rfc9671.original | rfc9671.txt | |||
---|---|---|---|---|
Network Working Group K. Murchison | Internet Engineering Task Force (IETF) K. Murchison | |||
Internet-Draft R. Signes | Request for Comments: 9671 R. Signes | |||
Intended status: Standards Track M. Horsfall | Category: Standards Track M. Horsfall | |||
Expires: 15 February 2025 Fastmail | ISSN: 2070-1721 Fastmail | |||
14 August 2024 | October 2024 | |||
Sieve Email Filtering: Extension for Processing Calendar Attachments | Sieve Email Filtering: Extension for Processing Calendar Attachments | |||
draft-ietf-extra-processimip-09 | ||||
Abstract | Abstract | |||
This document describes the "processcalendar" extension to the Sieve | This document describes the "processcalendar" extension to the Sieve | |||
email filtering language. The "processcalendar" extension gives | email filtering language. The "processcalendar" extension gives | |||
Sieve the ability to process machine-readable calendar data that is | Sieve the ability to process machine-readable calendar data that is | |||
encapsulated in an email message using Multipurpose Internet Mail | encapsulated in an email message using Multipurpose Internet Mail | |||
Extensions (MIME). | Extensions (MIME). | |||
Status of This Memo | Status of This Memo | |||
This Internet-Draft is submitted in full conformance with the | This is an Internet Standards Track document. | |||
provisions of BCP 78 and BCP 79. | ||||
Internet-Drafts are working documents of the Internet Engineering | ||||
Task Force (IETF). Note that other groups may also distribute | ||||
working documents as Internet-Drafts. The list of current Internet- | ||||
Drafts is at https://datatracker.ietf.org/drafts/current/. | ||||
Internet-Drafts are draft documents valid for a maximum of six months | This document is a product of the Internet Engineering Task Force | |||
and may be updated, replaced, or obsoleted by other documents at any | (IETF). It represents the consensus of the IETF community. It has | |||
time. It is inappropriate to use Internet-Drafts as reference | received public review and has been approved for publication by the | |||
material or to cite them other than as "work in progress." | Internet Engineering Steering Group (IESG). Further information on | |||
Internet Standards is available in Section 2 of RFC 7841. | ||||
This Internet-Draft will expire on 15 February 2025. | Information about the current status of this document, any errata, | |||
and how to provide feedback on it may be obtained at | ||||
https://www.rfc-editor.org/info/rfc9671. | ||||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2024 IETF Trust and the persons identified as the | Copyright (c) 2024 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents (https://trustee.ietf.org/ | Provisions Relating to IETF Documents | |||
license-info) in effect on the date of publication of this document. | (https://trustee.ietf.org/license-info) in effect on the date of | |||
Please review these documents carefully, as they describe your rights | publication of this document. Please review these documents | |||
and restrictions with respect to this document. Code Components | carefully, as they describe your rights and restrictions with respect | |||
extracted from this document must include Revised BSD License text as | to this document. Code Components extracted from this document must | |||
described in Section 4.e of the Trust Legal Provisions and are | include Revised BSD License text as described in Section 4.e of the | |||
provided without warranty as described in the Revised BSD License. | Trust Legal Provisions and are provided without warranty as described | |||
in the Revised BSD License. | ||||
Table of Contents | Table of Contents | |||
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction | |||
2. Conventions Used in This Document . . . . . . . . . . . . . . 3 | 2. Conventions Used in This Document | |||
3. Capability Identifier . . . . . . . . . . . . . . . . . . . . 3 | 3. Capability Identifier | |||
4. Process Calendar Action . . . . . . . . . . . . . . . . . . . 3 | 4. Process Calendar Action | |||
4.1. Allow Public Argument . . . . . . . . . . . . . . . . . . 4 | 4.1. Allow Public Argument | |||
4.2. Addresses Argument . . . . . . . . . . . . . . . . . . . 5 | 4.2. Addresses Argument | |||
4.3. Updates Only Argument . . . . . . . . . . . . . . . . . . 5 | 4.3. Updates Only Argument | |||
4.4. Calendar ID Argument . . . . . . . . . . . . . . . . . . 5 | 4.4. Calendar ID Argument | |||
4.5. Delete Cancelled Argument . . . . . . . . . . . . . . . . 6 | 4.5. Delete Cancelled Argument | |||
4.6. Organizers Argument . . . . . . . . . . . . . . . . . . . 6 | 4.6. Organizers Argument | |||
4.7. Outcome Argument . . . . . . . . . . . . . . . . . . . . 6 | 4.7. Outcome Argument | |||
4.8. Reason Argument . . . . . . . . . . . . . . . . . . . . . 6 | 4.8. Reason Argument | |||
4.9. Interaction with Other Sieve Actions . . . . . . . . . . 7 | 4.9. Interaction with Other Sieve Actions | |||
4.10. Examples . . . . . . . . . . . . . . . . . . . . . . . . 7 | 4.10. Examples | |||
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 | 5. Security Considerations | |||
6. Privacy Considerations . . . . . . . . . . . . . . . . . . . 9 | 6. Privacy Considerations | |||
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 | 7. IANA Considerations | |||
7.1. Registration of Sieve Extension . . . . . . . . . . . . . 9 | 7.1. Registration of Sieve Extension | |||
7.2. Registration of Sieve Action . . . . . . . . . . . . . . 10 | 7.2. Registration of Sieve Action | |||
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 10 | 8. References | |||
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 | 8.1. Normative References | |||
9.1. Normative References . . . . . . . . . . . . . . . . . . 10 | 8.2. Informative References | |||
9.2. Informative References . . . . . . . . . . . . . . . . . 11 | Acknowledgments | |||
Appendix A. Change History (To be removed by RFC Editor before | Authors' Addresses | |||
publication) . . . . . . . . . . . . . . . . . . . . . . 12 | ||||
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14 | ||||
1. Introduction | 1. Introduction | |||
Users frequently receive invites, replies, and cancellations for | Users frequently receive invites, replies, and cancellations for | |||
events, tasks, etc. via Internet mail messages. It is sometimes | events, tasks, etc. via Internet mail messages. It is sometimes | |||
desirable to have such messages automatically parsed and the enclosed | desirable to have such messages automatically parsed and the enclosed | |||
calendar data added to, updated on, or deleted from the user's | calendar data added to, updated on, or deleted from the user's | |||
calendars. | calendars. | |||
Typically such messages are based on the iCalendar Message-Based | Typically, such messages are based on the iCalendar Message-Based | |||
Interoperability Protocol (iMIP) [RFC6047]. However, sometimes the | Interoperability Protocol (iMIP) [RFC6047]. However, sometimes the | |||
enclosed iCalendar [RFC5545] data does not include an iTIP method | enclosed iCalendar [RFC5545] data does not include an iCalendar | |||
Transport-Independent Interoperability Protocol (iTIP) method | ||||
property (see [RFC5546], Section 1.4), or the enclosed data may be in | property (see [RFC5546], Section 1.4), or the enclosed data may be in | |||
some other machine-readable format (E.g. JSCalendar [RFC8984]). | some other machine-readable format (e.g., JSCalendar [RFC8984]). | |||
This document defines an extension to the Sieve language [RFC5228] | This document defines an extension to the Sieve language [RFC5228] | |||
that enables scripts to process machine-readable calendar data that | that enables scripts to process machine-readable calendar data that | |||
is encapsulated in an email message using MIME [RFC2045]. | is encapsulated in an email message using MIME [RFC2045]. | |||
Specifically, this extension provides the ability to alter items on a | Specifically, this extension provides the ability to alter items on a | |||
user's calendars referenced in the encapsulated calendar data. | user's calendars that are referenced in the encapsulated calendar | |||
data. | ||||
2. Conventions Used in This Document | 2. Conventions Used in This Document | |||
Conventions for notations are as in Section 1.1 of [RFC5228], | Conventions for notations are as in Section 1.1 of [RFC5228], | |||
including use of the "Usage:" label for the definition of action and | including use of the "Usage:" label for the definition of action and | |||
tagged arguments syntax. | tagged arguments syntax. | |||
This document uses terminology and concepts from iCalendar [RFC5545] | This document uses terminology and concepts from iCalendar [RFC5545] | |||
and iTIP [RFC5546] to describe the processing of calendar data, but | and iTIP [RFC5546] to describe the processing of calendar data, but | |||
this extension can be used with any machine-readable calendar data | this extension can be used with any machine-readable calendar data | |||
skipping to change at page 3, line 41 ¶ | skipping to change at line 132 ¶ | |||
[ :addresses <string-list> ] | [ :addresses <string-list> ] | |||
[ :updatesonly / :calendarid <string> ] | [ :updatesonly / :calendarid <string> ] | |||
[ :deletecancelled ] | [ :deletecancelled ] | |||
[ :organizers <ext-list-name: string> ] | [ :organizers <ext-list-name: string> ] | |||
[ :outcome <variablename: string> ] | [ :outcome <variablename: string> ] | |||
[ :reason <variablename: string> ] | [ :reason <variablename: string> ] | |||
The "processcalendar" action is used to parse encapsulated calendar | The "processcalendar" action is used to parse encapsulated calendar | |||
data and perform the appropriate action based on the content. If the | data and perform the appropriate action based on the content. If the | |||
calendar data is malformed in any way, it MUST be ignored and no | calendar data is malformed in any way, it MUST be ignored and no | |||
action is taken. Otherwise, based on the iTIP method (see | action is taken. Otherwise, calendar objects may be created, | |||
Section 1.4 of [RFC5546]) of the message, calendar objects are | updated, or deleted from a given calendar. | |||
created, updated, or deleted from a given calendar. | ||||
This action can be used with or without the "extlists" [RFC6134] | This action can be used with or without the "extlists" extension | |||
extension. When the "extlists" extension is enabled in a script | [RFC6134]. When the "extlists" extension is enabled in a script | |||
using <require "extlists">, the script can use the :organizers | using <require "extlists">, the script can use the :organizers | |||
(Section 4.6) argument to the "processcalendar" action as described | argument (Section 4.6) in the "processcalendar" action as described | |||
below. When the "extlists" extension is not enabled, the :organizers | below. When the "extlists" extension is not enabled, the :organizers | |||
argument MUST NOT be used and MUST cause an error according to | argument MUST NOT be used and MUST cause an error according to | |||
[RFC5228]. | [RFC5228]. | |||
This action can be used with or without the "variables" [RFC5229] | This action can be used with or without the "variables" extension | |||
extension. When the "variables" extension is enabled in a script | [RFC5229]. When the "variables" extension is enabled in a script | |||
using <require "variables">, the script can use the :outcome | using <require "variables">, the script can use the :outcome | |||
(Section 4.7) and :reason (Section 4.8) arguments to the | (Section 4.7) and :reason (Section 4.8) arguments in the | |||
"processcalendar" action as described below. When the "variables" | "processcalendar" action as described below. When the "variables" | |||
extension is not enabled, the :outcome and :reason arguments MUST NOT | extension is not enabled, the :outcome and :reason arguments MUST NOT | |||
be used and MUST cause an error according to [RFC5228]. | be used and MUST cause an error according to [RFC5228]. | |||
If a mail messages contains calendar data in multiple MIME [RFC2045] | If a mail message contains calendar data in multiple MIME [RFC2045] | |||
parts, this action MUST verify that the calendar data in each part | parts, this action MUST verify that the calendar data in each part | |||
are semantically equivalent to one another. If the data is found to | are semantically equivalent to one another. If the data is found to | |||
be semantically different, the action MUST NOT process the message. | be semantically different, the action MUST NOT process the message. | |||
Otherwise, the action MUST only process one representation of the | Otherwise, the action MUST only process one representation of the | |||
data. | data. | |||
This action MUST NOT make any changes to the participant status of | This action MUST NOT make any changes to the participant status of | |||
the recipient when processing the calendar data. The mechanism for a | the recipient when processing the calendar data. The mechanism for a | |||
recipient to change their participant status to an event is out of | recipient to change their participant status to an event is out of | |||
scope for this document. | scope for this document. | |||
This action SHOULD remove alarms from calendar data before applying | This action SHOULD remove alarms from calendar data before applying | |||
it to a calendar. Failure to do so could result in unwelcome | it to a calendar. Failure to do so could result in unwelcome | |||
notifications being triggered for the recipient. | notifications being triggered for the recipient. | |||
4.1. Allow Public Argument | 4.1. Allow Public Argument | |||
The optional :allowpublic argument is used to tell the implementation | The optional :allowpublic argument is used to tell the implementation | |||
that it can process calendar data that does not contain any ATTENDEE | that it can process calendar data that does not contain any ATTENDEE | |||
properties, such as iTIP messages where the METHOD is PUBLISH, or | properties, such as iTIP messages where the METHOD is PUBLISH or non- | |||
non-iTIP messages where the calendar data does not contain METHOD | iTIP messages where the calendar data does not contain METHOD and/or | |||
and/or ORGANIZER properties. | ORGANIZER properties. | |||
If used in conjunction with the :organizers (Section 4.6) argument, | If used in conjunction with the :organizers argument (Section 4.6), | |||
the implementation MUST NOT process non-iTIP messages. | the implementation MUST NOT process non-iTIP messages. | |||
If :allowpublic is omitted, the implementation MUST NOT process | If :allowpublic is omitted, the implementation MUST NOT process | |||
calendar data unless is it is a well-formed iTIP message and one of | calendar data unless is it is a well-formed iTIP message and one of | |||
the recipient user's email addresses matches the Calendar User | the recipient user's email addresses matches the Calendar User | |||
Address (see Section 3.3.3 of [RFC5545]) of the intended target of | Address (see Section 3.3.3 of [RFC5545]) of the intended target of | |||
the message, as determined by the iTIP method (see Section 1.4 of | the message, as determined by the iTIP method (see Section 1.4 of | |||
[RFC5546]) of the message: | [RFC5546]) of the message: | |||
"REPLY": Value of the "Organizer" property (see Section 3.8.4.1 of | * "REPLY": Value of the ORGANIZER property (see Section 3.8.4.3 of | |||
[RFC5545]) | [RFC5545]) | |||
"REQUEST", "CANCEL", "ADD": Value of one of the "Attendee" | * "REQUEST", "CANCEL", "ADD": Value of one of the ATTENDEE | |||
properties (see Section 3.8.4.3 of [RFC5545]) | properties (see Section 3.8.4.1 of [RFC5545]) | |||
The recipient user's email address matches the Calendar User Address | The recipient user's email address matches the Calendar User Address | |||
of the target if the Calendar User Address is in the form of a mailto | of the target if the Calendar User Address is in the form of a mailto | |||
URI and the email address matches the "addr-spec" of the URI. | URI and the email address matches the "addr-spec" of the URI. | |||
An email address is considered to belong to the recipient if it is | An email address is considered to belong to the recipient if it is | |||
one of: | one of the following: | |||
1. an email address known by the implementation to be associated | * an email address known by the implementation to be associated with | |||
with the recipient, | the recipient, | |||
2. the final envelope recipient address if it's available to the | * the final envelope recipient address if it's available to the | |||
implementation, or | implementation, or | |||
3. an address specified by the script writer via the :addresses | * an address specified by the script writer via the :addresses | |||
(Section 4.2) argument. | argument (Section 4.2). | |||
4.2. Addresses Argument | 4.2. Addresses Argument | |||
The optional :addresses argument is used to specify email addresses | The optional :addresses argument is used to specify email addresses | |||
that belong to the recipient in addition to the addresses known to | that belong to the recipient in addition to the addresses known to | |||
the implementation. | the implementation. | |||
4.3. Updates Only Argument | 4.3. Updates Only Argument | |||
The optional :updatesonly argument is used to limit the messages | The optional :updatesonly argument is used to limit the messages | |||
skipping to change at page 6, line 21 ¶ | skipping to change at line 256 ¶ | |||
If :deletecancelled is omitted, the status of the associated calendar | If :deletecancelled is omitted, the status of the associated calendar | |||
object will be set to cancelled and will remain on the calendar. | object will be set to cancelled and will remain on the calendar. | |||
4.6. Organizers Argument | 4.6. Organizers Argument | |||
The optional :organizers argument is used to specify an external list | The optional :organizers argument is used to specify an external list | |||
of email addresses from which the recipient is willing to accept | of email addresses from which the recipient is willing to accept | |||
public events, invites, updates, and cancellations. Implementations | public events, invites, updates, and cancellations. Implementations | |||
MUST NOT process calendar data unless is it is a well-formed iTIP | MUST NOT process calendar data unless is it is a well-formed iTIP | |||
message and one of the addresses in the external list matches the | message and one of the addresses in the external list matches the | |||
Calendar User Address of the "Organizer" property. An email address | Calendar User Address of the ORGANIZER property. An email address in | |||
in the external list matches the Calendar User Address of the | the external list matches the Calendar User Address of the ORGANIZER | |||
"Organizer" property if it is in the form of a mailto URI and the | property if it is in the form of a mailto URI and the email address | |||
email address matches the "addr-spec" of the URI. | matches the "addr-spec" of the URI. | |||
If :organizers is omitted, no validation of the "Organizer" property | If :organizers is omitted, no validation of the ORGANIZER property is | |||
is performed. | performed. | |||
4.7. Outcome Argument | 4.7. Outcome Argument | |||
The optional :outcome argument specifies the name of a variable into | The optional :outcome argument specifies the name of a variable into | |||
which one of the following strings specifying the outcome of the | which one of the following strings specifying the outcome of the | |||
action will be stored: | action will be stored: | |||
* "no_action": No action was performed (E.g., the message didn't | "no_action": No action was performed (e.g., the message didn't | |||
contain calendar data, or the set of provided options prevented | contain calendar data, or the set of provided options prevented | |||
the message from being processed). | the message from being processed). | |||
* "added": A new calendar object was added to a calendar | "added": A new calendar object was added to a calendar. | |||
* "updated": A calendar resource was updated, cancelled, or removed | "updated": A calendar object was updated, cancelled, or removed from | |||
from the calendar. | the calendar. | |||
* "error": The message would have been processed but encountered an | "error": The message would have been processed but encountered an | |||
error in doing so. | error in doing so. | |||
4.8. Reason Argument | 4.8. Reason Argument | |||
The optional :reason argument specifies the name of a variable into | The optional :reason argument specifies the name of a variable into | |||
which a string describing the reason for the outcome will be stored. | which a string describing the reason for the outcome will be stored. | |||
If no reason for the outcome is available, implementations MUST set | If no reason for the outcome is available, implementations MUST set | |||
the variable to the empty string. | the variable to the empty string. | |||
For example, an outcome of "no_action" may have a reason of "only | For example, an outcome of "no_action" may have a reason of "only | |||
processing updates" or an outcome of "error" may have a reason of | processing updates", or an outcome of "error" may have a reason of | |||
"missing unique identifier". | "missing unique identifier". | |||
4.9. Interaction with Other Sieve Actions | 4.9. Interaction with Other Sieve Actions | |||
The "processcalendar" action does not cancel Sieve's implicit keep | The "processcalendar" action does not cancel Sieve's implicit keep | |||
action. | action. | |||
The "processcalendar" action can only be executed once per script. A | The "processcalendar" action can only be executed once per script. A | |||
script MUST fail with an appropriate error if it attempts to execute | script MUST fail with an appropriate error if it attempts to execute | |||
two or more "processcalendar" actions. | two or more "processcalendar" actions. | |||
The "processcalendar" action is incompatible with the Sieve reject | The "processcalendar" action is incompatible with the Sieve "reject" | |||
and ereject [RFC5429] actions. | and "ereject" actions [RFC5429]. | |||
4.10. Examples | 4.10. Examples | |||
The following example specifies email addresses belonging to the user | The following example specifies email addresses belonging to the user | |||
and the identifier of the calendar onto which to place new calendar | and the identifier of the calendar onto which to place new calendar | |||
objects: | objects: | |||
require [ "processcalendar" ]; | require [ "processcalendar" ]; | |||
processcalendar :addresses [ "me@example.com", "alsome@example.com" ] | processcalendar :addresses [ "me@example.com", "alsome@example.com" ] | |||
skipping to change at page 8, line 26 ¶ | skipping to change at line 350 ¶ | |||
} | } | |||
5. Security Considerations | 5. Security Considerations | |||
This document describes a method for altering an electronic calendar | This document describes a method for altering an electronic calendar | |||
without user interaction. As such, unless proper precautions are | without user interaction. As such, unless proper precautions are | |||
undertaken, it can be used as a vector for calendar abuse. | undertaken, it can be used as a vector for calendar abuse. | |||
It is critical that implementations correctly implement the behavior | It is critical that implementations correctly implement the behavior | |||
and restrictions described throughout this document. Security issues | and restrictions described throughout this document. Security issues | |||
associated with processing unsolicited calendar data, and methods for | associated with processing unsolicited calendar data and methods for | |||
mitigating them are discussed in [CALSPAM]. Specifically: | mitigating them are discussed in [CALSPAM]. Specifically: | |||
* Processcalendar MUST NOT process any calendar data enclosed in a | * The "processcalendar" extension MUST NOT process any calendar data | |||
message flagged as spam and/or malicious. The spamtest and | enclosed in a message flagged as spam and/or malicious. The | |||
virustest [RFC5235] extensions (or the header [RFC5228] test if | "spamtest" and "virustest" extensions [RFC5235] (or the header | |||
messages are scanned outside of the Sieve interpreter) can be used | test [RFC5228] if messages are scanned outside of the Sieve | |||
to make processcalendar conditional on "safe" content. | interpreter) can be used to make "processcalendar" conditional on | |||
"safe" content. | ||||
* Processcalendar SHOULD NOT process calendar data received from a | * The "processcalendar" extension SHOULD NOT process calendar data | |||
potentially malicious sender. The address and envelope [RFC5228] | received from a potentially malicious sender. The address and | |||
tests (optionally along with the extlists [RFC6134] extension) can | envelope tests [RFC5228] (optionally along with the "extlists" | |||
be used to create a "deny list" and make processcalendar | extension [RFC6134]) can be used to create a "deny list" and make | |||
conditional on the sender not being a member of that list. | "processcalendar" conditional on the sender not being a member of | |||
that list. | ||||
* Similarly, processcalendar SHOULD only process calendar data | * Similarly, the "processcalendar" extension SHOULD only process | |||
received from a known sender. The address and envelope [RFC5228] | calendar data received from a known sender. The address and | |||
tests (optionally along with the extlists [RFC6134] extension) can | envelope tests [RFC5228] (optionally along with the "extlists" | |||
be used to create an "allow list" and make processcalendar | extension [RFC6134]) can be used to create an "allow list" and | |||
conditional on the sender being a member of that list. | make "processcalendar" conditional on the sender being a member of | |||
that list. | ||||
* Processcalendar SHOULD NOT process calendar data received from an | * The "processcalendar" extension SHOULD NOT process calendar data | |||
untrustworthy sender. Trustworthiness may depend on whether the | received from an untrustworthy sender. Trustworthiness may depend | |||
message has a valid signature (see [RFC8551]) and/or on whether | on whether the message has a valid signature (see [RFC8551]) and/ | |||
one or more of Sender Policy Framework (SPF) [RFC7208], DomainKeys | or on whether one or more of the following passes or fails on the | |||
Identified Mail (DKIM) Signatures [RFC6376], Domain-based Message | message: Sender Policy Framework (SPF) [RFC7208], DomainKeys | |||
Authentication, Reporting, and Conformance (DMARC) [RFC7489] | Identified Mail (DKIM) Signatures [RFC6376], and Domain-based | |||
passes or fails on the message. The mechanism by which a Sieve | Message Authentication, Reporting, and Conformance (DMARC) | |||
interpreter accesses the results of such checks is outside the | [RFC7489]. The mechanism by which a Sieve interpreter accesses | |||
scope of this document, but if the results are available in the | the results of such checks is outside the scope of this document, | |||
message's header fields, the header [RFC5228] test can be used to | but if the results are available in the message's header fields, | |||
make processcalendar conditional on the sender being trustworthy. | the header test [RFC5228] can be used to make "processcalendar" | |||
conditional on the sender being trustworthy. | ||||
Additionally, if the calendar data has embedded (a.k.a. inline) | Additionally, if the calendar data has embedded (a.k.a. inline) | |||
attachments, implementations SHOULD: | attachments, implementations SHOULD: | |||
* Decode the embedded attachment, if necessary. | * Decode the embedded attachment, if necessary. | |||
* Scan the (decoded) attachment for malicious content. | * Scan the (decoded) attachment for malicious content. | |||
If an attachment is found to be malicious, processcalendar MUST NOT | If an attachment is found to be malicious, "processcalendar" MUST NOT | |||
process the calendar data. | process the calendar data. | |||
6. Privacy Considerations | 6. Privacy Considerations | |||
It is believed that this extension doesn't introduce any privacy | It is believed that this extension doesn't introduce any privacy | |||
considerations beyond those in [RFC5228]. | considerations beyond those in [RFC5228]. | |||
7. IANA Considerations | 7. IANA Considerations | |||
7.1. Registration of Sieve Extension | 7.1. Registration of Sieve Extension | |||
This document defines the following new Sieve extension to be added | This document defines the following new Sieve extension, which IANA | |||
to the registry defined in Section 6.2 of [RFC5228] and located here: | has added to the "Sieve Extensions" registry | |||
https://www.iana.org/assignments/sieve-extensions/sieve- | (https://www.iana.org/assignments/sieve-extensions). The registry is | |||
extensions.xhtml#sieve-extensions | defined in Section 6.2 of [RFC5228]. | |||
IANA are requested to add a capability to the Sieve Extensions | ||||
registry: | ||||
To: iana@iana.org | ||||
Subject: Registration of new Sieve extension | ||||
Capability name: processcalendar | Capability name: processcalendar | |||
Description: Adds the "processcalendar" action command to add and | Description: Adds the "processcalendar" action command to add and | |||
update items on a user's calendars. | update items on a user's calendars. | |||
RFC number: RFC XXXX | RFC number: RFC 9671 | |||
Contact address: The Sieve discussion list <sieve@ietf.org> | Contact address: Sieve discussion list <sieve@ietf.org> | |||
7.2. Registration of Sieve Action | 7.2. Registration of Sieve Action | |||
This document defines the following new Sieve action to be added to | This document defines the following new Sieve action, which IANA has | |||
the registry defined in Section 2.1 of [RFC9122] and located here: | added to the "Sieve Actions" registry | |||
https://www.iana.org/assignments/sieve-extensions/sieve- | (https://www.iana.org/assignments/sieve-extensions). The registry is | |||
extensions.xhtml#sieve-actions | defined in Section 2.1 of [RFC9122]. | |||
IANA are requested to add a capability to the Sieve Actions registry: | ||||
To: iana@iana.org | ||||
Subject: Registration of new Sieve action | ||||
Name: processcalendar | ||||
Description: Add and update items on a user's calendars | ||||
References: RFC XXXX [RFC5229] [RFC6134] | Name: processcalendar | |||
Capabilities: "processcalendar", "variables", "extlists" | Description: Add and update items on a user's calendars | |||
Action Interactions: This action is incompatible with "reject" and | References: RFC 9671 [RFC5229] [RFC6134] | |||
"ereject" actions | ||||
Cancels Implicit Keep? No | Capabilities: "processcalendar", "variables", "extlists" | |||
Can Use with IMAP Events? No | Action Interactions: This action is incompatible with the "reject" | |||
and "ereject" actions. | ||||
8. Acknowledgments | Cancels Implicit Keep? No | |||
The authors would like to thank the following individuals for | Can Use with IMAP Events? No | |||
contributing their ideas and support for writing this specification: | ||||
Ned Freed and Alexey Melnikov. | ||||
9. References | 8. References | |||
9.1. Normative References | 8.1. Normative References | |||
[CALSPAM] The Calendaring and Scheduling Consortium, "Calendar | [CALSPAM] The Calendaring and Scheduling Consortium, "Calendar | |||
operator practices - Guidelines to protect against | operator practices - Guidelines to protect against | |||
calendar abuse", CC/R 18003, 2019, | calendar abuse", CC/R 18003:2019, 2019, | |||
<https://standards.calconnect.org/csd/cc-18003.html>. | <https://standards.calconnect.org/csd/cc-18003.html>. | |||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, | Requirement Levels", BCP 14, RFC 2119, | |||
DOI 10.17487/RFC2119, March 1997, | DOI 10.17487/RFC2119, March 1997, | |||
<https://www.rfc-editor.org/info/rfc2119>. | <https://www.rfc-editor.org/info/rfc2119>. | |||
[RFC5228] Guenther, P., Ed. and T. Showalter, Ed., "Sieve: An Email | [RFC5228] Guenther, P., Ed. and T. Showalter, Ed., "Sieve: An Email | |||
Filtering Language", RFC 5228, DOI 10.17487/RFC5228, | Filtering Language", RFC 5228, DOI 10.17487/RFC5228, | |||
January 2008, <https://www.rfc-editor.org/info/rfc5228>. | January 2008, <https://www.rfc-editor.org/info/rfc5228>. | |||
skipping to change at page 11, line 30 ¶ | skipping to change at line 481 ¶ | |||
<https://www.rfc-editor.org/info/rfc6134>. | <https://www.rfc-editor.org/info/rfc6134>. | |||
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | |||
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, | 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, | |||
May 2017, <https://www.rfc-editor.org/info/rfc8174>. | May 2017, <https://www.rfc-editor.org/info/rfc8174>. | |||
[RFC9122] Melnikov, A. and K. Murchison, "IANA Registry for Sieve | [RFC9122] Melnikov, A. and K. Murchison, "IANA Registry for Sieve | |||
Actions", RFC 9122, DOI 10.17487/RFC9122, June 2023, | Actions", RFC 9122, DOI 10.17487/RFC9122, June 2023, | |||
<https://www.rfc-editor.org/info/rfc9122>. | <https://www.rfc-editor.org/info/rfc9122>. | |||
9.2. Informative References | 8.2. Informative References | |||
[RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail | [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail | |||
Extensions (MIME) Part One: Format of Internet Message | Extensions (MIME) Part One: Format of Internet Message | |||
Bodies", RFC 2045, DOI 10.17487/RFC2045, November 1996, | Bodies", RFC 2045, DOI 10.17487/RFC2045, November 1996, | |||
<https://www.rfc-editor.org/info/rfc2045>. | <https://www.rfc-editor.org/info/rfc2045>. | |||
[RFC5235] Daboo, C., "Sieve Email Filtering: Spamtest and Virustest | [RFC5235] Daboo, C., "Sieve Email Filtering: Spamtest and Virustest | |||
Extensions", RFC 5235, DOI 10.17487/RFC5235, January 2008, | Extensions", RFC 5235, DOI 10.17487/RFC5235, January 2008, | |||
<https://www.rfc-editor.org/info/rfc5235>. | <https://www.rfc-editor.org/info/rfc5235>. | |||
skipping to change at page 12, line 35 ¶ | skipping to change at line 532 ¶ | |||
[RFC8551] Schaad, J., Ramsdell, B., and S. Turner, "Secure/ | [RFC8551] Schaad, J., Ramsdell, B., and S. Turner, "Secure/ | |||
Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 | Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 | |||
Message Specification", RFC 8551, DOI 10.17487/RFC8551, | Message Specification", RFC 8551, DOI 10.17487/RFC8551, | |||
April 2019, <https://www.rfc-editor.org/info/rfc8551>. | April 2019, <https://www.rfc-editor.org/info/rfc8551>. | |||
[RFC8984] Jenkins, N. and R. Stepanek, "JSCalendar: A JSON | [RFC8984] Jenkins, N. and R. Stepanek, "JSCalendar: A JSON | |||
Representation of Calendar Data", RFC 8984, | Representation of Calendar Data", RFC 8984, | |||
DOI 10.17487/RFC8984, July 2021, | DOI 10.17487/RFC8984, July 2021, | |||
<https://www.rfc-editor.org/info/rfc8984>. | <https://www.rfc-editor.org/info/rfc8984>. | |||
Appendix A. Change History (To be removed by RFC Editor before | Acknowledgments | |||
publication) | ||||
Changes since draft-ietf-sieve-processimip-08: | ||||
1. Added a consequence of not removing alarms before applying data | ||||
to a calendar. | ||||
2. Changed iCalendar-specific "UID" to generic "unique identifier". | ||||
3. Use a normative SHOULD for :deletecancelled argument. | ||||
4. Removed Implementation Status section. | ||||
Changes since draft-ietf-sieve-processimip-07: | ||||
1. Fixed Sieve Action registration to include all associated | ||||
capabilites and their references. | ||||
Changes since draft-ietf-sieve-processimip-06: | ||||
1. Fixed example that was still using :errstr rather than :reason. | ||||
2. Explicitly stated that the :updateonly and :calendarid options | ||||
are incompatible with each each. | ||||
3. Explicitly stated that if :allowpublic is used with :organizers | ||||
that non-iTIP messages MUST NOT be processed. | ||||
4. Updated security considerations to use "deny list" and "allow | ||||
list", and to add a bullet discussing use of S/MIME, SPF, DKIM, | ||||
and DMARC. | ||||
5. Updated the status of the Cyrus implementation. | ||||
6. Miscellaneous editorial changes. | ||||
Changes since draft-ietf-sieve-processimip-05: | ||||
1. Renamed :errstr to :reason and added examples. | ||||
2. Miscellaneous editorial changes. | ||||
Changes since draft-ietf-sieve-processimip-04: | ||||
1. Miscellaneous editorial changes. | ||||
Changes since draft-ietf-sieve-processimip-03: | ||||
1. Added text about multiple MIME parts containing calendar data. | ||||
2. Added text about embedded attachments to Security Considerations. | ||||
3. Added :organizers option if "extlists" is supported. | ||||
4. Miscellaneous editorial changes. | ||||
Changes since draft-ietf-sieve-processimip-02: | ||||
1. Renamed :nonitip to :allowpublic to cover both non-iTIP and | ||||
METHOD:PUBLIC messages. | ||||
2. Renamed :deletecanceled to :deletecancelled to match RFC5545 | ||||
language. | ||||
3. Specified that this action MUST NOT alter a recipient's | ||||
participation status. | ||||
4. :errstr MUST be set to the empty string if no reason for the | ||||
outcome is available. | ||||
5. Added the "Interaction with Other Sieve Actions" subsection. | ||||
6. Add Security Considerations. | ||||
7. Added action registration. | ||||
8. Added three issues for discussion. | ||||
9. Miscellaneous editorial changes. | ||||
Changes since draft-ietf-sieve-processimip-01: | ||||
1. Changed the name of the action from processimip to | ||||
processcalendar. | ||||
2. The action is now independent of iMIP and is calendar data format | ||||
agnostic. | ||||
3. Added examples. | ||||
Changes since draft-ietf-sieve-processimip-00: | ||||
1. No changes. | ||||
Changes since draft-murchison-sieve-processimip-00: | ||||
1. Document name change only. | The authors would like to thank the following individuals for | |||
contributing their ideas and support for writing this specification: | ||||
Ned Freed and Alexey Melnikov. | ||||
Authors' Addresses | Authors' Addresses | |||
Kenneth Murchison | Kenneth Murchison | |||
Fastmail US LLC | Fastmail US LLC | |||
1429 Walnut Street - Suite 1201 | 1429 Walnut Street, Suite 1201 | |||
Philadelphia, PA 19102 | Philadelphia, PA 19102 | |||
United States of America | United States of America | |||
Email: murch@fastmailteam.com | Email: murch@fastmailteam.com | |||
Ricardo Signes | Ricardo Signes | |||
Fastmail US LLC | Fastmail US LLC | |||
1429 Walnut Street - Suite 1201 | 1429 Walnut Street, Suite 1201 | |||
Philadelphia, PA 19102 | Philadelphia, PA 19102 | |||
United States of America | United States of America | |||
Email: rjbs@fastmailteam.com | Email: rjbs@fastmailteam.com | |||
Matthew Horsfall | Matthew Horsfall | |||
Fastmail US LLC | Fastmail US LLC | |||
1429 Walnut Street - Suite 1201 | 1429 Walnut Street, Suite 1201 | |||
Philadelphia, PA 19102 | Philadelphia, PA 19102 | |||
United States of America | United States of America | |||
Email: alh@fastmailteam.com | Email: alh@fastmailteam.com | |||
End of changes. 62 change blocks. | ||||
264 lines changed or deleted | 153 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. |