Consistently encode DRR_BEGIN packed nvlist payloads with NV_ENCODE_XDR

cmd/zstream/zstream_dump.c

@@ -385,6 +385,20 @@ zstream_do_dump(int argc, char *argv[])
 				(void) ssread(buf, sz, &zc);
 				if (ferror(send_stream))
 					perror("fread");
+
+				uint8_t *nv_header = (uint8_t *)buf;
+				boolean_t xdr = nv_header[0] == NV_ENCODE_XDR;
+				boolean_t big_endian = nv_header[1] == 0;
+				const char *nc;
+				if (xdr) {
+					nc = "NV_ENCODE_XDR";
+				} else if (big_endian) {
+					nc = "NV_ENCODE_NATIVE (big-endian)";
+				} else {
+					nc = "NV_ENCODE_NATIVE (little-endian)";
+				}
+				printf("nvlist encoding = %s\n", nc);
+
 				err = nvlist_unpack(buf, sz, &nv, 0);
 				if (err) {
 					perror(strerror(err));

module/zfs/dmu_send.c

@@ -2241,6 +2241,37 @@ setup_send_progress(struct dmu_send_params *dspp)
 	return (dssp);
 }
 
+/*
+ * Payloads must be multiples of 8 bytes for historical compatibility, but
+ * XDR-encoded nvlists are sized in multiples of 4 bytes and may need padding.
+ *
+ * Here we do the simplest possible thing and copy the data to a separate
+ * buffer. Not ideal in terms of performance and memory use, but most BEGIN
+ * nvlists are small or absent, the allocation is momentary, and we'll need
+ * to do this at most once per dataset.
+ *
+ * It's OK if there is extra data after a packed nvlist on the receiving
+ * side because packed nvlists have an internal end-of-list marker.
+ *
+ * The new buffer is allocated with kmem_alloc() and can be freed with
+ * fnvlist_pack_free(), like the original.
+ */
+static inline void
+pad_packed_nvlist(char **buffer, size_t *size)
+{
+	size_t size_in = *size;
+	size_t extra_bytes = P2ROUNDUP(size_in, 8) - size_in;
+	if (extra_bytes != 0) {
+		size_t expanded_size = size_in + extra_bytes;
+		char *longbuf = kmem_alloc(expanded_size, KM_SLEEP);
+		memcpy(longbuf, *buffer, size_in);
+		memset(longbuf + size_in, 0, extra_bytes);
+		fnvlist_pack_free(*buffer, size_in);
+		*buffer = longbuf;
+		*size = expanded_size;
+	}
+}
+
 /*
  * Actually do the bulk of the work in a zfs send.
  *
@@ -2474,7 +2505,7 @@ dmu_send_impl(struct dmu_send_params *dspp)
 
 	dsl_pool_rele(dp, tag);
 
-	void *payload = NULL;
+	char *payload = NULL;
 	size_t payload_len = 0;
 	nvlist_t *nvl = fnvlist_alloc();
 
@@ -2548,7 +2579,9 @@ dmu_send_impl(struct dmu_send_params *dspp)
 	}
 
 	if (!nvlist_empty(nvl)) {
-		payload = fnvlist_pack(nvl, &payload_len);
+		VERIFY0(nvlist_pack(nvl, &payload, &payload_len,
+		    NV_ENCODE_XDR, KM_SLEEP));
+		pad_packed_nvlist(&payload, &payload_len);
 		drr->drr_payloadlen = payload_len;
 	}
 

tests/runfiles/common.run

@@ -1025,6 +1025,15 @@ tests = ['scrub_mirror_001_pos', 'scrub_mirror_002_pos',
     'scrub_mirror_003_pos', 'scrub_mirror_004_pos']
 tags = ['functional', 'scrub_mirror']
 
+[tests/functional/send_xdr_encoding]
+tests = ['xdr_bookmark_raw', 'xdr_bookmark_raw_with_write',
+    'xdr_incr_from_bookmark', 'xdr_incr_from_redacted', 'xdr_raw',
+    'xdr_redacted_full', 'xdr_redacted_received',
+    'xdr_redacted_received_raw', 'xdr_replication', 'xdr_resume',
+    'xdr_resume_bookmark_raw', 'xdr_resume_bookmark_raw_with_write',
+    'xdr_resume_raw', 'xdr_resume_redacted']
+tags = ['functional', 'send_xdr_encoding']
+
 [tests/functional/slog]
 tests = ['slog_001_pos', 'slog_002_pos', 'slog_003_pos', 'slog_004_pos',
     'slog_005_pos', 'slog_006_pos', 'slog_007_pos', 'slog_008_neg',

tests/test-runner/bin/zts-report.py.in

@@ -253,6 +253,8 @@ maybe = {
     'renameat2/setup': ['SKIP', renameat2_reason],
     'reservation/reservation_008_pos': ['FAIL', 7741],
     'reservation/reservation_018_pos': ['FAIL', 5642],
+    'send_xdr_encoding/xdr_bookmark_raw_with_write': ['FAIL', 18491],
+    'send_xdr_encoding/xdr_resume_bookmark_raw_with_write': ['FAIL', 18491],
     'snapshot/clone_001_pos': ['FAIL', known_reason],
     'snapshot/snapshot_006_pos': ['FAIL', known_reason],
     'snapshot/snapshot_009_pos': ['FAIL', 7961],

tests/zfs-tests/tests/Makefile.am

@@ -376,6 +376,8 @@ nobase_dist_datadir_zfs_tests_tests_DATA += \
 	functional/rsend/rsend.kshlib \
 	functional/scrub_mirror/default.cfg \
 	functional/scrub_mirror/scrub_mirror_common.kshlib \
+	functional/send_xdr_encoding/send_xdr_encoding.cfg \
+	functional/send_xdr_encoding/send_xdr_encoding.kshlib \
 	functional/slog/slog.cfg \
 	functional/slog/slog.kshlib \
 	functional/snapshot/snapshot.cfg \
@@ -2129,6 +2131,22 @@ nobase_dist_datadir_zfs_tests_tests_SCRIPTS += \
 	functional/scrub_mirror/scrub_mirror_003_pos.ksh \
 	functional/scrub_mirror/scrub_mirror_004_pos.ksh \
 	functional/scrub_mirror/setup.ksh \
+	functional/send_xdr_encoding/cleanup.ksh \
+	functional/send_xdr_encoding/setup.ksh \
+	functional/send_xdr_encoding/xdr_bookmark_raw.ksh \
+	functional/send_xdr_encoding/xdr_bookmark_raw_with_write.ksh \
+	functional/send_xdr_encoding/xdr_incr_from_bookmark.ksh \
+	functional/send_xdr_encoding/xdr_incr_from_redacted.ksh \
+	functional/send_xdr_encoding/xdr_raw.ksh \
+	functional/send_xdr_encoding/xdr_redacted_full.ksh \
+	functional/send_xdr_encoding/xdr_redacted_received.ksh \
+	functional/send_xdr_encoding/xdr_redacted_received_raw.ksh \
+	functional/send_xdr_encoding/xdr_replication.ksh \
+	functional/send_xdr_encoding/xdr_resume.ksh \
+	functional/send_xdr_encoding/xdr_resume_bookmark_raw.ksh \
+	functional/send_xdr_encoding/xdr_resume_bookmark_raw_with_write.ksh \
+	functional/send_xdr_encoding/xdr_resume_raw.ksh \
+	functional/send_xdr_encoding/xdr_resume_redacted.ksh \
 	functional/slog/cleanup.ksh \
 	functional/slog/setup.ksh \
 	functional/slog/slog_001_pos.ksh \

tests/zfs-tests/tests/functional/send_xdr_encoding/cleanup.ksh

@@ -0,0 +1,27 @@
+#!/bin/ksh -p
+# SPDX-License-Identifier: CDDL-1.0
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2026 by Garth Snyder. All rights reserved.
+#
+
+. $STF_SUITE/tests/functional/send_xdr_encoding/send_xdr_encoding.kshlib
+
+destroy_pool $POOL
+destroy_pool $POOL2
+
+log_pass

tests/zfs-tests/tests/functional/send_xdr_encoding/send_xdr_encoding.cfg

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: CDDL-1.0
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2026 by Garth Snyder. All rights reserved.
+#
+
+read -r DISK1 DISK2 _ <<<"$DISKS"
+export DISK1 DISK2
+
+export POOL=$TESTPOOL
+export POOL2=$TESTPOOL2

tests/zfs-tests/tests/functional/send_xdr_encoding/send_xdr_encoding.kshlib

@@ -0,0 +1,71 @@
+#!/bin/ksh
+# SPDX-License-Identifier: CDDL-1.0
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2026 by Garth Snyder. All rights reserved.
+#
+
+. $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/send_xdr_encoding/send_xdr_encoding.cfg
+
+#
+# Verify that the DRR_BEGIN records in the given send stream encode their
+# nvlist payloads with NV_ENCODE_XDR (and not NV_ENCODE_NATIVE).
+#
+# DRR_BEGIN records that carry an nvlist payload (raw sends, redacted sends,
+# resumed sends, and combinations thereof) must encode that payload with
+# NV_ENCODE_XDR so the resulting stream can be portably consumed across
+# endianness. Encoding the payload with NV_ENCODE_NATIVE produces a stream
+# that is unreadable on a receiver of the opposite endianness.
+#
+# zstream dump prints a single "nvlist encoding = ..." line per DRR_BEGIN
+# record that carries an nvlist payload. The possible values are:
+#
+#     NV_ENCODE_XDR
+#     NV_ENCODE_NATIVE (big-endian)
+#     NV_ENCODE_NATIVE (little-endian)
+#
+# Every test in this suite generates a stream whose DRR_BEGIN record
+# carries an nvlist payload, so the pass criterion is:
+#
+#   - At least one NV_ENCODE_XDR line appears, AND
+#   - No NV_ENCODE_NATIVE line appears.
+#
+# Requiring at least one XDR line catches the case where zstream dump
+# itself fails before producing any encoding output. Asserting on dump
+# content rather than dump exit status means a partial dump can still
+# fail the test on an NV_ENCODE_NATIVE seen before the failure point.
+#
+function verify_xdr_nvlist_encoding
+{
+	typeset stream=$1
+	typeset out
+
+	[[ -f "$stream" ]] || \
+	    log_fail "verify_xdr_nvlist_encoding: stream not found: $stream"
+
+	out=$(zstream dump "$stream" 2>/dev/null)
+
+	if echo "$out" | grep -q 'NV_ENCODE_NATIVE'; then
+		log_fail "verify_xdr_nvlist_encoding: " \
+		    "NV_ENCODE_NATIVE found in $stream"
+	fi
+	if ! echo "$out" | grep -q 'NV_ENCODE_XDR'; then
+		log_fail "verify_xdr_nvlist_encoding: " \
+		    "no NV_ENCODE_XDR found in $stream"
+	fi
+}

tests/zfs-tests/tests/functional/send_xdr_encoding/setup.ksh

@@ -0,0 +1,29 @@
+#!/bin/ksh -p
+# SPDX-License-Identifier: CDDL-1.0
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2026 by Garth Snyder. All rights reserved.
+#
+
+. $STF_SUITE/tests/functional/send_xdr_encoding/send_xdr_encoding.kshlib
+
+verify_disk_count "$DISKS" 2
+
+create_pool $POOL $DISK1
+create_pool $POOL2 $DISK2
+
+log_pass

tests/zfs-tests/tests/functional/send_xdr_encoding/xdr_bookmark_raw.ksh

@@ -0,0 +1,93 @@
+#!/bin/ksh -p
+# SPDX-License-Identifier: CDDL-1.0
+#
+# CDDL HEADER START
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright (c) 2026 by Garth Snyder. All rights reserved.
+#
+
+. $STF_SUITE/tests/functional/send_xdr_encoding/send_xdr_encoding.kshlib
+
+#
+# Description:
+# A raw incremental send from a redaction bookmark on an encrypted dataset
+# (zfs send -w -i ds#book ds@snap) carries both BEGINNV_REDACT_FROM_SNAPS
+# and crypt_keydata in its DRR_BEGIN nvlist payload. Verify that this
+# combined payload is XDR-encoded and the stream can be received.
+#
+# Strategy:
+# 1. Create an encrypted source dataset with a redaction bookmark and a
+#    later snapshot.
+# 2. Establish a raw base on the receiver via zfs send -w of the bookmark's
+#    source snapshot.
+# 3. zfs send -w -i sendfs#book sendfs@s1 to a file.
+# 4. Verify that the resulting stream is XDR-encoded.
+# 5. Verify that the zfs receive succeeds.
+#
+
+verify_runnable "both"
+
+sendfs="$POOL/xdr_bookmark_raw_src"
+clonefs="$POOL/xdr_bookmark_raw_clone"
+recvfs="$POOL2/xdr_bookmark_raw_recv"
+keyfile="/$POOL/xdr_bookmark_raw.key"
+full_stream="/$POOL/xdr_bookmark_raw_full.zsend"
+incr_stream="/$POOL/xdr_bookmark_raw_incr.zsend"
+
+function cleanup
+{
+	datasetexists $sendfs && destroy_dataset $sendfs -R
+	datasetexists $recvfs && destroy_dataset $recvfs -R
+	rm -f $keyfile $full_stream $incr_stream
+}
+log_onexit cleanup
+
+log_assert "BEGIN nvlist of a raw incremental from a redaction bookmark is " \
+    "XDR-encoded and receivable"
+
+log_must eval "echo 'thisisapassphrase' > $keyfile"
+log_must zfs create -o encryption=on -o keyformat=passphrase \
+    -o keylocation=file://$keyfile $sendfs
+
+log_must dd if=/dev/urandom of=/$sendfs/f1 bs=128k count=8 status=none
+log_must dd if=/dev/urandom of=/$sendfs/f2 bs=128k count=8 status=none
+log_must zfs snapshot $sendfs@s0
+
+# The clone inherits encryption from $sendfs.
+log_must zfs clone $sendfs@s0 $clonefs
+log_must dd if=/dev/urandom of=/$clonefs/f1 bs=128k count=8 conv=notrunc \
+    status=none
+log_must zfs snapshot $clonefs@s
+
+log_must zfs redact $sendfs@s0 redaction-bookmark $clonefs@s
+
+# Take @s1 with no intervening writes. See xdr_bookmark_raw_with_write.ksh
+# for a variant that includes a post-redact write; that variant exercises
+# a known kernel-side issue (#18491) and may flake.
+log_must zfs snapshot $sendfs@s1
+
+# Establish a raw base on the receiver.
+log_must eval "zfs send -w $sendfs@s0 > $full_stream"
+log_must eval "zfs receive $recvfs < $full_stream"
+
+# Raw incremental from the redaction bookmark. This is the test focus.
+log_must eval "zfs send -w -i $sendfs#redaction-bookmark $sendfs@s1 > \
+    $incr_stream"
+verify_xdr_nvlist_encoding $incr_stream
+log_must eval "zfs receive $recvfs < $incr_stream"
+
+log_pass "BEGIN nvlist of a raw incremental from a redaction bookmark is " \
+    "XDR-encoded and receivable"