lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2011
   5   Free Software Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #ifdef HAVE_FCNTL_H
  69 #include <fcntl.h>
  70 #endif
  71 #ifdef HAVE_STRING_H
  72 #include <string.h>
  73 #endif
  74 #include "syswait.h"
  75 #ifdef MAIL_USE_POP
  76 #include "pop.h"
  77 #endif
  78
  79 #ifdef MSDOS
  80 #undef access
  81 #endif /* MSDOS */
  82
  83 #ifdef WINDOWSNT
  84 #include "ntlib.h"
  85 #undef access
  86 #undef unlink
  87 #define fork() 0
  88 #define wait(var) (*(var) = 0)
  89 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  90    though the locking call succeeds (and indeed blocks local access from
  91    other NT programs).  If you have direct file access using an NFS
  92    client or something other than Samba, the locking call might work
  93    properly - make sure it does before you enable this!
  94
  95    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  96    since it was based on a misunderstanding of how locking calls are
  97    implemented and used on Unix.  */
  98 //#define DISABLE_DIRECT_ACCESS
  99
 100 #include <fcntl.h>
 101 #endif /* WINDOWSNT */
 102
 103 #ifndef F_OK
 104 #define F_OK 0
 105 #define X_OK 1
 106 #define W_OK 2
 107 #define R_OK 4
 108 #endif
 109
 110 #ifdef WINDOWSNT
 111 #include <sys/locking.h>
 112 #endif
 113
 114 #ifdef MAIL_USE_LOCKF
 115 #define MAIL_USE_SYSTEM_LOCK
 116 #endif
 117
 118 #ifdef MAIL_USE_FLOCK
 119 #define MAIL_USE_SYSTEM_LOCK
 120 #endif
 121
 122 #ifdef MAIL_USE_MMDF
 123 extern int lk_open (), lk_close ();
 124 #endif
 125
 126 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 127         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 128         defined (HAVE_MAILLOCK_H)
 129 #include <maillock.h>
 130 /* We can't use maillock unless we know what directory system mail
 131    files appear in. */
 132 #ifdef MAILDIR
 133 #define MAIL_USE_MAILLOCK
 134 static char *mail_spool_name ();
 135 #endif
 136 #endif
 137
 138 #ifndef HAVE_STRERROR
 139 char *strerror (int);
 140 #endif
 141
 142 static void fatal (const char *s1, const char *s2, const char *s3) NO_RETURN;
 143 static void error (const char *s1, const char *s2, const char *s3);
 144 static void pfatal_with_name (char *name) NO_RETURN;
 145 static void pfatal_and_delete (char *name) NO_RETURN;
 146 static char *concat (const char *s1, const char *s2, const char *s3);
 147 static long *xmalloc (unsigned int size);
 148 #ifdef MAIL_USE_POP
 149 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 150 static int pop_retr (popserver server, int msgno, FILE *arg);
 151 static int mbx_write (char *line, int len, FILE *mbf);
 152 static int mbx_delimit_begin (FILE *mbf);
 153 static int mbx_delimit_end (FILE *mbf);
 154 #endif
 155
 156 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 157 static char *delete_lockname;
 158
 159 int
 160 main (int argc, char **argv)
 161 {
 162   char *inname, *outname;
 163   int indesc, outdesc;
 164   ssize_t nread;
 165   int wait_status;
 166   int c, preserve_mail = 0;
 167
 168 #ifndef MAIL_USE_SYSTEM_LOCK
 169   struct stat st;
 170   long now;
 171   int tem;
 172   char *lockname, *p;
 173   char *tempname;
 174   int desc;
 175 #endif /* not MAIL_USE_SYSTEM_LOCK */
 176
 177 #ifdef MAIL_USE_MAILLOCK
 178   char *spool_name;
 179 #endif
 180
 181 #ifdef MAIL_USE_POP
 182   int pop_reverse_order = 0;
 183 # define ARGSTR "pr"
 184 #else /* ! MAIL_USE_POP */
 185 # define ARGSTR "p"
 186 #endif /* MAIL_USE_POP */
 187
 188   uid_t real_gid = getgid();
 189   uid_t priv_gid = getegid();
 190
 191 #ifdef WINDOWSNT
 192   /* Ensure all file i/o is in binary mode. */
 193   _fmode = _O_BINARY;
 194 #endif
 195
 196   delete_lockname = 0;
 197
 198   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 199     {
 200       switch (c) {
 201 #ifdef MAIL_USE_POP
 202       case 'r':
 203         pop_reverse_order = 1;
 204         break;
 205 #endif
 206       case 'p':
 207         preserve_mail++;
 208         break;
 209       default:
 210         exit (EXIT_FAILURE);
 211       }
 212     }
 213
 214   if (
 215 #ifdef MAIL_USE_POP
 216       (argc - optind < 2) || (argc - optind > 3)
 217 #else
 218       (argc - optind != 2)
 219 #endif
 220       )
 221     {
 222 #ifdef MAIL_USE_POP
 223       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 224                " [POP-password]");
 225 #else
 226       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 227 #endif
 228       exit (EXIT_FAILURE);
 229     }
 230
 231   inname = argv[optind];
 232   outname = argv[optind+1];
 233
 234 #ifdef MAIL_USE_MMDF
 235   mmdf_init (argv[0]);
 236 #endif
 237
 238   if (*outname == 0)
 239     fatal ("Destination file name is empty", 0, 0);
 240
 241 #ifdef MAIL_USE_POP
 242   if (!strncmp (inname, "po:", 3))
 243     {
 244       int status;
 245
 246       status = popmail (inname + 3, outname, preserve_mail,
 247                         (argc - optind == 3) ? argv[optind+2] : NULL,
 248                         pop_reverse_order);
 249       exit (status);
 250     }
 251
 252   if (setuid (getuid ()) < 0)
 253     fatal ("Failed to drop privileges", 0, 0);
 254
 255 #endif /* MAIL_USE_POP */
 256
 257 #ifndef DISABLE_DIRECT_ACCESS
 258 #ifndef MAIL_USE_MMDF
 259 #ifndef MAIL_USE_SYSTEM_LOCK
 260 #ifdef MAIL_USE_MAILLOCK
 261   spool_name = mail_spool_name (inname);
 262   if (! spool_name)
 263 #endif
 264     {
 265       /* Use a lock file named after our first argument with .lock appended:
 266          If it exists, the mail file is locked.  */
 267       /* Note: this locking mechanism is *required* by the mailer
 268          (on systems which use it) to prevent loss of mail.
 269
 270          On systems that use a lock file, extracting the mail without locking
 271          WILL occasionally cause loss of mail due to timing errors!
 272
 273          So, if creation of the lock file fails
 274          due to access permission on the mail spool directory,
 275          you simply MUST change the permission
 276          and/or make movemail a setgid program
 277          so it can create lock files properly.
 278
 279          You might also wish to verify that your system is one
 280          which uses lock files for this purpose.  Some systems use other methods.
 281
 282          If your system uses the `flock' system call for mail locking,
 283          define MAIL_USE_SYSTEM_LOCK in config.h or the s-*.h file
 284          and recompile movemail.  If the s- file for your system
 285          should define MAIL_USE_SYSTEM_LOCK but does not, send a bug report
 286          to bug-gnu-emacs@prep.ai.mit.edu so we can fix it.  */
 287
 288       lockname = concat (inname, ".lock", "");
 289       tempname = (char *) xmalloc (strlen (inname) + strlen ("EXXXXXX") + 1);
 290       strcpy (tempname, inname);
 291       p = tempname + strlen (tempname);
 292       while (p != tempname && !IS_DIRECTORY_SEP (p[-1]))
 293         p--;
 294       *p = 0;
 295       strcpy (p, "EXXXXXX");
 296       mktemp (tempname);
 297       unlink (tempname);
 298
 299       while (1)
 300         {
 301           /* Create the lock file, but not under the lock file name.  */
 302           /* Give up if cannot do that.  */
 303           desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 304           if (desc < 0)
 305             {
 306               char *message = (char *) xmalloc (strlen (tempname) + 50);
 307               sprintf (message, "creating %s, which would become the lock file",
 308                        tempname);
 309               pfatal_with_name (message);
 310             }
 311           close (desc);
 312
 313           tem = link (tempname, lockname);
 314
 315 #ifdef EPERM
 316           if (tem < 0 && errno == EPERM)
 317             fatal ("Unable to create hard link between %s and %s",
 318                    tempname, lockname);
 319 #endif
 320
 321           unlink (tempname);
 322           if (tem >= 0)
 323             break;
 324           sleep (1);
 325
 326           /* If lock file is five minutes old, unlock it.
 327              Five minutes should be good enough to cope with crashes
 328              and wedgitude, and long enough to avoid being fooled
 329              by time differences between machines.  */
 330           if (stat (lockname, &st) >= 0)
 331             {
 332               now = time (0);
 333               if (st.st_ctime < now - 300)
 334                 unlink (lockname);
 335             }
 336         }
 337
 338       delete_lockname = lockname;
 339     }
 340 #endif /* not MAIL_USE_SYSTEM_LOCK */
 341 #endif /* not MAIL_USE_MMDF */
 342
 343   if (fork () == 0)
 344     {
 345       int lockcount = 0;
 346       int status = 0;
 347 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 348       time_t touched_lock, now;
 349 #endif
 350
 351       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 352         fatal ("Failed to drop privileges", 0, 0);
 353
 354 #ifndef MAIL_USE_MMDF
 355 #ifdef MAIL_USE_SYSTEM_LOCK
 356       indesc = open (inname, O_RDWR);
 357 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 358       indesc = open (inname, O_RDONLY);
 359 #endif /* not MAIL_USE_SYSTEM_LOCK */
 360 #else  /* MAIL_USE_MMDF */
 361       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 362 #endif /* MAIL_USE_MMDF */
 363
 364       if (indesc < 0)
 365         pfatal_with_name (inname);
 366
 367 #ifdef BSD_SYSTEM
 368       /* In case movemail is setuid to root, make sure the user can
 369          read the output file.  */
 370       /* This is desirable for all systems
 371          but I don't want to assume all have the umask system call */
 372       umask (umask (0) & 0333);
 373 #endif /* BSD_SYSTEM */
 374       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 375       if (outdesc < 0)
 376         pfatal_with_name (outname);
 377
 378       if (setregid (-1, priv_gid) < 0)
 379         fatal ("Failed to regain privileges", 0, 0);
 380
 381       /* This label exists so we can retry locking
 382          after a delay, if it got EAGAIN or EBUSY.  */
 383     retry_lock:
 384
 385       /* Try to lock it.  */
 386 #ifdef MAIL_USE_MAILLOCK
 387       if (spool_name)
 388         {
 389           /* The "0 - " is to make it a negative number if maillock returns
 390              non-zero. */
 391           status = 0 - maillock (spool_name, 1);
 392 #ifdef HAVE_TOUCHLOCK
 393           touched_lock = time (0);
 394 #endif
 395           lockcount = 5;
 396         }
 397       else
 398 #endif /* MAIL_USE_MAILLOCK */
 399         {
 400 #ifdef MAIL_USE_SYSTEM_LOCK
 401 #ifdef MAIL_USE_LOCKF
 402           status = lockf (indesc, F_LOCK, 0);
 403 #else /* not MAIL_USE_LOCKF */
 404 #ifdef WINDOWSNT
 405           status = locking (indesc, LK_RLCK, -1L);
 406 #else
 407           status = flock (indesc, LOCK_EX);
 408 #endif
 409 #endif /* not MAIL_USE_LOCKF */
 410 #endif /* MAIL_USE_SYSTEM_LOCK */
 411         }
 412
 413       /* If it fails, retry up to 5 times
 414          for certain failure codes.  */
 415       if (status < 0)
 416         {
 417           if (++lockcount <= 5)
 418             {
 419 #ifdef EAGAIN
 420               if (errno == EAGAIN)
 421                 {
 422                   sleep (1);
 423                   goto retry_lock;
 424                 }
 425 #endif
 426 #ifdef EBUSY
 427               if (errno == EBUSY)
 428                 {
 429                   sleep (1);
 430                   goto retry_lock;
 431                 }
 432 #endif
 433             }
 434
 435           pfatal_with_name (inname);
 436         }
 437
 438       {
 439         char buf[1024];
 440
 441         while (1)
 442           {
 443             nread = read (indesc, buf, sizeof buf);
 444             if (nread < 0)
 445               pfatal_with_name (inname);
 446             if (nread != write (outdesc, buf, nread))
 447               {
 448                 int saved_errno = errno;
 449                 unlink (outname);
 450                 errno = saved_errno;
 451                 pfatal_with_name (outname);
 452               }
 453             if (nread < sizeof buf)
 454               break;
 455 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 456             if (spool_name)
 457               {
 458                 now = time (0);
 459                 if (now - touched_lock > 60)
 460                   {
 461                     touchlock ();
 462                     touched_lock = now;
 463                   }
 464               }
 465 #endif /* MAIL_USE_MAILLOCK */
 466           }
 467       }
 468
 469 #ifdef BSD_SYSTEM
 470       if (fsync (outdesc) < 0)
 471         pfatal_and_delete (outname);
 472 #endif
 473
 474       /* Prevent symlink attacks truncating other users' mailboxes */
 475       if (setregid (-1, real_gid) < 0)
 476         fatal ("Failed to drop privileges", 0, 0);
 477
 478       /* Check to make sure no errors before we zap the inbox.  */
 479       if (close (outdesc) != 0)
 480         pfatal_and_delete (outname);
 481
 482 #ifdef MAIL_USE_SYSTEM_LOCK
 483       if (! preserve_mail)
 484         {
 485           if (ftruncate (indesc, 0L) != 0)
 486             pfatal_with_name (inname);
 487         }
 488 #endif /* MAIL_USE_SYSTEM_LOCK */
 489
 490 #ifdef MAIL_USE_MMDF
 491       lk_close (indesc, 0, 0, 0);
 492 #else
 493       close (indesc);
 494 #endif
 495
 496 #ifndef MAIL_USE_SYSTEM_LOCK
 497       if (! preserve_mail)
 498         {
 499           /* Delete the input file; if we can't, at least get rid of its
 500              contents.  */
 501 #ifdef MAIL_UNLINK_SPOOL
 502           /* This is generally bad to do, because it destroys the permissions
 503              that were set on the file.  Better to just empty the file.  */
 504           if (unlink (inname) < 0 && errno != ENOENT)
 505 #endif /* MAIL_UNLINK_SPOOL */
 506             creat (inname, 0600);
 507         }
 508 #endif /* not MAIL_USE_SYSTEM_LOCK */
 509
 510       /* End of mailbox truncation */
 511       if (setregid (-1, priv_gid) < 0)
 512         fatal ("Failed to regain privileges", 0, 0);
 513
 514 #ifdef MAIL_USE_MAILLOCK
 515       /* This has to occur in the child, i.e., in the process that
 516          acquired the lock! */
 517       if (spool_name)
 518         mailunlock ();
 519 #endif
 520       exit (EXIT_SUCCESS);
 521     }
 522
 523   wait (&wait_status);
 524   if (!WIFEXITED (wait_status))
 525     exit (EXIT_FAILURE);
 526   else if (WRETCODE (wait_status) != 0)
 527     exit (WRETCODE (wait_status));
 528
 529 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 530 #ifdef MAIL_USE_MAILLOCK
 531   if (! spool_name)
 532 #endif /* MAIL_USE_MAILLOCK */
 533     unlink (lockname);
 534 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 535
 536 #endif /* ! DISABLE_DIRECT_ACCESS */
 537
 538   return EXIT_SUCCESS;
 539 }
 540
 541 #ifdef MAIL_USE_MAILLOCK
 542 /* This function uses stat to confirm that the mail directory is
 543    identical to the directory of the input file, rather than just
 544    string-comparing the two paths, because one or both of them might
 545    be symbolic links pointing to some other directory. */
 546 static char *
 547 mail_spool_name (char *inname)
 548 {
 549   struct stat stat1, stat2;
 550   char *indir, *fname;
 551   int status;
 552
 553   if (! (fname = strrchr (inname, '/')))
 554     return NULL;
 555
 556   fname++;
 557
 558   if (stat (MAILDIR, &stat1) < 0)
 559     return NULL;
 560
 561   indir = (char *) xmalloc (fname - inname + 1);
 562   strncpy (indir, inname, fname - inname);
 563   indir[fname-inname] = '\0';
 564
 565
 566   status = stat (indir, &stat2);
 567
 568   free (indir);
 569
 570   if (status < 0)
 571     return NULL;
 572
 573   if (stat1.st_dev == stat2.st_dev
 574       && stat1.st_ino == stat2.st_ino)
 575     return fname;
 576
 577   return NULL;
 578 }
 579 #endif /* MAIL_USE_MAILLOCK */
 580 \f
 581 /* Print error message and exit.  */
 582
 583 static void
 584 fatal (const char *s1, const char *s2, const char *s3)
 585 {
 586   if (delete_lockname)
 587     unlink (delete_lockname);
 588   error (s1, s2, s3);
 589   exit (EXIT_FAILURE);
 590 }
 591
 592 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 593    are args for it or null. */
 594
 595 static void
 596 error (const char *s1, const char *s2, const char *s3)
 597 {
 598   fprintf (stderr, "movemail: ");
 599   if (s3)
 600     fprintf (stderr, s1, s2, s3);
 601   else if (s2)
 602     fprintf (stderr, s1, s2);
 603   else
 604     fprintf (stderr, "%s", s1);
 605   fprintf (stderr, "\n");
 606 }
 607
 608 static void
 609 pfatal_with_name (char *name)
 610 {
 611   fatal ("%s for %s", strerror (errno), name);
 612 }
 613
 614 static void
 615 pfatal_and_delete (char *name)
 616 {
 617   char *s = strerror (errno);
 618   unlink (name);
 619   fatal ("%s for %s", s, name);
 620 }
 621
 622 /* Return a newly-allocated string whose contents concatenate those of s1, s2, s3.  */
 623
 624 static char *
 625 concat (const char *s1, const char *s2, const char *s3)
 626 {
 627   size_t len1 = strlen (s1), len2 = strlen (s2), len3 = strlen (s3);
 628   char *result = (char *) xmalloc (len1 + len2 + len3 + 1);
 629
 630   strcpy (result, s1);
 631   strcpy (result + len1, s2);
 632   strcpy (result + len1 + len2, s3);
 633   *(result + len1 + len2 + len3) = 0;
 634
 635   return result;
 636 }
 637
 638 /* Like malloc but get fatal error if memory is exhausted.  */
 639
 640 static long *
 641 xmalloc (unsigned int size)
 642 {
 643   long *result = (long *) malloc (size);
 644   if (!result)
 645     fatal ("virtual memory exhausted", 0, 0);
 646   return result;
 647 }
 648 \f
 649 /* This is the guts of the interface to the Post Office Protocol.  */
 650
 651 #ifdef MAIL_USE_POP
 652
 653 #ifndef WINDOWSNT
 654 #include <sys/socket.h>
 655 #include <netinet/in.h>
 656 #include <netdb.h>
 657 #else
 658 #undef _WINSOCKAPI_
 659 #include <winsock.h>
 660 #endif
 661 #include <pwd.h>
 662 #include <string.h>
 663
 664 #define NOTOK (-1)
 665 #define OK 0
 666
 667 static char Errmsg[200];        /* POP errors, at least, can exceed
 668                                    the original length of 80.  */
 669
 670 /*
 671  * The full valid syntax for a POP mailbox specification for movemail
 672  * is "po:username:hostname".  The ":hostname" is optional; if it is
 673  * omitted, the MAILHOST environment variable will be consulted.  Note
 674  * that by the time popmail() is called the "po:" has been stripped
 675  * off of the front of the mailbox name.
 676  *
 677  * If the mailbox is in the form "po:username:hostname", then it is
 678  * modified by this function -- the second colon is replaced by a
 679  * null.
 680  *
 681  * Return a value suitable for passing to `exit'.
 682  */
 683
 684 static int
 685 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 686 {
 687   int nmsgs, nbytes;
 688   register int i;
 689   int mbfi;
 690   FILE *mbf;
 691   char *getenv (const char *);
 692   popserver server;
 693   int start, end, increment;
 694   char *user, *hostname;
 695
 696   user = mailbox;
 697   if ((hostname = strchr (mailbox, ':')))
 698     *hostname++ = '\0';
 699
 700   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 701   if (! server)
 702     {
 703       error ("Error connecting to POP server: %s", pop_error, 0);
 704       return EXIT_FAILURE;
 705     }
 706
 707   if (pop_stat (server, &nmsgs, &nbytes))
 708     {
 709       error ("Error getting message count from POP server: %s", pop_error, 0);
 710       return EXIT_FAILURE;
 711     }
 712
 713   if (!nmsgs)
 714     {
 715       pop_close (server);
 716       return EXIT_SUCCESS;
 717     }
 718
 719   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 720   if (mbfi < 0)
 721     {
 722       pop_close (server);
 723       error ("Error in open: %s, %s", strerror (errno), outfile);
 724       return EXIT_FAILURE;
 725     }
 726   fchown (mbfi, getuid (), -1);
 727
 728   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 729     {
 730       pop_close (server);
 731       error ("Error in fdopen: %s", strerror (errno), 0);
 732       close (mbfi);
 733       unlink (outfile);
 734       return EXIT_FAILURE;
 735     }
 736
 737   if (reverse_order)
 738     {
 739       start = nmsgs;
 740       end = 1;
 741       increment = -1;
 742     }
 743   else
 744     {
 745       start = 1;
 746       end = nmsgs;
 747       increment = 1;
 748     }
 749
 750   for (i = start; i * increment <= end * increment; i += increment)
 751     {
 752       mbx_delimit_begin (mbf);
 753       if (pop_retr (server, i, mbf) != OK)
 754         {
 755           error ("%s", Errmsg, 0);
 756           close (mbfi);
 757           return EXIT_FAILURE;
 758         }
 759       mbx_delimit_end (mbf);
 760       fflush (mbf);
 761       if (ferror (mbf))
 762         {
 763           error ("Error in fflush: %s", strerror (errno), 0);
 764           pop_close (server);
 765           close (mbfi);
 766           return EXIT_FAILURE;
 767         }
 768     }
 769
 770   /* On AFS, a call to write only modifies the file in the local
 771    *     workstation's AFS cache.  The changes are not written to the server
 772    *      until a call to fsync or close is made.  Users with AFS home
 773    *      directories have lost mail when over quota because these checks were
 774    *      not made in previous versions of movemail. */
 775
 776 #ifdef BSD_SYSTEM
 777   if (fsync (mbfi) < 0)
 778     {
 779       error ("Error in fsync: %s", strerror (errno), 0);
 780       return EXIT_FAILURE;
 781     }
 782 #endif
 783
 784   if (close (mbfi) == -1)
 785     {
 786       error ("Error in close: %s", strerror (errno), 0);
 787       return EXIT_FAILURE;
 788     }
 789
 790   if (! preserve)
 791     for (i = 1; i <= nmsgs; i++)
 792       {
 793         if (pop_delete (server, i))
 794           {
 795             error ("Error from POP server: %s", pop_error, 0);
 796             pop_close (server);
 797             return EXIT_FAILURE;
 798           }
 799       }
 800
 801   if (pop_quit (server))
 802     {
 803       error ("Error from POP server: %s", pop_error, 0);
 804       return EXIT_FAILURE;
 805     }
 806
 807   return EXIT_SUCCESS;
 808 }
 809
 810 static int
 811 pop_retr (popserver server, int msgno, FILE *arg)
 812 {
 813   char *line;
 814   int ret;
 815
 816   if (pop_retrieve_first (server, msgno, &line))
 817     {
 818       char *msg = concat ("Error from POP server: ", pop_error, "");
 819       strncpy (Errmsg, msg, sizeof (Errmsg));
 820       Errmsg[sizeof (Errmsg)-1] = '\0';
 821       free (msg);
 822       return (NOTOK);
 823     }
 824
 825   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 826     {
 827       if (! line)
 828         break;
 829
 830       if (mbx_write (line, ret, arg) != OK)
 831         {
 832           strcpy (Errmsg, strerror (errno));
 833           pop_close (server);
 834           return (NOTOK);
 835         }
 836     }
 837
 838   if (ret)
 839     {
 840       char *msg = concat ("Error from POP server: ", pop_error, "");
 841       strncpy (Errmsg, msg, sizeof (Errmsg));
 842       Errmsg[sizeof (Errmsg)-1] = '\0';
 843       free (msg);
 844       return (NOTOK);
 845     }
 846
 847   return (OK);
 848 }
 849
 850 static int
 851 mbx_write (char *line, int len, FILE *mbf)
 852 {
 853 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 854   if (IS_FROM_LINE (line))
 855     {
 856       if (fputc ('>', mbf) == EOF)
 857         return (NOTOK);
 858     }
 859 #endif
 860   if (line[0] == '\037')
 861     {
 862       if (fputs ("^_", mbf) == EOF)
 863         return (NOTOK);
 864       line++;
 865       len--;
 866     }
 867   if (fwrite (line, 1, len, mbf) != len)
 868     return (NOTOK);
 869   if (fputc (0x0a, mbf) == EOF)
 870     return (NOTOK);
 871   return (OK);
 872 }
 873
 874 static int
 875 mbx_delimit_begin (FILE *mbf)
 876 {
 877   time_t now;
 878   struct tm *ltime;
 879   char fromline[40] = "From movemail ";
 880
 881   now = time (NULL);
 882   ltime = localtime (&now);
 883
 884   strcat (fromline, asctime (ltime));
 885
 886   if (fputs (fromline, mbf) == EOF)
 887     return (NOTOK);
 888   return (OK);
 889 }
 890
 891 static int
 892 mbx_delimit_end (FILE *mbf)
 893 {
 894   if (putc ('\n', mbf) == EOF)
 895     return (NOTOK);
 896   return (OK);
 897 }
 898
 899 #endif /* MAIL_USE_POP */
 900 \f
 901 #ifndef HAVE_STRERROR
 902 char *
 903 strerror (errnum)
 904      int errnum;
 905 {
 906   extern char *sys_errlist[];
 907   extern int sys_nerr;
 908
 909   if (errnum >= 0 && errnum < sys_nerr)
 910     return sys_errlist[errnum];
 911   return (char *) "Unknown error";
 912 }
 913
 914 #endif /* ! HAVE_STRERROR */
 915
 916
 917 /* movemail.c ends here */