4551 	    DMU_BACKUP_FEATURE_DEDUP)) {
4552 		(void) fprintf(stderr,
4553 		    gettext("ERROR: \"zfs receive\" no longer supports "
4554 		    "deduplicated send streams.  Use\n"
4555 		    "the \"zstream redup\" command to convert this stream "
4556 		    "to a regular,\n"
4557 		    "non-deduplicated stream.\n"));
4558 		err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4559 		goto out;
4560 	}
4561 
4562 	boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4563 	    DMU_BACKUP_FEATURE_RESUMING;
4564 	boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4565 	    DMU_BACKUP_FEATURE_RAW;
4566 	boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4567 	    DMU_BACKUP_FEATURE_EMBED_DATA;
4568 	stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4569 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4570 	stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4571 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4572 
4573 	if (stream_wantsnewfs) {
4574 		/*
4575 		 * if the parent fs does not exist, look for it based on
4576 		 * the parent snap GUID
4577 		 */
4578 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4579 		    "cannot receive new filesystem stream"));
4580 
4581 		(void) strlcpy(name, destsnap, sizeof (name));
4582 		cp = strrchr(name, '/');
4583 		if (cp)
4584 			*cp = '\0';
4585 		if (cp &&
4586 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4587 			char suffix[ZFS_MAX_DATASET_NAME_LEN];
4588 			(void) strlcpy(suffix, strrchr(destsnap, '/'),
4589 			    sizeof (suffix));
4590 			if (guid_to_name(hdl, name, parent_snapguid,
4591 			    B_FALSE, destsnap) == 0) {
4592 				*strchr(destsnap, '@') = '\0';
4593 				(void) strlcat(destsnap, suffix,
4594 				    sizeof (destsnap));
4595 			}
4596 		}
4597 	} else {
4598 		/*
4599 		 * If the fs does not exist, look for it based on the
4600 		 * fromsnap GUID.
4601 		 */
4602 		if (resuming) {
4603 			(void) snprintf(errbuf, sizeof (errbuf),
4604 			    dgettext(TEXT_DOMAIN,
4605 			    "cannot receive resume stream"));
4606 		} else {
4607 			(void) snprintf(errbuf, sizeof (errbuf),
4608 			    dgettext(TEXT_DOMAIN,
4609 			    "cannot receive incremental stream"));
4610 		}
4611 
4612 		(void) strlcpy(name, destsnap, sizeof (name));
4613 		*strchr(name, '@') = '\0';
4614 
4615 		/*
4616 		 * If the exact receive path was specified and this is the
4617 		 * topmost path in the stream, then if the fs does not exist we
4618 		 * should look no further.
4619 		 */
4620 		if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4621 		    strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4622 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4623 			char snap[ZFS_MAX_DATASET_NAME_LEN];
4624 			(void) strlcpy(snap, strchr(destsnap, '@'),
4625 			    sizeof (snap));
4626 			if (guid_to_name(hdl, name, drrb->drr_fromguid,
4627 			    B_FALSE, destsnap) == 0) {
4628 				*strchr(destsnap, '@') = '\0';
4629 				(void) strlcat(destsnap, snap,
4630 				    sizeof (destsnap));
4631 			}
4632 		}
4633 	}
4634 
4635 	(void) strlcpy(name, destsnap, sizeof (name));
4636 	*strchr(name, '@') = '\0';
4637 
4638 	redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4639 	    DMU_BACKUP_FEATURE_REDACTED;
4640 
4641 	if (flags->heal) {
4642 		if (flags->isprefix || flags->istail || flags->force ||
4643 		    flags->canmountoff || flags->resumable || flags->nomount ||
4644 		    flags->skipholds) {
4645 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4646 			    "corrective recv can not be used when combined with"
4647 			    " this flag"));
4648 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4649 			goto out;
4650 		}
4651 		uint64_t guid =
4652 		    get_snap_guid(hdl, name, strchr(destsnap, '@') + 1);
4653 		if (guid == 0) {
4654 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4655 			    "corrective recv must specify an existing snapshot"
4656 			    " to heal"));
4657 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4658 			goto out;
4659 		} else if (guid != drrb->drr_toguid) {
4660 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4661 			    "local snapshot doesn't match the snapshot"
4662 			    " in the provided stream"));
4663 			err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4664 			goto out;
4665 		}
4666 	} else if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4667 		zfs_cmd_t zc = {"\0"};
4668 		zfs_handle_t *zhp = NULL;
4669 		boolean_t encrypted;
4670 
4671 		(void) strcpy(zc.zc_name, name);
4672 
4673 		/*
4674 		 * Destination fs exists.  It must be one of these cases:
4675 		 *  - an incremental send stream
4676 		 *  - the stream specifies a new fs (full stream or clone)
4677 		 *    and they want us to blow away the existing fs (and
4678 		 *    have therefore specified -F and removed any snapshots)
4679 		 *  - we are resuming a failed receive.
4680 		 */
4681 		if (stream_wantsnewfs) {
4682 			boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4683 			if (!flags->force) {
4684 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4685 				    "destination '%s' exists\n"
4686 				    "must specify -F to overwrite it"), name);
4687 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4688 				goto out;
4689 			}
4690 			if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4691 			    &zc) == 0) {
4692 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4693 				    "destination has snapshots (eg. %s)\n"
4694 				    "must destroy them to overwrite it"),
4695 				    zc.zc_name);
4696 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4697 				goto out;
4698 			}
4699 			if (is_volume && strrchr(name, '/') == NULL) {
4700 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4701 				    "destination %s is the root dataset\n"
4702 				    "cannot overwrite with a ZVOL"),
4703 				    name);
4704 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4705 				goto out;
4706 			}
4707 			if (is_volume &&
4708 			    zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4709 			    &zc) == 0) {
4710 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4711 				    "destination has children (eg. %s)\n"
4712 				    "cannot overwrite with a ZVOL"),
4713 				    zc.zc_name);
4714 				err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4715 				goto out;
4716 			}
4717 		}
4718 
4719 		if ((zhp = zfs_open(hdl, name,
4720 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4721 			err = -1;
4722 			goto out;
4723 		}
4724 
4725 		/*
4726 		 * When receiving full/newfs on existing dataset, then it
4727 		 * should be done with "-F" flag. Its enforced for initial
4728 		 * receive in previous checks in this function.
4729 		 * Similarly, on resuming full/newfs recv on existing dataset,
4730 		 * it should be done with "-F" flag.
4731 		 *
4732 		 * When dataset doesn't exist, then full/newfs recv is done on
4733 		 * newly created dataset and it's marked INCONSISTENT. But
4734 		 * When receiving on existing dataset, recv is first done on
4735 		 * %recv and its marked INCONSISTENT. Existing dataset is not
4736 		 * marked INCONSISTENT.
4737 		 * Resume of full/newfs receive with dataset not INCONSISTENT
4738 		 * indicates that its resuming newfs on existing dataset. So,
4739 		 * enforce "-F" flag in this case.
4740 		 */
4741 		if (stream_resumingnewfs &&
4742 		    !zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT) &&
4743 		    !flags->force) {
4744 			zfs_close(zhp);
4745 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4746 			    "Resuming recv on existing destination '%s'\n"
4747 			    "must specify -F to overwrite it"), name);
4748 			err = zfs_error(hdl, EZFS_RESUME_EXISTS, errbuf);
4749 			goto out;
4750 		}
4751 
4752 		if (stream_wantsnewfs &&
4753 		    zhp->zfs_dmustats.dds_origin[0]) {
4754 			zfs_close(zhp);
4755 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4756 			    "destination '%s' is a clone\n"
4757 			    "must destroy it to overwrite it"), name);
4758 			err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4759 			goto out;
4760 		}
4761 
4762 		/*
4763 		 * Raw sends can not be performed as an incremental on top
4764 		 * of existing unencrypted datasets. zfs recv -F can't be
4765 		 * used to blow away an existing encrypted filesystem. This
4766 		 * is because it would require the dsl dir to point to the
4767 		 * new key (or lack of a key) and the old key at the same
4768 		 * time. The -F flag may still be used for deleting
4769 		 * intermediate snapshots that would otherwise prevent the
4770 		 * receive from working.
4771 		 */
4772 		encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4773 		    ZIO_CRYPT_OFF;
4774 		if (!stream_wantsnewfs && !encrypted && raw) {
4775 			zfs_close(zhp);
4776 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4777 			    "cannot perform raw receive on top of "
4778 			    "existing unencrypted dataset"));
4779 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4780 			goto out;
4781 		}
4782 
4783 		if (stream_wantsnewfs && flags->force &&
4784 		    ((raw && !encrypted) || encrypted)) {
4785 			zfs_close(zhp);
4786 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4787 			    "zfs receive -F cannot be used to destroy an "
4788 			    "encrypted filesystem or overwrite an "
4789 			    "unencrypted one with an encrypted one"));
4790 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4791 			goto out;
4792 		}
4793 
4794 		if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4795 		    (stream_wantsnewfs || stream_resumingnewfs)) {
4796 			/* We can't do online recv in this case */
4797 			clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4798 			    flags->forceunmount ? MS_FORCE : 0);
4799 			if (clp == NULL) {
4800 				zfs_close(zhp);
4801 				err = -1;
4802 				goto out;
4803 			}
4804 			if (changelist_prefix(clp) != 0) {
4805 				changelist_free(clp);
4806 				zfs_close(zhp);
4807 				err = -1;
4808 				goto out;
4809 			}
4810 		}
4811 
4812 		/*
4813 		 * If we are resuming a newfs, set newfs here so that we will
4814 		 * mount it if the recv succeeds this time.  We can tell
4815 		 * that it was a newfs on the first recv because the fs
4816 		 * itself will be inconsistent (if the fs existed when we
4817 		 * did the first recv, we would have received it into
4818 		 * .../%recv).
4819 		 */
4820 		if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4821 			newfs = B_TRUE;
4822 
4823 		/* we want to know if we're zoned when validating -o|-x props */
4824 		zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4825 
4826 		/* may need this info later, get it now we have zhp around */
4827 		if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4828 		    NULL, NULL, 0, B_TRUE) == 0)
4829 			hastoken = B_TRUE;
4830 
4831 		/* gather existing properties on destination */
4832 		origprops = fnvlist_alloc();
4833 		fnvlist_merge(origprops, zhp->zfs_props);
4834 		fnvlist_merge(origprops, zhp->zfs_user_props);
4835 
4836 		zfs_close(zhp);
4837 	} else {
4838 		zfs_handle_t *zhp;
4839 
4840 		/*
4841 		 * Destination filesystem does not exist.  Therefore we better
4842 		 * be creating a new filesystem (either from a full backup, or
4843 		 * a clone).  It would therefore be invalid if the user
4844 		 * specified only the pool name (i.e. if the destination name
4845 		 * contained no slash character).
4846 		 */
4847 		cp = strrchr(name, '/');
4848 
4849 		if (!stream_wantsnewfs || cp == NULL) {
4850 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4851 			    "destination '%s' does not exist"), name);
4852 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4853 			goto out;
4854 		}
4855 
4856 		/*
4857 		 * Trim off the final dataset component so we perform the
4858 		 * recvbackup ioctl to the filesystems's parent.
4859 		 */
4860 		*cp = '\0';
4861 
4862 		if (flags->isprefix && !flags->istail && !flags->dryrun &&
4863 		    create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4864 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4865 			goto out;
4866 		}
4867 
4868 		/* validate parent */
4869 		zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4870 		if (zhp == NULL) {
4871 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4872 			goto out;
4873 		}
4874 		if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4875 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4876 			    "parent '%s' is not a filesystem"), name);
4877 			err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4878 			zfs_close(zhp);
4879 			goto out;
4880 		}
4881 
4882 		zfs_close(zhp);
4883 
4884 		newfs = B_TRUE;
4885 		*cp = '/';
4886 	}
4887 
4888 	if (flags->verbose) {
4889 		(void) printf("%s %s%s stream of %s into %s\n",
4890 		    flags->dryrun ? "would receive" : "receiving",
4891 		    flags->heal ? " corrective" : "",
4892 		    drrb->drr_fromguid ? "incremental" : "full",
4893 		    drrb->drr_toname, destsnap);
4894 		(void) fflush(stdout);
4895 	}
4896 
4897 	/*
4898 	 * If this is the top-level dataset, record it so we can use it
4899 	 * for recursive operations later.
4900 	 */
4901 	if (top_zfs != NULL &&
4902 	    (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4903 		toplevel = B_TRUE;
4904 		if (*top_zfs == NULL)
4905 			*top_zfs = zfs_strdup(hdl, name);
4906 	}
4907 
4908 	if (drrb->drr_type == DMU_OST_ZVOL) {
4909 		type = ZFS_TYPE_VOLUME;
4910 	} else if (drrb->drr_type == DMU_OST_ZFS) {
4911 		type = ZFS_TYPE_FILESYSTEM;
4912 	} else {
4913 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4914 		    "invalid record type: 0x%d"), drrb->drr_type);
4915 		err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4916 		goto out;
4917 	}
4918 	if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4919 	    stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4920 	    &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4921 		goto out;
4922 
4923 	/*
4924 	 * When sending with properties (zfs send -p), the encryption property
4925 	 * is not included because it is a SETONCE property and therefore
4926 	 * treated as read only. However, we are always able to determine its
4927 	 * value because raw sends will include it in the DRR_BDEGIN payload
4928 	 * and non-raw sends with properties are not allowed for encrypted
4929 	 * datasets. Therefore, if this is a non-raw properties stream, we can
4930 	 * infer that the value should be ZIO_CRYPT_OFF and manually add that
4931 	 * to the received properties.
4932 	 */
4933 	if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4934 	    !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4935 		if (oxprops == NULL)
4936 			oxprops = fnvlist_alloc();
4937 		fnvlist_add_uint64(oxprops,
4938 		    zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4939 	}
4940 
4941 	if (flags->dryrun) {
4942 		void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4943 
4944 		/*
4945 		 * We have read the DRR_BEGIN record, but we have
4946 		 * not yet read the payload. For non-dryrun sends
4947 		 * this will be done by the kernel, so we must
4948 		 * emulate that here, before attempting to read
4949 		 * more records.
4950 		 */
4951 		err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4952 		    flags->byteswap, NULL);
4953 		free(buf);
4954 		if (err != 0)
4955 			goto out;
4956 
4957 		err = recv_skip(hdl, infd, flags->byteswap);
4958 		goto out;
4959 	}
4960 
4961 	if (flags->heal) {
4962 		err = ioctl_err = lzc_receive_with_heal(destsnap, rcvprops,
4963 		    oxprops, wkeydata, wkeylen, origin, flags->force,
4964 		    flags->heal, flags->resumable, raw, infd, drr_noswap, -1,
4965 		    &read_bytes, &errflags, NULL, &prop_errors);
4966 	} else {
4967 		err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4968 		    oxprops, wkeydata, wkeylen, origin, flags->force,
4969 		    flags->resumable, raw, infd, drr_noswap, -1, &read_bytes,
4970 		    &errflags, NULL, &prop_errors);
4971 	}
4972 	ioctl_errno = ioctl_err;
4973 	prop_errflags = errflags;
4974 
4975 	if (err == 0) {
4976 		nvpair_t *prop_err = NULL;
4977 
4978 		while ((prop_err = nvlist_next_nvpair(prop_errors,
4979 		    prop_err)) != NULL) {
4980 			char tbuf[1024];
4981 			zfs_prop_t prop;
4982 			int intval;
4983 
4984 			prop = zfs_name_to_prop(nvpair_name(prop_err));
4985 			(void) nvpair_value_int32(prop_err, &intval);
4986 			if (strcmp(nvpair_name(prop_err),
4987 			    ZPROP_N_MORE_ERRORS) == 0) {
4988 				trunc_prop_errs(intval);
4989 				break;
4990 			} else if (snapname == NULL || finalsnap == NULL ||
4991 			    strcmp(finalsnap, snapname) == 0 ||
4992 			    strcmp(nvpair_name(prop_err),
4993 			    zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4994 				/*
4995 				 * Skip the special case of, for example,
4996 				 * "refquota", errors on intermediate
4997 				 * snapshots leading up to a final one.
4998 				 * That's why we have all of the checks above.
4999 				 *
5000 				 * See zfs_ioctl.c's extract_delay_props() for
5001 				 * a list of props which can fail on
5002 				 * intermediate snapshots, but shouldn't
5003 				 * affect the overall receive.
5004 				 */
5005 				(void) snprintf(tbuf, sizeof (tbuf),
5006 				    dgettext(TEXT_DOMAIN,
5007 				    "cannot receive %s property on %s"),
5008 				    nvpair_name(prop_err), name);
5009 				zfs_setprop_error(hdl, prop, intval, tbuf);
5010 			}
5011 		}
5012 	}
5013 
5014 	if (err == 0 && snapprops_nvlist) {
5015 		zfs_cmd_t zc = {"\0"};
5016 
5017 		(void) strlcpy(zc.zc_name, destsnap, sizeof (zc.zc_name));
5018 		zc.zc_cookie = B_TRUE; /* received */
5019 		zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist);
5020 		(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
5021 		zcmd_free_nvlists(&zc);
5022 	}
5023 	if (err == 0 && snapholds_nvlist) {
5024 		nvpair_t *pair;
5025 		nvlist_t *holds, *errors = NULL;
5026 		int cleanup_fd = -1;
5027 
5028 		VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
5029 		for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
5030 		    pair != NULL;
5031 		    pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
5032 			fnvlist_add_string(holds, destsnap, nvpair_name(pair));
5033 		}
5034 		(void) lzc_hold(holds, cleanup_fd, &errors);
5035 		fnvlist_free(snapholds_nvlist);
5036 		fnvlist_free(holds);
5037 	}
5038 
5039 	if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
5040 		/*
5041 		 * It may be that this snapshot already exists,
5042 		 * in which case we want to consume & ignore it
5043 		 * rather than failing.
5044 		 */
5045 		avl_tree_t *local_avl;
5046 		nvlist_t *local_nv, *fs;
5047 		cp = strchr(destsnap, '@');
5048 
5049 		/*
5050 		 * XXX Do this faster by just iterating over snaps in
5051 		 * this fs.  Also if zc_value does not exist, we will
5052 		 * get a strange "does not exist" error message.
5053 		 */
5054 		*cp = '\0';
5055 		if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
5056 		    B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
5057 		    B_TRUE, &local_nv, &local_avl) == 0) {
5058 			*cp = '@';
5059 			fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
5060 			fsavl_destroy(local_avl);
5061 			fnvlist_free(local_nv);
5062 
5063 			if (fs != NULL) {
5064 				if (flags->verbose) {
5065 					(void) printf("snap %s already exists; "
5066 					    "ignoring\n", destsnap);
5067 				}
5068 				err = ioctl_err = recv_skip(hdl, infd,
5069 				    flags->byteswap);
5070 			}
5071 		}
5072 		*cp = '@';
5073 	}
5074 
5075 	if (ioctl_err != 0) {
5076 		switch (ioctl_errno) {
5077 		case ENODEV:
5078 			cp = strchr(destsnap, '@');
5079 			*cp = '\0';
5080 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5081 			    "most recent snapshot of %s does not\n"
5082 			    "match incremental source"), destsnap);
5083 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
5084 			*cp = '@';
5085 			break;
5086 		case ETXTBSY:
5087 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5088 			    "destination %s has been modified\n"
5089 			    "since most recent snapshot"), name);
5090 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
5091 			break;
5092 		case EACCES:
5093 			if (flags->heal) {
5094 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5095 				    "key must be loaded to do a non-raw "
5096 				    "corrective recv on an encrypted "
5097 				    "dataset."));
5098 			} else if (raw && stream_wantsnewfs) {
5099 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5100 				    "failed to create encryption key"));
5101 			} else if (raw && !stream_wantsnewfs) {
5102 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5103 				    "encryption key does not match "
5104 				    "existing key"));
5105 			} else {
5106 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5107 				    "inherited key must be loaded"));
5108 			}
5109 			(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
5110 			break;
5111 		case EEXIST:
5112 			cp = strchr(destsnap, '@');
5113 			if (newfs) {
5114 				/* it's the containing fs that exists */
5115 				*cp = '\0';
5116 			}
5117 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5118 			    "destination already exists"));
5119 			(void) zfs_error_fmt(hdl, EZFS_EXISTS,
5120 			    dgettext(TEXT_DOMAIN, "cannot restore to %s"),
5121 			    destsnap);
5122 			*cp = '@';
5123 			break;
5124 		case EINVAL:
5125 			if (embedded && !raw) {
5126 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5127 				    "incompatible embedded data stream "
5128 				    "feature with encrypted receive."));
5129 			} else if (flags->resumable) {
5130 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5131 				    "kernel modules must be upgraded to "
5132 				    "receive this stream."));
5133 			}
5134 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5135 			break;
5136 		case ECKSUM:
5137 		case ZFS_ERR_STREAM_TRUNCATED:
5138 			if (flags->heal)
5139 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5140 				    "corrective receive was not able to "
5141 				    "reconstruct the data needed for "
5142 				    "healing."));
5143 			else
5144 				recv_ecksum_set_aux(hdl, destsnap,
5145 				    flags->resumable, ioctl_err == ECKSUM);
5146 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5147 			break;
5148 		case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
5149 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5150 			    "incremental send stream requires -L "
5151 			    "(--large-block), to match previous receive."));
5152 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5153 			break;
5154 		case ENOTSUP:
5155 			if (flags->heal)
5156 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5157 				    "stream is not compatible with the "
5158 				    "data in the pool."));
5159 			else
5160 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5161 				    "pool must be upgraded to receive this "
5162 				    "stream."));
5163 			(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
5164 			break;
5165 		case ZFS_ERR_CRYPTO_NOTSUP:
5166 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5167 			    "stream uses crypto parameters not compatible with "
5168 			    "this pool"));
5169 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5170 			break;
5171 		case EDQUOT:
5172 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5173 			    "destination %s space quota exceeded."), name);
5174 			(void) zfs_error(hdl, EZFS_NOSPC, errbuf);
5175 			break;
5176 		case ZFS_ERR_FROM_IVSET_GUID_MISSING:
5177 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5178 			    "IV set guid missing. See errata %u at "
5179 			    "https://openzfs.github.io/openzfs-docs/msg/"
5180 			    "ZFS-8000-ER."),
5181 			    ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
5182 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5183 			break;
5184 		case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
5185 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5186 			    "IV set guid mismatch. See the 'zfs receive' "
5187 			    "man page section\n discussing the limitations "
5188 			    "of raw encrypted send streams."));
5189 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5190 			break;
5191 		case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
5192 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5193 			    "Spill block flag missing for raw send.\n"
5194 			    "The zfs software on the sending system must "
5195 			    "be updated."));
5196 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5197 			break;
5198 		case ZFS_ERR_RESUME_EXISTS:
5199 			cp = strchr(destsnap, '@');
5200 			if (newfs) {
5201 				/* it's the containing fs that exists */
5202 				*cp = '\0';
5203 			}
5204 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5205 			    "Resuming recv on existing dataset without force"));
5206 			(void) zfs_error_fmt(hdl, EZFS_RESUME_EXISTS,
5207 			    dgettext(TEXT_DOMAIN, "cannot resume recv %s"),
5208 			    destsnap);
5209 			*cp = '@';
5210 			break;
5211 		case E2BIG:
5212 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5213 			    "zfs receive required kernel memory allocation "
5214 			    "larger than the system can support. Please file "
5215 			    "an issue at the OpenZFS issue tracker:\n"
5216 			    "https://github.com/openzfs/zfs/issues/new"));
5217 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5218 			break;
5219 		case EBUSY:
5220 			if (hastoken) {
5221 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5222 				    "destination %s contains "
5223 				    "partially-complete state from "
5224 				    "\"zfs receive -s\"."), name);
5225 				(void) zfs_error(hdl, EZFS_BUSY, errbuf);
5226 				break;
5227 			}
5228 			zfs_fallthrough;
5229 		default:
5230 			(void) zfs_standard_error(hdl, ioctl_errno, errbuf);
5231 		}
5232 	}
5233 
5234 	/*
5235 	 * Mount the target filesystem (if created).  Also mount any
5236 	 * children of the target filesystem if we did a replication
5237 	 * receive (indicated by stream_avl being non-NULL).
5238 	 */
5239 	if (clp) {
5240 		if (!flags->nomount)
5241 			err |= changelist_postfix(clp);
5242 		changelist_free(clp);
5243 	}
5244 
5245 	if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
5246 		flags->domount = B_TRUE;
5247 
5248 	if (prop_errflags & ZPROP_ERR_NOCLEAR) {
5249 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5250 		    "failed to clear unreceived properties on %s"), name);
5251 		(void) fprintf(stderr, "\n");
5252 	}
5253 	if (prop_errflags & ZPROP_ERR_NORESTORE) {
5254 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5255 		    "failed to restore original properties on %s"), name);
5256 		(void) fprintf(stderr, "\n");
5257 	}
5258 
5259 	if (err || ioctl_err) {
5260 		err = -1;
5261 		goto out;
5262 	}
5263 
5264 	if (flags->verbose) {
5265 		char buf1[64];
5266 		char buf2[64];
5267 		uint64_t bytes = read_bytes;
5268 		struct timespec delta;
5269 		clock_gettime(CLOCK_MONOTONIC_RAW, &delta);
5270 		if (begin_time.tv_nsec > delta.tv_nsec) {
5271 			delta.tv_nsec =
5272 			    1000000000 + delta.tv_nsec - begin_time.tv_nsec;
5273 			delta.tv_sec -= 1;
5274 		} else
5275 			delta.tv_nsec -= begin_time.tv_nsec;
5276 		delta.tv_sec -= begin_time.tv_sec;
5277 		if (delta.tv_sec == 0 && delta.tv_nsec == 0)
5278 			delta.tv_nsec = 1;
5279 		double delta_f = delta.tv_sec + (delta.tv_nsec / 1e9);
5280 		zfs_nicebytes(bytes, buf1, sizeof (buf1));
5281 		zfs_nicebytes(bytes / delta_f, buf2, sizeof (buf2));
5282 
5283 		(void) printf("received %s stream in %.2f seconds (%s/sec)\n",
5284 		    buf1, delta_f, buf2);
5285 	}
5286 
5287 	err = 0;
5288 out:
5289 	if (prop_errors != NULL)
5290 		fnvlist_free(prop_errors);
5291 
5292 	if (tmp_keylocation[0] != '\0') {
5293 		fnvlist_add_string(rcvprops,
5294 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
5295 	}
5296 
5297 	if (newprops)
5298 		fnvlist_free(rcvprops);
5299 
5300 	fnvlist_free(oxprops);
5301 	fnvlist_free(origprops);
5302 
5303 	return (err);
5304 }
5305 
5306 /*
5307  * Check properties we were asked to override (both -o|-x)
5308  */
5309 static boolean_t
5310 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
5311     const char *errbuf)
5312 {
5313 	nvpair_t *nvp = NULL;
5314 	zfs_prop_t prop;
5315 	const char *name;
5316 
5317 	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
5318 		name = nvpair_name(nvp);
5319 		prop = zfs_name_to_prop(name);
5320 
5321 		if (prop == ZPROP_USERPROP) {
5322 			if (!zfs_prop_user(name)) {
5323 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5324 				    "%s: invalid property '%s'"), errbuf, name);
5325 				return (B_FALSE);
5326 			}
5327 			continue;
5328 		}
5329 		/*
5330 		 * "origin" is readonly but is used to receive datasets as
5331 		 * clones so we don't raise an error here
5332 		 */
5333 		if (prop == ZFS_PROP_ORIGIN)
5334 			continue;
5335 
5336 		/* encryption params have their own verification later */
5337 		if (prop == ZFS_PROP_ENCRYPTION ||
5338 		    zfs_prop_encryption_key_param(prop))
5339 			continue;
5340 
5341 		/*
5342 		 * cannot override readonly, set-once and other specific
5343 		 * settable properties
5344 		 */
5345 		if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5346 		    prop == ZFS_PROP_VOLSIZE) {
5347 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5348 			    "%s: invalid property '%s'"), errbuf, name);
5349 			return (B_FALSE);
5350 		}
5351 	}
5352 
5353 	return (B_TRUE);
5354 }
5355 
5356 static int
5357 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5358     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5359     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5360     const char *finalsnap, nvlist_t *cmdprops)
5361 {
5362 	int err;
5363 	dmu_replay_record_t drr, drr_noswap;
5364 	struct drr_begin *drrb = &drr.drr_u.drr_begin;
5365 	char errbuf[ERRBUFLEN];
5366 	zio_cksum_t zcksum = { { 0 } };
5367 	uint64_t featureflags;
5368 	int hdrtype;
5369 
5370 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5371 	    "cannot receive"));
5372 
5373 	/* check cmdline props, raise an error if they cannot be received */
5374 	if (!zfs_receive_checkprops(hdl, cmdprops, errbuf))
5375 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5376 
5377 	if (flags->isprefix &&
5378 	    !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5379 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5380 		    "(%s) does not exist"), tosnap);
5381 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5382 	}
5383 	if (originsnap &&
5384 	    !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5385 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5386 		    "(%s) does not exist"), originsnap);
5387 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5388 	}
5389 
5390 	/* read in the BEGIN record */
5391 	if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5392 	    &zcksum)))
5393 		return (err);
5394 
5395 	if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5396 		/* It's the double end record at the end of a package */
5397 		return (ENODATA);
5398 	}
5399 
5400 	/* the kernel needs the non-byteswapped begin record */
5401 	drr_noswap = drr;
5402 
5403 	flags->byteswap = B_FALSE;
5404 	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5405 		/*
5406 		 * We computed the checksum in the wrong byteorder in
5407 		 * recv_read() above; do it again correctly.
5408 		 */
5409 		memset(&zcksum, 0, sizeof (zio_cksum_t));
5410 		fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5411 		flags->byteswap = B_TRUE;
5412 
5413 		drr.drr_type = BSWAP_32(drr.drr_type);
5414 		drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5415 		drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5416 		drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5417 		drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5418 		drrb->drr_type = BSWAP_32(drrb->drr_type);
5419 		drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5420 		drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5421 		drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5422 	}
5423 
5424 	if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5425 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5426 		    "stream (bad magic number)"));
5427 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5428 	}
5429 
5430 	featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5431 	hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5432 
5433 	if (!DMU_STREAM_SUPPORTED(featureflags) ||
5434 	    (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5435 		/*
5436 		 * Let's be explicit about this one, since rather than
5437 		 * being a new feature we can't know, it's an old
5438 		 * feature we dropped.
5439 		 */
5440 		if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5441 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5442 			    "stream has deprecated feature: dedup, try "
5443 			    "'zstream redup [send in a file] | zfs recv "
5444 			    "[...]'"));
5445 		} else {
5446 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5447 			    "stream has unsupported feature, feature flags = "
5448 			    "%llx (unknown flags = %llx)"),
5449 			    (u_longlong_t)featureflags,
5450 			    (u_longlong_t)((featureflags) &
5451 			    ~DMU_BACKUP_FEATURE_MASK));
5452 		}
5453 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5454 	}
5455 
5456 	/* Holds feature is set once in the compound stream header. */
5457 	if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5458 		flags->holds = B_TRUE;
5459 
5460 	if (strchr(drrb->drr_toname, '@') == NULL) {
5461 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5462 		    "stream (bad snapshot name)"));
5463 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5464 	}
5465 
5466 	if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5467 		char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5468 		if (sendfs == NULL) {
5469 			/*
5470 			 * We were not called from zfs_receive_package(). Get
5471 			 * the fs specified by 'zfs send'.
5472 			 */
5473 			char *cp;
5474 			(void) strlcpy(nonpackage_sendfs,
5475 			    drr.drr_u.drr_begin.drr_toname,
5476 			    sizeof (nonpackage_sendfs));
5477 			if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5478 				*cp = '\0';
5479 			sendfs = nonpackage_sendfs;
5480 			VERIFY(finalsnap == NULL);
5481 		}
5482 		return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5483 		    &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5484 		    finalsnap, cmdprops));
5485 	} else {
5486 		assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5487 		    DMU_COMPOUNDSTREAM);
5488 		return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5489 		    &zcksum, top_zfs, cmdprops));
5490 	}
5491 }
5492 
5493 /*
5494  * Restores a backup of tosnap from the file descriptor specified by infd.
5495  * Return 0 on total success, -2 if some things couldn't be
5496  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5497  * (-1 will override -2, if -1 and the resumable flag was specified the
5498  * transfer can be resumed if the sending side supports it).
5499  */
5500 int
5501 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5502     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5503 {
5504 	char *top_zfs = NULL;
5505 	int err;
5506 	struct stat sb;
5507 	const char *originsnap = NULL;
5508 
5509 	/*
5510 	 * The only way fstat can fail is if we do not have a valid file
5511 	 * descriptor.
5512 	 */
5513 	if (fstat(infd, &sb) == -1) {
5514 		perror("fstat");
5515 		return (-2);
5516 	}
5517 
5518 	if (props) {
5519 		err = nvlist_lookup_string(props, "origin", &originsnap);
5520 		if (err && err != ENOENT)
5521 			return (err);
5522 	}
5523 
5524 	err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5525 	    stream_avl, &top_zfs, NULL, props);
5526 
5527 	if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5528 		zfs_handle_t *zhp = NULL;
5529 		prop_changelist_t *clp = NULL;
5530 
5531 		zhp = zfs_open(hdl, top_zfs,
5532 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5533 		if (zhp == NULL) {
5534 			err = -1;
5535 			goto out;
5536 		} else {
5537 			if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5538 				zfs_close(zhp);
5539 				goto out;
5540 			}
5541 
5542 			clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5543 			    CL_GATHER_MOUNT_ALWAYS,
5544 			    flags->forceunmount ? MS_FORCE : 0);
5545 			zfs_close(zhp);
5546 			if (clp == NULL) {
5547 				err = -1;
5548 				goto out;
5549 			}
5550 
5551 			/* mount and share received datasets */
5552 			err = changelist_postfix(clp);
5553 			changelist_free(clp);
5554 			if (err != 0)
5555 				err = -1;
5556 		}
5557 	}
5558 
5559 out:
5560 	if (top_zfs)
5561 		free(top_zfs);
5562 
5563 	return (err);
5564 }
5565