xref: /freebsd/sys/contrib/openzfs/lib/libzfs/libzfs_sendrecv.c (revision e9e8876a4d6afc1ad5315faaa191b25121a813d7)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
25  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
27  * All rights reserved
28  * Copyright (c) 2013 Steven Hartland. All rights reserved.
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
31  * Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
32  * Copyright (c) 2019 Datto Inc.
33  */
34 
35 #include <assert.h>
36 #include <ctype.h>
37 #include <errno.h>
38 #include <libintl.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <strings.h>
42 #include <unistd.h>
43 #include <stddef.h>
44 #include <fcntl.h>
45 #include <sys/mount.h>
46 #include <sys/mntent.h>
47 #include <sys/mnttab.h>
48 #include <sys/avl.h>
49 #include <sys/debug.h>
50 #include <sys/stat.h>
51 #include <pthread.h>
52 #include <umem.h>
53 #include <time.h>
54 
55 #include <libzfs.h>
56 #include <libzfs_core.h>
57 #include <libzutil.h>
58 
59 #include "zfs_namecheck.h"
60 #include "zfs_prop.h"
61 #include "zfs_fletcher.h"
62 #include "libzfs_impl.h"
63 #include <cityhash.h>
64 #include <zlib.h>
65 #include <sys/zio_checksum.h>
66 #include <sys/dsl_crypt.h>
67 #include <sys/ddt.h>
68 #include <sys/socket.h>
69 #include <sys/sha2.h>
70 
71 static int zfs_receive_impl(libzfs_handle_t *, const char *, const char *,
72     recvflags_t *, int, const char *, nvlist_t *, avl_tree_t *, char **,
73     const char *, nvlist_t *);
74 static int guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
75     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
76     uint64_t num_redact_snaps, char *name);
77 static int guid_to_name(libzfs_handle_t *, const char *,
78     uint64_t, boolean_t, char *);
79 
80 typedef struct progress_arg {
81 	zfs_handle_t *pa_zhp;
82 	int pa_fd;
83 	boolean_t pa_parsable;
84 	boolean_t pa_estimate;
85 	int pa_verbosity;
86 } progress_arg_t;
87 
88 static int
89 dump_record(dmu_replay_record_t *drr, void *payload, int payload_len,
90     zio_cksum_t *zc, int outfd)
91 {
92 	ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
93 	    ==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
94 	fletcher_4_incremental_native(drr,
95 	    offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
96 	if (drr->drr_type != DRR_BEGIN) {
97 		ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
98 		    drr_checksum.drr_checksum));
99 		drr->drr_u.drr_checksum.drr_checksum = *zc;
100 	}
101 	fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
102 	    sizeof (zio_cksum_t), zc);
103 	if (write(outfd, drr, sizeof (*drr)) == -1)
104 		return (errno);
105 	if (payload_len != 0) {
106 		fletcher_4_incremental_native(payload, payload_len, zc);
107 		if (write(outfd, payload, payload_len) == -1)
108 			return (errno);
109 	}
110 	return (0);
111 }
112 
113 /*
114  * Routines for dealing with the AVL tree of fs-nvlists
115  */
116 typedef struct fsavl_node {
117 	avl_node_t fn_node;
118 	nvlist_t *fn_nvfs;
119 	char *fn_snapname;
120 	uint64_t fn_guid;
121 } fsavl_node_t;
122 
123 static int
124 fsavl_compare(const void *arg1, const void *arg2)
125 {
126 	const fsavl_node_t *fn1 = (const fsavl_node_t *)arg1;
127 	const fsavl_node_t *fn2 = (const fsavl_node_t *)arg2;
128 
129 	return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
130 }
131 
132 /*
133  * Given the GUID of a snapshot, find its containing filesystem and
134  * (optionally) name.
135  */
136 static nvlist_t *
137 fsavl_find(avl_tree_t *avl, uint64_t snapguid, char **snapname)
138 {
139 	fsavl_node_t fn_find;
140 	fsavl_node_t *fn;
141 
142 	fn_find.fn_guid = snapguid;
143 
144 	fn = avl_find(avl, &fn_find, NULL);
145 	if (fn) {
146 		if (snapname)
147 			*snapname = fn->fn_snapname;
148 		return (fn->fn_nvfs);
149 	}
150 	return (NULL);
151 }
152 
153 static void
154 fsavl_destroy(avl_tree_t *avl)
155 {
156 	fsavl_node_t *fn;
157 	void *cookie;
158 
159 	if (avl == NULL)
160 		return;
161 
162 	cookie = NULL;
163 	while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
164 		free(fn);
165 	avl_destroy(avl);
166 	free(avl);
167 }
168 
169 /*
170  * Given an nvlist, produce an avl tree of snapshots, ordered by guid
171  */
172 static avl_tree_t *
173 fsavl_create(nvlist_t *fss)
174 {
175 	avl_tree_t *fsavl;
176 	nvpair_t *fselem = NULL;
177 
178 	if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
179 		return (NULL);
180 
181 	avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
182 	    offsetof(fsavl_node_t, fn_node));
183 
184 	while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
185 		nvlist_t *nvfs, *snaps;
186 		nvpair_t *snapelem = NULL;
187 
188 		nvfs = fnvpair_value_nvlist(fselem);
189 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
190 
191 		while ((snapelem =
192 		    nvlist_next_nvpair(snaps, snapelem)) != NULL) {
193 			fsavl_node_t *fn;
194 			uint64_t guid;
195 
196 			guid = fnvpair_value_uint64(snapelem);
197 			if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
198 				fsavl_destroy(fsavl);
199 				return (NULL);
200 			}
201 			fn->fn_nvfs = nvfs;
202 			fn->fn_snapname = nvpair_name(snapelem);
203 			fn->fn_guid = guid;
204 
205 			/*
206 			 * Note: if there are multiple snaps with the
207 			 * same GUID, we ignore all but one.
208 			 */
209 			if (avl_find(fsavl, fn, NULL) == NULL)
210 				avl_add(fsavl, fn);
211 			else
212 				free(fn);
213 		}
214 	}
215 
216 	return (fsavl);
217 }
218 
219 /*
220  * Routines for dealing with the giant nvlist of fs-nvlists, etc.
221  */
222 typedef struct send_data {
223 	/*
224 	 * assigned inside every recursive call,
225 	 * restored from *_save on return:
226 	 *
227 	 * guid of fromsnap snapshot in parent dataset
228 	 * txg of fromsnap snapshot in current dataset
229 	 * txg of tosnap snapshot in current dataset
230 	 */
231 
232 	uint64_t parent_fromsnap_guid;
233 	uint64_t fromsnap_txg;
234 	uint64_t tosnap_txg;
235 
236 	/* the nvlists get accumulated during depth-first traversal */
237 	nvlist_t *parent_snaps;
238 	nvlist_t *fss;
239 	nvlist_t *snapprops;
240 	nvlist_t *snapholds;	/* user holds */
241 
242 	/* send-receive configuration, does not change during traversal */
243 	const char *fsname;
244 	const char *fromsnap;
245 	const char *tosnap;
246 	boolean_t recursive;
247 	boolean_t raw;
248 	boolean_t doall;
249 	boolean_t replicate;
250 	boolean_t skipmissing;
251 	boolean_t verbose;
252 	boolean_t backup;
253 	boolean_t seenfrom;
254 	boolean_t seento;
255 	boolean_t holds;	/* were holds requested with send -h */
256 	boolean_t props;
257 
258 	/*
259 	 * The header nvlist is of the following format:
260 	 * {
261 	 *   "tosnap" -> string
262 	 *   "fromsnap" -> string (if incremental)
263 	 *   "fss" -> {
264 	 *	id -> {
265 	 *
266 	 *	 "name" -> string (full name; for debugging)
267 	 *	 "parentfromsnap" -> number (guid of fromsnap in parent)
268 	 *
269 	 *	 "props" -> { name -> value (only if set here) }
270 	 *	 "snaps" -> { name (lastname) -> number (guid) }
271 	 *	 "snapprops" -> { name (lastname) -> { name -> value } }
272 	 *	 "snapholds" -> { name (lastname) -> { holdname -> crtime } }
273 	 *
274 	 *	 "origin" -> number (guid) (if clone)
275 	 *	 "is_encroot" -> boolean
276 	 *	 "sent" -> boolean (not on-disk)
277 	 *	}
278 	 *   }
279 	 * }
280 	 *
281 	 */
282 } send_data_t;
283 
284 static void
285 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv);
286 
287 static int
288 send_iterate_snap(zfs_handle_t *zhp, void *arg)
289 {
290 	send_data_t *sd = arg;
291 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
292 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
293 	char *snapname;
294 	nvlist_t *nv;
295 	boolean_t isfromsnap, istosnap, istosnapwithnofrom;
296 
297 	snapname = strrchr(zhp->zfs_name, '@')+1;
298 	isfromsnap = (sd->fromsnap != NULL &&
299 	    strcmp(sd->fromsnap, snapname) == 0);
300 	istosnap = (sd->tosnap != NULL && (strcmp(sd->tosnap, snapname) == 0));
301 	istosnapwithnofrom = (istosnap && sd->fromsnap == NULL);
302 
303 	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
304 		if (sd->verbose) {
305 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
306 			    "skipping snapshot %s because it was created "
307 			    "after the destination snapshot (%s)\n"),
308 			    zhp->zfs_name, sd->tosnap);
309 		}
310 		zfs_close(zhp);
311 		return (0);
312 	}
313 
314 	fnvlist_add_uint64(sd->parent_snaps, snapname, guid);
315 	/*
316 	 * NB: if there is no fromsnap here (it's a newly created fs in
317 	 * an incremental replication), we will substitute the tosnap.
318 	 */
319 	if (isfromsnap || (sd->parent_fromsnap_guid == 0 && istosnap)) {
320 		sd->parent_fromsnap_guid = guid;
321 	}
322 
323 	if (!sd->recursive) {
324 
325 		/*
326 		 * To allow a doall stream to work properly
327 		 * with a NULL fromsnap
328 		 */
329 		if (sd->doall && sd->fromsnap == NULL && !sd->seenfrom) {
330 			sd->seenfrom = B_TRUE;
331 		}
332 
333 		if (!sd->seenfrom && isfromsnap) {
334 			sd->seenfrom = B_TRUE;
335 			zfs_close(zhp);
336 			return (0);
337 		}
338 
339 		if ((sd->seento || !sd->seenfrom) && !istosnapwithnofrom) {
340 			zfs_close(zhp);
341 			return (0);
342 		}
343 
344 		if (istosnap)
345 			sd->seento = B_TRUE;
346 	}
347 
348 	nv = fnvlist_alloc();
349 	send_iterate_prop(zhp, sd->backup, nv);
350 	fnvlist_add_nvlist(sd->snapprops, snapname, nv);
351 	fnvlist_free(nv);
352 	if (sd->holds) {
353 		nvlist_t *holds = fnvlist_alloc();
354 		int err = lzc_get_holds(zhp->zfs_name, &holds);
355 		if (err == 0) {
356 			fnvlist_add_nvlist(sd->snapholds, snapname, holds);
357 		}
358 		fnvlist_free(holds);
359 	}
360 
361 	zfs_close(zhp);
362 	return (0);
363 }
364 
365 static void
366 send_iterate_prop(zfs_handle_t *zhp, boolean_t received_only, nvlist_t *nv)
367 {
368 	nvlist_t *props = NULL;
369 	nvpair_t *elem = NULL;
370 
371 	if (received_only)
372 		props = zfs_get_recvd_props(zhp);
373 	else
374 		props = zhp->zfs_props;
375 
376 	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
377 		char *propname = nvpair_name(elem);
378 		zfs_prop_t prop = zfs_name_to_prop(propname);
379 		nvlist_t *propnv;
380 
381 		if (!zfs_prop_user(propname)) {
382 			/*
383 			 * Realistically, this should never happen.  However,
384 			 * we want the ability to add DSL properties without
385 			 * needing to make incompatible version changes.  We
386 			 * need to ignore unknown properties to allow older
387 			 * software to still send datasets containing these
388 			 * properties, with the unknown properties elided.
389 			 */
390 			if (prop == ZPROP_INVAL)
391 				continue;
392 
393 			if (zfs_prop_readonly(prop))
394 				continue;
395 		}
396 
397 		verify(nvpair_value_nvlist(elem, &propnv) == 0);
398 		if (prop == ZFS_PROP_QUOTA || prop == ZFS_PROP_RESERVATION ||
399 		    prop == ZFS_PROP_REFQUOTA ||
400 		    prop == ZFS_PROP_REFRESERVATION) {
401 			char *source;
402 			uint64_t value;
403 			verify(nvlist_lookup_uint64(propnv,
404 			    ZPROP_VALUE, &value) == 0);
405 			if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
406 				continue;
407 			/*
408 			 * May have no source before SPA_VERSION_RECVD_PROPS,
409 			 * but is still modifiable.
410 			 */
411 			if (nvlist_lookup_string(propnv,
412 			    ZPROP_SOURCE, &source) == 0) {
413 				if ((strcmp(source, zhp->zfs_name) != 0) &&
414 				    (strcmp(source,
415 				    ZPROP_SOURCE_VAL_RECVD) != 0))
416 					continue;
417 			}
418 		} else {
419 			char *source;
420 			if (nvlist_lookup_string(propnv,
421 			    ZPROP_SOURCE, &source) != 0)
422 				continue;
423 			if ((strcmp(source, zhp->zfs_name) != 0) &&
424 			    (strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0))
425 				continue;
426 		}
427 
428 		if (zfs_prop_user(propname) ||
429 		    zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
430 			char *value;
431 			value = fnvlist_lookup_string(propnv, ZPROP_VALUE);
432 			fnvlist_add_string(nv, propname, value);
433 		} else {
434 			uint64_t value;
435 			value = fnvlist_lookup_uint64(propnv, ZPROP_VALUE);
436 			fnvlist_add_uint64(nv, propname, value);
437 		}
438 	}
439 }
440 
441 /*
442  * returns snapshot creation txg
443  * and returns 0 if the snapshot does not exist
444  */
445 static uint64_t
446 get_snap_txg(libzfs_handle_t *hdl, const char *fs, const char *snap)
447 {
448 	char name[ZFS_MAX_DATASET_NAME_LEN];
449 	uint64_t txg = 0;
450 
451 	if (fs == NULL || fs[0] == '\0' || snap == NULL || snap[0] == '\0')
452 		return (txg);
453 
454 	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
455 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
456 		zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
457 		if (zhp != NULL) {
458 			txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
459 			zfs_close(zhp);
460 		}
461 	}
462 
463 	return (txg);
464 }
465 
466 /*
467  * recursively generate nvlists describing datasets.  See comment
468  * for the data structure send_data_t above for description of contents
469  * of the nvlist.
470  */
471 static int
472 send_iterate_fs(zfs_handle_t *zhp, void *arg)
473 {
474 	send_data_t *sd = arg;
475 	nvlist_t *nvfs = NULL, *nv = NULL;
476 	int rv = 0;
477 	uint64_t min_txg = 0, max_txg = 0;
478 	uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
479 	uint64_t fromsnap_txg_save = sd->fromsnap_txg;
480 	uint64_t tosnap_txg_save = sd->tosnap_txg;
481 	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
482 	uint64_t guid = zhp->zfs_dmustats.dds_guid;
483 	uint64_t fromsnap_txg, tosnap_txg;
484 	char guidstring[64];
485 
486 	fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
487 	if (fromsnap_txg != 0)
488 		sd->fromsnap_txg = fromsnap_txg;
489 
490 	tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
491 	if (tosnap_txg != 0)
492 		sd->tosnap_txg = tosnap_txg;
493 
494 	/*
495 	 * on the send side, if the current dataset does not have tosnap,
496 	 * perform two additional checks:
497 	 *
498 	 * - skip sending the current dataset if it was created later than
499 	 *   the parent tosnap
500 	 * - return error if the current dataset was created earlier than
501 	 *   the parent tosnap, unless --skip-missing specified. Then
502 	 *   just print a warning
503 	 */
504 	if (sd->tosnap != NULL && tosnap_txg == 0) {
505 		if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
506 			if (sd->verbose) {
507 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
508 				    "skipping dataset %s: snapshot %s does "
509 				    "not exist\n"), zhp->zfs_name, sd->tosnap);
510 			}
511 		} else if (sd->skipmissing) {
512 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
513 			    "WARNING: skipping dataset %s and its children:"
514 			    " snapshot %s does not exist\n"),
515 			    zhp->zfs_name, sd->tosnap);
516 		} else {
517 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
518 			    "cannot send %s@%s%s: snapshot %s@%s does not "
519 			    "exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
520 			    dgettext(TEXT_DOMAIN, " recursively") : "",
521 			    zhp->zfs_name, sd->tosnap);
522 			rv = EZFS_NOENT;
523 		}
524 		goto out;
525 	}
526 
527 	nvfs = fnvlist_alloc();
528 	fnvlist_add_string(nvfs, "name", zhp->zfs_name);
529 	fnvlist_add_uint64(nvfs, "parentfromsnap",
530 	    sd->parent_fromsnap_guid);
531 
532 	if (zhp->zfs_dmustats.dds_origin[0]) {
533 		zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
534 		    zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
535 		if (origin == NULL) {
536 			rv = -1;
537 			goto out;
538 		}
539 		fnvlist_add_uint64(nvfs, "origin",
540 		    origin->zfs_dmustats.dds_guid);
541 
542 		zfs_close(origin);
543 	}
544 
545 	/* iterate over props */
546 	if (sd->props || sd->backup || sd->recursive) {
547 		nv = fnvlist_alloc();
548 		send_iterate_prop(zhp, sd->backup, nv);
549 	}
550 	if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
551 		boolean_t encroot;
552 
553 		/* determine if this dataset is an encryption root */
554 		if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
555 			rv = -1;
556 			goto out;
557 		}
558 
559 		if (encroot)
560 			fnvlist_add_boolean(nvfs, "is_encroot");
561 
562 		/*
563 		 * Encrypted datasets can only be sent with properties if
564 		 * the raw flag is specified because the receive side doesn't
565 		 * currently have a mechanism for recursively asking the user
566 		 * for new encryption parameters.
567 		 */
568 		if (!sd->raw) {
569 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
570 			    "cannot send %s@%s: encrypted dataset %s may not "
571 			    "be sent with properties without the raw flag\n"),
572 			    sd->fsname, sd->tosnap, zhp->zfs_name);
573 			rv = -1;
574 			goto out;
575 		}
576 
577 	}
578 
579 	if (nv != NULL)
580 		fnvlist_add_nvlist(nvfs, "props", nv);
581 
582 	/* iterate over snaps, and set sd->parent_fromsnap_guid */
583 	sd->parent_fromsnap_guid = 0;
584 	sd->parent_snaps = fnvlist_alloc();
585 	sd->snapprops = fnvlist_alloc();
586 	if (sd->holds)
587 		sd->snapholds = fnvlist_alloc();
588 
589 	/*
590 	 * If this is a "doall" send, a replicate send or we're just trying
591 	 * to gather a list of previous snapshots, iterate through all the
592 	 * snaps in the txg range. Otherwise just look at the one we're
593 	 * interested in.
594 	 */
595 	if (sd->doall || sd->replicate || sd->tosnap == NULL) {
596 		if (!sd->replicate && fromsnap_txg != 0)
597 			min_txg = fromsnap_txg;
598 		if (!sd->replicate && tosnap_txg != 0)
599 			max_txg = tosnap_txg;
600 		(void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
601 		    min_txg, max_txg);
602 	} else {
603 		char snapname[MAXPATHLEN] = { 0 };
604 		zfs_handle_t *snap;
605 
606 		(void) snprintf(snapname, sizeof (snapname), "%s@%s",
607 		    zhp->zfs_name, sd->tosnap);
608 		if (sd->fromsnap != NULL)
609 			sd->seenfrom = B_TRUE;
610 		snap = zfs_open(zhp->zfs_hdl, snapname,
611 		    ZFS_TYPE_SNAPSHOT);
612 		if (snap != NULL)
613 			(void) send_iterate_snap(snap, sd);
614 	}
615 
616 	fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
617 	fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
618 	if (sd->holds)
619 		fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
620 	fnvlist_free(sd->parent_snaps);
621 	fnvlist_free(sd->snapprops);
622 	fnvlist_free(sd->snapholds);
623 
624 	/* Do not allow the size of the properties list to exceed the limit */
625 	if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
626 	    zhp->zfs_hdl->libzfs_max_nvlist) {
627 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
628 		    "warning: cannot send %s@%s: the size of the list of "
629 		    "snapshots and properties is too large to be received "
630 		    "successfully.\n"
631 		    "Select a smaller number of snapshots to send.\n"),
632 		    zhp->zfs_name, sd->tosnap);
633 		rv = EZFS_NOSPC;
634 		goto out;
635 	}
636 	/* add this fs to nvlist */
637 	(void) snprintf(guidstring, sizeof (guidstring),
638 	    "0x%llx", (longlong_t)guid);
639 	fnvlist_add_nvlist(sd->fss, guidstring, nvfs);
640 
641 	/* iterate over children */
642 	if (sd->recursive)
643 		rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);
644 
645 out:
646 	sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
647 	sd->fromsnap_txg = fromsnap_txg_save;
648 	sd->tosnap_txg = tosnap_txg_save;
649 	fnvlist_free(nv);
650 	fnvlist_free(nvfs);
651 
652 	zfs_close(zhp);
653 	return (rv);
654 }
655 
656 static int
657 gather_nvlist(libzfs_handle_t *hdl, const char *fsname, const char *fromsnap,
658     const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
659     boolean_t replicate, boolean_t skipmissing, boolean_t verbose,
660     boolean_t backup, boolean_t holds, boolean_t props, nvlist_t **nvlp,
661     avl_tree_t **avlp)
662 {
663 	zfs_handle_t *zhp;
664 	send_data_t sd = { 0 };
665 	int error;
666 
667 	zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
668 	if (zhp == NULL)
669 		return (EZFS_BADTYPE);
670 
671 	sd.fss = fnvlist_alloc();
672 	sd.fsname = fsname;
673 	sd.fromsnap = fromsnap;
674 	sd.tosnap = tosnap;
675 	sd.recursive = recursive;
676 	sd.raw = raw;
677 	sd.doall = doall;
678 	sd.replicate = replicate;
679 	sd.skipmissing = skipmissing;
680 	sd.verbose = verbose;
681 	sd.backup = backup;
682 	sd.holds = holds;
683 	sd.props = props;
684 
685 	if ((error = send_iterate_fs(zhp, &sd)) != 0) {
686 		fnvlist_free(sd.fss);
687 		if (avlp != NULL)
688 			*avlp = NULL;
689 		*nvlp = NULL;
690 		return (error);
691 	}
692 
693 	if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
694 		fnvlist_free(sd.fss);
695 		*nvlp = NULL;
696 		return (EZFS_NOMEM);
697 	}
698 
699 	*nvlp = sd.fss;
700 	return (0);
701 }
702 
703 /*
704  * Routines specific to "zfs send"
705  */
706 typedef struct send_dump_data {
707 	/* these are all just the short snapname (the part after the @) */
708 	const char *fromsnap;
709 	const char *tosnap;
710 	char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
711 	uint64_t prevsnap_obj;
712 	boolean_t seenfrom, seento, replicate, doall, fromorigin;
713 	boolean_t dryrun, parsable, progress, embed_data, std_out;
714 	boolean_t large_block, compress, raw, holds;
715 	int outfd;
716 	boolean_t err;
717 	nvlist_t *fss;
718 	nvlist_t *snapholds;
719 	avl_tree_t *fsavl;
720 	snapfilter_cb_t *filter_cb;
721 	void *filter_cb_arg;
722 	nvlist_t *debugnv;
723 	char holdtag[ZFS_MAX_DATASET_NAME_LEN];
724 	int cleanup_fd;
725 	int verbosity;
726 	uint64_t size;
727 } send_dump_data_t;
728 
729 static int
730 zfs_send_space(zfs_handle_t *zhp, const char *snapname, const char *from,
731     enum lzc_send_flags flags, uint64_t *spacep)
732 {
733 	libzfs_handle_t *hdl = zhp->zfs_hdl;
734 	int error;
735 
736 	assert(snapname != NULL);
737 	error = lzc_send_space(snapname, from, flags, spacep);
738 
739 	if (error != 0) {
740 		char errbuf[1024];
741 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
742 		    "warning: cannot estimate space for '%s'"), snapname);
743 
744 		switch (error) {
745 		case EXDEV:
746 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
747 			    "not an earlier snapshot from the same fs"));
748 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
749 
750 		case ENOENT:
751 			if (zfs_dataset_exists(hdl, snapname,
752 			    ZFS_TYPE_SNAPSHOT)) {
753 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
754 				    "incremental source (%s) does not exist"),
755 				    snapname);
756 			}
757 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
758 
759 		case EDQUOT:
760 		case EFBIG:
761 		case EIO:
762 		case ENOLINK:
763 		case ENOSPC:
764 		case ENOSTR:
765 		case ENXIO:
766 		case EPIPE:
767 		case ERANGE:
768 		case EFAULT:
769 		case EROFS:
770 		case EINVAL:
771 			zfs_error_aux(hdl, "%s", strerror(error));
772 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
773 
774 		default:
775 			return (zfs_standard_error(hdl, error, errbuf));
776 		}
777 	}
778 
779 	return (0);
780 }
781 
782 /*
783  * Dumps a backup of the given snapshot (incremental from fromsnap if it's not
784  * NULL) to the file descriptor specified by outfd.
785  */
786 static int
787 dump_ioctl(zfs_handle_t *zhp, const char *fromsnap, uint64_t fromsnap_obj,
788     boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
789     nvlist_t *debugnv)
790 {
791 	zfs_cmd_t zc = {"\0"};
792 	libzfs_handle_t *hdl = zhp->zfs_hdl;
793 	nvlist_t *thisdbg;
794 
795 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
796 	assert(fromsnap_obj == 0 || !fromorigin);
797 
798 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
799 	zc.zc_cookie = outfd;
800 	zc.zc_obj = fromorigin;
801 	zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
802 	zc.zc_fromobj = fromsnap_obj;
803 	zc.zc_flags = flags;
804 
805 	thisdbg = fnvlist_alloc();
806 	if (fromsnap && fromsnap[0] != '\0') {
807 		fnvlist_add_string(thisdbg, "fromsnap", fromsnap);
808 	}
809 
810 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
811 		char errbuf[1024];
812 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
813 		    "warning: cannot send '%s'"), zhp->zfs_name);
814 
815 		fnvlist_add_uint64(thisdbg, "error", errno);
816 		if (debugnv) {
817 			fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
818 		}
819 		fnvlist_free(thisdbg);
820 
821 		switch (errno) {
822 		case EXDEV:
823 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
824 			    "not an earlier snapshot from the same fs"));
825 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
826 
827 		case EACCES:
828 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
829 			    "source key must be loaded"));
830 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
831 
832 		case ENOENT:
833 			if (zfs_dataset_exists(hdl, zc.zc_name,
834 			    ZFS_TYPE_SNAPSHOT)) {
835 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
836 				    "incremental source (@%s) does not exist"),
837 				    zc.zc_value);
838 			}
839 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
840 
841 		case EDQUOT:
842 		case EFBIG:
843 		case EIO:
844 		case ENOLINK:
845 		case ENOSPC:
846 		case ENOSTR:
847 		case ENXIO:
848 		case EPIPE:
849 		case ERANGE:
850 		case EFAULT:
851 		case EROFS:
852 		case EINVAL:
853 			zfs_error_aux(hdl, "%s", strerror(errno));
854 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
855 
856 		default:
857 			return (zfs_standard_error(hdl, errno, errbuf));
858 		}
859 	}
860 
861 	if (debugnv)
862 		fnvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg);
863 	fnvlist_free(thisdbg);
864 
865 	return (0);
866 }
867 
868 static void
869 gather_holds(zfs_handle_t *zhp, send_dump_data_t *sdd)
870 {
871 	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
872 
873 	/*
874 	 * zfs_send() only sets snapholds for sends that need them,
875 	 * e.g. replication and doall.
876 	 */
877 	if (sdd->snapholds == NULL)
878 		return;
879 
880 	fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
881 }
882 
883 int
884 zfs_send_progress(zfs_handle_t *zhp, int fd, uint64_t *bytes_written,
885     uint64_t *blocks_visited)
886 {
887 	zfs_cmd_t zc = {"\0"};
888 
889 	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
890 	zc.zc_cookie = fd;
891 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
892 		return (errno);
893 	if (bytes_written != NULL)
894 		*bytes_written = zc.zc_cookie;
895 	if (blocks_visited != NULL)
896 		*blocks_visited = zc.zc_objset_type;
897 	return (0);
898 }
899 
900 static void *
901 send_progress_thread(void *arg)
902 {
903 	progress_arg_t *pa = arg;
904 	zfs_handle_t *zhp = pa->pa_zhp;
905 	uint64_t bytes;
906 	uint64_t blocks;
907 	char buf[16];
908 	time_t t;
909 	struct tm *tm;
910 	boolean_t firstloop = B_TRUE;
911 
912 	/*
913 	 * Print the progress from ZFS_IOC_SEND_PROGRESS every second.
914 	 */
915 	for (;;) {
916 		int err;
917 		(void) sleep(1);
918 		if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
919 		    &blocks)) != 0) {
920 			if (err == EINTR || err == ENOENT)
921 				return ((void *)0);
922 			return ((void *)(uintptr_t)err);
923 		}
924 
925 		if (firstloop && !pa->pa_parsable) {
926 			(void) fprintf(stderr,
927 			    "TIME       %s   %sSNAPSHOT %s\n",
928 			    pa->pa_estimate ? "BYTES" : " SENT",
929 			    pa->pa_verbosity >= 2 ? "   BLOCKS    " : "",
930 			    zhp->zfs_name);
931 			firstloop = B_FALSE;
932 		}
933 
934 		(void) time(&t);
935 		tm = localtime(&t);
936 
937 		if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
938 			(void) fprintf(stderr,
939 			    "%02d:%02d:%02d\t%llu\t%llu\t%s\n",
940 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
941 			    (u_longlong_t)bytes, (u_longlong_t)blocks,
942 			    zhp->zfs_name);
943 		} else if (pa->pa_verbosity >= 2) {
944 			zfs_nicenum(bytes, buf, sizeof (buf));
945 			(void) fprintf(stderr,
946 			    "%02d:%02d:%02d   %5s    %8llu    %s\n",
947 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
948 			    buf, (u_longlong_t)blocks, zhp->zfs_name);
949 		} else if (pa->pa_parsable) {
950 			(void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
951 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
952 			    (u_longlong_t)bytes, zhp->zfs_name);
953 		} else {
954 			zfs_nicebytes(bytes, buf, sizeof (buf));
955 			(void) fprintf(stderr, "%02d:%02d:%02d   %5s   %s\n",
956 			    tm->tm_hour, tm->tm_min, tm->tm_sec,
957 			    buf, zhp->zfs_name);
958 		}
959 	}
960 }
961 
962 static void
963 send_print_verbose(FILE *fout, const char *tosnap, const char *fromsnap,
964     uint64_t size, boolean_t parsable)
965 {
966 	if (parsable) {
967 		if (fromsnap != NULL) {
968 			(void) fprintf(fout, "incremental\t%s\t%s",
969 			    fromsnap, tosnap);
970 		} else {
971 			(void) fprintf(fout, "full\t%s",
972 			    tosnap);
973 		}
974 	} else {
975 		if (fromsnap != NULL) {
976 			if (strchr(fromsnap, '@') == NULL &&
977 			    strchr(fromsnap, '#') == NULL) {
978 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
979 				    "send from @%s to %s"),
980 				    fromsnap, tosnap);
981 			} else {
982 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
983 				    "send from %s to %s"),
984 				    fromsnap, tosnap);
985 			}
986 		} else {
987 			(void) fprintf(fout, dgettext(TEXT_DOMAIN,
988 			    "full send of %s"),
989 			    tosnap);
990 		}
991 	}
992 
993 	if (parsable) {
994 		(void) fprintf(fout, "\t%llu",
995 		    (longlong_t)size);
996 	} else if (size != 0) {
997 		char buf[16];
998 		zfs_nicebytes(size, buf, sizeof (buf));
999 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1000 		    " estimated size is %s"), buf);
1001 	}
1002 	(void) fprintf(fout, "\n");
1003 }
1004 
1005 static int
1006 dump_snapshot(zfs_handle_t *zhp, void *arg)
1007 {
1008 	send_dump_data_t *sdd = arg;
1009 	progress_arg_t pa = { 0 };
1010 	pthread_t tid;
1011 	char *thissnap;
1012 	enum lzc_send_flags flags = 0;
1013 	int err;
1014 	boolean_t isfromsnap, istosnap, fromorigin;
1015 	boolean_t exclude = B_FALSE;
1016 	FILE *fout = sdd->std_out ? stdout : stderr;
1017 
1018 	err = 0;
1019 	thissnap = strchr(zhp->zfs_name, '@') + 1;
1020 	isfromsnap = (sdd->fromsnap != NULL &&
1021 	    strcmp(sdd->fromsnap, thissnap) == 0);
1022 
1023 	if (!sdd->seenfrom && isfromsnap) {
1024 		gather_holds(zhp, sdd);
1025 		sdd->seenfrom = B_TRUE;
1026 		(void) strlcpy(sdd->prevsnap, thissnap,
1027 		    sizeof (sdd->prevsnap));
1028 		sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1029 		zfs_close(zhp);
1030 		return (0);
1031 	}
1032 
1033 	if (sdd->seento || !sdd->seenfrom) {
1034 		zfs_close(zhp);
1035 		return (0);
1036 	}
1037 
1038 	istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
1039 	if (istosnap)
1040 		sdd->seento = B_TRUE;
1041 
1042 	if (sdd->large_block)
1043 		flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1044 	if (sdd->embed_data)
1045 		flags |= LZC_SEND_FLAG_EMBED_DATA;
1046 	if (sdd->compress)
1047 		flags |= LZC_SEND_FLAG_COMPRESS;
1048 	if (sdd->raw)
1049 		flags |= LZC_SEND_FLAG_RAW;
1050 
1051 	if (!sdd->doall && !isfromsnap && !istosnap) {
1052 		if (sdd->replicate) {
1053 			char *snapname;
1054 			nvlist_t *snapprops;
1055 			/*
1056 			 * Filter out all intermediate snapshots except origin
1057 			 * snapshots needed to replicate clones.
1058 			 */
1059 			nvlist_t *nvfs = fsavl_find(sdd->fsavl,
1060 			    zhp->zfs_dmustats.dds_guid, &snapname);
1061 
1062 			if (nvfs != NULL) {
1063 				snapprops = fnvlist_lookup_nvlist(nvfs,
1064 				    "snapprops");
1065 				snapprops = fnvlist_lookup_nvlist(snapprops,
1066 				    thissnap);
1067 				exclude = !nvlist_exists(snapprops,
1068 				    "is_clone_origin");
1069 			}
1070 		} else {
1071 			exclude = B_TRUE;
1072 		}
1073 	}
1074 
1075 	/*
1076 	 * If a filter function exists, call it to determine whether
1077 	 * this snapshot will be sent.
1078 	 */
1079 	if (exclude || (sdd->filter_cb != NULL &&
1080 	    sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
1081 		/*
1082 		 * This snapshot is filtered out.  Don't send it, and don't
1083 		 * set prevsnap_obj, so it will be as if this snapshot didn't
1084 		 * exist, and the next accepted snapshot will be sent as
1085 		 * an incremental from the last accepted one, or as the
1086 		 * first (and full) snapshot in the case of a replication,
1087 		 * non-incremental send.
1088 		 */
1089 		zfs_close(zhp);
1090 		return (0);
1091 	}
1092 
1093 	gather_holds(zhp, sdd);
1094 	fromorigin = sdd->prevsnap[0] == '\0' &&
1095 	    (sdd->fromorigin || sdd->replicate);
1096 
1097 	if (sdd->verbosity != 0) {
1098 		uint64_t size = 0;
1099 		char fromds[ZFS_MAX_DATASET_NAME_LEN];
1100 
1101 		if (sdd->prevsnap[0] != '\0') {
1102 			(void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
1103 			*(strchr(fromds, '@') + 1) = '\0';
1104 			(void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
1105 		}
1106 		if (zfs_send_space(zhp, zhp->zfs_name,
1107 		    sdd->prevsnap[0] ? fromds : NULL, flags, &size) != 0) {
1108 			size = 0; /* cannot estimate send space */
1109 		} else {
1110 			send_print_verbose(fout, zhp->zfs_name,
1111 			    sdd->prevsnap[0] ? sdd->prevsnap : NULL,
1112 			    size, sdd->parsable);
1113 		}
1114 		sdd->size += size;
1115 	}
1116 
1117 	if (!sdd->dryrun) {
1118 		/*
1119 		 * If progress reporting is requested, spawn a new thread to
1120 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1121 		 */
1122 		if (sdd->progress) {
1123 			pa.pa_zhp = zhp;
1124 			pa.pa_fd = sdd->outfd;
1125 			pa.pa_parsable = sdd->parsable;
1126 			pa.pa_estimate = B_FALSE;
1127 			pa.pa_verbosity = sdd->verbosity;
1128 
1129 			if ((err = pthread_create(&tid, NULL,
1130 			    send_progress_thread, &pa)) != 0) {
1131 				zfs_close(zhp);
1132 				return (err);
1133 			}
1134 		}
1135 
1136 		err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
1137 		    fromorigin, sdd->outfd, flags, sdd->debugnv);
1138 
1139 		if (sdd->progress) {
1140 			void *status = NULL;
1141 			(void) pthread_cancel(tid);
1142 			(void) pthread_join(tid, &status);
1143 			int error = (int)(uintptr_t)status;
1144 			if (error != 0 && status != PTHREAD_CANCELED) {
1145 				char errbuf[1024];
1146 				(void) snprintf(errbuf, sizeof (errbuf),
1147 				    dgettext(TEXT_DOMAIN,
1148 				    "progress thread exited nonzero"));
1149 				return (zfs_standard_error(zhp->zfs_hdl, error,
1150 				    errbuf));
1151 			}
1152 		}
1153 	}
1154 
1155 	(void) strcpy(sdd->prevsnap, thissnap);
1156 	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
1157 	zfs_close(zhp);
1158 	return (err);
1159 }
1160 
1161 static int
1162 dump_filesystem(zfs_handle_t *zhp, void *arg)
1163 {
1164 	int rv = 0;
1165 	send_dump_data_t *sdd = arg;
1166 	boolean_t missingfrom = B_FALSE;
1167 	zfs_cmd_t zc = {"\0"};
1168 	uint64_t min_txg = 0, max_txg = 0;
1169 
1170 	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1171 	    zhp->zfs_name, sdd->tosnap);
1172 	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1173 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1174 		    "WARNING: could not send %s@%s: does not exist\n"),
1175 		    zhp->zfs_name, sdd->tosnap);
1176 		sdd->err = B_TRUE;
1177 		return (0);
1178 	}
1179 
1180 	if (sdd->replicate && sdd->fromsnap) {
1181 		/*
1182 		 * If this fs does not have fromsnap, and we're doing
1183 		 * recursive, we need to send a full stream from the
1184 		 * beginning (or an incremental from the origin if this
1185 		 * is a clone).  If we're doing non-recursive, then let
1186 		 * them get the error.
1187 		 */
1188 		(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
1189 		    zhp->zfs_name, sdd->fromsnap);
1190 		if (zfs_ioctl(zhp->zfs_hdl,
1191 		    ZFS_IOC_OBJSET_STATS, &zc) != 0) {
1192 			missingfrom = B_TRUE;
1193 		}
1194 	}
1195 
1196 	sdd->seenfrom = sdd->seento = sdd->prevsnap[0] = 0;
1197 	sdd->prevsnap_obj = 0;
1198 	if (sdd->fromsnap == NULL || missingfrom)
1199 		sdd->seenfrom = B_TRUE;
1200 
1201 
1202 
1203 	/*
1204 	 * Iterate through all snapshots and process the ones we will be
1205 	 * sending. If we only have a "from" and "to" snapshot to deal
1206 	 * with, we can avoid iterating through all the other snapshots.
1207 	 */
1208 	if (sdd->doall || sdd->replicate || sdd->tosnap == NULL) {
1209 		if (!sdd->replicate && sdd->fromsnap != NULL)
1210 			min_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1211 			    sdd->fromsnap);
1212 		if (!sdd->replicate && sdd->tosnap != NULL)
1213 			max_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
1214 			    sdd->tosnap);
1215 		rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, arg,
1216 		    min_txg, max_txg);
1217 	} else {
1218 		char snapname[MAXPATHLEN] = { 0 };
1219 		zfs_handle_t *snap;
1220 
1221 		if (!sdd->seenfrom) {
1222 			(void) snprintf(snapname, sizeof (snapname),
1223 			    "%s@%s", zhp->zfs_name, sdd->fromsnap);
1224 			snap = zfs_open(zhp->zfs_hdl, snapname,
1225 			    ZFS_TYPE_SNAPSHOT);
1226 			if (snap != NULL)
1227 				rv = dump_snapshot(snap, sdd);
1228 			else
1229 				rv = -1;
1230 		}
1231 
1232 		if (rv == 0) {
1233 			(void) snprintf(snapname, sizeof (snapname),
1234 			    "%s@%s", zhp->zfs_name, sdd->tosnap);
1235 			snap = zfs_open(zhp->zfs_hdl, snapname,
1236 			    ZFS_TYPE_SNAPSHOT);
1237 			if (snap != NULL)
1238 				rv = dump_snapshot(snap, sdd);
1239 			else
1240 				rv = -1;
1241 		}
1242 	}
1243 
1244 	if (!sdd->seenfrom) {
1245 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1246 		    "WARNING: could not send %s@%s:\n"
1247 		    "incremental source (%s@%s) does not exist\n"),
1248 		    zhp->zfs_name, sdd->tosnap,
1249 		    zhp->zfs_name, sdd->fromsnap);
1250 		sdd->err = B_TRUE;
1251 	} else if (!sdd->seento) {
1252 		if (sdd->fromsnap) {
1253 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1254 			    "WARNING: could not send %s@%s:\n"
1255 			    "incremental source (%s@%s) "
1256 			    "is not earlier than it\n"),
1257 			    zhp->zfs_name, sdd->tosnap,
1258 			    zhp->zfs_name, sdd->fromsnap);
1259 		} else {
1260 			(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1261 			    "WARNING: "
1262 			    "could not send %s@%s: does not exist\n"),
1263 			    zhp->zfs_name, sdd->tosnap);
1264 		}
1265 		sdd->err = B_TRUE;
1266 	}
1267 
1268 	return (rv);
1269 }
1270 
1271 static int
1272 dump_filesystems(zfs_handle_t *rzhp, void *arg)
1273 {
1274 	send_dump_data_t *sdd = arg;
1275 	nvpair_t *fspair;
1276 	boolean_t needagain, progress;
1277 
1278 	if (!sdd->replicate)
1279 		return (dump_filesystem(rzhp, sdd));
1280 
1281 	/* Mark the clone origin snapshots. */
1282 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1283 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1284 		nvlist_t *nvfs;
1285 		uint64_t origin_guid = 0;
1286 
1287 		nvfs = fnvpair_value_nvlist(fspair);
1288 		(void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
1289 		if (origin_guid != 0) {
1290 			char *snapname;
1291 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1292 			    origin_guid, &snapname);
1293 			if (origin_nv != NULL) {
1294 				nvlist_t *snapprops;
1295 				snapprops = fnvlist_lookup_nvlist(origin_nv,
1296 				    "snapprops");
1297 				snapprops = fnvlist_lookup_nvlist(snapprops,
1298 				    snapname);
1299 				fnvlist_add_boolean(snapprops,
1300 				    "is_clone_origin");
1301 			}
1302 		}
1303 	}
1304 again:
1305 	needagain = progress = B_FALSE;
1306 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1307 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1308 		nvlist_t *fslist, *parent_nv;
1309 		char *fsname;
1310 		zfs_handle_t *zhp;
1311 		int err;
1312 		uint64_t origin_guid = 0;
1313 		uint64_t parent_guid = 0;
1314 
1315 		fslist = fnvpair_value_nvlist(fspair);
1316 		if (nvlist_lookup_boolean(fslist, "sent") == 0)
1317 			continue;
1318 
1319 		fsname = fnvlist_lookup_string(fslist, "name");
1320 		(void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
1321 		(void) nvlist_lookup_uint64(fslist, "parentfromsnap",
1322 		    &parent_guid);
1323 
1324 		if (parent_guid != 0) {
1325 			parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
1326 			if (!nvlist_exists(parent_nv, "sent")) {
1327 				/* parent has not been sent; skip this one */
1328 				needagain = B_TRUE;
1329 				continue;
1330 			}
1331 		}
1332 
1333 		if (origin_guid != 0) {
1334 			nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
1335 			    origin_guid, NULL);
1336 			if (origin_nv != NULL &&
1337 			    !nvlist_exists(origin_nv, "sent")) {
1338 				/*
1339 				 * origin has not been sent yet;
1340 				 * skip this clone.
1341 				 */
1342 				needagain = B_TRUE;
1343 				continue;
1344 			}
1345 		}
1346 
1347 		zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
1348 		if (zhp == NULL)
1349 			return (-1);
1350 		err = dump_filesystem(zhp, sdd);
1351 		fnvlist_add_boolean(fslist, "sent");
1352 		progress = B_TRUE;
1353 		zfs_close(zhp);
1354 		if (err)
1355 			return (err);
1356 	}
1357 	if (needagain) {
1358 		assert(progress);
1359 		goto again;
1360 	}
1361 
1362 	/* clean out the sent flags in case we reuse this fss */
1363 	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
1364 	    fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
1365 		nvlist_t *fslist;
1366 
1367 		fslist = fnvpair_value_nvlist(fspair);
1368 		(void) nvlist_remove_all(fslist, "sent");
1369 	}
1370 
1371 	return (0);
1372 }
1373 
1374 nvlist_t *
1375 zfs_send_resume_token_to_nvlist(libzfs_handle_t *hdl, const char *token)
1376 {
1377 	unsigned int version;
1378 	int nread, i;
1379 	unsigned long long checksum, packed_len;
1380 
1381 	/*
1382 	 * Decode token header, which is:
1383 	 *   <token version>-<checksum of payload>-<uncompressed payload length>
1384 	 * Note that the only supported token version is 1.
1385 	 */
1386 	nread = sscanf(token, "%u-%llx-%llx-",
1387 	    &version, &checksum, &packed_len);
1388 	if (nread != 3) {
1389 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1390 		    "resume token is corrupt (invalid format)"));
1391 		return (NULL);
1392 	}
1393 
1394 	if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
1395 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1396 		    "resume token is corrupt (invalid version %u)"),
1397 		    version);
1398 		return (NULL);
1399 	}
1400 
1401 	/* convert hexadecimal representation to binary */
1402 	token = strrchr(token, '-') + 1;
1403 	int len = strlen(token) / 2;
1404 	unsigned char *compressed = zfs_alloc(hdl, len);
1405 	for (i = 0; i < len; i++) {
1406 		nread = sscanf(token + i * 2, "%2hhx", compressed + i);
1407 		if (nread != 1) {
1408 			free(compressed);
1409 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1410 			    "resume token is corrupt "
1411 			    "(payload is not hex-encoded)"));
1412 			return (NULL);
1413 		}
1414 	}
1415 
1416 	/* verify checksum */
1417 	zio_cksum_t cksum;
1418 	fletcher_4_native_varsize(compressed, len, &cksum);
1419 	if (cksum.zc_word[0] != checksum) {
1420 		free(compressed);
1421 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1422 		    "resume token is corrupt (incorrect checksum)"));
1423 		return (NULL);
1424 	}
1425 
1426 	/* uncompress */
1427 	void *packed = zfs_alloc(hdl, packed_len);
1428 	uLongf packed_len_long = packed_len;
1429 	if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK ||
1430 	    packed_len_long != packed_len) {
1431 		free(packed);
1432 		free(compressed);
1433 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1434 		    "resume token is corrupt (decompression failed)"));
1435 		return (NULL);
1436 	}
1437 
1438 	/* unpack nvlist */
1439 	nvlist_t *nv;
1440 	int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
1441 	free(packed);
1442 	free(compressed);
1443 	if (error != 0) {
1444 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1445 		    "resume token is corrupt (nvlist_unpack failed)"));
1446 		return (NULL);
1447 	}
1448 	return (nv);
1449 }
1450 static enum lzc_send_flags
1451 lzc_flags_from_sendflags(const sendflags_t *flags)
1452 {
1453 	enum lzc_send_flags lzc_flags = 0;
1454 	if (flags->largeblock)
1455 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1456 	if (flags->embed_data)
1457 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1458 	if (flags->compress)
1459 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1460 	if (flags->raw)
1461 		lzc_flags |= LZC_SEND_FLAG_RAW;
1462 	if (flags->saved)
1463 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1464 	return (lzc_flags);
1465 }
1466 
1467 static int
1468 estimate_size(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
1469     uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
1470     const char *redactbook, char *errbuf)
1471 {
1472 	uint64_t size;
1473 	FILE *fout = flags->dryrun ? stdout : stderr;
1474 	progress_arg_t pa = { 0 };
1475 	int err = 0;
1476 	pthread_t ptid;
1477 
1478 	if (flags->progress) {
1479 		pa.pa_zhp = zhp;
1480 		pa.pa_fd = fd;
1481 		pa.pa_parsable = flags->parsable;
1482 		pa.pa_estimate = B_TRUE;
1483 		pa.pa_verbosity = flags->verbosity;
1484 
1485 		err = pthread_create(&ptid, NULL,
1486 		    send_progress_thread, &pa);
1487 		if (err != 0) {
1488 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
1489 			return (zfs_error(zhp->zfs_hdl,
1490 			    EZFS_THREADCREATEFAILED, errbuf));
1491 		}
1492 	}
1493 
1494 	err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
1495 	    lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
1496 	    redactbook, fd, &size);
1497 
1498 	if (flags->progress) {
1499 		void *status = NULL;
1500 		(void) pthread_cancel(ptid);
1501 		(void) pthread_join(ptid, &status);
1502 		int error = (int)(uintptr_t)status;
1503 		if (error != 0 && status != PTHREAD_CANCELED) {
1504 			char errbuf[1024];
1505 			(void) snprintf(errbuf, sizeof (errbuf),
1506 			    dgettext(TEXT_DOMAIN, "progress thread exited "
1507 			    "nonzero"));
1508 			return (zfs_standard_error(zhp->zfs_hdl, error,
1509 			    errbuf));
1510 		}
1511 	}
1512 
1513 	if (err != 0) {
1514 		zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
1515 		return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
1516 		    errbuf));
1517 	}
1518 	send_print_verbose(fout, zhp->zfs_name, from, size,
1519 	    flags->parsable);
1520 
1521 	if (flags->parsable) {
1522 		(void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
1523 	} else {
1524 		char buf[16];
1525 		zfs_nicenum(size, buf, sizeof (buf));
1526 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1527 		    "total estimated size is %s\n"), buf);
1528 	}
1529 	return (0);
1530 }
1531 
1532 static boolean_t
1533 redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
1534 {
1535 	for (int i = 0; i < num_snaps; i++) {
1536 		if (snaps[i] == guid)
1537 			return (B_TRUE);
1538 	}
1539 	return (B_FALSE);
1540 }
1541 
1542 static boolean_t
1543 redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
1544     const uint64_t *snaps2, uint64_t num_snaps2)
1545 {
1546 	if (num_snaps1 != num_snaps2)
1547 		return (B_FALSE);
1548 	for (int i = 0; i < num_snaps1; i++) {
1549 		if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
1550 			return (B_FALSE);
1551 	}
1552 	return (B_TRUE);
1553 }
1554 
1555 /*
1556  * Check that the list of redaction snapshots in the bookmark matches the send
1557  * we're resuming, and return whether or not it's complete.
1558  *
1559  * Note that the caller needs to free the contents of *bookname with free() if
1560  * this function returns successfully.
1561  */
1562 static int
1563 find_redact_book(libzfs_handle_t *hdl, const char *path,
1564     const uint64_t *redact_snap_guids, int num_redact_snaps,
1565     char **bookname)
1566 {
1567 	char errbuf[1024];
1568 	int error = 0;
1569 	nvlist_t *props = fnvlist_alloc();
1570 	nvlist_t *bmarks;
1571 
1572 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1573 	    "cannot resume send"));
1574 
1575 	fnvlist_add_boolean(props, "redact_complete");
1576 	fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1577 	error = lzc_get_bookmarks(path, props, &bmarks);
1578 	fnvlist_free(props);
1579 	if (error != 0) {
1580 		if (error == ESRCH) {
1581 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1582 			    "nonexistent redaction bookmark provided"));
1583 		} else if (error == ENOENT) {
1584 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1585 			    "dataset to be sent no longer exists"));
1586 		} else {
1587 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1588 			    "unknown error: %s"), strerror(error));
1589 		}
1590 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1591 	}
1592 	nvpair_t *pair;
1593 	for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
1594 	    pair = nvlist_next_nvpair(bmarks, pair)) {
1595 
1596 		nvlist_t *bmark = fnvpair_value_nvlist(pair);
1597 		nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
1598 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
1599 		uint_t len = 0;
1600 		uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
1601 		    ZPROP_VALUE, &len);
1602 		if (redact_snaps_equal(redact_snap_guids,
1603 		    num_redact_snaps, bmarksnaps, len)) {
1604 			break;
1605 		}
1606 	}
1607 	if (pair == NULL)  {
1608 		fnvlist_free(bmarks);
1609 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1610 		    "no appropriate redaction bookmark exists"));
1611 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1612 	}
1613 	char *name = nvpair_name(pair);
1614 	nvlist_t *bmark = fnvpair_value_nvlist(pair);
1615 	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
1616 	boolean_t complete = fnvlist_lookup_boolean_value(vallist,
1617 	    ZPROP_VALUE);
1618 	if (!complete) {
1619 		fnvlist_free(bmarks);
1620 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1621 		    "incomplete redaction bookmark provided"));
1622 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
1623 	}
1624 	*bookname = strndup(name, ZFS_MAX_DATASET_NAME_LEN);
1625 	ASSERT3P(*bookname, !=, NULL);
1626 	fnvlist_free(bmarks);
1627 	return (0);
1628 }
1629 
1630 static int
1631 zfs_send_resume_impl(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1632     nvlist_t *resume_nvl)
1633 {
1634 	char errbuf[1024];
1635 	char *toname;
1636 	char *fromname = NULL;
1637 	uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
1638 	zfs_handle_t *zhp;
1639 	int error = 0;
1640 	char name[ZFS_MAX_DATASET_NAME_LEN];
1641 	enum lzc_send_flags lzc_flags = 0;
1642 	FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
1643 	uint64_t *redact_snap_guids = NULL;
1644 	int num_redact_snaps = 0;
1645 	char *redact_book = NULL;
1646 
1647 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1648 	    "cannot resume send"));
1649 
1650 	if (flags->verbosity != 0) {
1651 		(void) fprintf(fout, dgettext(TEXT_DOMAIN,
1652 		    "resume token contents:\n"));
1653 		nvlist_print(fout, resume_nvl);
1654 	}
1655 
1656 	if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 ||
1657 	    nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 ||
1658 	    nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 ||
1659 	    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1660 	    nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
1661 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1662 		    "resume token is corrupt"));
1663 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1664 	}
1665 	fromguid = 0;
1666 	(void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);
1667 
1668 	if (flags->largeblock || nvlist_exists(resume_nvl, "largeblockok"))
1669 		lzc_flags |= LZC_SEND_FLAG_LARGE_BLOCK;
1670 	if (flags->embed_data || nvlist_exists(resume_nvl, "embedok"))
1671 		lzc_flags |= LZC_SEND_FLAG_EMBED_DATA;
1672 	if (flags->compress || nvlist_exists(resume_nvl, "compressok"))
1673 		lzc_flags |= LZC_SEND_FLAG_COMPRESS;
1674 	if (flags->raw || nvlist_exists(resume_nvl, "rawok"))
1675 		lzc_flags |= LZC_SEND_FLAG_RAW;
1676 	if (flags->saved || nvlist_exists(resume_nvl, "savedok"))
1677 		lzc_flags |= LZC_SEND_FLAG_SAVED;
1678 
1679 	if (flags->saved) {
1680 		(void) strcpy(name, toname);
1681 	} else {
1682 		error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
1683 		if (error != 0) {
1684 			if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
1685 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1686 				    "'%s' is no longer the same snapshot "
1687 				    "used in the initial send"), toname);
1688 			} else {
1689 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1690 				    "'%s' used in the initial send no "
1691 				    "longer exists"), toname);
1692 			}
1693 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1694 		}
1695 	}
1696 
1697 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
1698 	if (zhp == NULL) {
1699 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1700 		    "unable to access '%s'"), name);
1701 		return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1702 	}
1703 
1704 	if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
1705 	    &redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
1706 		num_redact_snaps = -1;
1707 	}
1708 
1709 	if (fromguid != 0) {
1710 		if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
1711 		    redact_snap_guids, num_redact_snaps, name) != 0) {
1712 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1713 			    "incremental source %#llx no longer exists"),
1714 			    (longlong_t)fromguid);
1715 			return (zfs_error(hdl, EZFS_BADPATH, errbuf));
1716 		}
1717 		fromname = name;
1718 	}
1719 
1720 	redact_snap_guids = NULL;
1721 
1722 	if (nvlist_lookup_uint64_array(resume_nvl,
1723 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
1724 	    (uint_t *)&num_redact_snaps) == 0) {
1725 		char path[ZFS_MAX_DATASET_NAME_LEN];
1726 
1727 		(void) strlcpy(path, toname, sizeof (path));
1728 		char *at = strchr(path, '@');
1729 		ASSERT3P(at, !=, NULL);
1730 
1731 		*at = '\0';
1732 
1733 		if ((error = find_redact_book(hdl, path, redact_snap_guids,
1734 		    num_redact_snaps, &redact_book)) != 0) {
1735 			return (error);
1736 		}
1737 	}
1738 
1739 	if (flags->verbosity != 0) {
1740 		/*
1741 		 * Some of these may have come from the resume token, set them
1742 		 * here for size estimate purposes.
1743 		 */
1744 		sendflags_t tmpflags = *flags;
1745 		if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
1746 			tmpflags.largeblock = B_TRUE;
1747 		if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
1748 			tmpflags.compress = B_TRUE;
1749 		if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
1750 			tmpflags.embed_data = B_TRUE;
1751 		if (lzc_flags & LZC_SEND_FLAG_RAW)
1752 			tmpflags.raw = B_TRUE;
1753 		if (lzc_flags & LZC_SEND_FLAG_SAVED)
1754 			tmpflags.saved = B_TRUE;
1755 		error = estimate_size(zhp, fromname, outfd, &tmpflags,
1756 		    resumeobj, resumeoff, bytes, redact_book, errbuf);
1757 	}
1758 
1759 	if (!flags->dryrun) {
1760 		progress_arg_t pa = { 0 };
1761 		pthread_t tid;
1762 		/*
1763 		 * If progress reporting is requested, spawn a new thread to
1764 		 * poll ZFS_IOC_SEND_PROGRESS at a regular interval.
1765 		 */
1766 		if (flags->progress) {
1767 			pa.pa_zhp = zhp;
1768 			pa.pa_fd = outfd;
1769 			pa.pa_parsable = flags->parsable;
1770 			pa.pa_estimate = B_FALSE;
1771 			pa.pa_verbosity = flags->verbosity;
1772 
1773 			error = pthread_create(&tid, NULL,
1774 			    send_progress_thread, &pa);
1775 			if (error != 0) {
1776 				if (redact_book != NULL)
1777 					free(redact_book);
1778 				zfs_close(zhp);
1779 				return (error);
1780 			}
1781 		}
1782 
1783 		error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
1784 		    lzc_flags, resumeobj, resumeoff, redact_book);
1785 		if (redact_book != NULL)
1786 			free(redact_book);
1787 
1788 		if (flags->progress) {
1789 			void *status = NULL;
1790 			(void) pthread_cancel(tid);
1791 			(void) pthread_join(tid, &status);
1792 			int error = (int)(uintptr_t)status;
1793 			if (error != 0 && status != PTHREAD_CANCELED) {
1794 				char errbuf[1024];
1795 				(void) snprintf(errbuf, sizeof (errbuf),
1796 				    dgettext(TEXT_DOMAIN,
1797 				    "progress thread exited nonzero"));
1798 				return (zfs_standard_error(hdl, error, errbuf));
1799 			}
1800 		}
1801 
1802 		char errbuf[1024];
1803 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1804 		    "warning: cannot send '%s'"), zhp->zfs_name);
1805 
1806 		zfs_close(zhp);
1807 
1808 		switch (error) {
1809 		case 0:
1810 			return (0);
1811 		case EACCES:
1812 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1813 			    "source key must be loaded"));
1814 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
1815 		case ESRCH:
1816 			if (lzc_exists(zhp->zfs_name)) {
1817 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1818 				    "incremental source could not be found"));
1819 			}
1820 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
1821 
1822 		case EXDEV:
1823 		case ENOENT:
1824 		case EDQUOT:
1825 		case EFBIG:
1826 		case EIO:
1827 		case ENOLINK:
1828 		case ENOSPC:
1829 		case ENOSTR:
1830 		case ENXIO:
1831 		case EPIPE:
1832 		case ERANGE:
1833 		case EFAULT:
1834 		case EROFS:
1835 			zfs_error_aux(hdl, "%s", strerror(errno));
1836 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
1837 
1838 		default:
1839 			return (zfs_standard_error(hdl, errno, errbuf));
1840 		}
1841 	} else {
1842 		if (redact_book != NULL)
1843 			free(redact_book);
1844 	}
1845 
1846 	zfs_close(zhp);
1847 
1848 	return (error);
1849 }
1850 
1851 int
1852 zfs_send_resume(libzfs_handle_t *hdl, sendflags_t *flags, int outfd,
1853     const char *resume_token)
1854 {
1855 	int ret;
1856 	char errbuf[1024];
1857 	nvlist_t *resume_nvl;
1858 
1859 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1860 	    "cannot resume send"));
1861 
1862 	resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
1863 	if (resume_nvl == NULL) {
1864 		/*
1865 		 * zfs_error_aux has already been set by
1866 		 * zfs_send_resume_token_to_nvlist()
1867 		 */
1868 		return (zfs_error(hdl, EZFS_FAULT, errbuf));
1869 	}
1870 
1871 	ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
1872 	fnvlist_free(resume_nvl);
1873 
1874 	return (ret);
1875 }
1876 
1877 int
1878 zfs_send_saved(zfs_handle_t *zhp, sendflags_t *flags, int outfd,
1879     const char *resume_token)
1880 {
1881 	int ret;
1882 	libzfs_handle_t *hdl = zhp->zfs_hdl;
1883 	nvlist_t *saved_nvl = NULL, *resume_nvl = NULL;
1884 	uint64_t saved_guid = 0, resume_guid = 0;
1885 	uint64_t obj = 0, off = 0, bytes = 0;
1886 	char token_buf[ZFS_MAXPROPLEN];
1887 	char errbuf[1024];
1888 
1889 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
1890 	    "saved send failed"));
1891 
1892 	ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
1893 	    token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
1894 	if (ret != 0)
1895 		goto out;
1896 
1897 	saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
1898 	if (saved_nvl == NULL) {
1899 		/*
1900 		 * zfs_error_aux has already been set by
1901 		 * zfs_send_resume_token_to_nvlist()
1902 		 */
1903 		ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1904 		goto out;
1905 	}
1906 
1907 	/*
1908 	 * If a resume token is provided we use the object and offset
1909 	 * from that instead of the default, which starts from the
1910 	 * beginning.
1911 	 */
1912 	if (resume_token != NULL) {
1913 		resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
1914 		    resume_token);
1915 		if (resume_nvl == NULL) {
1916 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1917 			goto out;
1918 		}
1919 
1920 		if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 ||
1921 		    nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 ||
1922 		    nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 ||
1923 		    nvlist_lookup_uint64(resume_nvl, "toguid",
1924 		    &resume_guid) != 0) {
1925 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1926 			    "provided resume token is corrupt"));
1927 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1928 			goto out;
1929 		}
1930 
1931 		if (nvlist_lookup_uint64(saved_nvl, "toguid",
1932 		    &saved_guid)) {
1933 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1934 			    "dataset's resume token is corrupt"));
1935 			ret = zfs_error(hdl, EZFS_FAULT, errbuf);
1936 			goto out;
1937 		}
1938 
1939 		if (resume_guid != saved_guid) {
1940 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
1941 			    "provided resume token does not match dataset"));
1942 			ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
1943 			goto out;
1944 		}
1945 	}
1946 
1947 	(void) nvlist_remove_all(saved_nvl, "object");
1948 	fnvlist_add_uint64(saved_nvl, "object", obj);
1949 
1950 	(void) nvlist_remove_all(saved_nvl, "offset");
1951 	fnvlist_add_uint64(saved_nvl, "offset", off);
1952 
1953 	(void) nvlist_remove_all(saved_nvl, "bytes");
1954 	fnvlist_add_uint64(saved_nvl, "bytes", bytes);
1955 
1956 	(void) nvlist_remove_all(saved_nvl, "toname");
1957 	fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);
1958 
1959 	ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);
1960 
1961 out:
1962 	fnvlist_free(saved_nvl);
1963 	fnvlist_free(resume_nvl);
1964 	return (ret);
1965 }
1966 
1967 /*
1968  * This function informs the target system that the recursive send is complete.
1969  * The record is also expected in the case of a send -p.
1970  */
1971 static int
1972 send_conclusion_record(int fd, zio_cksum_t *zc)
1973 {
1974 	dmu_replay_record_t drr = { 0 };
1975 	drr.drr_type = DRR_END;
1976 	if (zc != NULL)
1977 		drr.drr_u.drr_end.drr_checksum = *zc;
1978 	if (write(fd, &drr, sizeof (drr)) == -1) {
1979 		return (errno);
1980 	}
1981 	return (0);
1982 }
1983 
1984 /*
1985  * This function is responsible for sending the records that contain the
1986  * necessary information for the target system's libzfs to be able to set the
1987  * properties of the filesystem being received, or to be able to prepare for
1988  * a recursive receive.
1989  *
1990  * The "zhp" argument is the handle of the snapshot we are sending
1991  * (the "tosnap").  The "from" argument is the short snapshot name (the part
1992  * after the @) of the incremental source.
1993  */
1994 static int
1995 send_prelim_records(zfs_handle_t *zhp, const char *from, int fd,
1996     boolean_t gather_props, boolean_t recursive, boolean_t verbose,
1997     boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t skipmissing,
1998     boolean_t backup, boolean_t holds, boolean_t props, boolean_t doall,
1999     nvlist_t **fssp, avl_tree_t **fsavlp)
2000 {
2001 	int err = 0;
2002 	char *packbuf = NULL;
2003 	size_t buflen = 0;
2004 	zio_cksum_t zc = { {0} };
2005 	int featureflags = 0;
2006 	/* name of filesystem/volume that contains snapshot we are sending */
2007 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
2008 	/* short name of snap we are sending */
2009 	char *tosnap = "";
2010 
2011 	char errbuf[1024];
2012 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2013 	    "warning: cannot send '%s'"), zhp->zfs_name);
2014 	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
2015 	    ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
2016 		featureflags |= DMU_BACKUP_FEATURE_SA_SPILL;
2017 	}
2018 
2019 	if (holds)
2020 		featureflags |= DMU_BACKUP_FEATURE_HOLDS;
2021 
2022 	(void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
2023 	char *at = strchr(tofs, '@');
2024 	if (at != NULL) {
2025 		*at = '\0';
2026 		tosnap = at + 1;
2027 	}
2028 
2029 	if (gather_props) {
2030 		nvlist_t *hdrnv = fnvlist_alloc();
2031 		nvlist_t *fss = NULL;
2032 
2033 		if (from != NULL)
2034 			fnvlist_add_string(hdrnv, "fromsnap", from);
2035 		fnvlist_add_string(hdrnv, "tosnap", tosnap);
2036 		if (!recursive)
2037 			fnvlist_add_boolean(hdrnv, "not_recursive");
2038 
2039 		if (raw) {
2040 			fnvlist_add_boolean(hdrnv, "raw");
2041 		}
2042 
2043 		if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
2044 		    from, tosnap, recursive, raw, doall, replicate, skipmissing,
2045 		    verbose, backup, holds, props, &fss, fsavlp)) != 0) {
2046 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2047 			    errbuf));
2048 		}
2049 		/*
2050 		 * Do not allow the size of the properties list to exceed
2051 		 * the limit
2052 		 */
2053 		if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
2054 		    zhp->zfs_hdl->libzfs_max_nvlist) {
2055 			(void) snprintf(errbuf, sizeof (errbuf),
2056 			    dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
2057 			    "the size of the list of snapshots and properties "
2058 			    "is too large to be received successfully.\n"
2059 			    "Select a smaller number of snapshots to send.\n"),
2060 			    zhp->zfs_name);
2061 			return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
2062 			    errbuf));
2063 		}
2064 		fnvlist_add_nvlist(hdrnv, "fss", fss);
2065 		VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
2066 		    0));
2067 		if (fssp != NULL) {
2068 			*fssp = fss;
2069 		} else {
2070 			fnvlist_free(fss);
2071 		}
2072 		fnvlist_free(hdrnv);
2073 	}
2074 
2075 	if (!dryrun) {
2076 		dmu_replay_record_t drr = { 0 };
2077 		/* write first begin record */
2078 		drr.drr_type = DRR_BEGIN;
2079 		drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
2080 		DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
2081 		    drr_versioninfo, DMU_COMPOUNDSTREAM);
2082 		DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
2083 		    drr_versioninfo, featureflags);
2084 		if (snprintf(drr.drr_u.drr_begin.drr_toname,
2085 		    sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
2086 		    tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
2087 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2088 			    errbuf));
2089 		}
2090 		drr.drr_payloadlen = buflen;
2091 
2092 		err = dump_record(&drr, packbuf, buflen, &zc, fd);
2093 		free(packbuf);
2094 		if (err != 0) {
2095 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2096 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2097 			    errbuf));
2098 		}
2099 		err = send_conclusion_record(fd, &zc);
2100 		if (err != 0) {
2101 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(err));
2102 			return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
2103 			    errbuf));
2104 		}
2105 	}
2106 	return (0);
2107 }
2108 
2109 /*
2110  * Generate a send stream.  The "zhp" argument is the filesystem/volume
2111  * that contains the snapshot to send.  The "fromsnap" argument is the
2112  * short name (the part after the '@') of the snapshot that is the
2113  * incremental source to send from (if non-NULL).  The "tosnap" argument
2114  * is the short name of the snapshot to send.
2115  *
2116  * The content of the send stream is the snapshot identified by
2117  * 'tosnap'.  Incremental streams are requested in two ways:
2118  *     - from the snapshot identified by "fromsnap" (if non-null) or
2119  *     - from the origin of the dataset identified by zhp, which must
2120  *	 be a clone.  In this case, "fromsnap" is null and "fromorigin"
2121  *	 is TRUE.
2122  *
2123  * The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
2124  * uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
2125  * if "replicate" is set.  If "doall" is set, dump all the intermediate
2126  * snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
2127  * case too. If "props" is set, send properties.
2128  */
2129 int
2130 zfs_send(zfs_handle_t *zhp, const char *fromsnap, const char *tosnap,
2131     sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
2132     void *cb_arg, nvlist_t **debugnvp)
2133 {
2134 	char errbuf[1024];
2135 	send_dump_data_t sdd = { 0 };
2136 	int err = 0;
2137 	nvlist_t *fss = NULL;
2138 	avl_tree_t *fsavl = NULL;
2139 	static uint64_t holdseq;
2140 	int spa_version;
2141 	FILE *fout;
2142 
2143 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2144 	    "cannot send '%s'"), zhp->zfs_name);
2145 
2146 	if (fromsnap && fromsnap[0] == '\0') {
2147 		zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
2148 		    "zero-length incremental source"));
2149 		return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
2150 	}
2151 
2152 	if (fromsnap) {
2153 		char full_fromsnap_name[ZFS_MAX_DATASET_NAME_LEN];
2154 		if (snprintf(full_fromsnap_name, sizeof (full_fromsnap_name),
2155 		    "%s@%s", zhp->zfs_name, fromsnap) >=
2156 		    sizeof (full_fromsnap_name)) {
2157 			err = EINVAL;
2158 			goto stderr_out;
2159 		}
2160 		zfs_handle_t *fromsnapn = zfs_open(zhp->zfs_hdl,
2161 		    full_fromsnap_name, ZFS_TYPE_SNAPSHOT);
2162 		if (fromsnapn == NULL) {
2163 			err = -1;
2164 			goto err_out;
2165 		}
2166 		zfs_close(fromsnapn);
2167 	}
2168 
2169 	if (flags->replicate || flags->doall || flags->props ||
2170 	    flags->holds || flags->backup) {
2171 		char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
2172 		if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
2173 		    "%s@%s", zhp->zfs_name, tosnap) >=
2174 		    sizeof (full_tosnap_name)) {
2175 			err = EINVAL;
2176 			goto stderr_out;
2177 		}
2178 		zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
2179 		    full_tosnap_name, ZFS_TYPE_SNAPSHOT);
2180 		if (tosnap == NULL) {
2181 			err = -1;
2182 			goto err_out;
2183 		}
2184 		err = send_prelim_records(tosnap, fromsnap, outfd,
2185 		    flags->replicate || flags->props || flags->holds,
2186 		    flags->replicate, flags->verbosity > 0, flags->dryrun,
2187 		    flags->raw, flags->replicate, flags->skipmissing,
2188 		    flags->backup, flags->holds, flags->props, flags->doall,
2189 		    &fss, &fsavl);
2190 		zfs_close(tosnap);
2191 		if (err != 0)
2192 			goto err_out;
2193 	}
2194 
2195 	/* dump each stream */
2196 	sdd.fromsnap = fromsnap;
2197 	sdd.tosnap = tosnap;
2198 	sdd.outfd = outfd;
2199 	sdd.replicate = flags->replicate;
2200 	sdd.doall = flags->doall;
2201 	sdd.fromorigin = flags->fromorigin;
2202 	sdd.fss = fss;
2203 	sdd.fsavl = fsavl;
2204 	sdd.verbosity = flags->verbosity;
2205 	sdd.parsable = flags->parsable;
2206 	sdd.progress = flags->progress;
2207 	sdd.dryrun = flags->dryrun;
2208 	sdd.large_block = flags->largeblock;
2209 	sdd.embed_data = flags->embed_data;
2210 	sdd.compress = flags->compress;
2211 	sdd.raw = flags->raw;
2212 	sdd.holds = flags->holds;
2213 	sdd.filter_cb = filter_func;
2214 	sdd.filter_cb_arg = cb_arg;
2215 	if (debugnvp)
2216 		sdd.debugnv = *debugnvp;
2217 	if (sdd.verbosity != 0 && sdd.dryrun)
2218 		sdd.std_out = B_TRUE;
2219 	fout = sdd.std_out ? stdout : stderr;
2220 
2221 	/*
2222 	 * Some flags require that we place user holds on the datasets that are
2223 	 * being sent so they don't get destroyed during the send. We can skip
2224 	 * this step if the pool is imported read-only since the datasets cannot
2225 	 * be destroyed.
2226 	 */
2227 	if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
2228 	    ZPOOL_PROP_READONLY, NULL) &&
2229 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2230 	    spa_version >= SPA_VERSION_USERREFS &&
2231 	    (flags->doall || flags->replicate)) {
2232 		++holdseq;
2233 		(void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
2234 		    ".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
2235 		sdd.cleanup_fd = open(ZFS_DEV, O_RDWR | O_CLOEXEC);
2236 		if (sdd.cleanup_fd < 0) {
2237 			err = errno;
2238 			goto stderr_out;
2239 		}
2240 		sdd.snapholds = fnvlist_alloc();
2241 	} else {
2242 		sdd.cleanup_fd = -1;
2243 		sdd.snapholds = NULL;
2244 	}
2245 
2246 	if (flags->verbosity != 0 || sdd.snapholds != NULL) {
2247 		/*
2248 		 * Do a verbose no-op dry run to get all the verbose output
2249 		 * or to gather snapshot hold's before generating any data,
2250 		 * then do a non-verbose real run to generate the streams.
2251 		 */
2252 		sdd.dryrun = B_TRUE;
2253 		err = dump_filesystems(zhp, &sdd);
2254 
2255 		if (err != 0)
2256 			goto stderr_out;
2257 
2258 		if (flags->verbosity != 0) {
2259 			if (flags->parsable) {
2260 				(void) fprintf(fout, "size\t%llu\n",
2261 				    (longlong_t)sdd.size);
2262 			} else {
2263 				char buf[16];
2264 				zfs_nicebytes(sdd.size, buf, sizeof (buf));
2265 				(void) fprintf(fout, dgettext(TEXT_DOMAIN,
2266 				    "total estimated size is %s\n"), buf);
2267 			}
2268 		}
2269 
2270 		/* Ensure no snaps found is treated as an error. */
2271 		if (!sdd.seento) {
2272 			err = ENOENT;
2273 			goto err_out;
2274 		}
2275 
2276 		/* Skip the second run if dryrun was requested. */
2277 		if (flags->dryrun)
2278 			goto err_out;
2279 
2280 		if (sdd.snapholds != NULL) {
2281 			err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
2282 			if (err != 0)
2283 				goto stderr_out;
2284 
2285 			fnvlist_free(sdd.snapholds);
2286 			sdd.snapholds = NULL;
2287 		}
2288 
2289 		sdd.dryrun = B_FALSE;
2290 		sdd.verbosity = 0;
2291 	}
2292 
2293 	err = dump_filesystems(zhp, &sdd);
2294 	fsavl_destroy(fsavl);
2295 	fnvlist_free(fss);
2296 
2297 	/* Ensure no snaps found is treated as an error. */
2298 	if (err == 0 && !sdd.seento)
2299 		err = ENOENT;
2300 
2301 	if (sdd.cleanup_fd != -1) {
2302 		VERIFY(0 == close(sdd.cleanup_fd));
2303 		sdd.cleanup_fd = -1;
2304 	}
2305 
2306 	if (!flags->dryrun && (flags->replicate || flags->doall ||
2307 	    flags->props || flags->backup || flags->holds)) {
2308 		/*
2309 		 * write final end record.  NB: want to do this even if
2310 		 * there was some error, because it might not be totally
2311 		 * failed.
2312 		 */
2313 		err = send_conclusion_record(outfd, NULL);
2314 		if (err != 0)
2315 			return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
2316 	}
2317 
2318 	return (err || sdd.err);
2319 
2320 stderr_out:
2321 	err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
2322 err_out:
2323 	fsavl_destroy(fsavl);
2324 	fnvlist_free(fss);
2325 	fnvlist_free(sdd.snapholds);
2326 
2327 	if (sdd.cleanup_fd != -1)
2328 		VERIFY(0 == close(sdd.cleanup_fd));
2329 	return (err);
2330 }
2331 
2332 static zfs_handle_t *
2333 name_to_dir_handle(libzfs_handle_t *hdl, const char *snapname)
2334 {
2335 	char dirname[ZFS_MAX_DATASET_NAME_LEN];
2336 	(void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
2337 	char *c = strchr(dirname, '@');
2338 	if (c != NULL)
2339 		*c = '\0';
2340 	return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
2341 }
2342 
2343 /*
2344  * Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
2345  * an earlier snapshot in the same filesystem, or a snapshot before later's
2346  * origin, or it's origin's origin, etc.
2347  */
2348 static boolean_t
2349 snapshot_is_before(zfs_handle_t *earlier, zfs_handle_t *later)
2350 {
2351 	boolean_t ret;
2352 	uint64_t later_txg =
2353 	    (later->zfs_type == ZFS_TYPE_FILESYSTEM ||
2354 	    later->zfs_type == ZFS_TYPE_VOLUME ?
2355 	    UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
2356 	uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);
2357 
2358 	if (earlier_txg >= later_txg)
2359 		return (B_FALSE);
2360 
2361 	zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
2362 	    earlier->zfs_name);
2363 	zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
2364 	    later->zfs_name);
2365 
2366 	if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
2367 		zfs_close(earlier_dir);
2368 		zfs_close(later_dir);
2369 		return (B_TRUE);
2370 	}
2371 
2372 	char clonename[ZFS_MAX_DATASET_NAME_LEN];
2373 	if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
2374 	    ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
2375 		zfs_close(earlier_dir);
2376 		zfs_close(later_dir);
2377 		return (B_FALSE);
2378 	}
2379 
2380 	zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
2381 	    ZFS_TYPE_DATASET);
2382 	uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);
2383 
2384 	/*
2385 	 * If "earlier" is exactly the origin, then
2386 	 * snapshot_is_before(earlier, origin) will return false (because
2387 	 * they're the same).
2388 	 */
2389 	if (origin_txg == earlier_txg &&
2390 	    strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
2391 		zfs_close(earlier_dir);
2392 		zfs_close(later_dir);
2393 		zfs_close(origin);
2394 		return (B_TRUE);
2395 	}
2396 	zfs_close(earlier_dir);
2397 	zfs_close(later_dir);
2398 
2399 	ret = snapshot_is_before(earlier, origin);
2400 	zfs_close(origin);
2401 	return (ret);
2402 }
2403 
2404 /*
2405  * The "zhp" argument is the handle of the dataset to send (typically a
2406  * snapshot).  The "from" argument is the full name of the snapshot or
2407  * bookmark that is the incremental source.
2408  */
2409 int
2410 zfs_send_one(zfs_handle_t *zhp, const char *from, int fd, sendflags_t *flags,
2411     const char *redactbook)
2412 {
2413 	int err;
2414 	libzfs_handle_t *hdl = zhp->zfs_hdl;
2415 	char *name = zhp->zfs_name;
2416 	pthread_t ptid;
2417 	progress_arg_t pa = { 0 };
2418 
2419 	char errbuf[1024];
2420 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
2421 	    "warning: cannot send '%s'"), name);
2422 
2423 	if (from != NULL && strchr(from, '@')) {
2424 		zfs_handle_t *from_zhp = zfs_open(hdl, from,
2425 		    ZFS_TYPE_DATASET);
2426 		if (from_zhp == NULL)
2427 			return (-1);
2428 		if (!snapshot_is_before(from_zhp, zhp)) {
2429 			zfs_close(from_zhp);
2430 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2431 			    "not an earlier snapshot from the same fs"));
2432 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2433 		}
2434 		zfs_close(from_zhp);
2435 	}
2436 
2437 	if (redactbook != NULL) {
2438 		char bookname[ZFS_MAX_DATASET_NAME_LEN];
2439 		nvlist_t *redact_snaps;
2440 		zfs_handle_t *book_zhp;
2441 		char *at, *pound;
2442 		int dsnamelen;
2443 
2444 		pound = strchr(redactbook, '#');
2445 		if (pound != NULL)
2446 			redactbook = pound + 1;
2447 		at = strchr(name, '@');
2448 		if (at == NULL) {
2449 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2450 			    "cannot do a redacted send to a filesystem"));
2451 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2452 		}
2453 		dsnamelen = at - name;
2454 		if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
2455 		    dsnamelen, name, redactbook)
2456 		    >= sizeof (bookname)) {
2457 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2458 			    "invalid bookmark name"));
2459 			return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
2460 		}
2461 		book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
2462 		if (book_zhp == NULL)
2463 			return (-1);
2464 		if (nvlist_lookup_nvlist(book_zhp->zfs_props,
2465 		    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
2466 		    &redact_snaps) != 0 || redact_snaps == NULL) {
2467 			zfs_close(book_zhp);
2468 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2469 			    "not a redaction bookmark"));
2470 			return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
2471 		}
2472 		zfs_close(book_zhp);
2473 	}
2474 
2475 	/*
2476 	 * Send fs properties
2477 	 */
2478 	if (flags->props || flags->holds || flags->backup) {
2479 		/*
2480 		 * Note: the header generated by send_prelim_records()
2481 		 * assumes that the incremental source is in the same
2482 		 * filesystem/volume as the target (which is a requirement
2483 		 * when doing "zfs send -R").  But that isn't always the
2484 		 * case here (e.g. send from snap in origin, or send from
2485 		 * bookmark).  We pass from=NULL, which will omit this
2486 		 * information from the prelim records; it isn't used
2487 		 * when receiving this type of stream.
2488 		 */
2489 		err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
2490 		    flags->verbosity > 0, flags->dryrun, flags->raw,
2491 		    flags->replicate, B_FALSE, flags->backup, flags->holds,
2492 		    flags->props, flags->doall, NULL, NULL);
2493 		if (err != 0)
2494 			return (err);
2495 	}
2496 
2497 	/*
2498 	 * Perform size estimate if verbose was specified.
2499 	 */
2500 	if (flags->verbosity != 0) {
2501 		err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
2502 		    errbuf);
2503 		if (err != 0)
2504 			return (err);
2505 	}
2506 
2507 	if (flags->dryrun)
2508 		return (0);
2509 
2510 	/*
2511 	 * If progress reporting is requested, spawn a new thread to poll
2512 	 * ZFS_IOC_SEND_PROGRESS at a regular interval.
2513 	 */
2514 	if (flags->progress) {
2515 		pa.pa_zhp = zhp;
2516 		pa.pa_fd = fd;
2517 		pa.pa_parsable = flags->parsable;
2518 		pa.pa_estimate = B_FALSE;
2519 		pa.pa_verbosity = flags->verbosity;
2520 
2521 		err = pthread_create(&ptid, NULL,
2522 		    send_progress_thread, &pa);
2523 		if (err != 0) {
2524 			zfs_error_aux(zhp->zfs_hdl, "%s", strerror(errno));
2525 			return (zfs_error(zhp->zfs_hdl,
2526 			    EZFS_THREADCREATEFAILED, errbuf));
2527 		}
2528 	}
2529 
2530 	err = lzc_send_redacted(name, from, fd,
2531 	    lzc_flags_from_sendflags(flags), redactbook);
2532 
2533 	if (flags->progress) {
2534 		void *status = NULL;
2535 		if (err != 0)
2536 			(void) pthread_cancel(ptid);
2537 		(void) pthread_join(ptid, &status);
2538 		int error = (int)(uintptr_t)status;
2539 		if (error != 0 && status != PTHREAD_CANCELED)
2540 			return (zfs_standard_error_fmt(hdl, error,
2541 			    dgettext(TEXT_DOMAIN,
2542 			    "progress thread exited nonzero")));
2543 	}
2544 
2545 	if (flags->props || flags->holds || flags->backup) {
2546 		/* Write the final end record. */
2547 		err = send_conclusion_record(fd, NULL);
2548 		if (err != 0)
2549 			return (zfs_standard_error(hdl, err, errbuf));
2550 	}
2551 	if (err != 0) {
2552 		switch (errno) {
2553 		case EXDEV:
2554 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2555 			    "not an earlier snapshot from the same fs"));
2556 			return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
2557 
2558 		case ENOENT:
2559 		case ESRCH:
2560 			if (lzc_exists(name)) {
2561 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2562 				    "incremental source (%s) does not exist"),
2563 				    from);
2564 			}
2565 			return (zfs_error(hdl, EZFS_NOENT, errbuf));
2566 
2567 		case EACCES:
2568 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2569 			    "dataset key must be loaded"));
2570 			return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
2571 
2572 		case EBUSY:
2573 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2574 			    "target is busy; if a filesystem, "
2575 			    "it must not be mounted"));
2576 			return (zfs_error(hdl, EZFS_BUSY, errbuf));
2577 
2578 		case EDQUOT:
2579 		case EFAULT:
2580 		case EFBIG:
2581 		case EINVAL:
2582 		case EIO:
2583 		case ENOLINK:
2584 		case ENOSPC:
2585 		case ENOSTR:
2586 		case ENXIO:
2587 		case EPIPE:
2588 		case ERANGE:
2589 		case EROFS:
2590 			zfs_error_aux(hdl, "%s", strerror(errno));
2591 			return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));
2592 
2593 		default:
2594 			return (zfs_standard_error(hdl, errno, errbuf));
2595 		}
2596 	}
2597 	return (err != 0);
2598 }
2599 
2600 /*
2601  * Routines specific to "zfs recv"
2602  */
2603 
2604 static int
2605 recv_read(libzfs_handle_t *hdl, int fd, void *buf, int ilen,
2606     boolean_t byteswap, zio_cksum_t *zc)
2607 {
2608 	char *cp = buf;
2609 	int rv;
2610 	int len = ilen;
2611 
2612 	do {
2613 		rv = read(fd, cp, len);
2614 		cp += rv;
2615 		len -= rv;
2616 	} while (rv > 0);
2617 
2618 	if (rv < 0 || len != 0) {
2619 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
2620 		    "failed to read from stream"));
2621 		return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
2622 		    "cannot receive")));
2623 	}
2624 
2625 	if (zc) {
2626 		if (byteswap)
2627 			fletcher_4_incremental_byteswap(buf, ilen, zc);
2628 		else
2629 			fletcher_4_incremental_native(buf, ilen, zc);
2630 	}
2631 	return (0);
2632 }
2633 
2634 static int
2635 recv_read_nvlist(libzfs_handle_t *hdl, int fd, int len, nvlist_t **nvp,
2636     boolean_t byteswap, zio_cksum_t *zc)
2637 {
2638 	char *buf;
2639 	int err;
2640 
2641 	buf = zfs_alloc(hdl, len);
2642 	if (buf == NULL)
2643 		return (ENOMEM);
2644 
2645 	if (len > hdl->libzfs_max_nvlist) {
2646 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
2647 		free(buf);
2648 		return (ENOMEM);
2649 	}
2650 
2651 	err = recv_read(hdl, fd, buf, len, byteswap, zc);
2652 	if (err != 0) {
2653 		free(buf);
2654 		return (err);
2655 	}
2656 
2657 	err = nvlist_unpack(buf, len, nvp, 0);
2658 	free(buf);
2659 	if (err != 0) {
2660 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
2661 		    "stream (malformed nvlist)"));
2662 		return (EINVAL);
2663 	}
2664 	return (0);
2665 }
2666 
2667 /*
2668  * Returns the grand origin (origin of origin of origin...) of a given handle.
2669  * If this dataset is not a clone, it simply returns a copy of the original
2670  * handle.
2671  */
2672 static zfs_handle_t *
2673 recv_open_grand_origin(zfs_handle_t *zhp)
2674 {
2675 	char origin[ZFS_MAX_DATASET_NAME_LEN];
2676 	zprop_source_t src;
2677 	zfs_handle_t *ozhp = zfs_handle_dup(zhp);
2678 
2679 	while (ozhp != NULL) {
2680 		if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
2681 		    sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
2682 			break;
2683 
2684 		(void) zfs_close(ozhp);
2685 		ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
2686 	}
2687 
2688 	return (ozhp);
2689 }
2690 
2691 static int
2692 recv_rename_impl(zfs_handle_t *zhp, const char *name, const char *newname)
2693 {
2694 	int err;
2695 	zfs_handle_t *ozhp = NULL;
2696 
2697 	/*
2698 	 * Attempt to rename the dataset. If it fails with EACCES we have
2699 	 * attempted to rename the dataset outside of its encryption root.
2700 	 * Force the dataset to become an encryption root and try again.
2701 	 */
2702 	err = lzc_rename(name, newname);
2703 	if (err == EACCES) {
2704 		ozhp = recv_open_grand_origin(zhp);
2705 		if (ozhp == NULL) {
2706 			err = ENOENT;
2707 			goto out;
2708 		}
2709 
2710 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2711 		    NULL, NULL, 0);
2712 		if (err != 0)
2713 			goto out;
2714 
2715 		err = lzc_rename(name, newname);
2716 	}
2717 
2718 out:
2719 	if (ozhp != NULL)
2720 		zfs_close(ozhp);
2721 	return (err);
2722 }
2723 
2724 static int
2725 recv_rename(libzfs_handle_t *hdl, const char *name, const char *tryname,
2726     int baselen, char *newname, recvflags_t *flags)
2727 {
2728 	static int seq;
2729 	int err;
2730 	prop_changelist_t *clp = NULL;
2731 	zfs_handle_t *zhp = NULL;
2732 
2733 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2734 	if (zhp == NULL) {
2735 		err = -1;
2736 		goto out;
2737 	}
2738 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2739 	    flags->force ? MS_FORCE : 0);
2740 	if (clp == NULL) {
2741 		err = -1;
2742 		goto out;
2743 	}
2744 	err = changelist_prefix(clp);
2745 	if (err)
2746 		goto out;
2747 
2748 	if (tryname) {
2749 		(void) strcpy(newname, tryname);
2750 		if (flags->verbose) {
2751 			(void) printf("attempting rename %s to %s\n",
2752 			    name, newname);
2753 		}
2754 		err = recv_rename_impl(zhp, name, newname);
2755 		if (err == 0)
2756 			changelist_rename(clp, name, tryname);
2757 	} else {
2758 		err = ENOENT;
2759 	}
2760 
2761 	if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
2762 		seq++;
2763 
2764 		(void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
2765 		    "%.*srecv-%u-%u", baselen, name, getpid(), seq);
2766 
2767 		if (flags->verbose) {
2768 			(void) printf("failed - trying rename %s to %s\n",
2769 			    name, newname);
2770 		}
2771 		err = recv_rename_impl(zhp, name, newname);
2772 		if (err == 0)
2773 			changelist_rename(clp, name, newname);
2774 		if (err && flags->verbose) {
2775 			(void) printf("failed (%u) - "
2776 			    "will try again on next pass\n", errno);
2777 		}
2778 		err = EAGAIN;
2779 	} else if (flags->verbose) {
2780 		if (err == 0)
2781 			(void) printf("success\n");
2782 		else
2783 			(void) printf("failed (%u)\n", errno);
2784 	}
2785 
2786 	(void) changelist_postfix(clp);
2787 
2788 out:
2789 	if (clp != NULL)
2790 		changelist_free(clp);
2791 	if (zhp != NULL)
2792 		zfs_close(zhp);
2793 
2794 	return (err);
2795 }
2796 
2797 static int
2798 recv_promote(libzfs_handle_t *hdl, const char *fsname,
2799     const char *origin_fsname, recvflags_t *flags)
2800 {
2801 	int err;
2802 	zfs_cmd_t zc = {"\0"};
2803 	zfs_handle_t *zhp = NULL, *ozhp = NULL;
2804 
2805 	if (flags->verbose)
2806 		(void) printf("promoting %s\n", fsname);
2807 
2808 	(void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
2809 	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
2810 
2811 	/*
2812 	 * Attempt to promote the dataset. If it fails with EACCES the
2813 	 * promotion would cause this dataset to leave its encryption root.
2814 	 * Force the origin to become an encryption root and try again.
2815 	 */
2816 	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2817 	if (err == EACCES) {
2818 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
2819 		if (zhp == NULL) {
2820 			err = -1;
2821 			goto out;
2822 		}
2823 
2824 		ozhp = recv_open_grand_origin(zhp);
2825 		if (ozhp == NULL) {
2826 			err = -1;
2827 			goto out;
2828 		}
2829 
2830 		err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
2831 		    NULL, NULL, 0);
2832 		if (err != 0)
2833 			goto out;
2834 
2835 		err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
2836 	}
2837 
2838 out:
2839 	if (zhp != NULL)
2840 		zfs_close(zhp);
2841 	if (ozhp != NULL)
2842 		zfs_close(ozhp);
2843 
2844 	return (err);
2845 }
2846 
2847 static int
2848 recv_destroy(libzfs_handle_t *hdl, const char *name, int baselen,
2849     char *newname, recvflags_t *flags)
2850 {
2851 	int err = 0;
2852 	prop_changelist_t *clp;
2853 	zfs_handle_t *zhp;
2854 	boolean_t defer = B_FALSE;
2855 	int spa_version;
2856 
2857 	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
2858 	if (zhp == NULL)
2859 		return (-1);
2860 	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
2861 	    flags->force ? MS_FORCE : 0);
2862 	if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT &&
2863 	    zfs_spa_version(zhp, &spa_version) == 0 &&
2864 	    spa_version >= SPA_VERSION_USERREFS)
2865 		defer = B_TRUE;
2866 	zfs_close(zhp);
2867 	if (clp == NULL)
2868 		return (-1);
2869 	err = changelist_prefix(clp);
2870 	if (err)
2871 		return (err);
2872 
2873 	if (flags->verbose)
2874 		(void) printf("attempting destroy %s\n", name);
2875 	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
2876 		nvlist_t *nv = fnvlist_alloc();
2877 		fnvlist_add_boolean(nv, name);
2878 		err = lzc_destroy_snaps(nv, defer, NULL);
2879 		fnvlist_free(nv);
2880 	} else {
2881 		err = lzc_destroy(name);
2882 	}
2883 	if (err == 0) {
2884 		if (flags->verbose)
2885 			(void) printf("success\n");
2886 		changelist_remove(clp, name);
2887 	}
2888 
2889 	(void) changelist_postfix(clp);
2890 	changelist_free(clp);
2891 
2892 	/*
2893 	 * Deferred destroy might destroy the snapshot or only mark it to be
2894 	 * destroyed later, and it returns success in either case.
2895 	 */
2896 	if (err != 0 || (defer && zfs_dataset_exists(hdl, name,
2897 	    ZFS_TYPE_SNAPSHOT))) {
2898 		err = recv_rename(hdl, name, NULL, baselen, newname, flags);
2899 	}
2900 
2901 	return (err);
2902 }
2903 
2904 typedef struct guid_to_name_data {
2905 	uint64_t guid;
2906 	boolean_t bookmark_ok;
2907 	char *name;
2908 	char *skip;
2909 	uint64_t *redact_snap_guids;
2910 	uint64_t num_redact_snaps;
2911 } guid_to_name_data_t;
2912 
2913 static boolean_t
2914 redact_snaps_match(zfs_handle_t *zhp, guid_to_name_data_t *gtnd)
2915 {
2916 	uint64_t *bmark_snaps;
2917 	uint_t bmark_num_snaps;
2918 	nvlist_t *nvl;
2919 	if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
2920 		return (B_FALSE);
2921 
2922 	nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
2923 	    zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
2924 	bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
2925 	    &bmark_num_snaps);
2926 	if (bmark_num_snaps != gtnd->num_redact_snaps)
2927 		return (B_FALSE);
2928 	int i = 0;
2929 	for (; i < bmark_num_snaps; i++) {
2930 		int j = 0;
2931 		for (; j < bmark_num_snaps; j++) {
2932 			if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
2933 				break;
2934 		}
2935 		if (j == bmark_num_snaps)
2936 			break;
2937 	}
2938 	return (i == bmark_num_snaps);
2939 }
2940 
2941 static int
2942 guid_to_name_cb(zfs_handle_t *zhp, void *arg)
2943 {
2944 	guid_to_name_data_t *gtnd = arg;
2945 	const char *slash;
2946 	int err;
2947 
2948 	if (gtnd->skip != NULL &&
2949 	    (slash = strrchr(zhp->zfs_name, '/')) != NULL &&
2950 	    strcmp(slash + 1, gtnd->skip) == 0) {
2951 		zfs_close(zhp);
2952 		return (0);
2953 	}
2954 
2955 	if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
2956 	    (gtnd->num_redact_snaps == -1 || redact_snaps_match(zhp, gtnd))) {
2957 		(void) strcpy(gtnd->name, zhp->zfs_name);
2958 		zfs_close(zhp);
2959 		return (EEXIST);
2960 	}
2961 
2962 	err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
2963 	if (err != EEXIST && gtnd->bookmark_ok)
2964 		err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
2965 	zfs_close(zhp);
2966 	return (err);
2967 }
2968 
2969 /*
2970  * Attempt to find the local dataset associated with this guid.  In the case of
2971  * multiple matches, we attempt to find the "best" match by searching
2972  * progressively larger portions of the hierarchy.  This allows one to send a
2973  * tree of datasets individually and guarantee that we will find the source
2974  * guid within that hierarchy, even if there are multiple matches elsewhere.
2975  *
2976  * If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
2977  * the specified number of redaction snapshots.  If num_redact_snaps isn't 0 or
2978  * -1, then redact_snap_guids will be an array of the guids of the snapshots the
2979  * redaction bookmark was created with.  If num_redact_snaps is -1, then we will
2980  * attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
2981  * given guid.  Note that a redaction bookmark can be returned if
2982  * num_redact_snaps == -1.
2983  */
2984 static int
2985 guid_to_name_redact_snaps(libzfs_handle_t *hdl, const char *parent,
2986     uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
2987     uint64_t num_redact_snaps, char *name)
2988 {
2989 	char pname[ZFS_MAX_DATASET_NAME_LEN];
2990 	guid_to_name_data_t gtnd;
2991 
2992 	gtnd.guid = guid;
2993 	gtnd.bookmark_ok = bookmark_ok;
2994 	gtnd.name = name;
2995 	gtnd.skip = NULL;
2996 	gtnd.redact_snap_guids = redact_snap_guids;
2997 	gtnd.num_redact_snaps = num_redact_snaps;
2998 
2999 	/*
3000 	 * Search progressively larger portions of the hierarchy, starting
3001 	 * with the filesystem specified by 'parent'.  This will
3002 	 * select the "most local" version of the origin snapshot in the case
3003 	 * that there are multiple matching snapshots in the system.
3004 	 */
3005 	(void) strlcpy(pname, parent, sizeof (pname));
3006 	char *cp = strrchr(pname, '@');
3007 	if (cp == NULL)
3008 		cp = strchr(pname, '\0');
3009 	for (; cp != NULL; cp = strrchr(pname, '/')) {
3010 		/* Chop off the last component and open the parent */
3011 		*cp = '\0';
3012 		zfs_handle_t *zhp = make_dataset_handle(hdl, pname);
3013 
3014 		if (zhp == NULL)
3015 			continue;
3016 		int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
3017 		if (err != EEXIST)
3018 			err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
3019 		if (err != EEXIST && bookmark_ok)
3020 			err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
3021 		zfs_close(zhp);
3022 		if (err == EEXIST)
3023 			return (0);
3024 
3025 		/*
3026 		 * Remember the last portion of the dataset so we skip it next
3027 		 * time through (as we've already searched that portion of the
3028 		 * hierarchy).
3029 		 */
3030 		gtnd.skip = strrchr(pname, '/') + 1;
3031 	}
3032 
3033 	return (ENOENT);
3034 }
3035 
3036 static int
3037 guid_to_name(libzfs_handle_t *hdl, const char *parent, uint64_t guid,
3038     boolean_t bookmark_ok, char *name)
3039 {
3040 	return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
3041 	    -1, name));
3042 }
3043 
3044 /*
3045  * Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
3046  * guid1 is after guid2.
3047  */
3048 static int
3049 created_before(libzfs_handle_t *hdl, avl_tree_t *avl,
3050     uint64_t guid1, uint64_t guid2)
3051 {
3052 	nvlist_t *nvfs;
3053 	char *fsname = NULL, *snapname = NULL;
3054 	char buf[ZFS_MAX_DATASET_NAME_LEN];
3055 	int rv;
3056 	zfs_handle_t *guid1hdl, *guid2hdl;
3057 	uint64_t create1, create2;
3058 
3059 	if (guid2 == 0)
3060 		return (0);
3061 	if (guid1 == 0)
3062 		return (1);
3063 
3064 	nvfs = fsavl_find(avl, guid1, &snapname);
3065 	fsname = fnvlist_lookup_string(nvfs, "name");
3066 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3067 	guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3068 	if (guid1hdl == NULL)
3069 		return (-1);
3070 
3071 	nvfs = fsavl_find(avl, guid2, &snapname);
3072 	fsname = fnvlist_lookup_string(nvfs, "name");
3073 	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
3074 	guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
3075 	if (guid2hdl == NULL) {
3076 		zfs_close(guid1hdl);
3077 		return (-1);
3078 	}
3079 
3080 	create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
3081 	create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);
3082 
3083 	if (create1 < create2)
3084 		rv = -1;
3085 	else if (create1 > create2)
3086 		rv = +1;
3087 	else
3088 		rv = 0;
3089 
3090 	zfs_close(guid1hdl);
3091 	zfs_close(guid2hdl);
3092 
3093 	return (rv);
3094 }
3095 
3096 /*
3097  * This function reestablishes the hierarchy of encryption roots after a
3098  * recursive incremental receive has completed. This must be done after the
3099  * second call to recv_incremental_replication() has renamed and promoted all
3100  * sent datasets to their final locations in the dataset hierarchy.
3101  */
3102 static int
3103 recv_fix_encryption_hierarchy(libzfs_handle_t *hdl, const char *top_zfs,
3104     nvlist_t *stream_nv, avl_tree_t *stream_avl)
3105 {
3106 	int err;
3107 	nvpair_t *fselem = NULL;
3108 	nvlist_t *stream_fss;
3109 
3110 	stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3111 
3112 	while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
3113 		zfs_handle_t *zhp = NULL;
3114 		uint64_t crypt;
3115 		nvlist_t *snaps, *props, *stream_nvfs = NULL;
3116 		nvpair_t *snapel = NULL;
3117 		boolean_t is_encroot, is_clone, stream_encroot;
3118 		char *cp;
3119 		char *stream_keylocation = NULL;
3120 		char keylocation[MAXNAMELEN];
3121 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
3122 
3123 		keylocation[0] = '\0';
3124 		stream_nvfs = fnvpair_value_nvlist(fselem);
3125 		snaps = fnvlist_lookup_nvlist(stream_nvfs, "snaps");
3126 		props = fnvlist_lookup_nvlist(stream_nvfs, "props");
3127 		stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");
3128 
3129 		/* find a snapshot from the stream that exists locally */
3130 		err = ENOENT;
3131 		while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
3132 			uint64_t guid;
3133 
3134 			guid = fnvpair_value_uint64(snapel);
3135 			err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
3136 			    fsname);
3137 			if (err == 0)
3138 				break;
3139 		}
3140 
3141 		if (err != 0)
3142 			continue;
3143 
3144 		cp = strchr(fsname, '@');
3145 		if (cp != NULL)
3146 			*cp = '\0';
3147 
3148 		zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
3149 		if (zhp == NULL) {
3150 			err = ENOENT;
3151 			goto error;
3152 		}
3153 
3154 		crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
3155 		is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
3156 		(void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
3157 
3158 		/* we don't need to do anything for unencrypted datasets */
3159 		if (crypt == ZIO_CRYPT_OFF) {
3160 			zfs_close(zhp);
3161 			continue;
3162 		}
3163 
3164 		/*
3165 		 * If the dataset is flagged as an encryption root, was not
3166 		 * received as a clone and is not currently an encryption root,
3167 		 * force it to become one. Fixup the keylocation if necessary.
3168 		 */
3169 		if (stream_encroot) {
3170 			if (!is_clone && !is_encroot) {
3171 				err = lzc_change_key(fsname,
3172 				    DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
3173 				if (err != 0) {
3174 					zfs_close(zhp);
3175 					goto error;
3176 				}
3177 			}
3178 
3179 			stream_keylocation = fnvlist_lookup_string(props,
3180 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
3181 
3182 			/*
3183 			 * Refresh the properties in case the call to
3184 			 * lzc_change_key() changed the value.
3185 			 */
3186 			zfs_refresh_properties(zhp);
3187 			err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
3188 			    keylocation, sizeof (keylocation), NULL, NULL,
3189 			    0, B_TRUE);
3190 			if (err != 0) {
3191 				zfs_close(zhp);
3192 				goto error;
3193 			}
3194 
3195 			if (strcmp(keylocation, stream_keylocation) != 0) {
3196 				err = zfs_prop_set(zhp,
3197 				    zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
3198 				    stream_keylocation);
3199 				if (err != 0) {
3200 					zfs_close(zhp);
3201 					goto error;
3202 				}
3203 			}
3204 		}
3205 
3206 		/*
3207 		 * If the dataset is not flagged as an encryption root and is
3208 		 * currently an encryption root, force it to inherit from its
3209 		 * parent. The root of a raw send should never be
3210 		 * force-inherited.
3211 		 */
3212 		if (!stream_encroot && is_encroot &&
3213 		    strcmp(top_zfs, fsname) != 0) {
3214 			err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
3215 			    NULL, NULL, 0);
3216 			if (err != 0) {
3217 				zfs_close(zhp);
3218 				goto error;
3219 			}
3220 		}
3221 
3222 		zfs_close(zhp);
3223 	}
3224 
3225 	return (0);
3226 
3227 error:
3228 	return (err);
3229 }
3230 
3231 static int
3232 recv_incremental_replication(libzfs_handle_t *hdl, const char *tofs,
3233     recvflags_t *flags, nvlist_t *stream_nv, avl_tree_t *stream_avl,
3234     nvlist_t *renamed)
3235 {
3236 	nvlist_t *local_nv, *deleted = NULL;
3237 	avl_tree_t *local_avl;
3238 	nvpair_t *fselem, *nextfselem;
3239 	char *fromsnap;
3240 	char newname[ZFS_MAX_DATASET_NAME_LEN];
3241 	char guidname[32];
3242 	int error;
3243 	boolean_t needagain, progress, recursive;
3244 	char *s1, *s2;
3245 
3246 	fromsnap = fnvlist_lookup_string(stream_nv, "fromsnap");
3247 
3248 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3249 	    ENOENT);
3250 
3251 	if (flags->dryrun)
3252 		return (0);
3253 
3254 again:
3255 	needagain = progress = B_FALSE;
3256 
3257 	deleted = fnvlist_alloc();
3258 
3259 	if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
3260 	    recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE, B_FALSE,
3261 	    B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
3262 		return (error);
3263 
3264 	/*
3265 	 * Process deletes and renames
3266 	 */
3267 	for (fselem = nvlist_next_nvpair(local_nv, NULL);
3268 	    fselem; fselem = nextfselem) {
3269 		nvlist_t *nvfs, *snaps;
3270 		nvlist_t *stream_nvfs = NULL;
3271 		nvpair_t *snapelem, *nextsnapelem;
3272 		uint64_t fromguid = 0;
3273 		uint64_t originguid = 0;
3274 		uint64_t stream_originguid = 0;
3275 		uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
3276 		char *fsname, *stream_fsname;
3277 
3278 		nextfselem = nvlist_next_nvpair(local_nv, fselem);
3279 
3280 		nvfs = fnvpair_value_nvlist(fselem);
3281 		snaps = fnvlist_lookup_nvlist(nvfs, "snaps");
3282 		fsname = fnvlist_lookup_string(nvfs, "name");
3283 		parent_fromsnap_guid = fnvlist_lookup_uint64(nvfs,
3284 		    "parentfromsnap");
3285 		(void) nvlist_lookup_uint64(nvfs, "origin", &originguid);
3286 
3287 		/*
3288 		 * First find the stream's fs, so we can check for
3289 		 * a different origin (due to "zfs promote")
3290 		 */
3291 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3292 		    snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
3293 			uint64_t thisguid;
3294 
3295 			thisguid = fnvpair_value_uint64(snapelem);
3296 			stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);
3297 
3298 			if (stream_nvfs != NULL)
3299 				break;
3300 		}
3301 
3302 		/* check for promote */
3303 		(void) nvlist_lookup_uint64(stream_nvfs, "origin",
3304 		    &stream_originguid);
3305 		if (stream_nvfs && originguid != stream_originguid) {
3306 			switch (created_before(hdl, local_avl,
3307 			    stream_originguid, originguid)) {
3308 			case 1: {
3309 				/* promote it! */
3310 				nvlist_t *origin_nvfs;
3311 				char *origin_fsname;
3312 
3313 				origin_nvfs = fsavl_find(local_avl, originguid,
3314 				    NULL);
3315 				origin_fsname = fnvlist_lookup_string(
3316 				    origin_nvfs, "name");
3317 				error = recv_promote(hdl, fsname, origin_fsname,
3318 				    flags);
3319 				if (error == 0)
3320 					progress = B_TRUE;
3321 				break;
3322 			}
3323 			default:
3324 				break;
3325 			case -1:
3326 				fsavl_destroy(local_avl);
3327 				fnvlist_free(local_nv);
3328 				return (-1);
3329 			}
3330 			/*
3331 			 * We had/have the wrong origin, therefore our
3332 			 * list of snapshots is wrong.  Need to handle
3333 			 * them on the next pass.
3334 			 */
3335 			needagain = B_TRUE;
3336 			continue;
3337 		}
3338 
3339 		for (snapelem = nvlist_next_nvpair(snaps, NULL);
3340 		    snapelem; snapelem = nextsnapelem) {
3341 			uint64_t thisguid;
3342 			char *stream_snapname;
3343 			nvlist_t *found, *props;
3344 
3345 			nextsnapelem = nvlist_next_nvpair(snaps, snapelem);
3346 
3347 			thisguid = fnvpair_value_uint64(snapelem);
3348 			found = fsavl_find(stream_avl, thisguid,
3349 			    &stream_snapname);
3350 
3351 			/* check for delete */
3352 			if (found == NULL) {
3353 				char name[ZFS_MAX_DATASET_NAME_LEN];
3354 
3355 				if (!flags->force)
3356 					continue;
3357 
3358 				(void) snprintf(name, sizeof (name), "%s@%s",
3359 				    fsname, nvpair_name(snapelem));
3360 
3361 				error = recv_destroy(hdl, name,
3362 				    strlen(fsname)+1, newname, flags);
3363 				if (error)
3364 					needagain = B_TRUE;
3365 				else
3366 					progress = B_TRUE;
3367 				sprintf(guidname, "%llu",
3368 				    (u_longlong_t)thisguid);
3369 				nvlist_add_boolean(deleted, guidname);
3370 				continue;
3371 			}
3372 
3373 			stream_nvfs = found;
3374 
3375 			if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
3376 			    &props) && 0 == nvlist_lookup_nvlist(props,
3377 			    stream_snapname, &props)) {
3378 				zfs_cmd_t zc = {"\0"};
3379 
3380 				zc.zc_cookie = B_TRUE; /* received */
3381 				(void) snprintf(zc.zc_name, sizeof (zc.zc_name),
3382 				    "%s@%s", fsname, nvpair_name(snapelem));
3383 				if (zcmd_write_src_nvlist(hdl, &zc,
3384 				    props) == 0) {
3385 					(void) zfs_ioctl(hdl,
3386 					    ZFS_IOC_SET_PROP, &zc);
3387 					zcmd_free_nvlists(&zc);
3388 				}
3389 			}
3390 
3391 			/* check for different snapname */
3392 			if (strcmp(nvpair_name(snapelem),
3393 			    stream_snapname) != 0) {
3394 				char name[ZFS_MAX_DATASET_NAME_LEN];
3395 				char tryname[ZFS_MAX_DATASET_NAME_LEN];
3396 
3397 				(void) snprintf(name, sizeof (name), "%s@%s",
3398 				    fsname, nvpair_name(snapelem));
3399 				(void) snprintf(tryname, sizeof (name), "%s@%s",
3400 				    fsname, stream_snapname);
3401 
3402 				error = recv_rename(hdl, name, tryname,
3403 				    strlen(fsname)+1, newname, flags);
3404 				if (error)
3405 					needagain = B_TRUE;
3406 				else
3407 					progress = B_TRUE;
3408 			}
3409 
3410 			if (strcmp(stream_snapname, fromsnap) == 0)
3411 				fromguid = thisguid;
3412 		}
3413 
3414 		/* check for delete */
3415 		if (stream_nvfs == NULL) {
3416 			if (!flags->force)
3417 				continue;
3418 
3419 			error = recv_destroy(hdl, fsname, strlen(tofs)+1,
3420 			    newname, flags);
3421 			if (error)
3422 				needagain = B_TRUE;
3423 			else
3424 				progress = B_TRUE;
3425 			sprintf(guidname, "%llu",
3426 			    (u_longlong_t)parent_fromsnap_guid);
3427 			nvlist_add_boolean(deleted, guidname);
3428 			continue;
3429 		}
3430 
3431 		if (fromguid == 0) {
3432 			if (flags->verbose) {
3433 				(void) printf("local fs %s does not have "
3434 				    "fromsnap (%s in stream); must have "
3435 				    "been deleted locally; ignoring\n",
3436 				    fsname, fromsnap);
3437 			}
3438 			continue;
3439 		}
3440 
3441 		stream_fsname = fnvlist_lookup_string(stream_nvfs, "name");
3442 		stream_parent_fromsnap_guid = fnvlist_lookup_uint64(
3443 		    stream_nvfs, "parentfromsnap");
3444 
3445 		s1 = strrchr(fsname, '/');
3446 		s2 = strrchr(stream_fsname, '/');
3447 
3448 		/*
3449 		 * Check if we're going to rename based on parent guid change
3450 		 * and the current parent guid was also deleted. If it was then
3451 		 * rename will fail and is likely unneeded, so avoid this and
3452 		 * force an early retry to determine the new
3453 		 * parent_fromsnap_guid.
3454 		 */
3455 		if (stream_parent_fromsnap_guid != 0 &&
3456 		    parent_fromsnap_guid != 0 &&
3457 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) {
3458 			sprintf(guidname, "%llu",
3459 			    (u_longlong_t)parent_fromsnap_guid);
3460 			if (nvlist_exists(deleted, guidname)) {
3461 				progress = B_TRUE;
3462 				needagain = B_TRUE;
3463 				goto doagain;
3464 			}
3465 		}
3466 
3467 		/*
3468 		 * Check for rename. If the exact receive path is specified, it
3469 		 * does not count as a rename, but we still need to check the
3470 		 * datasets beneath it.
3471 		 */
3472 		if ((stream_parent_fromsnap_guid != 0 &&
3473 		    parent_fromsnap_guid != 0 &&
3474 		    stream_parent_fromsnap_guid != parent_fromsnap_guid) ||
3475 		    ((flags->isprefix || strcmp(tofs, fsname) != 0) &&
3476 		    (s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
3477 			nvlist_t *parent;
3478 			char tryname[ZFS_MAX_DATASET_NAME_LEN];
3479 
3480 			parent = fsavl_find(local_avl,
3481 			    stream_parent_fromsnap_guid, NULL);
3482 			/*
3483 			 * NB: parent might not be found if we used the
3484 			 * tosnap for stream_parent_fromsnap_guid,
3485 			 * because the parent is a newly-created fs;
3486 			 * we'll be able to rename it after we recv the
3487 			 * new fs.
3488 			 */
3489 			if (parent != NULL) {
3490 				char *pname;
3491 
3492 				pname = fnvlist_lookup_string(parent, "name");
3493 				(void) snprintf(tryname, sizeof (tryname),
3494 				    "%s%s", pname, strrchr(stream_fsname, '/'));
3495 			} else {
3496 				tryname[0] = '\0';
3497 				if (flags->verbose) {
3498 					(void) printf("local fs %s new parent "
3499 					    "not found\n", fsname);
3500 				}
3501 			}
3502 
3503 			newname[0] = '\0';
3504 
3505 			error = recv_rename(hdl, fsname, tryname,
3506 			    strlen(tofs)+1, newname, flags);
3507 
3508 			if (renamed != NULL && newname[0] != '\0') {
3509 				fnvlist_add_boolean(renamed, newname);
3510 			}
3511 
3512 			if (error)
3513 				needagain = B_TRUE;
3514 			else
3515 				progress = B_TRUE;
3516 		}
3517 	}
3518 
3519 doagain:
3520 	fsavl_destroy(local_avl);
3521 	fnvlist_free(local_nv);
3522 	fnvlist_free(deleted);
3523 
3524 	if (needagain && progress) {
3525 		/* do another pass to fix up temporary names */
3526 		if (flags->verbose)
3527 			(void) printf("another pass:\n");
3528 		goto again;
3529 	}
3530 
3531 	return (needagain || error != 0);
3532 }
3533 
3534 static int
3535 zfs_receive_package(libzfs_handle_t *hdl, int fd, const char *destname,
3536     recvflags_t *flags, dmu_replay_record_t *drr, zio_cksum_t *zc,
3537     char **top_zfs, nvlist_t *cmdprops)
3538 {
3539 	nvlist_t *stream_nv = NULL;
3540 	avl_tree_t *stream_avl = NULL;
3541 	char *fromsnap = NULL;
3542 	char *sendsnap = NULL;
3543 	char *cp;
3544 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
3545 	char sendfs[ZFS_MAX_DATASET_NAME_LEN];
3546 	char errbuf[1024];
3547 	dmu_replay_record_t drre;
3548 	int error;
3549 	boolean_t anyerr = B_FALSE;
3550 	boolean_t softerr = B_FALSE;
3551 	boolean_t recursive, raw;
3552 
3553 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3554 	    "cannot receive"));
3555 
3556 	assert(drr->drr_type == DRR_BEGIN);
3557 	assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
3558 	assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
3559 	    DMU_COMPOUNDSTREAM);
3560 
3561 	/*
3562 	 * Read in the nvlist from the stream.
3563 	 */
3564 	if (drr->drr_payloadlen != 0) {
3565 		error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
3566 		    &stream_nv, flags->byteswap, zc);
3567 		if (error) {
3568 			error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3569 			goto out;
3570 		}
3571 	}
3572 
3573 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
3574 	    ENOENT);
3575 	raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);
3576 
3577 	if (recursive && strchr(destname, '@')) {
3578 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3579 		    "cannot specify snapshot name for multi-snapshot stream"));
3580 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3581 		goto out;
3582 	}
3583 
3584 	/*
3585 	 * Read in the end record and verify checksum.
3586 	 */
3587 	if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
3588 	    flags->byteswap, NULL)))
3589 		goto out;
3590 	if (flags->byteswap) {
3591 		drre.drr_type = BSWAP_32(drre.drr_type);
3592 		drre.drr_u.drr_end.drr_checksum.zc_word[0] =
3593 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
3594 		drre.drr_u.drr_end.drr_checksum.zc_word[1] =
3595 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
3596 		drre.drr_u.drr_end.drr_checksum.zc_word[2] =
3597 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
3598 		drre.drr_u.drr_end.drr_checksum.zc_word[3] =
3599 		    BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
3600 	}
3601 	if (drre.drr_type != DRR_END) {
3602 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3603 		goto out;
3604 	}
3605 	if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
3606 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3607 		    "incorrect header checksum"));
3608 		error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
3609 		goto out;
3610 	}
3611 
3612 	(void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);
3613 
3614 	if (drr->drr_payloadlen != 0) {
3615 		nvlist_t *stream_fss;
3616 
3617 		stream_fss = fnvlist_lookup_nvlist(stream_nv, "fss");
3618 		if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
3619 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3620 			    "couldn't allocate avl tree"));
3621 			error = zfs_error(hdl, EZFS_NOMEM, errbuf);
3622 			goto out;
3623 		}
3624 
3625 		if (fromsnap != NULL && recursive) {
3626 			nvlist_t *renamed = NULL;
3627 			nvpair_t *pair = NULL;
3628 
3629 			(void) strlcpy(tofs, destname, sizeof (tofs));
3630 			if (flags->isprefix) {
3631 				struct drr_begin *drrb = &drr->drr_u.drr_begin;
3632 				int i;
3633 
3634 				if (flags->istail) {
3635 					cp = strrchr(drrb->drr_toname, '/');
3636 					if (cp == NULL) {
3637 						(void) strlcat(tofs, "/",
3638 						    sizeof (tofs));
3639 						i = 0;
3640 					} else {
3641 						i = (cp - drrb->drr_toname);
3642 					}
3643 				} else {
3644 					i = strcspn(drrb->drr_toname, "/@");
3645 				}
3646 				/* zfs_receive_one() will create_parents() */
3647 				(void) strlcat(tofs, &drrb->drr_toname[i],
3648 				    sizeof (tofs));
3649 				*strchr(tofs, '@') = '\0';
3650 			}
3651 
3652 			if (!flags->dryrun && !flags->nomount) {
3653 				renamed = fnvlist_alloc();
3654 			}
3655 
3656 			softerr = recv_incremental_replication(hdl, tofs, flags,
3657 			    stream_nv, stream_avl, renamed);
3658 
3659 			/* Unmount renamed filesystems before receiving. */
3660 			while ((pair = nvlist_next_nvpair(renamed,
3661 			    pair)) != NULL) {
3662 				zfs_handle_t *zhp;
3663 				prop_changelist_t *clp = NULL;
3664 
3665 				zhp = zfs_open(hdl, nvpair_name(pair),
3666 				    ZFS_TYPE_FILESYSTEM);
3667 				if (zhp != NULL) {
3668 					clp = changelist_gather(zhp,
3669 					    ZFS_PROP_MOUNTPOINT, 0,
3670 					    flags->forceunmount ? MS_FORCE : 0);
3671 					zfs_close(zhp);
3672 					if (clp != NULL) {
3673 						softerr |=
3674 						    changelist_prefix(clp);
3675 						changelist_free(clp);
3676 					}
3677 				}
3678 			}
3679 
3680 			fnvlist_free(renamed);
3681 		}
3682 	}
3683 
3684 	/*
3685 	 * Get the fs specified by the first path in the stream (the top level
3686 	 * specified by 'zfs send') and pass it to each invocation of
3687 	 * zfs_receive_one().
3688 	 */
3689 	(void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
3690 	    sizeof (sendfs));
3691 	if ((cp = strchr(sendfs, '@')) != NULL) {
3692 		*cp = '\0';
3693 		/*
3694 		 * Find the "sendsnap", the final snapshot in a replication
3695 		 * stream.  zfs_receive_one() handles certain errors
3696 		 * differently, depending on if the contained stream is the
3697 		 * last one or not.
3698 		 */
3699 		sendsnap = (cp + 1);
3700 	}
3701 
3702 	/* Finally, receive each contained stream */
3703 	do {
3704 		/*
3705 		 * we should figure out if it has a recoverable
3706 		 * error, in which case do a recv_skip() and drive on.
3707 		 * Note, if we fail due to already having this guid,
3708 		 * zfs_receive_one() will take care of it (ie,
3709 		 * recv_skip() and return 0).
3710 		 */
3711 		error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
3712 		    sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
3713 		if (error == ENODATA) {
3714 			error = 0;
3715 			break;
3716 		}
3717 		anyerr |= error;
3718 	} while (error == 0);
3719 
3720 	if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
3721 		/*
3722 		 * Now that we have the fs's they sent us, try the
3723 		 * renames again.
3724 		 */
3725 		softerr = recv_incremental_replication(hdl, tofs, flags,
3726 		    stream_nv, stream_avl, NULL);
3727 	}
3728 
3729 	if (raw && softerr == 0 && *top_zfs != NULL) {
3730 		softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
3731 		    stream_nv, stream_avl);
3732 	}
3733 
3734 out:
3735 	fsavl_destroy(stream_avl);
3736 	fnvlist_free(stream_nv);
3737 	if (softerr)
3738 		error = -2;
3739 	if (anyerr)
3740 		error = -1;
3741 	return (error);
3742 }
3743 
3744 static void
3745 trunc_prop_errs(int truncated)
3746 {
3747 	ASSERT(truncated != 0);
3748 
3749 	if (truncated == 1)
3750 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3751 		    "1 more property could not be set\n"));
3752 	else
3753 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3754 		    "%d more properties could not be set\n"), truncated);
3755 }
3756 
3757 static int
3758 recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
3759 {
3760 	dmu_replay_record_t *drr;
3761 	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
3762 	uint64_t payload_size;
3763 	char errbuf[1024];
3764 
3765 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
3766 	    "cannot receive"));
3767 
3768 	/* XXX would be great to use lseek if possible... */
3769 	drr = buf;
3770 
3771 	while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
3772 	    byteswap, NULL) == 0) {
3773 		if (byteswap)
3774 			drr->drr_type = BSWAP_32(drr->drr_type);
3775 
3776 		switch (drr->drr_type) {
3777 		case DRR_BEGIN:
3778 			if (drr->drr_payloadlen != 0) {
3779 				(void) recv_read(hdl, fd, buf,
3780 				    drr->drr_payloadlen, B_FALSE, NULL);
3781 			}
3782 			break;
3783 
3784 		case DRR_END:
3785 			free(buf);
3786 			return (0);
3787 
3788 		case DRR_OBJECT:
3789 			if (byteswap) {
3790 				drr->drr_u.drr_object.drr_bonuslen =
3791 				    BSWAP_32(drr->drr_u.drr_object.
3792 				    drr_bonuslen);
3793 				drr->drr_u.drr_object.drr_raw_bonuslen =
3794 				    BSWAP_32(drr->drr_u.drr_object.
3795 				    drr_raw_bonuslen);
3796 			}
3797 
3798 			payload_size =
3799 			    DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
3800 			(void) recv_read(hdl, fd, buf, payload_size,
3801 			    B_FALSE, NULL);
3802 			break;
3803 
3804 		case DRR_WRITE:
3805 			if (byteswap) {
3806 				drr->drr_u.drr_write.drr_logical_size =
3807 				    BSWAP_64(
3808 				    drr->drr_u.drr_write.drr_logical_size);
3809 				drr->drr_u.drr_write.drr_compressed_size =
3810 				    BSWAP_64(
3811 				    drr->drr_u.drr_write.drr_compressed_size);
3812 			}
3813 			payload_size =
3814 			    DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
3815 			assert(payload_size <= SPA_MAXBLOCKSIZE);
3816 			(void) recv_read(hdl, fd, buf,
3817 			    payload_size, B_FALSE, NULL);
3818 			break;
3819 		case DRR_SPILL:
3820 			if (byteswap) {
3821 				drr->drr_u.drr_spill.drr_length =
3822 				    BSWAP_64(drr->drr_u.drr_spill.drr_length);
3823 				drr->drr_u.drr_spill.drr_compressed_size =
3824 				    BSWAP_64(drr->drr_u.drr_spill.
3825 				    drr_compressed_size);
3826 			}
3827 
3828 			payload_size =
3829 			    DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
3830 			(void) recv_read(hdl, fd, buf, payload_size,
3831 			    B_FALSE, NULL);
3832 			break;
3833 		case DRR_WRITE_EMBEDDED:
3834 			if (byteswap) {
3835 				drr->drr_u.drr_write_embedded.drr_psize =
3836 				    BSWAP_32(drr->drr_u.drr_write_embedded.
3837 				    drr_psize);
3838 			}
3839 			(void) recv_read(hdl, fd, buf,
3840 			    P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
3841 			    8), B_FALSE, NULL);
3842 			break;
3843 		case DRR_OBJECT_RANGE:
3844 		case DRR_WRITE_BYREF:
3845 		case DRR_FREEOBJECTS:
3846 		case DRR_FREE:
3847 			break;
3848 
3849 		default:
3850 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3851 			    "invalid record type"));
3852 			free(buf);
3853 			return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
3854 		}
3855 	}
3856 
3857 	free(buf);
3858 	return (-1);
3859 }
3860 
3861 static void
3862 recv_ecksum_set_aux(libzfs_handle_t *hdl, const char *target_snap,
3863     boolean_t resumable, boolean_t checksum)
3864 {
3865 	char target_fs[ZFS_MAX_DATASET_NAME_LEN];
3866 
3867 	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
3868 	    "checksum mismatch" : "incomplete stream")));
3869 
3870 	if (!resumable)
3871 		return;
3872 	(void) strlcpy(target_fs, target_snap, sizeof (target_fs));
3873 	*strchr(target_fs, '@') = '\0';
3874 	zfs_handle_t *zhp = zfs_open(hdl, target_fs,
3875 	    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
3876 	if (zhp == NULL)
3877 		return;
3878 
3879 	char token_buf[ZFS_MAXPROPLEN];
3880 	int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
3881 	    token_buf, sizeof (token_buf),
3882 	    NULL, NULL, 0, B_TRUE);
3883 	if (error == 0) {
3884 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3885 		    "checksum mismatch or incomplete stream.\n"
3886 		    "Partially received snapshot is saved.\n"
3887 		    "A resuming stream can be generated on the sending "
3888 		    "system by running:\n"
3889 		    "    zfs send -t %s"),
3890 		    token_buf);
3891 	}
3892 	zfs_close(zhp);
3893 }
3894 
3895 /*
3896  * Prepare a new nvlist of properties that are to override (-o) or be excluded
3897  * (-x) from the received dataset
3898  * recvprops: received properties from the send stream
3899  * cmdprops: raw input properties from command line
3900  * origprops: properties, both locally-set and received, currently set on the
3901  *            target dataset if it exists, NULL otherwise.
3902  * oxprops: valid output override (-o) and excluded (-x) properties
3903  */
3904 static int
3905 zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
3906     char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
3907     boolean_t raw, boolean_t toplevel, nvlist_t *recvprops, nvlist_t *cmdprops,
3908     nvlist_t *origprops, nvlist_t **oxprops, uint8_t **wkeydata_out,
3909     uint_t *wkeylen_out, const char *errbuf)
3910 {
3911 	nvpair_t *nvp;
3912 	nvlist_t *oprops, *voprops;
3913 	zfs_handle_t *zhp = NULL;
3914 	zpool_handle_t *zpool_hdl = NULL;
3915 	char *cp;
3916 	int ret = 0;
3917 	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
3918 
3919 	if (nvlist_empty(cmdprops))
3920 		return (0); /* No properties to override or exclude */
3921 
3922 	*oxprops = fnvlist_alloc();
3923 	oprops = fnvlist_alloc();
3924 
3925 	strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);
3926 
3927 	/*
3928 	 * Get our dataset handle. The target dataset may not exist yet.
3929 	 */
3930 	if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
3931 		zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
3932 		if (zhp == NULL) {
3933 			ret = -1;
3934 			goto error;
3935 		}
3936 	}
3937 
3938 	/* open the zpool handle */
3939 	cp = strchr(namebuf, '/');
3940 	if (cp != NULL)
3941 		*cp = '\0';
3942 	zpool_hdl = zpool_open(hdl, namebuf);
3943 	if (zpool_hdl == NULL) {
3944 		ret = -1;
3945 		goto error;
3946 	}
3947 
3948 	/* restore namebuf to match fsname for later use */
3949 	if (cp != NULL)
3950 		*cp = '/';
3951 
3952 	/*
3953 	 * first iteration: process excluded (-x) properties now and gather
3954 	 * added (-o) properties to be later processed by zfs_valid_proplist()
3955 	 */
3956 	nvp = NULL;
3957 	while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
3958 		const char *name = nvpair_name(nvp);
3959 		zfs_prop_t prop = zfs_name_to_prop(name);
3960 
3961 		/*
3962 		 * It turns out, if we don't normalize "aliased" names
3963 		 * e.g. compress= against the "real" names (e.g. compression)
3964 		 * here, then setting/excluding them does not work as
3965 		 * intended.
3966 		 *
3967 		 * But since user-defined properties wouldn't have a valid
3968 		 * mapping here, we do this conditional dance.
3969 		 */
3970 		const char *newname = name;
3971 		if (prop >= ZFS_PROP_TYPE)
3972 			newname = zfs_prop_to_name(prop);
3973 
3974 		/* "origin" is processed separately, don't handle it here */
3975 		if (prop == ZFS_PROP_ORIGIN)
3976 			continue;
3977 
3978 		/* raw streams can't override encryption properties */
3979 		if ((zfs_prop_encryption_key_param(prop) ||
3980 		    prop == ZFS_PROP_ENCRYPTION) && raw) {
3981 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3982 			    "encryption property '%s' cannot "
3983 			    "be set or excluded for raw streams."), name);
3984 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3985 			goto error;
3986 		}
3987 
3988 		/* incremental streams can only exclude encryption properties */
3989 		if ((zfs_prop_encryption_key_param(prop) ||
3990 		    prop == ZFS_PROP_ENCRYPTION) && !newfs &&
3991 		    nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
3992 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
3993 			    "encryption property '%s' cannot "
3994 			    "be set for incremental streams."), name);
3995 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
3996 			goto error;
3997 		}
3998 
3999 		switch (nvpair_type(nvp)) {
4000 		case DATA_TYPE_BOOLEAN: /* -x property */
4001 			/*
4002 			 * DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
4003 			 * a property: this is done by forcing an explicit
4004 			 * inherit on the destination so the effective value is
4005 			 * not the one we received from the send stream.
4006 			 */
4007 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4008 			    !zfs_prop_user(name)) {
4009 				(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
4010 				    "Warning: %s: property '%s' does not "
4011 				    "apply to datasets of this type\n"),
4012 				    fsname, name);
4013 				continue;
4014 			}
4015 			/*
4016 			 * We do this only if the property is not already
4017 			 * locally-set, in which case its value will take
4018 			 * priority over the received anyway.
4019 			 */
4020 			if (nvlist_exists(origprops, newname)) {
4021 				nvlist_t *attrs;
4022 				char *source = NULL;
4023 
4024 				attrs = fnvlist_lookup_nvlist(origprops,
4025 				    newname);
4026 				if (nvlist_lookup_string(attrs,
4027 				    ZPROP_SOURCE, &source) == 0 &&
4028 				    strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
4029 					continue;
4030 			}
4031 			/*
4032 			 * We can't force an explicit inherit on non-inheritable
4033 			 * properties: if we're asked to exclude this kind of
4034 			 * values we remove them from "recvprops" input nvlist.
4035 			 */
4036 			if (!zfs_prop_inheritable(prop) &&
4037 			    !zfs_prop_user(name) && /* can be inherited too */
4038 			    nvlist_exists(recvprops, newname))
4039 				fnvlist_remove(recvprops, newname);
4040 			else
4041 				fnvlist_add_boolean(*oxprops, newname);
4042 			break;
4043 		case DATA_TYPE_STRING: /* -o property=value */
4044 			/*
4045 			 * we're trying to override a property that does not
4046 			 * make sense for this type of dataset, but we don't
4047 			 * want to fail if the receive is recursive: this comes
4048 			 * in handy when the send stream contains, for
4049 			 * instance, a child ZVOL and we're trying to receive
4050 			 * it with "-o atime=on"
4051 			 */
4052 			if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
4053 			    !zfs_prop_user(name)) {
4054 				if (recursive)
4055 					continue;
4056 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4057 				    "property '%s' does not apply to datasets "
4058 				    "of this type"), name);
4059 				ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4060 				goto error;
4061 			}
4062 			fnvlist_add_string(oprops, newname,
4063 			    fnvpair_value_string(nvp));
4064 			break;
4065 		default:
4066 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4067 			    "property '%s' must be a string or boolean"), name);
4068 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4069 			goto error;
4070 		}
4071 	}
4072 
4073 	if (toplevel) {
4074 		/* convert override strings properties to native */
4075 		if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
4076 		    oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
4077 			ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
4078 			goto error;
4079 		}
4080 
4081 		/*
4082 		 * zfs_crypto_create() requires the parent name. Get it
4083 		 * by truncating the fsname copy stored in namebuf.
4084 		 */
4085 		cp = strrchr(namebuf, '/');
4086 		if (cp != NULL)
4087 			*cp = '\0';
4088 
4089 		if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
4090 		    B_FALSE, wkeydata_out, wkeylen_out) != 0) {
4091 			fnvlist_free(voprops);
4092 			ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4093 			goto error;
4094 		}
4095 
4096 		/* second pass: process "-o" properties */
4097 		fnvlist_merge(*oxprops, voprops);
4098 		fnvlist_free(voprops);
4099 	} else {
4100 		/* override props on child dataset are inherited */
4101 		nvp = NULL;
4102 		while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
4103 			const char *name = nvpair_name(nvp);
4104 			fnvlist_add_boolean(*oxprops, name);
4105 		}
4106 	}
4107 
4108 error:
4109 	if (zhp != NULL)
4110 		zfs_close(zhp);
4111 	if (zpool_hdl != NULL)
4112 		zpool_close(zpool_hdl);
4113 	fnvlist_free(oprops);
4114 	return (ret);
4115 }
4116 
4117 /*
4118  * Restores a backup of tosnap from the file descriptor specified by infd.
4119  */
4120 static int
4121 zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
4122     const char *originsnap, recvflags_t *flags, dmu_replay_record_t *drr,
4123     dmu_replay_record_t *drr_noswap, const char *sendfs, nvlist_t *stream_nv,
4124     avl_tree_t *stream_avl, char **top_zfs,
4125     const char *finalsnap, nvlist_t *cmdprops)
4126 {
4127 	time_t begin_time;
4128 	int ioctl_err, ioctl_errno, err;
4129 	char *cp;
4130 	struct drr_begin *drrb = &drr->drr_u.drr_begin;
4131 	char errbuf[1024];
4132 	const char *chopprefix;
4133 	boolean_t newfs = B_FALSE;
4134 	boolean_t stream_wantsnewfs, stream_resumingnewfs;
4135 	boolean_t newprops = B_FALSE;
4136 	uint64_t read_bytes = 0;
4137 	uint64_t errflags = 0;
4138 	uint64_t parent_snapguid = 0;
4139 	prop_changelist_t *clp = NULL;
4140 	nvlist_t *snapprops_nvlist = NULL;
4141 	nvlist_t *snapholds_nvlist = NULL;
4142 	zprop_errflags_t prop_errflags;
4143 	nvlist_t *prop_errors = NULL;
4144 	boolean_t recursive;
4145 	char *snapname = NULL;
4146 	char destsnap[MAXPATHLEN * 2];
4147 	char origin[MAXNAMELEN];
4148 	char name[MAXPATHLEN];
4149 	char tmp_keylocation[MAXNAMELEN];
4150 	nvlist_t *rcvprops = NULL; /* props received from the send stream */
4151 	nvlist_t *oxprops = NULL; /* override (-o) and exclude (-x) props */
4152 	nvlist_t *origprops = NULL; /* original props (if destination exists) */
4153 	zfs_type_t type;
4154 	boolean_t toplevel = B_FALSE;
4155 	boolean_t zoned = B_FALSE;
4156 	boolean_t hastoken = B_FALSE;
4157 	boolean_t redacted;
4158 	uint8_t *wkeydata = NULL;
4159 	uint_t wkeylen = 0;
4160 
4161 	begin_time = time(NULL);
4162 	bzero(origin, MAXNAMELEN);
4163 	bzero(tmp_keylocation, MAXNAMELEN);
4164 
4165 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4166 	    "cannot receive"));
4167 
4168 	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
4169 	    ENOENT);
4170 
4171 	/* Did the user request holds be skipped via zfs recv -k? */
4172 	boolean_t holds = flags->holds && !flags->skipholds;
4173 
4174 	if (stream_avl != NULL) {
4175 		char *keylocation = NULL;
4176 		nvlist_t *lookup = NULL;
4177 		nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
4178 		    &snapname);
4179 
4180 		(void) nvlist_lookup_uint64(fs, "parentfromsnap",
4181 		    &parent_snapguid);
4182 		err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
4183 		if (err) {
4184 			rcvprops = fnvlist_alloc();
4185 			newprops = B_TRUE;
4186 		}
4187 
4188 		/*
4189 		 * The keylocation property may only be set on encryption roots,
4190 		 * but this dataset might not become an encryption root until
4191 		 * recv_fix_encryption_hierarchy() is called. That function
4192 		 * will fixup the keylocation anyway, so we temporarily unset
4193 		 * the keylocation for now to avoid any errors from the receive
4194 		 * ioctl.
4195 		 */
4196 		err = nvlist_lookup_string(rcvprops,
4197 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
4198 		if (err == 0) {
4199 			strcpy(tmp_keylocation, keylocation);
4200 			(void) nvlist_remove_all(rcvprops,
4201 			    zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
4202 		}
4203 
4204 		if (flags->canmountoff) {
4205 			fnvlist_add_uint64(rcvprops,
4206 			    zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0);
4207 		} else if (newprops) {	/* nothing in rcvprops, eliminate it */
4208 			fnvlist_free(rcvprops);
4209 			rcvprops = NULL;
4210 			newprops = B_FALSE;
4211 		}
4212 		if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
4213 			snapprops_nvlist = fnvlist_lookup_nvlist(lookup,
4214 			    snapname);
4215 		}
4216 		if (holds) {
4217 			if (0 == nvlist_lookup_nvlist(fs, "snapholds",
4218 			    &lookup)) {
4219 				snapholds_nvlist = fnvlist_lookup_nvlist(
4220 				    lookup, snapname);
4221 			}
4222 		}
4223 	}
4224 
4225 	cp = NULL;
4226 
4227 	/*
4228 	 * Determine how much of the snapshot name stored in the stream
4229 	 * we are going to tack on to the name they specified on the
4230 	 * command line, and how much we are going to chop off.
4231 	 *
4232 	 * If they specified a snapshot, chop the entire name stored in
4233 	 * the stream.
4234 	 */
4235 	if (flags->istail) {
4236 		/*
4237 		 * A filesystem was specified with -e. We want to tack on only
4238 		 * the tail of the sent snapshot path.
4239 		 */
4240 		if (strchr(tosnap, '@')) {
4241 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4242 			    "argument - snapshot not allowed with -e"));
4243 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4244 			goto out;
4245 		}
4246 
4247 		chopprefix = strrchr(sendfs, '/');
4248 
4249 		if (chopprefix == NULL) {
4250 			/*
4251 			 * The tail is the poolname, so we need to
4252 			 * prepend a path separator.
4253 			 */
4254 			int len = strlen(drrb->drr_toname);
4255 			cp = malloc(len + 2);
4256 			cp[0] = '/';
4257 			(void) strcpy(&cp[1], drrb->drr_toname);
4258 			chopprefix = cp;
4259 		} else {
4260 			chopprefix = drrb->drr_toname + (chopprefix - sendfs);
4261 		}
4262 	} else if (flags->isprefix) {
4263 		/*
4264 		 * A filesystem was specified with -d. We want to tack on
4265 		 * everything but the first element of the sent snapshot path
4266 		 * (all but the pool name).
4267 		 */
4268 		if (strchr(tosnap, '@')) {
4269 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
4270 			    "argument - snapshot not allowed with -d"));
4271 			err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4272 			goto out;
4273 		}
4274 
4275 		chopprefix = strchr(drrb->drr_toname, '/');
4276 		if (chopprefix == NULL)
4277 			chopprefix = strchr(drrb->drr_toname, '@');
4278 	} else if (strchr(tosnap, '@') == NULL) {
4279 		/*
4280 		 * If a filesystem was specified without -d or -e, we want to
4281 		 * tack on everything after the fs specified by 'zfs send'.
4282 		 */
4283 		chopprefix = drrb->drr_toname + strlen(sendfs);
4284 	} else {
4285 		/* A snapshot was specified as an exact path (no -d or -e). */
4286 		if (recursive) {
4287 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4288 			    "cannot specify snapshot name for multi-snapshot "
4289 			    "stream"));
4290 			err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4291 			goto out;
4292 		}
4293 		chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
4294 	}
4295 
4296 	ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
4297 	ASSERT(chopprefix > drrb->drr_toname || strchr(sendfs, '/') == NULL);
4298 	ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) ||
4299 	    strchr(sendfs, '/') == NULL);
4300 	ASSERT(chopprefix[0] == '/' || chopprefix[0] == '@' ||
4301 	    chopprefix[0] == '\0');
4302 
4303 	/*
4304 	 * Determine name of destination snapshot.
4305 	 */
4306 	(void) strlcpy(destsnap, tosnap, sizeof (destsnap));
4307 	(void) strlcat(destsnap, chopprefix, sizeof (destsnap));
4308 	free(cp);
4309 	if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
4310 		err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
4311 		goto out;
4312 	}
4313 
4314 	/*
4315 	 * Determine the name of the origin snapshot.
4316 	 */
4317 	if (originsnap) {
4318 		(void) strlcpy(origin, originsnap, sizeof (origin));
4319 		if (flags->verbose)
4320 			(void) printf("using provided clone origin %s\n",
4321 			    origin);
4322 	} else if (drrb->drr_flags & DRR_FLAG_CLONE) {
4323 		if (guid_to_name(hdl, destsnap,
4324 		    drrb->drr_fromguid, B_FALSE, origin) != 0) {
4325 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4326 			    "local origin for clone %s does not exist"),
4327 			    destsnap);
4328 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4329 			goto out;
4330 		}
4331 		if (flags->verbose)
4332 			(void) printf("found clone origin %s\n", origin);
4333 	}
4334 
4335 	if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4336 	    DMU_BACKUP_FEATURE_DEDUP)) {
4337 		(void) fprintf(stderr,
4338 		    gettext("ERROR: \"zfs receive\" no longer supports "
4339 		    "deduplicated send streams.  Use\n"
4340 		    "the \"zstream redup\" command to convert this stream "
4341 		    "to a regular,\n"
4342 		    "non-deduplicated stream.\n"));
4343 		err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
4344 		goto out;
4345 	}
4346 
4347 	boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4348 	    DMU_BACKUP_FEATURE_RESUMING;
4349 	boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4350 	    DMU_BACKUP_FEATURE_RAW;
4351 	boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4352 	    DMU_BACKUP_FEATURE_EMBED_DATA;
4353 	stream_wantsnewfs = (drrb->drr_fromguid == 0 ||
4354 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && !resuming;
4355 	stream_resumingnewfs = (drrb->drr_fromguid == 0 ||
4356 	    (drrb->drr_flags & DRR_FLAG_CLONE) || originsnap) && resuming;
4357 
4358 	if (stream_wantsnewfs) {
4359 		/*
4360 		 * if the parent fs does not exist, look for it based on
4361 		 * the parent snap GUID
4362 		 */
4363 		(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
4364 		    "cannot receive new filesystem stream"));
4365 
4366 		(void) strcpy(name, destsnap);
4367 		cp = strrchr(name, '/');
4368 		if (cp)
4369 			*cp = '\0';
4370 		if (cp &&
4371 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4372 			char suffix[ZFS_MAX_DATASET_NAME_LEN];
4373 			(void) strcpy(suffix, strrchr(destsnap, '/'));
4374 			if (guid_to_name(hdl, name, parent_snapguid,
4375 			    B_FALSE, destsnap) == 0) {
4376 				*strchr(destsnap, '@') = '\0';
4377 				(void) strcat(destsnap, suffix);
4378 			}
4379 		}
4380 	} else {
4381 		/*
4382 		 * If the fs does not exist, look for it based on the
4383 		 * fromsnap GUID.
4384 		 */
4385 		if (resuming) {
4386 			(void) snprintf(errbuf, sizeof (errbuf),
4387 			    dgettext(TEXT_DOMAIN,
4388 			    "cannot receive resume stream"));
4389 		} else {
4390 			(void) snprintf(errbuf, sizeof (errbuf),
4391 			    dgettext(TEXT_DOMAIN,
4392 			    "cannot receive incremental stream"));
4393 		}
4394 
4395 		(void) strcpy(name, destsnap);
4396 		*strchr(name, '@') = '\0';
4397 
4398 		/*
4399 		 * If the exact receive path was specified and this is the
4400 		 * topmost path in the stream, then if the fs does not exist we
4401 		 * should look no further.
4402 		 */
4403 		if ((flags->isprefix || (*(chopprefix = drrb->drr_toname +
4404 		    strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
4405 		    !zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4406 			char snap[ZFS_MAX_DATASET_NAME_LEN];
4407 			(void) strcpy(snap, strchr(destsnap, '@'));
4408 			if (guid_to_name(hdl, name, drrb->drr_fromguid,
4409 			    B_FALSE, destsnap) == 0) {
4410 				*strchr(destsnap, '@') = '\0';
4411 				(void) strcat(destsnap, snap);
4412 			}
4413 		}
4414 	}
4415 
4416 	(void) strcpy(name, destsnap);
4417 	*strchr(name, '@') = '\0';
4418 
4419 	redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
4420 	    DMU_BACKUP_FEATURE_REDACTED;
4421 
4422 	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
4423 		zfs_cmd_t zc = {"\0"};
4424 		zfs_handle_t *zhp;
4425 		boolean_t encrypted;
4426 
4427 		(void) strcpy(zc.zc_name, name);
4428 
4429 		/*
4430 		 * Destination fs exists.  It must be one of these cases:
4431 		 *  - an incremental send stream
4432 		 *  - the stream specifies a new fs (full stream or clone)
4433 		 *    and they want us to blow away the existing fs (and
4434 		 *    have therefore specified -F and removed any snapshots)
4435 		 *  - we are resuming a failed receive.
4436 		 */
4437 		if (stream_wantsnewfs) {
4438 			boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
4439 			if (!flags->force) {
4440 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4441 				    "destination '%s' exists\n"
4442 				    "must specify -F to overwrite it"), name);
4443 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4444 				goto out;
4445 			}
4446 			if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
4447 			    &zc) == 0) {
4448 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4449 				    "destination has snapshots (eg. %s)\n"
4450 				    "must destroy them to overwrite it"),
4451 				    zc.zc_name);
4452 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4453 				goto out;
4454 			}
4455 			if (is_volume && strrchr(name, '/') == NULL) {
4456 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4457 				    "destination %s is the root dataset\n"
4458 				    "cannot overwrite with a ZVOL"),
4459 				    name);
4460 				err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4461 				goto out;
4462 			}
4463 			if (is_volume &&
4464 			    zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
4465 			    &zc) == 0) {
4466 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4467 				    "destination has children (eg. %s)\n"
4468 				    "cannot overwrite with a ZVOL"),
4469 				    zc.zc_name);
4470 				err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4471 				goto out;
4472 			}
4473 		}
4474 
4475 		if ((zhp = zfs_open(hdl, name,
4476 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME)) == NULL) {
4477 			err = -1;
4478 			goto out;
4479 		}
4480 
4481 		if (stream_wantsnewfs &&
4482 		    zhp->zfs_dmustats.dds_origin[0]) {
4483 			zfs_close(zhp);
4484 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4485 			    "destination '%s' is a clone\n"
4486 			    "must destroy it to overwrite it"), name);
4487 			err = zfs_error(hdl, EZFS_EXISTS, errbuf);
4488 			goto out;
4489 		}
4490 
4491 		/*
4492 		 * Raw sends can not be performed as an incremental on top
4493 		 * of existing unencrypted datasets. zfs recv -F can't be
4494 		 * used to blow away an existing encrypted filesystem. This
4495 		 * is because it would require the dsl dir to point to the
4496 		 * new key (or lack of a key) and the old key at the same
4497 		 * time. The -F flag may still be used for deleting
4498 		 * intermediate snapshots that would otherwise prevent the
4499 		 * receive from working.
4500 		 */
4501 		encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
4502 		    ZIO_CRYPT_OFF;
4503 		if (!stream_wantsnewfs && !encrypted && raw) {
4504 			zfs_close(zhp);
4505 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4506 			    "cannot perform raw receive on top of "
4507 			    "existing unencrypted dataset"));
4508 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4509 			goto out;
4510 		}
4511 
4512 		if (stream_wantsnewfs && flags->force &&
4513 		    ((raw && !encrypted) || encrypted)) {
4514 			zfs_close(zhp);
4515 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4516 			    "zfs receive -F cannot be used to destroy an "
4517 			    "encrypted filesystem or overwrite an "
4518 			    "unencrypted one with an encrypted one"));
4519 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4520 			goto out;
4521 		}
4522 
4523 		if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
4524 		    (stream_wantsnewfs || stream_resumingnewfs)) {
4525 			/* We can't do online recv in this case */
4526 			clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
4527 			    flags->forceunmount ? MS_FORCE : 0);
4528 			if (clp == NULL) {
4529 				zfs_close(zhp);
4530 				err = -1;
4531 				goto out;
4532 			}
4533 			if (changelist_prefix(clp) != 0) {
4534 				changelist_free(clp);
4535 				zfs_close(zhp);
4536 				err = -1;
4537 				goto out;
4538 			}
4539 		}
4540 
4541 		/*
4542 		 * If we are resuming a newfs, set newfs here so that we will
4543 		 * mount it if the recv succeeds this time.  We can tell
4544 		 * that it was a newfs on the first recv because the fs
4545 		 * itself will be inconsistent (if the fs existed when we
4546 		 * did the first recv, we would have received it into
4547 		 * .../%recv).
4548 		 */
4549 		if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
4550 			newfs = B_TRUE;
4551 
4552 		/* we want to know if we're zoned when validating -o|-x props */
4553 		zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
4554 
4555 		/* may need this info later, get it now we have zhp around */
4556 		if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
4557 		    NULL, NULL, 0, B_TRUE) == 0)
4558 			hastoken = B_TRUE;
4559 
4560 		/* gather existing properties on destination */
4561 		origprops = fnvlist_alloc();
4562 		fnvlist_merge(origprops, zhp->zfs_props);
4563 		fnvlist_merge(origprops, zhp->zfs_user_props);
4564 
4565 		zfs_close(zhp);
4566 	} else {
4567 		zfs_handle_t *zhp;
4568 
4569 		/*
4570 		 * Destination filesystem does not exist.  Therefore we better
4571 		 * be creating a new filesystem (either from a full backup, or
4572 		 * a clone).  It would therefore be invalid if the user
4573 		 * specified only the pool name (i.e. if the destination name
4574 		 * contained no slash character).
4575 		 */
4576 		cp = strrchr(name, '/');
4577 
4578 		if (!stream_wantsnewfs || cp == NULL) {
4579 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4580 			    "destination '%s' does not exist"), name);
4581 			err = zfs_error(hdl, EZFS_NOENT, errbuf);
4582 			goto out;
4583 		}
4584 
4585 		/*
4586 		 * Trim off the final dataset component so we perform the
4587 		 * recvbackup ioctl to the filesystems's parent.
4588 		 */
4589 		*cp = '\0';
4590 
4591 		if (flags->isprefix && !flags->istail && !flags->dryrun &&
4592 		    create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
4593 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4594 			goto out;
4595 		}
4596 
4597 		/* validate parent */
4598 		zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
4599 		if (zhp == NULL) {
4600 			err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4601 			goto out;
4602 		}
4603 		if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
4604 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4605 			    "parent '%s' is not a filesystem"), name);
4606 			err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
4607 			zfs_close(zhp);
4608 			goto out;
4609 		}
4610 
4611 		zfs_close(zhp);
4612 
4613 		newfs = B_TRUE;
4614 		*cp = '/';
4615 	}
4616 
4617 	if (flags->verbose) {
4618 		(void) printf("%s %s stream of %s into %s\n",
4619 		    flags->dryrun ? "would receive" : "receiving",
4620 		    drrb->drr_fromguid ? "incremental" : "full",
4621 		    drrb->drr_toname, destsnap);
4622 		(void) fflush(stdout);
4623 	}
4624 
4625 	/*
4626 	 * If this is the top-level dataset, record it so we can use it
4627 	 * for recursive operations later.
4628 	 */
4629 	if (top_zfs != NULL &&
4630 	    (*top_zfs == NULL || strcmp(*top_zfs, name) == 0)) {
4631 		toplevel = B_TRUE;
4632 		if (*top_zfs == NULL)
4633 			*top_zfs = zfs_strdup(hdl, name);
4634 	}
4635 
4636 	if (drrb->drr_type == DMU_OST_ZVOL) {
4637 		type = ZFS_TYPE_VOLUME;
4638 	} else if (drrb->drr_type == DMU_OST_ZFS) {
4639 		type = ZFS_TYPE_FILESYSTEM;
4640 	} else {
4641 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4642 		    "invalid record type: 0x%d"), drrb->drr_type);
4643 		err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4644 		goto out;
4645 	}
4646 	if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
4647 	    stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
4648 	    &oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
4649 		goto out;
4650 
4651 	/*
4652 	 * When sending with properties (zfs send -p), the encryption property
4653 	 * is not included because it is a SETONCE property and therefore
4654 	 * treated as read only. However, we are always able to determine its
4655 	 * value because raw sends will include it in the DRR_BDEGIN payload
4656 	 * and non-raw sends with properties are not allowed for encrypted
4657 	 * datasets. Therefore, if this is a non-raw properties stream, we can
4658 	 * infer that the value should be ZIO_CRYPT_OFF and manually add that
4659 	 * to the received properties.
4660 	 */
4661 	if (stream_wantsnewfs && !raw && rcvprops != NULL &&
4662 	    !nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
4663 		if (oxprops == NULL)
4664 			oxprops = fnvlist_alloc();
4665 		fnvlist_add_uint64(oxprops,
4666 		    zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
4667 	}
4668 
4669 	if (flags->dryrun) {
4670 		void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
4671 
4672 		/*
4673 		 * We have read the DRR_BEGIN record, but we have
4674 		 * not yet read the payload. For non-dryrun sends
4675 		 * this will be done by the kernel, so we must
4676 		 * emulate that here, before attempting to read
4677 		 * more records.
4678 		 */
4679 		err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
4680 		    flags->byteswap, NULL);
4681 		free(buf);
4682 		if (err != 0)
4683 			goto out;
4684 
4685 		err = recv_skip(hdl, infd, flags->byteswap);
4686 		goto out;
4687 	}
4688 
4689 	err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
4690 	    oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
4691 	    raw, infd, drr_noswap, -1, &read_bytes, &errflags,
4692 	    NULL, &prop_errors);
4693 	ioctl_errno = ioctl_err;
4694 	prop_errflags = errflags;
4695 
4696 	if (err == 0) {
4697 		nvpair_t *prop_err = NULL;
4698 
4699 		while ((prop_err = nvlist_next_nvpair(prop_errors,
4700 		    prop_err)) != NULL) {
4701 			char tbuf[1024];
4702 			zfs_prop_t prop;
4703 			int intval;
4704 
4705 			prop = zfs_name_to_prop(nvpair_name(prop_err));
4706 			(void) nvpair_value_int32(prop_err, &intval);
4707 			if (strcmp(nvpair_name(prop_err),
4708 			    ZPROP_N_MORE_ERRORS) == 0) {
4709 				trunc_prop_errs(intval);
4710 				break;
4711 			} else if (snapname == NULL || finalsnap == NULL ||
4712 			    strcmp(finalsnap, snapname) == 0 ||
4713 			    strcmp(nvpair_name(prop_err),
4714 			    zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
4715 				/*
4716 				 * Skip the special case of, for example,
4717 				 * "refquota", errors on intermediate
4718 				 * snapshots leading up to a final one.
4719 				 * That's why we have all of the checks above.
4720 				 *
4721 				 * See zfs_ioctl.c's extract_delay_props() for
4722 				 * a list of props which can fail on
4723 				 * intermediate snapshots, but shouldn't
4724 				 * affect the overall receive.
4725 				 */
4726 				(void) snprintf(tbuf, sizeof (tbuf),
4727 				    dgettext(TEXT_DOMAIN,
4728 				    "cannot receive %s property on %s"),
4729 				    nvpair_name(prop_err), name);
4730 				zfs_setprop_error(hdl, prop, intval, tbuf);
4731 			}
4732 		}
4733 	}
4734 
4735 	if (err == 0 && snapprops_nvlist) {
4736 		zfs_cmd_t zc = {"\0"};
4737 
4738 		(void) strcpy(zc.zc_name, destsnap);
4739 		zc.zc_cookie = B_TRUE; /* received */
4740 		if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
4741 			(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
4742 			zcmd_free_nvlists(&zc);
4743 		}
4744 	}
4745 	if (err == 0 && snapholds_nvlist) {
4746 		nvpair_t *pair;
4747 		nvlist_t *holds, *errors = NULL;
4748 		int cleanup_fd = -1;
4749 
4750 		VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
4751 		for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
4752 		    pair != NULL;
4753 		    pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
4754 			fnvlist_add_string(holds, destsnap, nvpair_name(pair));
4755 		}
4756 		(void) lzc_hold(holds, cleanup_fd, &errors);
4757 		fnvlist_free(snapholds_nvlist);
4758 		fnvlist_free(holds);
4759 	}
4760 
4761 	if (err && (ioctl_errno == ENOENT || ioctl_errno == EEXIST)) {
4762 		/*
4763 		 * It may be that this snapshot already exists,
4764 		 * in which case we want to consume & ignore it
4765 		 * rather than failing.
4766 		 */
4767 		avl_tree_t *local_avl;
4768 		nvlist_t *local_nv, *fs;
4769 		cp = strchr(destsnap, '@');
4770 
4771 		/*
4772 		 * XXX Do this faster by just iterating over snaps in
4773 		 * this fs.  Also if zc_value does not exist, we will
4774 		 * get a strange "does not exist" error message.
4775 		 */
4776 		*cp = '\0';
4777 		if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
4778 		    B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE,
4779 		    B_TRUE, &local_nv, &local_avl) == 0) {
4780 			*cp = '@';
4781 			fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
4782 			fsavl_destroy(local_avl);
4783 			fnvlist_free(local_nv);
4784 
4785 			if (fs != NULL) {
4786 				if (flags->verbose) {
4787 					(void) printf("snap %s already exists; "
4788 					    "ignoring\n", destsnap);
4789 				}
4790 				err = ioctl_err = recv_skip(hdl, infd,
4791 				    flags->byteswap);
4792 			}
4793 		}
4794 		*cp = '@';
4795 	}
4796 
4797 	if (ioctl_err != 0) {
4798 		switch (ioctl_errno) {
4799 		case ENODEV:
4800 			cp = strchr(destsnap, '@');
4801 			*cp = '\0';
4802 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4803 			    "most recent snapshot of %s does not\n"
4804 			    "match incremental source"), destsnap);
4805 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4806 			*cp = '@';
4807 			break;
4808 		case ETXTBSY:
4809 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4810 			    "destination %s has been modified\n"
4811 			    "since most recent snapshot"), name);
4812 			(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
4813 			break;
4814 		case EACCES:
4815 			if (raw && stream_wantsnewfs) {
4816 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4817 				    "failed to create encryption key"));
4818 			} else if (raw && !stream_wantsnewfs) {
4819 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4820 				    "encryption key does not match "
4821 				    "existing key"));
4822 			} else {
4823 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4824 				    "inherited key must be loaded"));
4825 			}
4826 			(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
4827 			break;
4828 		case EEXIST:
4829 			cp = strchr(destsnap, '@');
4830 			if (newfs) {
4831 				/* it's the containing fs that exists */
4832 				*cp = '\0';
4833 			}
4834 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4835 			    "destination already exists"));
4836 			(void) zfs_error_fmt(hdl, EZFS_EXISTS,
4837 			    dgettext(TEXT_DOMAIN, "cannot restore to %s"),
4838 			    destsnap);
4839 			*cp = '@';
4840 			break;
4841 		case EINVAL:
4842 			if (flags->resumable) {
4843 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4844 				    "kernel modules must be upgraded to "
4845 				    "receive this stream."));
4846 			} else if (embedded && !raw) {
4847 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4848 				    "incompatible embedded data stream "
4849 				    "feature with encrypted receive."));
4850 			}
4851 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4852 			break;
4853 		case ECKSUM:
4854 		case ZFS_ERR_STREAM_TRUNCATED:
4855 			recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
4856 			    ioctl_err == ECKSUM);
4857 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4858 			break;
4859 		case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
4860 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4861 			    "incremental send stream requires -L "
4862 			    "(--large-block), to match previous receive."));
4863 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4864 			break;
4865 		case ENOTSUP:
4866 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4867 			    "pool must be upgraded to receive this stream."));
4868 			(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
4869 			break;
4870 		case EDQUOT:
4871 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4872 			    "destination %s space quota exceeded."), name);
4873 			(void) zfs_error(hdl, EZFS_NOSPC, errbuf);
4874 			break;
4875 		case ZFS_ERR_FROM_IVSET_GUID_MISSING:
4876 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4877 			    "IV set guid missing. See errata %u at "
4878 			    "https://openzfs.github.io/openzfs-docs/msg/"
4879 			    "ZFS-8000-ER."),
4880 			    ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
4881 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4882 			break;
4883 		case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
4884 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4885 			    "IV set guid mismatch. See the 'zfs receive' "
4886 			    "man page section\n discussing the limitations "
4887 			    "of raw encrypted send streams."));
4888 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4889 			break;
4890 		case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
4891 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4892 			    "Spill block flag missing for raw send.\n"
4893 			    "The zfs software on the sending system must "
4894 			    "be updated."));
4895 			(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
4896 			break;
4897 		case EBUSY:
4898 			if (hastoken) {
4899 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4900 				    "destination %s contains "
4901 				    "partially-complete state from "
4902 				    "\"zfs receive -s\"."), name);
4903 				(void) zfs_error(hdl, EZFS_BUSY, errbuf);
4904 				break;
4905 			}
4906 			fallthrough;
4907 		default:
4908 			(void) zfs_standard_error(hdl, ioctl_errno, errbuf);
4909 		}
4910 	}
4911 
4912 	/*
4913 	 * Mount the target filesystem (if created).  Also mount any
4914 	 * children of the target filesystem if we did a replication
4915 	 * receive (indicated by stream_avl being non-NULL).
4916 	 */
4917 	if (clp) {
4918 		if (!flags->nomount)
4919 			err |= changelist_postfix(clp);
4920 		changelist_free(clp);
4921 	}
4922 
4923 	if ((newfs || stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
4924 		flags->domount = B_TRUE;
4925 
4926 	if (prop_errflags & ZPROP_ERR_NOCLEAR) {
4927 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4928 		    "failed to clear unreceived properties on %s"), name);
4929 		(void) fprintf(stderr, "\n");
4930 	}
4931 	if (prop_errflags & ZPROP_ERR_NORESTORE) {
4932 		(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
4933 		    "failed to restore original properties on %s"), name);
4934 		(void) fprintf(stderr, "\n");
4935 	}
4936 
4937 	if (err || ioctl_err) {
4938 		err = -1;
4939 		goto out;
4940 	}
4941 
4942 	if (flags->verbose) {
4943 		char buf1[64];
4944 		char buf2[64];
4945 		uint64_t bytes = read_bytes;
4946 		time_t delta = time(NULL) - begin_time;
4947 		if (delta == 0)
4948 			delta = 1;
4949 		zfs_nicebytes(bytes, buf1, sizeof (buf1));
4950 		zfs_nicebytes(bytes/delta, buf2, sizeof (buf1));
4951 
4952 		(void) printf("received %s stream in %lld seconds (%s/sec)\n",
4953 		    buf1, (longlong_t)delta, buf2);
4954 	}
4955 
4956 	err = 0;
4957 out:
4958 	if (prop_errors != NULL)
4959 		fnvlist_free(prop_errors);
4960 
4961 	if (tmp_keylocation[0] != '\0') {
4962 		fnvlist_add_string(rcvprops,
4963 		    zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation);
4964 	}
4965 
4966 	if (newprops)
4967 		fnvlist_free(rcvprops);
4968 
4969 	fnvlist_free(oxprops);
4970 	fnvlist_free(origprops);
4971 
4972 	return (err);
4973 }
4974 
4975 /*
4976  * Check properties we were asked to override (both -o|-x)
4977  */
4978 static boolean_t
4979 zfs_receive_checkprops(libzfs_handle_t *hdl, nvlist_t *props,
4980     const char *errbuf)
4981 {
4982 	nvpair_t *nvp;
4983 	zfs_prop_t prop;
4984 	const char *name;
4985 
4986 	nvp = NULL;
4987 	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
4988 		name = nvpair_name(nvp);
4989 		prop = zfs_name_to_prop(name);
4990 
4991 		if (prop == ZPROP_INVAL) {
4992 			if (!zfs_prop_user(name)) {
4993 				zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
4994 				    "invalid property '%s'"), name);
4995 				return (B_FALSE);
4996 			}
4997 			continue;
4998 		}
4999 		/*
5000 		 * "origin" is readonly but is used to receive datasets as
5001 		 * clones so we don't raise an error here
5002 		 */
5003 		if (prop == ZFS_PROP_ORIGIN)
5004 			continue;
5005 
5006 		/* encryption params have their own verification later */
5007 		if (prop == ZFS_PROP_ENCRYPTION ||
5008 		    zfs_prop_encryption_key_param(prop))
5009 			continue;
5010 
5011 		/*
5012 		 * cannot override readonly, set-once and other specific
5013 		 * settable properties
5014 		 */
5015 		if (zfs_prop_readonly(prop) || prop == ZFS_PROP_VERSION ||
5016 		    prop == ZFS_PROP_VOLSIZE) {
5017 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5018 			    "invalid property '%s'"), name);
5019 			return (B_FALSE);
5020 		}
5021 	}
5022 
5023 	return (B_TRUE);
5024 }
5025 
5026 static int
5027 zfs_receive_impl(libzfs_handle_t *hdl, const char *tosnap,
5028     const char *originsnap, recvflags_t *flags, int infd, const char *sendfs,
5029     nvlist_t *stream_nv, avl_tree_t *stream_avl, char **top_zfs,
5030     const char *finalsnap, nvlist_t *cmdprops)
5031 {
5032 	int err;
5033 	dmu_replay_record_t drr, drr_noswap;
5034 	struct drr_begin *drrb = &drr.drr_u.drr_begin;
5035 	char errbuf[1024];
5036 	zio_cksum_t zcksum = { { 0 } };
5037 	uint64_t featureflags;
5038 	int hdrtype;
5039 
5040 	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
5041 	    "cannot receive"));
5042 
5043 	/* check cmdline props, raise an error if they cannot be received */
5044 	if (!zfs_receive_checkprops(hdl, cmdprops, errbuf)) {
5045 		return (zfs_error(hdl, EZFS_BADPROP, errbuf));
5046 	}
5047 
5048 	if (flags->isprefix &&
5049 	    !zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
5050 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
5051 		    "(%s) does not exist"), tosnap);
5052 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5053 	}
5054 	if (originsnap &&
5055 	    !zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
5056 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
5057 		    "(%s) does not exist"), originsnap);
5058 		return (zfs_error(hdl, EZFS_NOENT, errbuf));
5059 	}
5060 
5061 	/* read in the BEGIN record */
5062 	if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
5063 	    &zcksum)))
5064 		return (err);
5065 
5066 	if (drr.drr_type == DRR_END || drr.drr_type == BSWAP_32(DRR_END)) {
5067 		/* It's the double end record at the end of a package */
5068 		return (ENODATA);
5069 	}
5070 
5071 	/* the kernel needs the non-byteswapped begin record */
5072 	drr_noswap = drr;
5073 
5074 	flags->byteswap = B_FALSE;
5075 	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
5076 		/*
5077 		 * We computed the checksum in the wrong byteorder in
5078 		 * recv_read() above; do it again correctly.
5079 		 */
5080 		bzero(&zcksum, sizeof (zio_cksum_t));
5081 		fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
5082 		flags->byteswap = B_TRUE;
5083 
5084 		drr.drr_type = BSWAP_32(drr.drr_type);
5085 		drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
5086 		drrb->drr_magic = BSWAP_64(drrb->drr_magic);
5087 		drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
5088 		drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
5089 		drrb->drr_type = BSWAP_32(drrb->drr_type);
5090 		drrb->drr_flags = BSWAP_32(drrb->drr_flags);
5091 		drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
5092 		drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
5093 	}
5094 
5095 	if (drrb->drr_magic != DMU_BACKUP_MAGIC || drr.drr_type != DRR_BEGIN) {
5096 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5097 		    "stream (bad magic number)"));
5098 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5099 	}
5100 
5101 	featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
5102 	hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);
5103 
5104 	if (!DMU_STREAM_SUPPORTED(featureflags) ||
5105 	    (hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
5106 		/*
5107 		 * Let's be explicit about this one, since rather than
5108 		 * being a new feature we can't know, it's an old
5109 		 * feature we dropped.
5110 		 */
5111 		if (featureflags & DMU_BACKUP_FEATURE_DEDUP) {
5112 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5113 			    "stream has deprecated feature: dedup, try "
5114 			    "'zstream redup [send in a file] | zfs recv "
5115 			    "[...]'"));
5116 		} else {
5117 			zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
5118 			    "stream has unsupported feature, feature flags = "
5119 			    "%llx (unknown flags = %llx)"),
5120 			    (u_longlong_t)featureflags,
5121 			    (u_longlong_t)((featureflags) &
5122 			    ~DMU_BACKUP_FEATURE_MASK));
5123 		}
5124 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5125 	}
5126 
5127 	/* Holds feature is set once in the compound stream header. */
5128 	if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
5129 		flags->holds = B_TRUE;
5130 
5131 	if (strchr(drrb->drr_toname, '@') == NULL) {
5132 		zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
5133 		    "stream (bad snapshot name)"));
5134 		return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
5135 	}
5136 
5137 	if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
5138 		char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
5139 		if (sendfs == NULL) {
5140 			/*
5141 			 * We were not called from zfs_receive_package(). Get
5142 			 * the fs specified by 'zfs send'.
5143 			 */
5144 			char *cp;
5145 			(void) strlcpy(nonpackage_sendfs,
5146 			    drr.drr_u.drr_begin.drr_toname,
5147 			    sizeof (nonpackage_sendfs));
5148 			if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
5149 				*cp = '\0';
5150 			sendfs = nonpackage_sendfs;
5151 			VERIFY(finalsnap == NULL);
5152 		}
5153 		return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
5154 		    &drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
5155 		    finalsnap, cmdprops));
5156 	} else {
5157 		assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
5158 		    DMU_COMPOUNDSTREAM);
5159 		return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
5160 		    &zcksum, top_zfs, cmdprops));
5161 	}
5162 }
5163 
5164 /*
5165  * Restores a backup of tosnap from the file descriptor specified by infd.
5166  * Return 0 on total success, -2 if some things couldn't be
5167  * destroyed/renamed/promoted, -1 if some things couldn't be received.
5168  * (-1 will override -2, if -1 and the resumable flag was specified the
5169  * transfer can be resumed if the sending side supports it).
5170  */
5171 int
5172 zfs_receive(libzfs_handle_t *hdl, const char *tosnap, nvlist_t *props,
5173     recvflags_t *flags, int infd, avl_tree_t *stream_avl)
5174 {
5175 	char *top_zfs = NULL;
5176 	int err;
5177 	struct stat sb;
5178 	char *originsnap = NULL;
5179 
5180 	/*
5181 	 * The only way fstat can fail is if we do not have a valid file
5182 	 * descriptor.
5183 	 */
5184 	if (fstat(infd, &sb) == -1) {
5185 		perror("fstat");
5186 		return (-2);
5187 	}
5188 
5189 	/*
5190 	 * It is not uncommon for gigabytes to be processed in zfs receive.
5191 	 * Speculatively increase the buffer size if supported by the platform.
5192 	 */
5193 	if (S_ISFIFO(sb.st_mode))
5194 		libzfs_set_pipe_max(infd);
5195 
5196 	if (props) {
5197 		err = nvlist_lookup_string(props, "origin", &originsnap);
5198 		if (err && err != ENOENT)
5199 			return (err);
5200 	}
5201 
5202 	err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
5203 	    stream_avl, &top_zfs, NULL, props);
5204 
5205 	if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
5206 		zfs_handle_t *zhp = NULL;
5207 		prop_changelist_t *clp = NULL;
5208 
5209 		zhp = zfs_open(hdl, top_zfs,
5210 		    ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME);
5211 		if (zhp == NULL) {
5212 			err = -1;
5213 			goto out;
5214 		} else {
5215 			if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
5216 				zfs_close(zhp);
5217 				goto out;
5218 			}
5219 
5220 			clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
5221 			    CL_GATHER_MOUNT_ALWAYS,
5222 			    flags->forceunmount ? MS_FORCE : 0);
5223 			zfs_close(zhp);
5224 			if (clp == NULL) {
5225 				err = -1;
5226 				goto out;
5227 			}
5228 
5229 			/* mount and share received datasets */
5230 			err = changelist_postfix(clp);
5231 			changelist_free(clp);
5232 			if (err != 0)
5233 				err = -1;
5234 		}
5235 	}
5236 
5237 out:
5238 	if (top_zfs)
5239 		free(top_zfs);
5240 
5241 	return (err);
5242 }
5243