dispose_message(): A refinement of the message disposition scheme.

For messages that have toadmin set (i.e. came to the -admin address),
we only do bounce detection before sending off to the list owners.
Specifically, we don't do bounce-loop detection.

All messages sent to the owners will get Errors-To: set to the -owner
address.  It is the -owner address that does bounce-loop detection
before sending off to the list owners.

The reason this is done is so that bounces arriving at the -admin
address but not matching any detectors will be forwarded on the list
owners.  But bogus list owner address must be dealt with as well, so
these are handled by the -owner address.

This is all documented at the top of the file.

1 files changed, 74 insertions, 8 deletions

diff --git a/cron/qrunner b/cron/qrunner
index b4e6ac43f..23fb41df1 100644
--- a/cron/qrunner
+++ b/cron/qrunner
@@ -6,19 +6,72 @@
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; either version 2
 # of the License, or (at your option) any later version.
-# 
+#
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
-# 
+#
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software 
+# along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 
-"""Attempt redelivery for all messages that had delivery problems.
+"""Deliver queued messages.
 """
 
+# A typical Mailman list exposes four aliases which point to three different
+# wrapped scripts.  E.g. for a list named `mylist', you'd have:
+#
+# mylist         -> post
+# mylist-admin   -> mailowner
+# mylist-request -> mailcmd
+# mylist-owner   -> mailowner (through an alias to mylist-admin)
+#
+# Only 3 scripts are used for historical purposes, and this is unlikely to
+# change to due backwards compatibility.  That's immaterial though since the
+# mailowner script can determine which alias it received the message on.
+#
+# mylist-request is a robot address; it's sole purpose is to process emailed
+# commands in a Majordomo-like fashion.  mylist-admin is supposed to reach the
+# list owners, but it performs one vital step before list owner delivery - it
+# examines the message for bounce content.  mylist-owner is the fallback for
+# delivery to the list owners; it performs no bounce detection, but it /does/
+# look for bounce loops, which can occur if a list owner address is bouncing.
+#
+# So delivery flow of messages look like this:
+#
+# joerandom ---> mylist ---> list members
+#    |                           |
+#    |                           |[bounces]
+#    +-------> mylist-admin <----+ <-------------------------------+
+#    |              |                                              |
+#    |              +--->[internal bounce processing]              |
+#    |                               |                             |
+#    |                               |    [bounce found]           |
+#    |                               +--->[register and discard]   |
+#    |                               |                             |
+#    |                               |     [no bounce found]       |
+#    |                               +---> list owners <------+    |
+#    |                                          |             |    |
+#    |                                          |[bounces]    |    |
+#    +-------> mylist-owner <-------------------+             |    |
+#    |              |                                         |    |
+#    |              |     [bounce loop detected]              |    |
+#    |              +---> [log and discard]                   |    |
+#    |              |                                         |    |
+#    |              +-----------------------------------------+    |
+#    |               [no bounce loop detected]                     |
+#    |                                                             |
+#    |                                                             |
+#    +-------> mylist-request                                      |
+#                   |                                              |
+#                   +---> [command processor]                      |
+#                                 |                                |
+#                                 +---> joerandom                  |
+#                                           |                      |
+#                                           |[bounces]             |
+#                                           +----------------------+
+
 import sys
 import os
 import string
@@ -67,6 +120,17 @@ def dispose_message(mlist, msg, msgdata):
         if mlist.bounce_processing:
             if BouncerAPI.ScanMessages(mlist, mimemsg):
                 return 0
+        # Either bounce processing isn't turned on or the bounce detector
+        # found no recognized bounce format in the message.  In either case,
+        # forward the dang thing off to the list owners.  Be sure to munge the
+        # headers so that any bounces from the list owners goes to the -owner
+        # address instead of the -admin address.  This will avoid bounce
+        # loops.
+        msgdata.update({'recips'  : mlist.owner[:],
+                        'errorsto': mlist.GetOwnerEmail(),
+                        })
+        return HandlerAPI.DeliverToUser(mlist, msg, msgdata)
+    elif msgdata.get('toowner', 0):
         # The message could have been a bounce from a broken list admin
         # address.  About the only other test we can do is to see if the
         # message is appearing to come from a well-known MTA generated
@@ -80,10 +144,12 @@ def dispose_message(mlist, msg, msgdata):
         if senderlhs in mm_cfg.LIKELY_BOUNCE_SENDERS:
             syslog('error', 'bounce loop detected from: %s' % sender)
             return 0
-        # Either bounce processing isn't turned on or the bounce detector
-        # found no recognized bounce format in the message.  In either case,
-        # forward the dang thing off to the list owner.
-        msgdata['recips'] = mlist.owner[:]
+        # Any messages to the owner address must have Errors-To: set back to
+        # the owners address so bounce loops can be broken, as per the code
+        # above.
+        msgdata.update({'recips': mlist.owner[:],
+                        'errorsto': mlist.GetOwnerEmail(),
+                        })
         return HandlerAPI.DeliverToUser(mlist, msg, msgdata)
     elif msgdata.get('torequest', 0):
         mlist.ParseMailCommands(msg)