lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2013 Free Software
   5 Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #include <fcntl.h>
  69 #include <string.h>
  70 #include "syswait.h"
  71 #ifdef MAIL_USE_POP
  72 #include "pop.h"
  73 #endif
  74
  75 #ifdef MSDOS
  76 #undef access
  77 #endif /* MSDOS */
  78
  79 #ifdef WINDOWSNT
  80 #include "ntlib.h"
  81 #undef access
  82 #undef unlink
  83 #define fork() 0
  84 #define wait(var) (*(var) = 0)
  85 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  86    though the locking call succeeds (and indeed blocks local access from
  87    other NT programs).  If you have direct file access using an NFS
  88    client or something other than Samba, the locking call might work
  89    properly - make sure it does before you enable this!
  90
  91    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  92    since it was based on a misunderstanding of how locking calls are
  93    implemented and used on Unix.  */
  94 //#define DISABLE_DIRECT_ACCESS
  95
  96 #include <fcntl.h>
  97 #endif /* WINDOWSNT */
  98
  99 #ifdef WINDOWSNT
 100 #include <sys/locking.h>
 101 #endif
 102
 103 /* If your system uses the `flock' or `lockf' system call for mail locking,
 104    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 105    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 106    please make a bug report.  */
 107
 108 #ifdef MAIL_USE_LOCKF
 109 #define MAIL_USE_SYSTEM_LOCK
 110 #endif
 111
 112 #ifdef MAIL_USE_FLOCK
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_MMDF
 117 extern int lk_open (), lk_close ();
 118 #endif
 119
 120 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 121         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 122         defined (HAVE_MAILLOCK_H)
 123 #include <maillock.h>
 124 /* We can't use maillock unless we know what directory system mail
 125    files appear in. */
 126 #ifdef MAILDIR
 127 #define MAIL_USE_MAILLOCK
 128 static char *mail_spool_name (char *);
 129 #endif
 130 #endif
 131
 132 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 133 static void error (const char *s1, const char *s2, const char *s3);
 134 static _Noreturn void pfatal_with_name (char *name);
 135 static _Noreturn void pfatal_and_delete (char *name);
 136 #ifdef MAIL_USE_POP
 137 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 138 static int pop_retr (popserver server, int msgno, FILE *arg);
 139 static int mbx_write (char *line, int len, FILE *mbf);
 140 static int mbx_delimit_begin (FILE *mbf);
 141 static int mbx_delimit_end (FILE *mbf);
 142 #endif
 143
 144 #if (defined MAIL_USE_MAILLOCK                                          \
 145      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF       \
 146          && !defined MAIL_USE_SYSTEM_LOCK))
 147 /* Like malloc but get fatal error if memory is exhausted.  */
 148
 149 static void *
 150 xmalloc (size_t size)
 151 {
 152   void *result = malloc (size);
 153   if (!result)
 154     fatal ("virtual memory exhausted", 0, 0);
 155   return result;
 156 }
 157 #endif
 158
 159 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 160 static char *delete_lockname;
 161
 162 int
 163 main (int argc, char **argv)
 164 {
 165   char *inname, *outname;
 166   int indesc, outdesc;
 167   ssize_t nread;
 168   int wait_status;
 169   int c, preserve_mail = 0;
 170
 171 #ifndef MAIL_USE_SYSTEM_LOCK
 172   struct stat st;
 173   int tem;
 174   char *lockname;
 175   char *tempname;
 176   size_t inname_len, inname_dirlen;
 177   int desc;
 178 #endif /* not MAIL_USE_SYSTEM_LOCK */
 179
 180 #ifdef MAIL_USE_MAILLOCK
 181   char *spool_name;
 182 #endif
 183
 184 #ifdef MAIL_USE_POP
 185   int pop_reverse_order = 0;
 186 # define ARGSTR "pr"
 187 #else /* ! MAIL_USE_POP */
 188 # define ARGSTR "p"
 189 #endif /* MAIL_USE_POP */
 190
 191   uid_t real_gid = getgid ();
 192   uid_t priv_gid = getegid ();
 193
 194 #ifdef WINDOWSNT
 195   /* Ensure all file i/o is in binary mode. */
 196   _fmode = _O_BINARY;
 197 #endif
 198
 199   delete_lockname = 0;
 200
 201   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 202     {
 203       switch (c) {
 204 #ifdef MAIL_USE_POP
 205       case 'r':
 206         pop_reverse_order = 1;
 207         break;
 208 #endif
 209       case 'p':
 210         preserve_mail++;
 211         break;
 212       default:
 213         exit (EXIT_FAILURE);
 214       }
 215     }
 216
 217   if (
 218 #ifdef MAIL_USE_POP
 219       (argc - optind < 2) || (argc - optind > 3)
 220 #else
 221       (argc - optind != 2)
 222 #endif
 223       )
 224     {
 225 #ifdef MAIL_USE_POP
 226       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 227                " [POP-password]");
 228 #else
 229       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 230 #endif
 231       exit (EXIT_FAILURE);
 232     }
 233
 234   inname = argv[optind];
 235   outname = argv[optind+1];
 236
 237 #ifdef MAIL_USE_MMDF
 238   mmdf_init (argv[0]);
 239 #endif
 240
 241   if (*outname == 0)
 242     fatal ("Destination file name is empty", 0, 0);
 243
 244 #ifdef MAIL_USE_POP
 245   if (!strncmp (inname, "po:", 3))
 246     {
 247       int status;
 248
 249       status = popmail (inname + 3, outname, preserve_mail,
 250                         (argc - optind == 3) ? argv[optind+2] : NULL,
 251                         pop_reverse_order);
 252       exit (status);
 253     }
 254
 255   if (setuid (getuid ()) < 0)
 256     fatal ("Failed to drop privileges", 0, 0);
 257
 258 #endif /* MAIL_USE_POP */
 259
 260 #ifndef DISABLE_DIRECT_ACCESS
 261 #ifndef MAIL_USE_MMDF
 262 #ifndef MAIL_USE_SYSTEM_LOCK
 263 #ifdef MAIL_USE_MAILLOCK
 264   spool_name = mail_spool_name (inname);
 265   if (spool_name)
 266     {
 267 #ifdef lint
 268       lockname = 0;
 269 #endif
 270     }
 271   else
 272 #endif
 273     {
 274       /* Use a lock file named after our first argument with .lock appended:
 275          If it exists, the mail file is locked.  */
 276       /* Note: this locking mechanism is *required* by the mailer
 277          (on systems which use it) to prevent loss of mail.
 278
 279          On systems that use a lock file, extracting the mail without locking
 280          WILL occasionally cause loss of mail due to timing errors!
 281
 282          So, if creation of the lock file fails due to access
 283          permission on the mail spool directory, you simply MUST
 284          change the permission and/or make movemail a setgid program
 285          so it can create lock files properly.
 286
 287          You might also wish to verify that your system is one which
 288          uses lock files for this purpose.  Some systems use other methods.  */
 289
 290       inname_len = strlen (inname);
 291       lockname = xmalloc (inname_len + sizeof ".lock");
 292       strcpy (lockname, inname);
 293       strcpy (lockname + inname_len, ".lock");
 294       for (inname_dirlen = inname_len;
 295            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 296            inname_dirlen--)
 297         continue;
 298       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 299
 300       while (1)
 301         {
 302           /* Create the lock file, but not under the lock file name.  */
 303           /* Give up if cannot do that.  */
 304
 305           memcpy (tempname, inname, inname_dirlen);
 306           strcpy (tempname + inname_dirlen, "EXXXXXX");
 307           desc = mkostemp (tempname, 0);
 308           if (desc < 0)
 309             {
 310               int mkostemp_errno = errno;
 311               error ("error while creating what would become the lock file",
 312                      0, 0);
 313               errno = mkostemp_errno;
 314               pfatal_with_name (tempname);
 315             }
 316           close (desc);
 317
 318           tem = link (tempname, lockname);
 319
 320           if (tem < 0 && errno != EEXIST)
 321             pfatal_with_name (lockname);
 322
 323           unlink (tempname);
 324           if (tem >= 0)
 325             break;
 326           sleep (1);
 327
 328           /* If lock file is five minutes old, unlock it.
 329              Five minutes should be good enough to cope with crashes
 330              and wedgitude, and long enough to avoid being fooled
 331              by time differences between machines.  */
 332           if (stat (lockname, &st) >= 0)
 333             {
 334               time_t now = time (0);
 335               if (st.st_ctime < now - 300)
 336                 unlink (lockname);
 337             }
 338         }
 339
 340       delete_lockname = lockname;
 341     }
 342 #endif /* not MAIL_USE_SYSTEM_LOCK */
 343 #endif /* not MAIL_USE_MMDF */
 344
 345   if (fork () == 0)
 346     {
 347       int lockcount = 0;
 348       int status = 0;
 349 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 350       time_t touched_lock;
 351 # ifdef lint
 352       touched_lock = 0;
 353 # endif
 354 #endif
 355
 356       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 357         fatal ("Failed to drop privileges", 0, 0);
 358
 359 #ifndef MAIL_USE_MMDF
 360 #ifdef MAIL_USE_SYSTEM_LOCK
 361       indesc = open (inname, O_RDWR);
 362 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 363       indesc = open (inname, O_RDONLY);
 364 #endif /* not MAIL_USE_SYSTEM_LOCK */
 365 #else  /* MAIL_USE_MMDF */
 366       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 367 #endif /* MAIL_USE_MMDF */
 368
 369       if (indesc < 0)
 370         pfatal_with_name (inname);
 371
 372       /* Make sure the user can read the output file.  */
 373       umask (umask (0) & 0377);
 374
 375       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 376       if (outdesc < 0)
 377         pfatal_with_name (outname);
 378
 379       if (setregid (-1, priv_gid) < 0)
 380         fatal ("Failed to regain privileges", 0, 0);
 381
 382       /* This label exists so we can retry locking
 383          after a delay, if it got EAGAIN or EBUSY.  */
 384     retry_lock:
 385
 386       /* Try to lock it.  */
 387 #ifdef MAIL_USE_MAILLOCK
 388       if (spool_name)
 389         {
 390           /* The "0 - " is to make it a negative number if maillock returns
 391              non-zero. */
 392           status = 0 - maillock (spool_name, 1);
 393 #ifdef HAVE_TOUCHLOCK
 394           touched_lock = time (0);
 395 #endif
 396           lockcount = 5;
 397         }
 398       else
 399 #endif /* MAIL_USE_MAILLOCK */
 400         {
 401 #ifdef MAIL_USE_SYSTEM_LOCK
 402 #ifdef MAIL_USE_LOCKF
 403           status = lockf (indesc, F_LOCK, 0);
 404 #else /* not MAIL_USE_LOCKF */
 405 #ifdef WINDOWSNT
 406           status = locking (indesc, LK_RLCK, -1L);
 407 #else
 408           status = flock (indesc, LOCK_EX);
 409 #endif
 410 #endif /* not MAIL_USE_LOCKF */
 411 #endif /* MAIL_USE_SYSTEM_LOCK */
 412         }
 413
 414       /* If it fails, retry up to 5 times
 415          for certain failure codes.  */
 416       if (status < 0)
 417         {
 418           if (++lockcount <= 5 && (errno == EAGAIN || errno == EBUSY))
 419             {
 420               sleep (1);
 421               goto retry_lock;
 422             }
 423
 424           pfatal_with_name (inname);
 425         }
 426
 427       {
 428         char buf[1024];
 429
 430         while (1)
 431           {
 432             nread = read (indesc, buf, sizeof buf);
 433             if (nread < 0)
 434               pfatal_with_name (inname);
 435             if (nread != write (outdesc, buf, nread))
 436               {
 437                 int saved_errno = errno;
 438                 unlink (outname);
 439                 errno = saved_errno;
 440                 pfatal_with_name (outname);
 441               }
 442             if (nread < sizeof buf)
 443               break;
 444 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 445             if (spool_name)
 446               {
 447                 time_t now = time (0);
 448                 if (now - touched_lock > 60)
 449                   {
 450                     touchlock ();
 451                     touched_lock = now;
 452                   }
 453               }
 454 #endif /* MAIL_USE_MAILLOCK */
 455           }
 456       }
 457
 458       if (fsync (outdesc) != 0 && errno != EINVAL)
 459         pfatal_and_delete (outname);
 460
 461       /* Prevent symlink attacks truncating other users' mailboxes */
 462       if (setregid (-1, real_gid) < 0)
 463         fatal ("Failed to drop privileges", 0, 0);
 464
 465       /* Check to make sure no errors before we zap the inbox.  */
 466       if (close (outdesc) != 0)
 467         pfatal_and_delete (outname);
 468
 469 #ifdef MAIL_USE_SYSTEM_LOCK
 470       if (! preserve_mail)
 471         {
 472           if (ftruncate (indesc, 0L) != 0)
 473             pfatal_with_name (inname);
 474         }
 475 #endif /* MAIL_USE_SYSTEM_LOCK */
 476
 477 #ifdef MAIL_USE_MMDF
 478       lk_close (indesc, 0, 0, 0);
 479 #else
 480       close (indesc);
 481 #endif
 482
 483 #ifndef MAIL_USE_SYSTEM_LOCK
 484       if (! preserve_mail)
 485         {
 486           /* Delete the input file; if we can't, at least get rid of its
 487              contents.  */
 488 #ifdef MAIL_UNLINK_SPOOL
 489           /* This is generally bad to do, because it destroys the permissions
 490              that were set on the file.  Better to just empty the file.  */
 491           if (unlink (inname) < 0 && errno != ENOENT)
 492 #endif /* MAIL_UNLINK_SPOOL */
 493             creat (inname, 0600);
 494         }
 495 #endif /* not MAIL_USE_SYSTEM_LOCK */
 496
 497       /* End of mailbox truncation */
 498       if (setregid (-1, priv_gid) < 0)
 499         fatal ("Failed to regain privileges", 0, 0);
 500
 501 #ifdef MAIL_USE_MAILLOCK
 502       /* This has to occur in the child, i.e., in the process that
 503          acquired the lock! */
 504       if (spool_name)
 505         mailunlock ();
 506 #endif
 507       exit (EXIT_SUCCESS);
 508     }
 509
 510   wait (&wait_status);
 511   if (!WIFEXITED (wait_status))
 512     exit (EXIT_FAILURE);
 513   else if (WEXITSTATUS (wait_status) != 0)
 514     exit (WEXITSTATUS (wait_status));
 515
 516 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 517 #ifdef MAIL_USE_MAILLOCK
 518   if (! spool_name)
 519 #endif /* MAIL_USE_MAILLOCK */
 520     unlink (lockname);
 521 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 522
 523 #endif /* ! DISABLE_DIRECT_ACCESS */
 524
 525   return EXIT_SUCCESS;
 526 }
 527
 528 #ifdef MAIL_USE_MAILLOCK
 529 /* This function uses stat to confirm that the mail directory is
 530    identical to the directory of the input file, rather than just
 531    string-comparing the two paths, because one or both of them might
 532    be symbolic links pointing to some other directory. */
 533 static char *
 534 mail_spool_name (char *inname)
 535 {
 536   struct stat stat1, stat2;
 537   char *indir, *fname;
 538   int status;
 539
 540   if (! (fname = strrchr (inname, '/')))
 541     return NULL;
 542
 543   fname++;
 544
 545   if (stat (MAILDIR, &stat1) < 0)
 546     return NULL;
 547
 548   indir = xmalloc (fname - inname + 1);
 549   memcpy (indir, inname, fname - inname);
 550   indir[fname-inname] = '\0';
 551
 552
 553   status = stat (indir, &stat2);
 554
 555   free (indir);
 556
 557   if (status < 0)
 558     return NULL;
 559
 560   if (stat1.st_dev == stat2.st_dev
 561       && stat1.st_ino == stat2.st_ino)
 562     return fname;
 563
 564   return NULL;
 565 }
 566 #endif /* MAIL_USE_MAILLOCK */
 567 \f
 568 /* Print error message and exit.  */
 569
 570 static void
 571 fatal (const char *s1, const char *s2, const char *s3)
 572 {
 573   if (delete_lockname)
 574     unlink (delete_lockname);
 575   error (s1, s2, s3);
 576   exit (EXIT_FAILURE);
 577 }
 578
 579 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 580    are args for it or null. */
 581
 582 static void
 583 error (const char *s1, const char *s2, const char *s3)
 584 {
 585   fprintf (stderr, "movemail: ");
 586   if (s3)
 587     fprintf (stderr, s1, s2, s3);
 588   else if (s2)
 589     fprintf (stderr, s1, s2);
 590   else
 591     fprintf (stderr, "%s", s1);
 592   fprintf (stderr, "\n");
 593 }
 594
 595 static void
 596 pfatal_with_name (char *name)
 597 {
 598   fatal ("%s for %s", strerror (errno), name);
 599 }
 600
 601 static void
 602 pfatal_and_delete (char *name)
 603 {
 604   char *s = strerror (errno);
 605   unlink (name);
 606   fatal ("%s for %s", s, name);
 607 }
 608 \f
 609 /* This is the guts of the interface to the Post Office Protocol.  */
 610
 611 #ifdef MAIL_USE_POP
 612
 613 #ifndef WINDOWSNT
 614 #include <sys/socket.h>
 615 #include <netinet/in.h>
 616 #include <netdb.h>
 617 #else
 618 #undef _WINSOCKAPI_
 619 #include <winsock.h>
 620 #endif
 621 #include <pwd.h>
 622 #include <string.h>
 623
 624 #define NOTOK (-1)
 625 #define OK 0
 626
 627 static char Errmsg[200];        /* POP errors, at least, can exceed
 628                                    the original length of 80.  */
 629
 630 /*
 631  * The full valid syntax for a POP mailbox specification for movemail
 632  * is "po:username:hostname".  The ":hostname" is optional; if it is
 633  * omitted, the MAILHOST environment variable will be consulted.  Note
 634  * that by the time popmail() is called the "po:" has been stripped
 635  * off of the front of the mailbox name.
 636  *
 637  * If the mailbox is in the form "po:username:hostname", then it is
 638  * modified by this function -- the second colon is replaced by a
 639  * null.
 640  *
 641  * Return a value suitable for passing to `exit'.
 642  */
 643
 644 static int
 645 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 646 {
 647   int nmsgs, nbytes;
 648   register int i;
 649   int mbfi;
 650   FILE *mbf;
 651   popserver server;
 652   int start, end, increment;
 653   char *user, *hostname;
 654
 655   user = mailbox;
 656   if ((hostname = strchr (mailbox, ':')))
 657     *hostname++ = '\0';
 658
 659   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 660   if (! server)
 661     {
 662       error ("Error connecting to POP server: %s", pop_error, 0);
 663       return EXIT_FAILURE;
 664     }
 665
 666   if (pop_stat (server, &nmsgs, &nbytes))
 667     {
 668       error ("Error getting message count from POP server: %s", pop_error, 0);
 669       return EXIT_FAILURE;
 670     }
 671
 672   if (!nmsgs)
 673     {
 674       pop_close (server);
 675       return EXIT_SUCCESS;
 676     }
 677
 678   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 679   if (mbfi < 0)
 680     {
 681       pop_close (server);
 682       error ("Error in open: %s, %s", strerror (errno), outfile);
 683       return EXIT_FAILURE;
 684     }
 685
 686   if (fchown (mbfi, getuid (), -1) != 0)
 687     {
 688       int fchown_errno = errno;
 689       struct stat st;
 690       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 691         {
 692           pop_close (server);
 693           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 694           return EXIT_FAILURE;
 695         }
 696     }
 697
 698   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 699     {
 700       pop_close (server);
 701       error ("Error in fdopen: %s", strerror (errno), 0);
 702       close (mbfi);
 703       unlink (outfile);
 704       return EXIT_FAILURE;
 705     }
 706
 707   if (reverse_order)
 708     {
 709       start = nmsgs;
 710       end = 1;
 711       increment = -1;
 712     }
 713   else
 714     {
 715       start = 1;
 716       end = nmsgs;
 717       increment = 1;
 718     }
 719
 720   for (i = start; i * increment <= end * increment; i += increment)
 721     {
 722       mbx_delimit_begin (mbf);
 723       if (pop_retr (server, i, mbf) != OK)
 724         {
 725           error ("%s", Errmsg, 0);
 726           close (mbfi);
 727           return EXIT_FAILURE;
 728         }
 729       mbx_delimit_end (mbf);
 730       fflush (mbf);
 731       if (ferror (mbf))
 732         {
 733           error ("Error in fflush: %s", strerror (errno), 0);
 734           pop_close (server);
 735           close (mbfi);
 736           return EXIT_FAILURE;
 737         }
 738     }
 739
 740   if (fsync (mbfi) != 0 && errno != EINVAL)
 741     {
 742       error ("Error in fsync: %s", strerror (errno), 0);
 743       close (mbfi);
 744       return EXIT_FAILURE;
 745     }
 746
 747   if (close (mbfi) != 0)
 748     {
 749       error ("Error in close: %s", strerror (errno), 0);
 750       return EXIT_FAILURE;
 751     }
 752
 753   if (! preserve)
 754     for (i = 1; i <= nmsgs; i++)
 755       {
 756         if (pop_delete (server, i))
 757           {
 758             error ("Error from POP server: %s", pop_error, 0);
 759             pop_close (server);
 760             return EXIT_FAILURE;
 761           }
 762       }
 763
 764   if (pop_quit (server))
 765     {
 766       error ("Error from POP server: %s", pop_error, 0);
 767       return EXIT_FAILURE;
 768     }
 769
 770   return EXIT_SUCCESS;
 771 }
 772
 773 static int
 774 pop_retr (popserver server, int msgno, FILE *arg)
 775 {
 776   char *line;
 777   int ret;
 778
 779   if (pop_retrieve_first (server, msgno, &line))
 780     {
 781       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 782       return (NOTOK);
 783     }
 784
 785   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 786     {
 787       if (! line)
 788         break;
 789
 790       if (mbx_write (line, ret, arg) != OK)
 791         {
 792           strcpy (Errmsg, strerror (errno));
 793           pop_close (server);
 794           return (NOTOK);
 795         }
 796     }
 797
 798   if (ret)
 799     {
 800       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 801       return (NOTOK);
 802     }
 803
 804   return (OK);
 805 }
 806
 807 static int
 808 mbx_write (char *line, int len, FILE *mbf)
 809 {
 810 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 811   /* Do this as a macro instead of using strcmp to save on execution time. */
 812   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 813                             && (a[1] == 'r')    \
 814                             && (a[2] == 'o')    \
 815                             && (a[3] == 'm')    \
 816                             && (a[4] == ' '))
 817   if (IS_FROM_LINE (line))
 818     {
 819       if (fputc ('>', mbf) == EOF)
 820         return (NOTOK);
 821     }
 822 #endif
 823   if (line[0] == '\037')
 824     {
 825       if (fputs ("^_", mbf) == EOF)
 826         return (NOTOK);
 827       line++;
 828       len--;
 829     }
 830   if (fwrite (line, 1, len, mbf) != len)
 831     return (NOTOK);
 832   if (fputc (0x0a, mbf) == EOF)
 833     return (NOTOK);
 834   return (OK);
 835 }
 836
 837 static int
 838 mbx_delimit_begin (FILE *mbf)
 839 {
 840   time_t now;
 841   struct tm *ltime;
 842   char fromline[40] = "From movemail ";
 843
 844   now = time (NULL);
 845   ltime = localtime (&now);
 846
 847   strcat (fromline, asctime (ltime));
 848
 849   if (fputs (fromline, mbf) == EOF)
 850     return (NOTOK);
 851   return (OK);
 852 }
 853
 854 static int
 855 mbx_delimit_end (FILE *mbf)
 856 {
 857   if (putc ('\n', mbf) == EOF)
 858     return (NOTOK);
 859   return (OK);
 860 }
 861
 862 #endif /* MAIL_USE_POP */