Sieve Extension: Externally Stored Lists
Extracted elements (30)
The shorthand notation where a list name beginning with ":" expands to "urn:ietf:params:sieve:" was introduced to make it easier to use registered Sieve URN parameters without requiring users to type full URNs in scripts.
The "tag" URI scheme (RFC 4151) is recommended for opaque, user-friendly list identifiers because generic LDAP URI syntax is too complex for end users. An implementation can use a fixed tag URI prefix and hide backend complexity, e.g., mapping a simple tag to an LDAP query behind a web interface.
Applications are only REQUIRED to support "addrbook:default". If a server has no address book concept, it MAY support ":addrbook:default" by having all matches fail, but this SHOULD NOT be done except as a last resort. Other Sieve tests supporting ":list" SHOULD be documented in a specification with a testable capability string.
Address book names other than "default" MAY be case-sensitive depending on the implementation, so their case (after URI decoding) MUST be maintained.
Comparators MUST NOT be used together with the ":list" match type; if both are specified, that MUST result in an error.
If neither the Sieve engine nor the list handler can enumerate the list, or the list does not resolve to email addresses, the situation MUST result in a runtime error in the Sieve script.
If the Sieve engine is permanently unable to query a list (e.g., the list doesn't support the required operation), the test MUST result in a runtime error in the Sieve script.
Implementations MUST report an error when a script uses ":list" with a test that does not support ":list". This error SHOULD be reported at compile-time but MAY be reported at run-time.
Implementations MUST support the use of ":list" in "address", "envelope", and "header" tests. Implementations that include the Variables extension MUST also support its use in "string" tests.
Implementations that support the Variables extension MUST set the ${0} match variable to the value in the list that matched the query when using ":list". Other numbered match variables MAY be set with list-specific information.
Queries against address books SHOULD be done without regard to case.
The "addrbook" URN "urn:ietf:params:sieve:addrbook:default" MUST be supported by all implementations. The reserved name "default" MUST be treated as case-insensitive after URI decoding.
A name of an externally stored list is always an absolute URI (RFC 3986). Useful URI schemes include LDAP, CardDAV, and "tag" URIs. A list name beginning with ":" is shorthand for "urn:ietf:params:sieve:" — e.g., ":addrbook:default" expands to "urn:ietf:params:sieve:addrbook:default".
The "addrbook" URN parameter defines URIs of the form "urn:ietf:params:sieve:addrbook:<name>[?extensions]", where "default" is a mandatory case-insensitive sub-parameter representing the user's default address book. The ABNF specifies addrbook-urn = "addrbook:" addrbook [ "?" extensions ].
The capability string for this extension is "extlists". Sieve scripts must require this capability before using the :list match type or the :list argument to redirect.
The ":list" match type changes the interpretation of the key-list parameter in supported tests so that it becomes a list of names of externally stored lists. The test evaluates to "true" if any specified value matches any member of one or more of the named lists.
The ManageSieve "EXTLISTS" capability reports a space-separated list of URI schema parts for supported externally stored list types. This capability MUST be returned if the server supports the "extlists" extension. The EXTLISTS value MUST NOT be empty.
The "redirect :list <ext-list-name>" action sends the message to the set of email addresses in the externally stored list named by ext-list-name, enabling personal distribution lists. The list must either resolve to enumerable email addresses or the list handler must take care of redirection.
The "valid_ext_list" test returns true if all external list names in its argument are syntactically and semantically valid. It MUST perform exactly the same validation as would be performed by the "header :list" test.
This document creates a new "Sieve URN Parameters" registry under "Sieve Extensions", governed by the "Specification Required" policy (RFC 5226). Each entry must include the URN parameter name, a reference to the defining document and section, and documentation covering syntax, intended usage, interoperability considerations, and security considerations.
This document registers the "addrbook" URN parameter in the new Sieve URN Parameters registry, defined in Section 2.6, creating the top-level URN namespace "urn:ietf:params:sieve:addrbook:".
This document registers the "extlists" capability in the Sieve Extensions registry on iana.org, adding the ":list" match type and ":list" argument to the redirect action for externally stored list access.
This document registers the "extlists" ManageSieve capability in the IANA ManageSieve Capabilities registry, to be returned by servers that support the RFC 6134 Sieve extension.
This document registers the "sieve" URN sub-namespace within the IETF URN Sub-namespace for Registered Protocol Parameters (RFC 3553), with sub-parameters required to be specified in UTF-8 using standard URI encoding.
Applications SHOULD ensure appropriate access controls are in place to protect sensitive information that might be revealed by "addrbook" URNs from access or modification by untrusted sources.
External data controlling Sieve script behavior gives whoever controls that data unusual power over email disposition. Tampering with an external list could cause important mail to be discarded or redirected to unintended recipients. Security and integrity protection of external lists is as important as protection of the Sieve script itself.
External list memberships should be treated as integral parts of the Sieve script. A temporary failure to access an external list SHOULD be handled the same way as a temporary failure to retrieve the Sieve script itself — typically by delaying message delivery until the list can be accessed.
Matching values against externally stored lists can be I/O- and CPU-intensive, enabling denial-of-service attacks against the mail server or list service. Implementations SHOULD use protocol-specific search features (e.g., LDAP search filters) to minimize network traffic and server load rather than retrieving entire lists.
Protocols and APIs used to retrieve or verify external list membership MUST provide an appropriate level of confidentiality and authentication, at least equivalent to those used to retrieve Sieve scripts. The appropriate level depends on context (open Internet vs. closed LAN) and whether the list is private or public.
To prevent mailbombs when redirecting to externally stored lists with potentially thousands of recipients, implementations SHOULD enforce limits on the number of recipients and/or the domains to which recipients belong. The "redirect :list :addrbook:default" pattern is particularly prone to accidental or intentional abuse.