f00ab3f22c
Currently, there is an issue in the raw receive code where raw receives are allowed to happen on top of previously non-raw received datasets. This is a problem because the source-side dataset doesn't know about how the blocks on the destination were encrypted. As a result, any MAC in the objset's checksum-of-MACs tree that is a parent of both blocks encrypted on the source and blocks encrypted by the destination will be incorrect. This will result in authentication errors when we decrypt the dataset. This patch fixes this issue by adding a new check to the raw receive code. The code now maintains an "IVset guid", which acts as an identifier for the set of IVs used to encrypt a given snapshot. When a snapshot is raw received, the destination snapshot will take this value from the DRR_BEGIN payload. Non-raw receives and normal "zfs snap" operations will cause ZFS to generate a new IVset guid. When a raw incremental stream is received, ZFS will check that the "from" IVset guid in the stream matches that of the "from" destination snapshot. If they do not match, the code will error out the receive, preventing the problem. This patch requires an on-disk format change to add the IVset guids to snapshots and bookmarks. As a result, this patch has errata handling and a tunable to help affected users resolve the issue with as little interruption as possible. Reviewed-by: Paul Dagnelie <pcd@delphix.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Matt Ahrens <mahrens@delphix.com> Signed-off-by: Tom Caputi <tcaputi@datto.com> Closes #8308
71 lines
2.2 KiB
C
71 lines
2.2 KiB
C
/*
|
|
* CDDL HEADER START
|
|
*
|
|
* The contents of this file are subject to the terms of the
|
|
* Common Development and Distribution License (the "License").
|
|
* You may not use this file except in compliance with the License.
|
|
*
|
|
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
|
|
* or http://www.opensolaris.org/os/licensing.
|
|
* See the License for the specific language governing permissions
|
|
* and limitations under the License.
|
|
*
|
|
* When distributing Covered Code, include this CDDL HEADER in each
|
|
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
|
|
* If applicable, add the following below this CDDL HEADER, with the
|
|
* fields enclosed by brackets "[]" replaced with your own identifying
|
|
* information: Portions Copyright [yyyy] [name of copyright owner]
|
|
*
|
|
* CDDL HEADER END
|
|
*/
|
|
|
|
/*
|
|
* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
|
|
* Copyright (c) 2012, 2018 by Delphix. All rights reserved.
|
|
* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
|
|
* Copyright (c) 2013, Joyent, Inc. All rights reserved.
|
|
*/
|
|
|
|
#ifndef _DMU_RECV_H
|
|
#define _DMU_RECV_H
|
|
|
|
#include <sys/inttypes.h>
|
|
#include <sys/dsl_bookmark.h>
|
|
#include <sys/dsl_dataset.h>
|
|
#include <sys/spa.h>
|
|
|
|
extern const char *recv_clone_name;
|
|
|
|
typedef struct dmu_recv_cookie {
|
|
struct dsl_dataset *drc_ds;
|
|
struct dmu_replay_record *drc_drr_begin;
|
|
struct drr_begin *drc_drrb;
|
|
const char *drc_tofs;
|
|
const char *drc_tosnap;
|
|
boolean_t drc_newfs;
|
|
boolean_t drc_byteswap;
|
|
boolean_t drc_force;
|
|
boolean_t drc_resumable;
|
|
boolean_t drc_raw;
|
|
boolean_t drc_clone;
|
|
struct avl_tree *drc_guid_to_ds_map;
|
|
nvlist_t *drc_keynvl;
|
|
zio_cksum_t drc_cksum;
|
|
uint64_t drc_fromsnapobj;
|
|
uint64_t drc_newsnapobj;
|
|
uint64_t drc_ivset_guid;
|
|
void *drc_owner;
|
|
cred_t *drc_cred;
|
|
} dmu_recv_cookie_t;
|
|
|
|
int dmu_recv_begin(char *tofs, char *tosnap,
|
|
struct dmu_replay_record *drr_begin, boolean_t force, boolean_t resumable,
|
|
nvlist_t *localprops, nvlist_t *hidden_args, char *origin,
|
|
dmu_recv_cookie_t *drc);
|
|
int dmu_recv_stream(dmu_recv_cookie_t *drc, struct vnode *vp, offset_t *voffp,
|
|
int cleanup_fd, uint64_t *action_handlep);
|
|
int dmu_recv_end(dmu_recv_cookie_t *drc, void *owner);
|
|
boolean_t dmu_objset_is_receiving(objset_t *os);
|
|
|
|
#endif /* _DMU_RECV_H */
|