lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2012
   5   Free Software Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #ifdef HAVE_FCNTL_H
  69 #include <fcntl.h>
  70 #endif
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define wait(var) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifndef F_OK
 102 #define F_OK 0
 103 #define X_OK 1
 104 #define W_OK 2
 105 #define R_OK 4
 106 #endif
 107
 108 #ifdef WINDOWSNT
 109 #include <sys/locking.h>
 110 #endif
 111
 112 #ifdef MAIL_USE_LOCKF
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_FLOCK
 117 #define MAIL_USE_SYSTEM_LOCK
 118 #endif
 119
 120 #ifdef MAIL_USE_MMDF
 121 extern int lk_open (), lk_close ();
 122 #endif
 123
 124 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 125         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 126         defined (HAVE_MAILLOCK_H)
 127 #include <maillock.h>
 128 /* We can't use maillock unless we know what directory system mail
 129    files appear in. */
 130 #ifdef MAILDIR
 131 #define MAIL_USE_MAILLOCK
 132 static char *mail_spool_name (char *);
 133 #endif
 134 #endif
 135
 136 #ifndef HAVE_STRERROR
 137 char *strerror (int);
 138 #endif
 139
 140 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 141 static void error (const char *s1, const char *s2, const char *s3);
 142 static _Noreturn void pfatal_with_name (char *name);
 143 static _Noreturn void pfatal_and_delete (char *name);
 144 #ifdef MAIL_USE_MAILLOCK
 145 static void *xmalloc (size_t size);
 146 #endif
 147 #ifdef MAIL_USE_POP
 148 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 149 static int pop_retr (popserver server, int msgno, FILE *arg);
 150 static int mbx_write (char *line, int len, FILE *mbf);
 151 static int mbx_delimit_begin (FILE *mbf);
 152 static int mbx_delimit_end (FILE *mbf);
 153 #endif
 154
 155 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 156 static char *delete_lockname;
 157
 158 int
 159 main (int argc, char **argv)
 160 {
 161   char *inname, *outname;
 162   int indesc, outdesc;
 163   ssize_t nread;
 164   int wait_status;
 165   int c, preserve_mail = 0;
 166
 167 #ifndef MAIL_USE_SYSTEM_LOCK
 168   struct stat st;
 169   int tem;
 170   char *lockname;
 171   char *tempname;
 172   size_t inname_dirlen;
 173   int desc;
 174 #endif /* not MAIL_USE_SYSTEM_LOCK */
 175
 176 #ifdef MAIL_USE_MAILLOCK
 177   char *spool_name;
 178 #endif
 179
 180 #ifdef MAIL_USE_POP
 181   int pop_reverse_order = 0;
 182 # define ARGSTR "pr"
 183 #else /* ! MAIL_USE_POP */
 184 # define ARGSTR "p"
 185 #endif /* MAIL_USE_POP */
 186
 187   uid_t real_gid = getgid ();
 188   uid_t priv_gid = getegid ();
 189
 190 #ifdef WINDOWSNT
 191   /* Ensure all file i/o is in binary mode. */
 192   _fmode = _O_BINARY;
 193 #endif
 194
 195   delete_lockname = 0;
 196
 197   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 198     {
 199       switch (c) {
 200 #ifdef MAIL_USE_POP
 201       case 'r':
 202         pop_reverse_order = 1;
 203         break;
 204 #endif
 205       case 'p':
 206         preserve_mail++;
 207         break;
 208       default:
 209         exit (EXIT_FAILURE);
 210       }
 211     }
 212
 213   if (
 214 #ifdef MAIL_USE_POP
 215       (argc - optind < 2) || (argc - optind > 3)
 216 #else
 217       (argc - optind != 2)
 218 #endif
 219       )
 220     {
 221 #ifdef MAIL_USE_POP
 222       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 223                " [POP-password]");
 224 #else
 225       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 226 #endif
 227       exit (EXIT_FAILURE);
 228     }
 229
 230   inname = argv[optind];
 231   outname = argv[optind+1];
 232
 233 #ifdef MAIL_USE_MMDF
 234   mmdf_init (argv[0]);
 235 #endif
 236
 237   if (*outname == 0)
 238     fatal ("Destination file name is empty", 0, 0);
 239
 240 #ifdef MAIL_USE_POP
 241   if (!strncmp (inname, "po:", 3))
 242     {
 243       int status;
 244
 245       status = popmail (inname + 3, outname, preserve_mail,
 246                         (argc - optind == 3) ? argv[optind+2] : NULL,
 247                         pop_reverse_order);
 248       exit (status);
 249     }
 250
 251   if (setuid (getuid ()) < 0)
 252     fatal ("Failed to drop privileges", 0, 0);
 253
 254 #endif /* MAIL_USE_POP */
 255
 256 #ifndef DISABLE_DIRECT_ACCESS
 257 #ifndef MAIL_USE_MMDF
 258 #ifndef MAIL_USE_SYSTEM_LOCK
 259 #ifdef MAIL_USE_MAILLOCK
 260   spool_name = mail_spool_name (inname);
 261   if (spool_name)
 262     {
 263 #ifdef lint
 264       lockname = 0;
 265 #endif
 266     }
 267   else
 268 #endif
 269     {
 270       #ifndef DIRECTORY_SEP
 271        #define DIRECTORY_SEP '/'
 272       #endif
 273       #ifndef IS_DIRECTORY_SEP
 274        #define IS_DIRECTORY_SEP(_c_) ((_c_) == DIRECTORY_SEP)
 275       #endif
 276
 277       /* Use a lock file named after our first argument with .lock appended:
 278          If it exists, the mail file is locked.  */
 279       /* Note: this locking mechanism is *required* by the mailer
 280          (on systems which use it) to prevent loss of mail.
 281
 282          On systems that use a lock file, extracting the mail without locking
 283          WILL occasionally cause loss of mail due to timing errors!
 284
 285          So, if creation of the lock file fails
 286          due to access permission on the mail spool directory,
 287          you simply MUST change the permission
 288          and/or make movemail a setgid program
 289          so it can create lock files properly.
 290
 291          You might also wish to verify that your system is one
 292          which uses lock files for this purpose.  Some systems use other methods.
 293
 294          If your system uses the `flock' system call for mail locking,
 295          define MAIL_USE_SYSTEM_LOCK in config.h or the s-*.h file
 296          and recompile movemail.  If the s- file for your system
 297          should define MAIL_USE_SYSTEM_LOCK but does not, send a bug report
 298          to bug-gnu-emacs@prep.ai.mit.edu so we can fix it.  */
 299
 300       lockname = concat (inname, ".lock", "");
 301       for (inname_dirlen = strlen (inname);
 302            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 303            inname_dirlen--)
 304         continue;
 305       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 306
 307       while (1)
 308         {
 309           /* Create the lock file, but not under the lock file name.  */
 310           /* Give up if cannot do that.  */
 311
 312           memcpy (tempname, inname, inname_dirlen);
 313           strcpy (tempname + inname_dirlen, "EXXXXXX");
 314 #ifdef HAVE_MKSTEMP
 315           desc = mkstemp (tempname);
 316 #else
 317           mktemp (tempname);
 318           if (!*tempname)
 319             desc = -1;
 320           else
 321             {
 322               unlink (tempname);
 323               desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 324             }
 325 #endif
 326           if (desc < 0)
 327             {
 328               int mkstemp_errno = errno;
 329               error ("error while creating what would become the lock file",
 330                      0, 0);
 331               errno = mkstemp_errno;
 332               pfatal_with_name (tempname);
 333             }
 334           close (desc);
 335
 336           tem = link (tempname, lockname);
 337
 338 #ifdef EPERM
 339           if (tem < 0 && errno == EPERM)
 340             fatal ("Unable to create hard link between %s and %s",
 341                    tempname, lockname);
 342 #endif
 343
 344           unlink (tempname);
 345           if (tem >= 0)
 346             break;
 347           sleep (1);
 348
 349           /* If lock file is five minutes old, unlock it.
 350              Five minutes should be good enough to cope with crashes
 351              and wedgitude, and long enough to avoid being fooled
 352              by time differences between machines.  */
 353           if (stat (lockname, &st) >= 0)
 354             {
 355               time_t now = time (0);
 356               if (st.st_ctime < now - 300)
 357                 unlink (lockname);
 358             }
 359         }
 360
 361       delete_lockname = lockname;
 362     }
 363 #endif /* not MAIL_USE_SYSTEM_LOCK */
 364 #endif /* not MAIL_USE_MMDF */
 365
 366   if (fork () == 0)
 367     {
 368       int lockcount = 0;
 369       int status = 0;
 370 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 371       time_t touched_lock;
 372 # ifdef lint
 373       touched_lock = 0;
 374 # endif
 375 #endif
 376
 377       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 378         fatal ("Failed to drop privileges", 0, 0);
 379
 380 #ifndef MAIL_USE_MMDF
 381 #ifdef MAIL_USE_SYSTEM_LOCK
 382       indesc = open (inname, O_RDWR);
 383 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 384       indesc = open (inname, O_RDONLY);
 385 #endif /* not MAIL_USE_SYSTEM_LOCK */
 386 #else  /* MAIL_USE_MMDF */
 387       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 388 #endif /* MAIL_USE_MMDF */
 389
 390       if (indesc < 0)
 391         pfatal_with_name (inname);
 392
 393 #ifdef BSD_SYSTEM
 394       /* In case movemail is setuid to root, make sure the user can
 395          read the output file.  */
 396       /* This is desirable for all systems
 397          but I don't want to assume all have the umask system call */
 398       umask (umask (0) & 0333);
 399 #endif /* BSD_SYSTEM */
 400       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 401       if (outdesc < 0)
 402         pfatal_with_name (outname);
 403
 404       if (setregid (-1, priv_gid) < 0)
 405         fatal ("Failed to regain privileges", 0, 0);
 406
 407       /* This label exists so we can retry locking
 408          after a delay, if it got EAGAIN or EBUSY.  */
 409     retry_lock:
 410
 411       /* Try to lock it.  */
 412 #ifdef MAIL_USE_MAILLOCK
 413       if (spool_name)
 414         {
 415           /* The "0 - " is to make it a negative number if maillock returns
 416              non-zero. */
 417           status = 0 - maillock (spool_name, 1);
 418 #ifdef HAVE_TOUCHLOCK
 419           touched_lock = time (0);
 420 #endif
 421           lockcount = 5;
 422         }
 423       else
 424 #endif /* MAIL_USE_MAILLOCK */
 425         {
 426 #ifdef MAIL_USE_SYSTEM_LOCK
 427 #ifdef MAIL_USE_LOCKF
 428           status = lockf (indesc, F_LOCK, 0);
 429 #else /* not MAIL_USE_LOCKF */
 430 #ifdef WINDOWSNT
 431           status = locking (indesc, LK_RLCK, -1L);
 432 #else
 433           status = flock (indesc, LOCK_EX);
 434 #endif
 435 #endif /* not MAIL_USE_LOCKF */
 436 #endif /* MAIL_USE_SYSTEM_LOCK */
 437         }
 438
 439       /* If it fails, retry up to 5 times
 440          for certain failure codes.  */
 441       if (status < 0)
 442         {
 443           if (++lockcount <= 5)
 444             {
 445 #ifdef EAGAIN
 446               if (errno == EAGAIN)
 447                 {
 448                   sleep (1);
 449                   goto retry_lock;
 450                 }
 451 #endif
 452 #ifdef EBUSY
 453               if (errno == EBUSY)
 454                 {
 455                   sleep (1);
 456                   goto retry_lock;
 457                 }
 458 #endif
 459             }
 460
 461           pfatal_with_name (inname);
 462         }
 463
 464       {
 465         char buf[1024];
 466
 467         while (1)
 468           {
 469             nread = read (indesc, buf, sizeof buf);
 470             if (nread < 0)
 471               pfatal_with_name (inname);
 472             if (nread != write (outdesc, buf, nread))
 473               {
 474                 int saved_errno = errno;
 475                 unlink (outname);
 476                 errno = saved_errno;
 477                 pfatal_with_name (outname);
 478               }
 479             if (nread < sizeof buf)
 480               break;
 481 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 482             if (spool_name)
 483               {
 484                 time_t now = time (0);
 485                 if (now - touched_lock > 60)
 486                   {
 487                     touchlock ();
 488                     touched_lock = now;
 489                   }
 490               }
 491 #endif /* MAIL_USE_MAILLOCK */
 492           }
 493       }
 494
 495 #ifdef BSD_SYSTEM
 496       if (fsync (outdesc) < 0)
 497         pfatal_and_delete (outname);
 498 #endif
 499
 500       /* Prevent symlink attacks truncating other users' mailboxes */
 501       if (setregid (-1, real_gid) < 0)
 502         fatal ("Failed to drop privileges", 0, 0);
 503
 504       /* Check to make sure no errors before we zap the inbox.  */
 505       if (close (outdesc) != 0)
 506         pfatal_and_delete (outname);
 507
 508 #ifdef MAIL_USE_SYSTEM_LOCK
 509       if (! preserve_mail)
 510         {
 511           if (ftruncate (indesc, 0L) != 0)
 512             pfatal_with_name (inname);
 513         }
 514 #endif /* MAIL_USE_SYSTEM_LOCK */
 515
 516 #ifdef MAIL_USE_MMDF
 517       lk_close (indesc, 0, 0, 0);
 518 #else
 519       close (indesc);
 520 #endif
 521
 522 #ifndef MAIL_USE_SYSTEM_LOCK
 523       if (! preserve_mail)
 524         {
 525           /* Delete the input file; if we can't, at least get rid of its
 526              contents.  */
 527 #ifdef MAIL_UNLINK_SPOOL
 528           /* This is generally bad to do, because it destroys the permissions
 529              that were set on the file.  Better to just empty the file.  */
 530           if (unlink (inname) < 0 && errno != ENOENT)
 531 #endif /* MAIL_UNLINK_SPOOL */
 532             creat (inname, 0600);
 533         }
 534 #endif /* not MAIL_USE_SYSTEM_LOCK */
 535
 536       /* End of mailbox truncation */
 537       if (setregid (-1, priv_gid) < 0)
 538         fatal ("Failed to regain privileges", 0, 0);
 539
 540 #ifdef MAIL_USE_MAILLOCK
 541       /* This has to occur in the child, i.e., in the process that
 542          acquired the lock! */
 543       if (spool_name)
 544         mailunlock ();
 545 #endif
 546       exit (EXIT_SUCCESS);
 547     }
 548
 549   wait (&wait_status);
 550   if (!WIFEXITED (wait_status))
 551     exit (EXIT_FAILURE);
 552   else if (WRETCODE (wait_status) != 0)
 553     exit (WRETCODE (wait_status));
 554
 555 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 556 #ifdef MAIL_USE_MAILLOCK
 557   if (! spool_name)
 558 #endif /* MAIL_USE_MAILLOCK */
 559     unlink (lockname);
 560 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 561
 562 #endif /* ! DISABLE_DIRECT_ACCESS */
 563
 564   return EXIT_SUCCESS;
 565 }
 566
 567 #ifdef MAIL_USE_MAILLOCK
 568 /* This function uses stat to confirm that the mail directory is
 569    identical to the directory of the input file, rather than just
 570    string-comparing the two paths, because one or both of them might
 571    be symbolic links pointing to some other directory. */
 572 static char *
 573 mail_spool_name (char *inname)
 574 {
 575   struct stat stat1, stat2;
 576   char *indir, *fname;
 577   int status;
 578
 579   if (! (fname = strrchr (inname, '/')))
 580     return NULL;
 581
 582   fname++;
 583
 584   if (stat (MAILDIR, &stat1) < 0)
 585     return NULL;
 586
 587   indir = xmalloc (fname - inname + 1);
 588   memcpy (indir, inname, fname - inname);
 589   indir[fname-inname] = '\0';
 590
 591
 592   status = stat (indir, &stat2);
 593
 594   free (indir);
 595
 596   if (status < 0)
 597     return NULL;
 598
 599   if (stat1.st_dev == stat2.st_dev
 600       && stat1.st_ino == stat2.st_ino)
 601     return fname;
 602
 603   return NULL;
 604 }
 605 #endif /* MAIL_USE_MAILLOCK */
 606 \f
 607 /* Print error message and exit.  */
 608
 609 static void
 610 fatal (const char *s1, const char *s2, const char *s3)
 611 {
 612   if (delete_lockname)
 613     unlink (delete_lockname);
 614   error (s1, s2, s3);
 615   exit (EXIT_FAILURE);
 616 }
 617
 618 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 619    are args for it or null. */
 620
 621 static void
 622 error (const char *s1, const char *s2, const char *s3)
 623 {
 624   fprintf (stderr, "movemail: ");
 625   if (s3)
 626     fprintf (stderr, s1, s2, s3);
 627   else if (s2)
 628     fprintf (stderr, s1, s2);
 629   else
 630     fprintf (stderr, "%s", s1);
 631   fprintf (stderr, "\n");
 632 }
 633
 634 static void
 635 pfatal_with_name (char *name)
 636 {
 637   fatal ("%s for %s", strerror (errno), name);
 638 }
 639
 640 static void
 641 pfatal_and_delete (char *name)
 642 {
 643   char *s = strerror (errno);
 644   unlink (name);
 645   fatal ("%s for %s", s, name);
 646 }
 647
 648 #ifdef MAIL_USE_MAILLOCK
 649 /* Like malloc but get fatal error if memory is exhausted.  */
 650
 651 static void *
 652 xmalloc (size_t size)
 653 {
 654   void *result = malloc (size);
 655   if (!result)
 656     fatal ("virtual memory exhausted", 0, 0);
 657   return result;
 658 }
 659 #endif
 660 \f
 661 /* This is the guts of the interface to the Post Office Protocol.  */
 662
 663 #ifdef MAIL_USE_POP
 664
 665 #ifndef WINDOWSNT
 666 #include <sys/socket.h>
 667 #include <netinet/in.h>
 668 #include <netdb.h>
 669 #else
 670 #undef _WINSOCKAPI_
 671 #include <winsock.h>
 672 #endif
 673 #include <pwd.h>
 674 #include <string.h>
 675
 676 #define NOTOK (-1)
 677 #define OK 0
 678
 679 static char Errmsg[200];        /* POP errors, at least, can exceed
 680                                    the original length of 80.  */
 681
 682 /*
 683  * The full valid syntax for a POP mailbox specification for movemail
 684  * is "po:username:hostname".  The ":hostname" is optional; if it is
 685  * omitted, the MAILHOST environment variable will be consulted.  Note
 686  * that by the time popmail() is called the "po:" has been stripped
 687  * off of the front of the mailbox name.
 688  *
 689  * If the mailbox is in the form "po:username:hostname", then it is
 690  * modified by this function -- the second colon is replaced by a
 691  * null.
 692  *
 693  * Return a value suitable for passing to `exit'.
 694  */
 695
 696 static int
 697 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 698 {
 699   int nmsgs, nbytes;
 700   register int i;
 701   int mbfi;
 702   FILE *mbf;
 703   char *getenv (const char *);
 704   popserver server;
 705   int start, end, increment;
 706   char *user, *hostname;
 707
 708   user = mailbox;
 709   if ((hostname = strchr (mailbox, ':')))
 710     *hostname++ = '\0';
 711
 712   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 713   if (! server)
 714     {
 715       error ("Error connecting to POP server: %s", pop_error, 0);
 716       return EXIT_FAILURE;
 717     }
 718
 719   if (pop_stat (server, &nmsgs, &nbytes))
 720     {
 721       error ("Error getting message count from POP server: %s", pop_error, 0);
 722       return EXIT_FAILURE;
 723     }
 724
 725   if (!nmsgs)
 726     {
 727       pop_close (server);
 728       return EXIT_SUCCESS;
 729     }
 730
 731   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 732   if (mbfi < 0)
 733     {
 734       pop_close (server);
 735       error ("Error in open: %s, %s", strerror (errno), outfile);
 736       return EXIT_FAILURE;
 737     }
 738
 739   if (fchown (mbfi, getuid (), -1) != 0)
 740     {
 741       int fchown_errno = errno;
 742       struct stat st;
 743       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 744         {
 745           pop_close (server);
 746           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 747           return EXIT_FAILURE;
 748         }
 749     }
 750
 751   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 752     {
 753       pop_close (server);
 754       error ("Error in fdopen: %s", strerror (errno), 0);
 755       close (mbfi);
 756       unlink (outfile);
 757       return EXIT_FAILURE;
 758     }
 759
 760   if (reverse_order)
 761     {
 762       start = nmsgs;
 763       end = 1;
 764       increment = -1;
 765     }
 766   else
 767     {
 768       start = 1;
 769       end = nmsgs;
 770       increment = 1;
 771     }
 772
 773   for (i = start; i * increment <= end * increment; i += increment)
 774     {
 775       mbx_delimit_begin (mbf);
 776       if (pop_retr (server, i, mbf) != OK)
 777         {
 778           error ("%s", Errmsg, 0);
 779           close (mbfi);
 780           return EXIT_FAILURE;
 781         }
 782       mbx_delimit_end (mbf);
 783       fflush (mbf);
 784       if (ferror (mbf))
 785         {
 786           error ("Error in fflush: %s", strerror (errno), 0);
 787           pop_close (server);
 788           close (mbfi);
 789           return EXIT_FAILURE;
 790         }
 791     }
 792
 793   /* On AFS, a call to write only modifies the file in the local
 794    *     workstation's AFS cache.  The changes are not written to the server
 795    *      until a call to fsync or close is made.  Users with AFS home
 796    *      directories have lost mail when over quota because these checks were
 797    *      not made in previous versions of movemail. */
 798
 799 #ifdef BSD_SYSTEM
 800   if (fsync (mbfi) < 0)
 801     {
 802       error ("Error in fsync: %s", strerror (errno), 0);
 803       return EXIT_FAILURE;
 804     }
 805 #endif
 806
 807   if (close (mbfi) == -1)
 808     {
 809       error ("Error in close: %s", strerror (errno), 0);
 810       return EXIT_FAILURE;
 811     }
 812
 813   if (! preserve)
 814     for (i = 1; i <= nmsgs; i++)
 815       {
 816         if (pop_delete (server, i))
 817           {
 818             error ("Error from POP server: %s", pop_error, 0);
 819             pop_close (server);
 820             return EXIT_FAILURE;
 821           }
 822       }
 823
 824   if (pop_quit (server))
 825     {
 826       error ("Error from POP server: %s", pop_error, 0);
 827       return EXIT_FAILURE;
 828     }
 829
 830   return EXIT_SUCCESS;
 831 }
 832
 833 static int
 834 pop_retr (popserver server, int msgno, FILE *arg)
 835 {
 836   char *line;
 837   int ret;
 838
 839   if (pop_retrieve_first (server, msgno, &line))
 840     {
 841       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 842       return (NOTOK);
 843     }
 844
 845   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 846     {
 847       if (! line)
 848         break;
 849
 850       if (mbx_write (line, ret, arg) != OK)
 851         {
 852           strcpy (Errmsg, strerror (errno));
 853           pop_close (server);
 854           return (NOTOK);
 855         }
 856     }
 857
 858   if (ret)
 859     {
 860       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 861       return (NOTOK);
 862     }
 863
 864   return (OK);
 865 }
 866
 867 static int
 868 mbx_write (char *line, int len, FILE *mbf)
 869 {
 870 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 871   /* Do this as a macro instead of using strcmp to save on execution time. */
 872   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 873                             && (a[1] == 'r')    \
 874                             && (a[2] == 'o')    \
 875                             && (a[3] == 'm')    \
 876                             && (a[4] == ' '))
 877   if (IS_FROM_LINE (line))
 878     {
 879       if (fputc ('>', mbf) == EOF)
 880         return (NOTOK);
 881     }
 882 #endif
 883   if (line[0] == '\037')
 884     {
 885       if (fputs ("^_", mbf) == EOF)
 886         return (NOTOK);
 887       line++;
 888       len--;
 889     }
 890   if (fwrite (line, 1, len, mbf) != len)
 891     return (NOTOK);
 892   if (fputc (0x0a, mbf) == EOF)
 893     return (NOTOK);
 894   return (OK);
 895 }
 896
 897 static int
 898 mbx_delimit_begin (FILE *mbf)
 899 {
 900   time_t now;
 901   struct tm *ltime;
 902   char fromline[40] = "From movemail ";
 903
 904   now = time (NULL);
 905   ltime = localtime (&now);
 906
 907   strcat (fromline, asctime (ltime));
 908
 909   if (fputs (fromline, mbf) == EOF)
 910     return (NOTOK);
 911   return (OK);
 912 }
 913
 914 static int
 915 mbx_delimit_end (FILE *mbf)
 916 {
 917   if (putc ('\n', mbf) == EOF)
 918     return (NOTOK);
 919   return (OK);
 920 }
 921
 922 #endif /* MAIL_USE_POP */
 923 \f
 924 #ifndef HAVE_STRERROR
 925 char *
 926 strerror (errnum)
 927      int errnum;
 928 {
 929   extern char *sys_errlist[];
 930   extern int sys_nerr;
 931
 932   if (errnum >= 0 && errnum < sys_nerr)
 933     return sys_errlist[errnum];
 934   return (char *) "Unknown error";
 935 }
 936
 937 #endif /* ! HAVE_STRERROR */
 938
 939
 940 /* movemail.c ends here */