illumos gate

This is the ZOL PR by Tom Caputi, ported to IllumOS.

This change incorporates three major pieces:

The first change is a keystore that manages wrapping
    and encryption keys for encrypted datasets. These
    commands mostly involve manipulating the new
    DSL Crypto Key ZAP Objects that live in the MOS. Each
    encrypted dataset has its own DSL Crypto Key that is
    protected with a user's key. This level of indirection
    allows users to change their keys without re-encrypting
    their entire datasets. The change implements the new
    subcommands "zfs load-key", "zfs unload-key" and
    "zfs change-key" which allow the user to manage their
    encryption keys and settings. In addition, several new
    flags and properties have been added to allow dataset
    creation and to make mounting and unmounting more
    convenient.

The second piece of this patch provides the ability to
    encrypt, decyrpt, and authenticate protected datasets.
    Each object set maintains a Merkel tree of Message
    Authentication Codes that protect the lower layers,
    similarly to how checksums are maintained. This part
    impacts the zio layer, which handles the actual
    encryption and generation of MACs, as well as the ARC
    and DMU, which need to be able to handle encrypted
    buffers and protected data.

The last addition is the ability to do raw, encrypted
    sends and receives. The idea here is to send raw
    encrypted and compressed data and receive it exactly
    as is on a backup system. This means that the dataset
    on the receiving system is protected using the same
    user key that is in use on the sending side. By doing
    so, datasets can be efficiently backed up to an
    untrusted system without fear of data being
    compromised.

Reviewed by: Matthew Ahrens <mahrens@delphix.com>
    Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
    Reviewed-by: Jorgen Lundman <lundman@lundman.net>
    Signed-off-by: Tom Caputi <tcaputi@datto.com>

Send / Recv Fixes following b52563

This patch fixes several issues discovered after
    the encryption patch was merged:

Fixed a bug where encrypted datasets could attempt
    to receive embedded data records.

Fixed a bug where dirty records created by the recv
    code wasn't properly setting the dr_raw flag.

Fixed a typo where a dmu_tx_commit() was changed to
    dmu_tx_abort()

Fixed a few error handling bugs unrelated to the
    encryption patch in dmu_recv_stream()

Signed-off-by: Tom Caputi <tcaputi@datto.com>

Encryption patch follow-up

• HKDF implementation moved to its own file and tests added to ensure
  correctness.

• Ztest can now create and test encrypted datasets. This is currently
  disabled until issue ZOL #6526 is resolved, but otherwise functions as
  advertised.

• Several small bug fixes discovered after enabling ztest to run on
  encrypted datasets.

• Fixed coverity defects added by the encryption patch.

• Updated man pages for encrypted send / receive behavior.

• Fixed a bug where encrypted datasets could receive
  DRR_WRITE_EMBEDDED records.

• Minor code cleanups / consolidation.

Disable crypto tests in ztest

• Includes fix in dmu_free_long_object_impl

Unless permission is given to compile the crypto framework in userland
the crypto tests in ztest are disabled on IllumOS.