lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2012
   5   Free Software Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #ifdef HAVE_FCNTL_H
  69 #include <fcntl.h>
  70 #endif
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define wait(var) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifndef F_OK
 102 #define F_OK 0
 103 #define X_OK 1
 104 #define W_OK 2
 105 #define R_OK 4
 106 #endif
 107
 108 #ifdef WINDOWSNT
 109 #include <sys/locking.h>
 110 #endif
 111
 112 #ifdef MAIL_USE_LOCKF
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_FLOCK
 117 #define MAIL_USE_SYSTEM_LOCK
 118 #endif
 119
 120 #ifdef MAIL_USE_MMDF
 121 extern int lk_open (), lk_close ();
 122 #endif
 123
 124 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 125         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 126         defined (HAVE_MAILLOCK_H)
 127 #include <maillock.h>
 128 /* We can't use maillock unless we know what directory system mail
 129    files appear in. */
 130 #ifdef MAILDIR
 131 #define MAIL_USE_MAILLOCK
 132 static char *mail_spool_name (char *);
 133 #endif
 134 #endif
 135
 136 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 137 static void error (const char *s1, const char *s2, const char *s3);
 138 static _Noreturn void pfatal_with_name (char *name);
 139 static _Noreturn void pfatal_and_delete (char *name);
 140 #ifdef MAIL_USE_MAILLOCK
 141 static void *xmalloc (size_t size);
 142 #endif
 143 #ifdef MAIL_USE_POP
 144 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 145 static int pop_retr (popserver server, int msgno, FILE *arg);
 146 static int mbx_write (char *line, int len, FILE *mbf);
 147 static int mbx_delimit_begin (FILE *mbf);
 148 static int mbx_delimit_end (FILE *mbf);
 149 #endif
 150
 151 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 152 static char *delete_lockname;
 153
 154 int
 155 main (int argc, char **argv)
 156 {
 157   char *inname, *outname;
 158   int indesc, outdesc;
 159   ssize_t nread;
 160   int wait_status;
 161   int c, preserve_mail = 0;
 162
 163 #ifndef MAIL_USE_SYSTEM_LOCK
 164   struct stat st;
 165   int tem;
 166   char *lockname;
 167   char *tempname;
 168   size_t inname_dirlen;
 169   int desc;
 170 #endif /* not MAIL_USE_SYSTEM_LOCK */
 171
 172 #ifdef MAIL_USE_MAILLOCK
 173   char *spool_name;
 174 #endif
 175
 176 #ifdef MAIL_USE_POP
 177   int pop_reverse_order = 0;
 178 # define ARGSTR "pr"
 179 #else /* ! MAIL_USE_POP */
 180 # define ARGSTR "p"
 181 #endif /* MAIL_USE_POP */
 182
 183   uid_t real_gid = getgid ();
 184   uid_t priv_gid = getegid ();
 185
 186 #ifdef WINDOWSNT
 187   /* Ensure all file i/o is in binary mode. */
 188   _fmode = _O_BINARY;
 189 #endif
 190
 191   delete_lockname = 0;
 192
 193   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 194     {
 195       switch (c) {
 196 #ifdef MAIL_USE_POP
 197       case 'r':
 198         pop_reverse_order = 1;
 199         break;
 200 #endif
 201       case 'p':
 202         preserve_mail++;
 203         break;
 204       default:
 205         exit (EXIT_FAILURE);
 206       }
 207     }
 208
 209   if (
 210 #ifdef MAIL_USE_POP
 211       (argc - optind < 2) || (argc - optind > 3)
 212 #else
 213       (argc - optind != 2)
 214 #endif
 215       )
 216     {
 217 #ifdef MAIL_USE_POP
 218       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 219                " [POP-password]");
 220 #else
 221       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 222 #endif
 223       exit (EXIT_FAILURE);
 224     }
 225
 226   inname = argv[optind];
 227   outname = argv[optind+1];
 228
 229 #ifdef MAIL_USE_MMDF
 230   mmdf_init (argv[0]);
 231 #endif
 232
 233   if (*outname == 0)
 234     fatal ("Destination file name is empty", 0, 0);
 235
 236 #ifdef MAIL_USE_POP
 237   if (!strncmp (inname, "po:", 3))
 238     {
 239       int status;
 240
 241       status = popmail (inname + 3, outname, preserve_mail,
 242                         (argc - optind == 3) ? argv[optind+2] : NULL,
 243                         pop_reverse_order);
 244       exit (status);
 245     }
 246
 247   if (setuid (getuid ()) < 0)
 248     fatal ("Failed to drop privileges", 0, 0);
 249
 250 #endif /* MAIL_USE_POP */
 251
 252 #ifndef DISABLE_DIRECT_ACCESS
 253 #ifndef MAIL_USE_MMDF
 254 #ifndef MAIL_USE_SYSTEM_LOCK
 255 #ifdef MAIL_USE_MAILLOCK
 256   spool_name = mail_spool_name (inname);
 257   if (spool_name)
 258     {
 259 #ifdef lint
 260       lockname = 0;
 261 #endif
 262     }
 263   else
 264 #endif
 265     {
 266       #ifndef DIRECTORY_SEP
 267        #define DIRECTORY_SEP '/'
 268       #endif
 269       #ifndef IS_DIRECTORY_SEP
 270        #define IS_DIRECTORY_SEP(_c_) ((_c_) == DIRECTORY_SEP)
 271       #endif
 272
 273       /* Use a lock file named after our first argument with .lock appended:
 274          If it exists, the mail file is locked.  */
 275       /* Note: this locking mechanism is *required* by the mailer
 276          (on systems which use it) to prevent loss of mail.
 277
 278          On systems that use a lock file, extracting the mail without locking
 279          WILL occasionally cause loss of mail due to timing errors!
 280
 281          So, if creation of the lock file fails
 282          due to access permission on the mail spool directory,
 283          you simply MUST change the permission
 284          and/or make movemail a setgid program
 285          so it can create lock files properly.
 286
 287          You might also wish to verify that your system is one
 288          which uses lock files for this purpose.  Some systems use other methods.
 289
 290          If your system uses the `flock' system call for mail locking,
 291          define MAIL_USE_SYSTEM_LOCK in config.h or the s-*.h file
 292          and recompile movemail.  If the s- file for your system
 293          should define MAIL_USE_SYSTEM_LOCK but does not, send a bug report
 294          to bug-gnu-emacs@prep.ai.mit.edu so we can fix it.  */
 295
 296       lockname = concat (inname, ".lock", "");
 297       for (inname_dirlen = strlen (inname);
 298            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 299            inname_dirlen--)
 300         continue;
 301       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 302
 303       while (1)
 304         {
 305           /* Create the lock file, but not under the lock file name.  */
 306           /* Give up if cannot do that.  */
 307
 308           memcpy (tempname, inname, inname_dirlen);
 309           strcpy (tempname + inname_dirlen, "EXXXXXX");
 310 #ifdef HAVE_MKSTEMP
 311           desc = mkstemp (tempname);
 312 #else
 313           mktemp (tempname);
 314           if (!*tempname)
 315             desc = -1;
 316           else
 317             {
 318               unlink (tempname);
 319               desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 320             }
 321 #endif
 322           if (desc < 0)
 323             {
 324               int mkstemp_errno = errno;
 325               error ("error while creating what would become the lock file",
 326                      0, 0);
 327               errno = mkstemp_errno;
 328               pfatal_with_name (tempname);
 329             }
 330           close (desc);
 331
 332           tem = link (tempname, lockname);
 333
 334 #ifdef EPERM
 335           if (tem < 0 && errno == EPERM)
 336             fatal ("Unable to create hard link between %s and %s",
 337                    tempname, lockname);
 338 #endif
 339
 340           unlink (tempname);
 341           if (tem >= 0)
 342             break;
 343           sleep (1);
 344
 345           /* If lock file is five minutes old, unlock it.
 346              Five minutes should be good enough to cope with crashes
 347              and wedgitude, and long enough to avoid being fooled
 348              by time differences between machines.  */
 349           if (stat (lockname, &st) >= 0)
 350             {
 351               time_t now = time (0);
 352               if (st.st_ctime < now - 300)
 353                 unlink (lockname);
 354             }
 355         }
 356
 357       delete_lockname = lockname;
 358     }
 359 #endif /* not MAIL_USE_SYSTEM_LOCK */
 360 #endif /* not MAIL_USE_MMDF */
 361
 362   if (fork () == 0)
 363     {
 364       int lockcount = 0;
 365       int status = 0;
 366 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 367       time_t touched_lock;
 368 # ifdef lint
 369       touched_lock = 0;
 370 # endif
 371 #endif
 372
 373       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 374         fatal ("Failed to drop privileges", 0, 0);
 375
 376 #ifndef MAIL_USE_MMDF
 377 #ifdef MAIL_USE_SYSTEM_LOCK
 378       indesc = open (inname, O_RDWR);
 379 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 380       indesc = open (inname, O_RDONLY);
 381 #endif /* not MAIL_USE_SYSTEM_LOCK */
 382 #else  /* MAIL_USE_MMDF */
 383       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 384 #endif /* MAIL_USE_MMDF */
 385
 386       if (indesc < 0)
 387         pfatal_with_name (inname);
 388
 389 #ifdef BSD_SYSTEM
 390       /* In case movemail is setuid to root, make sure the user can
 391          read the output file.  */
 392       /* This is desirable for all systems
 393          but I don't want to assume all have the umask system call */
 394       umask (umask (0) & 0333);
 395 #endif /* BSD_SYSTEM */
 396       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 397       if (outdesc < 0)
 398         pfatal_with_name (outname);
 399
 400       if (setregid (-1, priv_gid) < 0)
 401         fatal ("Failed to regain privileges", 0, 0);
 402
 403       /* This label exists so we can retry locking
 404          after a delay, if it got EAGAIN or EBUSY.  */
 405     retry_lock:
 406
 407       /* Try to lock it.  */
 408 #ifdef MAIL_USE_MAILLOCK
 409       if (spool_name)
 410         {
 411           /* The "0 - " is to make it a negative number if maillock returns
 412              non-zero. */
 413           status = 0 - maillock (spool_name, 1);
 414 #ifdef HAVE_TOUCHLOCK
 415           touched_lock = time (0);
 416 #endif
 417           lockcount = 5;
 418         }
 419       else
 420 #endif /* MAIL_USE_MAILLOCK */
 421         {
 422 #ifdef MAIL_USE_SYSTEM_LOCK
 423 #ifdef MAIL_USE_LOCKF
 424           status = lockf (indesc, F_LOCK, 0);
 425 #else /* not MAIL_USE_LOCKF */
 426 #ifdef WINDOWSNT
 427           status = locking (indesc, LK_RLCK, -1L);
 428 #else
 429           status = flock (indesc, LOCK_EX);
 430 #endif
 431 #endif /* not MAIL_USE_LOCKF */
 432 #endif /* MAIL_USE_SYSTEM_LOCK */
 433         }
 434
 435       /* If it fails, retry up to 5 times
 436          for certain failure codes.  */
 437       if (status < 0)
 438         {
 439           if (++lockcount <= 5)
 440             {
 441 #ifdef EAGAIN
 442               if (errno == EAGAIN)
 443                 {
 444                   sleep (1);
 445                   goto retry_lock;
 446                 }
 447 #endif
 448 #ifdef EBUSY
 449               if (errno == EBUSY)
 450                 {
 451                   sleep (1);
 452                   goto retry_lock;
 453                 }
 454 #endif
 455             }
 456
 457           pfatal_with_name (inname);
 458         }
 459
 460       {
 461         char buf[1024];
 462
 463         while (1)
 464           {
 465             nread = read (indesc, buf, sizeof buf);
 466             if (nread < 0)
 467               pfatal_with_name (inname);
 468             if (nread != write (outdesc, buf, nread))
 469               {
 470                 int saved_errno = errno;
 471                 unlink (outname);
 472                 errno = saved_errno;
 473                 pfatal_with_name (outname);
 474               }
 475             if (nread < sizeof buf)
 476               break;
 477 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 478             if (spool_name)
 479               {
 480                 time_t now = time (0);
 481                 if (now - touched_lock > 60)
 482                   {
 483                     touchlock ();
 484                     touched_lock = now;
 485                   }
 486               }
 487 #endif /* MAIL_USE_MAILLOCK */
 488           }
 489       }
 490
 491 #ifdef BSD_SYSTEM
 492       if (fsync (outdesc) < 0)
 493         pfatal_and_delete (outname);
 494 #endif
 495
 496       /* Prevent symlink attacks truncating other users' mailboxes */
 497       if (setregid (-1, real_gid) < 0)
 498         fatal ("Failed to drop privileges", 0, 0);
 499
 500       /* Check to make sure no errors before we zap the inbox.  */
 501       if (close (outdesc) != 0)
 502         pfatal_and_delete (outname);
 503
 504 #ifdef MAIL_USE_SYSTEM_LOCK
 505       if (! preserve_mail)
 506         {
 507           if (ftruncate (indesc, 0L) != 0)
 508             pfatal_with_name (inname);
 509         }
 510 #endif /* MAIL_USE_SYSTEM_LOCK */
 511
 512 #ifdef MAIL_USE_MMDF
 513       lk_close (indesc, 0, 0, 0);
 514 #else
 515       close (indesc);
 516 #endif
 517
 518 #ifndef MAIL_USE_SYSTEM_LOCK
 519       if (! preserve_mail)
 520         {
 521           /* Delete the input file; if we can't, at least get rid of its
 522              contents.  */
 523 #ifdef MAIL_UNLINK_SPOOL
 524           /* This is generally bad to do, because it destroys the permissions
 525              that were set on the file.  Better to just empty the file.  */
 526           if (unlink (inname) < 0 && errno != ENOENT)
 527 #endif /* MAIL_UNLINK_SPOOL */
 528             creat (inname, 0600);
 529         }
 530 #endif /* not MAIL_USE_SYSTEM_LOCK */
 531
 532       /* End of mailbox truncation */
 533       if (setregid (-1, priv_gid) < 0)
 534         fatal ("Failed to regain privileges", 0, 0);
 535
 536 #ifdef MAIL_USE_MAILLOCK
 537       /* This has to occur in the child, i.e., in the process that
 538          acquired the lock! */
 539       if (spool_name)
 540         mailunlock ();
 541 #endif
 542       exit (EXIT_SUCCESS);
 543     }
 544
 545   wait (&wait_status);
 546   if (!WIFEXITED (wait_status))
 547     exit (EXIT_FAILURE);
 548   else if (WRETCODE (wait_status) != 0)
 549     exit (WRETCODE (wait_status));
 550
 551 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 552 #ifdef MAIL_USE_MAILLOCK
 553   if (! spool_name)
 554 #endif /* MAIL_USE_MAILLOCK */
 555     unlink (lockname);
 556 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 557
 558 #endif /* ! DISABLE_DIRECT_ACCESS */
 559
 560   return EXIT_SUCCESS;
 561 }
 562
 563 #ifdef MAIL_USE_MAILLOCK
 564 /* This function uses stat to confirm that the mail directory is
 565    identical to the directory of the input file, rather than just
 566    string-comparing the two paths, because one or both of them might
 567    be symbolic links pointing to some other directory. */
 568 static char *
 569 mail_spool_name (char *inname)
 570 {
 571   struct stat stat1, stat2;
 572   char *indir, *fname;
 573   int status;
 574
 575   if (! (fname = strrchr (inname, '/')))
 576     return NULL;
 577
 578   fname++;
 579
 580   if (stat (MAILDIR, &stat1) < 0)
 581     return NULL;
 582
 583   indir = xmalloc (fname - inname + 1);
 584   memcpy (indir, inname, fname - inname);
 585   indir[fname-inname] = '\0';
 586
 587
 588   status = stat (indir, &stat2);
 589
 590   free (indir);
 591
 592   if (status < 0)
 593     return NULL;
 594
 595   if (stat1.st_dev == stat2.st_dev
 596       && stat1.st_ino == stat2.st_ino)
 597     return fname;
 598
 599   return NULL;
 600 }
 601 #endif /* MAIL_USE_MAILLOCK */
 602 \f
 603 /* Print error message and exit.  */
 604
 605 static void
 606 fatal (const char *s1, const char *s2, const char *s3)
 607 {
 608   if (delete_lockname)
 609     unlink (delete_lockname);
 610   error (s1, s2, s3);
 611   exit (EXIT_FAILURE);
 612 }
 613
 614 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 615    are args for it or null. */
 616
 617 static void
 618 error (const char *s1, const char *s2, const char *s3)
 619 {
 620   fprintf (stderr, "movemail: ");
 621   if (s3)
 622     fprintf (stderr, s1, s2, s3);
 623   else if (s2)
 624     fprintf (stderr, s1, s2);
 625   else
 626     fprintf (stderr, "%s", s1);
 627   fprintf (stderr, "\n");
 628 }
 629
 630 static void
 631 pfatal_with_name (char *name)
 632 {
 633   fatal ("%s for %s", strerror (errno), name);
 634 }
 635
 636 static void
 637 pfatal_and_delete (char *name)
 638 {
 639   char *s = strerror (errno);
 640   unlink (name);
 641   fatal ("%s for %s", s, name);
 642 }
 643
 644 #ifdef MAIL_USE_MAILLOCK
 645 /* Like malloc but get fatal error if memory is exhausted.  */
 646
 647 static void *
 648 xmalloc (size_t size)
 649 {
 650   void *result = malloc (size);
 651   if (!result)
 652     fatal ("virtual memory exhausted", 0, 0);
 653   return result;
 654 }
 655 #endif
 656 \f
 657 /* This is the guts of the interface to the Post Office Protocol.  */
 658
 659 #ifdef MAIL_USE_POP
 660
 661 #ifndef WINDOWSNT
 662 #include <sys/socket.h>
 663 #include <netinet/in.h>
 664 #include <netdb.h>
 665 #else
 666 #undef _WINSOCKAPI_
 667 #include <winsock.h>
 668 #endif
 669 #include <pwd.h>
 670 #include <string.h>
 671
 672 #define NOTOK (-1)
 673 #define OK 0
 674
 675 static char Errmsg[200];        /* POP errors, at least, can exceed
 676                                    the original length of 80.  */
 677
 678 /*
 679  * The full valid syntax for a POP mailbox specification for movemail
 680  * is "po:username:hostname".  The ":hostname" is optional; if it is
 681  * omitted, the MAILHOST environment variable will be consulted.  Note
 682  * that by the time popmail() is called the "po:" has been stripped
 683  * off of the front of the mailbox name.
 684  *
 685  * If the mailbox is in the form "po:username:hostname", then it is
 686  * modified by this function -- the second colon is replaced by a
 687  * null.
 688  *
 689  * Return a value suitable for passing to `exit'.
 690  */
 691
 692 static int
 693 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 694 {
 695   int nmsgs, nbytes;
 696   register int i;
 697   int mbfi;
 698   FILE *mbf;
 699   char *getenv (const char *);
 700   popserver server;
 701   int start, end, increment;
 702   char *user, *hostname;
 703
 704   user = mailbox;
 705   if ((hostname = strchr (mailbox, ':')))
 706     *hostname++ = '\0';
 707
 708   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 709   if (! server)
 710     {
 711       error ("Error connecting to POP server: %s", pop_error, 0);
 712       return EXIT_FAILURE;
 713     }
 714
 715   if (pop_stat (server, &nmsgs, &nbytes))
 716     {
 717       error ("Error getting message count from POP server: %s", pop_error, 0);
 718       return EXIT_FAILURE;
 719     }
 720
 721   if (!nmsgs)
 722     {
 723       pop_close (server);
 724       return EXIT_SUCCESS;
 725     }
 726
 727   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 728   if (mbfi < 0)
 729     {
 730       pop_close (server);
 731       error ("Error in open: %s, %s", strerror (errno), outfile);
 732       return EXIT_FAILURE;
 733     }
 734
 735   if (fchown (mbfi, getuid (), -1) != 0)
 736     {
 737       int fchown_errno = errno;
 738       struct stat st;
 739       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 740         {
 741           pop_close (server);
 742           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 743           return EXIT_FAILURE;
 744         }
 745     }
 746
 747   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 748     {
 749       pop_close (server);
 750       error ("Error in fdopen: %s", strerror (errno), 0);
 751       close (mbfi);
 752       unlink (outfile);
 753       return EXIT_FAILURE;
 754     }
 755
 756   if (reverse_order)
 757     {
 758       start = nmsgs;
 759       end = 1;
 760       increment = -1;
 761     }
 762   else
 763     {
 764       start = 1;
 765       end = nmsgs;
 766       increment = 1;
 767     }
 768
 769   for (i = start; i * increment <= end * increment; i += increment)
 770     {
 771       mbx_delimit_begin (mbf);
 772       if (pop_retr (server, i, mbf) != OK)
 773         {
 774           error ("%s", Errmsg, 0);
 775           close (mbfi);
 776           return EXIT_FAILURE;
 777         }
 778       mbx_delimit_end (mbf);
 779       fflush (mbf);
 780       if (ferror (mbf))
 781         {
 782           error ("Error in fflush: %s", strerror (errno), 0);
 783           pop_close (server);
 784           close (mbfi);
 785           return EXIT_FAILURE;
 786         }
 787     }
 788
 789   /* On AFS, a call to write only modifies the file in the local
 790    *     workstation's AFS cache.  The changes are not written to the server
 791    *      until a call to fsync or close is made.  Users with AFS home
 792    *      directories have lost mail when over quota because these checks were
 793    *      not made in previous versions of movemail. */
 794
 795 #ifdef BSD_SYSTEM
 796   if (fsync (mbfi) < 0)
 797     {
 798       error ("Error in fsync: %s", strerror (errno), 0);
 799       return EXIT_FAILURE;
 800     }
 801 #endif
 802
 803   if (close (mbfi) == -1)
 804     {
 805       error ("Error in close: %s", strerror (errno), 0);
 806       return EXIT_FAILURE;
 807     }
 808
 809   if (! preserve)
 810     for (i = 1; i <= nmsgs; i++)
 811       {
 812         if (pop_delete (server, i))
 813           {
 814             error ("Error from POP server: %s", pop_error, 0);
 815             pop_close (server);
 816             return EXIT_FAILURE;
 817           }
 818       }
 819
 820   if (pop_quit (server))
 821     {
 822       error ("Error from POP server: %s", pop_error, 0);
 823       return EXIT_FAILURE;
 824     }
 825
 826   return EXIT_SUCCESS;
 827 }
 828
 829 static int
 830 pop_retr (popserver server, int msgno, FILE *arg)
 831 {
 832   char *line;
 833   int ret;
 834
 835   if (pop_retrieve_first (server, msgno, &line))
 836     {
 837       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 838       return (NOTOK);
 839     }
 840
 841   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 842     {
 843       if (! line)
 844         break;
 845
 846       if (mbx_write (line, ret, arg) != OK)
 847         {
 848           strcpy (Errmsg, strerror (errno));
 849           pop_close (server);
 850           return (NOTOK);
 851         }
 852     }
 853
 854   if (ret)
 855     {
 856       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 857       return (NOTOK);
 858     }
 859
 860   return (OK);
 861 }
 862
 863 static int
 864 mbx_write (char *line, int len, FILE *mbf)
 865 {
 866 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 867   /* Do this as a macro instead of using strcmp to save on execution time. */
 868   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 869                             && (a[1] == 'r')    \
 870                             && (a[2] == 'o')    \
 871                             && (a[3] == 'm')    \
 872                             && (a[4] == ' '))
 873   if (IS_FROM_LINE (line))
 874     {
 875       if (fputc ('>', mbf) == EOF)
 876         return (NOTOK);
 877     }
 878 #endif
 879   if (line[0] == '\037')
 880     {
 881       if (fputs ("^_", mbf) == EOF)
 882         return (NOTOK);
 883       line++;
 884       len--;
 885     }
 886   if (fwrite (line, 1, len, mbf) != len)
 887     return (NOTOK);
 888   if (fputc (0x0a, mbf) == EOF)
 889     return (NOTOK);
 890   return (OK);
 891 }
 892
 893 static int
 894 mbx_delimit_begin (FILE *mbf)
 895 {
 896   time_t now;
 897   struct tm *ltime;
 898   char fromline[40] = "From movemail ";
 899
 900   now = time (NULL);
 901   ltime = localtime (&now);
 902
 903   strcat (fromline, asctime (ltime));
 904
 905   if (fputs (fromline, mbf) == EOF)
 906     return (NOTOK);
 907   return (OK);
 908 }
 909
 910 static int
 911 mbx_delimit_end (FILE *mbf)
 912 {
 913   if (putc ('\n', mbf) == EOF)
 914     return (NOTOK);
 915   return (OK);
 916 }
 917
 918 #endif /* MAIL_USE_POP */