imapext-2007

annotate docs/rfc/rfc2971.txt @ 0:ada5e610ab86

imap-2007e
author yuuji@gentei.org
date Mon, 14 Sep 2009 15:17:45 +0900
parents
children
rev   line source
yuuji@0 1
yuuji@0 2
yuuji@0 3
yuuji@0 4
yuuji@0 5
yuuji@0 6
yuuji@0 7 Network Working Group T. Showalter
yuuji@0 8 Request for Comments: 2971 Mirapoint, Inc.
yuuji@0 9 Category: Standards Track October 2000
yuuji@0 10
yuuji@0 11
yuuji@0 12 IMAP4 ID extension
yuuji@0 13
yuuji@0 14 Status of this Memo
yuuji@0 15
yuuji@0 16 This document specifies an Internet standards track protocol for the
yuuji@0 17 Internet community, and requests discussion and suggestions for
yuuji@0 18 improvements. Please refer to the current edition of the "Internet
yuuji@0 19 Official Protocol Standards" (STD 1) for the standardization state
yuuji@0 20 and status of this protocol. Distribution of this memo is unlimited.
yuuji@0 21
yuuji@0 22 Copyright Notice
yuuji@0 23
yuuji@0 24 Copyright (C) The Internet Society (2000). All Rights Reserved.
yuuji@0 25
yuuji@0 26 Abstract
yuuji@0 27
yuuji@0 28 The ID extension to the Internet Message Access Protocol - Version
yuuji@0 29 4rev1 (IMAP4rev1) protocol allows the server and client to exchange
yuuji@0 30 identification information on their implementation in order to make
yuuji@0 31 bug reports and usage statistics more complete.
yuuji@0 32
yuuji@0 33 1. Introduction
yuuji@0 34
yuuji@0 35 The IMAP4rev1 protocol described in [IMAP4rev1] provides a method for
yuuji@0 36 accessing remote mail stores, but it provides no facility to
yuuji@0 37 advertise what program a client or server uses to provide service.
yuuji@0 38 This makes it difficult for implementors to get complete bug reports
yuuji@0 39 from users, as it is frequently difficult to know what client or
yuuji@0 40 server is in use.
yuuji@0 41
yuuji@0 42 Additionally, some sites may wish to assemble usage statistics based
yuuji@0 43 on what clients are used, but in an an environment where users are
yuuji@0 44 permitted to obtain and maintain their own clients this is difficult
yuuji@0 45 to accomplish.
yuuji@0 46
yuuji@0 47 The ID command provides a facility to advertise information on what
yuuji@0 48 programs are being used along with contact information (should bugs
yuuji@0 49 ever occur).
yuuji@0 50
yuuji@0 51
yuuji@0 52
yuuji@0 53
yuuji@0 54
yuuji@0 55
yuuji@0 56
yuuji@0 57
yuuji@0 58 Showalter Standards Track [Page 1]
yuuji@0 59
yuuji@0 60 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 61
yuuji@0 62
yuuji@0 63 2. Conventions Used in this Document
yuuji@0 64
yuuji@0 65 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
yuuji@0 66 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
yuuji@0 67 document are to be interpreted as described in [KEYWORDS].
yuuji@0 68
yuuji@0 69 The conventions used in this document are the same as specified in
yuuji@0 70 [IMAP4rev1]. In examples, "C:" and "S:" indicate lines sent by the
yuuji@0 71 client and server respectively. Line breaks have been inserted for
yuuji@0 72 readability.
yuuji@0 73
yuuji@0 74 3. Specification
yuuji@0 75
yuuji@0 76 The sole purpose of the ID extension is to enable clients and servers
yuuji@0 77 to exchange information on their implementations for the purposes of
yuuji@0 78 statistical analysis and problem determination.
yuuji@0 79
yuuji@0 80 This information is be submitted to a server by any client wishing to
yuuji@0 81 provide information for statistical purposes, provided the server
yuuji@0 82 advertises its willingness to take the information with the atom "ID"
yuuji@0 83 included in the list of capabilities returned by the CAPABILITY
yuuji@0 84 command.
yuuji@0 85
yuuji@0 86 Implementations MUST NOT make operational changes based on the data
yuuji@0 87 sent as part of the ID command or response. The ID command is for
yuuji@0 88 human consumption only, and is not to be used in improving the
yuuji@0 89 performance of clients or servers.
yuuji@0 90
yuuji@0 91 This includes, but is not limited to, the following:
yuuji@0 92
yuuji@0 93 Servers MUST NOT attempt to work around client bugs by using
yuuji@0 94 information from the ID command. Clients MUST NOT attempt to work
yuuji@0 95 around server bugs based on the ID response.
yuuji@0 96
yuuji@0 97 Servers MUST NOT provide features to a client or otherwise
yuuji@0 98 optimize for a particular client by using information from the ID
yuuji@0 99 command. Clients MUST NOT provide features to a server or
yuuji@0 100 otherwise optimize for a particular server based on the ID
yuuji@0 101 response.
yuuji@0 102
yuuji@0 103 Servers MUST NOT deny access to or refuse service for a client
yuuji@0 104 based on information from the ID command. Clients MUST NOT refuse
yuuji@0 105 to operate or limit their operation with a server based on the ID
yuuji@0 106 response.
yuuji@0 107
yuuji@0 108
yuuji@0 109
yuuji@0 110
yuuji@0 111
yuuji@0 112
yuuji@0 113
yuuji@0 114 Showalter Standards Track [Page 2]
yuuji@0 115
yuuji@0 116 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 117
yuuji@0 118
yuuji@0 119 Rationale: It is imperative that this extension not supplant IMAP's
yuuji@0 120 CAPABILITY mechanism with a ad-hoc approach where implementations
yuuji@0 121 guess each other's features based on who they claim to be.
yuuji@0 122
yuuji@0 123 Implementations MUST NOT send false information in an ID command.
yuuji@0 124
yuuji@0 125 Implementations MAY send less information than they have available or
yuuji@0 126 no information at all. Such behavior may be useful to preserve user
yuuji@0 127 privacy. See Security Considerations, section 7.
yuuji@0 128
yuuji@0 129 3.1. ID Command
yuuji@0 130
yuuji@0 131 Arguments: client parameter list or NIL
yuuji@0 132
yuuji@0 133 Responses: OPTIONAL untagged response: ID
yuuji@0 134
yuuji@0 135 Result: OK identification information accepted
yuuji@0 136 BAD command unknown or arguments invalid
yuuji@0 137
yuuji@0 138 Implementation identification information is sent by the client with
yuuji@0 139 the ID command.
yuuji@0 140
yuuji@0 141 This command is valid in any state.
yuuji@0 142
yuuji@0 143 The information sent is in the form of a list of field/value pairs.
yuuji@0 144 Fields are permitted to be any IMAP4 string, and values are permitted
yuuji@0 145 to be any IMAP4 string or NIL. A value of NIL indicates that the
yuuji@0 146 client can not or will not specify this information. The client may
yuuji@0 147 also send NIL instead of the list, indicating that it wants to send
yuuji@0 148 no information, but would still accept a server response.
yuuji@0 149
yuuji@0 150 The available fields are defined in section 3.3.
yuuji@0 151
yuuji@0 152 Example: C: a023 ID ("name" "sodr" "version" "19.34" "vendor"
yuuji@0 153 "Pink Floyd Music Limited")
yuuji@0 154 S: * ID NIL
yuuji@0 155 S: a023 OK ID completed
yuuji@0 156
yuuji@0 157 3.2. ID Response
yuuji@0 158
yuuji@0 159 Contents: server parameter list
yuuji@0 160
yuuji@0 161 In response to an ID command issued by the client, the server replies
yuuji@0 162 with a tagged response containing information on its implementation.
yuuji@0 163 The format is the same as the client list.
yuuji@0 164
yuuji@0 165
yuuji@0 166
yuuji@0 167
yuuji@0 168
yuuji@0 169
yuuji@0 170 Showalter Standards Track [Page 3]
yuuji@0 171
yuuji@0 172 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 173
yuuji@0 174
yuuji@0 175 Example: C: a042 ID NIL
yuuji@0 176 S: * ID ("name" "Cyrus" "version" "1.5" "os" "sunos"
yuuji@0 177 "os-version" "5.5" "support-url"
yuuji@0 178 "mailto:cyrus-bugs+@andrew.cmu.edu")
yuuji@0 179 S: a042 OK ID command completed
yuuji@0 180
yuuji@0 181 A server MUST send a tagged ID response to an ID command. However, a
yuuji@0 182 server MAY send NIL in place of the list.
yuuji@0 183
yuuji@0 184 3.3. Defined Field Values
yuuji@0 185
yuuji@0 186 Any string may be sent as a field, but the following are defined to
yuuji@0 187 describe certain values that might be sent. Implementations are free
yuuji@0 188 to send none, any, or all of these. Strings are not case-sensitive.
yuuji@0 189 Field strings MUST NOT be longer than 30 octets. Value strings MUST
yuuji@0 190 NOT be longer than 1024 octets. Implementations MUST NOT send more
yuuji@0 191 than 30 field-value pairs.
yuuji@0 192
yuuji@0 193 name Name of the program
yuuji@0 194 version Version number of the program
yuuji@0 195 os Name of the operating system
yuuji@0 196 os-version Version of the operating system
yuuji@0 197 vendor Vendor of the client/server
yuuji@0 198 support-url URL to contact for support
yuuji@0 199 address Postal address of contact/vendor
yuuji@0 200 date Date program was released, specified as a date-time
yuuji@0 201 in IMAP4rev1
yuuji@0 202 command Command used to start the program
yuuji@0 203 arguments Arguments supplied on the command line, if any
yuuji@0 204 if any
yuuji@0 205 environment Description of environment, i.e., UNIX environment
yuuji@0 206 variables or Windows registry settings
yuuji@0 207
yuuji@0 208 Implementations MUST NOT use contact information to submit automatic
yuuji@0 209 bug reports. Implementations may include information from an ID
yuuji@0 210 response in a report automatically prepared, but are prohibited from
yuuji@0 211 sending the report without user authorization.
yuuji@0 212
yuuji@0 213 It is preferable to find the name and version of the underlying
yuuji@0 214 operating system at runtime in cases where this is possible.
yuuji@0 215
yuuji@0 216 Information sent via an ID response may violate user privacy. See
yuuji@0 217 Security Considerations, section 7.
yuuji@0 218
yuuji@0 219 Implementations MUST NOT send the same field name more than once.
yuuji@0 220
yuuji@0 221
yuuji@0 222
yuuji@0 223
yuuji@0 224
yuuji@0 225
yuuji@0 226 Showalter Standards Track [Page 4]
yuuji@0 227
yuuji@0 228 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 229
yuuji@0 230
yuuji@0 231 4. Formal Syntax
yuuji@0 232
yuuji@0 233 This syntax is intended to augment the grammar specified in
yuuji@0 234 [IMAP4rev1] in order to provide for the ID command. This
yuuji@0 235 specification uses the augmented Backus-Naur Form (BNF) notation as
yuuji@0 236 used in [IMAP4rev1].
yuuji@0 237
yuuji@0 238 command_any ::= "CAPABILITY" / "LOGOUT" / "NOOP" / x_command / id
yuuji@0 239 ;; adds id command to command_any in [IMAP4rev1]
yuuji@0 240
yuuji@0 241 id ::= "ID" SPACE id_params_list
yuuji@0 242
yuuji@0 243 id_response ::= "ID" SPACE id_params_list
yuuji@0 244
yuuji@0 245 id_params_list ::= "(" #(string SPACE nstring) ")" / nil
yuuji@0 246 ;; list of field value pairs
yuuji@0 247
yuuji@0 248 response_data ::= "*" SPACE (resp_cond_state / resp_cond_bye /
yuuji@0 249 mailbox_data / message_data / capability_data / id_response)
yuuji@0 250
yuuji@0 251 5. Use of the ID extension with Firewalls and Other Intermediaries
yuuji@0 252
yuuji@0 253 There exist proxies, firewalls, and other intermediary systems that
yuuji@0 254 can intercept an IMAP session and make changes to the data exchanged
yuuji@0 255 in the session. Such intermediaries are not anticipated by the IMAP4
yuuji@0 256 protocol design and are not within the scope of the IMAP4 standard.
yuuji@0 257 However, in order for the ID command to be useful in the presence of
yuuji@0 258 such intermediaries, those intermediaries need to take special note
yuuji@0 259 of the ID command and response. In particular, if an intermediary
yuuji@0 260 changes any part of the IMAP session it must also change the ID
yuuji@0 261 command to advertise its presence.
yuuji@0 262
yuuji@0 263 A firewall MAY act to block transmission of specific information
yuuji@0 264 fields in the ID command and response that it believes reveal
yuuji@0 265 information that could expose a security vulnerability. However, a
yuuji@0 266 firewall SHOULD NOT disable the extension, when present, entirely,
yuuji@0 267 and SHOULD NOT unconditionally remove either the client or server
yuuji@0 268 list.
yuuji@0 269
yuuji@0 270 Finally, it should be noted that a firewall, when handling a
yuuji@0 271 CAPABILITY response, MUST NOT allow the names of extensions to be
yuuji@0 272 returned to the client that the firewall has no knowledge of.
yuuji@0 273
yuuji@0 274
yuuji@0 275
yuuji@0 276
yuuji@0 277
yuuji@0 278
yuuji@0 279
yuuji@0 280
yuuji@0 281
yuuji@0 282 Showalter Standards Track [Page 5]
yuuji@0 283
yuuji@0 284 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 285
yuuji@0 286
yuuji@0 287 6. References
yuuji@0 288
yuuji@0 289 [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate
yuuji@0 290 Requirement Levels", RFC 2119, March 1997.
yuuji@0 291
yuuji@0 292 [IMAP4rev1] Crispin, M., "Internet Message Access Protocol - Version
yuuji@0 293 4rev1", RFC 2060, October 1996.
yuuji@0 294
yuuji@0 295 [RFC-822] Crocker, D., "Standard for the Format of ARPA Internet
yuuji@0 296 Text Messages", STD 11, RFC 822, August 1982.
yuuji@0 297
yuuji@0 298 7. Security Considerations
yuuji@0 299
yuuji@0 300 This extension has the danger of violating the privacy of users if
yuuji@0 301 misused. Clients and servers should notify users that they implement
yuuji@0 302 and enable the ID command.
yuuji@0 303
yuuji@0 304 It is highly desirable that implementations provide a method of
yuuji@0 305 disabling ID support, perhaps by not sending ID at all, or by sending
yuuji@0 306 NIL as the argument to the ID command or response.
yuuji@0 307
yuuji@0 308 Implementors must exercise extreme care in adding fields sent as part
yuuji@0 309 of an ID command or response. Some fields, including a processor ID
yuuji@0 310 number, Ethernet address, or other unique (or mostly unique)
yuuji@0 311 identifier allow tracking of users in ways that violate user privacy
yuuji@0 312 expectations.
yuuji@0 313
yuuji@0 314 Having implementation information of a given client or server may
yuuji@0 315 make it easier for an attacker to gain unauthorized access due to
yuuji@0 316 security holes.
yuuji@0 317
yuuji@0 318 Since this command includes arbitrary data and does not require the
yuuji@0 319 user to authenticate, server implementations are cautioned to guard
yuuji@0 320 against an attacker sending arbitrary garbage data in order to fill
yuuji@0 321 up the ID log. In particular, if a server naively logs each ID
yuuji@0 322 command to disk without inspecting it, an attacker can simply fire up
yuuji@0 323 thousands of connections and send a few kilobytes of random data.
yuuji@0 324 Servers have to guard against this. Methods include truncating
yuuji@0 325 abnormally large responses; collating responses by storing only a
yuuji@0 326 single copy, then keeping a counter of the number of times that
yuuji@0 327 response has been seen; keeping only particularly interesting parts
yuuji@0 328 of responses; and only logging responses of users who actually log
yuuji@0 329 in.
yuuji@0 330
yuuji@0 331 Security is affected by firewalls which modify the IMAP protocol
yuuji@0 332 stream; see section 5, Use of the ID Extension with Firewalls and
yuuji@0 333 Other Intermediaries, for more information.
yuuji@0 334
yuuji@0 335
yuuji@0 336
yuuji@0 337
yuuji@0 338 Showalter Standards Track [Page 6]
yuuji@0 339
yuuji@0 340 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 341
yuuji@0 342
yuuji@0 343 8. Author's Address
yuuji@0 344
yuuji@0 345 Tim Showalter
yuuji@0 346 Mirapoint, Inc.
yuuji@0 347 909 Hermosa Ct.
yuuji@0 348 Sunnyvale, CA 94095
yuuji@0 349
yuuji@0 350 EMail: tjs@mirapoint.com
yuuji@0 351
yuuji@0 352
yuuji@0 353
yuuji@0 354
yuuji@0 355
yuuji@0 356
yuuji@0 357
yuuji@0 358
yuuji@0 359
yuuji@0 360
yuuji@0 361
yuuji@0 362
yuuji@0 363
yuuji@0 364
yuuji@0 365
yuuji@0 366
yuuji@0 367
yuuji@0 368
yuuji@0 369
yuuji@0 370
yuuji@0 371
yuuji@0 372
yuuji@0 373
yuuji@0 374
yuuji@0 375
yuuji@0 376
yuuji@0 377
yuuji@0 378
yuuji@0 379
yuuji@0 380
yuuji@0 381
yuuji@0 382
yuuji@0 383
yuuji@0 384
yuuji@0 385
yuuji@0 386
yuuji@0 387
yuuji@0 388
yuuji@0 389
yuuji@0 390
yuuji@0 391
yuuji@0 392
yuuji@0 393
yuuji@0 394 Showalter Standards Track [Page 7]
yuuji@0 395
yuuji@0 396 RFC 2971 IMAP4 ID extension October 2000
yuuji@0 397
yuuji@0 398
yuuji@0 399 9. Full Copyright Statement
yuuji@0 400
yuuji@0 401 Copyright (C) The Internet Society (2000). All Rights Reserved.
yuuji@0 402
yuuji@0 403 This document and translations of it may be copied and furnished to
yuuji@0 404 others, and derivative works that comment on or otherwise explain it
yuuji@0 405 or assist in its implementation may be prepared, copied, published
yuuji@0 406 and distributed, in whole or in part, without restriction of any
yuuji@0 407 kind, provided that the above copyright notice and this paragraph are
yuuji@0 408 included on all such copies and derivative works. However, this
yuuji@0 409 document itself may not be modified in any way, such as by removing
yuuji@0 410 the copyright notice or references to the Internet Society or other
yuuji@0 411 Internet organizations, except as needed for the purpose of
yuuji@0 412 developing Internet standards in which case the procedures for
yuuji@0 413 copyrights defined in the Internet Standards process must be
yuuji@0 414 followed, or as required to translate it into languages other than
yuuji@0 415 English.
yuuji@0 416
yuuji@0 417 The limited permissions granted above are perpetual and will not be
yuuji@0 418 revoked by the Internet Society or its successors or assigns.
yuuji@0 419
yuuji@0 420 This document and the information contained herein is provided on an
yuuji@0 421 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
yuuji@0 422 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
yuuji@0 423 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
yuuji@0 424 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
yuuji@0 425 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
yuuji@0 426
yuuji@0 427 Acknowledgement
yuuji@0 428
yuuji@0 429 Funding for the RFC Editor function is currently provided by the
yuuji@0 430 Internet Society.
yuuji@0 431
yuuji@0 432
yuuji@0 433
yuuji@0 434
yuuji@0 435
yuuji@0 436
yuuji@0 437
yuuji@0 438
yuuji@0 439
yuuji@0 440
yuuji@0 441
yuuji@0 442
yuuji@0 443
yuuji@0 444
yuuji@0 445
yuuji@0 446
yuuji@0 447
yuuji@0 448
yuuji@0 449
yuuji@0 450 Showalter Standards Track [Page 8]
yuuji@0 451

UW-IMAP'd extensions by yuuji