lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2015 Free Software
   5 Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdio.h>
  63 #include <errno.h>
  64 #include <time.h>
  65
  66 #include <getopt.h>
  67 #include <unistd.h>
  68 #include <fcntl.h>
  69 #include <string.h>
  70 #include "syswait.h"
  71 #ifdef MAIL_USE_POP
  72 #include "pop.h"
  73 #endif
  74
  75 #ifdef MSDOS
  76 #undef access
  77 #endif /* MSDOS */
  78
  79 #ifdef WINDOWSNT
  80 #include "ntlib.h"
  81 #undef access
  82 #undef unlink
  83 #define fork() 0
  84 #define wait(var) (*(var) = 0)
  85 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  86    though the locking call succeeds (and indeed blocks local access from
  87    other NT programs).  If you have direct file access using an NFS
  88    client or something other than Samba, the locking call might work
  89    properly - make sure it does before you enable this!
  90
  91    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  92    since it was based on a misunderstanding of how locking calls are
  93    implemented and used on Unix.  */
  94 //#define DISABLE_DIRECT_ACCESS
  95
  96 #include <fcntl.h>
  97 #endif /* WINDOWSNT */
  98
  99 #ifdef WINDOWSNT
 100 #include <sys/locking.h>
 101 #endif
 102
 103 /* If your system uses the `flock' or `lockf' system call for mail locking,
 104    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 105    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 106    please make a bug report.  */
 107
 108 #ifdef MAIL_USE_LOCKF
 109 #define MAIL_USE_SYSTEM_LOCK
 110 #endif
 111
 112 #ifdef MAIL_USE_FLOCK
 113 #define MAIL_USE_SYSTEM_LOCK
 114 #endif
 115
 116 #ifdef MAIL_USE_MMDF
 117 extern int lk_open (), lk_close ();
 118 #endif
 119
 120 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
 121         (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
 122         defined (HAVE_MAILLOCK_H)
 123 #include <maillock.h>
 124 /* We can't use maillock unless we know what directory system mail
 125    files appear in. */
 126 #ifdef MAILDIR
 127 #define MAIL_USE_MAILLOCK
 128 static char *mail_spool_name (char *);
 129 #endif
 130 #endif
 131
 132 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 133 static void error (const char *s1, const char *s2, const char *s3);
 134 static _Noreturn void pfatal_with_name (char *name);
 135 static _Noreturn void pfatal_and_delete (char *name);
 136 #ifdef MAIL_USE_POP
 137 static int popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order);
 138 static int pop_retr (popserver server, int msgno, FILE *arg);
 139 static int mbx_write (char *line, int len, FILE *mbf);
 140 static int mbx_delimit_begin (FILE *mbf);
 141 static int mbx_delimit_end (FILE *mbf);
 142 #endif
 143
 144 #if (defined MAIL_USE_MAILLOCK                                          \
 145      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF       \
 146          && !defined MAIL_USE_SYSTEM_LOCK))
 147 /* Like malloc but get fatal error if memory is exhausted.  */
 148
 149 static void *
 150 xmalloc (size_t size)
 151 {
 152   void *result = malloc (size);
 153   if (!result)
 154     fatal ("virtual memory exhausted", 0, 0);
 155   return result;
 156 }
 157 #endif
 158
 159 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 160 static char *delete_lockname;
 161
 162 int
 163 main (int argc, char **argv)
 164 {
 165   char *inname, *outname;
 166   int indesc, outdesc;
 167   ssize_t nread;
 168   int wait_status;
 169   int c, preserve_mail = 0;
 170
 171 #ifndef MAIL_USE_SYSTEM_LOCK
 172   struct stat st;
 173   int tem;
 174   char *lockname;
 175   char *tempname;
 176   size_t inname_len, inname_dirlen;
 177   int desc;
 178 #endif /* not MAIL_USE_SYSTEM_LOCK */
 179
 180 #ifdef MAIL_USE_MAILLOCK
 181   char *spool_name;
 182 #endif
 183
 184 #ifdef MAIL_USE_POP
 185   int pop_reverse_order = 0;
 186 # define ARGSTR "pr"
 187 #else /* ! MAIL_USE_POP */
 188 # define ARGSTR "p"
 189 #endif /* MAIL_USE_POP */
 190
 191   uid_t real_gid = getgid ();
 192   uid_t priv_gid = getegid ();
 193
 194   delete_lockname = 0;
 195
 196   while ((c = getopt (argc, argv, ARGSTR)) != EOF)
 197     {
 198       switch (c) {
 199 #ifdef MAIL_USE_POP
 200       case 'r':
 201         pop_reverse_order = 1;
 202         break;
 203 #endif
 204       case 'p':
 205         preserve_mail++;
 206         break;
 207       default:
 208         exit (EXIT_FAILURE);
 209       }
 210     }
 211
 212   if (
 213 #ifdef MAIL_USE_POP
 214       (argc - optind < 2) || (argc - optind > 3)
 215 #else
 216       (argc - optind != 2)
 217 #endif
 218       )
 219     {
 220 #ifdef MAIL_USE_POP
 221       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 222                " [POP-password]");
 223 #else
 224       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 225 #endif
 226       exit (EXIT_FAILURE);
 227     }
 228
 229   inname = argv[optind];
 230   outname = argv[optind+1];
 231
 232 #ifdef MAIL_USE_MMDF
 233   mmdf_init (argv[0]);
 234 #endif
 235
 236   if (*outname == 0)
 237     fatal ("Destination file name is empty", 0, 0);
 238
 239 #ifdef MAIL_USE_POP
 240   if (!strncmp (inname, "po:", 3))
 241     {
 242       int status;
 243
 244       status = popmail (inname + 3, outname, preserve_mail,
 245                         (argc - optind == 3) ? argv[optind+2] : NULL,
 246                         pop_reverse_order);
 247       exit (status);
 248     }
 249
 250   if (setuid (getuid ()) < 0)
 251     fatal ("Failed to drop privileges", 0, 0);
 252
 253 #endif /* MAIL_USE_POP */
 254
 255 #ifndef DISABLE_DIRECT_ACCESS
 256 #ifndef MAIL_USE_MMDF
 257 #ifndef MAIL_USE_SYSTEM_LOCK
 258 #ifdef MAIL_USE_MAILLOCK
 259   spool_name = mail_spool_name (inname);
 260   if (spool_name)
 261     {
 262 #ifdef lint
 263       lockname = 0;
 264 #endif
 265     }
 266   else
 267 #endif
 268     {
 269       /* Use a lock file named after our first argument with .lock appended:
 270          If it exists, the mail file is locked.  */
 271       /* Note: this locking mechanism is *required* by the mailer
 272          (on systems which use it) to prevent loss of mail.
 273
 274          On systems that use a lock file, extracting the mail without locking
 275          WILL occasionally cause loss of mail due to timing errors!
 276
 277          So, if creation of the lock file fails due to access
 278          permission on the mail spool directory, you simply MUST
 279          change the permission and/or make movemail a setgid program
 280          so it can create lock files properly.
 281
 282          You might also wish to verify that your system is one which
 283          uses lock files for this purpose.  Some systems use other methods.  */
 284
 285       inname_len = strlen (inname);
 286       lockname = xmalloc (inname_len + sizeof ".lock");
 287       strcpy (lockname, inname);
 288       strcpy (lockname + inname_len, ".lock");
 289       for (inname_dirlen = inname_len;
 290            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 291            inname_dirlen--)
 292         continue;
 293       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 294
 295       while (1)
 296         {
 297           /* Create the lock file, but not under the lock file name.  */
 298           /* Give up if cannot do that.  */
 299
 300           memcpy (tempname, inname, inname_dirlen);
 301           strcpy (tempname + inname_dirlen, "EXXXXXX");
 302           desc = mkostemp (tempname, O_BINARY);
 303           if (desc < 0)
 304             {
 305               int mkostemp_errno = errno;
 306               error ("error while creating what would become the lock file",
 307                      0, 0);
 308               errno = mkostemp_errno;
 309               pfatal_with_name (tempname);
 310             }
 311           close (desc);
 312
 313           tem = link (tempname, lockname);
 314
 315           if (tem < 0 && errno != EEXIST)
 316             pfatal_with_name (lockname);
 317
 318           unlink (tempname);
 319           if (tem >= 0)
 320             break;
 321           sleep (1);
 322
 323           /* If lock file is five minutes old, unlock it.
 324              Five minutes should be good enough to cope with crashes
 325              and wedgitude, and long enough to avoid being fooled
 326              by time differences between machines.  */
 327           if (stat (lockname, &st) >= 0)
 328             {
 329               time_t now = time (0);
 330               if (st.st_ctime < now - 300)
 331                 unlink (lockname);
 332             }
 333         }
 334
 335       delete_lockname = lockname;
 336     }
 337 #endif /* not MAIL_USE_SYSTEM_LOCK */
 338 #endif /* not MAIL_USE_MMDF */
 339
 340   if (fork () == 0)
 341     {
 342       int lockcount = 0;
 343       int status = 0;
 344 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 345       time_t touched_lock;
 346 # ifdef lint
 347       touched_lock = 0;
 348 # endif
 349 #endif
 350
 351       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 352         fatal ("Failed to drop privileges", 0, 0);
 353
 354 #ifndef MAIL_USE_MMDF
 355 #ifdef MAIL_USE_SYSTEM_LOCK
 356       indesc = open (inname, O_RDWR | O_BINARY);
 357 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 358       indesc = open (inname, O_RDONLY | O_BINARY);
 359 #endif /* not MAIL_USE_SYSTEM_LOCK */
 360 #else  /* MAIL_USE_MMDF */
 361       indesc = lk_open (inname, O_RDONLY | O_BINARY, 0, 0, 10);
 362 #endif /* MAIL_USE_MMDF */
 363
 364       if (indesc < 0)
 365         pfatal_with_name (inname);
 366
 367       /* Make sure the user can read the output file.  */
 368       umask (umask (0) & 0377);
 369
 370       outdesc = open (outname, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 371       if (outdesc < 0)
 372         pfatal_with_name (outname);
 373
 374       if (setregid (-1, priv_gid) < 0)
 375         fatal ("Failed to regain privileges", 0, 0);
 376
 377       /* This label exists so we can retry locking
 378          after a delay, if it got EAGAIN or EBUSY.  */
 379     retry_lock:
 380
 381       /* Try to lock it.  */
 382 #ifdef MAIL_USE_MAILLOCK
 383       if (spool_name)
 384         {
 385           /* The "0 - " is to make it a negative number if maillock returns
 386              non-zero. */
 387           status = 0 - maillock (spool_name, 1);
 388 #ifdef HAVE_TOUCHLOCK
 389           touched_lock = time (0);
 390 #endif
 391           lockcount = 5;
 392         }
 393       else
 394 #endif /* MAIL_USE_MAILLOCK */
 395         {
 396 #ifdef MAIL_USE_SYSTEM_LOCK
 397 #ifdef MAIL_USE_LOCKF
 398           status = lockf (indesc, F_LOCK, 0);
 399 #else /* not MAIL_USE_LOCKF */
 400 #ifdef WINDOWSNT
 401           status = locking (indesc, LK_RLCK, -1L);
 402 #else
 403           status = flock (indesc, LOCK_EX);
 404 #endif
 405 #endif /* not MAIL_USE_LOCKF */
 406 #endif /* MAIL_USE_SYSTEM_LOCK */
 407         }
 408
 409       /* If it fails, retry up to 5 times
 410          for certain failure codes.  */
 411       if (status < 0)
 412         {
 413           if (++lockcount <= 5 && (errno == EAGAIN || errno == EBUSY))
 414             {
 415               sleep (1);
 416               goto retry_lock;
 417             }
 418
 419           pfatal_with_name (inname);
 420         }
 421
 422       {
 423         char buf[1024];
 424
 425         while (1)
 426           {
 427             nread = read (indesc, buf, sizeof buf);
 428             if (nread < 0)
 429               pfatal_with_name (inname);
 430             if (nread != write (outdesc, buf, nread))
 431               {
 432                 int saved_errno = errno;
 433                 unlink (outname);
 434                 errno = saved_errno;
 435                 pfatal_with_name (outname);
 436               }
 437             if (nread < sizeof buf)
 438               break;
 439 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 440             if (spool_name)
 441               {
 442                 time_t now = time (0);
 443                 if (now - touched_lock > 60)
 444                   {
 445                     touchlock ();
 446                     touched_lock = now;
 447                   }
 448               }
 449 #endif /* MAIL_USE_MAILLOCK */
 450           }
 451       }
 452
 453       if (fsync (outdesc) != 0 && errno != EINVAL)
 454         pfatal_and_delete (outname);
 455
 456       /* Prevent symlink attacks truncating other users' mailboxes */
 457       if (setregid (-1, real_gid) < 0)
 458         fatal ("Failed to drop privileges", 0, 0);
 459
 460       /* Check to make sure no errors before we zap the inbox.  */
 461       if (close (outdesc) != 0)
 462         pfatal_and_delete (outname);
 463
 464 #ifdef MAIL_USE_SYSTEM_LOCK
 465       if (! preserve_mail)
 466         {
 467           if (ftruncate (indesc, 0L) != 0)
 468             pfatal_with_name (inname);
 469         }
 470 #endif /* MAIL_USE_SYSTEM_LOCK */
 471
 472 #ifdef MAIL_USE_MMDF
 473       lk_close (indesc, 0, 0, 0);
 474 #else
 475       close (indesc);
 476 #endif
 477
 478 #ifndef MAIL_USE_SYSTEM_LOCK
 479       if (! preserve_mail)
 480         {
 481           /* Delete the input file; if we can't, at least get rid of its
 482              contents.  */
 483 #ifdef MAIL_UNLINK_SPOOL
 484           /* This is generally bad to do, because it destroys the permissions
 485              that were set on the file.  Better to just empty the file.  */
 486           if (unlink (inname) < 0 && errno != ENOENT)
 487 #endif /* MAIL_UNLINK_SPOOL */
 488             creat (inname, 0600);
 489         }
 490 #endif /* not MAIL_USE_SYSTEM_LOCK */
 491
 492       /* End of mailbox truncation */
 493       if (setregid (-1, priv_gid) < 0)
 494         fatal ("Failed to regain privileges", 0, 0);
 495
 496 #ifdef MAIL_USE_MAILLOCK
 497       /* This has to occur in the child, i.e., in the process that
 498          acquired the lock! */
 499       if (spool_name)
 500         mailunlock ();
 501 #endif
 502       exit (EXIT_SUCCESS);
 503     }
 504
 505   wait (&wait_status);
 506   if (!WIFEXITED (wait_status))
 507     exit (EXIT_FAILURE);
 508   else if (WEXITSTATUS (wait_status) != 0)
 509     exit (WEXITSTATUS (wait_status));
 510
 511 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
 512 #ifdef MAIL_USE_MAILLOCK
 513   if (! spool_name)
 514 #endif /* MAIL_USE_MAILLOCK */
 515     unlink (lockname);
 516 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
 517
 518 #endif /* ! DISABLE_DIRECT_ACCESS */
 519
 520   return EXIT_SUCCESS;
 521 }
 522
 523 #ifdef MAIL_USE_MAILLOCK
 524 /* This function uses stat to confirm that the mail directory is
 525    identical to the directory of the input file, rather than just
 526    string-comparing the two paths, because one or both of them might
 527    be symbolic links pointing to some other directory. */
 528 static char *
 529 mail_spool_name (char *inname)
 530 {
 531   struct stat stat1, stat2;
 532   char *indir, *fname;
 533   int status;
 534
 535   if (! (fname = strrchr (inname, '/')))
 536     return NULL;
 537
 538   fname++;
 539
 540   if (stat (MAILDIR, &stat1) < 0)
 541     return NULL;
 542
 543   indir = xmalloc (fname - inname + 1);
 544   memcpy (indir, inname, fname - inname);
 545   indir[fname-inname] = '\0';
 546
 547
 548   status = stat (indir, &stat2);
 549
 550   free (indir);
 551
 552   if (status < 0)
 553     return NULL;
 554
 555   if (stat1.st_dev == stat2.st_dev
 556       && stat1.st_ino == stat2.st_ino)
 557     return fname;
 558
 559   return NULL;
 560 }
 561 #endif /* MAIL_USE_MAILLOCK */
 562 \f
 563 /* Print error message and exit.  */
 564
 565 static void
 566 fatal (const char *s1, const char *s2, const char *s3)
 567 {
 568   if (delete_lockname)
 569     unlink (delete_lockname);
 570   error (s1, s2, s3);
 571   exit (EXIT_FAILURE);
 572 }
 573
 574 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 575    are args for it or null. */
 576
 577 static void
 578 error (const char *s1, const char *s2, const char *s3)
 579 {
 580   fprintf (stderr, "movemail: ");
 581   if (s3)
 582     fprintf (stderr, s1, s2, s3);
 583   else if (s2)
 584     fprintf (stderr, s1, s2);
 585   else
 586     fprintf (stderr, "%s", s1);
 587   fprintf (stderr, "\n");
 588 }
 589
 590 static void
 591 pfatal_with_name (char *name)
 592 {
 593   fatal ("%s for %s", strerror (errno), name);
 594 }
 595
 596 static void
 597 pfatal_and_delete (char *name)
 598 {
 599   char *s = strerror (errno);
 600   unlink (name);
 601   fatal ("%s for %s", s, name);
 602 }
 603 \f
 604 /* This is the guts of the interface to the Post Office Protocol.  */
 605
 606 #ifdef MAIL_USE_POP
 607
 608 #ifndef WINDOWSNT
 609 #include <sys/socket.h>
 610 #include <netinet/in.h>
 611 #include <netdb.h>
 612 #else
 613 #undef _WINSOCKAPI_
 614 #include <winsock.h>
 615 #endif
 616 #include <pwd.h>
 617 #include <string.h>
 618
 619 #define NOTOK (-1)
 620 #define OK 0
 621
 622 static char Errmsg[200];        /* POP errors, at least, can exceed
 623                                    the original length of 80.  */
 624
 625 /*
 626  * The full valid syntax for a POP mailbox specification for movemail
 627  * is "po:username:hostname".  The ":hostname" is optional; if it is
 628  * omitted, the MAILHOST environment variable will be consulted.  Note
 629  * that by the time popmail() is called the "po:" has been stripped
 630  * off of the front of the mailbox name.
 631  *
 632  * If the mailbox is in the form "po:username:hostname", then it is
 633  * modified by this function -- the second colon is replaced by a
 634  * null.
 635  *
 636  * Return a value suitable for passing to `exit'.
 637  */
 638
 639 static int
 640 popmail (char *mailbox, char *outfile, int preserve, char *password, int reverse_order)
 641 {
 642   int nmsgs, nbytes;
 643   register int i;
 644   int mbfi;
 645   FILE *mbf;
 646   popserver server;
 647   int start, end, increment;
 648   char *user, *hostname;
 649
 650   user = mailbox;
 651   if ((hostname = strchr (mailbox, ':')))
 652     *hostname++ = '\0';
 653
 654   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 655   if (! server)
 656     {
 657       error ("Error connecting to POP server: %s", pop_error, 0);
 658       return EXIT_FAILURE;
 659     }
 660
 661   if (pop_stat (server, &nmsgs, &nbytes))
 662     {
 663       error ("Error getting message count from POP server: %s", pop_error, 0);
 664       return EXIT_FAILURE;
 665     }
 666
 667   if (!nmsgs)
 668     {
 669       pop_close (server);
 670       return EXIT_SUCCESS;
 671     }
 672
 673   mbfi = open (outfile, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 674   if (mbfi < 0)
 675     {
 676       pop_close (server);
 677       error ("Error in open: %s, %s", strerror (errno), outfile);
 678       return EXIT_FAILURE;
 679     }
 680
 681   if (fchown (mbfi, getuid (), -1) != 0)
 682     {
 683       int fchown_errno = errno;
 684       struct stat st;
 685       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 686         {
 687           pop_close (server);
 688           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 689           return EXIT_FAILURE;
 690         }
 691     }
 692
 693   if ((mbf = fdopen (mbfi, "wb")) == NULL)
 694     {
 695       pop_close (server);
 696       error ("Error in fdopen: %s", strerror (errno), 0);
 697       close (mbfi);
 698       unlink (outfile);
 699       return EXIT_FAILURE;
 700     }
 701
 702   if (reverse_order)
 703     {
 704       start = nmsgs;
 705       end = 1;
 706       increment = -1;
 707     }
 708   else
 709     {
 710       start = 1;
 711       end = nmsgs;
 712       increment = 1;
 713     }
 714
 715   for (i = start; i * increment <= end * increment; i += increment)
 716     {
 717       if (mbx_delimit_begin (mbf) != OK
 718           || pop_retr (server, i, mbf) != OK)
 719         {
 720           error ("%s", Errmsg, 0);
 721           close (mbfi);
 722           return EXIT_FAILURE;
 723         }
 724       mbx_delimit_end (mbf);
 725       fflush (mbf);
 726       if (ferror (mbf))
 727         {
 728           error ("Error in fflush: %s", strerror (errno), 0);
 729           pop_close (server);
 730           close (mbfi);
 731           return EXIT_FAILURE;
 732         }
 733     }
 734
 735   if (fsync (mbfi) != 0 && errno != EINVAL)
 736     {
 737       error ("Error in fsync: %s", strerror (errno), 0);
 738       close (mbfi);
 739       return EXIT_FAILURE;
 740     }
 741
 742   if (close (mbfi) != 0)
 743     {
 744       error ("Error in close: %s", strerror (errno), 0);
 745       return EXIT_FAILURE;
 746     }
 747
 748   if (! preserve)
 749     for (i = 1; i <= nmsgs; i++)
 750       {
 751         if (pop_delete (server, i))
 752           {
 753             error ("Error from POP server: %s", pop_error, 0);
 754             pop_close (server);
 755             return EXIT_FAILURE;
 756           }
 757       }
 758
 759   if (pop_quit (server))
 760     {
 761       error ("Error from POP server: %s", pop_error, 0);
 762       return EXIT_FAILURE;
 763     }
 764
 765   return EXIT_SUCCESS;
 766 }
 767
 768 static int
 769 pop_retr (popserver server, int msgno, FILE *arg)
 770 {
 771   char *line;
 772   int ret;
 773
 774   if (pop_retrieve_first (server, msgno, &line))
 775     {
 776       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 777       return (NOTOK);
 778     }
 779
 780   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 781     {
 782       if (! line)
 783         break;
 784
 785       if (mbx_write (line, ret, arg) != OK)
 786         {
 787           strcpy (Errmsg, strerror (errno));
 788           pop_close (server);
 789           return (NOTOK);
 790         }
 791     }
 792
 793   if (ret)
 794     {
 795       snprintf (Errmsg, sizeof Errmsg, "Error from POP server: %s", pop_error);
 796       return (NOTOK);
 797     }
 798
 799   return (OK);
 800 }
 801
 802 static int
 803 mbx_write (char *line, int len, FILE *mbf)
 804 {
 805 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 806   /* Do this as a macro instead of using strcmp to save on execution time. */
 807   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 808                             && (a[1] == 'r')    \
 809                             && (a[2] == 'o')    \
 810                             && (a[3] == 'm')    \
 811                             && (a[4] == ' '))
 812   if (IS_FROM_LINE (line))
 813     {
 814       if (fputc ('>', mbf) == EOF)
 815         return (NOTOK);
 816     }
 817 #endif
 818   if (line[0] == '\037')
 819     {
 820       if (fputs ("^_", mbf) == EOF)
 821         return (NOTOK);
 822       line++;
 823       len--;
 824     }
 825   if (fwrite (line, 1, len, mbf) != len)
 826     return (NOTOK);
 827   if (fputc (0x0a, mbf) == EOF)
 828     return (NOTOK);
 829   return (OK);
 830 }
 831
 832 static int
 833 mbx_delimit_begin (FILE *mbf)
 834 {
 835   time_t now = time (NULL);
 836   struct tm *ltime = localtime (&now);
 837   if (!ltime)
 838     return NOTOK;
 839
 840   char fromline[100];
 841   if (! strftime (fromline, sizeof fromline,
 842                   "From movemail %a %b %e %T %Y\n", ltime))
 843     return NOTOK;
 844   if (fputs (fromline, mbf) == EOF)
 845     return (NOTOK);
 846   return (OK);
 847 }
 848
 849 static int
 850 mbx_delimit_end (FILE *mbf)
 851 {
 852   if (putc ('\n', mbf) == EOF)
 853     return (NOTOK);
 854   return (OK);
 855 }
 856
 857 #endif /* MAIL_USE_POP */