rfc-3894

Sieve Extension: Copying Without Side Effects

J. Degener

date2004-10 streamIETF wgnon working group statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc3894 doi10.17487/RFC3894

The Sieve scripting language allows users to control handling and disposal of their incoming e-mail. By default, an e-mail message that is processed by a Sieve script is saved in the owner's "inbox". Actions such as "fileinto" and "redirect" cancel this default behavior. This document defines a new keyword parameter, ":copy", to be used with the Sieve "fileinto" and "redirect" actions. Adding ":copy" to an action suppresses cancellation of the default "inbox" save. It allows users to add commands to an existing script without changing the meaning of the rest of the script. [STANDARDS-TRACK]

Extracted elements (7)

design-rationale §1

The extension is motivated by the difficulty of generating Sieve code that correctly expresses "copy" semantics without it: such code grows unwieldy because it must track the state that the implicit "keep" would have had. The ":copy" parameter allows direct expression of copy semantics.

design-rationale §1

Without ":copy", users who want to file or forward an extra copy of a message while preserving normal delivery must use an explicit "keep" command. However, an explicit "keep" is a poor substitute for the implicit keep when more processing follows, because subsequent "discard" commands cannot cancel an explicit "keep", leading to unintended inbox delivery.

normative-requirement §3 MUST

If the optional ":copy" keyword is specified with "fileinto" or "redirect", the tagged command does not cancel the implicit "keep". Instead, it merely files or redirects a copy in addition to whatever else is happening to the message.

privacy-consideration §4

Organizations that wish to monitor their users' e-mail traffic must familiarize themselves with local data protection laws before creating stores of old e-mail traffic without the knowledge or consent of senders or intended recipients. Organizations using "redirect :copy" for legal monitoring should set users' privacy expectations correctly.

email, privacy

protocol-element §3

The ":copy" keyword parameter can be used with the Sieve "fileinto" and "redirect" actions. When specified, it suppresses cancellation of the implicit "keep" behavior, causing the action to file or redirect a copy of the message in addition to normal delivery.

registry §5

This document registers the "copy" Sieve extension capability with IANA under the Sieve extensions registry. The capability name and keyword are both "copy", with no capability arguments.

email, registry

security-consideration §4

The ":copy" extension makes it easier to eavesdrop on a user's message stream without the user noticing, since an attacker with write access to Sieve scripts no longer needs to parse a script to modify it. Write access to Sieve scripts must be protected as strongly as read/write access to e-mail, for example by using secure directory protocols such as correctly parameterized LDAP over TLS.

email, security, privacy, ldap, tls