lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2012
   5   Free Software Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #ifdef HAVE_FCNTL_H
  69 #include <fcntl.h>
  70 #endif
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define wait(var) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifndef F_OK
 102 #define F_OK 0
 103 #define X_OK 1
 104 #define W_OK 2
 105 #define R_OK 4
 106 #endif
 107
 108 #ifdef WINDOWSNT
 109 #include <sys/locking.h>
 110 #endif
 111
 112 /* If your system uses the `flock' or `lockf' system call for mail locking,
 113    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 114    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 115    please make a bug report.  */
 116
 117 #ifdef MAIL_USE_LOCKF
 118 #define MAIL_USE_SYSTEM_LOCK
 119 #endif
 120
 121 #ifdef MAIL_USE_FLOCK
 122 #define MAIL_USE_SYSTEM_LOCK
 123 #endif
 124
 125 #ifdef MAIL_USE_MMDF
 126 extern int lk_open (), lk_close ();
 127 #endif
 128
 129 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 130         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 131         defined (HAVE_MAILLOCK_H)
 132 #include <maillock.h>
 133 /* We can't use maillock unless we know what directory system mail
 134    files appear in. */
 135 #ifdef MAILDIR
 136 #define MAIL_USE_MAILLOCK
 137 static char *mail_spool_name (char *);
 138 #endif
 139 #endif
 140
 141 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 142 static void error (const char *s1, const char *s2, const char *s3);
 143 static _Noreturn void pfatal_with_name (char *name);
 144 static _Noreturn void pfatal_and_delete (char *name);
 145 #ifdef MAIL_USE_POP
 146 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 147 static int pop_retr (popserver server, int msgno, FILE *arg);
 148 static int mbx_write (char *line, int len, FILE *mbf);
 149 static int mbx_delimit_begin (FILE *mbf);
 150 static int mbx_delimit_end (FILE *mbf);
 151 #endif
 152
 153 #if (defined MAIL_USE_MAILLOCK                                          \
 154      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF       \
 155          && !defined MAIL_USE_SYSTEM_LOCK))
 156 /* Like malloc but get fatal error if memory is exhausted.  */
 157
 158 static void *
 159 xmalloc (size_t size)
 160 {
 161   void *result = malloc (size);
 162   if (!result)
 163     fatal ("virtual memory exhausted", 0, 0);
 164   return result;
 165 }
 166 #endif
 167
 168 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 169 static char *delete_lockname;
 170
 171 int
 172 main (int argc, char **argv)
 173 {
 174   char *inname, *outname;
 175   int indesc, outdesc;
 176   ssize_t nread;
 177   int wait_status;
 178   int c, preserve_mail = 0;
 179
 180 #ifndef MAIL_USE_SYSTEM_LOCK
 181   struct stat st;
 182   int tem;
 183   char *lockname;
 184   char *tempname;
 185   size_t inname_len, inname_dirlen;
 186   int desc;
 187 #endif /* not MAIL_USE_SYSTEM_LOCK */
 188
 189 #ifdef MAIL_USE_MAILLOCK
 190   char *spool_name;
 191 #endif
 192
 193 #ifdef MAIL_USE_POP
 194   int pop_reverse_order = 0;
 195 # define ARGSTR "pr"
 196 #else /* ! MAIL_USE_POP */
 197 # define ARGSTR "p"
 198 #endif /* MAIL_USE_POP */
 199
 200   uid_t real_gid = getgid ();
 201   uid_t priv_gid = getegid ();
 202
 203 #ifdef WINDOWSNT
 204   /* Ensure all file i/o is in binary mode. */
 205   _fmode = _O_BINARY;
 206 #endif
 207
 208   delete_lockname = 0;
 209
 210   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 211     {
 212       switch (c) {
 213 #ifdef MAIL_USE_POP
 214       case 'r':
 215         pop_reverse_order = 1;
 216         break;
 217 #endif
 218       case 'p':
 219         preserve_mail++;
 220         break;
 221       default:
 222         exit (EXIT_FAILURE);
 223       }
 224     }
 225
 226   if (
 227 #ifdef MAIL_USE_POP
 228       (argc - optind < 2) || (argc - optind > 3)
 229 #else
 230       (argc - optind != 2)
 231 #endif
 232       )
 233     {
 234 #ifdef MAIL_USE_POP
 235       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 236                " [POP-password]");
 237 #else
 238       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 239 #endif
 240       exit (EXIT_FAILURE);
 241     }
 242
 243   inname = argv[optind];
 244   outname = argv[optind+1];
 245
 246 #ifdef MAIL_USE_MMDF
 247   mmdf_init (argv[0]);
 248 #endif
 249
 250   if (*outname == 0)
 251     fatal ("Destination file name is empty", 0, 0);
 252
 253 #ifdef MAIL_USE_POP
 254   if (!strncmp (inname, "po:", 3))
 255     {
 256       int status;
 257
 258       status = popmail (inname + 3, outname, preserve_mail,
 259                         (argc - optind == 3) ? argv[optind+2] : NULL,
 260                         pop_reverse_order);
 261       exit (status);
 262     }
 263
 264   if (setuid (getuid ()) < 0)
 265     fatal ("Failed to drop privileges", 0, 0);
 266
 267 #endif /* MAIL_USE_POP */
 268
 269 #ifndef DISABLE_DIRECT_ACCESS
 270 #ifndef MAIL_USE_MMDF
 271 #ifndef MAIL_USE_SYSTEM_LOCK
 272 #ifdef MAIL_USE_MAILLOCK
 273   spool_name = mail_spool_name (inname);
 274   if (spool_name)
 275     {
 276 #ifdef lint
 277       lockname = 0;
 278 #endif
 279     }
 280   else
 281 #endif
 282     {
 283       /* Use a lock file named after our first argument with .lock appended:
 284          If it exists, the mail file is locked.  */
 285       /* Note: this locking mechanism is *required* by the mailer
 286          (on systems which use it) to prevent loss of mail.
 287
 288          On systems that use a lock file, extracting the mail without locking
 289          WILL occasionally cause loss of mail due to timing errors!
 290
 291          So, if creation of the lock file fails due to access
 292          permission on the mail spool directory, you simply MUST
 293          change the permission and/or make movemail a setgid program
 294          so it can create lock files properly.
 295
 296          You might also wish to verify that your system is one which
 297          uses lock files for this purpose.  Some systems use other methods.  */
 298
 299       inname_len = strlen (inname);
 300       lockname = xmalloc (inname_len + sizeof ".lock");
 301       strcpy (lockname, inname);
 302       strcpy (lockname + inname_len, ".lock");
 303       for (inname_dirlen = inname_len;
 304            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 305            inname_dirlen--)
 306         continue;
 307       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 308
 309       while (1)
 310         {
 311           /* Create the lock file, but not under the lock file name.  */
 312           /* Give up if cannot do that.  */
 313
 314           memcpy (tempname, inname, inname_dirlen);
 315           strcpy (tempname + inname_dirlen, "EXXXXXX");
 316 #ifdef HAVE_MKSTEMP
 317           desc = mkstemp (tempname);
 318 #else
 319           mktemp (tempname);
 320           if (!*tempname)
 321             desc = -1;
 322           else
 323             {
 324               unlink (tempname);
 325               desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 326             }
 327 #endif
 328           if (desc < 0)
 329             {
 330               int mkstemp_errno = errno;
 331               error ("error while creating what would become the lock file",
 332                      0, 0);
 333               errno = mkstemp_errno;
 334               pfatal_with_name (tempname);
 335             }
 336           close (desc);
 337
 338           tem = link (tempname, lockname);
 339
 340 #ifdef EPERM
 341           if (tem < 0 && errno == EPERM)
 342             fatal ("Unable to create hard link between %s and %s",
 343                    tempname, lockname);
 344 #endif
 345
 346           unlink (tempname);
 347           if (tem >= 0)
 348             break;
 349           sleep (1);
 350
 351           /* If lock file is five minutes old, unlock it.
 352              Five minutes should be good enough to cope with crashes
 353              and wedgitude, and long enough to avoid being fooled
 354              by time differences between machines.  */
 355           if (stat (lockname, &st) >= 0)
 356             {
 357               time_t now = time (0);
 358               if (st.st_ctime < now - 300)
 359                 unlink (lockname);
 360             }
 361         }
 362
 363       delete_lockname = lockname;
 364     }
 365 #endif /* not MAIL_USE_SYSTEM_LOCK */
 366 #endif /* not MAIL_USE_MMDF */
 367
 368   if (fork () == 0)
 369     {
 370       int lockcount = 0;
 371       int status = 0;
 372 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 373       time_t touched_lock;
 374 # ifdef lint
 375       touched_lock = 0;
 376 # endif
 377 #endif
 378
 379       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 380         fatal ("Failed to drop privileges", 0, 0);
 381
 382 #ifndef MAIL_USE_MMDF
 383 #ifdef MAIL_USE_SYSTEM_LOCK
 384       indesc = open (inname, O_RDWR);
 385 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 386       indesc = open (inname, O_RDONLY);
 387 #endif /* not MAIL_USE_SYSTEM_LOCK */
 388 #else  /* MAIL_USE_MMDF */
 389       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 390 #endif /* MAIL_USE_MMDF */
 391
 392       if (indesc < 0)
 393         pfatal_with_name (inname);
 394
 395 #ifdef BSD_SYSTEM
 396       /* In case movemail is setuid to root, make sure the user can
 397          read the output file.  */
 398       /* This is desirable for all systems
 399          but I don't want to assume all have the umask system call */
 400       umask (umask (0) & 0333);
 401 #endif /* BSD_SYSTEM */
 402       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 403       if (outdesc < 0)
 404         pfatal_with_name (outname);
 405
 406       if (setregid (-1, priv_gid) < 0)
 407         fatal ("Failed to regain privileges", 0, 0);
 408
 409       /* This label exists so we can retry locking
 410          after a delay, if it got EAGAIN or EBUSY.  */
 411     retry_lock:
 412
 413       /* Try to lock it.  */
 414 #ifdef MAIL_USE_MAILLOCK
 415       if (spool_name)
 416         {
 417           /* The "0 - " is to make it a negative number if maillock returns
 418              non-zero. */
 419           status = 0 - maillock (spool_name, 1);
 420 #ifdef HAVE_TOUCHLOCK
 421           touched_lock = time (0);
 422 #endif
 423           lockcount = 5;
 424         }
 425       else
 426 #endif /* MAIL_USE_MAILLOCK */
 427         {
 428 #ifdef MAIL_USE_SYSTEM_LOCK
 429 #ifdef MAIL_USE_LOCKF
 430           status = lockf (indesc, F_LOCK, 0);
 431 #else /* not MAIL_USE_LOCKF */
 432 #ifdef WINDOWSNT
 433           status = locking (indesc, LK_RLCK, -1L);
 434 #else
 435           status = flock (indesc, LOCK_EX);
 436 #endif
 437 #endif /* not MAIL_USE_LOCKF */
 438 #endif /* MAIL_USE_SYSTEM_LOCK */
 439         }
 440
 441       /* If it fails, retry up to 5 times
 442          for certain failure codes.  */
 443       if (status < 0)
 444         {
 445           if (++lockcount <= 5)
 446             {
 447 #ifdef EAGAIN
 448               if (errno == EAGAIN)
 449                 {
 450                   sleep (1);
 451                   goto retry_lock;
 452                 }
 453 #endif
 454 #ifdef EBUSY
 455               if (errno == EBUSY)
 456                 {
 457                   sleep (1);
 458                   goto retry_lock;
 459                 }
 460 #endif
 461             }
 462
 463           pfatal_with_name (inname);
 464         }
 465
 466       {
 467         char buf[1024];
 468
 469         while (1)
 470           {
 471             nread = read (indesc, buf, sizeof buf);
 472             if (nread < 0)
 473               pfatal_with_name (inname);
 474             if (nread != write (outdesc, buf, nread))
 475               {
 476                 int saved_errno = errno;
 477                 unlink (outname);
 478                 errno = saved_errno;
 479                 pfatal_with_name (outname);
 480               }
 481             if (nread < sizeof buf)
 482               break;
 483 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 484             if (spool_name)
 485               {
 486                 time_t now = time (0);
 487                 if (now - touched_lock > 60)
 488                   {
 489                     touchlock ();
 490                     touched_lock = now;
 491                   }
 492               }
 493 #endif /* MAIL_USE_MAILLOCK */
 494           }
 495       }
 496
 497 #ifdef BSD_SYSTEM
 498       if (fsync (outdesc) < 0)
 499         pfatal_and_delete (outname);
 500 #endif
 501
 502       /* Prevent symlink attacks truncating other users' mailboxes */
 503       if (setregid (-1, real_gid) < 0)
 504         fatal ("Failed to drop privileges", 0, 0);
 505
 506       /* Check to make sure no errors before we zap the inbox.  */
 507       if (close (outdesc) != 0)
 508         pfatal_and_delete (outname);
 509
 510 #ifdef MAIL_USE_SYSTEM_LOCK
 511       if (! preserve_mail)
 512         {
 513           if (ftruncate (indesc, 0L) != 0)
 514             pfatal_with_name (inname);
 515         }
 516 #endif /* MAIL_USE_SYSTEM_LOCK */
 517
 518 #ifdef MAIL_USE_MMDF
 519       lk_close (indesc, 0, 0, 0);
 520 #else
 521       close (indesc);
 522 #endif
 523
 524 #ifndef MAIL_USE_SYSTEM_LOCK
 525       if (! preserve_mail)
 526         {
 527           /* Delete the input file; if we can't, at least get rid of its
 528              contents.  */
 529 #ifdef MAIL_UNLINK_SPOOL
 530           /* This is generally bad to do, because it destroys the permissions
 531              that were set on the file.  Better to just empty the file.  */
 532           if (unlink (inname) < 0 && errno != ENOENT)
 533 #endif /* MAIL_UNLINK_SPOOL */
 534             creat (inname, 0600);
 535         }
 536 #endif /* not MAIL_USE_SYSTEM_LOCK */
 537
 538       /* End of mailbox truncation */
 539       if (setregid (-1, priv_gid) < 0)
 540         fatal ("Failed to regain privileges", 0, 0);
 541
 542 #ifdef MAIL_USE_MAILLOCK
 543       /* This has to occur in the child, i.e., in the process that
 544          acquired the lock! */
 545       if (spool_name)
 546         mailunlock ();
 547 #endif
 548       exit (EXIT_SUCCESS);
 549     }
 550
 551   wait (&wait_status);
 552   if (!WIFEXITED (wait_status))
 553     exit (EXIT_FAILURE);
 554   else if (WEXITSTATUS (wait_status) != 0)
 555     exit (WEXITSTATUS (wait_status));
 556
 557 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 558 #ifdef MAIL_USE_MAILLOCK
 559   if (! spool_name)
 560 #endif /* MAIL_USE_MAILLOCK */
 561     unlink (lockname);
 562 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 563
 564 #endif /* ! DISABLE_DIRECT_ACCESS */
 565
 566   return EXIT_SUCCESS;
 567 }
 568
 569 #ifdef MAIL_USE_MAILLOCK
 570 /* This function uses stat to confirm that the mail directory is
 571    identical to the directory of the input file, rather than just
 572    string-comparing the two paths, because one or both of them might
 573    be symbolic links pointing to some other directory. */
 574 static char *
 575 mail_spool_name (char *inname)
 576 {
 577   struct stat stat1, stat2;
 578   char *indir, *fname;
 579   int status;
 580
 581   if (! (fname = strrchr (inname, '/')))
 582     return NULL;
 583
 584   fname++;
 585
 586   if (stat (MAILDIR, &stat1) < 0)
 587     return NULL;
 588
 589   indir = xmalloc (fname - inname + 1);
 590   memcpy (indir, inname, fname - inname);
 591   indir[fname-inname] = '\0';
 592
 593
 594   status = stat (indir, &stat2);
 595
 596   free (indir);
 597
 598   if (status < 0)
 599     return NULL;
 600
 601   if (stat1.st_dev == stat2.st_dev
 602       && stat1.st_ino == stat2.st_ino)
 603     return fname;
 604
 605   return NULL;
 606 }
 607 #endif /* MAIL_USE_MAILLOCK */
 608 \f
 609 /* Print error message and exit.  */
 610
 611 static void
 612 fatal (const char *s1, const char *s2, const char *s3)
 613 {
 614   if (delete_lockname)
 615     unlink (delete_lockname);
 616   error (s1, s2, s3);
 617   exit (EXIT_FAILURE);
 618 }
 619
 620 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 621    are args for it or null. */
 622
 623 static void
 624 error (const char *s1, const char *s2, const char *s3)
 625 {
 626   fprintf (stderr, "movemail: ");
 627   if (s3)
 628     fprintf (stderr, s1, s2, s3);
 629   else if (s2)
 630     fprintf (stderr, s1, s2);
 631   else
 632     fprintf (stderr, "%s", s1);
 633   fprintf (stderr, "\n");
 634 }
 635
 636 static void
 637 pfatal_with_name (char *name)
 638 {
 639   fatal ("%s for %s", strerror (errno), name);
 640 }
 641
 642 static void
 643 pfatal_and_delete (char *name)
 644 {
 645   char *s = strerror (errno);
 646   unlink (name);
 647   fatal ("%s for %s", s, name);
 648 }
 649 \f
 650 /* This is the guts of the interface to the Post Office Protocol.  */
 651
 652 #ifdef MAIL_USE_POP
 653
 654 #ifndef WINDOWSNT
 655 #include <sys/socket.h>
 656 #include <netinet/in.h>
 657 #include <netdb.h>
 658 #else
 659 #undef _WINSOCKAPI_
 660 #include <winsock.h>
 661 #endif
 662 #include <pwd.h>
 663 #include <string.h>
 664
 665 #define NOTOK (-1)
 666 #define OK 0
 667
 668 static char Errmsg[200];        /* POP errors, at least, can exceed
 669                                    the original length of 80.  */
 670
 671 /*
 672  * The full valid syntax for a POP mailbox specification for movemail
 673  * is "po:username:hostname".  The ":hostname" is optional; if it is
 674  * omitted, the MAILHOST environment variable will be consulted.  Note
 675  * that by the time popmail() is called the "po:" has been stripped
 676  * off of the front of the mailbox name.
 677  *
 678  * If the mailbox is in the form "po:username:hostname", then it is
 679  * modified by this function -- the second colon is replaced by a
 680  * null.
 681  *
 682  * Return a value suitable for passing to `exit'.
 683  */
 684
 685 static int
 686 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 687 {
 688   int nmsgs, nbytes;
 689   register int i;
 690   int mbfi;
 691   FILE *mbf;
 692   char *getenv (const char *);
 693   popserver server;
 694   int start, end, increment;
 695   char *user, *hostname;
 696
 697   user = mailbox;
 698   if ((hostname = strchr (mailbox, ':')))
 699     *hostname++ = '\0';
 700
 701   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 702   if (! server)
 703     {
 704       error ("Error connecting to POP server: %s", pop_error, 0);
 705       return EXIT_FAILURE;
 706     }
 707
 708   if (pop_stat (server, &nmsgs, &nbytes))
 709     {
 710       error ("Error getting message count from POP server: %s", pop_error, 0);
 711       return EXIT_FAILURE;
 712     }
 713
 714   if (!nmsgs)
 715     {
 716       pop_close (server);
 717       return EXIT_SUCCESS;
 718     }
 719
 720   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 721   if (mbfi < 0)
 722     {
 723       pop_close (server);
 724       error ("Error in open: %s, %s", strerror (errno), outfile);
 725       return EXIT_FAILURE;
 726     }
 727
 728   if (fchown (mbfi, getuid (), -1) != 0)
 729     {
 730       int fchown_errno = errno;
 731       struct stat st;
 732       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 733         {
 734           pop_close (server);
 735           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 736           return EXIT_FAILURE;
 737         }
 738     }
 739
 740   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 741     {
 742       pop_close (server);
 743       error ("Error in fdopen: %s", strerror (errno), 0);
 744       close (mbfi);
 745       unlink (outfile);
 746       return EXIT_FAILURE;
 747     }
 748
 749   if (reverse_order)
 750     {
 751       start = nmsgs;
 752       end = 1;
 753       increment = -1;
 754     }
 755   else
 756     {
 757       start = 1;
 758       end = nmsgs;
 759       increment = 1;
 760     }
 761
 762   for (i = start; i * increment <= end * increment; i += increment)
 763     {
 764       mbx_delimit_begin (mbf);
 765       if (pop_retr (server, i, mbf) != OK)
 766         {
 767           error ("%s", Errmsg, 0);
 768           close (mbfi);
 769           return EXIT_FAILURE;
 770         }
 771       mbx_delimit_end (mbf);
 772       fflush (mbf);
 773       if (ferror (mbf))
 774         {
 775           error ("Error in fflush: %s", strerror (errno), 0);
 776           pop_close (server);
 777           close (mbfi);
 778           return EXIT_FAILURE;
 779         }
 780     }
 781
 782   /* On AFS, a call to write only modifies the file in the local
 783    *     workstation's AFS cache.  The changes are not written to the server
 784    *      until a call to fsync or close is made.  Users with AFS home
 785    *      directories have lost mail when over quota because these checks were
 786    *      not made in previous versions of movemail. */
 787
 788 #ifdef BSD_SYSTEM
 789   if (fsync (mbfi) < 0)
 790     {
 791       error ("Error in fsync: %s", strerror (errno), 0);
 792       return EXIT_FAILURE;
 793     }
 794 #endif
 795
 796   if (close (mbfi) == -1)
 797     {
 798       error ("Error in close: %s", strerror (errno), 0);
 799       return EXIT_FAILURE;
 800     }
 801
 802   if (! preserve)
 803     for (i = 1; i <= nmsgs; i++)
 804       {
 805         if (pop_delete (server, i))
 806           {
 807             error ("Error from POP server: %s", pop_error, 0);
 808             pop_close (server);
 809             return EXIT_FAILURE;
 810           }
 811       }
 812
 813   if (pop_quit (server))
 814     {
 815       error ("Error from POP server: %s", pop_error, 0);
 816       return EXIT_FAILURE;
 817     }
 818
 819   return EXIT_SUCCESS;
 820 }
 821
 822 static int
 823 pop_retr (popserver server, int msgno, FILE *arg)
 824 {
 825   char *line;
 826   int ret;
 827
 828   if (pop_retrieve_first (server, msgno, &line))
 829     {
 830       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 831       return (NOTOK);
 832     }
 833
 834   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 835     {
 836       if (! line)
 837         break;
 838
 839       if (mbx_write (line, ret, arg) != OK)
 840         {
 841           strcpy (Errmsg, strerror (errno));
 842           pop_close (server);
 843           return (NOTOK);
 844         }
 845     }
 846
 847   if (ret)
 848     {
 849       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 850       return (NOTOK);
 851     }
 852
 853   return (OK);
 854 }
 855
 856 static int
 857 mbx_write (char *line, int len, FILE *mbf)
 858 {
 859 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 860   /* Do this as a macro instead of using strcmp to save on execution time. */
 861   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 862                             && (a[1] == 'r')    \
 863                             && (a[2] == 'o')    \
 864                             && (a[3] == 'm')    \
 865                             && (a[4] == ' '))
 866   if (IS_FROM_LINE (line))
 867     {
 868       if (fputc ('>', mbf) == EOF)
 869         return (NOTOK);
 870     }
 871 #endif
 872   if (line[0] == '\037')
 873     {
 874       if (fputs ("^_", mbf) == EOF)
 875         return (NOTOK);
 876       line++;
 877       len--;
 878     }
 879   if (fwrite (line, 1, len, mbf) != len)
 880     return (NOTOK);
 881   if (fputc (0x0a, mbf) == EOF)
 882     return (NOTOK);
 883   return (OK);
 884 }
 885
 886 static int
 887 mbx_delimit_begin (FILE *mbf)
 888 {
 889   time_t now;
 890   struct tm *ltime;
 891   char fromline[40] = "From movemail ";
 892
 893   now = time (NULL);
 894   ltime = localtime (&now);
 895
 896   strcat (fromline, asctime (ltime));
 897
 898   if (fputs (fromline, mbf) == EOF)
 899     return (NOTOK);
 900   return (OK);
 901 }
 902
 903 static int
 904 mbx_delimit_end (FILE *mbf)
 905 {
 906   if (putc ('\n', mbf) == EOF)
 907     return (NOTOK);
 908   return (OK);
 909 }
 910
 911 #endif /* MAIL_USE_POP */