lib-src/movemail.c

   1 /* movemail foo bar -- move file foo to file bar,
   2    locking file foo the way /bin/mail respects.
   3
   4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2015 Free Software
   5 Foundation, Inc.
   6
   7 This file is part of GNU Emacs.
   8
   9 GNU Emacs is free software: you can redistribute it and/or modify
  10 it under the terms of the GNU General Public License as published by
  11 the Free Software Foundation, either version 3 of the License, or
  12 (at your option) any later version.
  13
  14 GNU Emacs is distributed in the hope that it will be useful,
  15 but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17 GNU General Public License for more details.
  18
  19 You should have received a copy of the GNU General Public License
  20 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  21
  22
  23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
  24    cause loss of mail* if you do it on a system that does not normally
  25    use flock/lockf as its way of interlocking access to inbox files.  The
  26    setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
  27    system's own conventions.  It is not a choice that is up to you.
  28
  29    So, if your system uses lock files rather than flock, then the only way
  30    you can get proper operation is to enable movemail to write lockfiles there.
  31    This means you must either give that directory access modes
  32    that permit everyone to write lockfiles in it, or you must make movemail
  33    a setuid or setgid program.  */
  34
  35 /*
  36  * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
  37  *
  38  * Added POP (Post Office Protocol) service.  When compiled -DMAIL_USE_POP
  39  * movemail will accept input filename arguments of the form
  40  * "po:username".  This will cause movemail to open a connection to
  41  * a pop server running on $MAILHOST (environment variable).  Movemail
  42  * must be setuid to root in order to work with POP.
  43  *
  44  * New module: popmail.c
  45  * Modified routines:
  46  *      main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
  47  *              after POP code.
  48  * New routines in movemail.c:
  49  *      get_errmsg - return pointer to system error message
  50  *
  51  * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
  52  *
  53  * Move all of the POP code into a separate file, "pop.c".
  54  * Use strerror instead of get_errmsg.
  55  *
  56  */
  57
  58 #include <config.h>
  59 #include <sys/types.h>
  60 #include <sys/stat.h>
  61 #include <sys/file.h>
  62 #include <stdbool.h>
  63 #include <stdio.h>
  64 #include <errno.h>
  65 #include <time.h>
  66
  67 #include <getopt.h>
  68 #include <unistd.h>
  69 #include <fcntl.h>
  70 #include <signal.h>
  71 #include <string.h>
  72 #include "syswait.h"
  73 #ifdef MAIL_USE_POP
  74 #include "pop.h"
  75 #endif
  76
  77 #ifdef MSDOS
  78 #undef access
  79 #endif /* MSDOS */
  80
  81 #ifdef WINDOWSNT
  82 #include "ntlib.h"
  83 #undef access
  84 #undef unlink
  85 #define fork() 0
  86 #define waitpid(child, var, flags) (*(var) = 0)
  87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
  88    though the locking call succeeds (and indeed blocks local access from
  89    other NT programs).  If you have direct file access using an NFS
  90    client or something other than Samba, the locking call might work
  91    properly - make sure it does before you enable this!
  92
  93    [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
  94    since it was based on a misunderstanding of how locking calls are
  95    implemented and used on Unix.  */
  96 //#define DISABLE_DIRECT_ACCESS
  97
  98 #include <fcntl.h>
  99 #endif /* WINDOWSNT */
 100
 101 #ifdef WINDOWSNT
 102 #include <sys/locking.h>
 103 #endif
 104
 105 /* If your system uses the `flock' or `lockf' system call for mail locking,
 106    define MAIL_USE_SYSTEM_LOCK.  If your system type should always define
 107    MAIL_USE_LOCKF or MAIL_USE_FLOCK but configure does not do this,
 108    please make a bug report.  */
 109
 110 #ifdef MAIL_USE_LOCKF
 111 #define MAIL_USE_SYSTEM_LOCK
 112 #endif
 113
 114 #ifdef MAIL_USE_FLOCK
 115 #define MAIL_USE_SYSTEM_LOCK
 116 #endif
 117
 118 #if (!defined MAIL_USE_SYSTEM_LOCK                              \
 119      && (defined HAVE_LIBMAIL || defined HAVE_LIBLOCKFILE)      \
 120      && defined HAVE_MAILLOCK_H)
 121 #include <maillock.h>
 122 /* We can't use maillock unless we know what directory system mail
 123    files appear in. */
 124 #ifdef MAILDIR
 125 #define MAIL_USE_MAILLOCK
 126 static char *mail_spool_name (char *);
 127 #endif
 128 #endif
 129
 130 static _Noreturn void fatal (const char *s1, const char *s2, const char *s3);
 131 static void error (const char *s1, const char *s2, const char *s3);
 132 static _Noreturn void pfatal_with_name (char *name);
 133 static _Noreturn void pfatal_and_delete (char *name);
 134 #ifdef MAIL_USE_POP
 135 static int popmail (char *, char *, bool, char *, bool);
 136 static bool pop_retr (popserver, int, FILE *);
 137 static bool mbx_write (char *, int, FILE *);
 138 static bool mbx_delimit_begin (FILE *);
 139 static bool mbx_delimit_end (FILE *);
 140 #endif
 141
 142 #if (defined MAIL_USE_MAILLOCK                                          \
 143      || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_SYSTEM_LOCK))
 144 /* Like malloc but get fatal error if memory is exhausted.  */
 145
 146 static void *
 147 xmalloc (size_t size)
 148 {
 149   void *result = malloc (size);
 150   if (!result)
 151     fatal ("virtual memory exhausted", 0, 0);
 152   return result;
 153 }
 154 #endif
 155
 156 /* Nonzero means this is name of a lock file to delete on fatal error.  */
 157 static char *delete_lockname;
 158
 159 int
 160 main (int argc, char **argv)
 161 {
 162   char *inname, *outname;
 163   int indesc, outdesc;
 164   ssize_t nread;
 165   int wait_status;
 166   int c;
 167   bool preserve_mail = false;
 168
 169 #ifndef MAIL_USE_SYSTEM_LOCK
 170   struct stat st;
 171   int tem;
 172   char *tempname;
 173   size_t inname_len, inname_dirlen;
 174   int desc;
 175 #endif /* not MAIL_USE_SYSTEM_LOCK */
 176
 177   char *spool_name = 0;
 178
 179 #ifdef MAIL_USE_POP
 180   bool pop_reverse_order = false;
 181 # define ARGSTR "pr"
 182 #else /* ! MAIL_USE_POP */
 183 # define ARGSTR "p"
 184 #endif /* MAIL_USE_POP */
 185
 186   uid_t real_gid = getgid ();
 187   uid_t priv_gid = getegid ();
 188
 189   delete_lockname = 0;
 190
 191   while (0 <= (c = getopt (argc, argv, ARGSTR)))
 192     {
 193       switch (c) {
 194 #ifdef MAIL_USE_POP
 195       case 'r':
 196         pop_reverse_order = true;
 197         break;
 198 #endif
 199       case 'p':
 200         preserve_mail = true;
 201         break;
 202       default:
 203         return EXIT_FAILURE;
 204       }
 205     }
 206
 207   if (
 208 #ifdef MAIL_USE_POP
 209       (argc - optind < 2) || (argc - optind > 3)
 210 #else
 211       (argc - optind != 2)
 212 #endif
 213       )
 214     {
 215 #ifdef MAIL_USE_POP
 216       fprintf (stderr, "Usage: movemail [-p] [-r] inbox destfile%s\n",
 217                " [POP-password]");
 218 #else
 219       fprintf (stderr, "Usage: movemail [-p] inbox destfile%s\n", "");
 220 #endif
 221       return EXIT_FAILURE;
 222     }
 223
 224   inname = argv[optind];
 225   outname = argv[optind+1];
 226
 227   if (*outname == 0)
 228     fatal ("Destination file name is empty", 0, 0);
 229
 230 #ifdef MAIL_USE_POP
 231   if (!strncmp (inname, "po:", 3))
 232     {
 233       int status;
 234
 235       status = popmail (inname + 3, outname, preserve_mail,
 236                         (argc - optind == 3) ? argv[optind+2] : NULL,
 237                         pop_reverse_order);
 238       return status;
 239     }
 240
 241   if (setuid (getuid ()) < 0)
 242     fatal ("Failed to drop privileges", 0, 0);
 243
 244 #endif /* MAIL_USE_POP */
 245
 246 #ifndef DISABLE_DIRECT_ACCESS
 247
 248   char *lockname = 0;
 249
 250 #ifndef MAIL_USE_SYSTEM_LOCK
 251 #ifdef MAIL_USE_MAILLOCK
 252   spool_name = mail_spool_name (inname);
 253 #endif
 254   if (! spool_name)
 255     {
 256       /* Use a lock file named after our first argument with .lock appended:
 257          If it exists, the mail file is locked.  */
 258       /* Note: this locking mechanism is *required* by the mailer
 259          (on systems which use it) to prevent loss of mail.
 260
 261          On systems that use a lock file, extracting the mail without locking
 262          WILL occasionally cause loss of mail due to timing errors!
 263
 264          So, if creation of the lock file fails due to access
 265          permission on the mail spool directory, you simply MUST
 266          change the permission and/or make movemail a setgid program
 267          so it can create lock files properly.
 268
 269          You might also wish to verify that your system is one which
 270          uses lock files for this purpose.  Some systems use other methods.  */
 271
 272       inname_len = strlen (inname);
 273       lockname = xmalloc (inname_len + sizeof ".lock");
 274       strcpy (lockname, inname);
 275       strcpy (lockname + inname_len, ".lock");
 276       for (inname_dirlen = inname_len;
 277            inname_dirlen && !IS_DIRECTORY_SEP (inname[inname_dirlen - 1]);
 278            inname_dirlen--)
 279         continue;
 280       tempname = xmalloc (inname_dirlen + sizeof "EXXXXXX");
 281
 282       while (true)
 283         {
 284           /* Create the lock file, but not under the lock file name.  */
 285           /* Give up if cannot do that.  */
 286
 287           memcpy (tempname, inname, inname_dirlen);
 288           strcpy (tempname + inname_dirlen, "EXXXXXX");
 289           desc = mkostemp (tempname, O_BINARY);
 290           if (desc < 0)
 291             {
 292               int mkostemp_errno = errno;
 293               error ("error while creating what would become the lock file",
 294                      0, 0);
 295               errno = mkostemp_errno;
 296               pfatal_with_name (tempname);
 297             }
 298           close (desc);
 299
 300           tem = link (tempname, lockname);
 301
 302           if (tem < 0 && errno != EEXIST)
 303             pfatal_with_name (lockname);
 304
 305           unlink (tempname);
 306           if (tem >= 0)
 307             break;
 308           sleep (1);
 309
 310           /* If lock file is five minutes old, unlock it.
 311              Five minutes should be good enough to cope with crashes
 312              and wedgitude, and long enough to avoid being fooled
 313              by time differences between machines.  */
 314           if (stat (lockname, &st) >= 0)
 315             {
 316               time_t now = time (0);
 317               if (st.st_ctime < now - 300)
 318                 {
 319                   unlink (lockname);
 320                   lockname = 0;
 321                 }
 322             }
 323         }
 324
 325       delete_lockname = lockname;
 326     }
 327 #endif /* not MAIL_USE_SYSTEM_LOCK */
 328
 329 #ifdef SIGCHLD
 330   signal (SIGCHLD, SIG_DFL);
 331 #endif
 332
 333   pid_t child = fork ();
 334   if (child < 0)
 335     fatal ("Error in fork; %s", strerror (errno), 0);
 336
 337   if (child == 0)
 338     {
 339       int lockcount = 0;
 340       int status = 0;
 341 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 342       time_t touched_lock IF_LINT (= 0);
 343 #endif
 344
 345       if (setuid (getuid ()) < 0 || setregid (-1, real_gid) < 0)
 346         fatal ("Failed to drop privileges", 0, 0);
 347
 348 #ifdef MAIL_USE_SYSTEM_LOCK
 349       indesc = open (inname, O_RDWR | O_BINARY);
 350 #else  /* if not MAIL_USE_SYSTEM_LOCK */
 351       indesc = open (inname, O_RDONLY | O_BINARY);
 352 #endif /* not MAIL_USE_SYSTEM_LOCK */
 353
 354       if (indesc < 0)
 355         pfatal_with_name (inname);
 356
 357       /* Make sure the user can read the output file.  */
 358       umask (umask (0) & 0377);
 359
 360       outdesc = open (outname, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 361       if (outdesc < 0)
 362         pfatal_with_name (outname);
 363
 364       if (setregid (-1, priv_gid) < 0)
 365         fatal ("Failed to regain privileges", 0, 0);
 366
 367       /* This label exists so we can retry locking
 368          after a delay, if it got EAGAIN or EBUSY.  */
 369     retry_lock:
 370
 371       /* Try to lock it.  */
 372 #ifdef MAIL_USE_MAILLOCK
 373       if (spool_name)
 374         {
 375           /* The "-" is to make it a negative number if maillock returns
 376              non-zero. */
 377           status = - maillock (spool_name, 1);
 378 #ifdef HAVE_TOUCHLOCK
 379           touched_lock = time (0);
 380 #endif
 381           lockcount = 5;
 382         }
 383       else
 384 #endif /* MAIL_USE_MAILLOCK */
 385         {
 386 #ifdef MAIL_USE_SYSTEM_LOCK
 387 #ifdef MAIL_USE_LOCKF
 388           status = lockf (indesc, F_LOCK, 0);
 389 #else /* not MAIL_USE_LOCKF */
 390 #ifdef WINDOWSNT
 391           status = locking (indesc, LK_RLCK, -1L);
 392 #else
 393           status = flock (indesc, LOCK_EX);
 394 #endif
 395 #endif /* not MAIL_USE_LOCKF */
 396 #endif /* MAIL_USE_SYSTEM_LOCK */
 397         }
 398
 399       /* If it fails, retry up to 5 times
 400          for certain failure codes.  */
 401       if (status < 0)
 402         {
 403           if (++lockcount <= 5 && (errno == EAGAIN || errno == EBUSY))
 404             {
 405               sleep (1);
 406               goto retry_lock;
 407             }
 408
 409           pfatal_with_name (inname);
 410         }
 411
 412       {
 413         char buf[1024];
 414
 415         while (true)
 416           {
 417             nread = read (indesc, buf, sizeof buf);
 418             if (nread < 0)
 419               pfatal_with_name (inname);
 420             if (nread != write (outdesc, buf, nread))
 421               {
 422                 int saved_errno = errno;
 423                 unlink (outname);
 424                 errno = saved_errno;
 425                 pfatal_with_name (outname);
 426               }
 427             if (nread < sizeof buf)
 428               break;
 429 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
 430             if (spool_name)
 431               {
 432                 time_t now = time (0);
 433                 if (now - touched_lock > 60)
 434                   {
 435                     touchlock ();
 436                     touched_lock = now;
 437                   }
 438               }
 439 #endif /* MAIL_USE_MAILLOCK */
 440           }
 441       }
 442
 443       if (fsync (outdesc) != 0 && errno != EINVAL)
 444         pfatal_and_delete (outname);
 445
 446       /* Prevent symlink attacks truncating other users' mailboxes */
 447       if (setregid (-1, real_gid) < 0)
 448         fatal ("Failed to drop privileges", 0, 0);
 449
 450       /* Check to make sure no errors before we zap the inbox.  */
 451       if (close (outdesc) != 0)
 452         pfatal_and_delete (outname);
 453
 454 #ifdef MAIL_USE_SYSTEM_LOCK
 455       if (! preserve_mail)
 456         {
 457           if (ftruncate (indesc, 0) != 0)
 458             pfatal_with_name (inname);
 459         }
 460 #endif /* MAIL_USE_SYSTEM_LOCK */
 461
 462       close (indesc);
 463
 464 #ifndef MAIL_USE_SYSTEM_LOCK
 465       if (! preserve_mail)
 466         {
 467           /* Delete the input file; if we can't, at least get rid of its
 468              contents.  */
 469 #ifdef MAIL_UNLINK_SPOOL
 470           /* This is generally bad to do, because it destroys the permissions
 471              that were set on the file.  Better to just empty the file.  */
 472           if (unlink (inname) < 0 && errno != ENOENT)
 473 #endif /* MAIL_UNLINK_SPOOL */
 474             creat (inname, 0600);
 475         }
 476 #endif /* not MAIL_USE_SYSTEM_LOCK */
 477
 478       /* End of mailbox truncation */
 479       if (setregid (-1, priv_gid) < 0)
 480         fatal ("Failed to regain privileges", 0, 0);
 481
 482 #ifdef MAIL_USE_MAILLOCK
 483       /* This has to occur in the child, i.e., in the process that
 484          acquired the lock! */
 485       if (spool_name)
 486         mailunlock ();
 487 #endif
 488       return EXIT_SUCCESS;
 489     }
 490
 491   if (waitpid (child, &wait_status, 0) < 0)
 492     fatal ("Error in waitpid; %s", strerror (errno), 0);
 493   if (!WIFEXITED (wait_status))
 494     return EXIT_FAILURE;
 495   else if (WEXITSTATUS (wait_status) != 0)
 496     return WEXITSTATUS (wait_status);
 497
 498   if (lockname)
 499     unlink (lockname);
 500
 501 #endif /* ! DISABLE_DIRECT_ACCESS */
 502
 503   return EXIT_SUCCESS;
 504 }
 505
 506 #ifdef MAIL_USE_MAILLOCK
 507 /* This function uses stat to confirm that the mail directory is
 508    identical to the directory of the input file, rather than just
 509    string-comparing the two paths, because one or both of them might
 510    be symbolic links pointing to some other directory. */
 511 static char *
 512 mail_spool_name (char *inname)
 513 {
 514   struct stat stat1, stat2;
 515   char *indir, *fname;
 516   int status;
 517
 518   if (! (fname = strrchr (inname, '/')))
 519     return NULL;
 520
 521   fname++;
 522
 523   if (stat (MAILDIR, &stat1) < 0)
 524     return NULL;
 525
 526   indir = xmalloc (fname - inname + 1);
 527   memcpy (indir, inname, fname - inname);
 528   indir[fname-inname] = '\0';
 529
 530
 531   status = stat (indir, &stat2);
 532
 533   free (indir);
 534
 535   if (status < 0)
 536     return NULL;
 537
 538   if (stat1.st_dev == stat2.st_dev
 539       && stat1.st_ino == stat2.st_ino)
 540     return fname;
 541
 542   return NULL;
 543 }
 544 #endif /* MAIL_USE_MAILLOCK */
 545 \f
 546 /* Print error message and exit.  */
 547
 548 static void
 549 fatal (const char *s1, const char *s2, const char *s3)
 550 {
 551   if (delete_lockname)
 552     unlink (delete_lockname);
 553   error (s1, s2, s3);
 554   exit (EXIT_FAILURE);
 555 }
 556
 557 /* Print error message.  `s1' is printf control string, `s2' and `s3'
 558    are args for it or null. */
 559
 560 static void
 561 error (const char *s1, const char *s2, const char *s3)
 562 {
 563   fprintf (stderr, "movemail: ");
 564   if (s3)
 565     fprintf (stderr, s1, s2, s3);
 566   else if (s2)
 567     fprintf (stderr, s1, s2);
 568   else
 569     fprintf (stderr, "%s", s1);
 570   fprintf (stderr, "\n");
 571 }
 572
 573 static void
 574 pfatal_with_name (char *name)
 575 {
 576   fatal ("%s for %s", strerror (errno), name);
 577 }
 578
 579 static void
 580 pfatal_and_delete (char *name)
 581 {
 582   char *s = strerror (errno);
 583   unlink (name);
 584   fatal ("%s for %s", s, name);
 585 }
 586 \f
 587 /* This is the guts of the interface to the Post Office Protocol.  */
 588
 589 #ifdef MAIL_USE_POP
 590
 591 #ifndef WINDOWSNT
 592 #include <sys/socket.h>
 593 #include <netinet/in.h>
 594 #include <netdb.h>
 595 #else
 596 #undef _WINSOCKAPI_
 597 #include <winsock.h>
 598 #endif
 599 #include <pwd.h>
 600 #include <string.h>
 601
 602 /*
 603  * The full valid syntax for a POP mailbox specification for movemail
 604  * is "po:username:hostname".  The ":hostname" is optional; if it is
 605  * omitted, the MAILHOST environment variable will be consulted.  Note
 606  * that by the time popmail() is called the "po:" has been stripped
 607  * off of the front of the mailbox name.
 608  *
 609  * If the mailbox is in the form "po:username:hostname", then it is
 610  * modified by this function -- the second colon is replaced by a
 611  * null.
 612  *
 613  * Return a value suitable for passing to `exit'.
 614  */
 615
 616 static int
 617 popmail (char *mailbox, char *outfile, bool preserve, char *password,
 618          bool reverse_order)
 619 {
 620   int nmsgs, nbytes;
 621   int i;
 622   int mbfi;
 623   FILE *mbf;
 624   popserver server;
 625   int start, end, increment;
 626   char *user, *hostname;
 627
 628   user = mailbox;
 629   if ((hostname = strchr (mailbox, ':')))
 630     *hostname++ = '\0';
 631
 632   server = pop_open (hostname, user, password, POP_NO_GETPASS);
 633   if (! server)
 634     {
 635       error ("Error connecting to POP server: %s", pop_error, 0);
 636       return EXIT_FAILURE;
 637     }
 638
 639   if (pop_stat (server, &nmsgs, &nbytes))
 640     {
 641       error ("Error getting message count from POP server: %s", pop_error, 0);
 642       return EXIT_FAILURE;
 643     }
 644
 645   if (!nmsgs)
 646     {
 647       pop_close (server);
 648       return EXIT_SUCCESS;
 649     }
 650
 651   mbfi = open (outfile, O_WRONLY | O_BINARY | O_CREAT | O_EXCL, 0666);
 652   if (mbfi < 0)
 653     {
 654       pop_close (server);
 655       error ("Error in open: %s, %s", strerror (errno), outfile);
 656       return EXIT_FAILURE;
 657     }
 658
 659   if (fchown (mbfi, getuid (), -1) != 0)
 660     {
 661       int fchown_errno = errno;
 662       struct stat st;
 663       if (fstat (mbfi, &st) != 0 || st.st_uid != getuid ())
 664         {
 665           pop_close (server);
 666           error ("Error in fchown: %s, %s", strerror (fchown_errno), outfile);
 667           return EXIT_FAILURE;
 668         }
 669     }
 670
 671   mbf = fdopen (mbfi, "wb");
 672   if (!mbf)
 673     {
 674       pop_close (server);
 675       error ("Error in fdopen: %s", strerror (errno), 0);
 676       close (mbfi);
 677       unlink (outfile);
 678       return EXIT_FAILURE;
 679     }
 680
 681   if (reverse_order)
 682     {
 683       start = nmsgs;
 684       end = 1;
 685       increment = -1;
 686     }
 687   else
 688     {
 689       start = 1;
 690       end = nmsgs;
 691       increment = 1;
 692     }
 693
 694   for (i = start; i * increment <= end * increment; i += increment)
 695     if (! (mbx_delimit_begin (mbf)
 696            && pop_retr (server, i, mbf)
 697            && mbx_delimit_end (mbf)
 698            && fflush (mbf) == 0))
 699       {
 700         if (errno)
 701           error ("Error in POP retrieving: %s", strerror (errno), 0);
 702         pop_close (server);
 703         fclose (mbf);
 704         return EXIT_FAILURE;
 705       }
 706
 707   if (fsync (mbfi) != 0 && errno != EINVAL)
 708     {
 709       error ("Error in fsync: %s", strerror (errno), 0);
 710       fclose (mbf);
 711       return EXIT_FAILURE;
 712     }
 713
 714   if (fclose (mbf) != 0)
 715     {
 716       error ("Error in fclose: %s", strerror (errno), 0);
 717       return EXIT_FAILURE;
 718     }
 719
 720   if (! preserve)
 721     for (i = 1; i <= nmsgs; i++)
 722       {
 723         if (pop_delete (server, i))
 724           {
 725             error ("Error from POP server: %s", pop_error, 0);
 726             pop_close (server);
 727             return EXIT_FAILURE;
 728           }
 729       }
 730
 731   if (pop_quit (server))
 732     {
 733       error ("Error from POP server: %s", pop_error, 0);
 734       return EXIT_FAILURE;
 735     }
 736
 737   return EXIT_SUCCESS;
 738 }
 739
 740 static bool
 741 pop_retr (popserver server, int msgno, FILE *arg)
 742 {
 743   char *line;
 744   int ret;
 745
 746   if (pop_retrieve_first (server, msgno, &line))
 747     {
 748       error ("Error from POP server: %s", pop_error, 0);
 749       errno = 0;
 750       return false;
 751     }
 752
 753   while ((ret = pop_retrieve_next (server, &line)) >= 0)
 754     {
 755       if (! line)
 756         break;
 757
 758       if (! mbx_write (line, ret, arg))
 759         {
 760           int write_errno = errno;
 761           pop_close (server);
 762           errno = write_errno;
 763           return false;
 764         }
 765     }
 766
 767   if (ret)
 768     {
 769       error ("Error from POP server: %s", pop_error, 0);
 770       errno = 0;
 771       return false;
 772     }
 773
 774   return true;
 775 }
 776
 777 static bool
 778 mbx_write (char *line, int len, FILE *mbf)
 779 {
 780 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
 781   /* Do this as a macro instead of using strcmp to save on execution time. */
 782   # define IS_FROM_LINE(a) ((a[0] == 'F')       \
 783                             && (a[1] == 'r')    \
 784                             && (a[2] == 'o')    \
 785                             && (a[3] == 'm')    \
 786                             && (a[4] == ' '))
 787   if (IS_FROM_LINE (line))
 788     {
 789       if (fputc ('>', mbf) < 0)
 790         return false;
 791     }
 792 #endif
 793   if (line[0] == '\037')
 794     {
 795       if (fputs ("^_", mbf) < 0)
 796         return false;
 797       line++;
 798       len--;
 799     }
 800   return fwrite (line, 1, len, mbf) == len && 0 <= fputc ('\n', mbf);
 801 }
 802
 803 static bool
 804 mbx_delimit_begin (FILE *mbf)
 805 {
 806   time_t now = time (NULL);
 807   struct tm *ltime = localtime (&now);
 808   if (!ltime)
 809     return false;
 810
 811   char fromline[100];
 812   if (! strftime (fromline, sizeof fromline,
 813                   "From movemail %a %b %e %T %Y\n", ltime))
 814     {
 815       errno = EOVERFLOW;
 816       return false;
 817     }
 818   return 0 <= fputs (fromline, mbf);
 819 }
 820
 821 static bool
 822 mbx_delimit_end (FILE *mbf)
 823 {
 824   return 0 <= putc ('\n', mbf);
 825 }
 826
 827 #endif /* MAIL_USE_POP */