Sieve Notification Mechanism: SIP MESSAGE
draft-ietf-sieve-notify-sip-message-08

The following message was sent after the Last Call:

Message-ID: <4F43FF5C.6060003@qualcomm.com>
Date: Tue, 21 Feb 2012 14:32:28 -0600
From: Pete Resnick
To: IETF-Discussion list
Subject: Conclusion of Last Call for draft-ietf-sieve-convert and
draft-ietf-sieve-notify-sip-message

I wanted to inform the community of the results of the second Last Call
issued for draft-ietf-sieve-convert and
draft-ietf-sieve-notify-sip-message. To remind you of the circumstances:
After these two documents were approved by the IESG and sent on to the
RFC Editor, an IPR disclosure was made pertaining to each of them
indicating that one of the document editors for both documents was also
the listed inventor for the disclosed patent. The disclosures were made
by the document editor's employer and indicate that the date of the
patent filings was prior to the adoption of these two drafts by the
SIEVE working group. The RFC Editor was asked to suspend their work on
the documents, and a second Last Call was made.

After reviewing discussions in the SIEVE WG and on the IETF mailing
list, the chairs have decided (and I support) that, because of the
failure to disclose the IPR as required by BCP 79 (RFC 3979), and as per
RFC 2418 Section 6.1, the following actions are appropriate and will be
taken:

- The document editor in question is no longer a document editor for
these two documents.
- The person's name will be removed from the front page of the documents
and from the Authors' Address section.
- The person's name will be added to the Acknowledgments section of both
documents to identify that he did contribute text to the drafts.
- The RFC Editor will be asked to continue processing and publication of
these drafts as RFCs.

We will be notifying the RFC Editor of this decision presently.

Meanwhile, the employer of the document editor in question has made
followup disclosures on each of the documents, saying that they
"covenant not to assert any such claim against any party for making,
using, selling, offering for sale or importing a product that implements
the corresponding part of the specification." The full text of the
disclosures can be seen here:

https://datatracker.ietf.org/ipr/1680/
https://datatracker.ietf.org/ipr/1681/

pr
--
Pete Resnick

IANA has already completed the following actions for this document, and
understands that no changes are required:

IANA has registered the following Sieve Notification Mechanism:

sip-message
SIP/SIPS as specified in [RFC3261].
none
[Sieve_discussion_list]
[RFC-ietf-sieve-notify-sip-message-08]

Please see
http://www.iana.org/assignments/sieve-notification

State changed to In Last Call from Last Call Requested.

The following Last Call Announcement was sent out:

From: The IESG
To: IETF-Announce
CC:
Reply-To: ietf@ietf.org
Subject: Second Last Call:  (Sieve Notification Mechanism: SIP MESSAGE) to Proposed Standard


The IESG has received a request from the Sieve Mail Filtering Language WG
(sieve) to consider the following document:
- 'Sieve Notification Mechanism: SIP MESSAGE'
  as a Proposed Standard

Last calls were earlier issued on version -05 of this document and this
document was approved by the IESG on 2011-10-06. Subsequently,
an IPR disclosure statement for this draft was submitted.
This Second Last Call is intended to determine whether the community
is still comfortable with publication of this document in light of the IPR statement.
The relevant IPR statement is available at:

https://datatracker.ietf.org/ipr/1658/

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2012-02-08. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This document describes a profile of the Sieve extension for
  notifications, to allow notifications to be sent over SIP MESSAGE.




The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-sieve-notify-sip-message/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-sieve-notify-sip-message/


The following IPR Declarations may be related to this I-D:

  http://datatracker.ietf.org/ipr/1658/

Upon approval of this document, IANA will register the following at
:

Mechanism name: sip-message
Mechanism URI: SIP/SIPS as specified in RFC 3261 [RFC3261]
Mechanism-specific options: none
Standards Track/IESG-approved experimental RFC number: [RFC XXXX]
Person and email address to contact for further information:
See authors of [RFC XXXX]

[Ballot comment]
I have a similar comment as Stephen (in his first comment). The use case is not clear, and some text or reference about why and where notifications are sent over SIP would be useful.

[Ballot comment]
I have a bunch of Comments on this document. I don't think any is serious enough to merit a Discuss, but I do hope the authors will have a look at addressing them before the document is advanced for publication.

---

Section 2.1

Passive voice is to be avoided...

  The
  URI parameter "method" MUST be included and MUST contain the value
  "MESSAGE".

Must be included where and by whom?

---

Section 2.1

Is the "note" present twice?

---

Section 2.2

You have a couple of instances of :from without quote marks.

---

Section 2.5

  The default message body
  SHOULD contain the values of the "From" and "Subject" header fields
  of the triggering email message

One is bound to ask: under what circumstances can the From and Subject
header fields be left out, and what would the result be?

---

Section 2.6

  Implementations SHOULD NOT use the hname "body" parameter
  value as the message-body of the SIP MESSAGE request.

Since this is "SHOULD NOT" they presumably can do so if they have good
reasons. Can you state that reason or change this to "MUST NOT"?

---

Section 2.6

  If the notification request fails, there will be a SIP error code
  describing the failure.

Elegant prose, but unsure exactly what it means. It could mean that
there is no failure other than one for which a SIP error code has been
defined. Or it could mean that an error code will be found in a majick
place.

---

Section 2.7

  Because, absent use of SIP extensions such as [RFC3856], it is
  impossible to tell in advance whether the notification recipient is
  online and able to receive a SIP MESSAGE, the
  notify_method_capability test for "online" will always return "maybe"
  for this notification method.

But surely, if RFC 3856 extensions are in use, the test for "online"
could return more details.

Maybe you intend to say that the test needs to have uniform behavior
regardless of whether 3856 extensions are in use, and so...

[Ballot comment]
- I don't get the use-case for this - why would I want a SIP MESSAGE
for each of the emails I get? I think a motivating use-case (or
reference thereto) would be useful.

- (Related to discuss point 1) How can a program "take care" to
"ensure that confidential information is not sent" when any inbound
mail might be forwarded?  If you mean that deployments SHOULD use
sips URIs then just saying that seems better.

- If someone set this up and that could be detected from the
Internet, and if each SIP MESSAGE cost someone some money, then
a botnet could easily ramp up a whole lot of charges. Is that
something that warrants a mention? (I'm not sure.)

[Ballot discuss]
Just a few points that should be fairly easily handled.

(1) You say that UAs MUST implement e2e SIP security. My
understanding is that that is mythical since no-one does it. Am
I wrong? If not, then I think you could say something about
what might go wrong without e2e security mechanisms and
that ought be enough.

(2) If SIP e2e security were implemented, and if the mail message
is S/MIME encrypted, then are there any possible ways to confuse
the two uses of CMS that might lead to problems? I guess there
shouldn't be, but given that this would represent one rarely used
feature (S/MIME) and one possibly mythical one (SIP e2e CMS),
I guess it might not have been thought through in the WG.

(3) If the rx'd mail is s/mime or pgp encrypted, what gets
forwarded, the plaintext or ciphertext? (I hope the latter, just
checking since I'm not that familiar with how sieve and mail UAs
work together.) If the forwarded SIP MESSAGE could contain the
plaintext then I think you need to say to not do that.

(4) How does loop prevention work via rate limiting? Isn't it
still a loop even if only 1 message per N seconds is sent?

[Ballot comment]
- I don't get the use-case for this - why would I want a SIP MESSAGE
for each of the emails I get? I think a motivating use-case (or
reference thereto) would be useful.

- (Related to discuss point 1) How can a program "take care" to
"ensure that confidential information is not sent" when any inbound
mail might be forwarded?  If you mean that deployments SHOULD use
sips URIs then just saying that seems better.

- If someone set this up and that could be detected from the
Internet, and if each SIP MESSAGE cost someone some money, then
a botnet could easily ramp up a whole lot of charges. Is that
something that warrants a mention? (I'm not sure.)

[Ballot discuss]
Just a few points that should be fairly easily handled.

(1) You say that UAs MUST implement e2e SIP security. My
understanding is that that is mythical since no-one does it. Am
I wrong? If not, then I think you could say something about
what might go wrong without e2e security mechanisms and
that ought be enough.

(2) If SIP e2e security were implemented, and if the mail message
is S/MIME encrypted, then are there any possible ways to confuse
the two uses of CMS that might lead to problems? I guess there
shouldn't be, but given that this would represent one rarely used
feature (S/MIME) and one possibly mythical one (SIP e2e CMS),
I guess it might not have been thought through in the WG.

(3) If the rx'd mail is s/mime or pgp encrypted, what gets
forwarded, the plaintext or ciphertext? (I hope the latter, just
checking since I'm not that familiar with how sieve and mail UAs
work together.) If the forwarded SIP MESSAGE could contain the
plaintext then I think you need to say to not do that.

(4) How does loop prevention work via rate limiting? Isn't it
still a loop even if only 1 message per N seconds is sent?

State changed to In Last Call from Last Call Requested.

The following Last Call Announcement was sent out:

From: The IESG
To: IETF-Announce
CC:
Reply-To: ietf@ietf.org
Subject: Last Call:  (Sieve Notification Mechanism: SIP MESSAGE) to Proposed Standard


The IESG has received a request from the Sieve Mail Filtering Language WG
(sieve) to consider the following document:
- 'Sieve Notification Mechanism: SIP MESSAGE'
  as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2011-10-05. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This document describes a profile of the Sieve extension for
  notifications, to allow notifications to be sent over SIP MESSAGE.




The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-sieve-notify-sip-message/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-sieve-notify-sip-message/


No IPR declarations have been submitted directly on this I-D.

"Sieve Notification Mechanism: SIP MESSAGE"
Chairs Write-up for IESG.

draft-ietf-sieve-notify-sip-message-04 - Proposed Standard

  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?
         
          Shepherd: Cyrus Daboo  I have
          personally reviewed this document and believe it ready for
          submission to the IESG.

  (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?
         
          This extension started as an individual submission in 2007 and
          was adopted as a WG document in 2008. The basic premise
          has remained the same throughout all revisions of the
          document.
         
          This extension adds an additional notification method to the SIEVE Notify extension (RFC5435) that enables use of SIP as a notification mechanism. There were no major issues with the SIEVE aspects of this extension, given experience with developing other notification mechanisms (already published as RFCs). The one major area of concern was the use of the SIP URI itself. Following an initial WG last call where this issue was brought up, the authors solicited reviews from relevant RAI area experts (in particular Ben Campbell and Adam Roach). The authors' documented the issues in the -03 draft for further WG discussions which resolved the issues, resulting in the current -04 document.

  (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization or XML?
         
          No.

  (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed?  If so, please include a reference to the
          disclosure and summarize the WG discussion and conclusion on
          this issue.
         
          No concerns with this document.

  (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?
         
          This document has gone through several revisions within the
          WG, with external reviews requested and addressed where needed.
         
          This specification has had detailed review from a core group
          of WG participants over its last few revisions, but has been
          reviewed by others over its lifetime and discussed at several
          IETF meetings.


  (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarise the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)
         
          No.

  (1.g)  Has the Document Shepherd personally verified that the
          document satisfies all ID nits?  (See
          http://www.ietf.org/ID-Checklist.html and
          http://tools.ietf.org/tools/idnits/).  Boilerplate checks are
          not enough; this check needs to be thorough.  Has the document
          met all formal review criteria it needs to, such as the MIB
          Doctor, media type and URI type reviews?
         
          ID nits were checked - no problems.

  (1.h)  Has the document split its references into normative and
          informative?  Are there normative references to documents that
          are not ready for advancement or are otherwise in an unclear
          state?  If such normative references exist, what is the
          strategy for their completion?  Are there normative references
          that are downward references, as described in [RFC3967]?  If
          so, list these downward references to support the Area
          Director in the Last Call procedure for them [RFC3967].
         
          A normative references section exists. There are no informative references. All references are to existing RFCs.

  (1.i)  Has the Document Shepherd verified that the document IANA
          consideration section exists and is consistent with the body
          of the document?  If the document specifies protocol
          extensions, are reservations requested in appropriate IANA
          registries?  Are the IANA registries clearly identified?  If
          the document creates a new registry, does it define the
          proposed initial contents of the registry and an allocation
          procedure for future registrations?  Does it suggest a
          reasonable name for the new registry?  See [RFC2434].  If the
          document describes an Expert Review process has Shepherd
          conferred with the Responsible Area Director so that the IESG
          can appoint the needed Expert during the IESG Evaluation?
         
          Yes.

  (1.j)  Has the Document Shepherd verified that sections of the
          document that are written in a formal language, such as XML
          code, BNF rules, MIB definitions, etc., validate correctly in
          an automated checker?
         
          Yes.

  (1.k)  The IESG approval announcement includes a Document
          Announcement Write-Up.  Please provide such a Document
          Announcement Write-Up?  Recent examples can be found in the
          "Action" announcements for approved documents.  The approval
          announcement contains the following sections:

          Technical Summary
            Relevant content can frequently be found in the abstract
            and/or introduction of the document.  If not, this may be
            an indication that there are deficiencies in the abstract
            or introduction.

          Working Group Summary
            Was there anything in WG process that is worth noting?  For
            example, was there controversy about particular points or
            were there decisions where the consensus was particularly
            rough?

          Document Quality
            Are there existing implementations of the protocol?  Have a
            significant number of vendors indicated their plan to
            implement the specification?  Are there any reviewers that
            merit special mention as having done a thorough review,
            e.g., one that resulted in important changes or a
            conclusion that the document had no substantive issues?  If
            there was a MIB Doctor, Media Type or other expert review,
            what was its course (briefly)?  In the case of a Media Type
            review, on what date was the request posted?

          Personnel
            Who is the Document Shepherd for this document?  Who is the
            Responsible Area Director? Is an IANA expert needed?

Technical Summary

    The Sieve scripting language is used to filter email messages. One action that can be executed on matching messages is sending of a notification, which can be sent using different mechanisms. This document describes a profile of the Sieve extension for notifications, to allow notifications to be sent over SIP MESSAGE.

Working Group Summary

    This extension started as an individual submission in 2007 and was
    adopted as a WG document in 2008. The basic premise has remained the
    same throughout all revisions of the document.

    This extension adds an additional notification method to the SIEVE
    Notify extension (RFC5435) that enables use of SIP as a notification
    mechanism. There were no major issues with the SIEVE aspects of this
    extension, given experience with developing other notification
    mechanisms (already published as RFCs). The one major area of concern
    was the use of the SIP URI itself. Following an initial WG last call
    where this issue was brought up, the authors solicited reviews from
    relevant RAI area experts. The authors' documented the issues in the -03
    draft for further WG discussions which resolved the issues, resulting in
    the current -04 document, which underwent another WG last call.

Document Quality

    There are no known implementations of this extension at present. Various vendors have expressed interest in implementing this extension, however it is not currently a top priority for any of them.

Personnel

Document Shepherd: Cyrus Daboo
AD: Pete Resnick