xref: /freebsd/sys/contrib/openzfs/lib/libzfs/libzfs_sendrecv.c (revision a12eb9e4ae534557867d49803a1e28bfe519a207)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
27  * All rights reserved
28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
32  * Copyright (c) 2019 Datto Inc.
33  */
34 
35 #include <assert.h>
36 #include <ctype.h>
37 #include <errno.h>
38 #include <libintl.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <unistd.h>
43 #include <stddef.h>
44 #include <fcntl.h>
45 #include <sys/mount.h>
46 #include <sys/mntent.h>
47 #include <sys/mnttab.h>
48 #include <sys/avl.h>
49 #include <sys/debug.h>
50 #include <sys/stat.h>
51 #include <pthread.h>
52 #include <umem.h>
53 #include <time.h>
54 
55 #include <libzfs.h>
56 #include <libzfs_core.h>
57 #include <libzutil.h>
58 
59 #include "zfs_namecheck.h"
60 #include "zfs_prop.h"
61 #include "zfs_fletcher.h"
62 #include "libzfs_impl.h"
63 #include <cityhash.h>
64 #include <zlib.h>
65 #include <sys/zio_checksum.h>
66 #include <sys/dsl_crypt.h>
67 #include <sys/ddt.h>
68 #include <sys/socket.h>
69 #include <sys/sha2.h>
70 
71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
73     const char *, nvlist_t *);
74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
76     uint64_t num_redact_snaps, char *name);
77 static int guid_to_name(libzfs_handle_t *, const char *,
78     uint64_t, boolean_t, char *);
79 
80 typedef struct progress_arg {
81 	zfs_handle_t *pa_zhp;
82 	int pa_fd;
83 	boolean_t pa_parsable;
84 	boolean_t pa_estimate;
85 	int pa_verbosity;
86 } progress_arg_t;
87 
88 static int
89 dump_record(dmu_replay_record_t *drr, void *payload, size_t payload_len,
90     zio_cksum_t *zc, int outfd)
91 {
92 	ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
93 	    ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
94 	fletcher_4_incremental_native(drr,
95 	    offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
96 	if (drr->drr_type != DRR_BEGIN) {
97 		ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
98 		    drr_checksum.drr_checksum));
99 		drr->drr_u.drr_checksum.drr_checksum = *zc;
100 	}
101 	fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
102 	    sizeof (zio_cksum_t), zc);
103 	if (write(outfd, drr, sizeof (*drr)) == -1)
104 		return (errno);
105 	if (payload_len != 0) {
106 		fletcher_4_incremental_native(payload, payload_len, zc);
107 		if (write(outfd, payload, payload_len) == -1)
108 			return (errno);
109 	}
110 	return (0);
111 }
112 
113 /*
114  * Routines for dealing with the AVL tree of fs-nvlists
115  */
116 typedef struct fsavl_node {
117 	avl_node_t fn_node;
118 	nvlist_t *fn_nvfs;
119 	char *fn_snapname;
120 	uint64_t fn_guid;
121 } fsavl_node_t;
122 
123 static int
124 fsavl_compare(const void *arg1, const void *arg2)
125 {
126 	const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
127 	const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
128 
129 	return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
130 }
131 
132 /*
133  * Given the GUID of a snapshot, find its containing filesystem and
134  * (optionally) name.
135  */
136 static nvlist_t *
137 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
138 {
139 	fsavl_node_t fn_find;
140 	fsavl_node_t *fn;
141 
142 	fn_find.fn_guid = snapguid;
143 
144 	fn = avl_find(avl, &fn_find, NULL);
145 	if (fn) {
146 		if (snapname)
147 			*snapname = fn->fn_snapname;
148 		return (fn->fn_nvfs);
149 	}
150 	return (NULL);
151 }
152 
153 static void
154 fsavl_destroy(avl_tree_t *avl)
155 {
156 	fsavl_node_t *fn;
157 	void *cookie;
158 
159 	if (avl == NULL)
160 		return;
161 
162 	cookie = NULL;
163 	while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
164 		free(fn);
165 	avl_destroy(avl);
166 	free(avl);
167 }
168 
169 /*
170  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
171  */
172 static avl_tree_t *
173 fsavl_create(nvlist_t *fss)
174 {
175 	avl_tree_t *fsavl;
176 	nvpair_t *fselem = NULL;
177 
178 	if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
179 		return (NULL);
180 
181 	avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
182 	    offsetof(fsavl_node_t, fn_node));
183 
184 	while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
185 		nvlist_t *nvfs, *snaps;
186 		nvpair_t *snapelem = NULL;
187 
188 		nvfs = fnvpair_value_nvlist(fselem);
189 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
190 
191 		while ((snapelem =
192 		    nvlist_next_nvpair(snaps, snapelem)) != NULL) {
193 			fsavl_node_t *fn;
194 
195 			if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
196 				fsavl_destroy(fsavl);
197 				return (NULL);
198 			}
199 			fn->fn_nvfs = nvfs;
200 			fn->fn_snapname = nvpair_name(snapelem);
201 			fn->fn_guid = fnvpair_value_uint64(snapelem);
202 
203 			/*
204 			 * Note: if there are multiple snaps with the
205 			 * same GUID, we ignore all but one.
206 			 */
207 			avl_index_t where = 0;
208 			if (avl_find(fsavl, fn, &where) == NULL)
209 				avl_insert(fsavl, fn, where);
210 			else
211 				free(fn);
212 		}
213 	}
214 
215 	return (fsavl);
216 }
217 
218 /*
219  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
220  */
221 typedef struct send_data {
222 	/*
223 	 * assigned inside every recursive call,
224 	 * restored from *_save on return:
225 	 *
226 	 * guid of fromsnap snapshot in parent dataset
227 	 * txg of fromsnap snapshot in current dataset
228 	 * txg of tosnap snapshot in current dataset
229 	 */
230 
231 	uint64_t parent_fromsnap_guid;
232 	uint64_t fromsnap_txg;
233 	uint64_t tosnap_txg;
234 
235 	/* the nvlists get accumulated during depth-first traversal */
236 	nvlist_t *parent_snaps;
237 	nvlist_t *fss;
238 	nvlist_t *snapprops;
239 	nvlist_t *snapholds;	/* user holds */
240 
241 	/* send-receive configuration, does not change during traversal */
242 	const char *fsname;
243 	const char *fromsnap;
244 	const char *tosnap;
245 	boolean_t recursive;
246 	boolean_t raw;
247 	boolean_t doall;
248 	boolean_t replicate;
249 	boolean_t skipmissing;
250 	boolean_t verbose;
251 	boolean_t backup;
252 	boolean_t seenfrom;
253 	boolean_t seento;
254 	boolean_t holds;	/* were holds requested with send -h */
255 	boolean_t props;
256 
257 	/*
258 	 * The header nvlist is of the following format:
259 	 * {
260 	 *   "tosnap" -> string
261 	 *   "fromsnap" -> string (if incremental)
262 	 *   "fss" -> {
263 	 *	id -> {
264 	 *
265 	 *	 "name" -> string (full name; for debugging)
266 	 *	 "parentfromsnap" -> number (guid of fromsnap in parent)
267 	 *
268 	 *	 "props" -> { name -> value (only if set here) }
269 	 *	 "snaps" -> { name (lastname) -> number (guid) }
270 	 *	 "snapprops" -> { name (lastname) -> { name -> value } }
271 	 *	 "snapholds" -> { name (lastname) -> { holdname -> crtime } }
272 	 *
273 	 *	 "origin" -> number (guid) (if clone)
274 	 *	 "is_encroot" -> boolean
275 	 *	 "sent" -> boolean (not on-disk)
276 	 *	}
277 	 *   }
278 	 * }
279 	 *
280 	 */
281 } send_data_t;
282 
283 static void
284 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
285 
286 /*
287  * Collect guid, valid props, optionally holds, etc. of a snapshot.
288  * This interface is intended for use as a zfs_iter_snapshots_sorted visitor.
289  */
290 static int
291 send_iterate_snap(zfs_handle_t *zhp, void *arg)
292 {
293 	send_data_t *sd = arg;
294 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
295 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
296 	boolean_t isfromsnap, istosnap, istosnapwithnofrom;
297 	char *snapname;
298 	const char *from = sd->fromsnap;
299 	const char *to = sd->tosnap;
300 
301 	snapname = strrchr(zhp->zfs_name, '@');
302 	assert(snapname != NULL);
303 	++snapname;
304 
305 	isfromsnap = (from != NULL && strcmp(from, snapname) == 0);
306 	istosnap = (to != NULL && strcmp(to, snapname) == 0);
307 	istosnapwithnofrom = (istosnap && from == NULL);
308 
309 	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
310 		if (sd->verbose) {
311 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
312 			    "skipping snapshot %s because it was created "
313 			    "after the destination snapshot (%s)\n"),
314 			    zhp->zfs_name, to);
315 		}
316 		zfs_close(zhp);
317 		return (0);
318 	}
319 
320 	fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
321 
322 	/*
323 	 * NB: if there is no fromsnap here (it's a newly created fs in
324 	 * an incremental replication), we will substitute the tosnap.
325 	 */
326 	if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap))
327 		sd->parent_fromsnap_guid = guid;
328 
329 	if (!sd->recursive) {
330 		/*
331 		 * To allow a doall stream to work properly
332 		 * with a NULL fromsnap
333 		 */
334 		if (sd->doall && from == NULL && !sd->seenfrom)
335 			sd->seenfrom = B_TRUE;
336 
337 		if (!sd->seenfrom && isfromsnap) {
338 			sd->seenfrom = B_TRUE;
339 			zfs_close(zhp);
340 			return (0);
341 		}
342 
343 		if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
344 			zfs_close(zhp);
345 			return (0);
346 		}
347 
348 		if (istosnap)
349 			sd->seento = B_TRUE;
350 	}
351 
352 	nvlist_t *nv = fnvlist_alloc();
353 	send_iterate_prop(zhp, sd->backup, nv);
354 	fnvlist_add_nvlist(sd->snapprops, snapname, nv);
355 	fnvlist_free(nv);
356 
357 	if (sd->holds) {
358 		nvlist_t *holds;
359 		if (lzc_get_holds(zhp->zfs_name, &holds) == 0) {
360 			fnvlist_add_nvlist(sd->snapholds, snapname, holds);
361 			fnvlist_free(holds);
362 		}
363 	}
364 
365 	zfs_close(zhp);
366 	return (0);
367 }
368 
369 /*
370  * Collect all valid props from the handle snap into an nvlist.
371  */
372 static void
373 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
374 {
375 	nvlist_t *props;
376 
377 	if (received_only)
378 		props = zfs_get_recvd_props(zhp);
379 	else
380 		props = zhp->zfs_props;
381 
382 	nvpair_t *elem = NULL;
383 	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
384 		char *propname = nvpair_name(elem);
385 		zfs_prop_t prop = zfs_name_to_prop(propname);
386 
387 		if (!zfs_prop_user(propname)) {
388 			/*
389 			 * Realistically, this should never happen.  However,
390 			 * we want the ability to add DSL properties without
391 			 * needing to make incompatible version changes.  We
392 			 * need to ignore unknown properties to allow older
393 			 * software to still send datasets containing these
394 			 * properties, with the unknown properties elided.
395 			 */
396 			if (prop == ZPROP_INVAL)
397 				continue;
398 
399 			if (zfs_prop_readonly(prop))
400 				continue;
401 		}
402 
403 		nvlist_t *propnv = fnvpair_value_nvlist(elem);
404 
405 		boolean_t isspacelimit = (prop == ZFS_PROP_QUOTA ||
406 		    prop == ZFS_PROP_RESERVATION ||
407 		    prop == ZFS_PROP_REFQUOTA ||
408 		    prop == ZFS_PROP_REFRESERVATION);
409 		if (isspacelimit && zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
410 			continue;
411 
412 		char *source;
413 		if (nvlist_lookup_string(propnv, ZPROP_SOURCE, &source) == 0) {
414 			if (strcmp(source, zhp->zfs_name) != 0 &&
415 			    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
416 				continue;
417 		} else {
418 			/*
419 			 * May have no source before SPA_VERSION_RECVD_PROPS,
420 			 * but is still modifiable.
421 			 */
422 			if (!isspacelimit)
423 				continue;
424 		}
425 
426 		if (zfs_prop_user(propname) ||
427 		    zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
428 			char *value;
429 			value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
430 			fnvlist_add_string(nv, propname, value);
431 		} else {
432 			uint64_t value;
433 			value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
434 			fnvlist_add_uint64(nv, propname, value);
435 		}
436 	}
437 }
438 
439 /*
440  * returns snapshot creation txg
441  * and returns 0 if the snapshot does not exist
442  */
443 static uint64_t
444 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
445 {
446 	char name[ZFS_MAX_DATASET_NAME_LEN];
447 	uint64_t txg = 0;
448 
449 	if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
450 		return (txg);
451 
452 	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
453 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
454 		zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
455 		if (zhp != NULL) {
456 			txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
457 			zfs_close(zhp);
458 		}
459 	}
460 
461 	return (txg);
462 }
463 
464 /*
465  * Recursively generate nvlists describing datasets.  See comment
466  * for the data structure send_data_t above for description of contents
467  * of the nvlist.
468  */
469 static int
470 send_iterate_fs(zfs_handle_t *zhp, void *arg)
471 {
472 	send_data_t *sd = arg;
473 	nvlist_t *nvfs = NULL, *nv = NULL;
474 	int rv = 0;
475 	uint64_t min_txg = 0, max_txg = 0;
476 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
477 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
478 	uint64_t fromsnap_txg, tosnap_txg;
479 	char guidstring[64];
480 
481 	/* These fields are restored on return from a recursive call. */
482 	uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
483 	uint64_t fromsnap_txg_save = sd->fromsnap_txg;
484 	uint64_t tosnap_txg_save = sd->tosnap_txg;
485 
486 	fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
487 	if (fromsnap_txg != 0)
488 		sd->fromsnap_txg = fromsnap_txg;
489 
490 	tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
491 	if (tosnap_txg != 0)
492 		sd->tosnap_txg = tosnap_txg;
493 
494 	/*
495 	 * On the send side, if the current dataset does not have tosnap,
496 	 * perform two additional checks:
497 	 *
498 	 * - Skip sending the current dataset if it was created later than
499 	 *   the parent tosnap.
500 	 * - Return error if the current dataset was created earlier than
501 	 *   the parent tosnap, unless --skip-missing specified. Then
502 	 *   just print a warning.
503 	 */
504 	if (sd->tosnap != NULL && tosnap_txg == 0) {
505 		if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
506 			if (sd->verbose) {
507 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
508 				    "skipping dataset %s: snapshot %s does "
509 				    "not exist\n"), zhp->zfs_name, sd->tosnap);
510 			}
511 		} else if (sd->skipmissing) {
512 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
513 			    "WARNING: skipping dataset %s and its children:"
514 			    " snapshot %s does not exist\n"),
515 			    zhp->zfs_name, sd->tosnap);
516 		} else {
517 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
518 			    "cannot send %s@%s%s: snapshot %s@%s does not "
519 			    "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
520 			    dgettext(TEXT_DOMAIN, " recursively") : "",
521 			    zhp->zfs_name, sd->tosnap);
522 			rv = EZFS_NOENT;
523 		}
524 		goto out;
525 	}
526 
527 	nvfs = fnvlist_alloc();
528 	fnvlist_add_string(nvfs, "name", zhp->zfs_name);
529 	fnvlist_add_uint64(nvfs, "parentfromsnap", sd->parent_fromsnap_guid);
530 
531 	if (zhp->zfs_dmustats.dds_origin[0] != '\0') {
532 		zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
533 		    zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
534 		if (origin == NULL) {
535 			rv = -1;
536 			goto out;
537 		}
538 		fnvlist_add_uint64(nvfs, "origin",
539 		    origin->zfs_dmustats.dds_guid);
540 		zfs_close(origin);
541 	}
542 
543 	/* Iterate over props. */
544 	if (sd->props || sd->backup || sd->recursive) {
545 		nv = fnvlist_alloc();
546 		send_iterate_prop(zhp, sd->backup, nv);
547 		fnvlist_add_nvlist(nvfs, "props", nv);
548 	}
549 	if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
550 		boolean_t encroot;
551 
552 		/* Determine if this dataset is an encryption root. */
553 		if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
554 			rv = -1;
555 			goto out;
556 		}
557 
558 		if (encroot)
559 			fnvlist_add_boolean(nvfs, "is_encroot");
560 
561 		/*
562 		 * Encrypted datasets can only be sent with properties if
563 		 * the raw flag is specified because the receive side doesn't
564 		 * currently have a mechanism for recursively asking the user
565 		 * for new encryption parameters.
566 		 */
567 		if (!sd->raw) {
568 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
569 			    "cannot send %s@%s: encrypted dataset %s may not "
570 			    "be sent with properties without the raw flag\n"),
571 			    sd->fsname, sd->tosnap, zhp->zfs_name);
572 			rv = -1;
573 			goto out;
574 		}
575 
576 	}
577 
578 	/*
579 	 * Iterate over snaps, and set sd->parent_fromsnap_guid.
580 	 *
581 	 * If this is a "doall" send, a replicate send or we're just trying
582 	 * to gather a list of previous snapshots, iterate through all the
583 	 * snaps in the txg range. Otherwise just look at the one we're
584 	 * interested in.
585 	 */
586 	sd->parent_fromsnap_guid = 0;
587 	sd->parent_snaps = fnvlist_alloc();
588 	sd->snapprops = fnvlist_alloc();
589 	if (sd->holds)
590 		sd->snapholds = fnvlist_alloc();
591 	if (sd->doall || sd->replicate || sd->tosnap == NULL) {
592 		if (!sd->replicate && fromsnap_txg != 0)
593 			min_txg = fromsnap_txg;
594 		if (!sd->replicate && tosnap_txg != 0)
595 			max_txg = tosnap_txg;
596 		(void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
597 		    min_txg, max_txg);
598 	} else {
599 		char snapname[MAXPATHLEN];
600 		zfs_handle_t *snap;
601 
602 		(void) snprintf(snapname, sizeof (snapname), "%s@%s",
603 		    zhp->zfs_name, sd->tosnap);
604 		if (sd->fromsnap != NULL)
605 			sd->seenfrom = B_TRUE;
606 		snap = zfs_open(zhp->zfs_hdl, snapname, ZFS_TYPE_SNAPSHOT);
607 		if (snap != NULL)
608 			(void) send_iterate_snap(snap, sd);
609 	}
610 
611 	fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
612 	fnvlist_free(sd->parent_snaps);
613 	fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
614 	fnvlist_free(sd->snapprops);
615 	if (sd->holds) {
616 		fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
617 		fnvlist_free(sd->snapholds);
618 	}
619 
620 	/* Do not allow the size of the properties list to exceed the limit */
621 	if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
622 	    zhp->zfs_hdl->libzfs_max_nvlist) {
623 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
624 		    "warning: cannot send %s@%s: the size of the list of "
625 		    "snapshots and properties is too large to be received "
626 		    "successfully.\n"
627 		    "Select a smaller number of snapshots to send.\n"),
628 		    zhp->zfs_name, sd->tosnap);
629 		rv = EZFS_NOSPC;
630 		goto out;
631 	}
632 	/* Add this fs to nvlist. */
633 	(void) snprintf(guidstring, sizeof (guidstring),
634 	    "0x%llx", (longlong_t)guid);
635 	fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
636 
637 	/* Iterate over children. */
638 	if (sd->recursive)
639 		rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
640 
641 out:
642 	/* Restore saved fields. */
643 	sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
644 	sd->fromsnap_txg = fromsnap_txg_save;
645 	sd->tosnap_txg = tosnap_txg_save;
646 
647 	fnvlist_free(nv);
648 	fnvlist_free(nvfs);
649 
650 	zfs_close(zhp);
651 	return (rv);
652 }
653 
654 static int
655 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
656     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
657     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
658     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
659     avl_tree_t **avlp)
660 {
661 	zfs_handle_t *zhp;
662 	send_data_t sd = { 0 };
663 	int error;
664 
665 	zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
666 	if (zhp == NULL)
667 		return (EZFS_BADTYPE);
668 
669 	sd.fss = fnvlist_alloc();
670 	sd.fsname = fsname;
671 	sd.fromsnap = fromsnap;
672 	sd.tosnap = tosnap;
673 	sd.recursive = recursive;
674 	sd.raw = raw;
675 	sd.doall = doall;
676 	sd.replicate = replicate;
677 	sd.skipmissing = skipmissing;
678 	sd.verbose = verbose;
679 	sd.backup = backup;
680 	sd.holds = holds;
681 	sd.props = props;
682 
683 	if ((error = send_iterate_fs(zhp, &sd)) != 0) {
684 		fnvlist_free(sd.fss);
685 		if (avlp != NULL)
686 			*avlp = NULL;
687 		*nvlp = NULL;
688 		return (error);
689 	}
690 
691 	if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
692 		fnvlist_free(sd.fss);
693 		*nvlp = NULL;
694 		return (EZFS_NOMEM);
695 	}
696 
697 	*nvlp = sd.fss;
698 	return (0);
699 }
700 
701 /*
702  * Routines specific to "zfs send"
703  */
704 typedef struct send_dump_data {
705 	/* these are all just the short snapname (the part after the @) */
706 	const char *fromsnap;
707 	const char *tosnap;
708 	char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
709 	uint64_t prevsnap_obj;
710 	boolean_t seenfrom, seento, replicate, doall, fromorigin;
711 	boolean_t dryrun, parsable, progress, embed_data, std_out;
712 	boolean_t large_block, compress, raw, holds;
713 	int outfd;
714 	boolean_t err;
715 	nvlist_t *fss;
716 	nvlist_t *snapholds;
717 	avl_tree_t *fsavl;
718 	snapfilter_cb_t *filter_cb;
719 	void *filter_cb_arg;
720 	nvlist_t *debugnv;
721 	char holdtag[ZFS_MAX_DATASET_NAME_LEN];
722 	int cleanup_fd;
723 	int verbosity;
724 	uint64_t size;
725 } send_dump_data_t;
726 
727 static int
728 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
729     enum lzc_send_flags flags, uint64_t *spacep)
730 {
731 	assert(snapname != NULL);
732 
733 	int error = lzc_send_space(snapname, from, flags, spacep);
734 	if (error == 0)
735 		return (0);
736 
737 	char errbuf[ERRBUFLEN];
738 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
739 	    "warning: cannot estimate space for '%s'"), snapname);
740 
741 	libzfs_handle_t *hdl = zhp->zfs_hdl;
742 	switch (error) {
743 	case EXDEV:
744 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
745 		    "not an earlier snapshot from the same fs"));
746 		return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
747 
748 	case ENOENT:
749 		if (zfs_dataset_exists(hdl, snapname,
750 		    ZFS_TYPE_SNAPSHOT)) {
751 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
752 			    "incremental source (%s) does not exist"),
753 			    snapname);
754 		}
755 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
756 
757 	case EDQUOT:
758 	case EFBIG:
759 	case EIO:
760 	case ENOLINK:
761 	case ENOSPC:
762 	case ENOSTR:
763 	case ENXIO:
764 	case EPIPE:
765 	case ERANGE:
766 	case EFAULT:
767 	case EROFS:
768 	case EINVAL:
769 		zfs_error_aux(hdl, "%s", strerror(error));
770 		return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
771 
772 	default:
773 		return (zfs_standard_error(hdl, error, errbuf));
774 	}
775 }
776 
777 /*
778  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
779  * NULL) to the file descriptor specified by outfd.
780  */
781 static int
782 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
783     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
784     nvlist_t *debugnv)
785 {
786 	zfs_cmd_t zc = {"\0"};
787 	libzfs_handle_t *hdl = zhp->zfs_hdl;
788 	nvlist_t *thisdbg;
789 
790 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
791 	assert(fromsnap_obj == 0 || !fromorigin);
792 
793 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
794 	zc.zc_cookie = outfd;
795 	zc.zc_obj = fromorigin;
796 	zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
797 	zc.zc_fromobj = fromsnap_obj;
798 	zc.zc_flags = flags;
799 
800 	if (debugnv != NULL) {
801 		thisdbg = fnvlist_alloc();
802 		if (fromsnap != NULL && fromsnap[0] != '\0')
803 			fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
804 	}
805 
806 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
807 		char errbuf[ERRBUFLEN];
808 		int error = errno;
809 
810 		(void) snprintf(errbuf, sizeof (errbuf), "%s '%s'",
811 		    dgettext(TEXT_DOMAIN, "warning: cannot send"),
812 		    zhp->zfs_name);
813 
814 		if (debugnv != NULL) {
815 			fnvlist_add_uint64(thisdbg, "error", error);
816 			fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
817 			fnvlist_free(thisdbg);
818 		}
819 
820 		switch (error) {
821 		case EXDEV:
822 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
823 			    "not an earlier snapshot from the same fs"));
824 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
825 
826 		case EACCES:
827 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
828 			    "source key must be loaded"));
829 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
830 
831 		case ENOENT:
832 			if (zfs_dataset_exists(hdl, zc.zc_name,
833 			    ZFS_TYPE_SNAPSHOT)) {
834 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
835 				    "incremental source (@%s) does not exist"),
836 				    zc.zc_value);
837 			}
838 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
839 
840 		case EDQUOT:
841 		case EFBIG:
842 		case EIO:
843 		case ENOLINK:
844 		case ENOSPC:
845 		case ENOSTR:
846 		case ENXIO:
847 		case EPIPE:
848 		case ERANGE:
849 		case EFAULT:
850 		case EROFS:
851 		case EINVAL:
852 			zfs_error_aux(hdl, "%s", strerror(errno));
853 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
854 		case ENOTSUP:
855 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
856 			    "large blocks detected but large_blocks feature "
857 			    "is inactive; raw send unsupported"));
858 			return (zfs_error(hdl, EZFS_NOTSUP, errbuf));
859 
860 		default:
861 			return (zfs_standard_error(hdl, errno, errbuf));
862 		}
863 	}
864 
865 	if (debugnv != NULL) {
866 		fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
867 		fnvlist_free(thisdbg);
868 	}
869 
870 	return (0);
871 }
872 
873 static void
874 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
875 {
876 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
877 
878 	/*
879 	 * zfs_send() only sets snapholds for sends that need them,
880 	 * e.g. replication and doall.
881 	 */
882 	if (sdd->snapholds == NULL)
883 		return;
884 
885 	fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
886 }
887 
888 int
889 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
890     uint64_t *blocks_visited)
891 {
892 	zfs_cmd_t zc = {"\0"};
893 
894 	if (bytes_written != NULL)
895 		*bytes_written = 0;
896 	if (blocks_visited != NULL)
897 		*blocks_visited = 0;
898 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
899 	zc.zc_cookie = fd;
900 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
901 		return (errno);
902 	if (bytes_written != NULL)
903 		*bytes_written = zc.zc_cookie;
904 	if (blocks_visited != NULL)
905 		*blocks_visited = zc.zc_objset_type;
906 	return (0);
907 }
908 
909 static void *
910 send_progress_thread(void *arg)
911 {
912 	progress_arg_t *pa = arg;
913 	zfs_handle_t *zhp = pa->pa_zhp;
914 	uint64_t bytes;
915 	uint64_t blocks;
916 	char buf[16];
917 	time_t t;
918 	struct tm tm;
919 	int err;
920 
921 	if (!pa->pa_parsable) {
922 		(void) fprintf(stderr,
923 		    "TIME       %s   %sSNAPSHOT %s\n",
924 		    pa->pa_estimate ? "BYTES" : " SENT",
925 		    pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
926 		    zhp->zfs_name);
927 	}
928 
929 	/*
930 	 * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
931 	 */
932 	for (;;) {
933 		(void) sleep(1);
934 		if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
935 		    &blocks)) != 0) {
936 			if (err == EINTR || err == ENOENT)
937 				return ((void *)0);
938 			return ((void *)(uintptr_t)err);
939 		}
940 
941 		(void) time(&t);
942 		localtime_r(&t, &tm);
943 
944 		if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
945 			(void) fprintf(stderr,
946 			    "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
947 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
948 			    (u_longlong_t)bytes, (u_longlong_t)blocks,
949 			    zhp->zfs_name);
950 		} else if (pa->pa_verbosity >= 2) {
951 			zfs_nicenum(bytes, buf, sizeof (buf));
952 			(void) fprintf(stderr,
953 			    "%02d:%02d:%02d   %5s    %8llu    %s\n",
954 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
955 			    buf, (u_longlong_t)blocks, zhp->zfs_name);
956 		} else if (pa->pa_parsable) {
957 			(void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
958 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
959 			    (u_longlong_t)bytes, zhp->zfs_name);
960 		} else {
961 			zfs_nicebytes(bytes, buf, sizeof (buf));
962 			(void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
963 			    tm.tm_hour, tm.tm_min, tm.tm_sec,
964 			    buf, zhp->zfs_name);
965 		}
966 	}
967 }
968 
969 static boolean_t
970 send_progress_thread_exit(libzfs_handle_t *hdl, pthread_t ptid)
971 {
972 	void *status = NULL;
973 	(void) pthread_cancel(ptid);
974 	(void) pthread_join(ptid, &status);
975 	int error = (int)(uintptr_t)status;
976 	if (error != 0 && status != PTHREAD_CANCELED)
977 		return (zfs_standard_error(hdl, error,
978 		    dgettext(TEXT_DOMAIN, "progress thread exited nonzero")));
979 	else
980 		return (B_FALSE);
981 }
982 
983 static void
984 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
985     uint64_t size, boolean_t parsable)
986 {
987 	if (parsable) {
988 		if (fromsnap != NULL) {
989 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
990 			    "incremental\t%s\t%s"), fromsnap, tosnap);
991 		} else {
992 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
993 			    "full\t%s"), tosnap);
994 		}
995 		(void) fprintf(fout, "\t%llu", (longlong_t)size);
996 	} else {
997 		if (fromsnap != NULL) {
998 			if (strchr(fromsnap, '@') == NULL &&
999 			    strchr(fromsnap, '#') == NULL) {
1000 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1001 				    "send from @%s to %s"), fromsnap, tosnap);
1002 			} else {
1003 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1004 				    "send from %s to %s"), fromsnap, tosnap);
1005 			}
1006 		} else {
1007 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1008 			    "full send of %s"), tosnap);
1009 		}
1010 		if (size != 0) {
1011 			char buf[16];
1012 			zfs_nicebytes(size, buf, sizeof (buf));
1013 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1014 			    " estimated size is %s"), buf);
1015 		}
1016 	}
1017 	(void) fprintf(fout, "\n");
1018 }
1019 
1020 /*
1021  * Send a single filesystem snapshot, updating the send dump data.
1022  * This interface is intended for use as a zfs_iter_snapshots_sorted visitor.
1023  */
1024 static int
1025 dump_snapshot(zfs_handle_t *zhp, void *arg)
1026 {
1027 	send_dump_data_t *sdd = arg;
1028 	progress_arg_t pa = { 0 };
1029 	pthread_t tid;
1030 	char *thissnap;
1031 	enum lzc_send_flags flags = 0;
1032 	int err;
1033 	boolean_t isfromsnap, istosnap, fromorigin;
1034 	boolean_t exclude = B_FALSE;
1035 	FILE *fout = sdd->std_out ? stdout : stderr;
1036 
1037 	err = 0;
1038 	thissnap = strchr(zhp->zfs_name, '@') + 1;
1039 	isfromsnap = (sdd->fromsnap != NULL &&
1040 	    strcmp(sdd->fromsnap, thissnap) == 0);
1041 
1042 	if (!sdd->seenfrom && isfromsnap) {
1043 		gather_holds(zhp, sdd);
1044 		sdd->seenfrom = B_TRUE;
1045 		(void) strlcpy(sdd->prevsnap, thissnap, sizeof (sdd->prevsnap));
1046 		sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1047 		zfs_close(zhp);
1048 		return (0);
1049 	}
1050 
1051 	if (sdd->seento || !sdd->seenfrom) {
1052 		zfs_close(zhp);
1053 		return (0);
1054 	}
1055 
1056 	istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1057 	if (istosnap)
1058 		sdd->seento = B_TRUE;
1059 
1060 	if (sdd->large_block)
1061 		flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1062 	if (sdd->embed_data)
1063 		flags |= LZC_SEND_FLAG_EMBED_DATA;
1064 	if (sdd->compress)
1065 		flags |= LZC_SEND_FLAG_COMPRESS;
1066 	if (sdd->raw)
1067 		flags |= LZC_SEND_FLAG_RAW;
1068 
1069 	if (!sdd->doall && !isfromsnap && !istosnap) {
1070 		if (sdd->replicate) {
1071 			char *snapname;
1072 			nvlist_t *snapprops;
1073 			/*
1074 			 * Filter out all intermediate snapshots except origin
1075 			 * snapshots needed to replicate clones.
1076 			 */
1077 			nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1078 			    zhp->zfs_dmustats.dds_guid, &snapname);
1079 
1080 			if (nvfs != NULL) {
1081 				snapprops = fnvlist_lookup_nvlist(nvfs,
1082 				    "snapprops");
1083 				snapprops = fnvlist_lookup_nvlist(snapprops,
1084 				    thissnap);
1085 				exclude = !nvlist_exists(snapprops,
1086 				    "is_clone_origin");
1087 			}
1088 		} else {
1089 			exclude = B_TRUE;
1090 		}
1091 	}
1092 
1093 	/*
1094 	 * If a filter function exists, call it to determine whether
1095 	 * this snapshot will be sent.
1096 	 */
1097 	if (exclude || (sdd->filter_cb != NULL &&
1098 	    sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1099 		/*
1100 		 * This snapshot is filtered out.  Don't send it, and don't
1101 		 * set prevsnap_obj, so it will be as if this snapshot didn't
1102 		 * exist, and the next accepted snapshot will be sent as
1103 		 * an incremental from the last accepted one, or as the
1104 		 * first (and full) snapshot in the case of a replication,
1105 		 * non-incremental send.
1106 		 */
1107 		zfs_close(zhp);
1108 		return (0);
1109 	}
1110 
1111 	gather_holds(zhp, sdd);
1112 	fromorigin = sdd->prevsnap[0] == '\0' &&
1113 	    (sdd->fromorigin || sdd->replicate);
1114 
1115 	if (sdd->verbosity != 0) {
1116 		uint64_t size = 0;
1117 		char fromds[ZFS_MAX_DATASET_NAME_LEN];
1118 
1119 		if (sdd->prevsnap[0] != '\0') {
1120 			(void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1121 			*(strchr(fromds, '@') + 1) = '\0';
1122 			(void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1123 		}
1124 		if (zfs_send_space(zhp, zhp->zfs_name,
1125 		    sdd->prevsnap[0] ? fromds : NULL, flags, &size) == 0) {
1126 			send_print_verbose(fout, zhp->zfs_name,
1127 			    sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1128 			    size, sdd->parsable);
1129 			sdd->size += size;
1130 		}
1131 	}
1132 
1133 	if (!sdd->dryrun) {
1134 		/*
1135 		 * If progress reporting is requested, spawn a new thread to
1136 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1137 		 */
1138 		if (sdd->progress) {
1139 			pa.pa_zhp = zhp;
1140 			pa.pa_fd = sdd->outfd;
1141 			pa.pa_parsable = sdd->parsable;
1142 			pa.pa_estimate = B_FALSE;
1143 			pa.pa_verbosity = sdd->verbosity;
1144 
1145 			if ((err = pthread_create(&tid, NULL,
1146 			    send_progress_thread, &pa)) != 0) {
1147 				zfs_close(zhp);
1148 				return (err);
1149 			}
1150 		}
1151 
1152 		err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1153 		    fromorigin, sdd->outfd, flags, sdd->debugnv);
1154 
1155 		if (sdd->progress &&
1156 		    send_progress_thread_exit(zhp->zfs_hdl, tid))
1157 			return (-1);
1158 	}
1159 
1160 	(void) strcpy(sdd->prevsnap, thissnap);
1161 	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1162 	zfs_close(zhp);
1163 	return (err);
1164 }
1165 
1166 /*
1167  * Send all snapshots for a filesystem, updating the send dump data.
1168  */
1169 static int
1170 dump_filesystem(zfs_handle_t *zhp, send_dump_data_t *sdd)
1171 {
1172 	int rv = 0;
1173 	boolean_t missingfrom = B_FALSE;
1174 	zfs_cmd_t zc = {"\0"};
1175 	uint64_t min_txg = 0, max_txg = 0;
1176 
1177 	/*
1178 	 * Make sure the tosnap exists.
1179 	 */
1180 	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1181 	    zhp->zfs_name, sdd->tosnap);
1182 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1183 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1184 		    "WARNING: could not send %s@%s: does not exist\n"),
1185 		    zhp->zfs_name, sdd->tosnap);
1186 		sdd->err = B_TRUE;
1187 		return (0);
1188 	}
1189 
1190 	/*
1191 	 * If this fs does not have fromsnap, and we're doing
1192 	 * recursive, we need to send a full stream from the
1193 	 * beginning (or an incremental from the origin if this
1194 	 * is a clone).  If we're doing non-recursive, then let
1195 	 * them get the error.
1196 	 */
1197 	if (sdd->replicate && sdd->fromsnap) {
1198 		/*
1199 		 * Make sure the fromsnap exists.
1200 		 */
1201 		(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1202 		    zhp->zfs_name, sdd->fromsnap);
1203 		if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0)
1204 			missingfrom = B_TRUE;
1205 	}
1206 
1207 	sdd->seenfrom = sdd->seento = B_FALSE;
1208 	sdd->prevsnap[0] = '\0';
1209 	sdd->prevsnap_obj = 0;
1210 	if (sdd->fromsnap == NULL || missingfrom)
1211 		sdd->seenfrom = B_TRUE;
1212 
1213 	/*
1214 	 * Iterate through all snapshots and process the ones we will be
1215 	 * sending. If we only have a "from" and "to" snapshot to deal
1216 	 * with, we can avoid iterating through all the other snapshots.
1217 	 */
1218 	if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1219 		if (!sdd->replicate) {
1220 			if (sdd->fromsnap != NULL) {
1221 				min_txg = get_snap_txg(zhp->zfs_hdl,
1222 				    zhp->zfs_name, sdd->fromsnap);
1223 			}
1224 			if (sdd->tosnap != NULL) {
1225 				max_txg = get_snap_txg(zhp->zfs_hdl,
1226 				    zhp->zfs_name, sdd->tosnap);
1227 			}
1228 		}
1229 		rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, sdd,
1230 		    min_txg, max_txg);
1231 	} else {
1232 		char snapname[MAXPATHLEN] = { 0 };
1233 		zfs_handle_t *snap;
1234 
1235 		/* Dump fromsnap. */
1236 		if (!sdd->seenfrom) {
1237 			(void) snprintf(snapname, sizeof (snapname),
1238 			    "%s@%s", zhp->zfs_name, sdd->fromsnap);
1239 			snap = zfs_open(zhp->zfs_hdl, snapname,
1240 			    ZFS_TYPE_SNAPSHOT);
1241 			if (snap != NULL)
1242 				rv = dump_snapshot(snap, sdd);
1243 			else
1244 				rv = -1;
1245 		}
1246 
1247 		/* Dump tosnap. */
1248 		if (rv == 0) {
1249 			(void) snprintf(snapname, sizeof (snapname),
1250 			    "%s@%s", zhp->zfs_name, sdd->tosnap);
1251 			snap = zfs_open(zhp->zfs_hdl, snapname,
1252 			    ZFS_TYPE_SNAPSHOT);
1253 			if (snap != NULL)
1254 				rv = dump_snapshot(snap, sdd);
1255 			else
1256 				rv = -1;
1257 		}
1258 	}
1259 
1260 	if (!sdd->seenfrom) {
1261 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1262 		    "WARNING: could not send %s@%s:\n"
1263 		    "incremental source (%s@%s) does not exist\n"),
1264 		    zhp->zfs_name, sdd->tosnap,
1265 		    zhp->zfs_name, sdd->fromsnap);
1266 		sdd->err = B_TRUE;
1267 	} else if (!sdd->seento) {
1268 		if (sdd->fromsnap) {
1269 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1270 			    "WARNING: could not send %s@%s:\n"
1271 			    "incremental source (%s@%s) "
1272 			    "is not earlier than it\n"),
1273 			    zhp->zfs_name, sdd->tosnap,
1274 			    zhp->zfs_name, sdd->fromsnap);
1275 		} else {
1276 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1277 			    "WARNING: "
1278 			    "could not send %s@%s: does not exist\n"),
1279 			    zhp->zfs_name, sdd->tosnap);
1280 		}
1281 		sdd->err = B_TRUE;
1282 	}
1283 
1284 	return (rv);
1285 }
1286 
1287 /*
1288  * Send all snapshots for all filesystems in sdd.
1289  */
1290 static int
1291 dump_filesystems(zfs_handle_t *rzhp, send_dump_data_t *sdd)
1292 {
1293 	nvpair_t *fspair;
1294 	boolean_t needagain, progress;
1295 
1296 	if (!sdd->replicate)
1297 		return (dump_filesystem(rzhp, sdd));
1298 
1299 	/* Mark the clone origin snapshots. */
1300 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1301 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1302 		nvlist_t *nvfs;
1303 		uint64_t origin_guid = 0;
1304 
1305 		nvfs = fnvpair_value_nvlist(fspair);
1306 		(void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1307 		if (origin_guid != 0) {
1308 			char *snapname;
1309 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1310 			    origin_guid, &snapname);
1311 			if (origin_nv != NULL) {
1312 				nvlist_t *snapprops;
1313 				snapprops = fnvlist_lookup_nvlist(origin_nv,
1314 				    "snapprops");
1315 				snapprops = fnvlist_lookup_nvlist(snapprops,
1316 				    snapname);
1317 				fnvlist_add_boolean(snapprops,
1318 				    "is_clone_origin");
1319 			}
1320 		}
1321 	}
1322 again:
1323 	needagain = progress = B_FALSE;
1324 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1325 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1326 		nvlist_t *fslist, *parent_nv;
1327 		char *fsname;
1328 		zfs_handle_t *zhp;
1329 		int err;
1330 		uint64_t origin_guid = 0;
1331 		uint64_t parent_guid = 0;
1332 
1333 		fslist = fnvpair_value_nvlist(fspair);
1334 		if (nvlist_lookup_boolean(fslist, "sent") == 0)
1335 			continue;
1336 
1337 		fsname = fnvlist_lookup_string(fslist, "name");
1338 		(void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1339 		(void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1340 		    &parent_guid);
1341 
1342 		if (parent_guid != 0) {
1343 			parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1344 			if (!nvlist_exists(parent_nv, "sent")) {
1345 				/* Parent has not been sent; skip this one. */
1346 				needagain = B_TRUE;
1347 				continue;
1348 			}
1349 		}
1350 
1351 		if (origin_guid != 0) {
1352 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1353 			    origin_guid, NULL);
1354 			if (origin_nv != NULL &&
1355 			    !nvlist_exists(origin_nv, "sent")) {
1356 				/*
1357 				 * Origin has not been sent yet;
1358 				 * skip this clone.
1359 				 */
1360 				needagain = B_TRUE;
1361 				continue;
1362 			}
1363 		}
1364 
1365 		zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1366 		if (zhp == NULL)
1367 			return (-1);
1368 		err = dump_filesystem(zhp, sdd);
1369 		fnvlist_add_boolean(fslist, "sent");
1370 		progress = B_TRUE;
1371 		zfs_close(zhp);
1372 		if (err)
1373 			return (err);
1374 	}
1375 	if (needagain) {
1376 		assert(progress);
1377 		goto again;
1378 	}
1379 
1380 	/* Clean out the sent flags in case we reuse this fss. */
1381 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1382 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1383 		nvlist_t *fslist;
1384 
1385 		fslist = fnvpair_value_nvlist(fspair);
1386 		(void) nvlist_remove_all(fslist, "sent");
1387 	}
1388 
1389 	return (0);
1390 }
1391 
1392 nvlist_t *
1393 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1394 {
1395 	unsigned int version;
1396 	int nread, i;
1397 	unsigned long long checksum, packed_len;
1398 
1399 	/*
1400 	 * Decode token header, which is:
1401 	 *   <token version>-<checksum of payload>-<uncompressed payload length>
1402 	 * Note that the only supported token version is 1.
1403 	 */
1404 	nread = sscanf(token, "%u-%llx-%llx-",
1405 	    &version, &checksum, &packed_len);
1406 	if (nread != 3) {
1407 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1408 		    "resume token is corrupt (invalid format)"));
1409 		return (NULL);
1410 	}
1411 
1412 	if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1413 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1414 		    "resume token is corrupt (invalid version %u)"),
1415 		    version);
1416 		return (NULL);
1417 	}
1418 
1419 	/* Convert hexadecimal representation to binary. */
1420 	token = strrchr(token, '-') + 1;
1421 	int len = strlen(token) / 2;
1422 	unsigned char *compressed = zfs_alloc(hdl, len);
1423 	for (i = 0; i < len; i++) {
1424 		nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1425 		if (nread != 1) {
1426 			free(compressed);
1427 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1428 			    "resume token is corrupt "
1429 			    "(payload is not hex-encoded)"));
1430 			return (NULL);
1431 		}
1432 	}
1433 
1434 	/* Verify checksum. */
1435 	zio_cksum_t cksum;
1436 	fletcher_4_native_varsize(compressed, len, &cksum);
1437 	if (cksum.zc_word[0] != checksum) {
1438 		free(compressed);
1439 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1440 		    "resume token is corrupt (incorrect checksum)"));
1441 		return (NULL);
1442 	}
1443 
1444 	/* Uncompress. */
1445 	void *packed = zfs_alloc(hdl, packed_len);
1446 	uLongf packed_len_long = packed_len;
1447 	if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1448 	    packed_len_long != packed_len) {
1449 		free(packed);
1450 		free(compressed);
1451 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1452 		    "resume token is corrupt (decompression failed)"));
1453 		return (NULL);
1454 	}
1455 
1456 	/* Unpack nvlist. */
1457 	nvlist_t *nv;
1458 	int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1459 	free(packed);
1460 	free(compressed);
1461 	if (error != 0) {
1462 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1463 		    "resume token is corrupt (nvlist_unpack failed)"));
1464 		return (NULL);
1465 	}
1466 	return (nv);
1467 }
1468 
1469 static enum lzc_send_flags
1470 lzc_flags_from_sendflags(const sendflags_t *flags)
1471 {
1472 	enum lzc_send_flags lzc_flags = 0;
1473 
1474 	if (flags->largeblock)
1475 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1476 	if (flags->embed_data)
1477 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1478 	if (flags->compress)
1479 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1480 	if (flags->raw)
1481 		lzc_flags |= LZC_SEND_FLAG_RAW;
1482 	if (flags->saved)
1483 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1484 
1485 	return (lzc_flags);
1486 }
1487 
1488 static int
1489 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1490     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1491     const char *redactbook, char *errbuf)
1492 {
1493 	uint64_t size;
1494 	FILE *fout = flags->dryrun ? stdout : stderr;
1495 	progress_arg_t pa = { 0 };
1496 	int err = 0;
1497 	pthread_t ptid;
1498 
1499 	if (flags->progress) {
1500 		pa.pa_zhp = zhp;
1501 		pa.pa_fd = fd;
1502 		pa.pa_parsable = flags->parsable;
1503 		pa.pa_estimate = B_TRUE;
1504 		pa.pa_verbosity = flags->verbosity;
1505 
1506 		err = pthread_create(&ptid, NULL,
1507 		    send_progress_thread, &pa);
1508 		if (err != 0) {
1509 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1510 			return (zfs_error(zhp->zfs_hdl,
1511 			    EZFS_THREADCREATEFAILED, errbuf));
1512 		}
1513 	}
1514 
1515 	err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1516 	    lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1517 	    redactbook, fd, &size);
1518 
1519 	if (flags->progress && send_progress_thread_exit(zhp->zfs_hdl, ptid))
1520 		return (-1);
1521 
1522 	if (err != 0) {
1523 		zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1524 		return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1525 		    errbuf));
1526 	}
1527 	send_print_verbose(fout, zhp->zfs_name, from, size,
1528 	    flags->parsable);
1529 
1530 	if (flags->parsable) {
1531 		(void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1532 	} else {
1533 		char buf[16];
1534 		zfs_nicenum(size, buf, sizeof (buf));
1535 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1536 		    "total estimated size is %s\n"), buf);
1537 	}
1538 	return (0);
1539 }
1540 
1541 static boolean_t
1542 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1543 {
1544 	for (int i = 0; i < num_snaps; i++) {
1545 		if (snaps[i] == guid)
1546 			return (B_TRUE);
1547 	}
1548 	return (B_FALSE);
1549 }
1550 
1551 static boolean_t
1552 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1553     const uint64_t *snaps2, uint64_t num_snaps2)
1554 {
1555 	if (num_snaps1 != num_snaps2)
1556 		return (B_FALSE);
1557 	for (int i = 0; i < num_snaps1; i++) {
1558 		if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1559 			return (B_FALSE);
1560 	}
1561 	return (B_TRUE);
1562 }
1563 
1564 static int
1565 get_bookmarks(const char *path, nvlist_t **bmarksp)
1566 {
1567 	nvlist_t *props = fnvlist_alloc();
1568 	int error;
1569 
1570 	fnvlist_add_boolean(props, "redact_complete");
1571 	fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1572 	error = lzc_get_bookmarks(path, props, bmarksp);
1573 	fnvlist_free(props);
1574 	return (error);
1575 }
1576 
1577 static nvpair_t *
1578 find_redact_pair(nvlist_t *bmarks, const uint64_t *redact_snap_guids,
1579     int num_redact_snaps)
1580 {
1581 	nvpair_t *pair;
1582 
1583 	for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1584 	    pair = nvlist_next_nvpair(bmarks, pair)) {
1585 
1586 		nvlist_t *bmark = fnvpair_value_nvlist(pair);
1587 		nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1588 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1589 		uint_t len = 0;
1590 		uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1591 		    ZPROP_VALUE, &len);
1592 		if (redact_snaps_equal(redact_snap_guids,
1593 		    num_redact_snaps, bmarksnaps, len)) {
1594 			break;
1595 		}
1596 	}
1597 	return (pair);
1598 }
1599 
1600 static boolean_t
1601 get_redact_complete(nvpair_t *pair)
1602 {
1603 	nvlist_t *bmark = fnvpair_value_nvlist(pair);
1604 	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1605 	boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1606 	    ZPROP_VALUE);
1607 
1608 	return (complete);
1609 }
1610 
1611 /*
1612  * Check that the list of redaction snapshots in the bookmark matches the send
1613  * we're resuming, and return whether or not it's complete.
1614  *
1615  * Note that the caller needs to free the contents of *bookname with free() if
1616  * this function returns successfully.
1617  */
1618 static int
1619 find_redact_book(libzfs_handle_t *hdl, const char *path,
1620     const uint64_t *redact_snap_guids, int num_redact_snaps,
1621     char **bookname)
1622 {
1623 	char errbuf[ERRBUFLEN];
1624 	nvlist_t *bmarks;
1625 
1626 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1627 	    "cannot resume send"));
1628 
1629 	int error = get_bookmarks(path, &bmarks);
1630 	if (error != 0) {
1631 		if (error == ESRCH) {
1632 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1633 			    "nonexistent redaction bookmark provided"));
1634 		} else if (error == ENOENT) {
1635 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1636 			    "dataset to be sent no longer exists"));
1637 		} else {
1638 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1639 			    "unknown error: %s"), strerror(error));
1640 		}
1641 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1642 	}
1643 	nvpair_t *pair = find_redact_pair(bmarks, redact_snap_guids,
1644 	    num_redact_snaps);
1645 	if (pair == NULL)  {
1646 		fnvlist_free(bmarks);
1647 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1648 		    "no appropriate redaction bookmark exists"));
1649 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1650 	}
1651 	boolean_t complete = get_redact_complete(pair);
1652 	if (!complete) {
1653 		fnvlist_free(bmarks);
1654 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1655 		    "incomplete redaction bookmark provided"));
1656 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1657 	}
1658 	*bookname = strndup(nvpair_name(pair), ZFS_MAX_DATASET_NAME_LEN);
1659 	ASSERT3P(*bookname, !=, NULL);
1660 	fnvlist_free(bmarks);
1661 	return (0);
1662 }
1663 
1664 static enum lzc_send_flags
1665 lzc_flags_from_resume_nvl(nvlist_t *resume_nvl)
1666 {
1667 	enum lzc_send_flags lzc_flags = 0;
1668 
1669 	if (nvlist_exists(resume_nvl, "largeblockok"))
1670 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1671 	if (nvlist_exists(resume_nvl, "embedok"))
1672 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1673 	if (nvlist_exists(resume_nvl, "compressok"))
1674 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1675 	if (nvlist_exists(resume_nvl, "rawok"))
1676 		lzc_flags |= LZC_SEND_FLAG_RAW;
1677 	if (nvlist_exists(resume_nvl, "savedok"))
1678 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1679 
1680 	return (lzc_flags);
1681 }
1682 
1683 static int
1684 zfs_send_resume_impl_cb_impl(libzfs_handle_t *hdl, sendflags_t *flags,
1685     int outfd, nvlist_t *resume_nvl)
1686 {
1687 	char errbuf[ERRBUFLEN];
1688 	char *toname;
1689 	char *fromname = NULL;
1690 	uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1691 	zfs_handle_t *zhp;
1692 	int error = 0;
1693 	char name[ZFS_MAX_DATASET_NAME_LEN];
1694 	FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1695 	uint64_t *redact_snap_guids = NULL;
1696 	int num_redact_snaps = 0;
1697 	char *redact_book = NULL;
1698 
1699 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1700 	    "cannot resume send"));
1701 
1702 	if (flags->verbosity != 0) {
1703 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1704 		    "resume token contents:\n"));
1705 		nvlist_print(fout, resume_nvl);
1706 	}
1707 
1708 	if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1709 	    nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1710 	    nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1711 	    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1712 	    nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1713 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1714 		    "resume token is corrupt"));
1715 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1716 	}
1717 	fromguid = 0;
1718 	(void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1719 
1720 	if (flags->saved) {
1721 		(void) strcpy(name, toname);
1722 	} else {
1723 		error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1724 		if (error != 0) {
1725 			if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1726 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1727 				    "'%s' is no longer the same snapshot "
1728 				    "used in the initial send"), toname);
1729 			} else {
1730 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1731 				    "'%s' used in the initial send no "
1732 				    "longer exists"), toname);
1733 			}
1734 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1735 		}
1736 	}
1737 
1738 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1739 	if (zhp == NULL) {
1740 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1741 		    "unable to access '%s'"), name);
1742 		return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1743 	}
1744 
1745 	if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1746 	    &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1747 		num_redact_snaps = -1;
1748 	}
1749 
1750 	if (fromguid != 0) {
1751 		if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1752 		    redact_snap_guids, num_redact_snaps, name) != 0) {
1753 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1754 			    "incremental source %#llx no longer exists"),
1755 			    (longlong_t)fromguid);
1756 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1757 		}
1758 		fromname = name;
1759 	}
1760 
1761 	redact_snap_guids = NULL;
1762 
1763 	if (nvlist_lookup_uint64_array(resume_nvl,
1764 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1765 	    (uint_t *)&num_redact_snaps) == 0) {
1766 		char path[ZFS_MAX_DATASET_NAME_LEN];
1767 
1768 		(void) strlcpy(path, toname, sizeof (path));
1769 		char *at = strchr(path, '@');
1770 		ASSERT3P(at, !=, NULL);
1771 
1772 		*at = '\0';
1773 
1774 		if ((error = find_redact_book(hdl, path, redact_snap_guids,
1775 		    num_redact_snaps, &redact_book)) != 0) {
1776 			return (error);
1777 		}
1778 	}
1779 
1780 	enum lzc_send_flags lzc_flags = lzc_flags_from_sendflags(flags) |
1781 	    lzc_flags_from_resume_nvl(resume_nvl);
1782 
1783 	if (flags->verbosity != 0) {
1784 		/*
1785 		 * Some of these may have come from the resume token, set them
1786 		 * here for size estimate purposes.
1787 		 */
1788 		sendflags_t tmpflags = *flags;
1789 		if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1790 			tmpflags.largeblock = B_TRUE;
1791 		if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1792 			tmpflags.compress = B_TRUE;
1793 		if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1794 			tmpflags.embed_data = B_TRUE;
1795 		if (lzc_flags & LZC_SEND_FLAG_RAW)
1796 			tmpflags.raw = B_TRUE;
1797 		if (lzc_flags & LZC_SEND_FLAG_SAVED)
1798 			tmpflags.saved = B_TRUE;
1799 		error = estimate_size(zhp, fromname, outfd, &tmpflags,
1800 		    resumeobj, resumeoff, bytes, redact_book, errbuf);
1801 	}
1802 
1803 	if (!flags->dryrun) {
1804 		progress_arg_t pa = { 0 };
1805 		pthread_t tid;
1806 		/*
1807 		 * If progress reporting is requested, spawn a new thread to
1808 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1809 		 */
1810 		if (flags->progress) {
1811 			pa.pa_zhp = zhp;
1812 			pa.pa_fd = outfd;
1813 			pa.pa_parsable = flags->parsable;
1814 			pa.pa_estimate = B_FALSE;
1815 			pa.pa_verbosity = flags->verbosity;
1816 
1817 			error = pthread_create(&tid, NULL,
1818 			    send_progress_thread, &pa);
1819 			if (error != 0) {
1820 				if (redact_book != NULL)
1821 					free(redact_book);
1822 				zfs_close(zhp);
1823 				return (error);
1824 			}
1825 		}
1826 
1827 		error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1828 		    lzc_flags, resumeobj, resumeoff, redact_book);
1829 		if (redact_book != NULL)
1830 			free(redact_book);
1831 
1832 		if (flags->progress && send_progress_thread_exit(hdl, tid))
1833 			return (-1);
1834 
1835 		char errbuf[ERRBUFLEN];
1836 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1837 		    "warning: cannot send '%s'"), zhp->zfs_name);
1838 
1839 		zfs_close(zhp);
1840 
1841 		switch (error) {
1842 		case 0:
1843 			return (0);
1844 		case EACCES:
1845 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1846 			    "source key must be loaded"));
1847 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1848 		case ESRCH:
1849 			if (lzc_exists(zhp->zfs_name)) {
1850 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1851 				    "incremental source could not be found"));
1852 			}
1853 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
1854 
1855 		case EXDEV:
1856 		case ENOENT:
1857 		case EDQUOT:
1858 		case EFBIG:
1859 		case EIO:
1860 		case ENOLINK:
1861 		case ENOSPC:
1862 		case ENOSTR:
1863 		case ENXIO:
1864 		case EPIPE:
1865 		case ERANGE:
1866 		case EFAULT:
1867 		case EROFS:
1868 			zfs_error_aux(hdl, "%s", strerror(errno));
1869 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1870 
1871 		default:
1872 			return (zfs_standard_error(hdl, errno, errbuf));
1873 		}
1874 	} else {
1875 		if (redact_book != NULL)
1876 			free(redact_book);
1877 	}
1878 
1879 	zfs_close(zhp);
1880 
1881 	return (error);
1882 }
1883 
1884 struct zfs_send_resume_impl {
1885 	libzfs_handle_t *hdl;
1886 	sendflags_t *flags;
1887 	nvlist_t *resume_nvl;
1888 };
1889 
1890 static int
1891 zfs_send_resume_impl_cb(int outfd, void *arg)
1892 {
1893 	struct zfs_send_resume_impl *zsri = arg;
1894 	return (zfs_send_resume_impl_cb_impl(zsri->hdl, zsri->flags, outfd,
1895 	    zsri->resume_nvl));
1896 }
1897 
1898 static int
1899 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1900     nvlist_t *resume_nvl)
1901 {
1902 	struct zfs_send_resume_impl zsri = {
1903 		.hdl = hdl,
1904 		.flags = flags,
1905 		.resume_nvl = resume_nvl,
1906 	};
1907 	return (lzc_send_wrapper(zfs_send_resume_impl_cb, outfd, &zsri));
1908 }
1909 
1910 int
1911 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1912     const char *resume_token)
1913 {
1914 	int ret;
1915 	char errbuf[ERRBUFLEN];
1916 	nvlist_t *resume_nvl;
1917 
1918 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1919 	    "cannot resume send"));
1920 
1921 	resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1922 	if (resume_nvl == NULL) {
1923 		/*
1924 		 * zfs_error_aux has already been set by
1925 		 * zfs_send_resume_token_to_nvlist()
1926 		 */
1927 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1928 	}
1929 
1930 	ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1931 	fnvlist_free(resume_nvl);
1932 
1933 	return (ret);
1934 }
1935 
1936 int
1937 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1938     const char *resume_token)
1939 {
1940 	int ret;
1941 	libzfs_handle_t *hdl = zhp->zfs_hdl;
1942 	nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1943 	uint64_t saved_guid = 0, resume_guid = 0;
1944 	uint64_t obj = 0, off = 0, bytes = 0;
1945 	char token_buf[ZFS_MAXPROPLEN];
1946 	char errbuf[ERRBUFLEN];
1947 
1948 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1949 	    "saved send failed"));
1950 
1951 	ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1952 	    token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1953 	if (ret != 0)
1954 		goto out;
1955 
1956 	saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1957 	if (saved_nvl == NULL) {
1958 		/*
1959 		 * zfs_error_aux has already been set by
1960 		 * zfs_send_resume_token_to_nvlist()
1961 		 */
1962 		ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1963 		goto out;
1964 	}
1965 
1966 	/*
1967 	 * If a resume token is provided we use the object and offset
1968 	 * from that instead of the default, which starts from the
1969 	 * beginning.
1970 	 */
1971 	if (resume_token != NULL) {
1972 		resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1973 		    resume_token);
1974 		if (resume_nvl == NULL) {
1975 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1976 			goto out;
1977 		}
1978 
1979 		if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1980 		    nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1981 		    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1982 		    nvlist_lookup_uint64(resume_nvl, "toguid",
1983 		    &resume_guid) != 0) {
1984 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1985 			    "provided resume token is corrupt"));
1986 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1987 			goto out;
1988 		}
1989 
1990 		if (nvlist_lookup_uint64(saved_nvl, "toguid",
1991 		    &saved_guid)) {
1992 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1993 			    "dataset's resume token is corrupt"));
1994 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1995 			goto out;
1996 		}
1997 
1998 		if (resume_guid != saved_guid) {
1999 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2000 			    "provided resume token does not match dataset"));
2001 			ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
2002 			goto out;
2003 		}
2004 	}
2005 
2006 	(void) nvlist_remove_all(saved_nvl, "object");
2007 	fnvlist_add_uint64(saved_nvl, "object", obj);
2008 
2009 	(void) nvlist_remove_all(saved_nvl, "offset");
2010 	fnvlist_add_uint64(saved_nvl, "offset", off);
2011 
2012 	(void) nvlist_remove_all(saved_nvl, "bytes");
2013 	fnvlist_add_uint64(saved_nvl, "bytes", bytes);
2014 
2015 	(void) nvlist_remove_all(saved_nvl, "toname");
2016 	fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
2017 
2018 	ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
2019 
2020 out:
2021 	fnvlist_free(saved_nvl);
2022 	fnvlist_free(resume_nvl);
2023 	return (ret);
2024 }
2025 
2026 /*
2027  * This function informs the target system that the recursive send is complete.
2028  * The record is also expected in the case of a send -p.
2029  */
2030 static int
2031 send_conclusion_record(int fd, zio_cksum_t *zc)
2032 {
2033 	dmu_replay_record_t drr = { 0 };
2034 	drr.drr_type = DRR_END;
2035 	if (zc != NULL)
2036 		drr.drr_u.drr_end.drr_checksum = *zc;
2037 	if (write(fd, &drr, sizeof (drr)) == -1) {
2038 		return (errno);
2039 	}
2040 	return (0);
2041 }
2042 
2043 /*
2044  * This function is responsible for sending the records that contain the
2045  * necessary information for the target system's libzfs to be able to set the
2046  * properties of the filesystem being received, or to be able to prepare for
2047  * a recursive receive.
2048  *
2049  * The "zhp" argument is the handle of the snapshot we are sending
2050  * (the "tosnap").  The "from" argument is the short snapshot name (the part
2051  * after the @) of the incremental source.
2052  */
2053 static int
2054 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
2055     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
2056     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
2057     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
2058     nvlist_t **fssp, avl_tree_t **fsavlp)
2059 {
2060 	int err = 0;
2061 	char *packbuf = NULL;
2062 	size_t buflen = 0;
2063 	zio_cksum_t zc = { {0} };
2064 	int featureflags = 0;
2065 	/* name of filesystem/volume that contains snapshot we are sending */
2066 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
2067 	/* short name of snap we are sending */
2068 	const char *tosnap = "";
2069 
2070 	char errbuf[ERRBUFLEN];
2071 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2072 	    "warning: cannot send '%s'"), zhp->zfs_name);
2073 	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2074 	    ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2075 		featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2076 	}
2077 
2078 	if (holds)
2079 		featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2080 
2081 	(void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2082 	char *at = strchr(tofs, '@');
2083 	if (at != NULL) {
2084 		*at = '\0';
2085 		tosnap = at + 1;
2086 	}
2087 
2088 	if (gather_props) {
2089 		nvlist_t *hdrnv = fnvlist_alloc();
2090 		nvlist_t *fss = NULL;
2091 
2092 		if (from != NULL)
2093 			fnvlist_add_string(hdrnv, "fromsnap", from);
2094 		fnvlist_add_string(hdrnv, "tosnap", tosnap);
2095 		if (!recursive)
2096 			fnvlist_add_boolean(hdrnv, "not_recursive");
2097 
2098 		if (raw) {
2099 			fnvlist_add_boolean(hdrnv, "raw");
2100 		}
2101 
2102 		if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2103 		    from, tosnap, recursive, raw, doall, replicate, skipmissing,
2104 		    verbose, backup, holds, props, &fss, fsavlp)) != 0) {
2105 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2106 			    errbuf));
2107 		}
2108 		/*
2109 		 * Do not allow the size of the properties list to exceed
2110 		 * the limit
2111 		 */
2112 		if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2113 		    zhp->zfs_hdl->libzfs_max_nvlist) {
2114 			(void) snprintf(errbuf, sizeof (errbuf),
2115 			    dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2116 			    "the size of the list of snapshots and properties "
2117 			    "is too large to be received successfully.\n"
2118 			    "Select a smaller number of snapshots to send.\n"),
2119 			    zhp->zfs_name);
2120 			return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2121 			    errbuf));
2122 		}
2123 		fnvlist_add_nvlist(hdrnv, "fss", fss);
2124 		VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2125 		    0));
2126 		if (fssp != NULL) {
2127 			*fssp = fss;
2128 		} else {
2129 			fnvlist_free(fss);
2130 		}
2131 		fnvlist_free(hdrnv);
2132 	}
2133 
2134 	if (!dryrun) {
2135 		dmu_replay_record_t drr = { 0 };
2136 		/* write first begin record */
2137 		drr.drr_type = DRR_BEGIN;
2138 		drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2139 		DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2140 		    drr_versioninfo, DMU_COMPOUNDSTREAM);
2141 		DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2142 		    drr_versioninfo, featureflags);
2143 		if (snprintf(drr.drr_u.drr_begin.drr_toname,
2144 		    sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2145 		    tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2146 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2147 			    errbuf));
2148 		}
2149 		drr.drr_payloadlen = buflen;
2150 
2151 		err = dump_record(&drr, packbuf, buflen, &zc, fd);
2152 		free(packbuf);
2153 		if (err != 0) {
2154 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2155 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2156 			    errbuf));
2157 		}
2158 		err = send_conclusion_record(fd, &zc);
2159 		if (err != 0) {
2160 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2161 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2162 			    errbuf));
2163 		}
2164 	}
2165 	return (0);
2166 }
2167 
2168 /*
2169  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2170  * that contains the snapshot to send.  The "fromsnap" argument is the
2171  * short name (the part after the '@') of the snapshot that is the
2172  * incremental source to send from (if non-NULL).  The "tosnap" argument
2173  * is the short name of the snapshot to send.
2174  *
2175  * The content of the send stream is the snapshot identified by
2176  * 'tosnap'.  Incremental streams are requested in two ways:
2177  *     - from the snapshot identified by "fromsnap" (if non-null) or
2178  *     - from the origin of the dataset identified by zhp, which must
2179  *	 be a clone.  In this case, "fromsnap" is null and "fromorigin"
2180  *	 is TRUE.
2181  *
2182  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2183  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2184  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2185  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2186  * case too. If "props" is set, send properties.
2187  *
2188  * Pre-wrapped (cf. lzc_send_wrapper()).
2189  */
2190 static int
2191 zfs_send_cb_impl(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2192     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2193     void *cb_arg, nvlist_t **debugnvp)
2194 {
2195 	char errbuf[ERRBUFLEN];
2196 	send_dump_data_t sdd = { 0 };
2197 	int err = 0;
2198 	nvlist_t *fss = NULL;
2199 	avl_tree_t *fsavl = NULL;
2200 	static uint64_t holdseq;
2201 	int spa_version;
2202 	FILE *fout;
2203 
2204 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2205 	    "cannot send '%s'"), zhp->zfs_name);
2206 
2207 	if (fromsnap && fromsnap[0] == '\0') {
2208 		zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2209 		    "zero-length incremental source"));
2210 		return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2211 	}
2212 
2213 	if (fromsnap) {
2214 		char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2215 		if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2216 		    "%s@%s", zhp->zfs_name, fromsnap) >=
2217 		    sizeof (full_fromsnap_name)) {
2218 			err = EINVAL;
2219 			goto stderr_out;
2220 		}
2221 		zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2222 		    full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2223 		if (fromsnapn == NULL) {
2224 			err = -1;
2225 			goto err_out;
2226 		}
2227 		zfs_close(fromsnapn);
2228 	}
2229 
2230 	if (flags->replicate || flags->doall || flags->props ||
2231 	    flags->holds || flags->backup) {
2232 		char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2233 		if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2234 		    "%s@%s", zhp->zfs_name, tosnap) >=
2235 		    sizeof (full_tosnap_name)) {
2236 			err = EINVAL;
2237 			goto stderr_out;
2238 		}
2239 		zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2240 		    full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2241 		if (tosnap == NULL) {
2242 			err = -1;
2243 			goto err_out;
2244 		}
2245 		err = send_prelim_records(tosnap, fromsnap, outfd,
2246 		    flags->replicate || flags->props || flags->holds,
2247 		    flags->replicate, flags->verbosity > 0, flags->dryrun,
2248 		    flags->raw, flags->replicate, flags->skipmissing,
2249 		    flags->backup, flags->holds, flags->props, flags->doall,
2250 		    &fss, &fsavl);
2251 		zfs_close(tosnap);
2252 		if (err != 0)
2253 			goto err_out;
2254 	}
2255 
2256 	/* dump each stream */
2257 	sdd.fromsnap = fromsnap;
2258 	sdd.tosnap = tosnap;
2259 	sdd.outfd = outfd;
2260 	sdd.replicate = flags->replicate;
2261 	sdd.doall = flags->doall;
2262 	sdd.fromorigin = flags->fromorigin;
2263 	sdd.fss = fss;
2264 	sdd.fsavl = fsavl;
2265 	sdd.verbosity = flags->verbosity;
2266 	sdd.parsable = flags->parsable;
2267 	sdd.progress = flags->progress;
2268 	sdd.dryrun = flags->dryrun;
2269 	sdd.large_block = flags->largeblock;
2270 	sdd.embed_data = flags->embed_data;
2271 	sdd.compress = flags->compress;
2272 	sdd.raw = flags->raw;
2273 	sdd.holds = flags->holds;
2274 	sdd.filter_cb = filter_func;
2275 	sdd.filter_cb_arg = cb_arg;
2276 	if (debugnvp)
2277 		sdd.debugnv = *debugnvp;
2278 	if (sdd.verbosity != 0 && sdd.dryrun)
2279 		sdd.std_out = B_TRUE;
2280 	fout = sdd.std_out ? stdout : stderr;
2281 
2282 	/*
2283 	 * Some flags require that we place user holds on the datasets that are
2284 	 * being sent so they don't get destroyed during the send. We can skip
2285 	 * this step if the pool is imported read-only since the datasets cannot
2286 	 * be destroyed.
2287 	 */
2288 	if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2289 	    ZPOOL_PROP_READONLY, NULL) &&
2290 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2291 	    spa_version >= SPA_VERSION_USERREFS &&
2292 	    (flags->doall || flags->replicate)) {
2293 		++holdseq;
2294 		(void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2295 		    ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2296 		sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2297 		if (sdd.cleanup_fd < 0) {
2298 			err = errno;
2299 			goto stderr_out;
2300 		}
2301 		sdd.snapholds = fnvlist_alloc();
2302 	} else {
2303 		sdd.cleanup_fd = -1;
2304 		sdd.snapholds = NULL;
2305 	}
2306 
2307 	if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2308 		/*
2309 		 * Do a verbose no-op dry run to get all the verbose output
2310 		 * or to gather snapshot hold's before generating any data,
2311 		 * then do a non-verbose real run to generate the streams.
2312 		 */
2313 		sdd.dryrun = B_TRUE;
2314 		err = dump_filesystems(zhp, &sdd);
2315 
2316 		if (err != 0)
2317 			goto stderr_out;
2318 
2319 		if (flags->verbosity != 0) {
2320 			if (flags->parsable) {
2321 				(void) fprintf(fout, "size\t%llu\n",
2322 				    (longlong_t)sdd.size);
2323 			} else {
2324 				char buf[16];
2325 				zfs_nicebytes(sdd.size, buf, sizeof (buf));
2326 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
2327 				    "total estimated size is %s\n"), buf);
2328 			}
2329 		}
2330 
2331 		/* Ensure no snaps found is treated as an error. */
2332 		if (!sdd.seento) {
2333 			err = ENOENT;
2334 			goto err_out;
2335 		}
2336 
2337 		/* Skip the second run if dryrun was requested. */
2338 		if (flags->dryrun)
2339 			goto err_out;
2340 
2341 		if (sdd.snapholds != NULL) {
2342 			err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2343 			if (err != 0)
2344 				goto stderr_out;
2345 
2346 			fnvlist_free(sdd.snapholds);
2347 			sdd.snapholds = NULL;
2348 		}
2349 
2350 		sdd.dryrun = B_FALSE;
2351 		sdd.verbosity = 0;
2352 	}
2353 
2354 	err = dump_filesystems(zhp, &sdd);
2355 	fsavl_destroy(fsavl);
2356 	fnvlist_free(fss);
2357 
2358 	/* Ensure no snaps found is treated as an error. */
2359 	if (err == 0 && !sdd.seento)
2360 		err = ENOENT;
2361 
2362 	if (sdd.cleanup_fd != -1) {
2363 		VERIFY(0 == close(sdd.cleanup_fd));
2364 		sdd.cleanup_fd = -1;
2365 	}
2366 
2367 	if (!flags->dryrun && (flags->replicate || flags->doall ||
2368 	    flags->props || flags->backup || flags->holds)) {
2369 		/*
2370 		 * write final end record.  NB: want to do this even if
2371 		 * there was some error, because it might not be totally
2372 		 * failed.
2373 		 */
2374 		int err2 = send_conclusion_record(outfd, NULL);
2375 		if (err2 != 0)
2376 			return (zfs_standard_error(zhp->zfs_hdl, err2, errbuf));
2377 	}
2378 
2379 	return (err || sdd.err);
2380 
2381 stderr_out:
2382 	err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2383 err_out:
2384 	fsavl_destroy(fsavl);
2385 	fnvlist_free(fss);
2386 	fnvlist_free(sdd.snapholds);
2387 
2388 	if (sdd.cleanup_fd != -1)
2389 		VERIFY(0 == close(sdd.cleanup_fd));
2390 	return (err);
2391 }
2392 
2393 struct zfs_send {
2394 	zfs_handle_t *zhp;
2395 	const char *fromsnap;
2396 	const char *tosnap;
2397 	sendflags_t *flags;
2398 	snapfilter_cb_t *filter_func;
2399 	void *cb_arg;
2400 	nvlist_t **debugnvp;
2401 };
2402 
2403 static int
2404 zfs_send_cb(int outfd, void *arg)
2405 {
2406 	struct zfs_send *zs = arg;
2407 	return (zfs_send_cb_impl(zs->zhp, zs->fromsnap, zs->tosnap, zs->flags,
2408 	    outfd, zs->filter_func, zs->cb_arg, zs->debugnvp));
2409 }
2410 
2411 int
2412 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2413     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2414     void *cb_arg, nvlist_t **debugnvp)
2415 {
2416 	struct zfs_send arg = {
2417 		.zhp = zhp,
2418 		.fromsnap = fromsnap,
2419 		.tosnap = tosnap,
2420 		.flags = flags,
2421 		.filter_func = filter_func,
2422 		.cb_arg = cb_arg,
2423 		.debugnvp = debugnvp,
2424 	};
2425 	return (lzc_send_wrapper(zfs_send_cb, outfd, &arg));
2426 }
2427 
2428 
2429 static zfs_handle_t *
2430 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2431 {
2432 	char dirname[ZFS_MAX_DATASET_NAME_LEN];
2433 	(void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2434 	char *c = strchr(dirname, '@');
2435 	if (c != NULL)
2436 		*c = '\0';
2437 	return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2438 }
2439 
2440 /*
2441  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2442  * an earlier snapshot in the same filesystem, or a snapshot before later's
2443  * origin, or it's origin's origin, etc.
2444  */
2445 static boolean_t
2446 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2447 {
2448 	boolean_t ret;
2449 	uint64_t later_txg =
2450 	    (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2451 	    later->zfs_type == ZFS_TYPE_VOLUME ?
2452 	    UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2453 	uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2454 
2455 	if (earlier_txg >= later_txg)
2456 		return (B_FALSE);
2457 
2458 	zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2459 	    earlier->zfs_name);
2460 	zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2461 	    later->zfs_name);
2462 
2463 	if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2464 		zfs_close(earlier_dir);
2465 		zfs_close(later_dir);
2466 		return (B_TRUE);
2467 	}
2468 
2469 	char clonename[ZFS_MAX_DATASET_NAME_LEN];
2470 	if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2471 	    ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2472 		zfs_close(earlier_dir);
2473 		zfs_close(later_dir);
2474 		return (B_FALSE);
2475 	}
2476 
2477 	zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2478 	    ZFS_TYPE_DATASET);
2479 	uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2480 
2481 	/*
2482 	 * If "earlier" is exactly the origin, then
2483 	 * snapshot_is_before(earlier, origin) will return false (because
2484 	 * they're the same).
2485 	 */
2486 	if (origin_txg == earlier_txg &&
2487 	    strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2488 		zfs_close(earlier_dir);
2489 		zfs_close(later_dir);
2490 		zfs_close(origin);
2491 		return (B_TRUE);
2492 	}
2493 	zfs_close(earlier_dir);
2494 	zfs_close(later_dir);
2495 
2496 	ret = snapshot_is_before(earlier, origin);
2497 	zfs_close(origin);
2498 	return (ret);
2499 }
2500 
2501 /*
2502  * The "zhp" argument is the handle of the dataset to send (typically a
2503  * snapshot).  The "from" argument is the full name of the snapshot or
2504  * bookmark that is the incremental source.
2505  *
2506  * Pre-wrapped (cf. lzc_send_wrapper()).
2507  */
2508 static int
2509 zfs_send_one_cb_impl(zfs_handle_t *zhp, const char *from, int fd,
2510     sendflags_t *flags, const char *redactbook)
2511 {
2512 	int err;
2513 	libzfs_handle_t *hdl = zhp->zfs_hdl;
2514 	char *name = zhp->zfs_name;
2515 	pthread_t ptid;
2516 	progress_arg_t pa = { 0 };
2517 
2518 	char errbuf[ERRBUFLEN];
2519 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2520 	    "warning: cannot send '%s'"), name);
2521 
2522 	if (from != NULL && strchr(from, '@')) {
2523 		zfs_handle_t *from_zhp = zfs_open(hdl, from,
2524 		    ZFS_TYPE_DATASET);
2525 		if (from_zhp == NULL)
2526 			return (-1);
2527 		if (!snapshot_is_before(from_zhp, zhp)) {
2528 			zfs_close(from_zhp);
2529 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2530 			    "not an earlier snapshot from the same fs"));
2531 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2532 		}
2533 		zfs_close(from_zhp);
2534 	}
2535 
2536 	if (redactbook != NULL) {
2537 		char bookname[ZFS_MAX_DATASET_NAME_LEN];
2538 		nvlist_t *redact_snaps;
2539 		zfs_handle_t *book_zhp;
2540 		char *at, *pound;
2541 		int dsnamelen;
2542 
2543 		pound = strchr(redactbook, '#');
2544 		if (pound != NULL)
2545 			redactbook = pound + 1;
2546 		at = strchr(name, '@');
2547 		if (at == NULL) {
2548 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2549 			    "cannot do a redacted send to a filesystem"));
2550 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2551 		}
2552 		dsnamelen = at - name;
2553 		if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2554 		    dsnamelen, name, redactbook)
2555 		    >= sizeof (bookname)) {
2556 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2557 			    "invalid bookmark name"));
2558 			return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2559 		}
2560 		book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2561 		if (book_zhp == NULL)
2562 			return (-1);
2563 		if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2564 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2565 		    &redact_snaps) != 0 || redact_snaps == NULL) {
2566 			zfs_close(book_zhp);
2567 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2568 			    "not a redaction bookmark"));
2569 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2570 		}
2571 		zfs_close(book_zhp);
2572 	}
2573 
2574 	/*
2575 	 * Send fs properties
2576 	 */
2577 	if (flags->props || flags->holds || flags->backup) {
2578 		/*
2579 		 * Note: the header generated by send_prelim_records()
2580 		 * assumes that the incremental source is in the same
2581 		 * filesystem/volume as the target (which is a requirement
2582 		 * when doing "zfs send -R").  But that isn't always the
2583 		 * case here (e.g. send from snap in origin, or send from
2584 		 * bookmark).  We pass from=NULL, which will omit this
2585 		 * information from the prelim records; it isn't used
2586 		 * when receiving this type of stream.
2587 		 */
2588 		err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2589 		    flags->verbosity > 0, flags->dryrun, flags->raw,
2590 		    flags->replicate, B_FALSE, flags->backup, flags->holds,
2591 		    flags->props, flags->doall, NULL, NULL);
2592 		if (err != 0)
2593 			return (err);
2594 	}
2595 
2596 	/*
2597 	 * Perform size estimate if verbose was specified.
2598 	 */
2599 	if (flags->verbosity != 0) {
2600 		err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2601 		    errbuf);
2602 		if (err != 0)
2603 			return (err);
2604 	}
2605 
2606 	if (flags->dryrun)
2607 		return (0);
2608 
2609 	/*
2610 	 * If progress reporting is requested, spawn a new thread to poll
2611 	 * ZFS_IOC_SEND_PROGRESS at a regular interval.
2612 	 */
2613 	if (flags->progress) {
2614 		pa.pa_zhp = zhp;
2615 		pa.pa_fd = fd;
2616 		pa.pa_parsable = flags->parsable;
2617 		pa.pa_estimate = B_FALSE;
2618 		pa.pa_verbosity = flags->verbosity;
2619 
2620 		err = pthread_create(&ptid, NULL,
2621 		    send_progress_thread, &pa);
2622 		if (err != 0) {
2623 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2624 			return (zfs_error(zhp->zfs_hdl,
2625 			    EZFS_THREADCREATEFAILED, errbuf));
2626 		}
2627 	}
2628 
2629 	err = lzc_send_redacted(name, from, fd,
2630 	    lzc_flags_from_sendflags(flags), redactbook);
2631 
2632 	if (flags->progress && send_progress_thread_exit(hdl, ptid))
2633 			return (-1);
2634 
2635 	if (err == 0 && (flags->props || flags->holds || flags->backup)) {
2636 		/* Write the final end record. */
2637 		err = send_conclusion_record(fd, NULL);
2638 		if (err != 0)
2639 			return (zfs_standard_error(hdl, err, errbuf));
2640 	}
2641 	if (err != 0) {
2642 		switch (errno) {
2643 		case EXDEV:
2644 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2645 			    "not an earlier snapshot from the same fs"));
2646 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2647 
2648 		case ENOENT:
2649 		case ESRCH:
2650 			if (lzc_exists(name)) {
2651 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2652 				    "incremental source (%s) does not exist"),
2653 				    from);
2654 			}
2655 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
2656 
2657 		case EACCES:
2658 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2659 			    "dataset key must be loaded"));
2660 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2661 
2662 		case EBUSY:
2663 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2664 			    "target is busy; if a filesystem, "
2665 			    "it must not be mounted"));
2666 			return (zfs_error(hdl, EZFS_BUSY, errbuf));
2667 
2668 		case EDQUOT:
2669 		case EFAULT:
2670 		case EFBIG:
2671 		case EINVAL:
2672 		case EIO:
2673 		case ENOLINK:
2674 		case ENOSPC:
2675 		case ENOSTR:
2676 		case ENXIO:
2677 		case EPIPE:
2678 		case ERANGE:
2679 		case EROFS:
2680 			zfs_error_aux(hdl, "%s", strerror(errno));
2681 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2682 		case ENOTSUP:
2683 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2684 			    "large blocks detected but large_blocks feature "
2685 			    "is inactive; raw send unsupported"));
2686 			return (zfs_error(hdl, EZFS_NOTSUP, errbuf));
2687 
2688 		default:
2689 			return (zfs_standard_error(hdl, errno, errbuf));
2690 		}
2691 	}
2692 	return (err != 0);
2693 }
2694 
2695 struct zfs_send_one {
2696 	zfs_handle_t *zhp;
2697 	const char *from;
2698 	sendflags_t *flags;
2699 	const char *redactbook;
2700 };
2701 
2702 static int
2703 zfs_send_one_cb(int fd, void *arg)
2704 {
2705 	struct zfs_send_one *zso = arg;
2706 	return (zfs_send_one_cb_impl(zso->zhp, zso->from, fd, zso->flags,
2707 	    zso->redactbook));
2708 }
2709 
2710 int
2711 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2712     const char *redactbook)
2713 {
2714 	struct zfs_send_one zso = {
2715 		.zhp = zhp,
2716 		.from = from,
2717 		.flags = flags,
2718 		.redactbook = redactbook,
2719 	};
2720 	return (lzc_send_wrapper(zfs_send_one_cb, fd, &zso));
2721 }
2722 
2723 /*
2724  * Routines specific to "zfs recv"
2725  */
2726 
2727 static int
2728 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2729     boolean_t byteswap, zio_cksum_t *zc)
2730 {
2731 	char *cp = buf;
2732 	int rv;
2733 	int len = ilen;
2734 
2735 	do {
2736 		rv = read(fd, cp, len);
2737 		cp += rv;
2738 		len -= rv;
2739 	} while (rv > 0);
2740 
2741 	if (rv < 0 || len != 0) {
2742 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2743 		    "failed to read from stream"));
2744 		return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2745 		    "cannot receive")));
2746 	}
2747 
2748 	if (zc) {
2749 		if (byteswap)
2750 			fletcher_4_incremental_byteswap(buf, ilen, zc);
2751 		else
2752 			fletcher_4_incremental_native(buf, ilen, zc);
2753 	}
2754 	return (0);
2755 }
2756 
2757 static int
2758 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2759     boolean_t byteswap, zio_cksum_t *zc)
2760 {
2761 	char *buf;
2762 	int err;
2763 
2764 	buf = zfs_alloc(hdl, len);
2765 
2766 	if (len > hdl->libzfs_max_nvlist) {
2767 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2768 		free(buf);
2769 		return (ENOMEM);
2770 	}
2771 
2772 	err = recv_read(hdl, fd, buf, len, byteswap, zc);
2773 	if (err != 0) {
2774 		free(buf);
2775 		return (err);
2776 	}
2777 
2778 	err = nvlist_unpack(buf, len, nvp, 0);
2779 	free(buf);
2780 	if (err != 0) {
2781 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2782 		    "stream (malformed nvlist)"));
2783 		return (EINVAL);
2784 	}
2785 	return (0);
2786 }
2787 
2788 /*
2789  * Returns the grand origin (origin of origin of origin...) of a given handle.
2790  * If this dataset is not a clone, it simply returns a copy of the original
2791  * handle.
2792  */
2793 static zfs_handle_t *
2794 recv_open_grand_origin(zfs_handle_t *zhp)
2795 {
2796 	char origin[ZFS_MAX_DATASET_NAME_LEN];
2797 	zprop_source_t src;
2798 	zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2799 
2800 	while (ozhp != NULL) {
2801 		if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2802 		    sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2803 			break;
2804 
2805 		(void) zfs_close(ozhp);
2806 		ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2807 	}
2808 
2809 	return (ozhp);
2810 }
2811 
2812 static int
2813 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2814 {
2815 	int err;
2816 	zfs_handle_t *ozhp = NULL;
2817 
2818 	/*
2819 	 * Attempt to rename the dataset. If it fails with EACCES we have
2820 	 * attempted to rename the dataset outside of its encryption root.
2821 	 * Force the dataset to become an encryption root and try again.
2822 	 */
2823 	err = lzc_rename(name, newname);
2824 	if (err == EACCES) {
2825 		ozhp = recv_open_grand_origin(zhp);
2826 		if (ozhp == NULL) {
2827 			err = ENOENT;
2828 			goto out;
2829 		}
2830 
2831 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2832 		    NULL, NULL, 0);
2833 		if (err != 0)
2834 			goto out;
2835 
2836 		err = lzc_rename(name, newname);
2837 	}
2838 
2839 out:
2840 	if (ozhp != NULL)
2841 		zfs_close(ozhp);
2842 	return (err);
2843 }
2844 
2845 static int
2846 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2847     int baselen, char *newname, recvflags_t *flags)
2848 {
2849 	static int seq;
2850 	int err;
2851 	prop_changelist_t *clp = NULL;
2852 	zfs_handle_t *zhp = NULL;
2853 
2854 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2855 	if (zhp == NULL) {
2856 		err = -1;
2857 		goto out;
2858 	}
2859 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2860 	    flags->force ? MS_FORCE : 0);
2861 	if (clp == NULL) {
2862 		err = -1;
2863 		goto out;
2864 	}
2865 	err = changelist_prefix(clp);
2866 	if (err)
2867 		goto out;
2868 
2869 	if (tryname) {
2870 		(void) strcpy(newname, tryname);
2871 		if (flags->verbose) {
2872 			(void) printf("attempting rename %s to %s\n",
2873 			    name, newname);
2874 		}
2875 		err = recv_rename_impl(zhp, name, newname);
2876 		if (err == 0)
2877 			changelist_rename(clp, name, tryname);
2878 	} else {
2879 		err = ENOENT;
2880 	}
2881 
2882 	if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2883 		seq++;
2884 
2885 		(void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2886 		    "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2887 
2888 		if (flags->verbose) {
2889 			(void) printf("failed - trying rename %s to %s\n",
2890 			    name, newname);
2891 		}
2892 		err = recv_rename_impl(zhp, name, newname);
2893 		if (err == 0)
2894 			changelist_rename(clp, name, newname);
2895 		if (err && flags->verbose) {
2896 			(void) printf("failed (%u) - "
2897 			    "will try again on next pass\n", errno);
2898 		}
2899 		err = EAGAIN;
2900 	} else if (flags->verbose) {
2901 		if (err == 0)
2902 			(void) printf("success\n");
2903 		else
2904 			(void) printf("failed (%u)\n", errno);
2905 	}
2906 
2907 	(void) changelist_postfix(clp);
2908 
2909 out:
2910 	if (clp != NULL)
2911 		changelist_free(clp);
2912 	if (zhp != NULL)
2913 		zfs_close(zhp);
2914 
2915 	return (err);
2916 }
2917 
2918 static int
2919 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2920     const char *origin_fsname, recvflags_t *flags)
2921 {
2922 	int err;
2923 	zfs_cmd_t zc = {"\0"};
2924 	zfs_handle_t *zhp = NULL, *ozhp = NULL;
2925 
2926 	if (flags->verbose)
2927 		(void) printf("promoting %s\n", fsname);
2928 
2929 	(void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2930 	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2931 
2932 	/*
2933 	 * Attempt to promote the dataset. If it fails with EACCES the
2934 	 * promotion would cause this dataset to leave its encryption root.
2935 	 * Force the origin to become an encryption root and try again.
2936 	 */
2937 	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2938 	if (err == EACCES) {
2939 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2940 		if (zhp == NULL) {
2941 			err = -1;
2942 			goto out;
2943 		}
2944 
2945 		ozhp = recv_open_grand_origin(zhp);
2946 		if (ozhp == NULL) {
2947 			err = -1;
2948 			goto out;
2949 		}
2950 
2951 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2952 		    NULL, NULL, 0);
2953 		if (err != 0)
2954 			goto out;
2955 
2956 		err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2957 	}
2958 
2959 out:
2960 	if (zhp != NULL)
2961 		zfs_close(zhp);
2962 	if (ozhp != NULL)
2963 		zfs_close(ozhp);
2964 
2965 	return (err);
2966 }
2967 
2968 static int
2969 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2970     char *newname, recvflags_t *flags)
2971 {
2972 	int err = 0;
2973 	prop_changelist_t *clp;
2974 	zfs_handle_t *zhp;
2975 	boolean_t defer = B_FALSE;
2976 	int spa_version;
2977 
2978 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2979 	if (zhp == NULL)
2980 		return (-1);
2981 	zfs_type_t type = zfs_get_type(zhp);
2982 	if (type == ZFS_TYPE_SNAPSHOT &&
2983 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2984 	    spa_version >= SPA_VERSION_USERREFS)
2985 		defer = B_TRUE;
2986 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2987 	    flags->force ? MS_FORCE : 0);
2988 	zfs_close(zhp);
2989 	if (clp == NULL)
2990 		return (-1);
2991 
2992 	err = changelist_prefix(clp);
2993 	if (err)
2994 		return (err);
2995 
2996 	if (flags->verbose)
2997 		(void) printf("attempting destroy %s\n", name);
2998 	if (type == ZFS_TYPE_SNAPSHOT) {
2999 		nvlist_t *nv = fnvlist_alloc();
3000 		fnvlist_add_boolean(nv, name);
3001 		err = lzc_destroy_snaps(nv, defer, NULL);
3002 		fnvlist_free(nv);
3003 	} else {
3004 		err = lzc_destroy(name);
3005 	}
3006 	if (err == 0) {
3007 		if (flags->verbose)
3008 			(void) printf("success\n");
3009 		changelist_remove(clp, name);
3010 	}
3011 
3012 	(void) changelist_postfix(clp);
3013 	changelist_free(clp);
3014 
3015 	/*
3016 	 * Deferred destroy might destroy the snapshot or only mark it to be
3017 	 * destroyed later, and it returns success in either case.
3018 	 */
3019 	if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
3020 	    ZFS_TYPE_SNAPSHOT))) {
3021 		err = recv_rename(hdl, name, NULL, baselen, newname, flags);
3022 	}
3023 
3024 	return (err);
3025 }
3026 
3027 typedef struct guid_to_name_data {
3028 	uint64_t guid;
3029 	boolean_t bookmark_ok;
3030 	char *name;
3031 	char *skip;
3032 	uint64_t *redact_snap_guids;
3033 	uint64_t num_redact_snaps;
3034 } guid_to_name_data_t;
3035 
3036 static boolean_t
3037 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
3038 {
3039 	uint64_t *bmark_snaps;
3040 	uint_t bmark_num_snaps;
3041 	nvlist_t *nvl;
3042 	if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
3043 		return (B_FALSE);
3044 
3045 	nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
3046 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
3047 	bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
3048 	    &bmark_num_snaps);
3049 	if (bmark_num_snaps != gtnd->num_redact_snaps)
3050 		return (B_FALSE);
3051 	int i = 0;
3052 	for (; i < bmark_num_snaps; i++) {
3053 		int j = 0;
3054 		for (; j < bmark_num_snaps; j++) {
3055 			if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
3056 				break;
3057 		}
3058 		if (j == bmark_num_snaps)
3059 			break;
3060 	}
3061 	return (i == bmark_num_snaps);
3062 }
3063 
3064 static int
3065 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
3066 {
3067 	guid_to_name_data_t *gtnd = arg;
3068 	const char *slash;
3069 	int err;
3070 
3071 	if (gtnd->skip != NULL &&
3072 	    (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
3073 	    strcmp(slash + 1, gtnd->skip) == 0) {
3074 		zfs_close(zhp);
3075 		return (0);
3076 	}
3077 
3078 	if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
3079 	    (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
3080 		(void) strcpy(gtnd->name, zhp->zfs_name);
3081 		zfs_close(zhp);
3082 		return (EEXIST);
3083 	}
3084 
3085 	err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
3086 	if (err != EEXIST && gtnd->bookmark_ok)
3087 		err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
3088 	zfs_close(zhp);
3089 	return (err);
3090 }
3091 
3092 /*
3093  * Attempt to find the local dataset associated with this guid.  In the case of
3094  * multiple matches, we attempt to find the "best" match by searching
3095  * progressively larger portions of the hierarchy.  This allows one to send a
3096  * tree of datasets individually and guarantee that we will find the source
3097  * guid within that hierarchy, even if there are multiple matches elsewhere.
3098  *
3099  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
3100  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
3101  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
3102  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
3103  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
3104  * given guid.  Note that a redaction bookmark can be returned if
3105  * num_redact_snaps == -1.
3106  */
3107 static int
3108 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
3109     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
3110     uint64_t num_redact_snaps, char *name)
3111 {
3112 	char pname[ZFS_MAX_DATASET_NAME_LEN];
3113 	guid_to_name_data_t gtnd;
3114 
3115 	gtnd.guid = guid;
3116 	gtnd.bookmark_ok = bookmark_ok;
3117 	gtnd.name = name;
3118 	gtnd.skip = NULL;
3119 	gtnd.redact_snap_guids = redact_snap_guids;
3120 	gtnd.num_redact_snaps = num_redact_snaps;
3121 
3122 	/*
3123 	 * Search progressively larger portions of the hierarchy, starting
3124 	 * with the filesystem specified by 'parent'.  This will
3125 	 * select the "most local" version of the origin snapshot in the case
3126 	 * that there are multiple matching snapshots in the system.
3127 	 */
3128 	(void) strlcpy(pname, parent, sizeof (pname));
3129 	char *cp = strrchr(pname, '@');
3130 	if (cp == NULL)
3131 		cp = strchr(pname, '\0');
3132 	for (; cp != NULL; cp = strrchr(pname, '/')) {
3133 		/* Chop off the last component and open the parent */
3134 		*cp = '\0';
3135 		zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3136 
3137 		if (zhp == NULL)
3138 			continue;
3139 		int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3140 		if (err != EEXIST)
3141 			err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3142 		if (err != EEXIST && bookmark_ok)
3143 			err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3144 		zfs_close(zhp);
3145 		if (err == EEXIST)
3146 			return (0);
3147 
3148 		/*
3149 		 * Remember the last portion of the dataset so we skip it next
3150 		 * time through (as we've already searched that portion of the
3151 		 * hierarchy).
3152 		 */
3153 		gtnd.skip = strrchr(pname, '/') + 1;
3154 	}
3155 
3156 	return (ENOENT);
3157 }
3158 
3159 static int
3160 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3161     boolean_t bookmark_ok, char *name)
3162 {
3163 	return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3164 	    -1, name));
3165 }
3166 
3167 /*
3168  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3169  * guid1 is after guid2.
3170  */
3171 static int
3172 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3173     uint64_t guid1, uint64_t guid2)
3174 {
3175 	nvlist_t *nvfs;
3176 	char *fsname = NULL, *snapname = NULL;
3177 	char buf[ZFS_MAX_DATASET_NAME_LEN];
3178 	int rv;
3179 	zfs_handle_t *guid1hdl, *guid2hdl;
3180 	uint64_t create1, create2;
3181 
3182 	if (guid2 == 0)
3183 		return (0);
3184 	if (guid1 == 0)
3185 		return (1);
3186 
3187 	nvfs = fsavl_find(avl, guid1, &snapname);
3188 	fsname = fnvlist_lookup_string(nvfs, "name");
3189 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3190 	guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3191 	if (guid1hdl == NULL)
3192 		return (-1);
3193 
3194 	nvfs = fsavl_find(avl, guid2, &snapname);
3195 	fsname = fnvlist_lookup_string(nvfs, "name");
3196 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3197 	guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3198 	if (guid2hdl == NULL) {
3199 		zfs_close(guid1hdl);
3200 		return (-1);
3201 	}
3202 
3203 	create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3204 	create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3205 
3206 	if (create1 < create2)
3207 		rv = -1;
3208 	else if (create1 > create2)
3209 		rv = +1;
3210 	else
3211 		rv = 0;
3212 
3213 	zfs_close(guid1hdl);
3214 	zfs_close(guid2hdl);
3215 
3216 	return (rv);
3217 }
3218 
3219 /*
3220  * This function reestablishes the hierarchy of encryption roots after a
3221  * recursive incremental receive has completed. This must be done after the
3222  * second call to recv_incremental_replication() has renamed and promoted all
3223  * sent datasets to their final locations in the dataset hierarchy.
3224  */
3225 static int
3226 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3227     nvlist_t *stream_nv)
3228 {
3229 	int err;
3230 	nvpair_t *fselem = NULL;
3231 	nvlist_t *stream_fss;
3232 
3233 	stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3234 
3235 	while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3236 		zfs_handle_t *zhp = NULL;
3237 		uint64_t crypt;
3238 		nvlist_t *snaps, *props, *stream_nvfs = NULL;
3239 		nvpair_t *snapel = NULL;
3240 		boolean_t is_encroot, is_clone, stream_encroot;
3241 		char *cp;
3242 		char *stream_keylocation = NULL;
3243 		char keylocation[MAXNAMELEN];
3244 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
3245 
3246 		keylocation[0] = '\0';
3247 		stream_nvfs = fnvpair_value_nvlist(fselem);
3248 		snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3249 		props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3250 		stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3251 
3252 		/* find a snapshot from the stream that exists locally */
3253 		err = ENOENT;
3254 		while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3255 			uint64_t guid;
3256 
3257 			guid = fnvpair_value_uint64(snapel);
3258 			err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3259 			    fsname);
3260 			if (err == 0)
3261 				break;
3262 		}
3263 
3264 		if (err != 0)
3265 			continue;
3266 
3267 		cp = strchr(fsname, '@');
3268 		if (cp != NULL)
3269 			*cp = '\0';
3270 
3271 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3272 		if (zhp == NULL) {
3273 			err = ENOENT;
3274 			goto error;
3275 		}
3276 
3277 		crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3278 		is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3279 		(void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3280 
3281 		/* we don't need to do anything for unencrypted datasets */
3282 		if (crypt == ZIO_CRYPT_OFF) {
3283 			zfs_close(zhp);
3284 			continue;
3285 		}
3286 
3287 		/*
3288 		 * If the dataset is flagged as an encryption root, was not
3289 		 * received as a clone and is not currently an encryption root,
3290 		 * force it to become one. Fixup the keylocation if necessary.
3291 		 */
3292 		if (stream_encroot) {
3293 			if (!is_clone && !is_encroot) {
3294 				err = lzc_change_key(fsname,
3295 				    DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3296 				if (err != 0) {
3297 					zfs_close(zhp);
3298 					goto error;
3299 				}
3300 			}
3301 
3302 			stream_keylocation = fnvlist_lookup_string(props,
3303 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3304 
3305 			/*
3306 			 * Refresh the properties in case the call to
3307 			 * lzc_change_key() changed the value.
3308 			 */
3309 			zfs_refresh_properties(zhp);
3310 			err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3311 			    keylocation, sizeof (keylocation), NULL, NULL,
3312 			    0, B_TRUE);
3313 			if (err != 0) {
3314 				zfs_close(zhp);
3315 				goto error;
3316 			}
3317 
3318 			if (strcmp(keylocation, stream_keylocation) != 0) {
3319 				err = zfs_prop_set(zhp,
3320 				    zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3321 				    stream_keylocation);
3322 				if (err != 0) {
3323 					zfs_close(zhp);
3324 					goto error;
3325 				}
3326 			}
3327 		}
3328 
3329 		/*
3330 		 * If the dataset is not flagged as an encryption root and is
3331 		 * currently an encryption root, force it to inherit from its
3332 		 * parent. The root of a raw send should never be
3333 		 * force-inherited.
3334 		 */
3335 		if (!stream_encroot && is_encroot &&
3336 		    strcmp(top_zfs, fsname) != 0) {
3337 			err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3338 			    NULL, NULL, 0);
3339 			if (err != 0) {
3340 				zfs_close(zhp);
3341 				goto error;
3342 			}
3343 		}
3344 
3345 		zfs_close(zhp);
3346 	}
3347 
3348 	return (0);
3349 
3350 error:
3351 	return (err);
3352 }
3353 
3354 static int
3355 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3356     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3357     nvlist_t *renamed)
3358 {
3359 	nvlist_t *local_nv, *deleted = NULL;
3360 	avl_tree_t *local_avl;
3361 	nvpair_t *fselem, *nextfselem;
3362 	char *fromsnap;
3363 	char newname[ZFS_MAX_DATASET_NAME_LEN];
3364 	char guidname[32];
3365 	int error;
3366 	boolean_t needagain, progress, recursive;
3367 	char *s1, *s2;
3368 
3369 	fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3370 
3371 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3372 	    ENOENT);
3373 
3374 	if (flags->dryrun)
3375 		return (0);
3376 
3377 again:
3378 	needagain = progress = B_FALSE;
3379 
3380 	deleted = fnvlist_alloc();
3381 
3382 	if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3383 	    recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3384 	    B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3385 		return (error);
3386 
3387 	/*
3388 	 * Process deletes and renames
3389 	 */
3390 	for (fselem = nvlist_next_nvpair(local_nv, NULL);
3391 	    fselem; fselem = nextfselem) {
3392 		nvlist_t *nvfs, *snaps;
3393 		nvlist_t *stream_nvfs = NULL;
3394 		nvpair_t *snapelem, *nextsnapelem;
3395 		uint64_t fromguid = 0;
3396 		uint64_t originguid = 0;
3397 		uint64_t stream_originguid = 0;
3398 		uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3399 		char *fsname, *stream_fsname;
3400 
3401 		nextfselem = nvlist_next_nvpair(local_nv, fselem);
3402 
3403 		nvfs = fnvpair_value_nvlist(fselem);
3404 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3405 		fsname = fnvlist_lookup_string(nvfs, "name");
3406 		parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3407 		    "parentfromsnap");
3408 		(void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3409 
3410 		/*
3411 		 * First find the stream's fs, so we can check for
3412 		 * a different origin (due to "zfs promote")
3413 		 */
3414 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3415 		    snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3416 			uint64_t thisguid;
3417 
3418 			thisguid = fnvpair_value_uint64(snapelem);
3419 			stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3420 
3421 			if (stream_nvfs != NULL)
3422 				break;
3423 		}
3424 
3425 		/* check for promote */
3426 		(void) nvlist_lookup_uint64(stream_nvfs, "origin",
3427 		    &stream_originguid);
3428 		if (stream_nvfs && originguid != stream_originguid) {
3429 			switch (created_before(hdl, local_avl,
3430 			    stream_originguid, originguid)) {
3431 			case 1: {
3432 				/* promote it! */
3433 				nvlist_t *origin_nvfs;
3434 				char *origin_fsname;
3435 
3436 				origin_nvfs = fsavl_find(local_avl, originguid,
3437 				    NULL);
3438 				origin_fsname = fnvlist_lookup_string(
3439 				    origin_nvfs, "name");
3440 				error = recv_promote(hdl, fsname, origin_fsname,
3441 				    flags);
3442 				if (error == 0)
3443 					progress = B_TRUE;
3444 				break;
3445 			}
3446 			default:
3447 				break;
3448 			case -1:
3449 				fsavl_destroy(local_avl);
3450 				fnvlist_free(local_nv);
3451 				return (-1);
3452 			}
3453 			/*
3454 			 * We had/have the wrong origin, therefore our
3455 			 * list of snapshots is wrong.  Need to handle
3456 			 * them on the next pass.
3457 			 */
3458 			needagain = B_TRUE;
3459 			continue;
3460 		}
3461 
3462 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3463 		    snapelem; snapelem = nextsnapelem) {
3464 			uint64_t thisguid;
3465 			char *stream_snapname;
3466 			nvlist_t *found, *props;
3467 
3468 			nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3469 
3470 			thisguid = fnvpair_value_uint64(snapelem);
3471 			found = fsavl_find(stream_avl, thisguid,
3472 			    &stream_snapname);
3473 
3474 			/* check for delete */
3475 			if (found == NULL) {
3476 				char name[ZFS_MAX_DATASET_NAME_LEN];
3477 
3478 				if (!flags->force)
3479 					continue;
3480 
3481 				(void) snprintf(name, sizeof (name), "%s@%s",
3482 				    fsname, nvpair_name(snapelem));
3483 
3484 				error = recv_destroy(hdl, name,
3485 				    strlen(fsname)+1, newname, flags);
3486 				if (error)
3487 					needagain = B_TRUE;
3488 				else
3489 					progress = B_TRUE;
3490 				sprintf(guidname, "%llu",
3491 				    (u_longlong_t)thisguid);
3492 				nvlist_add_boolean(deleted, guidname);
3493 				continue;
3494 			}
3495 
3496 			stream_nvfs = found;
3497 
3498 			if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3499 			    &props) && 0 == nvlist_lookup_nvlist(props,
3500 			    stream_snapname, &props)) {
3501 				zfs_cmd_t zc = {"\0"};
3502 
3503 				zc.zc_cookie = B_TRUE; /* received */
3504 				(void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3505 				    "%s@%s", fsname, nvpair_name(snapelem));
3506 				zcmd_write_src_nvlist(hdl, &zc, props);
3507 				(void) zfs_ioctl(hdl,
3508 				    ZFS_IOC_SET_PROP, &zc);
3509 				zcmd_free_nvlists(&zc);
3510 			}
3511 
3512 			/* check for different snapname */
3513 			if (strcmp(nvpair_name(snapelem),
3514 			    stream_snapname) != 0) {
3515 				char name[ZFS_MAX_DATASET_NAME_LEN];
3516 				char tryname[ZFS_MAX_DATASET_NAME_LEN];
3517 
3518 				(void) snprintf(name, sizeof (name), "%s@%s",
3519 				    fsname, nvpair_name(snapelem));
3520 				(void) snprintf(tryname, sizeof (name), "%s@%s",
3521 				    fsname, stream_snapname);
3522 
3523 				error = recv_rename(hdl, name, tryname,
3524 				    strlen(fsname)+1, newname, flags);
3525 				if (error)
3526 					needagain = B_TRUE;
3527 				else
3528 					progress = B_TRUE;
3529 			}
3530 
3531 			if (strcmp(stream_snapname, fromsnap) == 0)
3532 				fromguid = thisguid;
3533 		}
3534 
3535 		/* check for delete */
3536 		if (stream_nvfs == NULL) {
3537 			if (!flags->force)
3538 				continue;
3539 
3540 			error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3541 			    newname, flags);
3542 			if (error)
3543 				needagain = B_TRUE;
3544 			else
3545 				progress = B_TRUE;
3546 			sprintf(guidname, "%llu",
3547 			    (u_longlong_t)parent_fromsnap_guid);
3548 			nvlist_add_boolean(deleted, guidname);
3549 			continue;
3550 		}
3551 
3552 		if (fromguid == 0) {
3553 			if (flags->verbose) {
3554 				(void) printf("local fs %s does not have "
3555 				    "fromsnap (%s in stream); must have "
3556 				    "been deleted locally; ignoring\n",
3557 				    fsname, fromsnap);
3558 			}
3559 			continue;
3560 		}
3561 
3562 		stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3563 		stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3564 		    stream_nvfs, "parentfromsnap");
3565 
3566 		s1 = strrchr(fsname, '/');
3567 		s2 = strrchr(stream_fsname, '/');
3568 
3569 		/*
3570 		 * Check if we're going to rename based on parent guid change
3571 		 * and the current parent guid was also deleted. If it was then
3572 		 * rename will fail and is likely unneeded, so avoid this and
3573 		 * force an early retry to determine the new
3574 		 * parent_fromsnap_guid.
3575 		 */
3576 		if (stream_parent_fromsnap_guid != 0 &&
3577 		    parent_fromsnap_guid != 0 &&
3578 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3579 			sprintf(guidname, "%llu",
3580 			    (u_longlong_t)parent_fromsnap_guid);
3581 			if (nvlist_exists(deleted, guidname)) {
3582 				progress = B_TRUE;
3583 				needagain = B_TRUE;
3584 				goto doagain;
3585 			}
3586 		}
3587 
3588 		/*
3589 		 * Check for rename. If the exact receive path is specified, it
3590 		 * does not count as a rename, but we still need to check the
3591 		 * datasets beneath it.
3592 		 */
3593 		if ((stream_parent_fromsnap_guid != 0 &&
3594 		    parent_fromsnap_guid != 0 &&
3595 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3596 		    ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3597 		    (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3598 			nvlist_t *parent;
3599 			char tryname[ZFS_MAX_DATASET_NAME_LEN];
3600 
3601 			parent = fsavl_find(local_avl,
3602 			    stream_parent_fromsnap_guid, NULL);
3603 			/*
3604 			 * NB: parent might not be found if we used the
3605 			 * tosnap for stream_parent_fromsnap_guid,
3606 			 * because the parent is a newly-created fs;
3607 			 * we'll be able to rename it after we recv the
3608 			 * new fs.
3609 			 */
3610 			if (parent != NULL) {
3611 				char *pname;
3612 
3613 				pname = fnvlist_lookup_string(parent, "name");
3614 				(void) snprintf(tryname, sizeof (tryname),
3615 				    "%s%s", pname, strrchr(stream_fsname, '/'));
3616 			} else {
3617 				tryname[0] = '\0';
3618 				if (flags->verbose) {
3619 					(void) printf("local fs %s new parent "
3620 					    "not found\n", fsname);
3621 				}
3622 			}
3623 
3624 			newname[0] = '\0';
3625 
3626 			error = recv_rename(hdl, fsname, tryname,
3627 			    strlen(tofs)+1, newname, flags);
3628 
3629 			if (renamed != NULL && newname[0] != '\0') {
3630 				fnvlist_add_boolean(renamed, newname);
3631 			}
3632 
3633 			if (error)
3634 				needagain = B_TRUE;
3635 			else
3636 				progress = B_TRUE;
3637 		}
3638 	}
3639 
3640 doagain:
3641 	fsavl_destroy(local_avl);
3642 	fnvlist_free(local_nv);
3643 	fnvlist_free(deleted);
3644 
3645 	if (needagain && progress) {
3646 		/* do another pass to fix up temporary names */
3647 		if (flags->verbose)
3648 			(void) printf("another pass:\n");
3649 		goto again;
3650 	}
3651 
3652 	return (needagain || error != 0);
3653 }
3654 
3655 static int
3656 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3657     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3658     char **top_zfs, nvlist_t *cmdprops)
3659 {
3660 	nvlist_t *stream_nv = NULL;
3661 	avl_tree_t *stream_avl = NULL;
3662 	char *fromsnap = NULL;
3663 	char *sendsnap = NULL;
3664 	char *cp;
3665 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
3666 	char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3667 	char errbuf[ERRBUFLEN];
3668 	dmu_replay_record_t drre;
3669 	int error;
3670 	boolean_t anyerr = B_FALSE;
3671 	boolean_t softerr = B_FALSE;
3672 	boolean_t recursive, raw;
3673 
3674 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3675 	    "cannot receive"));
3676 
3677 	assert(drr->drr_type == DRR_BEGIN);
3678 	assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3679 	assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3680 	    DMU_COMPOUNDSTREAM);
3681 
3682 	/*
3683 	 * Read in the nvlist from the stream.
3684 	 */
3685 	if (drr->drr_payloadlen != 0) {
3686 		error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3687 		    &stream_nv, flags->byteswap, zc);
3688 		if (error) {
3689 			error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3690 			goto out;
3691 		}
3692 	}
3693 
3694 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3695 	    ENOENT);
3696 	raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3697 
3698 	if (recursive && strchr(destname, '@')) {
3699 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3700 		    "cannot specify snapshot name for multi-snapshot stream"));
3701 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3702 		goto out;
3703 	}
3704 
3705 	/*
3706 	 * Read in the end record and verify checksum.
3707 	 */
3708 	if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3709 	    flags->byteswap, NULL)))
3710 		goto out;
3711 	if (flags->byteswap) {
3712 		drre.drr_type = BSWAP_32(drre.drr_type);
3713 		drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3714 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3715 		drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3716 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3717 		drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3718 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3719 		drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3720 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3721 	}
3722 	if (drre.drr_type != DRR_END) {
3723 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3724 		goto out;
3725 	}
3726 	if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3727 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3728 		    "incorrect header checksum"));
3729 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3730 		goto out;
3731 	}
3732 
3733 	(void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3734 
3735 	if (drr->drr_payloadlen != 0) {
3736 		nvlist_t *stream_fss;
3737 
3738 		stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3739 		if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3740 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3741 			    "couldn't allocate avl tree"));
3742 			error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3743 			goto out;
3744 		}
3745 
3746 		if (fromsnap != NULL && recursive) {
3747 			nvlist_t *renamed = NULL;
3748 			nvpair_t *pair = NULL;
3749 
3750 			(void) strlcpy(tofs, destname, sizeof (tofs));
3751 			if (flags->isprefix) {
3752 				struct drr_begin *drrb = &drr->drr_u.drr_begin;
3753 				int i;
3754 
3755 				if (flags->istail) {
3756 					cp = strrchr(drrb->drr_toname, '/');
3757 					if (cp == NULL) {
3758 						(void) strlcat(tofs, "/",
3759 						    sizeof (tofs));
3760 						i = 0;
3761 					} else {
3762 						i = (cp - drrb->drr_toname);
3763 					}
3764 				} else {
3765 					i = strcspn(drrb->drr_toname, "/@");
3766 				}
3767 				/* zfs_receive_one() will create_parents() */
3768 				(void) strlcat(tofs, &drrb->drr_toname[i],
3769 				    sizeof (tofs));
3770 				*strchr(tofs, '@') = '\0';
3771 			}
3772 
3773 			if (!flags->dryrun && !flags->nomount) {
3774 				renamed = fnvlist_alloc();
3775 			}
3776 
3777 			softerr = recv_incremental_replication(hdl, tofs, flags,
3778 			    stream_nv, stream_avl, renamed);
3779 
3780 			/* Unmount renamed filesystems before receiving. */
3781 			while ((pair = nvlist_next_nvpair(renamed,
3782 			    pair)) != NULL) {
3783 				zfs_handle_t *zhp;
3784 				prop_changelist_t *clp = NULL;
3785 
3786 				zhp = zfs_open(hdl, nvpair_name(pair),
3787 				    ZFS_TYPE_FILESYSTEM);
3788 				if (zhp != NULL) {
3789 					clp = changelist_gather(zhp,
3790 					    ZFS_PROP_MOUNTPOINT, 0,
3791 					    flags->forceunmount ? MS_FORCE : 0);
3792 					zfs_close(zhp);
3793 					if (clp != NULL) {
3794 						softerr |=
3795 						    changelist_prefix(clp);
3796 						changelist_free(clp);
3797 					}
3798 				}
3799 			}
3800 
3801 			fnvlist_free(renamed);
3802 		}
3803 	}
3804 
3805 	/*
3806 	 * Get the fs specified by the first path in the stream (the top level
3807 	 * specified by 'zfs send') and pass it to each invocation of
3808 	 * zfs_receive_one().
3809 	 */
3810 	(void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3811 	    sizeof (sendfs));
3812 	if ((cp = strchr(sendfs, '@')) != NULL) {
3813 		*cp = '\0';
3814 		/*
3815 		 * Find the "sendsnap", the final snapshot in a replication
3816 		 * stream.  zfs_receive_one() handles certain errors
3817 		 * differently, depending on if the contained stream is the
3818 		 * last one or not.
3819 		 */
3820 		sendsnap = (cp + 1);
3821 	}
3822 
3823 	/* Finally, receive each contained stream */
3824 	do {
3825 		/*
3826 		 * we should figure out if it has a recoverable
3827 		 * error, in which case do a recv_skip() and drive on.
3828 		 * Note, if we fail due to already having this guid,
3829 		 * zfs_receive_one() will take care of it (ie,
3830 		 * recv_skip() and return 0).
3831 		 */
3832 		error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3833 		    sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3834 		if (error == ENODATA) {
3835 			error = 0;
3836 			break;
3837 		}
3838 		anyerr |= error;
3839 	} while (error == 0);
3840 
3841 	if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3842 		/*
3843 		 * Now that we have the fs's they sent us, try the
3844 		 * renames again.
3845 		 */
3846 		softerr = recv_incremental_replication(hdl, tofs, flags,
3847 		    stream_nv, stream_avl, NULL);
3848 	}
3849 
3850 	if (raw && softerr == 0 && *top_zfs != NULL) {
3851 		softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3852 		    stream_nv);
3853 	}
3854 
3855 out:
3856 	fsavl_destroy(stream_avl);
3857 	fnvlist_free(stream_nv);
3858 	if (softerr)
3859 		error = -2;
3860 	if (anyerr)
3861 		error = -1;
3862 	return (error);
3863 }
3864 
3865 static void
3866 trunc_prop_errs(int truncated)
3867 {
3868 	ASSERT(truncated != 0);
3869 
3870 	if (truncated == 1)
3871 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3872 		    "1 more property could not be set\n"));
3873 	else
3874 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3875 		    "%d more properties could not be set\n"), truncated);
3876 }
3877 
3878 static int
3879 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3880 {
3881 	dmu_replay_record_t *drr;
3882 	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3883 	uint64_t payload_size;
3884 	char errbuf[ERRBUFLEN];
3885 
3886 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3887 	    "cannot receive"));
3888 
3889 	/* XXX would be great to use lseek if possible... */
3890 	drr = buf;
3891 
3892 	while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3893 	    byteswap, NULL) == 0) {
3894 		if (byteswap)
3895 			drr->drr_type = BSWAP_32(drr->drr_type);
3896 
3897 		switch (drr->drr_type) {
3898 		case DRR_BEGIN:
3899 			if (drr->drr_payloadlen != 0) {
3900 				(void) recv_read(hdl, fd, buf,
3901 				    drr->drr_payloadlen, B_FALSE, NULL);
3902 			}
3903 			break;
3904 
3905 		case DRR_END:
3906 			free(buf);
3907 			return (0);
3908 
3909 		case DRR_OBJECT:
3910 			if (byteswap) {
3911 				drr->drr_u.drr_object.drr_bonuslen =
3912 				    BSWAP_32(drr->drr_u.drr_object.
3913 				    drr_bonuslen);
3914 				drr->drr_u.drr_object.drr_raw_bonuslen =
3915 				    BSWAP_32(drr->drr_u.drr_object.
3916 				    drr_raw_bonuslen);
3917 			}
3918 
3919 			payload_size =
3920 			    DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3921 			(void) recv_read(hdl, fd, buf, payload_size,
3922 			    B_FALSE, NULL);
3923 			break;
3924 
3925 		case DRR_WRITE:
3926 			if (byteswap) {
3927 				drr->drr_u.drr_write.drr_logical_size =
3928 				    BSWAP_64(
3929 				    drr->drr_u.drr_write.drr_logical_size);
3930 				drr->drr_u.drr_write.drr_compressed_size =
3931 				    BSWAP_64(
3932 				    drr->drr_u.drr_write.drr_compressed_size);
3933 			}
3934 			payload_size =
3935 			    DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3936 			assert(payload_size <= SPA_MAXBLOCKSIZE);
3937 			(void) recv_read(hdl, fd, buf,
3938 			    payload_size, B_FALSE, NULL);
3939 			break;
3940 		case DRR_SPILL:
3941 			if (byteswap) {
3942 				drr->drr_u.drr_spill.drr_length =
3943 				    BSWAP_64(drr->drr_u.drr_spill.drr_length);
3944 				drr->drr_u.drr_spill.drr_compressed_size =
3945 				    BSWAP_64(drr->drr_u.drr_spill.
3946 				    drr_compressed_size);
3947 			}
3948 
3949 			payload_size =
3950 			    DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3951 			(void) recv_read(hdl, fd, buf, payload_size,
3952 			    B_FALSE, NULL);
3953 			break;
3954 		case DRR_WRITE_EMBEDDED:
3955 			if (byteswap) {
3956 				drr->drr_u.drr_write_embedded.drr_psize =
3957 				    BSWAP_32(drr->drr_u.drr_write_embedded.
3958 				    drr_psize);
3959 			}
3960 			(void) recv_read(hdl, fd, buf,
3961 			    P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3962 			    8), B_FALSE, NULL);
3963 			break;
3964 		case DRR_OBJECT_RANGE:
3965 		case DRR_WRITE_BYREF:
3966 		case DRR_FREEOBJECTS:
3967 		case DRR_FREE:
3968 			break;
3969 
3970 		default:
3971 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3972 			    "invalid record type"));
3973 			free(buf);
3974 			return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3975 		}
3976 	}
3977 
3978 	free(buf);
3979 	return (-1);
3980 }
3981 
3982 static void
3983 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
3984     boolean_t resumable, boolean_t checksum)
3985 {
3986 	char target_fs[ZFS_MAX_DATASET_NAME_LEN];
3987 
3988 	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
3989 	    "checksum mismatch" : "incomplete stream")));
3990 
3991 	if (!resumable)
3992 		return;
3993 	(void) strlcpy(target_fs, target_snap, sizeof (target_fs));
3994 	*strchr(target_fs, '@') = '\0';
3995 	zfs_handle_t *zhp = zfs_open(hdl, target_fs,
3996 	    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
3997 	if (zhp == NULL)
3998 		return;
3999 
4000 	char token_buf[ZFS_MAXPROPLEN];
4001 	int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
4002 	    token_buf, sizeof (token_buf),
4003 	    NULL, NULL, 0, B_TRUE);
4004 	if (error == 0) {
4005 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4006 		    "checksum mismatch or incomplete stream.\n"
4007 		    "Partially received snapshot is saved.\n"
4008 		    "A resuming stream can be generated on the sending "
4009 		    "system by running:\n"
4010 		    "    zfs send -t %s"),
4011 		    token_buf);
4012 	}
4013 	zfs_close(zhp);
4014 }
4015 
4016 /*
4017  * Prepare a new nvlist of properties that are to override (-o) or be excluded
4018  * (-x) from the received dataset
4019  * recvprops: received properties from the send stream
4020  * cmdprops: raw input properties from command line
4021  * origprops: properties, both locally-set and received, currently set on the
4022  *            target dataset if it exists, NULL otherwise.
4023  * oxprops: valid output override (-o) and excluded (-x) properties
4024  */
4025 static int
4026 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
4027     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
4028     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
4029     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
4030     uint_t *wkeylen_out, const char *errbuf)
4031 {
4032 	nvpair_t *nvp;
4033 	nvlist_t *oprops, *voprops;
4034 	zfs_handle_t *zhp = NULL;
4035 	zpool_handle_t *zpool_hdl = NULL;
4036 	char *cp;
4037 	int ret = 0;
4038 	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
4039 
4040 	if (nvlist_empty(cmdprops))
4041 		return (0); /* No properties to override or exclude */
4042 
4043 	*oxprops = fnvlist_alloc();
4044 	oprops = fnvlist_alloc();
4045 
4046 	strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
4047 
4048 	/*
4049 	 * Get our dataset handle. The target dataset may not exist yet.
4050 	 */
4051 	if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
4052 		zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
4053 		if (zhp == NULL) {
4054 			ret = -1;
4055 			goto error;
4056 		}
4057 	}
4058 
4059 	/* open the zpool handle */
4060 	cp = strchr(namebuf, '/');
4061 	if (cp != NULL)
4062 		*cp = '\0';
4063 	zpool_hdl = zpool_open(hdl, namebuf);
4064 	if (zpool_hdl == NULL) {
4065 		ret = -1;
4066 		goto error;
4067 	}
4068 
4069 	/* restore namebuf to match fsname for later use */
4070 	if (cp != NULL)
4071 		*cp = '/';
4072 
4073 	/*
4074 	 * first iteration: process excluded (-x) properties now and gather
4075 	 * added (-o) properties to be later processed by zfs_valid_proplist()
4076 	 */
4077 	nvp = NULL;
4078 	while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
4079 		const char *name = nvpair_name(nvp);
4080 		zfs_prop_t prop = zfs_name_to_prop(name);
4081 
4082 		/*
4083 		 * It turns out, if we don't normalize "aliased" names
4084 		 * e.g. compress= against the "real" names (e.g. compression)
4085 		 * here, then setting/excluding them does not work as
4086 		 * intended.
4087 		 *
4088 		 * But since user-defined properties wouldn't have a valid
4089 		 * mapping here, we do this conditional dance.
4090 		 */
4091 		const char *newname = name;
4092 		if (prop >= ZFS_PROP_TYPE)
4093 			newname = zfs_prop_to_name(prop);
4094 
4095 		/* "origin" is processed separately, don't handle it here */
4096 		if (prop == ZFS_PROP_ORIGIN)
4097 			continue;
4098 
4099 		/* raw streams can't override encryption properties */
4100 		if ((zfs_prop_encryption_key_param(prop) ||
4101 		    prop == ZFS_PROP_ENCRYPTION) && raw) {
4102 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4103 			    "encryption property '%s' cannot "
4104 			    "be set or excluded for raw streams."), name);
4105 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4106 			goto error;
4107 		}
4108 
4109 		/* incremental streams can only exclude encryption properties */
4110 		if ((zfs_prop_encryption_key_param(prop) ||
4111 		    prop == ZFS_PROP_ENCRYPTION) && !newfs &&
4112 		    nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
4113 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4114 			    "encryption property '%s' cannot "
4115 			    "be set for incremental streams."), name);
4116 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4117 			goto error;
4118 		}
4119 
4120 		switch (nvpair_type(nvp)) {
4121 		case DATA_TYPE_BOOLEAN: /* -x property */
4122 			/*
4123 			 * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4124 			 * a property: this is done by forcing an explicit
4125 			 * inherit on the destination so the effective value is
4126 			 * not the one we received from the send stream.
4127 			 */
4128 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4129 			    !zfs_prop_user(name)) {
4130 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4131 				    "Warning: %s: property '%s' does not "
4132 				    "apply to datasets of this type\n"),
4133 				    fsname, name);
4134 				continue;
4135 			}
4136 			/*
4137 			 * We do this only if the property is not already
4138 			 * locally-set, in which case its value will take
4139 			 * priority over the received anyway.
4140 			 */
4141 			if (nvlist_exists(origprops, newname)) {
4142 				nvlist_t *attrs;
4143 				char *source = NULL;
4144 
4145 				attrs = fnvlist_lookup_nvlist(origprops,
4146 				    newname);
4147 				if (nvlist_lookup_string(attrs,
4148 				    ZPROP_SOURCE, &source) == 0 &&
4149 				    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4150 					continue;
4151 			}
4152 			/*
4153 			 * We can't force an explicit inherit on non-inheritable
4154 			 * properties: if we're asked to exclude this kind of
4155 			 * values we remove them from "recvprops" input nvlist.
4156 			 */
4157 			if (!zfs_prop_user(name) && /* can be inherited too */
4158 			    !zfs_prop_inheritable(prop) &&
4159 			    nvlist_exists(recvprops, newname))
4160 				fnvlist_remove(recvprops, newname);
4161 			else
4162 				fnvlist_add_boolean(*oxprops, newname);
4163 			break;
4164 		case DATA_TYPE_STRING: /* -o property=value */
4165 			/*
4166 			 * we're trying to override a property that does not
4167 			 * make sense for this type of dataset, but we don't
4168 			 * want to fail if the receive is recursive: this comes
4169 			 * in handy when the send stream contains, for
4170 			 * instance, a child ZVOL and we're trying to receive
4171 			 * it with "-o atime=on"
4172 			 */
4173 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4174 			    !zfs_prop_user(name)) {
4175 				if (recursive)
4176 					continue;
4177 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4178 				    "property '%s' does not apply to datasets "
4179 				    "of this type"), name);
4180 				ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4181 				goto error;
4182 			}
4183 			fnvlist_add_string(oprops, newname,
4184 			    fnvpair_value_string(nvp));
4185 			break;
4186 		default:
4187 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4188 			    "property '%s' must be a string or boolean"), name);
4189 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4190 			goto error;
4191 		}
4192 	}
4193 
4194 	if (toplevel) {
4195 		/* convert override strings properties to native */
4196 		if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4197 		    oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4198 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4199 			goto error;
4200 		}
4201 
4202 		/*
4203 		 * zfs_crypto_create() requires the parent name. Get it
4204 		 * by truncating the fsname copy stored in namebuf.
4205 		 */
4206 		cp = strrchr(namebuf, '/');
4207 		if (cp != NULL)
4208 			*cp = '\0';
4209 
4210 		if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4211 		    B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4212 			fnvlist_free(voprops);
4213 			ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4214 			goto error;
4215 		}
4216 
4217 		/* second pass: process "-o" properties */
4218 		fnvlist_merge(*oxprops, voprops);
4219 		fnvlist_free(voprops);
4220 	} else {
4221 		/* override props on child dataset are inherited */
4222 		nvp = NULL;
4223 		while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4224 			const char *name = nvpair_name(nvp);
4225 			fnvlist_add_boolean(*oxprops, name);
4226 		}
4227 	}
4228 
4229 error:
4230 	if (zhp != NULL)
4231 		zfs_close(zhp);
4232 	if (zpool_hdl != NULL)
4233 		zpool_close(zpool_hdl);
4234 	fnvlist_free(oprops);
4235 	return (ret);
4236 }
4237 
4238 /*
4239  * Restores a backup of tosnap from the file descriptor specified by infd.
4240  */
4241 static int
4242 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4243     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4244     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4245     avl_tree_t *stream_avl, char **top_zfs,
4246     const char *finalsnap, nvlist_t *cmdprops)
4247 {
4248 	struct timespec begin_time;
4249 	int ioctl_err, ioctl_errno, err;
4250 	char *cp;
4251 	struct drr_begin *drrb = &drr->drr_u.drr_begin;
4252 	char errbuf[ERRBUFLEN];
4253 	const char *chopprefix;
4254 	boolean_t newfs = B_FALSE;
4255 	boolean_t stream_wantsnewfs, stream_resumingnewfs;
4256 	boolean_t newprops = B_FALSE;
4257 	uint64_t read_bytes = 0;
4258 	uint64_t errflags = 0;
4259 	uint64_t parent_snapguid = 0;
4260 	prop_changelist_t *clp = NULL;
4261 	nvlist_t *snapprops_nvlist = NULL;
4262 	nvlist_t *snapholds_nvlist = NULL;
4263 	zprop_errflags_t prop_errflags;
4264 	nvlist_t *prop_errors = NULL;
4265 	boolean_t recursive;
4266 	char *snapname = NULL;
4267 	char destsnap[MAXPATHLEN * 2];
4268 	char origin[MAXNAMELEN] = {0};
4269 	char name[MAXPATHLEN];
4270 	char tmp_keylocation[MAXNAMELEN] = {0};
4271 	nvlist_t *rcvprops = NULL; /* props received from the send stream */
4272 	nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4273 	nvlist_t *origprops = NULL; /* original props (if destination exists) */
4274 	zfs_type_t type = ZFS_TYPE_INVALID;
4275 	boolean_t toplevel = B_FALSE;
4276 	boolean_t zoned = B_FALSE;
4277 	boolean_t hastoken = B_FALSE;
4278 	boolean_t redacted;
4279 	uint8_t *wkeydata = NULL;
4280 	uint_t wkeylen = 0;
4281 
4282 #ifndef CLOCK_MONOTONIC_RAW
4283 #define	CLOCK_MONOTONIC_RAW CLOCK_MONOTONIC
4284 #endif
4285 	clock_gettime(CLOCK_MONOTONIC_RAW, &begin_time);
4286 
4287 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4288 	    "cannot receive"));
4289 
4290 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4291 	    ENOENT);
4292 
4293 	/* Did the user request holds be skipped via zfs recv -k? */
4294 	boolean_t holds = flags->holds && !flags->skipholds;
4295 
4296 	if (stream_avl != NULL) {
4297 		char *keylocation = NULL;
4298 		nvlist_t *lookup = NULL;
4299 		nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4300 		    &snapname);
4301 
4302 		(void) nvlist_lookup_uint64(fs, "parentfromsnap",
4303 		    &parent_snapguid);
4304 		err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4305 		if (err) {
4306 			rcvprops = fnvlist_alloc();
4307 			newprops = B_TRUE;
4308 		}
4309 
4310 		/*
4311 		 * The keylocation property may only be set on encryption roots,
4312 		 * but this dataset might not become an encryption root until
4313 		 * recv_fix_encryption_hierarchy() is called. That function
4314 		 * will fixup the keylocation anyway, so we temporarily unset
4315 		 * the keylocation for now to avoid any errors from the receive
4316 		 * ioctl.
4317 		 */
4318 		err = nvlist_lookup_string(rcvprops,
4319 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4320 		if (err == 0) {
4321 			strcpy(tmp_keylocation, keylocation);
4322 			(void) nvlist_remove_all(rcvprops,
4323 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4324 		}
4325 
4326 		if (flags->canmountoff) {
4327 			fnvlist_add_uint64(rcvprops,
4328 			    zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4329 		} else if (newprops) {	/* nothing in rcvprops, eliminate it */
4330 			fnvlist_free(rcvprops);
4331 			rcvprops = NULL;
4332 			newprops = B_FALSE;
4333 		}
4334 		if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4335 			snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4336 			    snapname);
4337 		}
4338 		if (holds) {
4339 			if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4340 			    &lookup)) {
4341 				snapholds_nvlist = fnvlist_lookup_nvlist(
4342 				    lookup, snapname);
4343 			}
4344 		}
4345 	}
4346 
4347 	cp = NULL;
4348 
4349 	/*
4350 	 * Determine how much of the snapshot name stored in the stream
4351 	 * we are going to tack on to the name they specified on the
4352 	 * command line, and how much we are going to chop off.
4353 	 *
4354 	 * If they specified a snapshot, chop the entire name stored in
4355 	 * the stream.
4356 	 */
4357 	if (flags->istail) {
4358 		/*
4359 		 * A filesystem was specified with -e. We want to tack on only
4360 		 * the tail of the sent snapshot path.
4361 		 */
4362 		if (strchr(tosnap, '@')) {
4363 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4364 			    "argument - snapshot not allowed with -e"));
4365 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4366 			goto out;
4367 		}
4368 
4369 		chopprefix = strrchr(sendfs, '/');
4370 
4371 		if (chopprefix == NULL) {
4372 			/*
4373 			 * The tail is the poolname, so we need to
4374 			 * prepend a path separator.
4375 			 */
4376 			int len = strlen(drrb->drr_toname);
4377 			cp = malloc(len + 2);
4378 			cp[0] = '/';
4379 			(void) strcpy(&cp[1], drrb->drr_toname);
4380 			chopprefix = cp;
4381 		} else {
4382 			chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4383 		}
4384 	} else if (flags->isprefix) {
4385 		/*
4386 		 * A filesystem was specified with -d. We want to tack on
4387 		 * everything but the first element of the sent snapshot path
4388 		 * (all but the pool name).
4389 		 */
4390 		if (strchr(tosnap, '@')) {
4391 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4392 			    "argument - snapshot not allowed with -d"));
4393 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4394 			goto out;
4395 		}
4396 
4397 		chopprefix = strchr(drrb->drr_toname, '/');
4398 		if (chopprefix == NULL)
4399 			chopprefix = strchr(drrb->drr_toname, '@');
4400 	} else if (strchr(tosnap, '@') == NULL) {
4401 		/*
4402 		 * If a filesystem was specified without -d or -e, we want to
4403 		 * tack on everything after the fs specified by 'zfs send'.
4404 		 */
4405 		chopprefix = drrb->drr_toname + strlen(sendfs);
4406 	} else {
4407 		/* A snapshot was specified as an exact path (no -d or -e). */
4408 		if (recursive) {
4409 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4410 			    "cannot specify snapshot name for multi-snapshot "
4411 			    "stream"));
4412 			err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4413 			goto out;
4414 		}
4415 		chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4416 	}
4417 
4418 	ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4419 	ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4420 	ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4421 	    strchr(sendfs, '/') == NULL);
4422 	ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4423 	    chopprefix[0] == '\0');
4424 
4425 	/*
4426 	 * Determine name of destination snapshot.
4427 	 */
4428 	(void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4429 	(void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4430 	free(cp);
4431 	if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4432 		err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4433 		goto out;
4434 	}
4435 
4436 	/*
4437 	 * Determine the name of the origin snapshot.
4438 	 */
4439 	if (originsnap) {
4440 		(void) strlcpy(origin, originsnap, sizeof (origin));
4441 		if (flags->verbose)
4442 			(void) printf("using provided clone origin %s\n",
4443 			    origin);
4444 	} else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4445 		if (guid_to_name(hdl, destsnap,
4446 		    drrb->drr_fromguid, B_FALSE, origin) != 0) {
4447 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4448 			    "local origin for clone %s does not exist"),
4449 			    destsnap);
4450 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4451 			goto out;
4452 		}
4453 		if (flags->verbose)
4454 			(void) printf("found clone origin %s\n", origin);
4455 	}
4456 
4457 	if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4458 	    DMU_BACKUP_FEATURE_DEDUP)) {
4459 		(void) fprintf(stderr,
4460 		    gettext("ERROR: \"zfs receive\" no longer supports "
4461 		    "deduplicated send streams.  Use\n"
4462 		    "the \"zstream redup\" command to convert this stream "
4463 		    "to a regular,\n"
4464 		    "non-deduplicated stream.\n"));
4465 		err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4466 		goto out;
4467 	}
4468 
4469 	boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4470 	    DMU_BACKUP_FEATURE_RESUMING;
4471 	boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4472 	    DMU_BACKUP_FEATURE_RAW;
4473 	boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4474 	    DMU_BACKUP_FEATURE_EMBED_DATA;
4475 	stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4476 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4477 	stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4478 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4479 
4480 	if (stream_wantsnewfs) {
4481 		/*
4482 		 * if the parent fs does not exist, look for it based on
4483 		 * the parent snap GUID
4484 		 */
4485 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4486 		    "cannot receive new filesystem stream"));
4487 
4488 		(void) strcpy(name, destsnap);
4489 		cp = strrchr(name, '/');
4490 		if (cp)
4491 			*cp = '\0';
4492 		if (cp &&
4493 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4494 			char suffix[ZFS_MAX_DATASET_NAME_LEN];
4495 			(void) strcpy(suffix, strrchr(destsnap, '/'));
4496 			if (guid_to_name(hdl, name, parent_snapguid,
4497 			    B_FALSE, destsnap) == 0) {
4498 				*strchr(destsnap, '@') = '\0';
4499 				(void) strcat(destsnap, suffix);
4500 			}
4501 		}
4502 	} else {
4503 		/*
4504 		 * If the fs does not exist, look for it based on the
4505 		 * fromsnap GUID.
4506 		 */
4507 		if (resuming) {
4508 			(void) snprintf(errbuf, sizeof (errbuf),
4509 			    dgettext(TEXT_DOMAIN,
4510 			    "cannot receive resume stream"));
4511 		} else {
4512 			(void) snprintf(errbuf, sizeof (errbuf),
4513 			    dgettext(TEXT_DOMAIN,
4514 			    "cannot receive incremental stream"));
4515 		}
4516 
4517 		(void) strcpy(name, destsnap);
4518 		*strchr(name, '@') = '\0';
4519 
4520 		/*
4521 		 * If the exact receive path was specified and this is the
4522 		 * topmost path in the stream, then if the fs does not exist we
4523 		 * should look no further.
4524 		 */
4525 		if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4526 		    strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4527 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4528 			char snap[ZFS_MAX_DATASET_NAME_LEN];
4529 			(void) strcpy(snap, strchr(destsnap, '@'));
4530 			if (guid_to_name(hdl, name, drrb->drr_fromguid,
4531 			    B_FALSE, destsnap) == 0) {
4532 				*strchr(destsnap, '@') = '\0';
4533 				(void) strcat(destsnap, snap);
4534 			}
4535 		}
4536 	}
4537 
4538 	(void) strcpy(name, destsnap);
4539 	*strchr(name, '@') = '\0';
4540 
4541 	redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4542 	    DMU_BACKUP_FEATURE_REDACTED;
4543 
4544 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4545 		zfs_cmd_t zc = {"\0"};
4546 		zfs_handle_t *zhp;
4547 		boolean_t encrypted;
4548 
4549 		(void) strcpy(zc.zc_name, name);
4550 
4551 		/*
4552 		 * Destination fs exists.  It must be one of these cases:
4553 		 *  - an incremental send stream
4554 		 *  - the stream specifies a new fs (full stream or clone)
4555 		 *    and they want us to blow away the existing fs (and
4556 		 *    have therefore specified -F and removed any snapshots)
4557 		 *  - we are resuming a failed receive.
4558 		 */
4559 		if (stream_wantsnewfs) {
4560 			boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4561 			if (!flags->force) {
4562 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4563 				    "destination '%s' exists\n"
4564 				    "must specify -F to overwrite it"), name);
4565 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4566 				goto out;
4567 			}
4568 			if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4569 			    &zc) == 0) {
4570 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4571 				    "destination has snapshots (eg. %s)\n"
4572 				    "must destroy them to overwrite it"),
4573 				    zc.zc_name);
4574 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4575 				goto out;
4576 			}
4577 			if (is_volume && strrchr(name, '/') == NULL) {
4578 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4579 				    "destination %s is the root dataset\n"
4580 				    "cannot overwrite with a ZVOL"),
4581 				    name);
4582 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4583 				goto out;
4584 			}
4585 			if (is_volume &&
4586 			    zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4587 			    &zc) == 0) {
4588 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4589 				    "destination has children (eg. %s)\n"
4590 				    "cannot overwrite with a ZVOL"),
4591 				    zc.zc_name);
4592 				err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4593 				goto out;
4594 			}
4595 		}
4596 
4597 		if ((zhp = zfs_open(hdl, name,
4598 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4599 			err = -1;
4600 			goto out;
4601 		}
4602 
4603 		if (stream_wantsnewfs &&
4604 		    zhp->zfs_dmustats.dds_origin[0]) {
4605 			zfs_close(zhp);
4606 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4607 			    "destination '%s' is a clone\n"
4608 			    "must destroy it to overwrite it"), name);
4609 			err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4610 			goto out;
4611 		}
4612 
4613 		/*
4614 		 * Raw sends can not be performed as an incremental on top
4615 		 * of existing unencrypted datasets. zfs recv -F can't be
4616 		 * used to blow away an existing encrypted filesystem. This
4617 		 * is because it would require the dsl dir to point to the
4618 		 * new key (or lack of a key) and the old key at the same
4619 		 * time. The -F flag may still be used for deleting
4620 		 * intermediate snapshots that would otherwise prevent the
4621 		 * receive from working.
4622 		 */
4623 		encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4624 		    ZIO_CRYPT_OFF;
4625 		if (!stream_wantsnewfs && !encrypted && raw) {
4626 			zfs_close(zhp);
4627 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4628 			    "cannot perform raw receive on top of "
4629 			    "existing unencrypted dataset"));
4630 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4631 			goto out;
4632 		}
4633 
4634 		if (stream_wantsnewfs && flags->force &&
4635 		    ((raw && !encrypted) || encrypted)) {
4636 			zfs_close(zhp);
4637 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4638 			    "zfs receive -F cannot be used to destroy an "
4639 			    "encrypted filesystem or overwrite an "
4640 			    "unencrypted one with an encrypted one"));
4641 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4642 			goto out;
4643 		}
4644 
4645 		if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4646 		    (stream_wantsnewfs || stream_resumingnewfs)) {
4647 			/* We can't do online recv in this case */
4648 			clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4649 			    flags->forceunmount ? MS_FORCE : 0);
4650 			if (clp == NULL) {
4651 				zfs_close(zhp);
4652 				err = -1;
4653 				goto out;
4654 			}
4655 			if (changelist_prefix(clp) != 0) {
4656 				changelist_free(clp);
4657 				zfs_close(zhp);
4658 				err = -1;
4659 				goto out;
4660 			}
4661 		}
4662 
4663 		/*
4664 		 * If we are resuming a newfs, set newfs here so that we will
4665 		 * mount it if the recv succeeds this time.  We can tell
4666 		 * that it was a newfs on the first recv because the fs
4667 		 * itself will be inconsistent (if the fs existed when we
4668 		 * did the first recv, we would have received it into
4669 		 * .../%recv).
4670 		 */
4671 		if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4672 			newfs = B_TRUE;
4673 
4674 		/* we want to know if we're zoned when validating -o|-x props */
4675 		zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4676 
4677 		/* may need this info later, get it now we have zhp around */
4678 		if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4679 		    NULL, NULL, 0, B_TRUE) == 0)
4680 			hastoken = B_TRUE;
4681 
4682 		/* gather existing properties on destination */
4683 		origprops = fnvlist_alloc();
4684 		fnvlist_merge(origprops, zhp->zfs_props);
4685 		fnvlist_merge(origprops, zhp->zfs_user_props);
4686 
4687 		zfs_close(zhp);
4688 	} else {
4689 		zfs_handle_t *zhp;
4690 
4691 		/*
4692 		 * Destination filesystem does not exist.  Therefore we better
4693 		 * be creating a new filesystem (either from a full backup, or
4694 		 * a clone).  It would therefore be invalid if the user
4695 		 * specified only the pool name (i.e. if the destination name
4696 		 * contained no slash character).
4697 		 */
4698 		cp = strrchr(name, '/');
4699 
4700 		if (!stream_wantsnewfs || cp == NULL) {
4701 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4702 			    "destination '%s' does not exist"), name);
4703 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4704 			goto out;
4705 		}
4706 
4707 		/*
4708 		 * Trim off the final dataset component so we perform the
4709 		 * recvbackup ioctl to the filesystems's parent.
4710 		 */
4711 		*cp = '\0';
4712 
4713 		if (flags->isprefix && !flags->istail && !flags->dryrun &&
4714 		    create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4715 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4716 			goto out;
4717 		}
4718 
4719 		/* validate parent */
4720 		zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4721 		if (zhp == NULL) {
4722 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4723 			goto out;
4724 		}
4725 		if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4726 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4727 			    "parent '%s' is not a filesystem"), name);
4728 			err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4729 			zfs_close(zhp);
4730 			goto out;
4731 		}
4732 
4733 		zfs_close(zhp);
4734 
4735 		newfs = B_TRUE;
4736 		*cp = '/';
4737 	}
4738 
4739 	if (flags->verbose) {
4740 		(void) printf("%s %s stream of %s into %s\n",
4741 		    flags->dryrun ? "would receive" : "receiving",
4742 		    drrb->drr_fromguid ? "incremental" : "full",
4743 		    drrb->drr_toname, destsnap);
4744 		(void) fflush(stdout);
4745 	}
4746 
4747 	/*
4748 	 * If this is the top-level dataset, record it so we can use it
4749 	 * for recursive operations later.
4750 	 */
4751 	if (top_zfs != NULL &&
4752 	    (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4753 		toplevel = B_TRUE;
4754 		if (*top_zfs == NULL)
4755 			*top_zfs = zfs_strdup(hdl, name);
4756 	}
4757 
4758 	if (drrb->drr_type == DMU_OST_ZVOL) {
4759 		type = ZFS_TYPE_VOLUME;
4760 	} else if (drrb->drr_type == DMU_OST_ZFS) {
4761 		type = ZFS_TYPE_FILESYSTEM;
4762 	} else {
4763 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4764 		    "invalid record type: 0x%d"), drrb->drr_type);
4765 		err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4766 		goto out;
4767 	}
4768 	if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4769 	    stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4770 	    &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4771 		goto out;
4772 
4773 	/*
4774 	 * When sending with properties (zfs send -p), the encryption property
4775 	 * is not included because it is a SETONCE property and therefore
4776 	 * treated as read only. However, we are always able to determine its
4777 	 * value because raw sends will include it in the DRR_BDEGIN payload
4778 	 * and non-raw sends with properties are not allowed for encrypted
4779 	 * datasets. Therefore, if this is a non-raw properties stream, we can
4780 	 * infer that the value should be ZIO_CRYPT_OFF and manually add that
4781 	 * to the received properties.
4782 	 */
4783 	if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4784 	    !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4785 		if (oxprops == NULL)
4786 			oxprops = fnvlist_alloc();
4787 		fnvlist_add_uint64(oxprops,
4788 		    zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4789 	}
4790 
4791 	if (flags->dryrun) {
4792 		void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4793 
4794 		/*
4795 		 * We have read the DRR_BEGIN record, but we have
4796 		 * not yet read the payload. For non-dryrun sends
4797 		 * this will be done by the kernel, so we must
4798 		 * emulate that here, before attempting to read
4799 		 * more records.
4800 		 */
4801 		err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4802 		    flags->byteswap, NULL);
4803 		free(buf);
4804 		if (err != 0)
4805 			goto out;
4806 
4807 		err = recv_skip(hdl, infd, flags->byteswap);
4808 		goto out;
4809 	}
4810 
4811 	err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4812 	    oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4813 	    raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4814 	    NULL, &prop_errors);
4815 	ioctl_errno = ioctl_err;
4816 	prop_errflags = errflags;
4817 
4818 	if (err == 0) {
4819 		nvpair_t *prop_err = NULL;
4820 
4821 		while ((prop_err = nvlist_next_nvpair(prop_errors,
4822 		    prop_err)) != NULL) {
4823 			char tbuf[1024];
4824 			zfs_prop_t prop;
4825 			int intval;
4826 
4827 			prop = zfs_name_to_prop(nvpair_name(prop_err));
4828 			(void) nvpair_value_int32(prop_err, &intval);
4829 			if (strcmp(nvpair_name(prop_err),
4830 			    ZPROP_N_MORE_ERRORS) == 0) {
4831 				trunc_prop_errs(intval);
4832 				break;
4833 			} else if (snapname == NULL || finalsnap == NULL ||
4834 			    strcmp(finalsnap, snapname) == 0 ||
4835 			    strcmp(nvpair_name(prop_err),
4836 			    zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4837 				/*
4838 				 * Skip the special case of, for example,
4839 				 * "refquota", errors on intermediate
4840 				 * snapshots leading up to a final one.
4841 				 * That's why we have all of the checks above.
4842 				 *
4843 				 * See zfs_ioctl.c's extract_delay_props() for
4844 				 * a list of props which can fail on
4845 				 * intermediate snapshots, but shouldn't
4846 				 * affect the overall receive.
4847 				 */
4848 				(void) snprintf(tbuf, sizeof (tbuf),
4849 				    dgettext(TEXT_DOMAIN,
4850 				    "cannot receive %s property on %s"),
4851 				    nvpair_name(prop_err), name);
4852 				zfs_setprop_error(hdl, prop, intval, tbuf);
4853 			}
4854 		}
4855 	}
4856 
4857 	if (err == 0 && snapprops_nvlist) {
4858 		zfs_cmd_t zc = {"\0"};
4859 
4860 		(void) strcpy(zc.zc_name, destsnap);
4861 		zc.zc_cookie = B_TRUE; /* received */
4862 		zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist);
4863 		(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4864 		zcmd_free_nvlists(&zc);
4865 	}
4866 	if (err == 0 && snapholds_nvlist) {
4867 		nvpair_t *pair;
4868 		nvlist_t *holds, *errors = NULL;
4869 		int cleanup_fd = -1;
4870 
4871 		VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4872 		for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4873 		    pair != NULL;
4874 		    pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4875 			fnvlist_add_string(holds, destsnap, nvpair_name(pair));
4876 		}
4877 		(void) lzc_hold(holds, cleanup_fd, &errors);
4878 		fnvlist_free(snapholds_nvlist);
4879 		fnvlist_free(holds);
4880 	}
4881 
4882 	if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4883 		/*
4884 		 * It may be that this snapshot already exists,
4885 		 * in which case we want to consume & ignore it
4886 		 * rather than failing.
4887 		 */
4888 		avl_tree_t *local_avl;
4889 		nvlist_t *local_nv, *fs;
4890 		cp = strchr(destsnap, '@');
4891 
4892 		/*
4893 		 * XXX Do this faster by just iterating over snaps in
4894 		 * this fs.  Also if zc_value does not exist, we will
4895 		 * get a strange "does not exist" error message.
4896 		 */
4897 		*cp = '\0';
4898 		if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4899 		    B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
4900 		    B_TRUE, &local_nv, &local_avl) == 0) {
4901 			*cp = '@';
4902 			fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4903 			fsavl_destroy(local_avl);
4904 			fnvlist_free(local_nv);
4905 
4906 			if (fs != NULL) {
4907 				if (flags->verbose) {
4908 					(void) printf("snap %s already exists; "
4909 					    "ignoring\n", destsnap);
4910 				}
4911 				err = ioctl_err = recv_skip(hdl, infd,
4912 				    flags->byteswap);
4913 			}
4914 		}
4915 		*cp = '@';
4916 	}
4917 
4918 	if (ioctl_err != 0) {
4919 		switch (ioctl_errno) {
4920 		case ENODEV:
4921 			cp = strchr(destsnap, '@');
4922 			*cp = '\0';
4923 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4924 			    "most recent snapshot of %s does not\n"
4925 			    "match incremental source"), destsnap);
4926 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4927 			*cp = '@';
4928 			break;
4929 		case ETXTBSY:
4930 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4931 			    "destination %s has been modified\n"
4932 			    "since most recent snapshot"), name);
4933 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4934 			break;
4935 		case EACCES:
4936 			if (raw && stream_wantsnewfs) {
4937 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4938 				    "failed to create encryption key"));
4939 			} else if (raw && !stream_wantsnewfs) {
4940 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4941 				    "encryption key does not match "
4942 				    "existing key"));
4943 			} else {
4944 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4945 				    "inherited key must be loaded"));
4946 			}
4947 			(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4948 			break;
4949 		case EEXIST:
4950 			cp = strchr(destsnap, '@');
4951 			if (newfs) {
4952 				/* it's the containing fs that exists */
4953 				*cp = '\0';
4954 			}
4955 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4956 			    "destination already exists"));
4957 			(void) zfs_error_fmt(hdl, EZFS_EXISTS,
4958 			    dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4959 			    destsnap);
4960 			*cp = '@';
4961 			break;
4962 		case EINVAL:
4963 			if (flags->resumable) {
4964 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4965 				    "kernel modules must be upgraded to "
4966 				    "receive this stream."));
4967 			} else if (embedded && !raw) {
4968 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4969 				    "incompatible embedded data stream "
4970 				    "feature with encrypted receive."));
4971 			}
4972 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4973 			break;
4974 		case ECKSUM:
4975 		case ZFS_ERR_STREAM_TRUNCATED:
4976 			recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4977 			    ioctl_err == ECKSUM);
4978 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4979 			break;
4980 		case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
4981 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4982 			    "incremental send stream requires -L "
4983 			    "(--large-block), to match previous receive."));
4984 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4985 			break;
4986 		case ENOTSUP:
4987 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4988 			    "pool must be upgraded to receive this stream."));
4989 			(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
4990 			break;
4991 		case EDQUOT:
4992 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4993 			    "destination %s space quota exceeded."), name);
4994 			(void) zfs_error(hdl, EZFS_NOSPC, errbuf);
4995 			break;
4996 		case ZFS_ERR_FROM_IVSET_GUID_MISSING:
4997 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4998 			    "IV set guid missing. See errata %u at "
4999 			    "https://openzfs.github.io/openzfs-docs/msg/"
5000 			    "ZFS-8000-ER."),
5001 			    ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
5002 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5003 			break;
5004 		case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
5005 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5006 			    "IV set guid mismatch. See the 'zfs receive' "
5007 			    "man page section\n discussing the limitations "
5008 			    "of raw encrypted send streams."));
5009 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5010 			break;
5011 		case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
5012 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5013 			    "Spill block flag missing for raw send.\n"
5014 			    "The zfs software on the sending system must "
5015 			    "be updated."));
5016 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5017 			break;
5018 		case EBUSY:
5019 			if (hastoken) {
5020 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5021 				    "destination %s contains "
5022 				    "partially-complete state from "
5023 				    "\"zfs receive -s\"."), name);
5024 				(void) zfs_error(hdl, EZFS_BUSY, errbuf);
5025 				break;
5026 			}
5027 			zfs_fallthrough;
5028 		default:
5029 			(void) zfs_standard_error(hdl, ioctl_errno, errbuf);
5030 		}
5031 	}
5032 
5033 	/*
5034 	 * Mount the target filesystem (if created).  Also mount any
5035 	 * children of the target filesystem if we did a replication
5036 	 * receive (indicated by stream_avl being non-NULL).
5037 	 */
5038 	if (clp) {
5039 		if (!flags->nomount)
5040 			err |= changelist_postfix(clp);
5041 		changelist_free(clp);
5042 	}
5043 
5044 	if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
5045 		flags->domount = B_TRUE;
5046 
5047 	if (prop_errflags & ZPROP_ERR_NOCLEAR) {
5048 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5049 		    "failed to clear unreceived properties on %s"), name);
5050 		(void) fprintf(stderr, "\n");
5051 	}
5052 	if (prop_errflags & ZPROP_ERR_NORESTORE) {
5053 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5054 		    "failed to restore original properties on %s"), name);
5055 		(void) fprintf(stderr, "\n");
5056 	}
5057 
5058 	if (err || ioctl_err) {
5059 		err = -1;
5060 		goto out;
5061 	}
5062 
5063 	if (flags->verbose) {
5064 		char buf1[64];
5065 		char buf2[64];
5066 		uint64_t bytes = read_bytes;
5067 		struct timespec delta;
5068 		clock_gettime(CLOCK_MONOTONIC_RAW, &delta);
5069 		if (begin_time.tv_nsec > delta.tv_nsec) {
5070 			delta.tv_nsec =
5071 			    1000000000 + delta.tv_nsec - begin_time.tv_nsec;
5072 			delta.tv_sec -= 1;
5073 		} else
5074 			delta.tv_nsec -= begin_time.tv_nsec;
5075 		delta.tv_sec -= begin_time.tv_sec;
5076 		if (delta.tv_sec == 0 && delta.tv_nsec == 0)
5077 			delta.tv_nsec = 1;
5078 		double delta_f = delta.tv_sec + (delta.tv_nsec / 1e9);
5079 		zfs_nicebytes(bytes, buf1, sizeof (buf1));
5080 		zfs_nicebytes(bytes / delta_f, buf2, sizeof (buf2));
5081 
5082 		(void) printf("received %s stream in %.2f seconds (%s/sec)\n",
5083 		    buf1, delta_f, buf2);
5084 	}
5085 
5086 	err = 0;
5087 out:
5088 	if (prop_errors != NULL)
5089 		fnvlist_free(prop_errors);
5090 
5091 	if (tmp_keylocation[0] != '\0') {
5092 		fnvlist_add_string(rcvprops,
5093 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
5094 	}
5095 
5096 	if (newprops)
5097 		fnvlist_free(rcvprops);
5098 
5099 	fnvlist_free(oxprops);
5100 	fnvlist_free(origprops);
5101 
5102 	return (err);
5103 }
5104 
5105 /*
5106  * Check properties we were asked to override (both -o|-x)
5107  */
5108 static boolean_t
5109 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
5110     const char *errbuf)
5111 {
5112 	nvpair_t *nvp = NULL;
5113 	zfs_prop_t prop;
5114 	const char *name;
5115 
5116 	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
5117 		name = nvpair_name(nvp);
5118 		prop = zfs_name_to_prop(name);
5119 
5120 		if (prop == ZPROP_USERPROP) {
5121 			if (!zfs_prop_user(name)) {
5122 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5123 				    "%s: invalid property '%s'"), errbuf, name);
5124 				return (B_FALSE);
5125 			}
5126 			continue;
5127 		}
5128 		/*
5129 		 * "origin" is readonly but is used to receive datasets as
5130 		 * clones so we don't raise an error here
5131 		 */
5132 		if (prop == ZFS_PROP_ORIGIN)
5133 			continue;
5134 
5135 		/* encryption params have their own verification later */
5136 		if (prop == ZFS_PROP_ENCRYPTION ||
5137 		    zfs_prop_encryption_key_param(prop))
5138 			continue;
5139 
5140 		/*
5141 		 * cannot override readonly, set-once and other specific
5142 		 * settable properties
5143 		 */
5144 		if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5145 		    prop == ZFS_PROP_VOLSIZE) {
5146 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5147 			    "%s: invalid property '%s'"), errbuf, name);
5148 			return (B_FALSE);
5149 		}
5150 	}
5151 
5152 	return (B_TRUE);
5153 }
5154 
5155 static int
5156 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5157     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5158     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5159     const char *finalsnap, nvlist_t *cmdprops)
5160 {
5161 	int err;
5162 	dmu_replay_record_t drr, drr_noswap;
5163 	struct drr_begin *drrb = &drr.drr_u.drr_begin;
5164 	char errbuf[ERRBUFLEN];
5165 	zio_cksum_t zcksum = { { 0 } };
5166 	uint64_t featureflags;
5167 	int hdrtype;
5168 
5169 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5170 	    "cannot receive"));
5171 
5172 	/* check cmdline props, raise an error if they cannot be received */
5173 	if (!zfs_receive_checkprops(hdl, cmdprops, errbuf))
5174 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5175 
5176 	if (flags->isprefix &&
5177 	    !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5178 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5179 		    "(%s) does not exist"), tosnap);
5180 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5181 	}
5182 	if (originsnap &&
5183 	    !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5184 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5185 		    "(%s) does not exist"), originsnap);
5186 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5187 	}
5188 
5189 	/* read in the BEGIN record */
5190 	if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5191 	    &zcksum)))
5192 		return (err);
5193 
5194 	if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5195 		/* It's the double end record at the end of a package */
5196 		return (ENODATA);
5197 	}
5198 
5199 	/* the kernel needs the non-byteswapped begin record */
5200 	drr_noswap = drr;
5201 
5202 	flags->byteswap = B_FALSE;
5203 	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5204 		/*
5205 		 * We computed the checksum in the wrong byteorder in
5206 		 * recv_read() above; do it again correctly.
5207 		 */
5208 		memset(&zcksum, 0, sizeof (zio_cksum_t));
5209 		fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5210 		flags->byteswap = B_TRUE;
5211 
5212 		drr.drr_type = BSWAP_32(drr.drr_type);
5213 		drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5214 		drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5215 		drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5216 		drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5217 		drrb->drr_type = BSWAP_32(drrb->drr_type);
5218 		drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5219 		drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5220 		drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5221 	}
5222 
5223 	if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5224 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5225 		    "stream (bad magic number)"));
5226 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5227 	}
5228 
5229 	featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5230 	hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5231 
5232 	if (!DMU_STREAM_SUPPORTED(featureflags) ||
5233 	    (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5234 		/*
5235 		 * Let's be explicit about this one, since rather than
5236 		 * being a new feature we can't know, it's an old
5237 		 * feature we dropped.
5238 		 */
5239 		if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5240 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5241 			    "stream has deprecated feature: dedup, try "
5242 			    "'zstream redup [send in a file] | zfs recv "
5243 			    "[...]'"));
5244 		} else {
5245 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5246 			    "stream has unsupported feature, feature flags = "
5247 			    "%llx (unknown flags = %llx)"),
5248 			    (u_longlong_t)featureflags,
5249 			    (u_longlong_t)((featureflags) &
5250 			    ~DMU_BACKUP_FEATURE_MASK));
5251 		}
5252 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5253 	}
5254 
5255 	/* Holds feature is set once in the compound stream header. */
5256 	if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5257 		flags->holds = B_TRUE;
5258 
5259 	if (strchr(drrb->drr_toname, '@') == NULL) {
5260 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5261 		    "stream (bad snapshot name)"));
5262 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5263 	}
5264 
5265 	if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5266 		char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5267 		if (sendfs == NULL) {
5268 			/*
5269 			 * We were not called from zfs_receive_package(). Get
5270 			 * the fs specified by 'zfs send'.
5271 			 */
5272 			char *cp;
5273 			(void) strlcpy(nonpackage_sendfs,
5274 			    drr.drr_u.drr_begin.drr_toname,
5275 			    sizeof (nonpackage_sendfs));
5276 			if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5277 				*cp = '\0';
5278 			sendfs = nonpackage_sendfs;
5279 			VERIFY(finalsnap == NULL);
5280 		}
5281 		return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5282 		    &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5283 		    finalsnap, cmdprops));
5284 	} else {
5285 		assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5286 		    DMU_COMPOUNDSTREAM);
5287 		return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5288 		    &zcksum, top_zfs, cmdprops));
5289 	}
5290 }
5291 
5292 /*
5293  * Restores a backup of tosnap from the file descriptor specified by infd.
5294  * Return 0 on total success, -2 if some things couldn't be
5295  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5296  * (-1 will override -2, if -1 and the resumable flag was specified the
5297  * transfer can be resumed if the sending side supports it).
5298  */
5299 int
5300 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5301     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5302 {
5303 	char *top_zfs = NULL;
5304 	int err;
5305 	struct stat sb;
5306 	char *originsnap = NULL;
5307 
5308 	/*
5309 	 * The only way fstat can fail is if we do not have a valid file
5310 	 * descriptor.
5311 	 */
5312 	if (fstat(infd, &sb) == -1) {
5313 		perror("fstat");
5314 		return (-2);
5315 	}
5316 
5317 	if (props) {
5318 		err = nvlist_lookup_string(props, "origin", &originsnap);
5319 		if (err && err != ENOENT)
5320 			return (err);
5321 	}
5322 
5323 	err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5324 	    stream_avl, &top_zfs, NULL, props);
5325 
5326 	if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5327 		zfs_handle_t *zhp = NULL;
5328 		prop_changelist_t *clp = NULL;
5329 
5330 		zhp = zfs_open(hdl, top_zfs,
5331 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5332 		if (zhp == NULL) {
5333 			err = -1;
5334 			goto out;
5335 		} else {
5336 			if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5337 				zfs_close(zhp);
5338 				goto out;
5339 			}
5340 
5341 			clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5342 			    CL_GATHER_MOUNT_ALWAYS,
5343 			    flags->forceunmount ? MS_FORCE : 0);
5344 			zfs_close(zhp);
5345 			if (clp == NULL) {
5346 				err = -1;
5347 				goto out;
5348 			}
5349 
5350 			/* mount and share received datasets */
5351 			err = changelist_postfix(clp);
5352 			changelist_free(clp);
5353 			if (err != 0)
5354 				err = -1;
5355 		}
5356 	}
5357 
5358 out:
5359 	if (top_zfs)
5360 		free(top_zfs);
5361 
5362 	return (err);
5363 }
5364