lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2013 Free Software
   5 Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #include <fcntl.h>
  69 #include <string.h>
  70 #include "syswait.h"
  71 #ifdef MAIL_USE_POP
  72 #include "pop.h"
  73 #endif
  74
  75 #ifdef MSDOS
  76 #undef access
  77 #endif /* MSDOS */
  78
  79 #ifdef WINDOWSNT
  80 #include "ntlib.h"
  81 #undef access
  82 #undef unlink
  83 #define fork() 0
  84 #define wait(var) (*(var) = 0)
  85 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  86    though the locking call succeeds (and indeed blocks local access from
  87    other NT programs).  If you have direct file access using an NFS
  88    client or something other than Samba, the locking call might work
  89    properly - make sure it does before you enable this!
  90
  91    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  92    since it was based on a misunderstanding of how locking calls are
  93    implemented and used on Unix.  */
  94 //#define DISABLE_DIRECT_ACCESS
  95
  96 #include <fcntl.h>
  97 #endif /* WINDOWSNT */
  98
  99 #ifdef WINDOWSNT
 100 #include <sys/locking.h>
 101 #endif
 102
 103 /* If your system uses the `flock' or `lockf' system call for mail locking,
 104    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 105    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 106    please make a bug report.  */
 107
 108 #ifdef MAIL_USE_LOCKF
 109 #define MAIL_USE_SYSTEM_LOCK
 110 #endif
 111
 112 #ifdef MAIL_USE_FLOCK
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_MMDF
 117 extern int lk_open (), lk_close ();
 118 #endif
 119
 120 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 121         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 122         defined (HAVE_MAILLOCK_H)
 123 #include <maillock.h>
 124 /* We can't use maillock unless we know what directory system mail
 125    files appear in. */
 126 #ifdef MAILDIR
 127 #define MAIL_USE_MAILLOCK
 128 static char *mail_spool_name (char *);
 129 #endif
 130 #endif
 131
 132 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 133 static void error (const char *s1, const char *s2, const char *s3);
 134 static _Noreturn void pfatal_with_name (char *name);
 135 static _Noreturn void pfatal_and_delete (char *name);
 136 #ifdef MAIL_USE_POP
 137 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 138 static int pop_retr (popserver server, int msgno, FILE *arg);
 139 static int mbx_write (char *line, int len, FILE *mbf);
 140 static int mbx_delimit_begin (FILE *mbf);
 141 static int mbx_delimit_end (FILE *mbf);
 142 #endif
 143
 144 #if (defined MAIL_USE_MAILLOCK                                          \
 145      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF       \
 146          && !defined MAIL_USE_SYSTEM_LOCK))
 147 /* Like malloc but get fatal error if memory is exhausted.  */
 148
 149 static void *
 150 xmalloc (size_t size)
 151 {
 152   void *result = malloc (size);
 153   if (!result)
 154     fatal ("virtual memory exhausted", 0, 0);
 155   return result;
 156 }
 157 #endif
 158
 159 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 160 static char *delete_lockname;
 161
 162 int
 163 main (int argc, char **argv)
 164 {
 165   char *inname, *outname;
 166   int indesc, outdesc;
 167   ssize_t nread;
 168   int wait_status;
 169   int c, preserve_mail = 0;
 170
 171 #ifndef MAIL_USE_SYSTEM_LOCK
 172   struct stat st;
 173   int tem;
 174   char *lockname;
 175   char *tempname;
 176   size_t inname_len, inname_dirlen;
 177   int desc;
 178 #endif /* not MAIL_USE_SYSTEM_LOCK */
 179
 180 #ifdef MAIL_USE_MAILLOCK
 181   char *spool_name;
 182 #endif
 183
 184 #ifdef MAIL_USE_POP
 185   int pop_reverse_order = 0;
 186 # define ARGSTR "pr"
 187 #else /* ! MAIL_USE_POP */
 188 # define ARGSTR "p"
 189 #endif /* MAIL_USE_POP */
 190
 191   uid_t real_gid = getgid ();
 192   uid_t priv_gid = getegid ();
 193
 194 #ifdef WINDOWSNT
 195   /* Ensure all file i/o is in binary mode. */
 196   _fmode = _O_BINARY;
 197 #endif
 198
 199   delete_lockname = 0;
 200
 201   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 202     {
 203       switch (c) {
 204 #ifdef MAIL_USE_POP
 205       case 'r':
 206         pop_reverse_order = 1;
 207         break;
 208 #endif
 209       case 'p':
 210         preserve_mail++;
 211         break;
 212       default:
 213         exit (EXIT_FAILURE);
 214       }
 215     }
 216
 217   if (
 218 #ifdef MAIL_USE_POP
 219       (argc - optind < 2) || (argc - optind > 3)
 220 #else
 221       (argc - optind != 2)
 222 #endif
 223       )
 224     {
 225 #ifdef MAIL_USE_POP
 226       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 227                " [POP-password]");
 228 #else
 229       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 230 #endif
 231       exit (EXIT_FAILURE);
 232     }
 233
 234   inname = argv[optind];
 235   outname = argv[optind+1];
 236
 237 #ifdef MAIL_USE_MMDF
 238   mmdf_init (argv[0]);
 239 #endif
 240
 241   if (*outname == 0)
 242     fatal ("Destination file name is empty", 0, 0);
 243
 244 #ifdef MAIL_USE_POP
 245   if (!strncmp (inname, "po:", 3))
 246     {
 247       int status;
 248
 249       status = popmail (inname + 3, outname, preserve_mail,
 250                         (argc - optind == 3) ? argv[optind+2] : NULL,
 251                         pop_reverse_order);
 252       exit (status);
 253     }
 254
 255   if (setuid (getuid ()) < 0)
 256     fatal ("Failed to drop privileges", 0, 0);
 257
 258 #endif /* MAIL_USE_POP */
 259
 260 #ifndef DISABLE_DIRECT_ACCESS
 261 #ifndef MAIL_USE_MMDF
 262 #ifndef MAIL_USE_SYSTEM_LOCK
 263 #ifdef MAIL_USE_MAILLOCK
 264   spool_name = mail_spool_name (inname);
 265   if (spool_name)
 266     {
 267 #ifdef lint
 268       lockname = 0;
 269 #endif
 270     }
 271   else
 272 #endif
 273     {
 274       /* Use a lock file named after our first argument with .lock appended:
 275          If it exists, the mail file is locked.  */
 276       /* Note: this locking mechanism is *required* by the mailer
 277          (on systems which use it) to prevent loss of mail.
 278
 279          On systems that use a lock file, extracting the mail without locking
 280          WILL occasionally cause loss of mail due to timing errors!
 281
 282          So, if creation of the lock file fails due to access
 283          permission on the mail spool directory, you simply MUST
 284          change the permission and/or make movemail a setgid program
 285          so it can create lock files properly.
 286
 287          You might also wish to verify that your system is one which
 288          uses lock files for this purpose.  Some systems use other methods.  */
 289
 290       inname_len = strlen (inname);
 291       lockname = xmalloc (inname_len + sizeof ".lock");
 292       strcpy (lockname, inname);
 293       strcpy (lockname + inname_len, ".lock");
 294       for (inname_dirlen = inname_len;
 295            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 296            inname_dirlen--)
 297         continue;
 298       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 299
 300       while (1)
 301         {
 302           /* Create the lock file, but not under the lock file name.  */
 303           /* Give up if cannot do that.  */
 304
 305           memcpy (tempname, inname, inname_dirlen);
 306           strcpy (tempname + inname_dirlen, "EXXXXXX");
 307 #ifdef HAVE_MKSTEMP
 308           desc = mkstemp (tempname);
 309 #else
 310           mktemp (tempname);
 311           if (!*tempname)
 312             desc = -1;
 313           else
 314             {
 315               unlink (tempname);
 316               desc = open (tempname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 317             }
 318 #endif
 319           if (desc < 0)
 320             {
 321               int mkstemp_errno = errno;
 322               error ("error while creating what would become the lock file",
 323                      0, 0);
 324               errno = mkstemp_errno;
 325               pfatal_with_name (tempname);
 326             }
 327           close (desc);
 328
 329           tem = link (tempname, lockname);
 330
 331           if (tem < 0 && errno != EEXIST)
 332             pfatal_with_name (lockname);
 333
 334           unlink (tempname);
 335           if (tem >= 0)
 336             break;
 337           sleep (1);
 338
 339           /* If lock file is five minutes old, unlock it.
 340              Five minutes should be good enough to cope with crashes
 341              and wedgitude, and long enough to avoid being fooled
 342              by time differences between machines.  */
 343           if (stat (lockname, &st) >= 0)
 344             {
 345               time_t now = time (0);
 346               if (st.st_ctime < now - 300)
 347                 unlink (lockname);
 348             }
 349         }
 350
 351       delete_lockname = lockname;
 352     }
 353 #endif /* not MAIL_USE_SYSTEM_LOCK */
 354 #endif /* not MAIL_USE_MMDF */
 355
 356   if (fork () == 0)
 357     {
 358       int lockcount = 0;
 359       int status = 0;
 360 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 361       time_t touched_lock;
 362 # ifdef lint
 363       touched_lock = 0;
 364 # endif
 365 #endif
 366
 367       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 368         fatal ("Failed to drop privileges", 0, 0);
 369
 370 #ifndef MAIL_USE_MMDF
 371 #ifdef MAIL_USE_SYSTEM_LOCK
 372       indesc = open (inname, O_RDWR);
 373 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 374       indesc = open (inname, O_RDONLY);
 375 #endif /* not MAIL_USE_SYSTEM_LOCK */
 376 #else  /* MAIL_USE_MMDF */
 377       indesc = lk_open (inname, O_RDONLY, 0, 0, 10);
 378 #endif /* MAIL_USE_MMDF */
 379
 380       if (indesc < 0)
 381         pfatal_with_name (inname);
 382
 383 #ifdef BSD_SYSTEM
 384       /* In case movemail is setuid to root, make sure the user can
 385          read the output file.  */
 386       /* This is desirable for all systems
 387          but I don't want to assume all have the umask system call */
 388       umask (umask (0) & 0333);
 389 #endif /* BSD_SYSTEM */
 390       outdesc = open (outname, O_WRONLY | O_CREAT | O_EXCL, 0666);
 391       if (outdesc < 0)
 392         pfatal_with_name (outname);
 393
 394       if (setregid (-1, priv_gid) < 0)
 395         fatal ("Failed to regain privileges", 0, 0);
 396
 397       /* This label exists so we can retry locking
 398          after a delay, if it got EAGAIN or EBUSY.  */
 399     retry_lock:
 400
 401       /* Try to lock it.  */
 402 #ifdef MAIL_USE_MAILLOCK
 403       if (spool_name)
 404         {
 405           /* The "0 - " is to make it a negative number if maillock returns
 406              non-zero. */
 407           status = 0 - maillock (spool_name, 1);
 408 #ifdef HAVE_TOUCHLOCK
 409           touched_lock = time (0);
 410 #endif
 411           lockcount = 5;
 412         }
 413       else
 414 #endif /* MAIL_USE_MAILLOCK */
 415         {
 416 #ifdef MAIL_USE_SYSTEM_LOCK
 417 #ifdef MAIL_USE_LOCKF
 418           status = lockf (indesc, F_LOCK, 0);
 419 #else /* not MAIL_USE_LOCKF */
 420 #ifdef WINDOWSNT
 421           status = locking (indesc, LK_RLCK, -1L);
 422 #else
 423           status = flock (indesc, LOCK_EX);
 424 #endif
 425 #endif /* not MAIL_USE_LOCKF */
 426 #endif /* MAIL_USE_SYSTEM_LOCK */
 427         }
 428
 429       /* If it fails, retry up to 5 times
 430          for certain failure codes.  */
 431       if (status < 0)
 432         {
 433           if (++lockcount <= 5 && (errno == EAGAIN || errno == EBUSY))
 434             {
 435               sleep (1);
 436               goto retry_lock;
 437             }
 438
 439           pfatal_with_name (inname);
 440         }
 441
 442       {
 443         char buf[1024];
 444
 445         while (1)
 446           {
 447             nread = read (indesc, buf, sizeof buf);
 448             if (nread < 0)
 449               pfatal_with_name (inname);
 450             if (nread != write (outdesc, buf, nread))
 451               {
 452                 int saved_errno = errno;
 453                 unlink (outname);
 454                 errno = saved_errno;
 455                 pfatal_with_name (outname);
 456               }
 457             if (nread < sizeof buf)
 458               break;
 459 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 460             if (spool_name)
 461               {
 462                 time_t now = time (0);
 463                 if (now - touched_lock > 60)
 464                   {
 465                     touchlock ();
 466                     touched_lock = now;
 467                   }
 468               }
 469 #endif /* MAIL_USE_MAILLOCK */
 470           }
 471       }
 472
 473 #ifdef BSD_SYSTEM
 474       if (fsync (outdesc) < 0)
 475         pfatal_and_delete (outname);
 476 #endif
 477
 478       /* Prevent symlink attacks truncating other users' mailboxes */
 479       if (setregid (-1, real_gid) < 0)
 480         fatal ("Failed to drop privileges", 0, 0);
 481
 482       /* Check to make sure no errors before we zap the inbox.  */
 483       if (close (outdesc) != 0)
 484         pfatal_and_delete (outname);
 485
 486 #ifdef MAIL_USE_SYSTEM_LOCK
 487       if (! preserve_mail)
 488         {
 489           if (ftruncate (indesc, 0L) != 0)
 490             pfatal_with_name (inname);
 491         }
 492 #endif /* MAIL_USE_SYSTEM_LOCK */
 493
 494 #ifdef MAIL_USE_MMDF
 495       lk_close (indesc, 0, 0, 0);
 496 #else
 497       close (indesc);
 498 #endif
 499
 500 #ifndef MAIL_USE_SYSTEM_LOCK
 501       if (! preserve_mail)
 502         {
 503           /* Delete the input file; if we can't, at least get rid of its
 504              contents.  */
 505 #ifdef MAIL_UNLINK_SPOOL
 506           /* This is generally bad to do, because it destroys the permissions
 507              that were set on the file.  Better to just empty the file.  */
 508           if (unlink (inname) < 0 && errno != ENOENT)
 509 #endif /* MAIL_UNLINK_SPOOL */
 510             creat (inname, 0600);
 511         }
 512 #endif /* not MAIL_USE_SYSTEM_LOCK */
 513
 514       /* End of mailbox truncation */
 515       if (setregid (-1, priv_gid) < 0)
 516         fatal ("Failed to regain privileges", 0, 0);
 517
 518 #ifdef MAIL_USE_MAILLOCK
 519       /* This has to occur in the child, i.e., in the process that
 520          acquired the lock! */
 521       if (spool_name)
 522         mailunlock ();
 523 #endif
 524       exit (EXIT_SUCCESS);
 525     }
 526
 527   wait (&wait_status);
 528   if (!WIFEXITED (wait_status))
 529     exit (EXIT_FAILURE);
 530   else if (WEXITSTATUS (wait_status) != 0)
 531     exit (WEXITSTATUS (wait_status));
 532
 533 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 534 #ifdef MAIL_USE_MAILLOCK
 535   if (! spool_name)
 536 #endif /* MAIL_USE_MAILLOCK */
 537     unlink (lockname);
 538 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 539
 540 #endif /* ! DISABLE_DIRECT_ACCESS */
 541
 542   return EXIT_SUCCESS;
 543 }
 544
 545 #ifdef MAIL_USE_MAILLOCK
 546 /* This function uses stat to confirm that the mail directory is
 547    identical to the directory of the input file, rather than just
 548    string-comparing the two paths, because one or both of them might
 549    be symbolic links pointing to some other directory. */
 550 static char *
 551 mail_spool_name (char *inname)
 552 {
 553   struct stat stat1, stat2;
 554   char *indir, *fname;
 555   int status;
 556
 557   if (! (fname = strrchr (inname, '/')))
 558     return NULL;
 559
 560   fname++;
 561
 562   if (stat (MAILDIR, &stat1) < 0)
 563     return NULL;
 564
 565   indir = xmalloc (fname - inname + 1);
 566   memcpy (indir, inname, fname - inname);
 567   indir[fname-inname] = '\0';
 568
 569
 570   status = stat (indir, &stat2);
 571
 572   free (indir);
 573
 574   if (status < 0)
 575     return NULL;
 576
 577   if (stat1.st_dev == stat2.st_dev
 578       && stat1.st_ino == stat2.st_ino)
 579     return fname;
 580
 581   return NULL;
 582 }
 583 #endif /* MAIL_USE_MAILLOCK */
 584 \f
 585 /* Print error message and exit.  */
 586
 587 static void
 588 fatal (const char *s1, const char *s2, const char *s3)
 589 {
 590   if (delete_lockname)
 591     unlink (delete_lockname);
 592   error (s1, s2, s3);
 593   exit (EXIT_FAILURE);
 594 }
 595
 596 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 597    are args for it or null. */
 598
 599 static void
 600 error (const char *s1, const char *s2, const char *s3)
 601 {
 602   fprintf (stderr, "movemail: ");
 603   if (s3)
 604     fprintf (stderr, s1, s2, s3);
 605   else if (s2)
 606     fprintf (stderr, s1, s2);
 607   else
 608     fprintf (stderr, "%s", s1);
 609   fprintf (stderr, "\n");
 610 }
 611
 612 static void
 613 pfatal_with_name (char *name)
 614 {
 615   fatal ("%s for %s", strerror (errno), name);
 616 }
 617
 618 static void
 619 pfatal_and_delete (char *name)
 620 {
 621   char *s = strerror (errno);
 622   unlink (name);
 623   fatal ("%s for %s", s, name);
 624 }
 625 \f
 626 /* This is the guts of the interface to the Post Office Protocol.  */
 627
 628 #ifdef MAIL_USE_POP
 629
 630 #ifndef WINDOWSNT
 631 #include <sys/socket.h>
 632 #include <netinet/in.h>
 633 #include <netdb.h>
 634 #else
 635 #undef _WINSOCKAPI_
 636 #include <winsock.h>
 637 #endif
 638 #include <pwd.h>
 639 #include <string.h>
 640
 641 #define NOTOK (-1)
 642 #define OK 0
 643
 644 static char Errmsg[200];        /* POP errors, at least, can exceed
 645                                    the original length of 80.  */
 646
 647 /*
 648  * The full valid syntax for a POP mailbox specification for movemail
 649  * is "po:username:hostname".  The ":hostname" is optional; if it is
 650  * omitted, the MAILHOST environment variable will be consulted.  Note
 651  * that by the time popmail() is called the "po:" has been stripped
 652  * off of the front of the mailbox name.
 653  *
 654  * If the mailbox is in the form "po:username:hostname", then it is
 655  * modified by this function -- the second colon is replaced by a
 656  * null.
 657  *
 658  * Return a value suitable for passing to `exit'.
 659  */
 660
 661 static int
 662 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 663 {
 664   int nmsgs, nbytes;
 665   register int i;
 666   int mbfi;
 667   FILE *mbf;
 668   popserver server;
 669   int start, end, increment;
 670   char *user, *hostname;
 671
 672   user = mailbox;
 673   if ((hostname = strchr (mailbox, ':')))
 674     *hostname++ = '\0';
 675
 676   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 677   if (! server)
 678     {
 679       error ("Error connecting to POP server: %s", pop_error, 0);
 680       return EXIT_FAILURE;
 681     }
 682
 683   if (pop_stat (server, &nmsgs, &nbytes))
 684     {
 685       error ("Error getting message count from POP server: %s", pop_error, 0);
 686       return EXIT_FAILURE;
 687     }
 688
 689   if (!nmsgs)
 690     {
 691       pop_close (server);
 692       return EXIT_SUCCESS;
 693     }
 694
 695   mbfi = open (outfile, O_WRONLY | O_CREAT | O_EXCL, 0666);
 696   if (mbfi < 0)
 697     {
 698       pop_close (server);
 699       error ("Error in open: %s, %s", strerror (errno), outfile);
 700       return EXIT_FAILURE;
 701     }
 702
 703   if (fchown (mbfi, getuid (), -1) != 0)
 704     {
 705       int fchown_errno = errno;
 706       struct stat st;
 707       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 708         {
 709           pop_close (server);
 710           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 711           return EXIT_FAILURE;
 712         }
 713     }
 714
 715   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 716     {
 717       pop_close (server);
 718       error ("Error in fdopen: %s", strerror (errno), 0);
 719       close (mbfi);
 720       unlink (outfile);
 721       return EXIT_FAILURE;
 722     }
 723
 724   if (reverse_order)
 725     {
 726       start = nmsgs;
 727       end = 1;
 728       increment = -1;
 729     }
 730   else
 731     {
 732       start = 1;
 733       end = nmsgs;
 734       increment = 1;
 735     }
 736
 737   for (i = start; i * increment <= end * increment; i += increment)
 738     {
 739       mbx_delimit_begin (mbf);
 740       if (pop_retr (server, i, mbf) != OK)
 741         {
 742           error ("%s", Errmsg, 0);
 743           close (mbfi);
 744           return EXIT_FAILURE;
 745         }
 746       mbx_delimit_end (mbf);
 747       fflush (mbf);
 748       if (ferror (mbf))
 749         {
 750           error ("Error in fflush: %s", strerror (errno), 0);
 751           pop_close (server);
 752           close (mbfi);
 753           return EXIT_FAILURE;
 754         }
 755     }
 756
 757   /* On AFS, a call to write only modifies the file in the local
 758    *     workstation's AFS cache.  The changes are not written to the server
 759    *      until a call to fsync or close is made.  Users with AFS home
 760    *      directories have lost mail when over quota because these checks were
 761    *      not made in previous versions of movemail. */
 762
 763 #ifdef BSD_SYSTEM
 764   if (fsync (mbfi) < 0)
 765     {
 766       error ("Error in fsync: %s", strerror (errno), 0);
 767       return EXIT_FAILURE;
 768     }
 769 #endif
 770
 771   if (close (mbfi) == -1)
 772     {
 773       error ("Error in close: %s", strerror (errno), 0);
 774       return EXIT_FAILURE;
 775     }
 776
 777   if (! preserve)
 778     for (i = 1; i <= nmsgs; i++)
 779       {
 780         if (pop_delete (server, i))
 781           {
 782             error ("Error from POP server: %s", pop_error, 0);
 783             pop_close (server);
 784             return EXIT_FAILURE;
 785           }
 786       }
 787
 788   if (pop_quit (server))
 789     {
 790       error ("Error from POP server: %s", pop_error, 0);
 791       return EXIT_FAILURE;
 792     }
 793
 794   return EXIT_SUCCESS;
 795 }
 796
 797 static int
 798 pop_retr (popserver server, int msgno, FILE *arg)
 799 {
 800   char *line;
 801   int ret;
 802
 803   if (pop_retrieve_first (server, msgno, &line))
 804     {
 805       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 806       return (NOTOK);
 807     }
 808
 809   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 810     {
 811       if (! line)
 812         break;
 813
 814       if (mbx_write (line, ret, arg) != OK)
 815         {
 816           strcpy (Errmsg, strerror (errno));
 817           pop_close (server);
 818           return (NOTOK);
 819         }
 820     }
 821
 822   if (ret)
 823     {
 824       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 825       return (NOTOK);
 826     }
 827
 828   return (OK);
 829 }
 830
 831 static int
 832 mbx_write (char *line, int len, FILE *mbf)
 833 {
 834 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 835   /* Do this as a macro instead of using strcmp to save on execution time. */
 836   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 837                             && (a[1] == 'r')    \
 838                             && (a[2] == 'o')    \
 839                             && (a[3] == 'm')    \
 840                             && (a[4] == ' '))
 841   if (IS_FROM_LINE (line))
 842     {
 843       if (fputc ('>', mbf) == EOF)
 844         return (NOTOK);
 845     }
 846 #endif
 847   if (line[0] == '\037')
 848     {
 849       if (fputs ("^_", mbf) == EOF)
 850         return (NOTOK);
 851       line++;
 852       len--;
 853     }
 854   if (fwrite (line, 1, len, mbf) != len)
 855     return (NOTOK);
 856   if (fputc (0x0a, mbf) == EOF)
 857     return (NOTOK);
 858   return (OK);
 859 }
 860
 861 static int
 862 mbx_delimit_begin (FILE *mbf)
 863 {
 864   time_t now;
 865   struct tm *ltime;
 866   char fromline[40] = "From movemail ";
 867
 868   now = time (NULL);
 869   ltime = localtime (&now);
 870
 871   strcat (fromline, asctime (ltime));
 872
 873   if (fputs (fromline, mbf) == EOF)
 874     return (NOTOK);
 875   return (OK);
 876 }
 877
 878 static int
 879 mbx_delimit_end (FILE *mbf)
 880 {
 881   if (putc ('\n', mbf) == EOF)
 882     return (NOTOK);
 883   return (OK);
 884 }
 885
 886 #endif /* MAIL_USE_POP */