lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2012
   5   Free Software Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #ifdef HAVE_FCNTL_H
  69 #include <fcntl.h>
  70 #endif
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define wait(var) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifndef F_OK
 102 #define F_OK 0
 103 #define X_OK 1
 104 #define W_OK 2
 105 #define R_OK 4
 106 #endif
 107
 108 #ifdef WINDOWSNT
 109 #include <sys/locking.h>
 110 #endif
 111
 112 #ifdef MAIL_USE_LOCKF
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_FLOCK
 117 #define MAIL_USE_SYSTEM_LOCK
 118 #endif
 119
 120 #ifdef MAIL_USE_MMDF
 121 extern int lk_open (), lk_close ();
 122 #endif
 123
 124 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 125         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 126         defined (HAVE_MAILLOCK_H)
 127 #include <maillock.h>
 128 /* We can't use maillock unless we know what directory system mail
 129    files appear in. */
 130 #ifdef MAILDIR
 131 #define MAIL_USE_MAILLOCK
 132 static char *mail_spool_name (char *);
 133 #endif
 134 #endif
 135
 136 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 137 static void error (const char *s1, const char *s2, const char *s3);
 138 static _Noreturn void pfatal_with_name (char *name);
 139 static _Noreturn void pfatal_and_delete (char *name);
 140 #ifdef MAIL_USE_POP
 141 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 142 static int pop_retr (popserver server, int msgno, FILE *arg);
 143 static int mbx_write (char *line, int len, FILE *mbf);
 144 static int mbx_delimit_begin (FILE *mbf);
 145 static int mbx_delimit_end (FILE *mbf);
 146 #endif
 147
 148 #if (defined MAIL_USE_MAILLOCK                                          \
 149      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF       \
 150          && !defined MAIL_USE_SYSTEM_LOCK))
 151 /* Like malloc but get fatal error if memory is exhausted.  */
 152
 153 static void *
 154 xmalloc (size_t size)
 155 {
 156   void *result = malloc (size);
 157   if (!result)
 158     fatal ("virtual memory exhausted", 0, 0);
 159   return result;
 160 }
 161 #endif
 162
 163 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 164 static char *delete_lockname;
 165
 166 int
 167 main (int argc, char **argv)
 168 {
 169   char *inname, *outname;
 170   int indesc, outdesc;
 171   ssize_t nread;
 172   int wait_status;
 173   int c, preserve_mail = 0;
 174
 175 #ifndef MAIL_USE_SYSTEM_LOCK
 176   struct stat st;
 177   int tem;
 178   char *lockname;
 179   char *tempname;
 180   size_t inname_len, inname_dirlen;
 181   int desc;
 182 #endif /* not MAIL_USE_SYSTEM_LOCK */
 183
 184 #ifdef MAIL_USE_MAILLOCK
 185   char *spool_name;
 186 #endif
 187
 188 #ifdef MAIL_USE_POP
 189   int pop_reverse_order = 0;
 190 # define ARGSTR "pr"
 191 #else /* ! MAIL_USE_POP */
 192 # define ARGSTR "p"
 193 #endif /* MAIL_USE_POP */
 194
 195   uid_t real_gid = getgid ();
 196   uid_t priv_gid = getegid ();
 197
 198 #ifdef WINDOWSNT
 199   /* Ensure all file i/o is in binary mode. */
 200   _fmode = _O_BINARY;
 201 #endif
 202
 203   delete_lockname = 0;
 204
 205   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 206     {
 207       switch (c) {
 208 #ifdef MAIL_USE_POP
 209       case 'r':
 210         pop_reverse_order = 1;
 211         break;
 212 #endif
 213       case 'p':
 214         preserve_mail++;
 215         break;
 216       default:
 217         exit (EXIT_FAILURE);
 218       }
 219     }
 220
 221   if (
 222 #ifdef MAIL_USE_POP
 223       (argc - optind < 2) || (argc - optind > 3)
 224 #else
 225       (argc - optind != 2)
 226 #endif
 227       )
 228     {
 229 #ifdef MAIL_USE_POP
 230       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 231                " [POP-password]");
 232 #else
 233       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 234 #endif
 235       exit (EXIT_FAILURE);
 236     }
 237
 238   inname = argv[optind];
 239   outname = argv[optind+1];
 240
 241 #ifdef MAIL_USE_MMDF
 242   mmdf_init (argv[0]);
 243 #endif
 244
 245   if (*outname == 0)
 246     fatal ("Destination file name is empty", 0, 0);
 247
 248 #ifdef MAIL_USE_POP
 249   if (!strncmp (inname, "po:", 3))
 250     {
 251       int status;
 252
 253       status = popmail (inname + 3, outname, preserve_mail,
 254                         (argc - optind == 3) ? argv[optind+2] : NULL,
 255                         pop_reverse_order);
 256       exit (status);
 257     }
 258
 259   if (setuid (getuid ()) < 0)
 260     fatal ("Failed to drop privileges", 0, 0);
 261
 262 #endif /* MAIL_USE_POP */
 263
 264 #ifndef DISABLE_DIRECT_ACCESS
 265 #ifndef MAIL_USE_MMDF
 266 #ifndef MAIL_USE_SYSTEM_LOCK
 267 #ifdef MAIL_USE_MAILLOCK
 268   spool_name = mail_spool_name (inname);
 269   if (spool_name)
 270     {
 271 #ifdef lint
 272       lockname = 0;
 273 #endif
 274     }
 275   else
 276 #endif
 277     {
 278       #ifndef DIRECTORY_SEP
 279        #define DIRECTORY_SEP '/'
 280       #endif
 281       #ifndef IS_DIRECTORY_SEP
 282        #define IS_DIRECTORY_SEP(_c_) ((_c_) == DIRECTORY_SEP)
 283       #endif
 284
 285       /* Use a lock file named after our first argument with .lock appended:
 286          If it exists, the mail file is locked.  */
 287       /* Note: this locking mechanism is *required* by the mailer
 288          (on systems which use it) to prevent loss of mail.
 289
 290          On systems that use a lock file, extracting the mail without locking
 291          WILL occasionally cause loss of mail due to timing errors!
 292
 293          So, if creation of the lock file fails due to access
 294          permission on the mail spool directory, you simply MUST
 295          change the permission and/or make movemail a setgid program
 296          so it can create lock files properly.
 297
 298          You might also wish to verify that your system is one which
 299          uses lock files for this purpose.  Some systems use other methods.
 300
 301          If your system uses the `flock' system call for mail locking,
 302          define MAIL_USE_SYSTEM_LOCK in config.h and recompile movemail.
 303          If your system type should always define MAIL_USE_SYSTEM_LOCK
 304          but does not, send a bug report to bug-gnu-emacs@gnu.org so we
 305          can change the default in configure.  */
 306
 307       inname_len = strlen (inname);
 308       lockname = xmalloc (inname_len + sizeof ".lock");
 309       strcpy (lockname, inname);
 310       strcpy (lockname + inname_len, ".lock");
 311       for (inname_dirlen = inname_len;
 312            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 313            inname_dirlen--)
 314         continue;
 315       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 316
 317       while (1)
 318         {
 319           /* Create the lock file, but not under the lock file name.  */
 320           /* Give up if cannot do that.  */
 321
 322           memcpy (tempname, inname, inname_dirlen);
 323           strcpy (tempname + inname_dirlen, "EXXXXXX");
 324 #ifdef HAVE_MKSTEMP
 325           desc = mkstemp (tempname);
 326 #else
 327           mktemp (tempname);
 328           if (!*tempname)
 329             desc = -1;
 330           else
 331             {
 332               unlink (tempname);
 333               desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 334             }
 335 #endif
 336           if (desc < 0)
 337             {
 338               int mkstemp_errno = errno;
 339               error ("error while creating what would become the lock file",
 340                      0, 0);
 341               errno = mkstemp_errno;
 342               pfatal_with_name (tempname);
 343             }
 344           close (desc);
 345
 346           tem = link (tempname, lockname);
 347
 348 #ifdef EPERM
 349           if (tem < 0 && errno == EPERM)
 350             fatal ("Unable to create hard link between %s and %s",
 351                    tempname, lockname);
 352 #endif
 353
 354           unlink (tempname);
 355           if (tem >= 0)
 356             break;
 357           sleep (1);
 358
 359           /* If lock file is five minutes old, unlock it.
 360              Five minutes should be good enough to cope with crashes
 361              and wedgitude, and long enough to avoid being fooled
 362              by time differences between machines.  */
 363           if (stat (lockname, &st) >= 0)
 364             {
 365               time_t now = time (0);
 366               if (st.st_ctime < now - 300)
 367                 unlink (lockname);
 368             }
 369         }
 370
 371       delete_lockname = lockname;
 372     }
 373 #endif /* not MAIL_USE_SYSTEM_LOCK */
 374 #endif /* not MAIL_USE_MMDF */
 375
 376   if (fork () == 0)
 377     {
 378       int lockcount = 0;
 379       int status = 0;
 380 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 381       time_t touched_lock;
 382 # ifdef lint
 383       touched_lock = 0;
 384 # endif
 385 #endif
 386
 387       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 388         fatal ("Failed to drop privileges", 0, 0);
 389
 390 #ifndef MAIL_USE_MMDF
 391 #ifdef MAIL_USE_SYSTEM_LOCK
 392       indesc = open (inname, O_RDWR);
 393 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 394       indesc = open (inname, O_RDONLY);
 395 #endif /* not MAIL_USE_SYSTEM_LOCK */
 396 #else  /* MAIL_USE_MMDF */
 397       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 398 #endif /* MAIL_USE_MMDF */
 399
 400       if (indesc < 0)
 401         pfatal_with_name (inname);
 402
 403 #ifdef BSD_SYSTEM
 404       /* In case movemail is setuid to root, make sure the user can
 405          read the output file.  */
 406       /* This is desirable for all systems
 407          but I don't want to assume all have the umask system call */
 408       umask (umask (0) & 0333);
 409 #endif /* BSD_SYSTEM */
 410       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 411       if (outdesc < 0)
 412         pfatal_with_name (outname);
 413
 414       if (setregid (-1, priv_gid) < 0)
 415         fatal ("Failed to regain privileges", 0, 0);
 416
 417       /* This label exists so we can retry locking
 418          after a delay, if it got EAGAIN or EBUSY.  */
 419     retry_lock:
 420
 421       /* Try to lock it.  */
 422 #ifdef MAIL_USE_MAILLOCK
 423       if (spool_name)
 424         {
 425           /* The "0 - " is to make it a negative number if maillock returns
 426              non-zero. */
 427           status = 0 - maillock (spool_name, 1);
 428 #ifdef HAVE_TOUCHLOCK
 429           touched_lock = time (0);
 430 #endif
 431           lockcount = 5;
 432         }
 433       else
 434 #endif /* MAIL_USE_MAILLOCK */
 435         {
 436 #ifdef MAIL_USE_SYSTEM_LOCK
 437 #ifdef MAIL_USE_LOCKF
 438           status = lockf (indesc, F_LOCK, 0);
 439 #else /* not MAIL_USE_LOCKF */
 440 #ifdef WINDOWSNT
 441           status = locking (indesc, LK_RLCK, -1L);
 442 #else
 443           status = flock (indesc, LOCK_EX);
 444 #endif
 445 #endif /* not MAIL_USE_LOCKF */
 446 #endif /* MAIL_USE_SYSTEM_LOCK */
 447         }
 448
 449       /* If it fails, retry up to 5 times
 450          for certain failure codes.  */
 451       if (status < 0)
 452         {
 453           if (++lockcount <= 5)
 454             {
 455 #ifdef EAGAIN
 456               if (errno == EAGAIN)
 457                 {
 458                   sleep (1);
 459                   goto retry_lock;
 460                 }
 461 #endif
 462 #ifdef EBUSY
 463               if (errno == EBUSY)
 464                 {
 465                   sleep (1);
 466                   goto retry_lock;
 467                 }
 468 #endif
 469             }
 470
 471           pfatal_with_name (inname);
 472         }
 473
 474       {
 475         char buf[1024];
 476
 477         while (1)
 478           {
 479             nread = read (indesc, buf, sizeof buf);
 480             if (nread < 0)
 481               pfatal_with_name (inname);
 482             if (nread != write (outdesc, buf, nread))
 483               {
 484                 int saved_errno = errno;
 485                 unlink (outname);
 486                 errno = saved_errno;
 487                 pfatal_with_name (outname);
 488               }
 489             if (nread < sizeof buf)
 490               break;
 491 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 492             if (spool_name)
 493               {
 494                 time_t now = time (0);
 495                 if (now - touched_lock > 60)
 496                   {
 497                     touchlock ();
 498                     touched_lock = now;
 499                   }
 500               }
 501 #endif /* MAIL_USE_MAILLOCK */
 502           }
 503       }
 504
 505 #ifdef BSD_SYSTEM
 506       if (fsync (outdesc) < 0)
 507         pfatal_and_delete (outname);
 508 #endif
 509
 510       /* Prevent symlink attacks truncating other users' mailboxes */
 511       if (setregid (-1, real_gid) < 0)
 512         fatal ("Failed to drop privileges", 0, 0);
 513
 514       /* Check to make sure no errors before we zap the inbox.  */
 515       if (close (outdesc) != 0)
 516         pfatal_and_delete (outname);
 517
 518 #ifdef MAIL_USE_SYSTEM_LOCK
 519       if (! preserve_mail)
 520         {
 521           if (ftruncate (indesc, 0L) != 0)
 522             pfatal_with_name (inname);
 523         }
 524 #endif /* MAIL_USE_SYSTEM_LOCK */
 525
 526 #ifdef MAIL_USE_MMDF
 527       lk_close (indesc, 0, 0, 0);
 528 #else
 529       close (indesc);
 530 #endif
 531
 532 #ifndef MAIL_USE_SYSTEM_LOCK
 533       if (! preserve_mail)
 534         {
 535           /* Delete the input file; if we can't, at least get rid of its
 536              contents.  */
 537 #ifdef MAIL_UNLINK_SPOOL
 538           /* This is generally bad to do, because it destroys the permissions
 539              that were set on the file.  Better to just empty the file.  */
 540           if (unlink (inname) < 0 && errno != ENOENT)
 541 #endif /* MAIL_UNLINK_SPOOL */
 542             creat (inname, 0600);
 543         }
 544 #endif /* not MAIL_USE_SYSTEM_LOCK */
 545
 546       /* End of mailbox truncation */
 547       if (setregid (-1, priv_gid) < 0)
 548         fatal ("Failed to regain privileges", 0, 0);
 549
 550 #ifdef MAIL_USE_MAILLOCK
 551       /* This has to occur in the child, i.e., in the process that
 552          acquired the lock! */
 553       if (spool_name)
 554         mailunlock ();
 555 #endif
 556       exit (EXIT_SUCCESS);
 557     }
 558
 559   wait (&wait_status);
 560   if (!WIFEXITED (wait_status))
 561     exit (EXIT_FAILURE);
 562   else if (WEXITSTATUS (wait_status) != 0)
 563     exit (WEXITSTATUS (wait_status));
 564
 565 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 566 #ifdef MAIL_USE_MAILLOCK
 567   if (! spool_name)
 568 #endif /* MAIL_USE_MAILLOCK */
 569     unlink (lockname);
 570 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 571
 572 #endif /* ! DISABLE_DIRECT_ACCESS */
 573
 574   return EXIT_SUCCESS;
 575 }
 576
 577 #ifdef MAIL_USE_MAILLOCK
 578 /* This function uses stat to confirm that the mail directory is
 579    identical to the directory of the input file, rather than just
 580    string-comparing the two paths, because one or both of them might
 581    be symbolic links pointing to some other directory. */
 582 static char *
 583 mail_spool_name (char *inname)
 584 {
 585   struct stat stat1, stat2;
 586   char *indir, *fname;
 587   int status;
 588
 589   if (! (fname = strrchr (inname, '/')))
 590     return NULL;
 591
 592   fname++;
 593
 594   if (stat (MAILDIR, &stat1) < 0)
 595     return NULL;
 596
 597   indir = xmalloc (fname - inname + 1);
 598   memcpy (indir, inname, fname - inname);
 599   indir[fname-inname] = '\0';
 600
 601
 602   status = stat (indir, &stat2);
 603
 604   free (indir);
 605
 606   if (status < 0)
 607     return NULL;
 608
 609   if (stat1.st_dev == stat2.st_dev
 610       && stat1.st_ino == stat2.st_ino)
 611     return fname;
 612
 613   return NULL;
 614 }
 615 #endif /* MAIL_USE_MAILLOCK */
 616 \f
 617 /* Print error message and exit.  */
 618
 619 static void
 620 fatal (const char *s1, const char *s2, const char *s3)
 621 {
 622   if (delete_lockname)
 623     unlink (delete_lockname);
 624   error (s1, s2, s3);
 625   exit (EXIT_FAILURE);
 626 }
 627
 628 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 629    are args for it or null. */
 630
 631 static void
 632 error (const char *s1, const char *s2, const char *s3)
 633 {
 634   fprintf (stderr, "movemail: ");
 635   if (s3)
 636     fprintf (stderr, s1, s2, s3);
 637   else if (s2)
 638     fprintf (stderr, s1, s2);
 639   else
 640     fprintf (stderr, "%s", s1);
 641   fprintf (stderr, "\n");
 642 }
 643
 644 static void
 645 pfatal_with_name (char *name)
 646 {
 647   fatal ("%s for %s", strerror (errno), name);
 648 }
 649
 650 static void
 651 pfatal_and_delete (char *name)
 652 {
 653   char *s = strerror (errno);
 654   unlink (name);
 655   fatal ("%s for %s", s, name);
 656 }
 657 \f
 658 /* This is the guts of the interface to the Post Office Protocol.  */
 659
 660 #ifdef MAIL_USE_POP
 661
 662 #ifndef WINDOWSNT
 663 #include <sys/socket.h>
 664 #include <netinet/in.h>
 665 #include <netdb.h>
 666 #else
 667 #undef _WINSOCKAPI_
 668 #include <winsock.h>
 669 #endif
 670 #include <pwd.h>
 671 #include <string.h>
 672
 673 #define NOTOK (-1)
 674 #define OK 0
 675
 676 static char Errmsg[200];        /* POP errors, at least, can exceed
 677                                    the original length of 80.  */
 678
 679 /*
 680  * The full valid syntax for a POP mailbox specification for movemail
 681  * is "po:username:hostname".  The ":hostname" is optional; if it is
 682  * omitted, the MAILHOST environment variable will be consulted.  Note
 683  * that by the time popmail() is called the "po:" has been stripped
 684  * off of the front of the mailbox name.
 685  *
 686  * If the mailbox is in the form "po:username:hostname", then it is
 687  * modified by this function -- the second colon is replaced by a
 688  * null.
 689  *
 690  * Return a value suitable for passing to `exit'.
 691  */
 692
 693 static int
 694 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 695 {
 696   int nmsgs, nbytes;
 697   register int i;
 698   int mbfi;
 699   FILE *mbf;
 700   char *getenv (const char *);
 701   popserver server;
 702   int start, end, increment;
 703   char *user, *hostname;
 704
 705   user = mailbox;
 706   if ((hostname = strchr (mailbox, ':')))
 707     *hostname++ = '\0';
 708
 709   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 710   if (! server)
 711     {
 712       error ("Error connecting to POP server: %s", pop_error, 0);
 713       return EXIT_FAILURE;
 714     }
 715
 716   if (pop_stat (server, &nmsgs, &nbytes))
 717     {
 718       error ("Error getting message count from POP server: %s", pop_error, 0);
 719       return EXIT_FAILURE;
 720     }
 721
 722   if (!nmsgs)
 723     {
 724       pop_close (server);
 725       return EXIT_SUCCESS;
 726     }
 727
 728   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 729   if (mbfi < 0)
 730     {
 731       pop_close (server);
 732       error ("Error in open: %s, %s", strerror (errno), outfile);
 733       return EXIT_FAILURE;
 734     }
 735
 736   if (fchown (mbfi, getuid (), -1) != 0)
 737     {
 738       int fchown_errno = errno;
 739       struct stat st;
 740       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 741         {
 742           pop_close (server);
 743           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 744           return EXIT_FAILURE;
 745         }
 746     }
 747
 748   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 749     {
 750       pop_close (server);
 751       error ("Error in fdopen: %s", strerror (errno), 0);
 752       close (mbfi);
 753       unlink (outfile);
 754       return EXIT_FAILURE;
 755     }
 756
 757   if (reverse_order)
 758     {
 759       start = nmsgs;
 760       end = 1;
 761       increment = -1;
 762     }
 763   else
 764     {
 765       start = 1;
 766       end = nmsgs;
 767       increment = 1;
 768     }
 769
 770   for (i = start; i * increment <= end * increment; i += increment)
 771     {
 772       mbx_delimit_begin (mbf);
 773       if (pop_retr (server, i, mbf) != OK)
 774         {
 775           error ("%s", Errmsg, 0);
 776           close (mbfi);
 777           return EXIT_FAILURE;
 778         }
 779       mbx_delimit_end (mbf);
 780       fflush (mbf);
 781       if (ferror (mbf))
 782         {
 783           error ("Error in fflush: %s", strerror (errno), 0);
 784           pop_close (server);
 785           close (mbfi);
 786           return EXIT_FAILURE;
 787         }
 788     }
 789
 790   /* On AFS, a call to write only modifies the file in the local
 791    *     workstation's AFS cache.  The changes are not written to the server
 792    *      until a call to fsync or close is made.  Users with AFS home
 793    *      directories have lost mail when over quota because these checks were
 794    *      not made in previous versions of movemail. */
 795
 796 #ifdef BSD_SYSTEM
 797   if (fsync (mbfi) < 0)
 798     {
 799       error ("Error in fsync: %s", strerror (errno), 0);
 800       return EXIT_FAILURE;
 801     }
 802 #endif
 803
 804   if (close (mbfi) == -1)
 805     {
 806       error ("Error in close: %s", strerror (errno), 0);
 807       return EXIT_FAILURE;
 808     }
 809
 810   if (! preserve)
 811     for (i = 1; i <= nmsgs; i++)
 812       {
 813         if (pop_delete (server, i))
 814           {
 815             error ("Error from POP server: %s", pop_error, 0);
 816             pop_close (server);
 817             return EXIT_FAILURE;
 818           }
 819       }
 820
 821   if (pop_quit (server))
 822     {
 823       error ("Error from POP server: %s", pop_error, 0);
 824       return EXIT_FAILURE;
 825     }
 826
 827   return EXIT_SUCCESS;
 828 }
 829
 830 static int
 831 pop_retr (popserver server, int msgno, FILE *arg)
 832 {
 833   char *line;
 834   int ret;
 835
 836   if (pop_retrieve_first (server, msgno, &line))
 837     {
 838       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 839       return (NOTOK);
 840     }
 841
 842   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 843     {
 844       if (! line)
 845         break;
 846
 847       if (mbx_write (line, ret, arg) != OK)
 848         {
 849           strcpy (Errmsg, strerror (errno));
 850           pop_close (server);
 851           return (NOTOK);
 852         }
 853     }
 854
 855   if (ret)
 856     {
 857       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 858       return (NOTOK);
 859     }
 860
 861   return (OK);
 862 }
 863
 864 static int
 865 mbx_write (char *line, int len, FILE *mbf)
 866 {
 867 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 868   /* Do this as a macro instead of using strcmp to save on execution time. */
 869   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 870                             && (a[1] == 'r')    \
 871                             && (a[2] == 'o')    \
 872                             && (a[3] == 'm')    \
 873                             && (a[4] == ' '))
 874   if (IS_FROM_LINE (line))
 875     {
 876       if (fputc ('>', mbf) == EOF)
 877         return (NOTOK);
 878     }
 879 #endif
 880   if (line[0] == '\037')
 881     {
 882       if (fputs ("^_", mbf) == EOF)
 883         return (NOTOK);
 884       line++;
 885       len--;
 886     }
 887   if (fwrite (line, 1, len, mbf) != len)
 888     return (NOTOK);
 889   if (fputc (0x0a, mbf) == EOF)
 890     return (NOTOK);
 891   return (OK);
 892 }
 893
 894 static int
 895 mbx_delimit_begin (FILE *mbf)
 896 {
 897   time_t now;
 898   struct tm *ltime;
 899   char fromline[40] = "From movemail ";
 900
 901   now = time (NULL);
 902   ltime = localtime (&now);
 903
 904   strcat (fromline, asctime (ltime));
 905
 906   if (fputs (fromline, mbf) == EOF)
 907     return (NOTOK);
 908   return (OK);
 909 }
 910
 911 static int
 912 mbx_delimit_end (FILE *mbf)
 913 {
 914   if (putc ('\n', mbf) == EOF)
 915     return (NOTOK);
 916   return (OK);
 917 }
 918
 919 #endif /* MAIL_USE_POP */