xref: /freebsd/sys/contrib/openzfs/lib/libzfs/libzfs_sendrecv.c (revision cc1a53bc1aea0675d64e9547cdca241612906592)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
27  * All rights reserved
28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
32  * Copyright (c) 2019 Datto Inc.
33  */
34 
35 #include <assert.h>
36 #include <ctype.h>
37 #include <errno.h>
38 #include <libintl.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <unistd.h>
43 #include <stddef.h>
44 #include <fcntl.h>
45 #include <sys/mount.h>
46 #include <sys/mntent.h>
47 #include <sys/mnttab.h>
48 #include <sys/avl.h>
49 #include <sys/debug.h>
50 #include <sys/stat.h>
51 #include <pthread.h>
52 #include <umem.h>
53 #include <time.h>
54 
55 #include <libzfs.h>
56 #include <libzfs_core.h>
57 #include <libzutil.h>
58 
59 #include "zfs_namecheck.h"
60 #include "zfs_prop.h"
61 #include "zfs_fletcher.h"
62 #include "libzfs_impl.h"
63 #include <cityhash.h>
64 #include <zlib.h>
65 #include <sys/zio_checksum.h>
66 #include <sys/dsl_crypt.h>
67 #include <sys/ddt.h>
68 #include <sys/socket.h>
69 #include <sys/sha2.h>
70 
71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
73     const char *, nvlist_t *);
74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
76     uint64_t num_redact_snaps, char *name);
77 static int guid_to_name(libzfs_handle_t *, const char *,
78     uint64_t, boolean_t, char *);
79 
80 typedef struct progress_arg {
81 	zfs_handle_t *pa_zhp;
82 	int pa_fd;
83 	boolean_t pa_parsable;
84 	boolean_t pa_estimate;
85 	int pa_verbosity;
86 } progress_arg_t;
87 
88 static int
89 dump_record(dmu_replay_record_t *drr, void *payload, size_t payload_len,
90     zio_cksum_t *zc, int outfd)
91 {
92 	ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
93 	    ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
94 	fletcher_4_incremental_native(drr,
95 	    offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
96 	if (drr->drr_type != DRR_BEGIN) {
97 		ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
98 		    drr_checksum.drr_checksum));
99 		drr->drr_u.drr_checksum.drr_checksum = *zc;
100 	}
101 	fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
102 	    sizeof (zio_cksum_t), zc);
103 	if (write(outfd, drr, sizeof (*drr)) == -1)
104 		return (errno);
105 	if (payload_len != 0) {
106 		fletcher_4_incremental_native(payload, payload_len, zc);
107 		if (write(outfd, payload, payload_len) == -1)
108 			return (errno);
109 	}
110 	return (0);
111 }
112 
113 /*
114  * Routines for dealing with the AVL tree of fs-nvlists
115  */
116 typedef struct fsavl_node {
117 	avl_node_t fn_node;
118 	nvlist_t *fn_nvfs;
119 	char *fn_snapname;
120 	uint64_t fn_guid;
121 } fsavl_node_t;
122 
123 static int
124 fsavl_compare(const void *arg1, const void *arg2)
125 {
126 	const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
127 	const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
128 
129 	return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
130 }
131 
132 /*
133  * Given the GUID of a snapshot, find its containing filesystem and
134  * (optionally) name.
135  */
136 static nvlist_t *
137 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
138 {
139 	fsavl_node_t fn_find;
140 	fsavl_node_t *fn;
141 
142 	fn_find.fn_guid = snapguid;
143 
144 	fn = avl_find(avl, &fn_find, NULL);
145 	if (fn) {
146 		if (snapname)
147 			*snapname = fn->fn_snapname;
148 		return (fn->fn_nvfs);
149 	}
150 	return (NULL);
151 }
152 
153 static void
154 fsavl_destroy(avl_tree_t *avl)
155 {
156 	fsavl_node_t *fn;
157 	void *cookie;
158 
159 	if (avl == NULL)
160 		return;
161 
162 	cookie = NULL;
163 	while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
164 		free(fn);
165 	avl_destroy(avl);
166 	free(avl);
167 }
168 
169 /*
170  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
171  */
172 static avl_tree_t *
173 fsavl_create(nvlist_t *fss)
174 {
175 	avl_tree_t *fsavl;
176 	nvpair_t *fselem = NULL;
177 
178 	if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
179 		return (NULL);
180 
181 	avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
182 	    offsetof(fsavl_node_t, fn_node));
183 
184 	while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
185 		nvlist_t *nvfs, *snaps;
186 		nvpair_t *snapelem = NULL;
187 
188 		nvfs = fnvpair_value_nvlist(fselem);
189 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
190 
191 		while ((snapelem =
192 		    nvlist_next_nvpair(snaps, snapelem)) != NULL) {
193 			fsavl_node_t *fn;
194 
195 			if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
196 				fsavl_destroy(fsavl);
197 				return (NULL);
198 			}
199 			fn->fn_nvfs = nvfs;
200 			fn->fn_snapname = nvpair_name(snapelem);
201 			fn->fn_guid = fnvpair_value_uint64(snapelem);
202 
203 			/*
204 			 * Note: if there are multiple snaps with the
205 			 * same GUID, we ignore all but one.
206 			 */
207 			avl_index_t where = 0;
208 			if (avl_find(fsavl, fn, &where) == NULL)
209 				avl_insert(fsavl, fn, where);
210 			else
211 				free(fn);
212 		}
213 	}
214 
215 	return (fsavl);
216 }
217 
218 /*
219  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
220  */
221 typedef struct send_data {
222 	/*
223 	 * assigned inside every recursive call,
224 	 * restored from *_save on return:
225 	 *
226 	 * guid of fromsnap snapshot in parent dataset
227 	 * txg of fromsnap snapshot in current dataset
228 	 * txg of tosnap snapshot in current dataset
229 	 */
230 
231 	uint64_t parent_fromsnap_guid;
232 	uint64_t fromsnap_txg;
233 	uint64_t tosnap_txg;
234 
235 	/* the nvlists get accumulated during depth-first traversal */
236 	nvlist_t *parent_snaps;
237 	nvlist_t *fss;
238 	nvlist_t *snapprops;
239 	nvlist_t *snapholds;	/* user holds */
240 
241 	/* send-receive configuration, does not change during traversal */
242 	const char *fsname;
243 	const char *fromsnap;
244 	const char *tosnap;
245 	boolean_t recursive;
246 	boolean_t raw;
247 	boolean_t doall;
248 	boolean_t replicate;
249 	boolean_t skipmissing;
250 	boolean_t verbose;
251 	boolean_t backup;
252 	boolean_t seenfrom;
253 	boolean_t seento;
254 	boolean_t holds;	/* were holds requested with send -h */
255 	boolean_t props;
256 
257 	/*
258 	 * The header nvlist is of the following format:
259 	 * {
260 	 *   "tosnap" -> string
261 	 *   "fromsnap" -> string (if incremental)
262 	 *   "fss" -> {
263 	 *	id -> {
264 	 *
265 	 *	 "name" -> string (full name; for debugging)
266 	 *	 "parentfromsnap" -> number (guid of fromsnap in parent)
267 	 *
268 	 *	 "props" -> { name -> value (only if set here) }
269 	 *	 "snaps" -> { name (lastname) -> number (guid) }
270 	 *	 "snapprops" -> { name (lastname) -> { name -> value } }
271 	 *	 "snapholds" -> { name (lastname) -> { holdname -> crtime } }
272 	 *
273 	 *	 "origin" -> number (guid) (if clone)
274 	 *	 "is_encroot" -> boolean
275 	 *	 "sent" -> boolean (not on-disk)
276 	 *	}
277 	 *   }
278 	 * }
279 	 *
280 	 */
281 } send_data_t;
282 
283 static void
284 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
285 
286 /*
287  * Collect guid, valid props, optionally holds, etc. of a snapshot.
288  * This interface is intended for use as a zfs_iter_snapshots_sorted visitor.
289  */
290 static int
291 send_iterate_snap(zfs_handle_t *zhp, void *arg)
292 {
293 	send_data_t *sd = arg;
294 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
295 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
296 	boolean_t isfromsnap, istosnap, istosnapwithnofrom;
297 	char *snapname;
298 	const char *from = sd->fromsnap;
299 	const char *to = sd->tosnap;
300 
301 	snapname = strrchr(zhp->zfs_name, '@');
302 	assert(snapname != NULL);
303 	++snapname;
304 
305 	isfromsnap = (from != NULL && strcmp(from, snapname) == 0);
306 	istosnap = (to != NULL && strcmp(to, snapname) == 0);
307 	istosnapwithnofrom = (istosnap && from == NULL);
308 
309 	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
310 		if (sd->verbose) {
311 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
312 			    "skipping snapshot %s because it was created "
313 			    "after the destination snapshot (%s)\n"),
314 			    zhp->zfs_name, to);
315 		}
316 		zfs_close(zhp);
317 		return (0);
318 	}
319 
320 	fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
321 
322 	/*
323 	 * NB: if there is no fromsnap here (it's a newly created fs in
324 	 * an incremental replication), we will substitute the tosnap.
325 	 */
326 	if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap))
327 		sd->parent_fromsnap_guid = guid;
328 
329 	if (!sd->recursive) {
330 		/*
331 		 * To allow a doall stream to work properly
332 		 * with a NULL fromsnap
333 		 */
334 		if (sd->doall && from == NULL && !sd->seenfrom)
335 			sd->seenfrom = B_TRUE;
336 
337 		if (!sd->seenfrom && isfromsnap) {
338 			sd->seenfrom = B_TRUE;
339 			zfs_close(zhp);
340 			return (0);
341 		}
342 
343 		if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
344 			zfs_close(zhp);
345 			return (0);
346 		}
347 
348 		if (istosnap)
349 			sd->seento = B_TRUE;
350 	}
351 
352 	nvlist_t *nv = fnvlist_alloc();
353 	send_iterate_prop(zhp, sd->backup, nv);
354 	fnvlist_add_nvlist(sd->snapprops, snapname, nv);
355 	fnvlist_free(nv);
356 
357 	if (sd->holds) {
358 		nvlist_t *holds;
359 		if (lzc_get_holds(zhp->zfs_name, &holds) == 0) {
360 			fnvlist_add_nvlist(sd->snapholds, snapname, holds);
361 			fnvlist_free(holds);
362 		}
363 	}
364 
365 	zfs_close(zhp);
366 	return (0);
367 }
368 
369 /*
370  * Collect all valid props from the handle snap into an nvlist.
371  */
372 static void
373 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
374 {
375 	nvlist_t *props;
376 
377 	if (received_only)
378 		props = zfs_get_recvd_props(zhp);
379 	else
380 		props = zhp->zfs_props;
381 
382 	nvpair_t *elem = NULL;
383 	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
384 		char *propname = nvpair_name(elem);
385 		zfs_prop_t prop = zfs_name_to_prop(propname);
386 
387 		if (!zfs_prop_user(propname)) {
388 			/*
389 			 * Realistically, this should never happen.  However,
390 			 * we want the ability to add DSL properties without
391 			 * needing to make incompatible version changes.  We
392 			 * need to ignore unknown properties to allow older
393 			 * software to still send datasets containing these
394 			 * properties, with the unknown properties elided.
395 			 */
396 			if (prop == ZPROP_INVAL)
397 				continue;
398 
399 			if (zfs_prop_readonly(prop))
400 				continue;
401 		}
402 
403 		nvlist_t *propnv = fnvpair_value_nvlist(elem);
404 
405 		boolean_t isspacelimit = (prop == ZFS_PROP_QUOTA ||
406 		    prop == ZFS_PROP_RESERVATION ||
407 		    prop == ZFS_PROP_REFQUOTA ||
408 		    prop == ZFS_PROP_REFRESERVATION);
409 		if (isspacelimit && zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
410 			continue;
411 
412 		char *source;
413 		if (nvlist_lookup_string(propnv, ZPROP_SOURCE, &source) == 0) {
414 			if (strcmp(source, zhp->zfs_name) != 0 &&
415 			    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
416 				continue;
417 		} else {
418 			/*
419 			 * May have no source before SPA_VERSION_RECVD_PROPS,
420 			 * but is still modifiable.
421 			 */
422 			if (!isspacelimit)
423 				continue;
424 		}
425 
426 		if (zfs_prop_user(propname) ||
427 		    zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
428 			char *value;
429 			value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
430 			fnvlist_add_string(nv, propname, value);
431 		} else {
432 			uint64_t value;
433 			value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
434 			fnvlist_add_uint64(nv, propname, value);
435 		}
436 	}
437 }
438 
439 /*
440  * returns snapshot creation txg
441  * and returns 0 if the snapshot does not exist
442  */
443 static uint64_t
444 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
445 {
446 	char name[ZFS_MAX_DATASET_NAME_LEN];
447 	uint64_t txg = 0;
448 
449 	if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
450 		return (txg);
451 
452 	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
453 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
454 		zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
455 		if (zhp != NULL) {
456 			txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
457 			zfs_close(zhp);
458 		}
459 	}
460 
461 	return (txg);
462 }
463 
464 /*
465  * Recursively generate nvlists describing datasets.  See comment
466  * for the data structure send_data_t above for description of contents
467  * of the nvlist.
468  */
469 static int
470 send_iterate_fs(zfs_handle_t *zhp, void *arg)
471 {
472 	send_data_t *sd = arg;
473 	nvlist_t *nvfs = NULL, *nv = NULL;
474 	int rv = 0;
475 	uint64_t min_txg = 0, max_txg = 0;
476 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
477 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
478 	uint64_t fromsnap_txg, tosnap_txg;
479 	char guidstring[64];
480 
481 	/* These fields are restored on return from a recursive call. */
482 	uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
483 	uint64_t fromsnap_txg_save = sd->fromsnap_txg;
484 	uint64_t tosnap_txg_save = sd->tosnap_txg;
485 
486 	fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
487 	if (fromsnap_txg != 0)
488 		sd->fromsnap_txg = fromsnap_txg;
489 
490 	tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
491 	if (tosnap_txg != 0)
492 		sd->tosnap_txg = tosnap_txg;
493 
494 	/*
495 	 * On the send side, if the current dataset does not have tosnap,
496 	 * perform two additional checks:
497 	 *
498 	 * - Skip sending the current dataset if it was created later than
499 	 *   the parent tosnap.
500 	 * - Return error if the current dataset was created earlier than
501 	 *   the parent tosnap, unless --skip-missing specified. Then
502 	 *   just print a warning.
503 	 */
504 	if (sd->tosnap != NULL && tosnap_txg == 0) {
505 		if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
506 			if (sd->verbose) {
507 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
508 				    "skipping dataset %s: snapshot %s does "
509 				    "not exist\n"), zhp->zfs_name, sd->tosnap);
510 			}
511 		} else if (sd->skipmissing) {
512 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
513 			    "WARNING: skipping dataset %s and its children:"
514 			    " snapshot %s does not exist\n"),
515 			    zhp->zfs_name, sd->tosnap);
516 		} else {
517 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
518 			    "cannot send %s@%s%s: snapshot %s@%s does not "
519 			    "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
520 			    dgettext(TEXT_DOMAIN, " recursively") : "",
521 			    zhp->zfs_name, sd->tosnap);
522 			rv = EZFS_NOENT;
523 		}
524 		goto out;
525 	}
526 
527 	nvfs = fnvlist_alloc();
528 	fnvlist_add_string(nvfs, "name", zhp->zfs_name);
529 	fnvlist_add_uint64(nvfs, "parentfromsnap", sd->parent_fromsnap_guid);
530 
531 	if (zhp->zfs_dmustats.dds_origin[0] != '\0') {
532 		zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
533 		    zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
534 		if (origin == NULL) {
535 			rv = -1;
536 			goto out;
537 		}
538 		fnvlist_add_uint64(nvfs, "origin",
539 		    origin->zfs_dmustats.dds_guid);
540 		zfs_close(origin);
541 	}
542 
543 	/* Iterate over props. */
544 	if (sd->props || sd->backup || sd->recursive) {
545 		nv = fnvlist_alloc();
546 		send_iterate_prop(zhp, sd->backup, nv);
547 		fnvlist_add_nvlist(nvfs, "props", nv);
548 	}
549 	if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
550 		boolean_t encroot;
551 
552 		/* Determine if this dataset is an encryption root. */
553 		if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
554 			rv = -1;
555 			goto out;
556 		}
557 
558 		if (encroot)
559 			fnvlist_add_boolean(nvfs, "is_encroot");
560 
561 		/*
562 		 * Encrypted datasets can only be sent with properties if
563 		 * the raw flag is specified because the receive side doesn't
564 		 * currently have a mechanism for recursively asking the user
565 		 * for new encryption parameters.
566 		 */
567 		if (!sd->raw) {
568 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
569 			    "cannot send %s@%s: encrypted dataset %s may not "
570 			    "be sent with properties without the raw flag\n"),
571 			    sd->fsname, sd->tosnap, zhp->zfs_name);
572 			rv = -1;
573 			goto out;
574 		}
575 
576 	}
577 
578 	/*
579 	 * Iterate over snaps, and set sd->parent_fromsnap_guid.
580 	 *
581 	 * If this is a "doall" send, a replicate send or we're just trying
582 	 * to gather a list of previous snapshots, iterate through all the
583 	 * snaps in the txg range. Otherwise just look at the one we're
584 	 * interested in.
585 	 */
586 	sd->parent_fromsnap_guid = 0;
587 	sd->parent_snaps = fnvlist_alloc();
588 	sd->snapprops = fnvlist_alloc();
589 	if (sd->holds)
590 		sd->snapholds = fnvlist_alloc();
591 	if (sd->doall || sd->replicate || sd->tosnap == NULL) {
592 		if (!sd->replicate && fromsnap_txg != 0)
593 			min_txg = fromsnap_txg;
594 		if (!sd->replicate && tosnap_txg != 0)
595 			max_txg = tosnap_txg;
596 		(void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
597 		    min_txg, max_txg);
598 	} else {
599 		char snapname[MAXPATHLEN];
600 		zfs_handle_t *snap;
601 
602 		(void) snprintf(snapname, sizeof (snapname), "%s@%s",
603 		    zhp->zfs_name, sd->tosnap);
604 		if (sd->fromsnap != NULL)
605 			sd->seenfrom = B_TRUE;
606 		snap = zfs_open(zhp->zfs_hdl, snapname, ZFS_TYPE_SNAPSHOT);
607 		if (snap != NULL)
608 			(void) send_iterate_snap(snap, sd);
609 	}
610 
611 	fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
612 	fnvlist_free(sd->parent_snaps);
613 	fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
614 	fnvlist_free(sd->snapprops);
615 	if (sd->holds) {
616 		fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
617 		fnvlist_free(sd->snapholds);
618 	}
619 
620 	/* Do not allow the size of the properties list to exceed the limit */
621 	if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
622 	    zhp->zfs_hdl->libzfs_max_nvlist) {
623 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
624 		    "warning: cannot send %s@%s: the size of the list of "
625 		    "snapshots and properties is too large to be received "
626 		    "successfully.\n"
627 		    "Select a smaller number of snapshots to send.\n"),
628 		    zhp->zfs_name, sd->tosnap);
629 		rv = EZFS_NOSPC;
630 		goto out;
631 	}
632 	/* Add this fs to nvlist. */
633 	(void) snprintf(guidstring, sizeof (guidstring),
634 	    "0x%llx", (longlong_t)guid);
635 	fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
636 
637 	/* Iterate over children. */
638 	if (sd->recursive)
639 		rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
640 
641 out:
642 	/* Restore saved fields. */
643 	sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
644 	sd->fromsnap_txg = fromsnap_txg_save;
645 	sd->tosnap_txg = tosnap_txg_save;
646 
647 	fnvlist_free(nv);
648 	fnvlist_free(nvfs);
649 
650 	zfs_close(zhp);
651 	return (rv);
652 }
653 
654 static int
655 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
656     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
657     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
658     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
659     avl_tree_t **avlp)
660 {
661 	zfs_handle_t *zhp;
662 	send_data_t sd = { 0 };
663 	int error;
664 
665 	zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
666 	if (zhp == NULL)
667 		return (EZFS_BADTYPE);
668 
669 	sd.fss = fnvlist_alloc();
670 	sd.fsname = fsname;
671 	sd.fromsnap = fromsnap;
672 	sd.tosnap = tosnap;
673 	sd.recursive = recursive;
674 	sd.raw = raw;
675 	sd.doall = doall;
676 	sd.replicate = replicate;
677 	sd.skipmissing = skipmissing;
678 	sd.verbose = verbose;
679 	sd.backup = backup;
680 	sd.holds = holds;
681 	sd.props = props;
682 
683 	if ((error = send_iterate_fs(zhp, &sd)) != 0) {
684 		fnvlist_free(sd.fss);
685 		if (avlp != NULL)
686 			*avlp = NULL;
687 		*nvlp = NULL;
688 		return (error);
689 	}
690 
691 	if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
692 		fnvlist_free(sd.fss);
693 		*nvlp = NULL;
694 		return (EZFS_NOMEM);
695 	}
696 
697 	*nvlp = sd.fss;
698 	return (0);
699 }
700 
701 /*
702  * Routines specific to "zfs send"
703  */
704 typedef struct send_dump_data {
705 	/* these are all just the short snapname (the part after the @) */
706 	const char *fromsnap;
707 	const char *tosnap;
708 	char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
709 	uint64_t prevsnap_obj;
710 	boolean_t seenfrom, seento, replicate, doall, fromorigin;
711 	boolean_t dryrun, parsable, progress, embed_data, std_out;
712 	boolean_t large_block, compress, raw, holds;
713 	int outfd;
714 	boolean_t err;
715 	nvlist_t *fss;
716 	nvlist_t *snapholds;
717 	avl_tree_t *fsavl;
718 	snapfilter_cb_t *filter_cb;
719 	void *filter_cb_arg;
720 	nvlist_t *debugnv;
721 	char holdtag[ZFS_MAX_DATASET_NAME_LEN];
722 	int cleanup_fd;
723 	int verbosity;
724 	uint64_t size;
725 } send_dump_data_t;
726 
727 static int
728 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
729     enum lzc_send_flags flags, uint64_t *spacep)
730 {
731 	assert(snapname != NULL);
732 
733 	int error = lzc_send_space(snapname, from, flags, spacep);
734 	if (error == 0)
735 		return (0);
736 
737 	char errbuf[1024];
738 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
739 	    "warning: cannot estimate space for '%s'"), snapname);
740 
741 	libzfs_handle_t *hdl = zhp->zfs_hdl;
742 	switch (error) {
743 	case EXDEV:
744 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
745 		    "not an earlier snapshot from the same fs"));
746 		return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
747 
748 	case ENOENT:
749 		if (zfs_dataset_exists(hdl, snapname,
750 		    ZFS_TYPE_SNAPSHOT)) {
751 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
752 			    "incremental source (%s) does not exist"),
753 			    snapname);
754 		}
755 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
756 
757 	case EDQUOT:
758 	case EFBIG:
759 	case EIO:
760 	case ENOLINK:
761 	case ENOSPC:
762 	case ENOSTR:
763 	case ENXIO:
764 	case EPIPE:
765 	case ERANGE:
766 	case EFAULT:
767 	case EROFS:
768 	case EINVAL:
769 		zfs_error_aux(hdl, "%s", strerror(error));
770 		return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
771 
772 	default:
773 		return (zfs_standard_error(hdl, error, errbuf));
774 	}
775 }
776 
777 /*
778  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
779  * NULL) to the file descriptor specified by outfd.
780  */
781 static int
782 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
783     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
784     nvlist_t *debugnv)
785 {
786 	zfs_cmd_t zc = {"\0"};
787 	libzfs_handle_t *hdl = zhp->zfs_hdl;
788 	nvlist_t *thisdbg;
789 
790 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
791 	assert(fromsnap_obj == 0 || !fromorigin);
792 
793 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
794 	zc.zc_cookie = outfd;
795 	zc.zc_obj = fromorigin;
796 	zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
797 	zc.zc_fromobj = fromsnap_obj;
798 	zc.zc_flags = flags;
799 
800 	if (debugnv != NULL) {
801 		thisdbg = fnvlist_alloc();
802 		if (fromsnap != NULL && fromsnap[0] != '\0')
803 			fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
804 	}
805 
806 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
807 		char errbuf[1024];
808 		int error = errno;
809 
810 		(void) snprintf(errbuf, sizeof (errbuf), "%s '%s'",
811 		    dgettext(TEXT_DOMAIN, "warning: cannot send"),
812 		    zhp->zfs_name);
813 
814 		if (debugnv != NULL) {
815 			fnvlist_add_uint64(thisdbg, "error", error);
816 			fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
817 			fnvlist_free(thisdbg);
818 		}
819 
820 		switch (error) {
821 		case EXDEV:
822 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
823 			    "not an earlier snapshot from the same fs"));
824 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
825 
826 		case EACCES:
827 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
828 			    "source key must be loaded"));
829 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
830 
831 		case ENOENT:
832 			if (zfs_dataset_exists(hdl, zc.zc_name,
833 			    ZFS_TYPE_SNAPSHOT)) {
834 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
835 				    "incremental source (@%s) does not exist"),
836 				    zc.zc_value);
837 			}
838 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
839 
840 		case EDQUOT:
841 		case EFBIG:
842 		case EIO:
843 		case ENOLINK:
844 		case ENOSPC:
845 		case ENOSTR:
846 		case ENXIO:
847 		case EPIPE:
848 		case ERANGE:
849 		case EFAULT:
850 		case EROFS:
851 		case EINVAL:
852 			zfs_error_aux(hdl, "%s", strerror(errno));
853 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
854 
855 		default:
856 			return (zfs_standard_error(hdl, errno, errbuf));
857 		}
858 	}
859 
860 	if (debugnv != NULL) {
861 		fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
862 		fnvlist_free(thisdbg);
863 	}
864 
865 	return (0);
866 }
867 
868 static void
869 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
870 {
871 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
872 
873 	/*
874 	 * zfs_send() only sets snapholds for sends that need them,
875 	 * e.g. replication and doall.
876 	 */
877 	if (sdd->snapholds == NULL)
878 		return;
879 
880 	fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
881 }
882 
883 int
884 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
885     uint64_t *blocks_visited)
886 {
887 	zfs_cmd_t zc = {"\0"};
888 
889 	if (bytes_written != NULL)
890 		*bytes_written = 0;
891 	if (blocks_visited != NULL)
892 		*blocks_visited = 0;
893 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
894 	zc.zc_cookie = fd;
895 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
896 		return (errno);
897 	if (bytes_written != NULL)
898 		*bytes_written = zc.zc_cookie;
899 	if (blocks_visited != NULL)
900 		*blocks_visited = zc.zc_objset_type;
901 	return (0);
902 }
903 
904 static void *
905 send_progress_thread(void *arg)
906 {
907 	progress_arg_t *pa = arg;
908 	zfs_handle_t *zhp = pa->pa_zhp;
909 	uint64_t bytes;
910 	uint64_t blocks;
911 	char buf[16];
912 	time_t t;
913 	struct tm *tm;
914 	int err;
915 
916 	if (!pa->pa_parsable) {
917 		(void) fprintf(stderr,
918 		    "TIME       %s   %sSNAPSHOT %s\n",
919 		    pa->pa_estimate ? "BYTES" : " SENT",
920 		    pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
921 		    zhp->zfs_name);
922 	}
923 
924 	/*
925 	 * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
926 	 */
927 	for (;;) {
928 		(void) sleep(1);
929 		if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
930 		    &blocks)) != 0) {
931 			if (err == EINTR || err == ENOENT)
932 				return ((void *)0);
933 			return ((void *)(uintptr_t)err);
934 		}
935 
936 		(void) time(&t);
937 		tm = localtime(&t);
938 
939 		if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
940 			(void) fprintf(stderr,
941 			    "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
942 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
943 			    (u_longlong_t)bytes, (u_longlong_t)blocks,
944 			    zhp->zfs_name);
945 		} else if (pa->pa_verbosity >= 2) {
946 			zfs_nicenum(bytes, buf, sizeof (buf));
947 			(void) fprintf(stderr,
948 			    "%02d:%02d:%02d   %5s    %8llu    %s\n",
949 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
950 			    buf, (u_longlong_t)blocks, zhp->zfs_name);
951 		} else if (pa->pa_parsable) {
952 			(void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
953 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
954 			    (u_longlong_t)bytes, zhp->zfs_name);
955 		} else {
956 			zfs_nicebytes(bytes, buf, sizeof (buf));
957 			(void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
958 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
959 			    buf, zhp->zfs_name);
960 		}
961 	}
962 }
963 
964 static void
965 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
966     uint64_t size, boolean_t parsable)
967 {
968 	if (parsable) {
969 		if (fromsnap != NULL) {
970 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
971 			    "incremental\t%s\t%s"), fromsnap, tosnap);
972 		} else {
973 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
974 			    "full\t%s"), tosnap);
975 		}
976 		(void) fprintf(fout, "\t%llu", (longlong_t)size);
977 	} else {
978 		if (fromsnap != NULL) {
979 			if (strchr(fromsnap, '@') == NULL &&
980 			    strchr(fromsnap, '#') == NULL) {
981 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
982 				    "send from @%s to %s"), fromsnap, tosnap);
983 			} else {
984 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
985 				    "send from %s to %s"), fromsnap, tosnap);
986 			}
987 		} else {
988 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
989 			    "full send of %s"), tosnap);
990 		}
991 		if (size != 0) {
992 			char buf[16];
993 			zfs_nicebytes(size, buf, sizeof (buf));
994 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
995 			    " estimated size is %s"), buf);
996 		}
997 	}
998 	(void) fprintf(fout, "\n");
999 }
1000 
1001 /*
1002  * Send a single filesystem snapshot, updating the send dump data.
1003  * This interface is intended for use as a zfs_iter_snapshots_sorted visitor.
1004  */
1005 static int
1006 dump_snapshot(zfs_handle_t *zhp, void *arg)
1007 {
1008 	send_dump_data_t *sdd = arg;
1009 	progress_arg_t pa = { 0 };
1010 	pthread_t tid;
1011 	char *thissnap;
1012 	enum lzc_send_flags flags = 0;
1013 	int err;
1014 	boolean_t isfromsnap, istosnap, fromorigin;
1015 	boolean_t exclude = B_FALSE;
1016 	FILE *fout = sdd->std_out ? stdout : stderr;
1017 
1018 	err = 0;
1019 	thissnap = strchr(zhp->zfs_name, '@') + 1;
1020 	isfromsnap = (sdd->fromsnap != NULL &&
1021 	    strcmp(sdd->fromsnap, thissnap) == 0);
1022 
1023 	if (!sdd->seenfrom && isfromsnap) {
1024 		gather_holds(zhp, sdd);
1025 		sdd->seenfrom = B_TRUE;
1026 		(void) strlcpy(sdd->prevsnap, thissnap, sizeof (sdd->prevsnap));
1027 		sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1028 		zfs_close(zhp);
1029 		return (0);
1030 	}
1031 
1032 	if (sdd->seento || !sdd->seenfrom) {
1033 		zfs_close(zhp);
1034 		return (0);
1035 	}
1036 
1037 	istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1038 	if (istosnap)
1039 		sdd->seento = B_TRUE;
1040 
1041 	if (sdd->large_block)
1042 		flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1043 	if (sdd->embed_data)
1044 		flags |= LZC_SEND_FLAG_EMBED_DATA;
1045 	if (sdd->compress)
1046 		flags |= LZC_SEND_FLAG_COMPRESS;
1047 	if (sdd->raw)
1048 		flags |= LZC_SEND_FLAG_RAW;
1049 
1050 	if (!sdd->doall && !isfromsnap && !istosnap) {
1051 		if (sdd->replicate) {
1052 			char *snapname;
1053 			nvlist_t *snapprops;
1054 			/*
1055 			 * Filter out all intermediate snapshots except origin
1056 			 * snapshots needed to replicate clones.
1057 			 */
1058 			nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1059 			    zhp->zfs_dmustats.dds_guid, &snapname);
1060 
1061 			if (nvfs != NULL) {
1062 				snapprops = fnvlist_lookup_nvlist(nvfs,
1063 				    "snapprops");
1064 				snapprops = fnvlist_lookup_nvlist(snapprops,
1065 				    thissnap);
1066 				exclude = !nvlist_exists(snapprops,
1067 				    "is_clone_origin");
1068 			}
1069 		} else {
1070 			exclude = B_TRUE;
1071 		}
1072 	}
1073 
1074 	/*
1075 	 * If a filter function exists, call it to determine whether
1076 	 * this snapshot will be sent.
1077 	 */
1078 	if (exclude || (sdd->filter_cb != NULL &&
1079 	    sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1080 		/*
1081 		 * This snapshot is filtered out.  Don't send it, and don't
1082 		 * set prevsnap_obj, so it will be as if this snapshot didn't
1083 		 * exist, and the next accepted snapshot will be sent as
1084 		 * an incremental from the last accepted one, or as the
1085 		 * first (and full) snapshot in the case of a replication,
1086 		 * non-incremental send.
1087 		 */
1088 		zfs_close(zhp);
1089 		return (0);
1090 	}
1091 
1092 	gather_holds(zhp, sdd);
1093 	fromorigin = sdd->prevsnap[0] == '\0' &&
1094 	    (sdd->fromorigin || sdd->replicate);
1095 
1096 	if (sdd->verbosity != 0) {
1097 		uint64_t size = 0;
1098 		char fromds[ZFS_MAX_DATASET_NAME_LEN];
1099 
1100 		if (sdd->prevsnap[0] != '\0') {
1101 			(void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1102 			*(strchr(fromds, '@') + 1) = '\0';
1103 			(void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1104 		}
1105 		if (zfs_send_space(zhp, zhp->zfs_name,
1106 		    sdd->prevsnap[0] ? fromds : NULL, flags, &size) == 0) {
1107 			send_print_verbose(fout, zhp->zfs_name,
1108 			    sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1109 			    size, sdd->parsable);
1110 			sdd->size += size;
1111 		}
1112 	}
1113 
1114 	if (!sdd->dryrun) {
1115 		/*
1116 		 * If progress reporting is requested, spawn a new thread to
1117 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1118 		 */
1119 		if (sdd->progress) {
1120 			pa.pa_zhp = zhp;
1121 			pa.pa_fd = sdd->outfd;
1122 			pa.pa_parsable = sdd->parsable;
1123 			pa.pa_estimate = B_FALSE;
1124 			pa.pa_verbosity = sdd->verbosity;
1125 
1126 			if ((err = pthread_create(&tid, NULL,
1127 			    send_progress_thread, &pa)) != 0) {
1128 				zfs_close(zhp);
1129 				return (err);
1130 			}
1131 		}
1132 
1133 		err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1134 		    fromorigin, sdd->outfd, flags, sdd->debugnv);
1135 
1136 		if (sdd->progress) {
1137 			void *status = NULL;
1138 			(void) pthread_cancel(tid);
1139 			(void) pthread_join(tid, &status);
1140 			int error = (int)(uintptr_t)status;
1141 			if (error != 0 && status != PTHREAD_CANCELED) {
1142 				return (zfs_standard_error(zhp->zfs_hdl, error,
1143 				    dgettext(TEXT_DOMAIN,
1144 				    "progress thread exited nonzero")));
1145 			}
1146 		}
1147 	}
1148 
1149 	(void) strcpy(sdd->prevsnap, thissnap);
1150 	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1151 	zfs_close(zhp);
1152 	return (err);
1153 }
1154 
1155 /*
1156  * Send all snapshots for a filesystem, updating the send dump data.
1157  */
1158 static int
1159 dump_filesystem(zfs_handle_t *zhp, send_dump_data_t *sdd)
1160 {
1161 	int rv = 0;
1162 	boolean_t missingfrom = B_FALSE;
1163 	zfs_cmd_t zc = {"\0"};
1164 	uint64_t min_txg = 0, max_txg = 0;
1165 
1166 	/*
1167 	 * Make sure the tosnap exists.
1168 	 */
1169 	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1170 	    zhp->zfs_name, sdd->tosnap);
1171 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1172 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1173 		    "WARNING: could not send %s@%s: does not exist\n"),
1174 		    zhp->zfs_name, sdd->tosnap);
1175 		sdd->err = B_TRUE;
1176 		return (0);
1177 	}
1178 
1179 	/*
1180 	 * If this fs does not have fromsnap, and we're doing
1181 	 * recursive, we need to send a full stream from the
1182 	 * beginning (or an incremental from the origin if this
1183 	 * is a clone).  If we're doing non-recursive, then let
1184 	 * them get the error.
1185 	 */
1186 	if (sdd->replicate && sdd->fromsnap) {
1187 		/*
1188 		 * Make sure the fromsnap exists.
1189 		 */
1190 		(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1191 		    zhp->zfs_name, sdd->fromsnap);
1192 		if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0)
1193 			missingfrom = B_TRUE;
1194 	}
1195 
1196 	sdd->seenfrom = sdd->seento = B_FALSE;
1197 	sdd->prevsnap[0] = '\0';
1198 	sdd->prevsnap_obj = 0;
1199 	if (sdd->fromsnap == NULL || missingfrom)
1200 		sdd->seenfrom = B_TRUE;
1201 
1202 	/*
1203 	 * Iterate through all snapshots and process the ones we will be
1204 	 * sending. If we only have a "from" and "to" snapshot to deal
1205 	 * with, we can avoid iterating through all the other snapshots.
1206 	 */
1207 	if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1208 		if (!sdd->replicate) {
1209 			if (sdd->fromsnap != NULL) {
1210 				min_txg = get_snap_txg(zhp->zfs_hdl,
1211 				    zhp->zfs_name, sdd->fromsnap);
1212 			}
1213 			if (sdd->tosnap != NULL) {
1214 				max_txg = get_snap_txg(zhp->zfs_hdl,
1215 				    zhp->zfs_name, sdd->tosnap);
1216 			}
1217 		}
1218 		rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, sdd,
1219 		    min_txg, max_txg);
1220 	} else {
1221 		char snapname[MAXPATHLEN] = { 0 };
1222 		zfs_handle_t *snap;
1223 
1224 		/* Dump fromsnap. */
1225 		if (!sdd->seenfrom) {
1226 			(void) snprintf(snapname, sizeof (snapname),
1227 			    "%s@%s", zhp->zfs_name, sdd->fromsnap);
1228 			snap = zfs_open(zhp->zfs_hdl, snapname,
1229 			    ZFS_TYPE_SNAPSHOT);
1230 			if (snap != NULL)
1231 				rv = dump_snapshot(snap, sdd);
1232 			else
1233 				rv = -1;
1234 		}
1235 
1236 		/* Dump tosnap. */
1237 		if (rv == 0) {
1238 			(void) snprintf(snapname, sizeof (snapname),
1239 			    "%s@%s", zhp->zfs_name, sdd->tosnap);
1240 			snap = zfs_open(zhp->zfs_hdl, snapname,
1241 			    ZFS_TYPE_SNAPSHOT);
1242 			if (snap != NULL)
1243 				rv = dump_snapshot(snap, sdd);
1244 			else
1245 				rv = -1;
1246 		}
1247 	}
1248 
1249 	if (!sdd->seenfrom) {
1250 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1251 		    "WARNING: could not send %s@%s:\n"
1252 		    "incremental source (%s@%s) does not exist\n"),
1253 		    zhp->zfs_name, sdd->tosnap,
1254 		    zhp->zfs_name, sdd->fromsnap);
1255 		sdd->err = B_TRUE;
1256 	} else if (!sdd->seento) {
1257 		if (sdd->fromsnap) {
1258 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1259 			    "WARNING: could not send %s@%s:\n"
1260 			    "incremental source (%s@%s) "
1261 			    "is not earlier than it\n"),
1262 			    zhp->zfs_name, sdd->tosnap,
1263 			    zhp->zfs_name, sdd->fromsnap);
1264 		} else {
1265 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1266 			    "WARNING: "
1267 			    "could not send %s@%s: does not exist\n"),
1268 			    zhp->zfs_name, sdd->tosnap);
1269 		}
1270 		sdd->err = B_TRUE;
1271 	}
1272 
1273 	return (rv);
1274 }
1275 
1276 /*
1277  * Send all snapshots for all filesystems in sdd.
1278  */
1279 static int
1280 dump_filesystems(zfs_handle_t *rzhp, send_dump_data_t *sdd)
1281 {
1282 	nvpair_t *fspair;
1283 	boolean_t needagain, progress;
1284 
1285 	if (!sdd->replicate)
1286 		return (dump_filesystem(rzhp, sdd));
1287 
1288 	/* Mark the clone origin snapshots. */
1289 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1290 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1291 		nvlist_t *nvfs;
1292 		uint64_t origin_guid = 0;
1293 
1294 		nvfs = fnvpair_value_nvlist(fspair);
1295 		(void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1296 		if (origin_guid != 0) {
1297 			char *snapname;
1298 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1299 			    origin_guid, &snapname);
1300 			if (origin_nv != NULL) {
1301 				nvlist_t *snapprops;
1302 				snapprops = fnvlist_lookup_nvlist(origin_nv,
1303 				    "snapprops");
1304 				snapprops = fnvlist_lookup_nvlist(snapprops,
1305 				    snapname);
1306 				fnvlist_add_boolean(snapprops,
1307 				    "is_clone_origin");
1308 			}
1309 		}
1310 	}
1311 again:
1312 	needagain = progress = B_FALSE;
1313 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1314 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1315 		nvlist_t *fslist, *parent_nv;
1316 		char *fsname;
1317 		zfs_handle_t *zhp;
1318 		int err;
1319 		uint64_t origin_guid = 0;
1320 		uint64_t parent_guid = 0;
1321 
1322 		fslist = fnvpair_value_nvlist(fspair);
1323 		if (nvlist_lookup_boolean(fslist, "sent") == 0)
1324 			continue;
1325 
1326 		fsname = fnvlist_lookup_string(fslist, "name");
1327 		(void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1328 		(void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1329 		    &parent_guid);
1330 
1331 		if (parent_guid != 0) {
1332 			parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1333 			if (!nvlist_exists(parent_nv, "sent")) {
1334 				/* Parent has not been sent; skip this one. */
1335 				needagain = B_TRUE;
1336 				continue;
1337 			}
1338 		}
1339 
1340 		if (origin_guid != 0) {
1341 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1342 			    origin_guid, NULL);
1343 			if (origin_nv != NULL &&
1344 			    !nvlist_exists(origin_nv, "sent")) {
1345 				/*
1346 				 * Origin has not been sent yet;
1347 				 * skip this clone.
1348 				 */
1349 				needagain = B_TRUE;
1350 				continue;
1351 			}
1352 		}
1353 
1354 		zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1355 		if (zhp == NULL)
1356 			return (-1);
1357 		err = dump_filesystem(zhp, sdd);
1358 		fnvlist_add_boolean(fslist, "sent");
1359 		progress = B_TRUE;
1360 		zfs_close(zhp);
1361 		if (err)
1362 			return (err);
1363 	}
1364 	if (needagain) {
1365 		assert(progress);
1366 		goto again;
1367 	}
1368 
1369 	/* Clean out the sent flags in case we reuse this fss. */
1370 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1371 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1372 		nvlist_t *fslist;
1373 
1374 		fslist = fnvpair_value_nvlist(fspair);
1375 		(void) nvlist_remove_all(fslist, "sent");
1376 	}
1377 
1378 	return (0);
1379 }
1380 
1381 nvlist_t *
1382 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1383 {
1384 	unsigned int version;
1385 	int nread, i;
1386 	unsigned long long checksum, packed_len;
1387 
1388 	/*
1389 	 * Decode token header, which is:
1390 	 *   <token version>-<checksum of payload>-<uncompressed payload length>
1391 	 * Note that the only supported token version is 1.
1392 	 */
1393 	nread = sscanf(token, "%u-%llx-%llx-",
1394 	    &version, &checksum, &packed_len);
1395 	if (nread != 3) {
1396 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1397 		    "resume token is corrupt (invalid format)"));
1398 		return (NULL);
1399 	}
1400 
1401 	if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1402 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1403 		    "resume token is corrupt (invalid version %u)"),
1404 		    version);
1405 		return (NULL);
1406 	}
1407 
1408 	/* Convert hexadecimal representation to binary. */
1409 	token = strrchr(token, '-') + 1;
1410 	int len = strlen(token) / 2;
1411 	unsigned char *compressed = zfs_alloc(hdl, len);
1412 	for (i = 0; i < len; i++) {
1413 		nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1414 		if (nread != 1) {
1415 			free(compressed);
1416 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1417 			    "resume token is corrupt "
1418 			    "(payload is not hex-encoded)"));
1419 			return (NULL);
1420 		}
1421 	}
1422 
1423 	/* Verify checksum. */
1424 	zio_cksum_t cksum;
1425 	fletcher_4_native_varsize(compressed, len, &cksum);
1426 	if (cksum.zc_word[0] != checksum) {
1427 		free(compressed);
1428 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1429 		    "resume token is corrupt (incorrect checksum)"));
1430 		return (NULL);
1431 	}
1432 
1433 	/* Uncompress. */
1434 	void *packed = zfs_alloc(hdl, packed_len);
1435 	uLongf packed_len_long = packed_len;
1436 	if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1437 	    packed_len_long != packed_len) {
1438 		free(packed);
1439 		free(compressed);
1440 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1441 		    "resume token is corrupt (decompression failed)"));
1442 		return (NULL);
1443 	}
1444 
1445 	/* Unpack nvlist. */
1446 	nvlist_t *nv;
1447 	int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1448 	free(packed);
1449 	free(compressed);
1450 	if (error != 0) {
1451 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1452 		    "resume token is corrupt (nvlist_unpack failed)"));
1453 		return (NULL);
1454 	}
1455 	return (nv);
1456 }
1457 
1458 static enum lzc_send_flags
1459 lzc_flags_from_sendflags(const sendflags_t *flags)
1460 {
1461 	enum lzc_send_flags lzc_flags = 0;
1462 
1463 	if (flags->largeblock)
1464 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1465 	if (flags->embed_data)
1466 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1467 	if (flags->compress)
1468 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1469 	if (flags->raw)
1470 		lzc_flags |= LZC_SEND_FLAG_RAW;
1471 	if (flags->saved)
1472 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1473 
1474 	return (lzc_flags);
1475 }
1476 
1477 static int
1478 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1479     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1480     const char *redactbook, char *errbuf)
1481 {
1482 	uint64_t size;
1483 	FILE *fout = flags->dryrun ? stdout : stderr;
1484 	progress_arg_t pa = { 0 };
1485 	int err = 0;
1486 	pthread_t ptid;
1487 
1488 	if (flags->progress) {
1489 		pa.pa_zhp = zhp;
1490 		pa.pa_fd = fd;
1491 		pa.pa_parsable = flags->parsable;
1492 		pa.pa_estimate = B_TRUE;
1493 		pa.pa_verbosity = flags->verbosity;
1494 
1495 		err = pthread_create(&ptid, NULL,
1496 		    send_progress_thread, &pa);
1497 		if (err != 0) {
1498 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1499 			return (zfs_error(zhp->zfs_hdl,
1500 			    EZFS_THREADCREATEFAILED, errbuf));
1501 		}
1502 	}
1503 
1504 	err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1505 	    lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1506 	    redactbook, fd, &size);
1507 
1508 	if (flags->progress) {
1509 		void *status = NULL;
1510 		(void) pthread_cancel(ptid);
1511 		(void) pthread_join(ptid, &status);
1512 		int error = (int)(uintptr_t)status;
1513 		if (error != 0 && status != PTHREAD_CANCELED) {
1514 			char errbuf[1024];
1515 			(void) snprintf(errbuf, sizeof (errbuf),
1516 			    dgettext(TEXT_DOMAIN, "progress thread exited "
1517 			    "nonzero"));
1518 			return (zfs_standard_error(zhp->zfs_hdl, error,
1519 			    errbuf));
1520 		}
1521 	}
1522 
1523 	if (err != 0) {
1524 		zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1525 		return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1526 		    errbuf));
1527 	}
1528 	send_print_verbose(fout, zhp->zfs_name, from, size,
1529 	    flags->parsable);
1530 
1531 	if (flags->parsable) {
1532 		(void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1533 	} else {
1534 		char buf[16];
1535 		zfs_nicenum(size, buf, sizeof (buf));
1536 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1537 		    "total estimated size is %s\n"), buf);
1538 	}
1539 	return (0);
1540 }
1541 
1542 static boolean_t
1543 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1544 {
1545 	for (int i = 0; i < num_snaps; i++) {
1546 		if (snaps[i] == guid)
1547 			return (B_TRUE);
1548 	}
1549 	return (B_FALSE);
1550 }
1551 
1552 static boolean_t
1553 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1554     const uint64_t *snaps2, uint64_t num_snaps2)
1555 {
1556 	if (num_snaps1 != num_snaps2)
1557 		return (B_FALSE);
1558 	for (int i = 0; i < num_snaps1; i++) {
1559 		if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1560 			return (B_FALSE);
1561 	}
1562 	return (B_TRUE);
1563 }
1564 
1565 static int
1566 get_bookmarks(const char *path, nvlist_t **bmarksp)
1567 {
1568 	nvlist_t *props = fnvlist_alloc();
1569 	int error;
1570 
1571 	fnvlist_add_boolean(props, "redact_complete");
1572 	fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1573 	error = lzc_get_bookmarks(path, props, bmarksp);
1574 	fnvlist_free(props);
1575 	return (error);
1576 }
1577 
1578 static nvpair_t *
1579 find_redact_pair(nvlist_t *bmarks, const uint64_t *redact_snap_guids,
1580     int num_redact_snaps)
1581 {
1582 	nvpair_t *pair;
1583 
1584 	for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1585 	    pair = nvlist_next_nvpair(bmarks, pair)) {
1586 
1587 		nvlist_t *bmark = fnvpair_value_nvlist(pair);
1588 		nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1589 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1590 		uint_t len = 0;
1591 		uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1592 		    ZPROP_VALUE, &len);
1593 		if (redact_snaps_equal(redact_snap_guids,
1594 		    num_redact_snaps, bmarksnaps, len)) {
1595 			break;
1596 		}
1597 	}
1598 	return (pair);
1599 }
1600 
1601 static boolean_t
1602 get_redact_complete(nvpair_t *pair)
1603 {
1604 	nvlist_t *bmark = fnvpair_value_nvlist(pair);
1605 	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1606 	boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1607 	    ZPROP_VALUE);
1608 
1609 	return (complete);
1610 }
1611 
1612 /*
1613  * Check that the list of redaction snapshots in the bookmark matches the send
1614  * we're resuming, and return whether or not it's complete.
1615  *
1616  * Note that the caller needs to free the contents of *bookname with free() if
1617  * this function returns successfully.
1618  */
1619 static int
1620 find_redact_book(libzfs_handle_t *hdl, const char *path,
1621     const uint64_t *redact_snap_guids, int num_redact_snaps,
1622     char **bookname)
1623 {
1624 	char errbuf[1024];
1625 	nvlist_t *bmarks;
1626 
1627 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1628 	    "cannot resume send"));
1629 
1630 	int error = get_bookmarks(path, &bmarks);
1631 	if (error != 0) {
1632 		if (error == ESRCH) {
1633 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1634 			    "nonexistent redaction bookmark provided"));
1635 		} else if (error == ENOENT) {
1636 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1637 			    "dataset to be sent no longer exists"));
1638 		} else {
1639 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1640 			    "unknown error: %s"), strerror(error));
1641 		}
1642 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1643 	}
1644 	nvpair_t *pair = find_redact_pair(bmarks, redact_snap_guids,
1645 	    num_redact_snaps);
1646 	if (pair == NULL)  {
1647 		fnvlist_free(bmarks);
1648 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1649 		    "no appropriate redaction bookmark exists"));
1650 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1651 	}
1652 	boolean_t complete = get_redact_complete(pair);
1653 	if (!complete) {
1654 		fnvlist_free(bmarks);
1655 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1656 		    "incomplete redaction bookmark provided"));
1657 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1658 	}
1659 	*bookname = strndup(nvpair_name(pair), ZFS_MAX_DATASET_NAME_LEN);
1660 	ASSERT3P(*bookname, !=, NULL);
1661 	fnvlist_free(bmarks);
1662 	return (0);
1663 }
1664 
1665 static enum lzc_send_flags
1666 lzc_flags_from_resume_nvl(nvlist_t *resume_nvl)
1667 {
1668 	enum lzc_send_flags lzc_flags = 0;
1669 
1670 	if (nvlist_exists(resume_nvl, "largeblockok"))
1671 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1672 	if (nvlist_exists(resume_nvl, "embedok"))
1673 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1674 	if (nvlist_exists(resume_nvl, "compressok"))
1675 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1676 	if (nvlist_exists(resume_nvl, "rawok"))
1677 		lzc_flags |= LZC_SEND_FLAG_RAW;
1678 	if (nvlist_exists(resume_nvl, "savedok"))
1679 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1680 
1681 	return (lzc_flags);
1682 }
1683 
1684 static int
1685 zfs_send_resume_impl_cb_impl(libzfs_handle_t *hdl, sendflags_t *flags,
1686     int outfd, nvlist_t *resume_nvl)
1687 {
1688 	char errbuf[1024];
1689 	char *toname;
1690 	char *fromname = NULL;
1691 	uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1692 	zfs_handle_t *zhp;
1693 	int error = 0;
1694 	char name[ZFS_MAX_DATASET_NAME_LEN];
1695 	FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1696 	uint64_t *redact_snap_guids = NULL;
1697 	int num_redact_snaps = 0;
1698 	char *redact_book = NULL;
1699 
1700 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1701 	    "cannot resume send"));
1702 
1703 	if (flags->verbosity != 0) {
1704 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1705 		    "resume token contents:\n"));
1706 		nvlist_print(fout, resume_nvl);
1707 	}
1708 
1709 	if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1710 	    nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1711 	    nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1712 	    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1713 	    nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1714 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1715 		    "resume token is corrupt"));
1716 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1717 	}
1718 	fromguid = 0;
1719 	(void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1720 
1721 	if (flags->saved) {
1722 		(void) strcpy(name, toname);
1723 	} else {
1724 		error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1725 		if (error != 0) {
1726 			if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1727 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1728 				    "'%s' is no longer the same snapshot "
1729 				    "used in the initial send"), toname);
1730 			} else {
1731 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1732 				    "'%s' used in the initial send no "
1733 				    "longer exists"), toname);
1734 			}
1735 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1736 		}
1737 	}
1738 
1739 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1740 	if (zhp == NULL) {
1741 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1742 		    "unable to access '%s'"), name);
1743 		return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1744 	}
1745 
1746 	if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1747 	    &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1748 		num_redact_snaps = -1;
1749 	}
1750 
1751 	if (fromguid != 0) {
1752 		if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1753 		    redact_snap_guids, num_redact_snaps, name) != 0) {
1754 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1755 			    "incremental source %#llx no longer exists"),
1756 			    (longlong_t)fromguid);
1757 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1758 		}
1759 		fromname = name;
1760 	}
1761 
1762 	redact_snap_guids = NULL;
1763 
1764 	if (nvlist_lookup_uint64_array(resume_nvl,
1765 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1766 	    (uint_t *)&num_redact_snaps) == 0) {
1767 		char path[ZFS_MAX_DATASET_NAME_LEN];
1768 
1769 		(void) strlcpy(path, toname, sizeof (path));
1770 		char *at = strchr(path, '@');
1771 		ASSERT3P(at, !=, NULL);
1772 
1773 		*at = '\0';
1774 
1775 		if ((error = find_redact_book(hdl, path, redact_snap_guids,
1776 		    num_redact_snaps, &redact_book)) != 0) {
1777 			return (error);
1778 		}
1779 	}
1780 
1781 	enum lzc_send_flags lzc_flags = lzc_flags_from_sendflags(flags) |
1782 	    lzc_flags_from_resume_nvl(resume_nvl);
1783 
1784 	if (flags->verbosity != 0) {
1785 		/*
1786 		 * Some of these may have come from the resume token, set them
1787 		 * here for size estimate purposes.
1788 		 */
1789 		sendflags_t tmpflags = *flags;
1790 		if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1791 			tmpflags.largeblock = B_TRUE;
1792 		if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1793 			tmpflags.compress = B_TRUE;
1794 		if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1795 			tmpflags.embed_data = B_TRUE;
1796 		if (lzc_flags & LZC_SEND_FLAG_RAW)
1797 			tmpflags.raw = B_TRUE;
1798 		if (lzc_flags & LZC_SEND_FLAG_SAVED)
1799 			tmpflags.saved = B_TRUE;
1800 		error = estimate_size(zhp, fromname, outfd, &tmpflags,
1801 		    resumeobj, resumeoff, bytes, redact_book, errbuf);
1802 	}
1803 
1804 	if (!flags->dryrun) {
1805 		progress_arg_t pa = { 0 };
1806 		pthread_t tid;
1807 		/*
1808 		 * If progress reporting is requested, spawn a new thread to
1809 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1810 		 */
1811 		if (flags->progress) {
1812 			pa.pa_zhp = zhp;
1813 			pa.pa_fd = outfd;
1814 			pa.pa_parsable = flags->parsable;
1815 			pa.pa_estimate = B_FALSE;
1816 			pa.pa_verbosity = flags->verbosity;
1817 
1818 			error = pthread_create(&tid, NULL,
1819 			    send_progress_thread, &pa);
1820 			if (error != 0) {
1821 				if (redact_book != NULL)
1822 					free(redact_book);
1823 				zfs_close(zhp);
1824 				return (error);
1825 			}
1826 		}
1827 
1828 		error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1829 		    lzc_flags, resumeobj, resumeoff, redact_book);
1830 		if (redact_book != NULL)
1831 			free(redact_book);
1832 
1833 		if (flags->progress) {
1834 			void *status = NULL;
1835 			(void) pthread_cancel(tid);
1836 			(void) pthread_join(tid, &status);
1837 			int error = (int)(uintptr_t)status;
1838 			if (error != 0 && status != PTHREAD_CANCELED) {
1839 				char errbuf[1024];
1840 				(void) snprintf(errbuf, sizeof (errbuf),
1841 				    dgettext(TEXT_DOMAIN,
1842 				    "progress thread exited nonzero"));
1843 				return (zfs_standard_error(hdl, error, errbuf));
1844 			}
1845 		}
1846 
1847 		char errbuf[1024];
1848 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1849 		    "warning: cannot send '%s'"), zhp->zfs_name);
1850 
1851 		zfs_close(zhp);
1852 
1853 		switch (error) {
1854 		case 0:
1855 			return (0);
1856 		case EACCES:
1857 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1858 			    "source key must be loaded"));
1859 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1860 		case ESRCH:
1861 			if (lzc_exists(zhp->zfs_name)) {
1862 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1863 				    "incremental source could not be found"));
1864 			}
1865 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
1866 
1867 		case EXDEV:
1868 		case ENOENT:
1869 		case EDQUOT:
1870 		case EFBIG:
1871 		case EIO:
1872 		case ENOLINK:
1873 		case ENOSPC:
1874 		case ENOSTR:
1875 		case ENXIO:
1876 		case EPIPE:
1877 		case ERANGE:
1878 		case EFAULT:
1879 		case EROFS:
1880 			zfs_error_aux(hdl, "%s", strerror(errno));
1881 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1882 
1883 		default:
1884 			return (zfs_standard_error(hdl, errno, errbuf));
1885 		}
1886 	} else {
1887 		if (redact_book != NULL)
1888 			free(redact_book);
1889 	}
1890 
1891 	zfs_close(zhp);
1892 
1893 	return (error);
1894 }
1895 
1896 struct zfs_send_resume_impl {
1897 	libzfs_handle_t *hdl;
1898 	sendflags_t *flags;
1899 	nvlist_t *resume_nvl;
1900 };
1901 
1902 static int
1903 zfs_send_resume_impl_cb(int outfd, void *arg)
1904 {
1905 	struct zfs_send_resume_impl *zsri = arg;
1906 	return (zfs_send_resume_impl_cb_impl(zsri->hdl, zsri->flags, outfd,
1907 	    zsri->resume_nvl));
1908 }
1909 
1910 static int
1911 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1912     nvlist_t *resume_nvl)
1913 {
1914 	struct zfs_send_resume_impl zsri = {
1915 		.hdl = hdl,
1916 		.flags = flags,
1917 		.resume_nvl = resume_nvl,
1918 	};
1919 	return (lzc_send_wrapper(zfs_send_resume_impl_cb, outfd, &zsri));
1920 }
1921 
1922 int
1923 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1924     const char *resume_token)
1925 {
1926 	int ret;
1927 	char errbuf[1024];
1928 	nvlist_t *resume_nvl;
1929 
1930 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1931 	    "cannot resume send"));
1932 
1933 	resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1934 	if (resume_nvl == NULL) {
1935 		/*
1936 		 * zfs_error_aux has already been set by
1937 		 * zfs_send_resume_token_to_nvlist()
1938 		 */
1939 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1940 	}
1941 
1942 	ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1943 	fnvlist_free(resume_nvl);
1944 
1945 	return (ret);
1946 }
1947 
1948 int
1949 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1950     const char *resume_token)
1951 {
1952 	int ret;
1953 	libzfs_handle_t *hdl = zhp->zfs_hdl;
1954 	nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1955 	uint64_t saved_guid = 0, resume_guid = 0;
1956 	uint64_t obj = 0, off = 0, bytes = 0;
1957 	char token_buf[ZFS_MAXPROPLEN];
1958 	char errbuf[1024];
1959 
1960 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1961 	    "saved send failed"));
1962 
1963 	ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1964 	    token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1965 	if (ret != 0)
1966 		goto out;
1967 
1968 	saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1969 	if (saved_nvl == NULL) {
1970 		/*
1971 		 * zfs_error_aux has already been set by
1972 		 * zfs_send_resume_token_to_nvlist()
1973 		 */
1974 		ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1975 		goto out;
1976 	}
1977 
1978 	/*
1979 	 * If a resume token is provided we use the object and offset
1980 	 * from that instead of the default, which starts from the
1981 	 * beginning.
1982 	 */
1983 	if (resume_token != NULL) {
1984 		resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1985 		    resume_token);
1986 		if (resume_nvl == NULL) {
1987 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1988 			goto out;
1989 		}
1990 
1991 		if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1992 		    nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1993 		    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1994 		    nvlist_lookup_uint64(resume_nvl, "toguid",
1995 		    &resume_guid) != 0) {
1996 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1997 			    "provided resume token is corrupt"));
1998 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1999 			goto out;
2000 		}
2001 
2002 		if (nvlist_lookup_uint64(saved_nvl, "toguid",
2003 		    &saved_guid)) {
2004 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2005 			    "dataset's resume token is corrupt"));
2006 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
2007 			goto out;
2008 		}
2009 
2010 		if (resume_guid != saved_guid) {
2011 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2012 			    "provided resume token does not match dataset"));
2013 			ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
2014 			goto out;
2015 		}
2016 	}
2017 
2018 	(void) nvlist_remove_all(saved_nvl, "object");
2019 	fnvlist_add_uint64(saved_nvl, "object", obj);
2020 
2021 	(void) nvlist_remove_all(saved_nvl, "offset");
2022 	fnvlist_add_uint64(saved_nvl, "offset", off);
2023 
2024 	(void) nvlist_remove_all(saved_nvl, "bytes");
2025 	fnvlist_add_uint64(saved_nvl, "bytes", bytes);
2026 
2027 	(void) nvlist_remove_all(saved_nvl, "toname");
2028 	fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
2029 
2030 	ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
2031 
2032 out:
2033 	fnvlist_free(saved_nvl);
2034 	fnvlist_free(resume_nvl);
2035 	return (ret);
2036 }
2037 
2038 /*
2039  * This function informs the target system that the recursive send is complete.
2040  * The record is also expected in the case of a send -p.
2041  */
2042 static int
2043 send_conclusion_record(int fd, zio_cksum_t *zc)
2044 {
2045 	dmu_replay_record_t drr = { 0 };
2046 	drr.drr_type = DRR_END;
2047 	if (zc != NULL)
2048 		drr.drr_u.drr_end.drr_checksum = *zc;
2049 	if (write(fd, &drr, sizeof (drr)) == -1) {
2050 		return (errno);
2051 	}
2052 	return (0);
2053 }
2054 
2055 /*
2056  * This function is responsible for sending the records that contain the
2057  * necessary information for the target system's libzfs to be able to set the
2058  * properties of the filesystem being received, or to be able to prepare for
2059  * a recursive receive.
2060  *
2061  * The "zhp" argument is the handle of the snapshot we are sending
2062  * (the "tosnap").  The "from" argument is the short snapshot name (the part
2063  * after the @) of the incremental source.
2064  */
2065 static int
2066 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
2067     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
2068     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
2069     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
2070     nvlist_t **fssp, avl_tree_t **fsavlp)
2071 {
2072 	int err = 0;
2073 	char *packbuf = NULL;
2074 	size_t buflen = 0;
2075 	zio_cksum_t zc = { {0} };
2076 	int featureflags = 0;
2077 	/* name of filesystem/volume that contains snapshot we are sending */
2078 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
2079 	/* short name of snap we are sending */
2080 	char *tosnap = "";
2081 
2082 	char errbuf[1024];
2083 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2084 	    "warning: cannot send '%s'"), zhp->zfs_name);
2085 	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2086 	    ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2087 		featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2088 	}
2089 
2090 	if (holds)
2091 		featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2092 
2093 	(void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2094 	char *at = strchr(tofs, '@');
2095 	if (at != NULL) {
2096 		*at = '\0';
2097 		tosnap = at + 1;
2098 	}
2099 
2100 	if (gather_props) {
2101 		nvlist_t *hdrnv = fnvlist_alloc();
2102 		nvlist_t *fss = NULL;
2103 
2104 		if (from != NULL)
2105 			fnvlist_add_string(hdrnv, "fromsnap", from);
2106 		fnvlist_add_string(hdrnv, "tosnap", tosnap);
2107 		if (!recursive)
2108 			fnvlist_add_boolean(hdrnv, "not_recursive");
2109 
2110 		if (raw) {
2111 			fnvlist_add_boolean(hdrnv, "raw");
2112 		}
2113 
2114 		if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2115 		    from, tosnap, recursive, raw, doall, replicate, skipmissing,
2116 		    verbose, backup, holds, props, &fss, fsavlp)) != 0) {
2117 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2118 			    errbuf));
2119 		}
2120 		/*
2121 		 * Do not allow the size of the properties list to exceed
2122 		 * the limit
2123 		 */
2124 		if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2125 		    zhp->zfs_hdl->libzfs_max_nvlist) {
2126 			(void) snprintf(errbuf, sizeof (errbuf),
2127 			    dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2128 			    "the size of the list of snapshots and properties "
2129 			    "is too large to be received successfully.\n"
2130 			    "Select a smaller number of snapshots to send.\n"),
2131 			    zhp->zfs_name);
2132 			return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2133 			    errbuf));
2134 		}
2135 		fnvlist_add_nvlist(hdrnv, "fss", fss);
2136 		VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2137 		    0));
2138 		if (fssp != NULL) {
2139 			*fssp = fss;
2140 		} else {
2141 			fnvlist_free(fss);
2142 		}
2143 		fnvlist_free(hdrnv);
2144 	}
2145 
2146 	if (!dryrun) {
2147 		dmu_replay_record_t drr = { 0 };
2148 		/* write first begin record */
2149 		drr.drr_type = DRR_BEGIN;
2150 		drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2151 		DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2152 		    drr_versioninfo, DMU_COMPOUNDSTREAM);
2153 		DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2154 		    drr_versioninfo, featureflags);
2155 		if (snprintf(drr.drr_u.drr_begin.drr_toname,
2156 		    sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2157 		    tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2158 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2159 			    errbuf));
2160 		}
2161 		drr.drr_payloadlen = buflen;
2162 
2163 		err = dump_record(&drr, packbuf, buflen, &zc, fd);
2164 		free(packbuf);
2165 		if (err != 0) {
2166 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2167 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2168 			    errbuf));
2169 		}
2170 		err = send_conclusion_record(fd, &zc);
2171 		if (err != 0) {
2172 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2173 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2174 			    errbuf));
2175 		}
2176 	}
2177 	return (0);
2178 }
2179 
2180 /*
2181  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2182  * that contains the snapshot to send.  The "fromsnap" argument is the
2183  * short name (the part after the '@') of the snapshot that is the
2184  * incremental source to send from (if non-NULL).  The "tosnap" argument
2185  * is the short name of the snapshot to send.
2186  *
2187  * The content of the send stream is the snapshot identified by
2188  * 'tosnap'.  Incremental streams are requested in two ways:
2189  *     - from the snapshot identified by "fromsnap" (if non-null) or
2190  *     - from the origin of the dataset identified by zhp, which must
2191  *	 be a clone.  In this case, "fromsnap" is null and "fromorigin"
2192  *	 is TRUE.
2193  *
2194  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2195  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2196  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2197  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2198  * case too. If "props" is set, send properties.
2199  *
2200  * Pre-wrapped (cf. lzc_send_wrapper()).
2201  */
2202 static int
2203 zfs_send_cb_impl(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2204     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2205     void *cb_arg, nvlist_t **debugnvp)
2206 {
2207 	char errbuf[1024];
2208 	send_dump_data_t sdd = { 0 };
2209 	int err = 0;
2210 	nvlist_t *fss = NULL;
2211 	avl_tree_t *fsavl = NULL;
2212 	static uint64_t holdseq;
2213 	int spa_version;
2214 	FILE *fout;
2215 
2216 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2217 	    "cannot send '%s'"), zhp->zfs_name);
2218 
2219 	if (fromsnap && fromsnap[0] == '\0') {
2220 		zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2221 		    "zero-length incremental source"));
2222 		return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2223 	}
2224 
2225 	if (fromsnap) {
2226 		char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2227 		if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2228 		    "%s@%s", zhp->zfs_name, fromsnap) >=
2229 		    sizeof (full_fromsnap_name)) {
2230 			err = EINVAL;
2231 			goto stderr_out;
2232 		}
2233 		zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2234 		    full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2235 		if (fromsnapn == NULL) {
2236 			err = -1;
2237 			goto err_out;
2238 		}
2239 		zfs_close(fromsnapn);
2240 	}
2241 
2242 	if (flags->replicate || flags->doall || flags->props ||
2243 	    flags->holds || flags->backup) {
2244 		char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2245 		if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2246 		    "%s@%s", zhp->zfs_name, tosnap) >=
2247 		    sizeof (full_tosnap_name)) {
2248 			err = EINVAL;
2249 			goto stderr_out;
2250 		}
2251 		zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2252 		    full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2253 		if (tosnap == NULL) {
2254 			err = -1;
2255 			goto err_out;
2256 		}
2257 		err = send_prelim_records(tosnap, fromsnap, outfd,
2258 		    flags->replicate || flags->props || flags->holds,
2259 		    flags->replicate, flags->verbosity > 0, flags->dryrun,
2260 		    flags->raw, flags->replicate, flags->skipmissing,
2261 		    flags->backup, flags->holds, flags->props, flags->doall,
2262 		    &fss, &fsavl);
2263 		zfs_close(tosnap);
2264 		if (err != 0)
2265 			goto err_out;
2266 	}
2267 
2268 	/* dump each stream */
2269 	sdd.fromsnap = fromsnap;
2270 	sdd.tosnap = tosnap;
2271 	sdd.outfd = outfd;
2272 	sdd.replicate = flags->replicate;
2273 	sdd.doall = flags->doall;
2274 	sdd.fromorigin = flags->fromorigin;
2275 	sdd.fss = fss;
2276 	sdd.fsavl = fsavl;
2277 	sdd.verbosity = flags->verbosity;
2278 	sdd.parsable = flags->parsable;
2279 	sdd.progress = flags->progress;
2280 	sdd.dryrun = flags->dryrun;
2281 	sdd.large_block = flags->largeblock;
2282 	sdd.embed_data = flags->embed_data;
2283 	sdd.compress = flags->compress;
2284 	sdd.raw = flags->raw;
2285 	sdd.holds = flags->holds;
2286 	sdd.filter_cb = filter_func;
2287 	sdd.filter_cb_arg = cb_arg;
2288 	if (debugnvp)
2289 		sdd.debugnv = *debugnvp;
2290 	if (sdd.verbosity != 0 && sdd.dryrun)
2291 		sdd.std_out = B_TRUE;
2292 	fout = sdd.std_out ? stdout : stderr;
2293 
2294 	/*
2295 	 * Some flags require that we place user holds on the datasets that are
2296 	 * being sent so they don't get destroyed during the send. We can skip
2297 	 * this step if the pool is imported read-only since the datasets cannot
2298 	 * be destroyed.
2299 	 */
2300 	if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2301 	    ZPOOL_PROP_READONLY, NULL) &&
2302 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2303 	    spa_version >= SPA_VERSION_USERREFS &&
2304 	    (flags->doall || flags->replicate)) {
2305 		++holdseq;
2306 		(void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2307 		    ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2308 		sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2309 		if (sdd.cleanup_fd < 0) {
2310 			err = errno;
2311 			goto stderr_out;
2312 		}
2313 		sdd.snapholds = fnvlist_alloc();
2314 	} else {
2315 		sdd.cleanup_fd = -1;
2316 		sdd.snapholds = NULL;
2317 	}
2318 
2319 	if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2320 		/*
2321 		 * Do a verbose no-op dry run to get all the verbose output
2322 		 * or to gather snapshot hold's before generating any data,
2323 		 * then do a non-verbose real run to generate the streams.
2324 		 */
2325 		sdd.dryrun = B_TRUE;
2326 		err = dump_filesystems(zhp, &sdd);
2327 
2328 		if (err != 0)
2329 			goto stderr_out;
2330 
2331 		if (flags->verbosity != 0) {
2332 			if (flags->parsable) {
2333 				(void) fprintf(fout, "size\t%llu\n",
2334 				    (longlong_t)sdd.size);
2335 			} else {
2336 				char buf[16];
2337 				zfs_nicebytes(sdd.size, buf, sizeof (buf));
2338 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
2339 				    "total estimated size is %s\n"), buf);
2340 			}
2341 		}
2342 
2343 		/* Ensure no snaps found is treated as an error. */
2344 		if (!sdd.seento) {
2345 			err = ENOENT;
2346 			goto err_out;
2347 		}
2348 
2349 		/* Skip the second run if dryrun was requested. */
2350 		if (flags->dryrun)
2351 			goto err_out;
2352 
2353 		if (sdd.snapholds != NULL) {
2354 			err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2355 			if (err != 0)
2356 				goto stderr_out;
2357 
2358 			fnvlist_free(sdd.snapholds);
2359 			sdd.snapholds = NULL;
2360 		}
2361 
2362 		sdd.dryrun = B_FALSE;
2363 		sdd.verbosity = 0;
2364 	}
2365 
2366 	err = dump_filesystems(zhp, &sdd);
2367 	fsavl_destroy(fsavl);
2368 	fnvlist_free(fss);
2369 
2370 	/* Ensure no snaps found is treated as an error. */
2371 	if (err == 0 && !sdd.seento)
2372 		err = ENOENT;
2373 
2374 	if (sdd.cleanup_fd != -1) {
2375 		VERIFY(0 == close(sdd.cleanup_fd));
2376 		sdd.cleanup_fd = -1;
2377 	}
2378 
2379 	if (!flags->dryrun && (flags->replicate || flags->doall ||
2380 	    flags->props || flags->backup || flags->holds)) {
2381 		/*
2382 		 * write final end record.  NB: want to do this even if
2383 		 * there was some error, because it might not be totally
2384 		 * failed.
2385 		 */
2386 		err = send_conclusion_record(outfd, NULL);
2387 		if (err != 0)
2388 			return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
2389 	}
2390 
2391 	return (err || sdd.err);
2392 
2393 stderr_out:
2394 	err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2395 err_out:
2396 	fsavl_destroy(fsavl);
2397 	fnvlist_free(fss);
2398 	fnvlist_free(sdd.snapholds);
2399 
2400 	if (sdd.cleanup_fd != -1)
2401 		VERIFY(0 == close(sdd.cleanup_fd));
2402 	return (err);
2403 }
2404 
2405 struct zfs_send {
2406 	zfs_handle_t *zhp;
2407 	const char *fromsnap;
2408 	const char *tosnap;
2409 	sendflags_t *flags;
2410 	snapfilter_cb_t *filter_func;
2411 	void *cb_arg;
2412 	nvlist_t **debugnvp;
2413 };
2414 
2415 static int
2416 zfs_send_cb(int outfd, void *arg)
2417 {
2418 	struct zfs_send *zs = arg;
2419 	return (zfs_send_cb_impl(zs->zhp, zs->fromsnap, zs->tosnap, zs->flags,
2420 	    outfd, zs->filter_func, zs->cb_arg, zs->debugnvp));
2421 }
2422 
2423 int
2424 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2425     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2426     void *cb_arg, nvlist_t **debugnvp)
2427 {
2428 	struct zfs_send arg = {
2429 		.zhp = zhp,
2430 		.fromsnap = fromsnap,
2431 		.tosnap = tosnap,
2432 		.flags = flags,
2433 		.filter_func = filter_func,
2434 		.cb_arg = cb_arg,
2435 		.debugnvp = debugnvp,
2436 	};
2437 	return (lzc_send_wrapper(zfs_send_cb, outfd, &arg));
2438 }
2439 
2440 
2441 static zfs_handle_t *
2442 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2443 {
2444 	char dirname[ZFS_MAX_DATASET_NAME_LEN];
2445 	(void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2446 	char *c = strchr(dirname, '@');
2447 	if (c != NULL)
2448 		*c = '\0';
2449 	return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2450 }
2451 
2452 /*
2453  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2454  * an earlier snapshot in the same filesystem, or a snapshot before later's
2455  * origin, or it's origin's origin, etc.
2456  */
2457 static boolean_t
2458 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2459 {
2460 	boolean_t ret;
2461 	uint64_t later_txg =
2462 	    (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2463 	    later->zfs_type == ZFS_TYPE_VOLUME ?
2464 	    UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2465 	uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2466 
2467 	if (earlier_txg >= later_txg)
2468 		return (B_FALSE);
2469 
2470 	zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2471 	    earlier->zfs_name);
2472 	zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2473 	    later->zfs_name);
2474 
2475 	if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2476 		zfs_close(earlier_dir);
2477 		zfs_close(later_dir);
2478 		return (B_TRUE);
2479 	}
2480 
2481 	char clonename[ZFS_MAX_DATASET_NAME_LEN];
2482 	if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2483 	    ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2484 		zfs_close(earlier_dir);
2485 		zfs_close(later_dir);
2486 		return (B_FALSE);
2487 	}
2488 
2489 	zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2490 	    ZFS_TYPE_DATASET);
2491 	uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2492 
2493 	/*
2494 	 * If "earlier" is exactly the origin, then
2495 	 * snapshot_is_before(earlier, origin) will return false (because
2496 	 * they're the same).
2497 	 */
2498 	if (origin_txg == earlier_txg &&
2499 	    strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2500 		zfs_close(earlier_dir);
2501 		zfs_close(later_dir);
2502 		zfs_close(origin);
2503 		return (B_TRUE);
2504 	}
2505 	zfs_close(earlier_dir);
2506 	zfs_close(later_dir);
2507 
2508 	ret = snapshot_is_before(earlier, origin);
2509 	zfs_close(origin);
2510 	return (ret);
2511 }
2512 
2513 /*
2514  * The "zhp" argument is the handle of the dataset to send (typically a
2515  * snapshot).  The "from" argument is the full name of the snapshot or
2516  * bookmark that is the incremental source.
2517  *
2518  * Pre-wrapped (cf. lzc_send_wrapper()).
2519  */
2520 static int
2521 zfs_send_one_cb_impl(zfs_handle_t *zhp, const char *from, int fd,
2522     sendflags_t *flags, const char *redactbook)
2523 {
2524 	int err;
2525 	libzfs_handle_t *hdl = zhp->zfs_hdl;
2526 	char *name = zhp->zfs_name;
2527 	pthread_t ptid;
2528 	progress_arg_t pa = { 0 };
2529 
2530 	char errbuf[1024];
2531 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2532 	    "warning: cannot send '%s'"), name);
2533 
2534 	if (from != NULL && strchr(from, '@')) {
2535 		zfs_handle_t *from_zhp = zfs_open(hdl, from,
2536 		    ZFS_TYPE_DATASET);
2537 		if (from_zhp == NULL)
2538 			return (-1);
2539 		if (!snapshot_is_before(from_zhp, zhp)) {
2540 			zfs_close(from_zhp);
2541 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2542 			    "not an earlier snapshot from the same fs"));
2543 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2544 		}
2545 		zfs_close(from_zhp);
2546 	}
2547 
2548 	if (redactbook != NULL) {
2549 		char bookname[ZFS_MAX_DATASET_NAME_LEN];
2550 		nvlist_t *redact_snaps;
2551 		zfs_handle_t *book_zhp;
2552 		char *at, *pound;
2553 		int dsnamelen;
2554 
2555 		pound = strchr(redactbook, '#');
2556 		if (pound != NULL)
2557 			redactbook = pound + 1;
2558 		at = strchr(name, '@');
2559 		if (at == NULL) {
2560 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2561 			    "cannot do a redacted send to a filesystem"));
2562 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2563 		}
2564 		dsnamelen = at - name;
2565 		if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2566 		    dsnamelen, name, redactbook)
2567 		    >= sizeof (bookname)) {
2568 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2569 			    "invalid bookmark name"));
2570 			return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2571 		}
2572 		book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2573 		if (book_zhp == NULL)
2574 			return (-1);
2575 		if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2576 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2577 		    &redact_snaps) != 0 || redact_snaps == NULL) {
2578 			zfs_close(book_zhp);
2579 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2580 			    "not a redaction bookmark"));
2581 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2582 		}
2583 		zfs_close(book_zhp);
2584 	}
2585 
2586 	/*
2587 	 * Send fs properties
2588 	 */
2589 	if (flags->props || flags->holds || flags->backup) {
2590 		/*
2591 		 * Note: the header generated by send_prelim_records()
2592 		 * assumes that the incremental source is in the same
2593 		 * filesystem/volume as the target (which is a requirement
2594 		 * when doing "zfs send -R").  But that isn't always the
2595 		 * case here (e.g. send from snap in origin, or send from
2596 		 * bookmark).  We pass from=NULL, which will omit this
2597 		 * information from the prelim records; it isn't used
2598 		 * when receiving this type of stream.
2599 		 */
2600 		err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2601 		    flags->verbosity > 0, flags->dryrun, flags->raw,
2602 		    flags->replicate, B_FALSE, flags->backup, flags->holds,
2603 		    flags->props, flags->doall, NULL, NULL);
2604 		if (err != 0)
2605 			return (err);
2606 	}
2607 
2608 	/*
2609 	 * Perform size estimate if verbose was specified.
2610 	 */
2611 	if (flags->verbosity != 0) {
2612 		err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2613 		    errbuf);
2614 		if (err != 0)
2615 			return (err);
2616 	}
2617 
2618 	if (flags->dryrun)
2619 		return (0);
2620 
2621 	/*
2622 	 * If progress reporting is requested, spawn a new thread to poll
2623 	 * ZFS_IOC_SEND_PROGRESS at a regular interval.
2624 	 */
2625 	if (flags->progress) {
2626 		pa.pa_zhp = zhp;
2627 		pa.pa_fd = fd;
2628 		pa.pa_parsable = flags->parsable;
2629 		pa.pa_estimate = B_FALSE;
2630 		pa.pa_verbosity = flags->verbosity;
2631 
2632 		err = pthread_create(&ptid, NULL,
2633 		    send_progress_thread, &pa);
2634 		if (err != 0) {
2635 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2636 			return (zfs_error(zhp->zfs_hdl,
2637 			    EZFS_THREADCREATEFAILED, errbuf));
2638 		}
2639 	}
2640 
2641 	err = lzc_send_redacted(name, from, fd,
2642 	    lzc_flags_from_sendflags(flags), redactbook);
2643 
2644 	if (flags->progress) {
2645 		void *status = NULL;
2646 		if (err != 0)
2647 			(void) pthread_cancel(ptid);
2648 		(void) pthread_join(ptid, &status);
2649 		int error = (int)(uintptr_t)status;
2650 		if (error != 0 && status != PTHREAD_CANCELED)
2651 			return (zfs_standard_error_fmt(hdl, error,
2652 			    dgettext(TEXT_DOMAIN,
2653 			    "progress thread exited nonzero")));
2654 	}
2655 
2656 	if (err == 0 && (flags->props || flags->holds || flags->backup)) {
2657 		/* Write the final end record. */
2658 		err = send_conclusion_record(fd, NULL);
2659 		if (err != 0)
2660 			return (zfs_standard_error(hdl, err, errbuf));
2661 	}
2662 	if (err != 0) {
2663 		switch (errno) {
2664 		case EXDEV:
2665 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2666 			    "not an earlier snapshot from the same fs"));
2667 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2668 
2669 		case ENOENT:
2670 		case ESRCH:
2671 			if (lzc_exists(name)) {
2672 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2673 				    "incremental source (%s) does not exist"),
2674 				    from);
2675 			}
2676 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
2677 
2678 		case EACCES:
2679 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2680 			    "dataset key must be loaded"));
2681 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2682 
2683 		case EBUSY:
2684 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2685 			    "target is busy; if a filesystem, "
2686 			    "it must not be mounted"));
2687 			return (zfs_error(hdl, EZFS_BUSY, errbuf));
2688 
2689 		case EDQUOT:
2690 		case EFAULT:
2691 		case EFBIG:
2692 		case EINVAL:
2693 		case EIO:
2694 		case ENOLINK:
2695 		case ENOSPC:
2696 		case ENOSTR:
2697 		case ENXIO:
2698 		case EPIPE:
2699 		case ERANGE:
2700 		case EROFS:
2701 			zfs_error_aux(hdl, "%s", strerror(errno));
2702 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2703 
2704 		default:
2705 			return (zfs_standard_error(hdl, errno, errbuf));
2706 		}
2707 	}
2708 	return (err != 0);
2709 }
2710 
2711 struct zfs_send_one {
2712 	zfs_handle_t *zhp;
2713 	const char *from;
2714 	sendflags_t *flags;
2715 	const char *redactbook;
2716 };
2717 
2718 static int
2719 zfs_send_one_cb(int fd, void *arg)
2720 {
2721 	struct zfs_send_one *zso = arg;
2722 	return (zfs_send_one_cb_impl(zso->zhp, zso->from, fd, zso->flags,
2723 	    zso->redactbook));
2724 }
2725 
2726 int
2727 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2728     const char *redactbook)
2729 {
2730 	struct zfs_send_one zso = {
2731 		.zhp = zhp,
2732 		.from = from,
2733 		.flags = flags,
2734 		.redactbook = redactbook,
2735 	};
2736 	return (lzc_send_wrapper(zfs_send_one_cb, fd, &zso));
2737 }
2738 
2739 /*
2740  * Routines specific to "zfs recv"
2741  */
2742 
2743 static int
2744 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2745     boolean_t byteswap, zio_cksum_t *zc)
2746 {
2747 	char *cp = buf;
2748 	int rv;
2749 	int len = ilen;
2750 
2751 	do {
2752 		rv = read(fd, cp, len);
2753 		cp += rv;
2754 		len -= rv;
2755 	} while (rv > 0);
2756 
2757 	if (rv < 0 || len != 0) {
2758 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2759 		    "failed to read from stream"));
2760 		return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2761 		    "cannot receive")));
2762 	}
2763 
2764 	if (zc) {
2765 		if (byteswap)
2766 			fletcher_4_incremental_byteswap(buf, ilen, zc);
2767 		else
2768 			fletcher_4_incremental_native(buf, ilen, zc);
2769 	}
2770 	return (0);
2771 }
2772 
2773 static int
2774 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2775     boolean_t byteswap, zio_cksum_t *zc)
2776 {
2777 	char *buf;
2778 	int err;
2779 
2780 	buf = zfs_alloc(hdl, len);
2781 	if (buf == NULL)
2782 		return (ENOMEM);
2783 
2784 	if (len > hdl->libzfs_max_nvlist) {
2785 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2786 		free(buf);
2787 		return (ENOMEM);
2788 	}
2789 
2790 	err = recv_read(hdl, fd, buf, len, byteswap, zc);
2791 	if (err != 0) {
2792 		free(buf);
2793 		return (err);
2794 	}
2795 
2796 	err = nvlist_unpack(buf, len, nvp, 0);
2797 	free(buf);
2798 	if (err != 0) {
2799 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2800 		    "stream (malformed nvlist)"));
2801 		return (EINVAL);
2802 	}
2803 	return (0);
2804 }
2805 
2806 /*
2807  * Returns the grand origin (origin of origin of origin...) of a given handle.
2808  * If this dataset is not a clone, it simply returns a copy of the original
2809  * handle.
2810  */
2811 static zfs_handle_t *
2812 recv_open_grand_origin(zfs_handle_t *zhp)
2813 {
2814 	char origin[ZFS_MAX_DATASET_NAME_LEN];
2815 	zprop_source_t src;
2816 	zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2817 
2818 	while (ozhp != NULL) {
2819 		if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2820 		    sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2821 			break;
2822 
2823 		(void) zfs_close(ozhp);
2824 		ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2825 	}
2826 
2827 	return (ozhp);
2828 }
2829 
2830 static int
2831 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2832 {
2833 	int err;
2834 	zfs_handle_t *ozhp = NULL;
2835 
2836 	/*
2837 	 * Attempt to rename the dataset. If it fails with EACCES we have
2838 	 * attempted to rename the dataset outside of its encryption root.
2839 	 * Force the dataset to become an encryption root and try again.
2840 	 */
2841 	err = lzc_rename(name, newname);
2842 	if (err == EACCES) {
2843 		ozhp = recv_open_grand_origin(zhp);
2844 		if (ozhp == NULL) {
2845 			err = ENOENT;
2846 			goto out;
2847 		}
2848 
2849 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2850 		    NULL, NULL, 0);
2851 		if (err != 0)
2852 			goto out;
2853 
2854 		err = lzc_rename(name, newname);
2855 	}
2856 
2857 out:
2858 	if (ozhp != NULL)
2859 		zfs_close(ozhp);
2860 	return (err);
2861 }
2862 
2863 static int
2864 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2865     int baselen, char *newname, recvflags_t *flags)
2866 {
2867 	static int seq;
2868 	int err;
2869 	prop_changelist_t *clp = NULL;
2870 	zfs_handle_t *zhp = NULL;
2871 
2872 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2873 	if (zhp == NULL) {
2874 		err = -1;
2875 		goto out;
2876 	}
2877 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2878 	    flags->force ? MS_FORCE : 0);
2879 	if (clp == NULL) {
2880 		err = -1;
2881 		goto out;
2882 	}
2883 	err = changelist_prefix(clp);
2884 	if (err)
2885 		goto out;
2886 
2887 	if (tryname) {
2888 		(void) strcpy(newname, tryname);
2889 		if (flags->verbose) {
2890 			(void) printf("attempting rename %s to %s\n",
2891 			    name, newname);
2892 		}
2893 		err = recv_rename_impl(zhp, name, newname);
2894 		if (err == 0)
2895 			changelist_rename(clp, name, tryname);
2896 	} else {
2897 		err = ENOENT;
2898 	}
2899 
2900 	if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2901 		seq++;
2902 
2903 		(void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2904 		    "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2905 
2906 		if (flags->verbose) {
2907 			(void) printf("failed - trying rename %s to %s\n",
2908 			    name, newname);
2909 		}
2910 		err = recv_rename_impl(zhp, name, newname);
2911 		if (err == 0)
2912 			changelist_rename(clp, name, newname);
2913 		if (err && flags->verbose) {
2914 			(void) printf("failed (%u) - "
2915 			    "will try again on next pass\n", errno);
2916 		}
2917 		err = EAGAIN;
2918 	} else if (flags->verbose) {
2919 		if (err == 0)
2920 			(void) printf("success\n");
2921 		else
2922 			(void) printf("failed (%u)\n", errno);
2923 	}
2924 
2925 	(void) changelist_postfix(clp);
2926 
2927 out:
2928 	if (clp != NULL)
2929 		changelist_free(clp);
2930 	if (zhp != NULL)
2931 		zfs_close(zhp);
2932 
2933 	return (err);
2934 }
2935 
2936 static int
2937 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2938     const char *origin_fsname, recvflags_t *flags)
2939 {
2940 	int err;
2941 	zfs_cmd_t zc = {"\0"};
2942 	zfs_handle_t *zhp = NULL, *ozhp = NULL;
2943 
2944 	if (flags->verbose)
2945 		(void) printf("promoting %s\n", fsname);
2946 
2947 	(void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2948 	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2949 
2950 	/*
2951 	 * Attempt to promote the dataset. If it fails with EACCES the
2952 	 * promotion would cause this dataset to leave its encryption root.
2953 	 * Force the origin to become an encryption root and try again.
2954 	 */
2955 	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2956 	if (err == EACCES) {
2957 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2958 		if (zhp == NULL) {
2959 			err = -1;
2960 			goto out;
2961 		}
2962 
2963 		ozhp = recv_open_grand_origin(zhp);
2964 		if (ozhp == NULL) {
2965 			err = -1;
2966 			goto out;
2967 		}
2968 
2969 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2970 		    NULL, NULL, 0);
2971 		if (err != 0)
2972 			goto out;
2973 
2974 		err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2975 	}
2976 
2977 out:
2978 	if (zhp != NULL)
2979 		zfs_close(zhp);
2980 	if (ozhp != NULL)
2981 		zfs_close(ozhp);
2982 
2983 	return (err);
2984 }
2985 
2986 static int
2987 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2988     char *newname, recvflags_t *flags)
2989 {
2990 	int err = 0;
2991 	prop_changelist_t *clp;
2992 	zfs_handle_t *zhp;
2993 	boolean_t defer = B_FALSE;
2994 	int spa_version;
2995 
2996 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2997 	if (zhp == NULL)
2998 		return (-1);
2999 	zfs_type_t type = zfs_get_type(zhp);
3000 	if (type == ZFS_TYPE_SNAPSHOT &&
3001 	    zfs_spa_version(zhp, &spa_version) == 0 &&
3002 	    spa_version >= SPA_VERSION_USERREFS)
3003 		defer = B_TRUE;
3004 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
3005 	    flags->force ? MS_FORCE : 0);
3006 	zfs_close(zhp);
3007 	if (clp == NULL)
3008 		return (-1);
3009 
3010 	err = changelist_prefix(clp);
3011 	if (err)
3012 		return (err);
3013 
3014 	if (flags->verbose)
3015 		(void) printf("attempting destroy %s\n", name);
3016 	if (type == ZFS_TYPE_SNAPSHOT) {
3017 		nvlist_t *nv = fnvlist_alloc();
3018 		fnvlist_add_boolean(nv, name);
3019 		err = lzc_destroy_snaps(nv, defer, NULL);
3020 		fnvlist_free(nv);
3021 	} else {
3022 		err = lzc_destroy(name);
3023 	}
3024 	if (err == 0) {
3025 		if (flags->verbose)
3026 			(void) printf("success\n");
3027 		changelist_remove(clp, name);
3028 	}
3029 
3030 	(void) changelist_postfix(clp);
3031 	changelist_free(clp);
3032 
3033 	/*
3034 	 * Deferred destroy might destroy the snapshot or only mark it to be
3035 	 * destroyed later, and it returns success in either case.
3036 	 */
3037 	if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
3038 	    ZFS_TYPE_SNAPSHOT))) {
3039 		err = recv_rename(hdl, name, NULL, baselen, newname, flags);
3040 	}
3041 
3042 	return (err);
3043 }
3044 
3045 typedef struct guid_to_name_data {
3046 	uint64_t guid;
3047 	boolean_t bookmark_ok;
3048 	char *name;
3049 	char *skip;
3050 	uint64_t *redact_snap_guids;
3051 	uint64_t num_redact_snaps;
3052 } guid_to_name_data_t;
3053 
3054 static boolean_t
3055 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
3056 {
3057 	uint64_t *bmark_snaps;
3058 	uint_t bmark_num_snaps;
3059 	nvlist_t *nvl;
3060 	if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
3061 		return (B_FALSE);
3062 
3063 	nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
3064 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
3065 	bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
3066 	    &bmark_num_snaps);
3067 	if (bmark_num_snaps != gtnd->num_redact_snaps)
3068 		return (B_FALSE);
3069 	int i = 0;
3070 	for (; i < bmark_num_snaps; i++) {
3071 		int j = 0;
3072 		for (; j < bmark_num_snaps; j++) {
3073 			if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
3074 				break;
3075 		}
3076 		if (j == bmark_num_snaps)
3077 			break;
3078 	}
3079 	return (i == bmark_num_snaps);
3080 }
3081 
3082 static int
3083 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
3084 {
3085 	guid_to_name_data_t *gtnd = arg;
3086 	const char *slash;
3087 	int err;
3088 
3089 	if (gtnd->skip != NULL &&
3090 	    (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
3091 	    strcmp(slash + 1, gtnd->skip) == 0) {
3092 		zfs_close(zhp);
3093 		return (0);
3094 	}
3095 
3096 	if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
3097 	    (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
3098 		(void) strcpy(gtnd->name, zhp->zfs_name);
3099 		zfs_close(zhp);
3100 		return (EEXIST);
3101 	}
3102 
3103 	err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
3104 	if (err != EEXIST && gtnd->bookmark_ok)
3105 		err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
3106 	zfs_close(zhp);
3107 	return (err);
3108 }
3109 
3110 /*
3111  * Attempt to find the local dataset associated with this guid.  In the case of
3112  * multiple matches, we attempt to find the "best" match by searching
3113  * progressively larger portions of the hierarchy.  This allows one to send a
3114  * tree of datasets individually and guarantee that we will find the source
3115  * guid within that hierarchy, even if there are multiple matches elsewhere.
3116  *
3117  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
3118  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
3119  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
3120  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
3121  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
3122  * given guid.  Note that a redaction bookmark can be returned if
3123  * num_redact_snaps == -1.
3124  */
3125 static int
3126 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
3127     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
3128     uint64_t num_redact_snaps, char *name)
3129 {
3130 	char pname[ZFS_MAX_DATASET_NAME_LEN];
3131 	guid_to_name_data_t gtnd;
3132 
3133 	gtnd.guid = guid;
3134 	gtnd.bookmark_ok = bookmark_ok;
3135 	gtnd.name = name;
3136 	gtnd.skip = NULL;
3137 	gtnd.redact_snap_guids = redact_snap_guids;
3138 	gtnd.num_redact_snaps = num_redact_snaps;
3139 
3140 	/*
3141 	 * Search progressively larger portions of the hierarchy, starting
3142 	 * with the filesystem specified by 'parent'.  This will
3143 	 * select the "most local" version of the origin snapshot in the case
3144 	 * that there are multiple matching snapshots in the system.
3145 	 */
3146 	(void) strlcpy(pname, parent, sizeof (pname));
3147 	char *cp = strrchr(pname, '@');
3148 	if (cp == NULL)
3149 		cp = strchr(pname, '\0');
3150 	for (; cp != NULL; cp = strrchr(pname, '/')) {
3151 		/* Chop off the last component and open the parent */
3152 		*cp = '\0';
3153 		zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3154 
3155 		if (zhp == NULL)
3156 			continue;
3157 		int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3158 		if (err != EEXIST)
3159 			err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3160 		if (err != EEXIST && bookmark_ok)
3161 			err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3162 		zfs_close(zhp);
3163 		if (err == EEXIST)
3164 			return (0);
3165 
3166 		/*
3167 		 * Remember the last portion of the dataset so we skip it next
3168 		 * time through (as we've already searched that portion of the
3169 		 * hierarchy).
3170 		 */
3171 		gtnd.skip = strrchr(pname, '/') + 1;
3172 	}
3173 
3174 	return (ENOENT);
3175 }
3176 
3177 static int
3178 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3179     boolean_t bookmark_ok, char *name)
3180 {
3181 	return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3182 	    -1, name));
3183 }
3184 
3185 /*
3186  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3187  * guid1 is after guid2.
3188  */
3189 static int
3190 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3191     uint64_t guid1, uint64_t guid2)
3192 {
3193 	nvlist_t *nvfs;
3194 	char *fsname = NULL, *snapname = NULL;
3195 	char buf[ZFS_MAX_DATASET_NAME_LEN];
3196 	int rv;
3197 	zfs_handle_t *guid1hdl, *guid2hdl;
3198 	uint64_t create1, create2;
3199 
3200 	if (guid2 == 0)
3201 		return (0);
3202 	if (guid1 == 0)
3203 		return (1);
3204 
3205 	nvfs = fsavl_find(avl, guid1, &snapname);
3206 	fsname = fnvlist_lookup_string(nvfs, "name");
3207 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3208 	guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3209 	if (guid1hdl == NULL)
3210 		return (-1);
3211 
3212 	nvfs = fsavl_find(avl, guid2, &snapname);
3213 	fsname = fnvlist_lookup_string(nvfs, "name");
3214 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3215 	guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3216 	if (guid2hdl == NULL) {
3217 		zfs_close(guid1hdl);
3218 		return (-1);
3219 	}
3220 
3221 	create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3222 	create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3223 
3224 	if (create1 < create2)
3225 		rv = -1;
3226 	else if (create1 > create2)
3227 		rv = +1;
3228 	else
3229 		rv = 0;
3230 
3231 	zfs_close(guid1hdl);
3232 	zfs_close(guid2hdl);
3233 
3234 	return (rv);
3235 }
3236 
3237 /*
3238  * This function reestablishes the hierarchy of encryption roots after a
3239  * recursive incremental receive has completed. This must be done after the
3240  * second call to recv_incremental_replication() has renamed and promoted all
3241  * sent datasets to their final locations in the dataset hierarchy.
3242  */
3243 static int
3244 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3245     nvlist_t *stream_nv)
3246 {
3247 	int err;
3248 	nvpair_t *fselem = NULL;
3249 	nvlist_t *stream_fss;
3250 
3251 	stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3252 
3253 	while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3254 		zfs_handle_t *zhp = NULL;
3255 		uint64_t crypt;
3256 		nvlist_t *snaps, *props, *stream_nvfs = NULL;
3257 		nvpair_t *snapel = NULL;
3258 		boolean_t is_encroot, is_clone, stream_encroot;
3259 		char *cp;
3260 		char *stream_keylocation = NULL;
3261 		char keylocation[MAXNAMELEN];
3262 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
3263 
3264 		keylocation[0] = '\0';
3265 		stream_nvfs = fnvpair_value_nvlist(fselem);
3266 		snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3267 		props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3268 		stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3269 
3270 		/* find a snapshot from the stream that exists locally */
3271 		err = ENOENT;
3272 		while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3273 			uint64_t guid;
3274 
3275 			guid = fnvpair_value_uint64(snapel);
3276 			err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3277 			    fsname);
3278 			if (err == 0)
3279 				break;
3280 		}
3281 
3282 		if (err != 0)
3283 			continue;
3284 
3285 		cp = strchr(fsname, '@');
3286 		if (cp != NULL)
3287 			*cp = '\0';
3288 
3289 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3290 		if (zhp == NULL) {
3291 			err = ENOENT;
3292 			goto error;
3293 		}
3294 
3295 		crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3296 		is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3297 		(void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3298 
3299 		/* we don't need to do anything for unencrypted datasets */
3300 		if (crypt == ZIO_CRYPT_OFF) {
3301 			zfs_close(zhp);
3302 			continue;
3303 		}
3304 
3305 		/*
3306 		 * If the dataset is flagged as an encryption root, was not
3307 		 * received as a clone and is not currently an encryption root,
3308 		 * force it to become one. Fixup the keylocation if necessary.
3309 		 */
3310 		if (stream_encroot) {
3311 			if (!is_clone && !is_encroot) {
3312 				err = lzc_change_key(fsname,
3313 				    DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3314 				if (err != 0) {
3315 					zfs_close(zhp);
3316 					goto error;
3317 				}
3318 			}
3319 
3320 			stream_keylocation = fnvlist_lookup_string(props,
3321 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3322 
3323 			/*
3324 			 * Refresh the properties in case the call to
3325 			 * lzc_change_key() changed the value.
3326 			 */
3327 			zfs_refresh_properties(zhp);
3328 			err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3329 			    keylocation, sizeof (keylocation), NULL, NULL,
3330 			    0, B_TRUE);
3331 			if (err != 0) {
3332 				zfs_close(zhp);
3333 				goto error;
3334 			}
3335 
3336 			if (strcmp(keylocation, stream_keylocation) != 0) {
3337 				err = zfs_prop_set(zhp,
3338 				    zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3339 				    stream_keylocation);
3340 				if (err != 0) {
3341 					zfs_close(zhp);
3342 					goto error;
3343 				}
3344 			}
3345 		}
3346 
3347 		/*
3348 		 * If the dataset is not flagged as an encryption root and is
3349 		 * currently an encryption root, force it to inherit from its
3350 		 * parent. The root of a raw send should never be
3351 		 * force-inherited.
3352 		 */
3353 		if (!stream_encroot && is_encroot &&
3354 		    strcmp(top_zfs, fsname) != 0) {
3355 			err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3356 			    NULL, NULL, 0);
3357 			if (err != 0) {
3358 				zfs_close(zhp);
3359 				goto error;
3360 			}
3361 		}
3362 
3363 		zfs_close(zhp);
3364 	}
3365 
3366 	return (0);
3367 
3368 error:
3369 	return (err);
3370 }
3371 
3372 static int
3373 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3374     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3375     nvlist_t *renamed)
3376 {
3377 	nvlist_t *local_nv, *deleted = NULL;
3378 	avl_tree_t *local_avl;
3379 	nvpair_t *fselem, *nextfselem;
3380 	char *fromsnap;
3381 	char newname[ZFS_MAX_DATASET_NAME_LEN];
3382 	char guidname[32];
3383 	int error;
3384 	boolean_t needagain, progress, recursive;
3385 	char *s1, *s2;
3386 
3387 	fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3388 
3389 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3390 	    ENOENT);
3391 
3392 	if (flags->dryrun)
3393 		return (0);
3394 
3395 again:
3396 	needagain = progress = B_FALSE;
3397 
3398 	deleted = fnvlist_alloc();
3399 
3400 	if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3401 	    recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3402 	    B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3403 		return (error);
3404 
3405 	/*
3406 	 * Process deletes and renames
3407 	 */
3408 	for (fselem = nvlist_next_nvpair(local_nv, NULL);
3409 	    fselem; fselem = nextfselem) {
3410 		nvlist_t *nvfs, *snaps;
3411 		nvlist_t *stream_nvfs = NULL;
3412 		nvpair_t *snapelem, *nextsnapelem;
3413 		uint64_t fromguid = 0;
3414 		uint64_t originguid = 0;
3415 		uint64_t stream_originguid = 0;
3416 		uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3417 		char *fsname, *stream_fsname;
3418 
3419 		nextfselem = nvlist_next_nvpair(local_nv, fselem);
3420 
3421 		nvfs = fnvpair_value_nvlist(fselem);
3422 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3423 		fsname = fnvlist_lookup_string(nvfs, "name");
3424 		parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3425 		    "parentfromsnap");
3426 		(void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3427 
3428 		/*
3429 		 * First find the stream's fs, so we can check for
3430 		 * a different origin (due to "zfs promote")
3431 		 */
3432 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3433 		    snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3434 			uint64_t thisguid;
3435 
3436 			thisguid = fnvpair_value_uint64(snapelem);
3437 			stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3438 
3439 			if (stream_nvfs != NULL)
3440 				break;
3441 		}
3442 
3443 		/* check for promote */
3444 		(void) nvlist_lookup_uint64(stream_nvfs, "origin",
3445 		    &stream_originguid);
3446 		if (stream_nvfs && originguid != stream_originguid) {
3447 			switch (created_before(hdl, local_avl,
3448 			    stream_originguid, originguid)) {
3449 			case 1: {
3450 				/* promote it! */
3451 				nvlist_t *origin_nvfs;
3452 				char *origin_fsname;
3453 
3454 				origin_nvfs = fsavl_find(local_avl, originguid,
3455 				    NULL);
3456 				origin_fsname = fnvlist_lookup_string(
3457 				    origin_nvfs, "name");
3458 				error = recv_promote(hdl, fsname, origin_fsname,
3459 				    flags);
3460 				if (error == 0)
3461 					progress = B_TRUE;
3462 				break;
3463 			}
3464 			default:
3465 				break;
3466 			case -1:
3467 				fsavl_destroy(local_avl);
3468 				fnvlist_free(local_nv);
3469 				return (-1);
3470 			}
3471 			/*
3472 			 * We had/have the wrong origin, therefore our
3473 			 * list of snapshots is wrong.  Need to handle
3474 			 * them on the next pass.
3475 			 */
3476 			needagain = B_TRUE;
3477 			continue;
3478 		}
3479 
3480 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3481 		    snapelem; snapelem = nextsnapelem) {
3482 			uint64_t thisguid;
3483 			char *stream_snapname;
3484 			nvlist_t *found, *props;
3485 
3486 			nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3487 
3488 			thisguid = fnvpair_value_uint64(snapelem);
3489 			found = fsavl_find(stream_avl, thisguid,
3490 			    &stream_snapname);
3491 
3492 			/* check for delete */
3493 			if (found == NULL) {
3494 				char name[ZFS_MAX_DATASET_NAME_LEN];
3495 
3496 				if (!flags->force)
3497 					continue;
3498 
3499 				(void) snprintf(name, sizeof (name), "%s@%s",
3500 				    fsname, nvpair_name(snapelem));
3501 
3502 				error = recv_destroy(hdl, name,
3503 				    strlen(fsname)+1, newname, flags);
3504 				if (error)
3505 					needagain = B_TRUE;
3506 				else
3507 					progress = B_TRUE;
3508 				sprintf(guidname, "%llu",
3509 				    (u_longlong_t)thisguid);
3510 				nvlist_add_boolean(deleted, guidname);
3511 				continue;
3512 			}
3513 
3514 			stream_nvfs = found;
3515 
3516 			if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3517 			    &props) && 0 == nvlist_lookup_nvlist(props,
3518 			    stream_snapname, &props)) {
3519 				zfs_cmd_t zc = {"\0"};
3520 
3521 				zc.zc_cookie = B_TRUE; /* received */
3522 				(void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3523 				    "%s@%s", fsname, nvpair_name(snapelem));
3524 				if (zcmd_write_src_nvlist(hdl, &zc,
3525 				    props) == 0) {
3526 					(void) zfs_ioctl(hdl,
3527 					    ZFS_IOC_SET_PROP, &zc);
3528 					zcmd_free_nvlists(&zc);
3529 				}
3530 			}
3531 
3532 			/* check for different snapname */
3533 			if (strcmp(nvpair_name(snapelem),
3534 			    stream_snapname) != 0) {
3535 				char name[ZFS_MAX_DATASET_NAME_LEN];
3536 				char tryname[ZFS_MAX_DATASET_NAME_LEN];
3537 
3538 				(void) snprintf(name, sizeof (name), "%s@%s",
3539 				    fsname, nvpair_name(snapelem));
3540 				(void) snprintf(tryname, sizeof (name), "%s@%s",
3541 				    fsname, stream_snapname);
3542 
3543 				error = recv_rename(hdl, name, tryname,
3544 				    strlen(fsname)+1, newname, flags);
3545 				if (error)
3546 					needagain = B_TRUE;
3547 				else
3548 					progress = B_TRUE;
3549 			}
3550 
3551 			if (strcmp(stream_snapname, fromsnap) == 0)
3552 				fromguid = thisguid;
3553 		}
3554 
3555 		/* check for delete */
3556 		if (stream_nvfs == NULL) {
3557 			if (!flags->force)
3558 				continue;
3559 
3560 			error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3561 			    newname, flags);
3562 			if (error)
3563 				needagain = B_TRUE;
3564 			else
3565 				progress = B_TRUE;
3566 			sprintf(guidname, "%llu",
3567 			    (u_longlong_t)parent_fromsnap_guid);
3568 			nvlist_add_boolean(deleted, guidname);
3569 			continue;
3570 		}
3571 
3572 		if (fromguid == 0) {
3573 			if (flags->verbose) {
3574 				(void) printf("local fs %s does not have "
3575 				    "fromsnap (%s in stream); must have "
3576 				    "been deleted locally; ignoring\n",
3577 				    fsname, fromsnap);
3578 			}
3579 			continue;
3580 		}
3581 
3582 		stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3583 		stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3584 		    stream_nvfs, "parentfromsnap");
3585 
3586 		s1 = strrchr(fsname, '/');
3587 		s2 = strrchr(stream_fsname, '/');
3588 
3589 		/*
3590 		 * Check if we're going to rename based on parent guid change
3591 		 * and the current parent guid was also deleted. If it was then
3592 		 * rename will fail and is likely unneeded, so avoid this and
3593 		 * force an early retry to determine the new
3594 		 * parent_fromsnap_guid.
3595 		 */
3596 		if (stream_parent_fromsnap_guid != 0 &&
3597 		    parent_fromsnap_guid != 0 &&
3598 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3599 			sprintf(guidname, "%llu",
3600 			    (u_longlong_t)parent_fromsnap_guid);
3601 			if (nvlist_exists(deleted, guidname)) {
3602 				progress = B_TRUE;
3603 				needagain = B_TRUE;
3604 				goto doagain;
3605 			}
3606 		}
3607 
3608 		/*
3609 		 * Check for rename. If the exact receive path is specified, it
3610 		 * does not count as a rename, but we still need to check the
3611 		 * datasets beneath it.
3612 		 */
3613 		if ((stream_parent_fromsnap_guid != 0 &&
3614 		    parent_fromsnap_guid != 0 &&
3615 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3616 		    ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3617 		    (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3618 			nvlist_t *parent;
3619 			char tryname[ZFS_MAX_DATASET_NAME_LEN];
3620 
3621 			parent = fsavl_find(local_avl,
3622 			    stream_parent_fromsnap_guid, NULL);
3623 			/*
3624 			 * NB: parent might not be found if we used the
3625 			 * tosnap for stream_parent_fromsnap_guid,
3626 			 * because the parent is a newly-created fs;
3627 			 * we'll be able to rename it after we recv the
3628 			 * new fs.
3629 			 */
3630 			if (parent != NULL) {
3631 				char *pname;
3632 
3633 				pname = fnvlist_lookup_string(parent, "name");
3634 				(void) snprintf(tryname, sizeof (tryname),
3635 				    "%s%s", pname, strrchr(stream_fsname, '/'));
3636 			} else {
3637 				tryname[0] = '\0';
3638 				if (flags->verbose) {
3639 					(void) printf("local fs %s new parent "
3640 					    "not found\n", fsname);
3641 				}
3642 			}
3643 
3644 			newname[0] = '\0';
3645 
3646 			error = recv_rename(hdl, fsname, tryname,
3647 			    strlen(tofs)+1, newname, flags);
3648 
3649 			if (renamed != NULL && newname[0] != '\0') {
3650 				fnvlist_add_boolean(renamed, newname);
3651 			}
3652 
3653 			if (error)
3654 				needagain = B_TRUE;
3655 			else
3656 				progress = B_TRUE;
3657 		}
3658 	}
3659 
3660 doagain:
3661 	fsavl_destroy(local_avl);
3662 	fnvlist_free(local_nv);
3663 	fnvlist_free(deleted);
3664 
3665 	if (needagain && progress) {
3666 		/* do another pass to fix up temporary names */
3667 		if (flags->verbose)
3668 			(void) printf("another pass:\n");
3669 		goto again;
3670 	}
3671 
3672 	return (needagain || error != 0);
3673 }
3674 
3675 static int
3676 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3677     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3678     char **top_zfs, nvlist_t *cmdprops)
3679 {
3680 	nvlist_t *stream_nv = NULL;
3681 	avl_tree_t *stream_avl = NULL;
3682 	char *fromsnap = NULL;
3683 	char *sendsnap = NULL;
3684 	char *cp;
3685 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
3686 	char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3687 	char errbuf[1024];
3688 	dmu_replay_record_t drre;
3689 	int error;
3690 	boolean_t anyerr = B_FALSE;
3691 	boolean_t softerr = B_FALSE;
3692 	boolean_t recursive, raw;
3693 
3694 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3695 	    "cannot receive"));
3696 
3697 	assert(drr->drr_type == DRR_BEGIN);
3698 	assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3699 	assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3700 	    DMU_COMPOUNDSTREAM);
3701 
3702 	/*
3703 	 * Read in the nvlist from the stream.
3704 	 */
3705 	if (drr->drr_payloadlen != 0) {
3706 		error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3707 		    &stream_nv, flags->byteswap, zc);
3708 		if (error) {
3709 			error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3710 			goto out;
3711 		}
3712 	}
3713 
3714 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3715 	    ENOENT);
3716 	raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3717 
3718 	if (recursive && strchr(destname, '@')) {
3719 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3720 		    "cannot specify snapshot name for multi-snapshot stream"));
3721 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3722 		goto out;
3723 	}
3724 
3725 	/*
3726 	 * Read in the end record and verify checksum.
3727 	 */
3728 	if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3729 	    flags->byteswap, NULL)))
3730 		goto out;
3731 	if (flags->byteswap) {
3732 		drre.drr_type = BSWAP_32(drre.drr_type);
3733 		drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3734 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3735 		drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3736 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3737 		drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3738 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3739 		drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3740 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3741 	}
3742 	if (drre.drr_type != DRR_END) {
3743 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3744 		goto out;
3745 	}
3746 	if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3747 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3748 		    "incorrect header checksum"));
3749 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3750 		goto out;
3751 	}
3752 
3753 	(void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3754 
3755 	if (drr->drr_payloadlen != 0) {
3756 		nvlist_t *stream_fss;
3757 
3758 		stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3759 		if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3760 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3761 			    "couldn't allocate avl tree"));
3762 			error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3763 			goto out;
3764 		}
3765 
3766 		if (fromsnap != NULL && recursive) {
3767 			nvlist_t *renamed = NULL;
3768 			nvpair_t *pair = NULL;
3769 
3770 			(void) strlcpy(tofs, destname, sizeof (tofs));
3771 			if (flags->isprefix) {
3772 				struct drr_begin *drrb = &drr->drr_u.drr_begin;
3773 				int i;
3774 
3775 				if (flags->istail) {
3776 					cp = strrchr(drrb->drr_toname, '/');
3777 					if (cp == NULL) {
3778 						(void) strlcat(tofs, "/",
3779 						    sizeof (tofs));
3780 						i = 0;
3781 					} else {
3782 						i = (cp - drrb->drr_toname);
3783 					}
3784 				} else {
3785 					i = strcspn(drrb->drr_toname, "/@");
3786 				}
3787 				/* zfs_receive_one() will create_parents() */
3788 				(void) strlcat(tofs, &drrb->drr_toname[i],
3789 				    sizeof (tofs));
3790 				*strchr(tofs, '@') = '\0';
3791 			}
3792 
3793 			if (!flags->dryrun && !flags->nomount) {
3794 				renamed = fnvlist_alloc();
3795 			}
3796 
3797 			softerr = recv_incremental_replication(hdl, tofs, flags,
3798 			    stream_nv, stream_avl, renamed);
3799 
3800 			/* Unmount renamed filesystems before receiving. */
3801 			while ((pair = nvlist_next_nvpair(renamed,
3802 			    pair)) != NULL) {
3803 				zfs_handle_t *zhp;
3804 				prop_changelist_t *clp = NULL;
3805 
3806 				zhp = zfs_open(hdl, nvpair_name(pair),
3807 				    ZFS_TYPE_FILESYSTEM);
3808 				if (zhp != NULL) {
3809 					clp = changelist_gather(zhp,
3810 					    ZFS_PROP_MOUNTPOINT, 0,
3811 					    flags->forceunmount ? MS_FORCE : 0);
3812 					zfs_close(zhp);
3813 					if (clp != NULL) {
3814 						softerr |=
3815 						    changelist_prefix(clp);
3816 						changelist_free(clp);
3817 					}
3818 				}
3819 			}
3820 
3821 			fnvlist_free(renamed);
3822 		}
3823 	}
3824 
3825 	/*
3826 	 * Get the fs specified by the first path in the stream (the top level
3827 	 * specified by 'zfs send') and pass it to each invocation of
3828 	 * zfs_receive_one().
3829 	 */
3830 	(void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3831 	    sizeof (sendfs));
3832 	if ((cp = strchr(sendfs, '@')) != NULL) {
3833 		*cp = '\0';
3834 		/*
3835 		 * Find the "sendsnap", the final snapshot in a replication
3836 		 * stream.  zfs_receive_one() handles certain errors
3837 		 * differently, depending on if the contained stream is the
3838 		 * last one or not.
3839 		 */
3840 		sendsnap = (cp + 1);
3841 	}
3842 
3843 	/* Finally, receive each contained stream */
3844 	do {
3845 		/*
3846 		 * we should figure out if it has a recoverable
3847 		 * error, in which case do a recv_skip() and drive on.
3848 		 * Note, if we fail due to already having this guid,
3849 		 * zfs_receive_one() will take care of it (ie,
3850 		 * recv_skip() and return 0).
3851 		 */
3852 		error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3853 		    sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3854 		if (error == ENODATA) {
3855 			error = 0;
3856 			break;
3857 		}
3858 		anyerr |= error;
3859 	} while (error == 0);
3860 
3861 	if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3862 		/*
3863 		 * Now that we have the fs's they sent us, try the
3864 		 * renames again.
3865 		 */
3866 		softerr = recv_incremental_replication(hdl, tofs, flags,
3867 		    stream_nv, stream_avl, NULL);
3868 	}
3869 
3870 	if (raw && softerr == 0 && *top_zfs != NULL) {
3871 		softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3872 		    stream_nv);
3873 	}
3874 
3875 out:
3876 	fsavl_destroy(stream_avl);
3877 	fnvlist_free(stream_nv);
3878 	if (softerr)
3879 		error = -2;
3880 	if (anyerr)
3881 		error = -1;
3882 	return (error);
3883 }
3884 
3885 static void
3886 trunc_prop_errs(int truncated)
3887 {
3888 	ASSERT(truncated != 0);
3889 
3890 	if (truncated == 1)
3891 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3892 		    "1 more property could not be set\n"));
3893 	else
3894 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3895 		    "%d more properties could not be set\n"), truncated);
3896 }
3897 
3898 static int
3899 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3900 {
3901 	dmu_replay_record_t *drr;
3902 	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3903 	uint64_t payload_size;
3904 	char errbuf[1024];
3905 
3906 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3907 	    "cannot receive"));
3908 
3909 	/* XXX would be great to use lseek if possible... */
3910 	drr = buf;
3911 
3912 	while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3913 	    byteswap, NULL) == 0) {
3914 		if (byteswap)
3915 			drr->drr_type = BSWAP_32(drr->drr_type);
3916 
3917 		switch (drr->drr_type) {
3918 		case DRR_BEGIN:
3919 			if (drr->drr_payloadlen != 0) {
3920 				(void) recv_read(hdl, fd, buf,
3921 				    drr->drr_payloadlen, B_FALSE, NULL);
3922 			}
3923 			break;
3924 
3925 		case DRR_END:
3926 			free(buf);
3927 			return (0);
3928 
3929 		case DRR_OBJECT:
3930 			if (byteswap) {
3931 				drr->drr_u.drr_object.drr_bonuslen =
3932 				    BSWAP_32(drr->drr_u.drr_object.
3933 				    drr_bonuslen);
3934 				drr->drr_u.drr_object.drr_raw_bonuslen =
3935 				    BSWAP_32(drr->drr_u.drr_object.
3936 				    drr_raw_bonuslen);
3937 			}
3938 
3939 			payload_size =
3940 			    DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3941 			(void) recv_read(hdl, fd, buf, payload_size,
3942 			    B_FALSE, NULL);
3943 			break;
3944 
3945 		case DRR_WRITE:
3946 			if (byteswap) {
3947 				drr->drr_u.drr_write.drr_logical_size =
3948 				    BSWAP_64(
3949 				    drr->drr_u.drr_write.drr_logical_size);
3950 				drr->drr_u.drr_write.drr_compressed_size =
3951 				    BSWAP_64(
3952 				    drr->drr_u.drr_write.drr_compressed_size);
3953 			}
3954 			payload_size =
3955 			    DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3956 			assert(payload_size <= SPA_MAXBLOCKSIZE);
3957 			(void) recv_read(hdl, fd, buf,
3958 			    payload_size, B_FALSE, NULL);
3959 			break;
3960 		case DRR_SPILL:
3961 			if (byteswap) {
3962 				drr->drr_u.drr_spill.drr_length =
3963 				    BSWAP_64(drr->drr_u.drr_spill.drr_length);
3964 				drr->drr_u.drr_spill.drr_compressed_size =
3965 				    BSWAP_64(drr->drr_u.drr_spill.
3966 				    drr_compressed_size);
3967 			}
3968 
3969 			payload_size =
3970 			    DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3971 			(void) recv_read(hdl, fd, buf, payload_size,
3972 			    B_FALSE, NULL);
3973 			break;
3974 		case DRR_WRITE_EMBEDDED:
3975 			if (byteswap) {
3976 				drr->drr_u.drr_write_embedded.drr_psize =
3977 				    BSWAP_32(drr->drr_u.drr_write_embedded.
3978 				    drr_psize);
3979 			}
3980 			(void) recv_read(hdl, fd, buf,
3981 			    P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3982 			    8), B_FALSE, NULL);
3983 			break;
3984 		case DRR_OBJECT_RANGE:
3985 		case DRR_WRITE_BYREF:
3986 		case DRR_FREEOBJECTS:
3987 		case DRR_FREE:
3988 			break;
3989 
3990 		default:
3991 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3992 			    "invalid record type"));
3993 			free(buf);
3994 			return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3995 		}
3996 	}
3997 
3998 	free(buf);
3999 	return (-1);
4000 }
4001 
4002 static void
4003 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
4004     boolean_t resumable, boolean_t checksum)
4005 {
4006 	char target_fs[ZFS_MAX_DATASET_NAME_LEN];
4007 
4008 	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
4009 	    "checksum mismatch" : "incomplete stream")));
4010 
4011 	if (!resumable)
4012 		return;
4013 	(void) strlcpy(target_fs, target_snap, sizeof (target_fs));
4014 	*strchr(target_fs, '@') = '\0';
4015 	zfs_handle_t *zhp = zfs_open(hdl, target_fs,
4016 	    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
4017 	if (zhp == NULL)
4018 		return;
4019 
4020 	char token_buf[ZFS_MAXPROPLEN];
4021 	int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
4022 	    token_buf, sizeof (token_buf),
4023 	    NULL, NULL, 0, B_TRUE);
4024 	if (error == 0) {
4025 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4026 		    "checksum mismatch or incomplete stream.\n"
4027 		    "Partially received snapshot is saved.\n"
4028 		    "A resuming stream can be generated on the sending "
4029 		    "system by running:\n"
4030 		    "    zfs send -t %s"),
4031 		    token_buf);
4032 	}
4033 	zfs_close(zhp);
4034 }
4035 
4036 /*
4037  * Prepare a new nvlist of properties that are to override (-o) or be excluded
4038  * (-x) from the received dataset
4039  * recvprops: received properties from the send stream
4040  * cmdprops: raw input properties from command line
4041  * origprops: properties, both locally-set and received, currently set on the
4042  *            target dataset if it exists, NULL otherwise.
4043  * oxprops: valid output override (-o) and excluded (-x) properties
4044  */
4045 static int
4046 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
4047     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
4048     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
4049     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
4050     uint_t *wkeylen_out, const char *errbuf)
4051 {
4052 	nvpair_t *nvp;
4053 	nvlist_t *oprops, *voprops;
4054 	zfs_handle_t *zhp = NULL;
4055 	zpool_handle_t *zpool_hdl = NULL;
4056 	char *cp;
4057 	int ret = 0;
4058 	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
4059 
4060 	if (nvlist_empty(cmdprops))
4061 		return (0); /* No properties to override or exclude */
4062 
4063 	*oxprops = fnvlist_alloc();
4064 	oprops = fnvlist_alloc();
4065 
4066 	strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
4067 
4068 	/*
4069 	 * Get our dataset handle. The target dataset may not exist yet.
4070 	 */
4071 	if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
4072 		zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
4073 		if (zhp == NULL) {
4074 			ret = -1;
4075 			goto error;
4076 		}
4077 	}
4078 
4079 	/* open the zpool handle */
4080 	cp = strchr(namebuf, '/');
4081 	if (cp != NULL)
4082 		*cp = '\0';
4083 	zpool_hdl = zpool_open(hdl, namebuf);
4084 	if (zpool_hdl == NULL) {
4085 		ret = -1;
4086 		goto error;
4087 	}
4088 
4089 	/* restore namebuf to match fsname for later use */
4090 	if (cp != NULL)
4091 		*cp = '/';
4092 
4093 	/*
4094 	 * first iteration: process excluded (-x) properties now and gather
4095 	 * added (-o) properties to be later processed by zfs_valid_proplist()
4096 	 */
4097 	nvp = NULL;
4098 	while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
4099 		const char *name = nvpair_name(nvp);
4100 		zfs_prop_t prop = zfs_name_to_prop(name);
4101 
4102 		/*
4103 		 * It turns out, if we don't normalize "aliased" names
4104 		 * e.g. compress= against the "real" names (e.g. compression)
4105 		 * here, then setting/excluding them does not work as
4106 		 * intended.
4107 		 *
4108 		 * But since user-defined properties wouldn't have a valid
4109 		 * mapping here, we do this conditional dance.
4110 		 */
4111 		const char *newname = name;
4112 		if (prop >= ZFS_PROP_TYPE)
4113 			newname = zfs_prop_to_name(prop);
4114 
4115 		/* "origin" is processed separately, don't handle it here */
4116 		if (prop == ZFS_PROP_ORIGIN)
4117 			continue;
4118 
4119 		/* raw streams can't override encryption properties */
4120 		if ((zfs_prop_encryption_key_param(prop) ||
4121 		    prop == ZFS_PROP_ENCRYPTION) && raw) {
4122 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4123 			    "encryption property '%s' cannot "
4124 			    "be set or excluded for raw streams."), name);
4125 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4126 			goto error;
4127 		}
4128 
4129 		/* incremental streams can only exclude encryption properties */
4130 		if ((zfs_prop_encryption_key_param(prop) ||
4131 		    prop == ZFS_PROP_ENCRYPTION) && !newfs &&
4132 		    nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
4133 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4134 			    "encryption property '%s' cannot "
4135 			    "be set for incremental streams."), name);
4136 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4137 			goto error;
4138 		}
4139 
4140 		switch (nvpair_type(nvp)) {
4141 		case DATA_TYPE_BOOLEAN: /* -x property */
4142 			/*
4143 			 * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4144 			 * a property: this is done by forcing an explicit
4145 			 * inherit on the destination so the effective value is
4146 			 * not the one we received from the send stream.
4147 			 */
4148 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4149 			    !zfs_prop_user(name)) {
4150 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4151 				    "Warning: %s: property '%s' does not "
4152 				    "apply to datasets of this type\n"),
4153 				    fsname, name);
4154 				continue;
4155 			}
4156 			/*
4157 			 * We do this only if the property is not already
4158 			 * locally-set, in which case its value will take
4159 			 * priority over the received anyway.
4160 			 */
4161 			if (nvlist_exists(origprops, newname)) {
4162 				nvlist_t *attrs;
4163 				char *source = NULL;
4164 
4165 				attrs = fnvlist_lookup_nvlist(origprops,
4166 				    newname);
4167 				if (nvlist_lookup_string(attrs,
4168 				    ZPROP_SOURCE, &source) == 0 &&
4169 				    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4170 					continue;
4171 			}
4172 			/*
4173 			 * We can't force an explicit inherit on non-inheritable
4174 			 * properties: if we're asked to exclude this kind of
4175 			 * values we remove them from "recvprops" input nvlist.
4176 			 */
4177 			if (!zfs_prop_user(name) && /* can be inherited too */
4178 			    !zfs_prop_inheritable(prop) &&
4179 			    nvlist_exists(recvprops, newname))
4180 				fnvlist_remove(recvprops, newname);
4181 			else
4182 				fnvlist_add_boolean(*oxprops, newname);
4183 			break;
4184 		case DATA_TYPE_STRING: /* -o property=value */
4185 			/*
4186 			 * we're trying to override a property that does not
4187 			 * make sense for this type of dataset, but we don't
4188 			 * want to fail if the receive is recursive: this comes
4189 			 * in handy when the send stream contains, for
4190 			 * instance, a child ZVOL and we're trying to receive
4191 			 * it with "-o atime=on"
4192 			 */
4193 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4194 			    !zfs_prop_user(name)) {
4195 				if (recursive)
4196 					continue;
4197 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4198 				    "property '%s' does not apply to datasets "
4199 				    "of this type"), name);
4200 				ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4201 				goto error;
4202 			}
4203 			fnvlist_add_string(oprops, newname,
4204 			    fnvpair_value_string(nvp));
4205 			break;
4206 		default:
4207 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4208 			    "property '%s' must be a string or boolean"), name);
4209 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4210 			goto error;
4211 		}
4212 	}
4213 
4214 	if (toplevel) {
4215 		/* convert override strings properties to native */
4216 		if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4217 		    oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4218 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4219 			goto error;
4220 		}
4221 
4222 		/*
4223 		 * zfs_crypto_create() requires the parent name. Get it
4224 		 * by truncating the fsname copy stored in namebuf.
4225 		 */
4226 		cp = strrchr(namebuf, '/');
4227 		if (cp != NULL)
4228 			*cp = '\0';
4229 
4230 		if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4231 		    B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4232 			fnvlist_free(voprops);
4233 			ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4234 			goto error;
4235 		}
4236 
4237 		/* second pass: process "-o" properties */
4238 		fnvlist_merge(*oxprops, voprops);
4239 		fnvlist_free(voprops);
4240 	} else {
4241 		/* override props on child dataset are inherited */
4242 		nvp = NULL;
4243 		while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4244 			const char *name = nvpair_name(nvp);
4245 			fnvlist_add_boolean(*oxprops, name);
4246 		}
4247 	}
4248 
4249 error:
4250 	if (zhp != NULL)
4251 		zfs_close(zhp);
4252 	if (zpool_hdl != NULL)
4253 		zpool_close(zpool_hdl);
4254 	fnvlist_free(oprops);
4255 	return (ret);
4256 }
4257 
4258 /*
4259  * Restores a backup of tosnap from the file descriptor specified by infd.
4260  */
4261 static int
4262 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4263     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4264     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4265     avl_tree_t *stream_avl, char **top_zfs,
4266     const char *finalsnap, nvlist_t *cmdprops)
4267 {
4268 	struct timespec begin_time;
4269 	int ioctl_err, ioctl_errno, err;
4270 	char *cp;
4271 	struct drr_begin *drrb = &drr->drr_u.drr_begin;
4272 	char errbuf[1024];
4273 	const char *chopprefix;
4274 	boolean_t newfs = B_FALSE;
4275 	boolean_t stream_wantsnewfs, stream_resumingnewfs;
4276 	boolean_t newprops = B_FALSE;
4277 	uint64_t read_bytes = 0;
4278 	uint64_t errflags = 0;
4279 	uint64_t parent_snapguid = 0;
4280 	prop_changelist_t *clp = NULL;
4281 	nvlist_t *snapprops_nvlist = NULL;
4282 	nvlist_t *snapholds_nvlist = NULL;
4283 	zprop_errflags_t prop_errflags;
4284 	nvlist_t *prop_errors = NULL;
4285 	boolean_t recursive;
4286 	char *snapname = NULL;
4287 	char destsnap[MAXPATHLEN * 2];
4288 	char origin[MAXNAMELEN] = {0};
4289 	char name[MAXPATHLEN];
4290 	char tmp_keylocation[MAXNAMELEN] = {0};
4291 	nvlist_t *rcvprops = NULL; /* props received from the send stream */
4292 	nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4293 	nvlist_t *origprops = NULL; /* original props (if destination exists) */
4294 	zfs_type_t type = ZFS_TYPE_INVALID;
4295 	boolean_t toplevel = B_FALSE;
4296 	boolean_t zoned = B_FALSE;
4297 	boolean_t hastoken = B_FALSE;
4298 	boolean_t redacted;
4299 	uint8_t *wkeydata = NULL;
4300 	uint_t wkeylen = 0;
4301 
4302 #ifndef CLOCK_MONOTONIC_RAW
4303 #define	CLOCK_MONOTONIC_RAW CLOCK_MONOTONIC
4304 #endif
4305 	clock_gettime(CLOCK_MONOTONIC_RAW, &begin_time);
4306 
4307 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4308 	    "cannot receive"));
4309 
4310 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4311 	    ENOENT);
4312 
4313 	/* Did the user request holds be skipped via zfs recv -k? */
4314 	boolean_t holds = flags->holds && !flags->skipholds;
4315 
4316 	if (stream_avl != NULL) {
4317 		char *keylocation = NULL;
4318 		nvlist_t *lookup = NULL;
4319 		nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4320 		    &snapname);
4321 
4322 		(void) nvlist_lookup_uint64(fs, "parentfromsnap",
4323 		    &parent_snapguid);
4324 		err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4325 		if (err) {
4326 			rcvprops = fnvlist_alloc();
4327 			newprops = B_TRUE;
4328 		}
4329 
4330 		/*
4331 		 * The keylocation property may only be set on encryption roots,
4332 		 * but this dataset might not become an encryption root until
4333 		 * recv_fix_encryption_hierarchy() is called. That function
4334 		 * will fixup the keylocation anyway, so we temporarily unset
4335 		 * the keylocation for now to avoid any errors from the receive
4336 		 * ioctl.
4337 		 */
4338 		err = nvlist_lookup_string(rcvprops,
4339 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4340 		if (err == 0) {
4341 			strcpy(tmp_keylocation, keylocation);
4342 			(void) nvlist_remove_all(rcvprops,
4343 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4344 		}
4345 
4346 		if (flags->canmountoff) {
4347 			fnvlist_add_uint64(rcvprops,
4348 			    zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4349 		} else if (newprops) {	/* nothing in rcvprops, eliminate it */
4350 			fnvlist_free(rcvprops);
4351 			rcvprops = NULL;
4352 			newprops = B_FALSE;
4353 		}
4354 		if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4355 			snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4356 			    snapname);
4357 		}
4358 		if (holds) {
4359 			if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4360 			    &lookup)) {
4361 				snapholds_nvlist = fnvlist_lookup_nvlist(
4362 				    lookup, snapname);
4363 			}
4364 		}
4365 	}
4366 
4367 	cp = NULL;
4368 
4369 	/*
4370 	 * Determine how much of the snapshot name stored in the stream
4371 	 * we are going to tack on to the name they specified on the
4372 	 * command line, and how much we are going to chop off.
4373 	 *
4374 	 * If they specified a snapshot, chop the entire name stored in
4375 	 * the stream.
4376 	 */
4377 	if (flags->istail) {
4378 		/*
4379 		 * A filesystem was specified with -e. We want to tack on only
4380 		 * the tail of the sent snapshot path.
4381 		 */
4382 		if (strchr(tosnap, '@')) {
4383 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4384 			    "argument - snapshot not allowed with -e"));
4385 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4386 			goto out;
4387 		}
4388 
4389 		chopprefix = strrchr(sendfs, '/');
4390 
4391 		if (chopprefix == NULL) {
4392 			/*
4393 			 * The tail is the poolname, so we need to
4394 			 * prepend a path separator.
4395 			 */
4396 			int len = strlen(drrb->drr_toname);
4397 			cp = malloc(len + 2);
4398 			cp[0] = '/';
4399 			(void) strcpy(&cp[1], drrb->drr_toname);
4400 			chopprefix = cp;
4401 		} else {
4402 			chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4403 		}
4404 	} else if (flags->isprefix) {
4405 		/*
4406 		 * A filesystem was specified with -d. We want to tack on
4407 		 * everything but the first element of the sent snapshot path
4408 		 * (all but the pool name).
4409 		 */
4410 		if (strchr(tosnap, '@')) {
4411 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4412 			    "argument - snapshot not allowed with -d"));
4413 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4414 			goto out;
4415 		}
4416 
4417 		chopprefix = strchr(drrb->drr_toname, '/');
4418 		if (chopprefix == NULL)
4419 			chopprefix = strchr(drrb->drr_toname, '@');
4420 	} else if (strchr(tosnap, '@') == NULL) {
4421 		/*
4422 		 * If a filesystem was specified without -d or -e, we want to
4423 		 * tack on everything after the fs specified by 'zfs send'.
4424 		 */
4425 		chopprefix = drrb->drr_toname + strlen(sendfs);
4426 	} else {
4427 		/* A snapshot was specified as an exact path (no -d or -e). */
4428 		if (recursive) {
4429 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4430 			    "cannot specify snapshot name for multi-snapshot "
4431 			    "stream"));
4432 			err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4433 			goto out;
4434 		}
4435 		chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4436 	}
4437 
4438 	ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4439 	ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4440 	ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4441 	    strchr(sendfs, '/') == NULL);
4442 	ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4443 	    chopprefix[0] == '\0');
4444 
4445 	/*
4446 	 * Determine name of destination snapshot.
4447 	 */
4448 	(void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4449 	(void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4450 	free(cp);
4451 	if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4452 		err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4453 		goto out;
4454 	}
4455 
4456 	/*
4457 	 * Determine the name of the origin snapshot.
4458 	 */
4459 	if (originsnap) {
4460 		(void) strlcpy(origin, originsnap, sizeof (origin));
4461 		if (flags->verbose)
4462 			(void) printf("using provided clone origin %s\n",
4463 			    origin);
4464 	} else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4465 		if (guid_to_name(hdl, destsnap,
4466 		    drrb->drr_fromguid, B_FALSE, origin) != 0) {
4467 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4468 			    "local origin for clone %s does not exist"),
4469 			    destsnap);
4470 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4471 			goto out;
4472 		}
4473 		if (flags->verbose)
4474 			(void) printf("found clone origin %s\n", origin);
4475 	}
4476 
4477 	if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4478 	    DMU_BACKUP_FEATURE_DEDUP)) {
4479 		(void) fprintf(stderr,
4480 		    gettext("ERROR: \"zfs receive\" no longer supports "
4481 		    "deduplicated send streams.  Use\n"
4482 		    "the \"zstream redup\" command to convert this stream "
4483 		    "to a regular,\n"
4484 		    "non-deduplicated stream.\n"));
4485 		err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4486 		goto out;
4487 	}
4488 
4489 	boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4490 	    DMU_BACKUP_FEATURE_RESUMING;
4491 	boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4492 	    DMU_BACKUP_FEATURE_RAW;
4493 	boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4494 	    DMU_BACKUP_FEATURE_EMBED_DATA;
4495 	stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4496 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4497 	stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4498 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4499 
4500 	if (stream_wantsnewfs) {
4501 		/*
4502 		 * if the parent fs does not exist, look for it based on
4503 		 * the parent snap GUID
4504 		 */
4505 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4506 		    "cannot receive new filesystem stream"));
4507 
4508 		(void) strcpy(name, destsnap);
4509 		cp = strrchr(name, '/');
4510 		if (cp)
4511 			*cp = '\0';
4512 		if (cp &&
4513 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4514 			char suffix[ZFS_MAX_DATASET_NAME_LEN];
4515 			(void) strcpy(suffix, strrchr(destsnap, '/'));
4516 			if (guid_to_name(hdl, name, parent_snapguid,
4517 			    B_FALSE, destsnap) == 0) {
4518 				*strchr(destsnap, '@') = '\0';
4519 				(void) strcat(destsnap, suffix);
4520 			}
4521 		}
4522 	} else {
4523 		/*
4524 		 * If the fs does not exist, look for it based on the
4525 		 * fromsnap GUID.
4526 		 */
4527 		if (resuming) {
4528 			(void) snprintf(errbuf, sizeof (errbuf),
4529 			    dgettext(TEXT_DOMAIN,
4530 			    "cannot receive resume stream"));
4531 		} else {
4532 			(void) snprintf(errbuf, sizeof (errbuf),
4533 			    dgettext(TEXT_DOMAIN,
4534 			    "cannot receive incremental stream"));
4535 		}
4536 
4537 		(void) strcpy(name, destsnap);
4538 		*strchr(name, '@') = '\0';
4539 
4540 		/*
4541 		 * If the exact receive path was specified and this is the
4542 		 * topmost path in the stream, then if the fs does not exist we
4543 		 * should look no further.
4544 		 */
4545 		if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4546 		    strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4547 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4548 			char snap[ZFS_MAX_DATASET_NAME_LEN];
4549 			(void) strcpy(snap, strchr(destsnap, '@'));
4550 			if (guid_to_name(hdl, name, drrb->drr_fromguid,
4551 			    B_FALSE, destsnap) == 0) {
4552 				*strchr(destsnap, '@') = '\0';
4553 				(void) strcat(destsnap, snap);
4554 			}
4555 		}
4556 	}
4557 
4558 	(void) strcpy(name, destsnap);
4559 	*strchr(name, '@') = '\0';
4560 
4561 	redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4562 	    DMU_BACKUP_FEATURE_REDACTED;
4563 
4564 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4565 		zfs_cmd_t zc = {"\0"};
4566 		zfs_handle_t *zhp;
4567 		boolean_t encrypted;
4568 
4569 		(void) strcpy(zc.zc_name, name);
4570 
4571 		/*
4572 		 * Destination fs exists.  It must be one of these cases:
4573 		 *  - an incremental send stream
4574 		 *  - the stream specifies a new fs (full stream or clone)
4575 		 *    and they want us to blow away the existing fs (and
4576 		 *    have therefore specified -F and removed any snapshots)
4577 		 *  - we are resuming a failed receive.
4578 		 */
4579 		if (stream_wantsnewfs) {
4580 			boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4581 			if (!flags->force) {
4582 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4583 				    "destination '%s' exists\n"
4584 				    "must specify -F to overwrite it"), name);
4585 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4586 				goto out;
4587 			}
4588 			if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4589 			    &zc) == 0) {
4590 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4591 				    "destination has snapshots (eg. %s)\n"
4592 				    "must destroy them to overwrite it"),
4593 				    zc.zc_name);
4594 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4595 				goto out;
4596 			}
4597 			if (is_volume && strrchr(name, '/') == NULL) {
4598 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4599 				    "destination %s is the root dataset\n"
4600 				    "cannot overwrite with a ZVOL"),
4601 				    name);
4602 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4603 				goto out;
4604 			}
4605 			if (is_volume &&
4606 			    zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4607 			    &zc) == 0) {
4608 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4609 				    "destination has children (eg. %s)\n"
4610 				    "cannot overwrite with a ZVOL"),
4611 				    zc.zc_name);
4612 				err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4613 				goto out;
4614 			}
4615 		}
4616 
4617 		if ((zhp = zfs_open(hdl, name,
4618 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4619 			err = -1;
4620 			goto out;
4621 		}
4622 
4623 		if (stream_wantsnewfs &&
4624 		    zhp->zfs_dmustats.dds_origin[0]) {
4625 			zfs_close(zhp);
4626 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4627 			    "destination '%s' is a clone\n"
4628 			    "must destroy it to overwrite it"), name);
4629 			err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4630 			goto out;
4631 		}
4632 
4633 		/*
4634 		 * Raw sends can not be performed as an incremental on top
4635 		 * of existing unencrypted datasets. zfs recv -F can't be
4636 		 * used to blow away an existing encrypted filesystem. This
4637 		 * is because it would require the dsl dir to point to the
4638 		 * new key (or lack of a key) and the old key at the same
4639 		 * time. The -F flag may still be used for deleting
4640 		 * intermediate snapshots that would otherwise prevent the
4641 		 * receive from working.
4642 		 */
4643 		encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4644 		    ZIO_CRYPT_OFF;
4645 		if (!stream_wantsnewfs && !encrypted && raw) {
4646 			zfs_close(zhp);
4647 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4648 			    "cannot perform raw receive on top of "
4649 			    "existing unencrypted dataset"));
4650 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4651 			goto out;
4652 		}
4653 
4654 		if (stream_wantsnewfs && flags->force &&
4655 		    ((raw && !encrypted) || encrypted)) {
4656 			zfs_close(zhp);
4657 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4658 			    "zfs receive -F cannot be used to destroy an "
4659 			    "encrypted filesystem or overwrite an "
4660 			    "unencrypted one with an encrypted one"));
4661 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4662 			goto out;
4663 		}
4664 
4665 		if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4666 		    (stream_wantsnewfs || stream_resumingnewfs)) {
4667 			/* We can't do online recv in this case */
4668 			clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4669 			    flags->forceunmount ? MS_FORCE : 0);
4670 			if (clp == NULL) {
4671 				zfs_close(zhp);
4672 				err = -1;
4673 				goto out;
4674 			}
4675 			if (changelist_prefix(clp) != 0) {
4676 				changelist_free(clp);
4677 				zfs_close(zhp);
4678 				err = -1;
4679 				goto out;
4680 			}
4681 		}
4682 
4683 		/*
4684 		 * If we are resuming a newfs, set newfs here so that we will
4685 		 * mount it if the recv succeeds this time.  We can tell
4686 		 * that it was a newfs on the first recv because the fs
4687 		 * itself will be inconsistent (if the fs existed when we
4688 		 * did the first recv, we would have received it into
4689 		 * .../%recv).
4690 		 */
4691 		if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4692 			newfs = B_TRUE;
4693 
4694 		/* we want to know if we're zoned when validating -o|-x props */
4695 		zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4696 
4697 		/* may need this info later, get it now we have zhp around */
4698 		if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4699 		    NULL, NULL, 0, B_TRUE) == 0)
4700 			hastoken = B_TRUE;
4701 
4702 		/* gather existing properties on destination */
4703 		origprops = fnvlist_alloc();
4704 		fnvlist_merge(origprops, zhp->zfs_props);
4705 		fnvlist_merge(origprops, zhp->zfs_user_props);
4706 
4707 		zfs_close(zhp);
4708 	} else {
4709 		zfs_handle_t *zhp;
4710 
4711 		/*
4712 		 * Destination filesystem does not exist.  Therefore we better
4713 		 * be creating a new filesystem (either from a full backup, or
4714 		 * a clone).  It would therefore be invalid if the user
4715 		 * specified only the pool name (i.e. if the destination name
4716 		 * contained no slash character).
4717 		 */
4718 		cp = strrchr(name, '/');
4719 
4720 		if (!stream_wantsnewfs || cp == NULL) {
4721 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4722 			    "destination '%s' does not exist"), name);
4723 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4724 			goto out;
4725 		}
4726 
4727 		/*
4728 		 * Trim off the final dataset component so we perform the
4729 		 * recvbackup ioctl to the filesystems's parent.
4730 		 */
4731 		*cp = '\0';
4732 
4733 		if (flags->isprefix && !flags->istail && !flags->dryrun &&
4734 		    create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4735 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4736 			goto out;
4737 		}
4738 
4739 		/* validate parent */
4740 		zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4741 		if (zhp == NULL) {
4742 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4743 			goto out;
4744 		}
4745 		if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4746 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4747 			    "parent '%s' is not a filesystem"), name);
4748 			err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4749 			zfs_close(zhp);
4750 			goto out;
4751 		}
4752 
4753 		zfs_close(zhp);
4754 
4755 		newfs = B_TRUE;
4756 		*cp = '/';
4757 	}
4758 
4759 	if (flags->verbose) {
4760 		(void) printf("%s %s stream of %s into %s\n",
4761 		    flags->dryrun ? "would receive" : "receiving",
4762 		    drrb->drr_fromguid ? "incremental" : "full",
4763 		    drrb->drr_toname, destsnap);
4764 		(void) fflush(stdout);
4765 	}
4766 
4767 	/*
4768 	 * If this is the top-level dataset, record it so we can use it
4769 	 * for recursive operations later.
4770 	 */
4771 	if (top_zfs != NULL &&
4772 	    (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4773 		toplevel = B_TRUE;
4774 		if (*top_zfs == NULL)
4775 			*top_zfs = zfs_strdup(hdl, name);
4776 	}
4777 
4778 	if (drrb->drr_type == DMU_OST_ZVOL) {
4779 		type = ZFS_TYPE_VOLUME;
4780 	} else if (drrb->drr_type == DMU_OST_ZFS) {
4781 		type = ZFS_TYPE_FILESYSTEM;
4782 	} else {
4783 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4784 		    "invalid record type: 0x%d"), drrb->drr_type);
4785 		err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4786 		goto out;
4787 	}
4788 	if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4789 	    stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4790 	    &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4791 		goto out;
4792 
4793 	/*
4794 	 * When sending with properties (zfs send -p), the encryption property
4795 	 * is not included because it is a SETONCE property and therefore
4796 	 * treated as read only. However, we are always able to determine its
4797 	 * value because raw sends will include it in the DRR_BDEGIN payload
4798 	 * and non-raw sends with properties are not allowed for encrypted
4799 	 * datasets. Therefore, if this is a non-raw properties stream, we can
4800 	 * infer that the value should be ZIO_CRYPT_OFF and manually add that
4801 	 * to the received properties.
4802 	 */
4803 	if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4804 	    !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4805 		if (oxprops == NULL)
4806 			oxprops = fnvlist_alloc();
4807 		fnvlist_add_uint64(oxprops,
4808 		    zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4809 	}
4810 
4811 	if (flags->dryrun) {
4812 		void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4813 
4814 		/*
4815 		 * We have read the DRR_BEGIN record, but we have
4816 		 * not yet read the payload. For non-dryrun sends
4817 		 * this will be done by the kernel, so we must
4818 		 * emulate that here, before attempting to read
4819 		 * more records.
4820 		 */
4821 		err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4822 		    flags->byteswap, NULL);
4823 		free(buf);
4824 		if (err != 0)
4825 			goto out;
4826 
4827 		err = recv_skip(hdl, infd, flags->byteswap);
4828 		goto out;
4829 	}
4830 
4831 	err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4832 	    oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4833 	    raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4834 	    NULL, &prop_errors);
4835 	ioctl_errno = ioctl_err;
4836 	prop_errflags = errflags;
4837 
4838 	if (err == 0) {
4839 		nvpair_t *prop_err = NULL;
4840 
4841 		while ((prop_err = nvlist_next_nvpair(prop_errors,
4842 		    prop_err)) != NULL) {
4843 			char tbuf[1024];
4844 			zfs_prop_t prop;
4845 			int intval;
4846 
4847 			prop = zfs_name_to_prop(nvpair_name(prop_err));
4848 			(void) nvpair_value_int32(prop_err, &intval);
4849 			if (strcmp(nvpair_name(prop_err),
4850 			    ZPROP_N_MORE_ERRORS) == 0) {
4851 				trunc_prop_errs(intval);
4852 				break;
4853 			} else if (snapname == NULL || finalsnap == NULL ||
4854 			    strcmp(finalsnap, snapname) == 0 ||
4855 			    strcmp(nvpair_name(prop_err),
4856 			    zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4857 				/*
4858 				 * Skip the special case of, for example,
4859 				 * "refquota", errors on intermediate
4860 				 * snapshots leading up to a final one.
4861 				 * That's why we have all of the checks above.
4862 				 *
4863 				 * See zfs_ioctl.c's extract_delay_props() for
4864 				 * a list of props which can fail on
4865 				 * intermediate snapshots, but shouldn't
4866 				 * affect the overall receive.
4867 				 */
4868 				(void) snprintf(tbuf, sizeof (tbuf),
4869 				    dgettext(TEXT_DOMAIN,
4870 				    "cannot receive %s property on %s"),
4871 				    nvpair_name(prop_err), name);
4872 				zfs_setprop_error(hdl, prop, intval, tbuf);
4873 			}
4874 		}
4875 	}
4876 
4877 	if (err == 0 && snapprops_nvlist) {
4878 		zfs_cmd_t zc = {"\0"};
4879 
4880 		(void) strcpy(zc.zc_name, destsnap);
4881 		zc.zc_cookie = B_TRUE; /* received */
4882 		if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
4883 			(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4884 			zcmd_free_nvlists(&zc);
4885 		}
4886 	}
4887 	if (err == 0 && snapholds_nvlist) {
4888 		nvpair_t *pair;
4889 		nvlist_t *holds, *errors = NULL;
4890 		int cleanup_fd = -1;
4891 
4892 		VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4893 		for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4894 		    pair != NULL;
4895 		    pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4896 			fnvlist_add_string(holds, destsnap, nvpair_name(pair));
4897 		}
4898 		(void) lzc_hold(holds, cleanup_fd, &errors);
4899 		fnvlist_free(snapholds_nvlist);
4900 		fnvlist_free(holds);
4901 	}
4902 
4903 	if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4904 		/*
4905 		 * It may be that this snapshot already exists,
4906 		 * in which case we want to consume & ignore it
4907 		 * rather than failing.
4908 		 */
4909 		avl_tree_t *local_avl;
4910 		nvlist_t *local_nv, *fs;
4911 		cp = strchr(destsnap, '@');
4912 
4913 		/*
4914 		 * XXX Do this faster by just iterating over snaps in
4915 		 * this fs.  Also if zc_value does not exist, we will
4916 		 * get a strange "does not exist" error message.
4917 		 */
4918 		*cp = '\0';
4919 		if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4920 		    B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
4921 		    B_TRUE, &local_nv, &local_avl) == 0) {
4922 			*cp = '@';
4923 			fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4924 			fsavl_destroy(local_avl);
4925 			fnvlist_free(local_nv);
4926 
4927 			if (fs != NULL) {
4928 				if (flags->verbose) {
4929 					(void) printf("snap %s already exists; "
4930 					    "ignoring\n", destsnap);
4931 				}
4932 				err = ioctl_err = recv_skip(hdl, infd,
4933 				    flags->byteswap);
4934 			}
4935 		}
4936 		*cp = '@';
4937 	}
4938 
4939 	if (ioctl_err != 0) {
4940 		switch (ioctl_errno) {
4941 		case ENODEV:
4942 			cp = strchr(destsnap, '@');
4943 			*cp = '\0';
4944 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4945 			    "most recent snapshot of %s does not\n"
4946 			    "match incremental source"), destsnap);
4947 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4948 			*cp = '@';
4949 			break;
4950 		case ETXTBSY:
4951 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4952 			    "destination %s has been modified\n"
4953 			    "since most recent snapshot"), name);
4954 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4955 			break;
4956 		case EACCES:
4957 			if (raw && stream_wantsnewfs) {
4958 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4959 				    "failed to create encryption key"));
4960 			} else if (raw && !stream_wantsnewfs) {
4961 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4962 				    "encryption key does not match "
4963 				    "existing key"));
4964 			} else {
4965 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4966 				    "inherited key must be loaded"));
4967 			}
4968 			(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4969 			break;
4970 		case EEXIST:
4971 			cp = strchr(destsnap, '@');
4972 			if (newfs) {
4973 				/* it's the containing fs that exists */
4974 				*cp = '\0';
4975 			}
4976 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4977 			    "destination already exists"));
4978 			(void) zfs_error_fmt(hdl, EZFS_EXISTS,
4979 			    dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4980 			    destsnap);
4981 			*cp = '@';
4982 			break;
4983 		case EINVAL:
4984 			if (flags->resumable) {
4985 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4986 				    "kernel modules must be upgraded to "
4987 				    "receive this stream."));
4988 			} else if (embedded && !raw) {
4989 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4990 				    "incompatible embedded data stream "
4991 				    "feature with encrypted receive."));
4992 			}
4993 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4994 			break;
4995 		case ECKSUM:
4996 		case ZFS_ERR_STREAM_TRUNCATED:
4997 			recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4998 			    ioctl_err == ECKSUM);
4999 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5000 			break;
5001 		case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
5002 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5003 			    "incremental send stream requires -L "
5004 			    "(--large-block), to match previous receive."));
5005 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5006 			break;
5007 		case ENOTSUP:
5008 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5009 			    "pool must be upgraded to receive this stream."));
5010 			(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
5011 			break;
5012 		case EDQUOT:
5013 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5014 			    "destination %s space quota exceeded."), name);
5015 			(void) zfs_error(hdl, EZFS_NOSPC, errbuf);
5016 			break;
5017 		case ZFS_ERR_FROM_IVSET_GUID_MISSING:
5018 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5019 			    "IV set guid missing. See errata %u at "
5020 			    "https://openzfs.github.io/openzfs-docs/msg/"
5021 			    "ZFS-8000-ER."),
5022 			    ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
5023 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5024 			break;
5025 		case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
5026 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5027 			    "IV set guid mismatch. See the 'zfs receive' "
5028 			    "man page section\n discussing the limitations "
5029 			    "of raw encrypted send streams."));
5030 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5031 			break;
5032 		case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
5033 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5034 			    "Spill block flag missing for raw send.\n"
5035 			    "The zfs software on the sending system must "
5036 			    "be updated."));
5037 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
5038 			break;
5039 		case EBUSY:
5040 			if (hastoken) {
5041 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5042 				    "destination %s contains "
5043 				    "partially-complete state from "
5044 				    "\"zfs receive -s\"."), name);
5045 				(void) zfs_error(hdl, EZFS_BUSY, errbuf);
5046 				break;
5047 			}
5048 			zfs_fallthrough;
5049 		default:
5050 			(void) zfs_standard_error(hdl, ioctl_errno, errbuf);
5051 		}
5052 	}
5053 
5054 	/*
5055 	 * Mount the target filesystem (if created).  Also mount any
5056 	 * children of the target filesystem if we did a replication
5057 	 * receive (indicated by stream_avl being non-NULL).
5058 	 */
5059 	if (clp) {
5060 		if (!flags->nomount)
5061 			err |= changelist_postfix(clp);
5062 		changelist_free(clp);
5063 	}
5064 
5065 	if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
5066 		flags->domount = B_TRUE;
5067 
5068 	if (prop_errflags & ZPROP_ERR_NOCLEAR) {
5069 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5070 		    "failed to clear unreceived properties on %s"), name);
5071 		(void) fprintf(stderr, "\n");
5072 	}
5073 	if (prop_errflags & ZPROP_ERR_NORESTORE) {
5074 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
5075 		    "failed to restore original properties on %s"), name);
5076 		(void) fprintf(stderr, "\n");
5077 	}
5078 
5079 	if (err || ioctl_err) {
5080 		err = -1;
5081 		goto out;
5082 	}
5083 
5084 	if (flags->verbose) {
5085 		char buf1[64];
5086 		char buf2[64];
5087 		uint64_t bytes = read_bytes;
5088 		struct timespec delta;
5089 		clock_gettime(CLOCK_MONOTONIC_RAW, &delta);
5090 		if (begin_time.tv_nsec > delta.tv_nsec) {
5091 			delta.tv_nsec =
5092 			    1000000000 + delta.tv_nsec - begin_time.tv_nsec;
5093 			delta.tv_sec -= 1;
5094 		} else
5095 			delta.tv_nsec -= begin_time.tv_nsec;
5096 		delta.tv_sec -= begin_time.tv_sec;
5097 		if (delta.tv_sec == 0 && delta.tv_nsec == 0)
5098 			delta.tv_nsec = 1;
5099 		double delta_f = delta.tv_sec + (delta.tv_nsec / 1e9);
5100 		zfs_nicebytes(bytes, buf1, sizeof (buf1));
5101 		zfs_nicebytes(bytes / delta_f, buf2, sizeof (buf2));
5102 
5103 		(void) printf("received %s stream in %.2f seconds (%s/sec)\n",
5104 		    buf1, delta_f, buf2);
5105 	}
5106 
5107 	err = 0;
5108 out:
5109 	if (prop_errors != NULL)
5110 		fnvlist_free(prop_errors);
5111 
5112 	if (tmp_keylocation[0] != '\0') {
5113 		fnvlist_add_string(rcvprops,
5114 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
5115 	}
5116 
5117 	if (newprops)
5118 		fnvlist_free(rcvprops);
5119 
5120 	fnvlist_free(oxprops);
5121 	fnvlist_free(origprops);
5122 
5123 	return (err);
5124 }
5125 
5126 /*
5127  * Check properties we were asked to override (both -o|-x)
5128  */
5129 static boolean_t
5130 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
5131     const char *errbuf)
5132 {
5133 	nvpair_t *nvp = NULL;
5134 	zfs_prop_t prop;
5135 	const char *name;
5136 
5137 	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
5138 		name = nvpair_name(nvp);
5139 		prop = zfs_name_to_prop(name);
5140 
5141 		if (prop == ZPROP_INVAL) {
5142 			if (!zfs_prop_user(name)) {
5143 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5144 				    "%s: invalid property '%s'"), errbuf, name);
5145 				return (B_FALSE);
5146 			}
5147 			continue;
5148 		}
5149 		/*
5150 		 * "origin" is readonly but is used to receive datasets as
5151 		 * clones so we don't raise an error here
5152 		 */
5153 		if (prop == ZFS_PROP_ORIGIN)
5154 			continue;
5155 
5156 		/* encryption params have their own verification later */
5157 		if (prop == ZFS_PROP_ENCRYPTION ||
5158 		    zfs_prop_encryption_key_param(prop))
5159 			continue;
5160 
5161 		/*
5162 		 * cannot override readonly, set-once and other specific
5163 		 * settable properties
5164 		 */
5165 		if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5166 		    prop == ZFS_PROP_VOLSIZE) {
5167 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5168 			    "%s: invalid property '%s'"), errbuf, name);
5169 			return (B_FALSE);
5170 		}
5171 	}
5172 
5173 	return (B_TRUE);
5174 }
5175 
5176 static int
5177 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5178     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5179     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5180     const char *finalsnap, nvlist_t *cmdprops)
5181 {
5182 	int err;
5183 	dmu_replay_record_t drr, drr_noswap;
5184 	struct drr_begin *drrb = &drr.drr_u.drr_begin;
5185 	char errbuf[1024];
5186 	zio_cksum_t zcksum = { { 0 } };
5187 	uint64_t featureflags;
5188 	int hdrtype;
5189 
5190 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5191 	    "cannot receive"));
5192 
5193 	/* check cmdline props, raise an error if they cannot be received */
5194 	if (!zfs_receive_checkprops(hdl, cmdprops, errbuf))
5195 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5196 
5197 	if (flags->isprefix &&
5198 	    !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5199 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5200 		    "(%s) does not exist"), tosnap);
5201 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5202 	}
5203 	if (originsnap &&
5204 	    !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5205 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5206 		    "(%s) does not exist"), originsnap);
5207 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5208 	}
5209 
5210 	/* read in the BEGIN record */
5211 	if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5212 	    &zcksum)))
5213 		return (err);
5214 
5215 	if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5216 		/* It's the double end record at the end of a package */
5217 		return (ENODATA);
5218 	}
5219 
5220 	/* the kernel needs the non-byteswapped begin record */
5221 	drr_noswap = drr;
5222 
5223 	flags->byteswap = B_FALSE;
5224 	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5225 		/*
5226 		 * We computed the checksum in the wrong byteorder in
5227 		 * recv_read() above; do it again correctly.
5228 		 */
5229 		memset(&zcksum, 0, sizeof (zio_cksum_t));
5230 		fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5231 		flags->byteswap = B_TRUE;
5232 
5233 		drr.drr_type = BSWAP_32(drr.drr_type);
5234 		drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5235 		drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5236 		drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5237 		drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5238 		drrb->drr_type = BSWAP_32(drrb->drr_type);
5239 		drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5240 		drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5241 		drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5242 	}
5243 
5244 	if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5245 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5246 		    "stream (bad magic number)"));
5247 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5248 	}
5249 
5250 	featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5251 	hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5252 
5253 	if (!DMU_STREAM_SUPPORTED(featureflags) ||
5254 	    (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5255 		/*
5256 		 * Let's be explicit about this one, since rather than
5257 		 * being a new feature we can't know, it's an old
5258 		 * feature we dropped.
5259 		 */
5260 		if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5261 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5262 			    "stream has deprecated feature: dedup, try "
5263 			    "'zstream redup [send in a file] | zfs recv "
5264 			    "[...]'"));
5265 		} else {
5266 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5267 			    "stream has unsupported feature, feature flags = "
5268 			    "%llx (unknown flags = %llx)"),
5269 			    (u_longlong_t)featureflags,
5270 			    (u_longlong_t)((featureflags) &
5271 			    ~DMU_BACKUP_FEATURE_MASK));
5272 		}
5273 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5274 	}
5275 
5276 	/* Holds feature is set once in the compound stream header. */
5277 	if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5278 		flags->holds = B_TRUE;
5279 
5280 	if (strchr(drrb->drr_toname, '@') == NULL) {
5281 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5282 		    "stream (bad snapshot name)"));
5283 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5284 	}
5285 
5286 	if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5287 		char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5288 		if (sendfs == NULL) {
5289 			/*
5290 			 * We were not called from zfs_receive_package(). Get
5291 			 * the fs specified by 'zfs send'.
5292 			 */
5293 			char *cp;
5294 			(void) strlcpy(nonpackage_sendfs,
5295 			    drr.drr_u.drr_begin.drr_toname,
5296 			    sizeof (nonpackage_sendfs));
5297 			if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5298 				*cp = '\0';
5299 			sendfs = nonpackage_sendfs;
5300 			VERIFY(finalsnap == NULL);
5301 		}
5302 		return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5303 		    &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5304 		    finalsnap, cmdprops));
5305 	} else {
5306 		assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5307 		    DMU_COMPOUNDSTREAM);
5308 		return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5309 		    &zcksum, top_zfs, cmdprops));
5310 	}
5311 }
5312 
5313 /*
5314  * Restores a backup of tosnap from the file descriptor specified by infd.
5315  * Return 0 on total success, -2 if some things couldn't be
5316  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5317  * (-1 will override -2, if -1 and the resumable flag was specified the
5318  * transfer can be resumed if the sending side supports it).
5319  */
5320 int
5321 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5322     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5323 {
5324 	char *top_zfs = NULL;
5325 	int err;
5326 	struct stat sb;
5327 	char *originsnap = NULL;
5328 
5329 	/*
5330 	 * The only way fstat can fail is if we do not have a valid file
5331 	 * descriptor.
5332 	 */
5333 	if (fstat(infd, &sb) == -1) {
5334 		perror("fstat");
5335 		return (-2);
5336 	}
5337 
5338 	if (props) {
5339 		err = nvlist_lookup_string(props, "origin", &originsnap);
5340 		if (err && err != ENOENT)
5341 			return (err);
5342 	}
5343 
5344 	err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5345 	    stream_avl, &top_zfs, NULL, props);
5346 
5347 	if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5348 		zfs_handle_t *zhp = NULL;
5349 		prop_changelist_t *clp = NULL;
5350 
5351 		zhp = zfs_open(hdl, top_zfs,
5352 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5353 		if (zhp == NULL) {
5354 			err = -1;
5355 			goto out;
5356 		} else {
5357 			if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5358 				zfs_close(zhp);
5359 				goto out;
5360 			}
5361 
5362 			clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5363 			    CL_GATHER_MOUNT_ALWAYS,
5364 			    flags->forceunmount ? MS_FORCE : 0);
5365 			zfs_close(zhp);
5366 			if (clp == NULL) {
5367 				err = -1;
5368 				goto out;
5369 			}
5370 
5371 			/* mount and share received datasets */
5372 			err = changelist_postfix(clp);
5373 			changelist_free(clp);
5374 			if (err != 0)
5375 				err = -1;
5376 		}
5377 	}
5378 
5379 out:
5380 	if (top_zfs)
5381 		free(top_zfs);
5382 
5383 	return (err);
5384 }
5385