Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America murch@fastmailteam.com

Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America rjbs@fastmailteam.com

Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America alh@fastmailteam.com

ART extra Sieve This document describes the "processcalendar" extension to the Sieve email filtering language. The "processcalendar" extension gives Sieve the ability to process machine-readable calendar data that is encapsulated in an email message using Multipurpose Internet Mail Extensions (MIME).

Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at .

Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents () in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.

Table of Contents

• .  Introduction
• .  Conventions Used in This Document
• .  Capability Identifier
• .  Process Calendar Action
  • .  Allow Public Argument
  • .  Addresses Argument
  • .  Updates Only Argument
  • .  Calendar ID Argument
  • .  Delete Cancelled Argument
  • .  Organizers Argument
  • .  Outcome Argument
  • .  Reason Argument
  • .  Interaction with Other Sieve Actions
  • . Examples
• .  Security Considerations
• .  Privacy Considerations
• .  IANA Considerations
  • .  Registration of Sieve Extension
  • .  Registration of Sieve Action
• .  References
  • .  Normative References
  • .  Informative References
• Acknowledgments
• Authors' Addresses

Introduction Users frequently receive invites, replies, and cancellations for events, tasks, etc. via Internet mail messages. It is sometimes desirable to have such messages automatically parsed and the enclosed calendar data added to, updated on, or deleted from the user's calendars. Typically, such messages are based on the iCalendar Message-Based Interoperability Protocol (iMIP) . However, sometimes the enclosed iCalendar data does not include an iCalendar Transport-Independent Interoperability Protocol (iTIP) method property (see ), or the enclosed data may be in some other machine-readable format (e.g., JSCalendar ). This document defines an extension to the Sieve language that enables scripts to process machine-readable calendar data that is encapsulated in an email message using MIME . Specifically, this extension provides the ability to alter items on a user's calendars that are referenced in the encapsulated calendar data.

Conventions Used in This Document Conventions for notations are as in , including use of the "Usage:" label for the definition of action and tagged arguments syntax. This document uses terminology and concepts from iCalendar and iTIP to describe the processing of calendar data, but this extension can be used with any machine-readable calendar data format that can express similar concepts. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Capability Identifier Sieve interpreters that implement this extension MUST have an identifier of "processcalendar" for use with the capability mechanism.

Process Calendar Action Usage: processcalendar [ :allowpublic ] [ :addresses <string-list> ] [ :updatesonly / :calendarid <string> ] [ :deletecancelled ] [ :organizers <ext-list-name: string> ] [ :outcome <variablename: string> ] [ :reason <variablename: string> ] The "processcalendar" action is used to parse encapsulated calendar data and perform the appropriate action based on the content. If the calendar data is malformed in any way, it MUST be ignored and no action is taken. Otherwise, calendar objects may be created, updated, or deleted from a given calendar. This action can be used with or without the "extlists" extension . When the "extlists" extension is enabled in a script using <require "extlists">, the script can use the :organizers argument () in the "processcalendar" action as described below. When the "extlists" extension is not enabled, the :organizers argument MUST NOT be used and MUST cause an error according to . This action can be used with or without the "variables" extension . When the "variables" extension is enabled in a script using <require "variables">, the script can use the :outcome () and :reason () arguments in the "processcalendar" action as described below. When the "variables" extension is not enabled, the :outcome and :reason arguments MUST NOT be used and MUST cause an error according to . If a mail message contains calendar data in multiple MIME parts, this action MUST verify that the calendar data in each part are semantically equivalent to one another. If the data is found to be semantically different, the action MUST NOT process the message. Otherwise, the action MUST only process one representation of the data. This action MUST NOT make any changes to the participant status of the recipient when processing the calendar data. The mechanism for a recipient to change their participant status to an event is out of scope for this document. This action SHOULD remove alarms from calendar data before applying it to a calendar. Failure to do so could result in unwelcome notifications being triggered for the recipient.

Allow Public Argument The optional :allowpublic argument is used to tell the implementation that it can process calendar data that does not contain any ATTENDEE properties, such as iTIP messages where the METHOD is PUBLISH or non-iTIP messages where the calendar data does not contain METHOD and/or ORGANIZER properties. If used in conjunction with the :organizers argument (), the implementation MUST NOT process non-iTIP messages. If :allowpublic is omitted, the implementation MUST NOT process calendar data unless is it is a well-formed iTIP message and one of the recipient user's email addresses matches the Calendar User Address (see ) of the intended target of the message, as determined by the iTIP method (see ) of the message:

• "REPLY": Value of the ORGANIZER property (see )
• "REQUEST", "CANCEL", "ADD": Value of one of the ATTENDEE properties (see )

The recipient user's email address matches the Calendar User Address of the target if the Calendar User Address is in the form of a mailto URI and the email address matches the "addr-spec" of the URI. An email address is considered to belong to the recipient if it is one of the following:

• an email address known by the implementation to be associated with the recipient,
• the final envelope recipient address if it's available to the implementation, or
• an address specified by the script writer via the :addresses argument ().

Addresses Argument The optional :addresses argument is used to specify email addresses that belong to the recipient in addition to the addresses known to the implementation.

Updates Only Argument The optional :updatesonly argument is used to limit the messages processed to those targeting existing calendar objects only. If the message contains a new calendar object (its unique identifier does not exist on any of the user's calendars), the implementation MUST NOT add the object to a calendar. If :updatesonly is omitted, new calendar objects may be added to one of the user's calendars. The :updatesonly and :calendarid () arguments are incompatible with each other. It is an error if both arguments are used in the same "processcalendar" action.

Calendar ID Argument The optional :calendarid argument specifies the identifier of the calendar onto which new calendar objects should be placed. If :calendarid is omitted, new calendar objects will be placed on the user's "default" calendar as determined by the implementation. The :updatesonly () and :calendarid arguments are incompatible with each other. It is an error if both arguments are used in the same "processcalendar" action.

Delete Cancelled Argument The optional :deletecancelled argument is used to tell the implementation that if it receives a cancellation message, it SHOULD remove the associated calendar object from the calendar. If :deletecancelled is omitted, the status of the associated calendar object will be set to cancelled and will remain on the calendar.

Organizers Argument The optional :organizers argument is used to specify an external list of email addresses from which the recipient is willing to accept public events, invites, updates, and cancellations. Implementations MUST NOT process calendar data unless is it is a well-formed iTIP message and one of the addresses in the external list matches the Calendar User Address of the ORGANIZER property. An email address in the external list matches the Calendar User Address of the ORGANIZER property if it is in the form of a mailto URI and the email address matches the "addr-spec" of the URI. If :organizers is omitted, no validation of the ORGANIZER property is performed.

Outcome Argument The optional :outcome argument specifies the name of a variable into which one of the following strings specifying the outcome of the action will be stored:

"no_action":

No action was performed (e.g., the message didn't contain calendar data, or the set of provided options prevented the message from being processed).

"added":

A new calendar object was added to a calendar.

"updated":

A calendar object was updated, cancelled, or removed from the calendar.

"error":

The message would have been processed but encountered an error in doing so.

Reason Argument The optional :reason argument specifies the name of a variable into which a string describing the reason for the outcome will be stored. If no reason for the outcome is available, implementations MUST set the variable to the empty string. For example, an outcome of "no_action" may have a reason of "only processing updates", or an outcome of "error" may have a reason of "missing unique identifier".

Interaction with Other Sieve Actions The "processcalendar" action does not cancel Sieve's implicit keep action. The "processcalendar" action can only be executed once per script. A script MUST fail with an appropriate error if it attempts to execute two or more "processcalendar" actions. The "processcalendar" action is incompatible with the Sieve "reject" and "ereject" actions .

Examples The following example specifies email addresses belonging to the user and the identifier of the calendar onto which to place new calendar objects: require [ "processcalendar" ]; processcalendar :addresses [ "me@example.com", "alsome@example.com" ] :calendarid "1ea6d86b-6c7f-48a2-bed3-2a4c40ec281a"; The following example tells the interpreter to process flight itineraries from a particular airline: require [ "processcalendar" ]; if allof (address ["from", "sender"] "airline@example.com", header :contains "subject" "itinerary") { processcalendar :allowpublic; } The following example adds headers to the message if calendar data isn't processed : require [ "processcalendar", "variables", "editheader" ]; set "processcal_outcome" "no_action"; set "processcal_reason" ""; processcalendar :outcome "processcal_outcome" :reason "processcal_reason"; if not string :is "${processcal_outcome}" ["added", "updated"] { addheader "X-ProcessCal-Outcome" "${processcal_outcome}"; addheader "X-ProcessCal-Reason" "${processcal_reason}"; }

Security Considerations This document describes a method for altering an electronic calendar without user interaction. As such, unless proper precautions are undertaken, it can be used as a vector for calendar abuse. It is critical that implementations correctly implement the behavior and restrictions described throughout this document. Security issues associated with processing unsolicited calendar data and methods for mitigating them are discussed in . Specifically:

• The "processcalendar" extension MUST NOT process any calendar data enclosed in a message flagged as spam and/or malicious. The "spamtest" and "virustest" extensions (or the header test if messages are scanned outside of the Sieve interpreter) can be used to make "processcalendar" conditional on "safe" content.
• The "processcalendar" extension SHOULD NOT process calendar data received from a potentially malicious sender. The address and envelope tests (optionally along with the "extlists" extension ) can be used to create a "deny list" and make "processcalendar" conditional on the sender not being a member of that list.
• Similarly, the "processcalendar" extension SHOULD only process calendar data received from a known sender. The address and envelope tests (optionally along with the "extlists" extension ) can be used to create an "allow list" and make "processcalendar" conditional on the sender being a member of that list.
• The "processcalendar" extension SHOULD NOT process calendar data received from an untrustworthy sender. Trustworthiness may depend on whether the message has a valid signature (see ) and/or on whether one or more of the following passes or fails on the message: Sender Policy Framework (SPF) , DomainKeys Identified Mail (DKIM) Signatures , and Domain-based Message Authentication, Reporting, and Conformance (DMARC) . The mechanism by which a Sieve interpreter accesses the results of such checks is outside the scope of this document, but if the results are available in the message's header fields, the header test can be used to make "processcalendar" conditional on the sender being trustworthy.

Additionally, if the calendar data has embedded (a.k.a. inline) attachments, implementations SHOULD:

• Decode the embedded attachment, if necessary.
• Scan the (decoded) attachment for malicious content.

If an attachment is found to be malicious, "processcalendar" MUST NOT process the calendar data.

Privacy Considerations It is believed that this extension doesn't introduce any privacy considerations beyond those in .

IANA Considerations

Registration of Sieve Extension This document defines the following new Sieve extension, which IANA has added to the "Sieve Extensions" registry. The registry is defined in .

Capability name:

processcalendar

Description:

Adds the "processcalendar" action command to add and update items on a user's calendars.

RFC number:

RFC 9671

Contact address:

Sieve discussion list <sieve@ietf.org>

Registration of Sieve Action This document defines the following new Sieve action, which IANA has added to the "Sieve Actions" registry . The registry is defined in .

Name:

processcalendar

Description:

Add and update items on a user's calendars

References:

RFC 9671

Capabilities:

"processcalendar", "variables", "extlists"

Action Interactions:

This action is incompatible with the "reject" and "ereject" actions.

Cancels Implicit Keep?

No

Can Use with IMAP Events?

No

References Normative References The Calendaring and Scheduling Consortium In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document describes a language for filtering email messages at time of final delivery. It is designed to be implementable on either a mail client or mail server. It is meant to be extensible, simple, and independent of access protocol, mail architecture, and operating system. It is suitable for running on a mail server where users may not be allowed to execute arbitrary programs, such as on black box Internet Message Access Protocol (IMAP) servers, as the base language has no variables, loops, or ability to shell out to external programs. [STANDARDS-TRACK] In advanced mail filtering rule sets, it is useful to keep state or configuration details across rules. This document updates the Sieve filtering language (RFC 5228) with an extension to support variables. The extension changes the interpretation of strings, adds an action to store data in variables, and supplies a new test so that the value of a string can be examined. [STANDARDS-TRACK] This document, "iCalendar Message-Based Interoperability Protocol (iMIP)", specifies a binding from the iCalendar Transport-independent Interoperability Protocol (iTIP) to Internet email-based transports. Calendaring entries defined by the iCalendar Object Model (iCalendar) are wrapped using constructs from RFC 5322 and MIME (RFC 2045, RFC 2046, RFC 2047, and RFC 2049), and then transported over SMTP. [STANDARDS-TRACK] The Sieve email filtering language can be used to implement email whitelisting, blacklisting, personal distribution lists, and other sorts of list matching. Currently, this requires that all members of such lists be hard-coded in the script itself. Whenever a member of a list is added or deleted, the script needs to be updated and possibly uploaded to a mail server. This document defines a Sieve extension for accessing externally stored lists -- lists whose members are stored externally to the script, such as using the Lightweight Directory Access Protocol (LDAP), the Application Configuration Access Protocol (ACAP), vCard Extensions to WebDAV (CardDAV), or relational databases. [STANDARDS-TRACK] RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. The Sieve Email Filtering Language (RFC 5228) is a popular email filtering language used upon final mail delivery. This document creates a registry for Sieve actions to help developers and Sieve extension writers track interactions between different extensions. Informative References This initial document specifies the various headers used to describe the structure of MIME messages. [STANDARDS-TRACK] The Sieve email filtering language "spamtest", "spamtestplus", and "virustest" extensions permit users to use simple, portable commands for spam and virus tests on email messages. Each extension provides a new test using matches against numeric "scores". It is the responsibility of the underlying Sieve implementation to do the actual checks that result in proper input to the tests. [STANDARDS-TRACK] This memo updates the definition of the Sieve mail filtering language "reject" extension, originally defined in RFC 3028. A "Joe-job" is a spam run forged to appear as though it came from an innocent party, who is then generally flooded by automated bounces, Message Disposition Notifications (MDNs), and personal messages with complaints. The original Sieve "reject" action defined in RFC 3028 required use of MDNs for rejecting messages, thus contributing to the flood of Joe-job spam to victims of Joe-jobs. This memo updates the definition of the "reject" action to allow messages to be refused during the SMTP transaction, and defines the "ereject" action to require messages to be refused during the SMTP transaction, if possible. The "ereject" action is intended to replace the "reject" action wherever possible. The "ereject" action is similar to "reject", but will always favor protocol-level message rejection. [STANDARDS-TRACK] This document defines the iCalendar data format for representing and exchanging calendaring and scheduling information such as events, to-dos, journal entries, and free/busy information, independent of any particular calendar service or protocol. [STANDARDS-TRACK] This document specifies a protocol that uses the iCalendar object specification to provide scheduling interoperability between different calendaring systems. This is done without reference to a specific transport protocol so as to allow multiple methods of communication between systems. Subsequent documents will define profiles of this protocol that use specific, interoperable methods of communication between systems. The iCalendar Transport-Independent Interoperability Protocol (iTIP) complements the iCalendar object specification by adding semantics for group scheduling methods commonly available in current calendaring systems. These scheduling methods permit two or more calendaring systems to perform transactions such as publishing, scheduling, rescheduling, responding to scheduling requests, negotiating changes, or canceling. [STANDARDS-TRACK] DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message. This can be an author's organization, an operational relay, or one of their agents. DKIM separates the question of the identity of the Signer of the message from the purported author of the message. Assertion of responsibility is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key. Message transit from author to recipient is through relays that typically make no substantive change to the message content and thus preserve the DKIM signature. This memo obsoletes RFC 4871 and RFC 5672. [STANDARDS-TRACK] Email on the Internet can be forged in a number of ways. In particular, existing protocols place no restriction on what a sending host can use as the "MAIL FROM" of a message or the domain given on the SMTP HELO/EHLO commands. This document describes version 1 of the Sender Policy Framework (SPF) protocol, whereby ADministrative Management Domains (ADMDs) can explicitly authorize the hosts that are allowed to use their domain names, and a receiving host can check such authorization. This document obsoletes RFC 4408. Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting, that a mail-receiving organization can use to improve mail handling. Originators of Internet Mail need to be able to associate reliable and authenticated domain identifiers with messages, communicate policies about messages that use those identifiers, and report about mail using those identifiers. These abilities have several benefits: Receivers can provide feedback to Domain Owners about the use of their domains; this feedback can provide valuable insight about the management of internal operations and the presence of external domain name abuse. DMARC does not produce or encourage elevated delivery privilege of authenticated email. DMARC is a mechanism for policy distribution that enables increasingly strict handling of messages that fail authentication checks, ranging from no action, through altered delivery, up to message rejection. This document defines Secure/Multipurpose Internet Mail Extensions (S/MIME) version 4.0. S/MIME provides a consistent way to send and receive secure MIME data. Digital signatures provide authentication, message integrity, and non-repudiation with proof of origin. Encryption provides data confidentiality. Compression can be used to reduce data size. This document obsoletes RFC 5751. This specification defines a data model and JSON representation of calendar data that can be used for storage and data exchange in a calendaring and scheduling environment. It aims to be an alternative and, over time, successor to the widely deployed iCalendar data format. It also aims to be unambiguous, extendable, and simple to process. In contrast to the jCal format, which is also based on JSON, JSCalendar is not a direct mapping from iCalendar but defines the data model independently and expands semantics where appropriate.

Acknowledgments The authors would like to thank the following individuals for contributing their ideas and support for writing this specification: and .

Authors' Addresses Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America murch@fastmailteam.com

Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America rjbs@fastmailteam.com

Fastmail US LLC

1429 Walnut Street, Suite 1201 Philadelphia PA 19102 United States of America alh@fastmailteam.com