lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2017 Free Software
   5 Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or (at
  12 your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <stdlib.h>
  64 #include <errno.h>
  65 #include <time.h>
  66
  67 #include <getopt.h>
  68 #include <unistd.h>
  69 #include <fcntl.h>
  70 #include <signal.h>
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define waitpid(child, var, flags) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifdef WINDOWSNT
 102 #include <sys/locking.h>
 103 #endif
 104
 105 /* If your system uses the `flock' or `lockf' system call for mail locking,
 106    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 107    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 108    please make a bug report.  */
 109
 110 #ifdef MAIL_USE_LOCKF
 111 #define MAIL_USE_SYSTEM_LOCK
 112 #endif
 113
 114 #ifdef MAIL_USE_FLOCK
 115 #define MAIL_USE_SYSTEM_LOCK
 116 #endif
 117
 118 #if (!defined MAIL_USE_SYSTEM_LOCK                              \
 119      && (defined HAVE_LIBMAIL || defined HAVE_LIBLOCKFILE)      \
 120      && defined HAVE_MAILLOCK_H)
 121 #include <maillock.h>
 122 /* We can't use maillock unless we know what directory system mail
 123    files appear in. */
 124 #ifdef MAILDIR
 125 #define MAIL_USE_MAILLOCK
 126 static char *mail_spool_name (char *);
 127 #endif
 128 #endif
 129
 130 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 131 static void error (const char *s1, const char *s2, const char *s3);
 132 static _Noreturn void pfatal_with_name (char *name);
 133 static _Noreturn void pfatal_and_delete (char *name);
 134 #ifdef MAIL_USE_POP
 135 static int popmail (char *, char *, bool, char *, bool);
 136 static bool pop_retr (popserver, int, FILE *);
 137 static bool mbx_write (char *, int, FILE *);
 138 static bool mbx_delimit_begin (FILE *);
 139 static bool mbx_delimit_end (FILE *);
 140 #endif
 141
 142 #if (defined MAIL_USE_MAILLOCK                                          \
 143      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_SYSTEM_LOCK))
 144 /* Like malloc but get fatal error if memory is exhausted.  */
 145
 146 static void *
 147 xmalloc (size_t size)
 148 {
 149   void *result = malloc (size);
 150   if (!result)
 151     fatal ("virtual memory exhausted", 0, 0);
 152   return result;
 153 }
 154 #endif
 155
 156 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 157 static char *delete_lockname;
 158
 159 int
 160 main (int argc, char **argv)
 161 {
 162   char *inname, *outname;
 163   int indesc, outdesc;
 164   ssize_t nread;
 165   int wait_status;
 166   int c;
 167   bool preserve_mail = false;
 168
 169 #ifndef MAIL_USE_SYSTEM_LOCK
 170   struct stat st;
 171   int tem;
 172   char *tempname;
 173   size_t inname_len, inname_dirlen;
 174   int desc;
 175 #endif /* not MAIL_USE_SYSTEM_LOCK */
 176
 177 #ifdef MAIL_USE_POP
 178   bool pop_reverse_order = false;
 179 # define ARGSTR "pr"
 180 #else /* ! MAIL_USE_POP */
 181 # define ARGSTR "p"
 182 #endif /* MAIL_USE_POP */
 183
 184   uid_t real_gid = getgid ();
 185   uid_t priv_gid = getegid ();
 186
 187   delete_lockname = 0;
 188
 189   while (0 <= (c = getopt (argc, argv, ARGSTR)))
 190     {
 191       switch (c) {
 192 #ifdef MAIL_USE_POP
 193       case 'r':
 194         pop_reverse_order = true;
 195         break;
 196 #endif
 197       case 'p':
 198         preserve_mail = true;
 199         break;
 200       default:
 201         return EXIT_FAILURE;
 202       }
 203     }
 204
 205   if (
 206 #ifdef MAIL_USE_POP
 207       (argc - optind < 2) || (argc - optind > 3)
 208 #else
 209       (argc - optind != 2)
 210 #endif
 211       )
 212     {
 213 #ifdef MAIL_USE_POP
 214       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 215                " [POP-password]");
 216 #else
 217       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 218 #endif
 219       return EXIT_FAILURE;
 220     }
 221
 222   inname = argv[optind];
 223   outname = argv[optind+1];
 224
 225   if (*outname == 0)
 226     fatal ("Destination file name is empty", 0, 0);
 227
 228 #ifdef MAIL_USE_POP
 229   if (!strncmp (inname, "po:", 3))
 230     {
 231       int status;
 232
 233       status = popmail (inname + 3, outname, preserve_mail,
 234                         (argc - optind == 3) ? argv[optind+2] : NULL,
 235                         pop_reverse_order);
 236       return status;
 237     }
 238
 239   if (setuid (getuid ()) < 0)
 240     fatal ("Failed to drop privileges", 0, 0);
 241
 242 #endif /* MAIL_USE_POP */
 243
 244 #ifndef DISABLE_DIRECT_ACCESS
 245
 246   char *lockname = 0;
 247   char *spool_name = 0;
 248
 249 #ifdef MAIL_USE_MAILLOCK
 250   spool_name = mail_spool_name (inname);
 251 #endif
 252   if (! spool_name)
 253     {
 254 #ifndef MAIL_USE_SYSTEM_LOCK
 255       /* Use a lock file named after our first argument with .lock appended:
 256          If it exists, the mail file is locked.  */
 257       /* Note: this locking mechanism is *required* by the mailer
 258          (on systems which use it) to prevent loss of mail.
 259
 260          On systems that use a lock file, extracting the mail without locking
 261          WILL occasionally cause loss of mail due to timing errors!
 262
 263          So, if creation of the lock file fails due to access
 264          permission on the mail spool directory, you simply MUST
 265          change the permission and/or make movemail a setgid program
 266          so it can create lock files properly.
 267
 268          You might also wish to verify that your system is one which
 269          uses lock files for this purpose.  Some systems use other methods.  */
 270
 271       inname_len = strlen (inname);
 272       lockname = xmalloc (inname_len + sizeof ".lock");
 273       strcpy (lockname, inname);
 274       strcpy (lockname + inname_len, ".lock");
 275       for (inname_dirlen = inname_len;
 276            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 277            inname_dirlen--)
 278         continue;
 279       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 280
 281       while (true)
 282         {
 283           /* Create the lock file, but not under the lock file name.  */
 284           /* Give up if cannot do that.  */
 285
 286           memcpy (tempname, inname, inname_dirlen);
 287           strcpy (tempname + inname_dirlen, "EXXXXXX");
 288           desc = mkostemp (tempname, O_BINARY);
 289           if (desc < 0)
 290             {
 291               int mkostemp_errno = errno;
 292               error ("error while creating what would become the lock file",
 293                      0, 0);
 294               errno = mkostemp_errno;
 295               pfatal_with_name (tempname);
 296             }
 297           close (desc);
 298
 299           tem = link (tempname, lockname);
 300
 301           if (tem < 0 && errno != EEXIST)
 302             pfatal_with_name (lockname);
 303
 304           unlink (tempname);
 305           if (tem >= 0)
 306             break;
 307           sleep (1);
 308
 309           /* If lock file is five minutes old, unlock it.
 310              Five minutes should be good enough to cope with crashes
 311              and wedgitude, and long enough to avoid being fooled
 312              by time differences between machines.  */
 313           if (stat (lockname, &st) >= 0)
 314             {
 315               time_t now = time (0);
 316               if (st.st_ctime < now - 300)
 317                 {
 318                   unlink (lockname);
 319                   lockname = 0;
 320                 }
 321             }
 322         }
 323
 324       delete_lockname = lockname;
 325 #endif /* not MAIL_USE_SYSTEM_LOCK */
 326     }
 327
 328 #ifdef SIGCHLD
 329   signal (SIGCHLD, SIG_DFL);
 330 #endif
 331
 332   pid_t child = fork ();
 333   if (child < 0)
 334     fatal ("Error in fork; %s", strerror (errno), 0);
 335
 336   if (child == 0)
 337     {
 338       int lockcount = 0;
 339       int status = 0;
 340 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 341       time_t touched_lock;
 342 #endif
 343
 344       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 345         fatal ("Failed to drop privileges", 0, 0);
 346
 347 #ifdef MAIL_USE_SYSTEM_LOCK
 348       indesc = open (inname, O_RDWR | O_BINARY);
 349 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 350       indesc = open (inname, O_RDONLY | O_BINARY);
 351 #endif /* not MAIL_USE_SYSTEM_LOCK */
 352
 353       if (indesc < 0)
 354         pfatal_with_name (inname);
 355
 356       /* Make sure the user can read the output file.  */
 357       umask (umask (0) & 0377);
 358
 359       outdesc = open (outname, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 360       if (outdesc < 0)
 361         pfatal_with_name (outname);
 362
 363       if (setregid (-1, priv_gid) < 0)
 364         fatal ("Failed to regain privileges", 0, 0);
 365
 366       /* This label exists so we can retry locking
 367          after a delay, if it got EAGAIN or EBUSY.  */
 368     retry_lock:
 369
 370       /* Try to lock it.  */
 371 #ifdef MAIL_USE_MAILLOCK
 372       if (spool_name)
 373         {
 374           /* The "-" is to make it a negative number if maillock returns
 375              non-zero. */
 376           status = - maillock (spool_name, 1);
 377 #ifdef HAVE_TOUCHLOCK
 378           touched_lock = time (0);
 379 #endif
 380           lockcount = 5;
 381         }
 382       else
 383 #endif /* MAIL_USE_MAILLOCK */
 384         {
 385 #ifdef MAIL_USE_SYSTEM_LOCK
 386 #ifdef MAIL_USE_LOCKF
 387           status = lockf (indesc, F_LOCK, 0);
 388 #else /* not MAIL_USE_LOCKF */
 389 #ifdef WINDOWSNT
 390           status = locking (indesc, LK_RLCK, -1L);
 391 #else
 392           status = flock (indesc, LOCK_EX);
 393 #endif
 394 #endif /* not MAIL_USE_LOCKF */
 395 #endif /* MAIL_USE_SYSTEM_LOCK */
 396         }
 397
 398       /* If it fails, retry up to 5 times
 399          for certain failure codes.  */
 400       if (status < 0)
 401         {
 402           if (++lockcount <= 5 && (errno == EAGAIN || errno == EBUSY))
 403             {
 404               sleep (1);
 405               goto retry_lock;
 406             }
 407
 408           pfatal_with_name (inname);
 409         }
 410
 411       {
 412         char buf[1024];
 413
 414         while (true)
 415           {
 416             nread = read (indesc, buf, sizeof buf);
 417             if (nread < 0)
 418               pfatal_with_name (inname);
 419             if (nread != write (outdesc, buf, nread))
 420               {
 421                 int saved_errno = errno;
 422                 unlink (outname);
 423                 errno = saved_errno;
 424                 pfatal_with_name (outname);
 425               }
 426             if (nread < sizeof buf)
 427               break;
 428 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 429             if (spool_name)
 430               {
 431                 time_t now = time (0);
 432                 if (now - touched_lock > 60)
 433                   {
 434                     touchlock ();
 435                     touched_lock = now;
 436                   }
 437               }
 438 #endif /* MAIL_USE_MAILLOCK */
 439           }
 440       }
 441
 442       if (fsync (outdesc) != 0 && errno != EINVAL)
 443         pfatal_and_delete (outname);
 444
 445       /* Prevent symlink attacks truncating other users' mailboxes */
 446       if (setregid (-1, real_gid) < 0)
 447         fatal ("Failed to drop privileges", 0, 0);
 448
 449       /* Check to make sure no errors before we zap the inbox.  */
 450       if (close (outdesc) != 0)
 451         pfatal_and_delete (outname);
 452
 453 #ifdef MAIL_USE_SYSTEM_LOCK
 454       if (! preserve_mail)
 455         {
 456           if (ftruncate (indesc, 0) != 0)
 457             pfatal_with_name (inname);
 458         }
 459 #endif /* MAIL_USE_SYSTEM_LOCK */
 460
 461       close (indesc);
 462
 463 #ifndef MAIL_USE_SYSTEM_LOCK
 464       if (! preserve_mail)
 465         {
 466           /* Delete the input file; if we can't, at least get rid of its
 467              contents.  */
 468 #ifdef MAIL_UNLINK_SPOOL
 469           /* This is generally bad to do, because it destroys the permissions
 470              that were set on the file.  Better to just empty the file.  */
 471           if (unlink (inname) < 0 && errno != ENOENT)
 472 #endif /* MAIL_UNLINK_SPOOL */
 473             creat (inname, 0600);
 474         }
 475 #endif /* not MAIL_USE_SYSTEM_LOCK */
 476
 477       /* End of mailbox truncation */
 478       if (setregid (-1, priv_gid) < 0)
 479         fatal ("Failed to regain privileges", 0, 0);
 480
 481 #ifdef MAIL_USE_MAILLOCK
 482       /* This has to occur in the child, i.e., in the process that
 483          acquired the lock! */
 484       if (spool_name)
 485         mailunlock ();
 486 #endif
 487       return EXIT_SUCCESS;
 488     }
 489
 490   if (waitpid (child, &wait_status, 0) < 0)
 491     fatal ("Error in waitpid; %s", strerror (errno), 0);
 492   if (!WIFEXITED (wait_status))
 493     return EXIT_FAILURE;
 494   else if (WEXITSTATUS (wait_status) != 0)
 495     return WEXITSTATUS (wait_status);
 496
 497   if (lockname)
 498     unlink (lockname);
 499
 500 #endif /* ! DISABLE_DIRECT_ACCESS */
 501
 502   return EXIT_SUCCESS;
 503 }
 504
 505 #ifdef MAIL_USE_MAILLOCK
 506 /* This function uses stat to confirm that the mail directory is
 507    identical to the directory of the input file, rather than just
 508    string-comparing the two paths, because one or both of them might
 509    be symbolic links pointing to some other directory. */
 510 static char *
 511 mail_spool_name (char *inname)
 512 {
 513   struct stat stat1, stat2;
 514   char *indir, *fname;
 515   int status;
 516
 517   if (! (fname = strrchr (inname, '/')))
 518     return NULL;
 519
 520   fname++;
 521
 522   if (stat (MAILDIR, &stat1) < 0)
 523     return NULL;
 524
 525   indir = xmalloc (fname - inname + 1);
 526   memcpy (indir, inname, fname - inname);
 527   indir[fname-inname] = '\0';
 528
 529
 530   status = stat (indir, &stat2);
 531
 532   free (indir);
 533
 534   if (status < 0)
 535     return NULL;
 536
 537   if (stat1.st_dev == stat2.st_dev
 538       && stat1.st_ino == stat2.st_ino)
 539     return fname;
 540
 541   return NULL;
 542 }
 543 #endif /* MAIL_USE_MAILLOCK */
 544 \f
 545 /* Print error message and exit.  */
 546
 547 static void
 548 fatal (const char *s1, const char *s2, const char *s3)
 549 {
 550   if (delete_lockname)
 551     unlink (delete_lockname);
 552   error (s1, s2, s3);
 553   exit (EXIT_FAILURE);
 554 }
 555
 556 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 557    are args for it or null. */
 558
 559 static void
 560 error (const char *s1, const char *s2, const char *s3)
 561 {
 562   fprintf (stderr, "movemail: ");
 563   if (s3)
 564     fprintf (stderr, s1, s2, s3);
 565   else if (s2)
 566     fprintf (stderr, s1, s2);
 567   else
 568     fprintf (stderr, "%s", s1);
 569   fprintf (stderr, "\n");
 570 }
 571
 572 static void
 573 pfatal_with_name (char *name)
 574 {
 575   fatal ("%s for %s", strerror (errno), name);
 576 }
 577
 578 static void
 579 pfatal_and_delete (char *name)
 580 {
 581   char *s = strerror (errno);
 582   unlink (name);
 583   fatal ("%s for %s", s, name);
 584 }
 585 \f
 586 /* This is the guts of the interface to the Post Office Protocol.  */
 587
 588 #ifdef MAIL_USE_POP
 589
 590 #ifndef WINDOWSNT
 591 #include <sys/socket.h>
 592 #include <netinet/in.h>
 593 #include <netdb.h>
 594 #else
 595 #undef _WINSOCKAPI_
 596 #include <winsock.h>
 597 #endif
 598 #include <pwd.h>
 599 #include <string.h>
 600
 601 /*
 602  * The full valid syntax for a POP mailbox specification for movemail
 603  * is "po:username:hostname".  The ":hostname" is optional; if it is
 604  * omitted, the MAILHOST environment variable will be consulted.  Note
 605  * that by the time popmail() is called the "po:" has been stripped
 606  * off of the front of the mailbox name.
 607  *
 608  * If the mailbox is in the form "po:username:hostname", then it is
 609  * modified by this function -- the second colon is replaced by a
 610  * null.
 611  *
 612  * Return a value suitable for passing to `exit'.
 613  */
 614
 615 static int
 616 popmail (char *mailbox, char *outfile, bool preserve, char *password,
 617          bool reverse_order)
 618 {
 619   int nmsgs, nbytes;
 620   int i;
 621   int mbfi;
 622   FILE *mbf;
 623   popserver server;
 624   int start, end, increment;
 625   char *user, *hostname;
 626
 627   user = mailbox;
 628   if ((hostname = strchr (mailbox, ':')))
 629     *hostname++ = '\0';
 630
 631   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 632   if (! server)
 633     {
 634       error ("Error connecting to POP server: %s", pop_error, 0);
 635       return EXIT_FAILURE;
 636     }
 637
 638   if (pop_stat (server, &nmsgs, &nbytes))
 639     {
 640       error ("Error getting message count from POP server: %s", pop_error, 0);
 641       return EXIT_FAILURE;
 642     }
 643
 644   if (!nmsgs)
 645     {
 646       pop_close (server);
 647       return EXIT_SUCCESS;
 648     }
 649
 650   mbfi = open (outfile, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 651   if (mbfi < 0)
 652     {
 653       pop_close (server);
 654       error ("Error in open: %s, %s", strerror (errno), outfile);
 655       return EXIT_FAILURE;
 656     }
 657
 658   if (fchown (mbfi, getuid (), -1) != 0)
 659     {
 660       int fchown_errno = errno;
 661       struct stat st;
 662       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 663         {
 664           pop_close (server);
 665           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 666           return EXIT_FAILURE;
 667         }
 668     }
 669
 670   mbf = fdopen (mbfi, "wb");
 671   if (!mbf)
 672     {
 673       pop_close (server);
 674       error ("Error in fdopen: %s", strerror (errno), 0);
 675       close (mbfi);
 676       unlink (outfile);
 677       return EXIT_FAILURE;
 678     }
 679
 680   if (reverse_order)
 681     {
 682       start = nmsgs;
 683       end = 1;
 684       increment = -1;
 685     }
 686   else
 687     {
 688       start = 1;
 689       end = nmsgs;
 690       increment = 1;
 691     }
 692
 693   for (i = start; i * increment <= end * increment; i += increment)
 694     if (! (mbx_delimit_begin (mbf)
 695            && pop_retr (server, i, mbf)
 696            && mbx_delimit_end (mbf)
 697            && fflush (mbf) == 0))
 698       {
 699         if (errno)
 700           error ("Error in POP retrieving: %s", strerror (errno), 0);
 701         pop_close (server);
 702         fclose (mbf);
 703         return EXIT_FAILURE;
 704       }
 705
 706   if (fsync (mbfi) != 0 && errno != EINVAL)
 707     {
 708       error ("Error in fsync: %s", strerror (errno), 0);
 709       fclose (mbf);
 710       return EXIT_FAILURE;
 711     }
 712
 713   if (fclose (mbf) != 0)
 714     {
 715       error ("Error in fclose: %s", strerror (errno), 0);
 716       return EXIT_FAILURE;
 717     }
 718
 719   if (! preserve)
 720     for (i = 1; i <= nmsgs; i++)
 721       {
 722         if (pop_delete (server, i))
 723           {
 724             error ("Error from POP server: %s", pop_error, 0);
 725             pop_close (server);
 726             return EXIT_FAILURE;
 727           }
 728       }
 729
 730   if (pop_quit (server))
 731     {
 732       error ("Error from POP server: %s", pop_error, 0);
 733       return EXIT_FAILURE;
 734     }
 735
 736   return EXIT_SUCCESS;
 737 }
 738
 739 static bool
 740 pop_retr (popserver server, int msgno, FILE *arg)
 741 {
 742   char *line;
 743   int ret;
 744
 745   if (pop_retrieve_first (server, msgno, &line))
 746     {
 747       error ("Error from POP server: %s", pop_error, 0);
 748       errno = 0;
 749       return false;
 750     }
 751
 752   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 753     {
 754       if (! line)
 755         break;
 756
 757       if (! mbx_write (line, ret, arg))
 758         {
 759           int write_errno = errno;
 760           pop_close (server);
 761           errno = write_errno;
 762           return false;
 763         }
 764     }
 765
 766   if (ret)
 767     {
 768       error ("Error from POP server: %s", pop_error, 0);
 769       errno = 0;
 770       return false;
 771     }
 772
 773   return true;
 774 }
 775
 776 static bool
 777 mbx_write (char *line, int len, FILE *mbf)
 778 {
 779 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 780   /* Do this as a macro instead of using strcmp to save on execution time. */
 781   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 782                             && (a[1] == 'r')    \
 783                             && (a[2] == 'o')    \
 784                             && (a[3] == 'm')    \
 785                             && (a[4] == ' '))
 786   if (IS_FROM_LINE (line))
 787     {
 788       if (fputc ('>', mbf) < 0)
 789         return false;
 790     }
 791 #endif
 792   if (line[0] == '\037')
 793     {
 794       if (fputs ("^_", mbf) < 0)
 795         return false;
 796       line++;
 797       len--;
 798     }
 799   return fwrite (line, 1, len, mbf) == len && 0 <= fputc ('\n', mbf);
 800 }
 801
 802 #ifdef WINDOWSNT
 803 /* Work around MS-Windows lack of support for %e or %T with a
 804    special-purpose strftime that assumes the exact format that
 805    movemail uses.  */
 806 static size_t
 807 movemail_strftime (char *s, size_t size, char const *format,
 808                    struct tm const *tm)
 809 {
 810   char fmt[size + 6], *q;
 811   const char *p;
 812
 813   for (p = format, q = &fmt[0]; *p; )
 814     {
 815       if (*p == '%' && p[1] == 'e')
 816         {
 817           memcpy (q, "%d", 2);
 818           q += 2;
 819           p += 2;
 820         }
 821       else if (*p == '%' && p[1] == 'T')
 822         {
 823           memcpy (q, "%H:%M:%S", 8);
 824           q += 8;
 825           p += 2;
 826         }
 827       else if (*p == '%' && p[1] == '%')
 828         {
 829           memcpy (q, p, 2);
 830           q += 2;
 831           p += 2;
 832         }
 833       else
 834         *q++ = *p++;
 835     }
 836
 837   size_t n = strftime (s, size, fmt, tm);
 838   char *mday = s + sizeof "From movemail Sun Jan " - 1;
 839   if (*mday == '0')
 840     *mday = ' ';
 841   return n;
 842 }
 843 # undef strftime
 844 # define strftime movemail_strftime
 845 #endif
 846
 847 static bool
 848 mbx_delimit_begin (FILE *mbf)
 849 {
 850   time_t now = time (NULL);
 851   struct tm *ltime = localtime (&now);
 852   if (!ltime)
 853     return false;
 854
 855   char fromline[100];
 856   if (! strftime (fromline, sizeof fromline,
 857                   "From movemail %a %b %e %T %Y\n", ltime))
 858     {
 859       errno = EOVERFLOW;
 860       return false;
 861     }
 862   return 0 <= fputs (fromline, mbf);
 863 }
 864
 865 static bool
 866 mbx_delimit_end (FILE *mbf)
 867 {
 868   return 0 <= putc ('\n', mbf);
 869 }
 870
 871 #endif /* MAIL_USE_POP */