home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Halting the Hacker - A P…uide to Computer Security
/
Halting the Hacker - A Practical Guide to Computer Security.iso
/
rfc
/
rfc1844.txt
< prev
next >
Wrap
Text File
|
1997-04-01
|
15KB
|
452 lines
Network Working Group E. Huizer
Request for Comments: 1844 SURFnet bv
Obsoletes: 1820 August 1995
Category: Informational
Multimedia E-mail (MIME) User Agent checklist
Status of this Memo
This memo provides information for the Internet community. This memo
does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.
Abstract
This document presents a checklist to facilitate evaluation of MIME
capable User Agents. Access to a MIME test-responder, that generates
test-messages is described.
Introduction
This document presents a checklist that facilitates evaluation of
MIME capable E-mail User Agents. It is by no means a conformance or
interoperability (both strictly defined and measurable quantities)
checklist, but rather an interworking (practical perspective)
checklist that is aimed at the users and system managers.
Usage and submission
If you use this checklist against a specific product (regardless of
whether you're a vendor, implementor or user) you can submit the
result to mime-check@nic.surfnet.nl, make sure that the subject
reflects the name and version of the product. This is an automated
mailhandler, so PLEASE only submit filled-in checklists (in content-
type text/plain or text/html) to this address. This information will
be made available (at no cost) for other people to browse through at
URL: http://www.nic.surfnet.nl/surfnet/projects/surf-ace/mime/
Although SURFnet will attempt to verify the correctness of each
submission, all submitted information is made available as is, with
no guarantees (SURFnet does not take any responsibility for errors in
the data that is made available, or for any damages resulting from
usage of that data). Users who want to procure a UA are advised to
use the data as an orientation, and to perform their own procurement
tests (possibly using the checklist below as a guideline). Also it is
noted that vendors and implementors are encouraged to use the results
from the checklist to improve their products.
Huizer Informational [Page 1]
RFC 1844 MIME User Agent Checklist August 1995
Getting test messages
For several tests in the checklist a test message is required. Test
messages can be requested in the following way: Send mail to <mime-
test@relay.surfnet.nl> with a subject field containing ONE of the
following:
text/plain
text/enriched
image/gif
image/jpeg
audio/basic
video/mpeg
application/octet-stream
application/postscript
message/rfc822
message/partial
message/external
multipart/mixed
multipart/parallel
multipart/digest
multipart/alternative
multipart/appledouble
application/wordperfect5.1
application/msword
application/rtf
X-local <to test how your UA deals with undefined content-types>
nested <returns a message that contains nested multipart contents>
iso-8859-1 <returns a message with text/plain; charset=iso-8859-1>
A message containing the requested content-type will be returned to
the address contained in the from field.
References
The reader is encouraged to also check out the following references:
The MIME standards:
- Borenstein N. and N. Freed, "MIME (Multipurpose Internet
Mail Extensions) Part One: Mechanisms for specifying and
describing the format of Internet message bodies", RFC 1521,
Bellcore, Innosoft, September 1993.
- Moore K., "MIME (Multipurpose Internet Mail Extensions) Part
Two: Message header extensions for non-Ascii text", RFC 1522,
University of Tennessee, September 1993.
Huizer Informational [Page 2]
RFC 1844 MIME User Agent Checklist August 1995
The registration procedure for content types:
- Postel J., "Media type registration procedure", RFC 1590,
USC/Information Sciences Institute, March 1994.
Some related informational documents:
- Borenstein N., "The text/enriched MIME content-type",
RFC 1563, Bellcore, October 1994.
- Borenstein N., "A user agent configuration mechanism for
multimedia mail format information", RFC 1524, Bellcore,
September 1993.
Registered MIME content-types can be found at the following URL:
ftp://ftp.isi.edu/in-notes/iana/assignments/media-types/media-types
The SUNet MIME project: http://www.nada.kth.se/sunet-mime/ This
offers evaluation tests reports of MIME products, as well as tests
and test-criteria for MIME implementors.
From Stockholm University a list of user-interface requirments for a
mail/news reader is available under: gopher://mars.dsv.su.se/11/dsv-
reports/research-reports/messaging-research
Checklist for Mime UAs
(note that for items with multiple choice options, it is possible
that more than one option is applicable)
1. General information:
1.1 The name and version of the product
1.2 The name and addressing information of the manufacturer
1.3 What are the platforms that are supported (Operating system,
GUI and hardware requirements, if applicable: what APIs are
supported (like MAPI etc.))? [Note: Please use separate
checklist forms for different platforms!!]
1.4 What is the platform that was used for this checklist
(Operating system, GUI and hardware)? [Note: Only one
platform per checklist!!]
1.5 Is the software available in source format or in binary
format or both.
1.6 Pricing information. Is the software available:
- In the Public Domain, free of charge
- As shareware (what is the price?)
- PD for non-profit use, but not for commercial use
- Commercially
Huizer Informational [Page 3]
RFC 1844 MIME User Agent Checklist August 1995
2. System installation, configuration and management
2.1 How complex/easy is installation and configuration? Are
there any pitfalls that need attention? Can you configure
per set of users (i.e systemwide or LAN wide default
configuration) and/or per user?
2.2 Are there facilities for logging and/or accounting?
2.3 Does the UA generate correct RFC-822 headers for outgoing
messages:
From:, (and if necessary) Sender:
Date:
Message-id:
2.4 Is it possible for a non-priviledged user to change the
"from" and/or "sender" field?
2.5 Does the UA have any size restrictions (default or applied
by system manager) for:
- Message size
- Number of messages
- Number of folders
- Number of messages per folder
2.6 How secure is the users mailbox when using this UA? Can
other non-privileged usets access the mailbox?
2.7 What is the performance of the UA on this platform? (As this
is difficult to measure, give your subjective impression:
slow, reasonable or fast) E.g for:
- Displaying a text message
- Displaying a MIME message that contains an image
- Complex actions like sorting etc.
3. General UA properties
3.1 Does the UA have a graphical or a character based interface
or both?
3.2 Does the UA support native RFC-822/MIME or does it require a
gateway?
3.3 Which protocols are supported for message delivery:
a. SMTP (MX records or static routing to Mailhost)
b. ESMTP
c. POP (which version)
d. IMAP
e. Co-location with specific MTA (which MTA)
f. Other ...............
3.4 Which protocols are supported for message submission:
a. SMTP
b. ESMTP
c. Co-location with specific MTA (which MTA)
d. Other ...............
3.5 Does the UA support the following basic functionalities:
- List messages
- Read messages
Huizer Informational [Page 4]
RFC 1844 MIME User Agent Checklist August 1995
- Delete messages
- Compose new messages
- Reply to messages (Inclusion of original message-text in
reply, reply to originator or to any or all recipients
etc.)
- Forward message
o using MIME
o using RFC-934 encapsulation; i.e. message is
encapsulated in between:
------- Forwarded Message and
------- End of Forwarded Message
o Other .......
- Distribute message (the from field does not change)
3.6 Does the UA support the following header fields and can they
be supplied by the user:
Generated correctly Can be supplied by user
- To:
- Cc:
- Bcc:
- From:
- Reply-to:
- Subject:
- Comments:
3.7 Does the UA support filing mail into folders? Are there any
restrictions?
3.8 Does the UA support a filtering mechanism that allows the
user to configure automatic processing of incoming mail
(e.g. automatic filing into specific folders)? If so, how
simple is the configuration of these filters?
3.9 Does the UA support a sorting mechanism that allows the user
to sort mail on date and/or subject and/or from field etc?
If so describe the possibilities and restrictions.
3.10 Does the UA support address lists and/or directory services?
- Local (local address list, local aliases, local distribution
lists etc.)
- Whois++
- Ph (to CCSO server)
- LDAP or SOLO or other access protocols to a directory
service
- Other .....
3.11 What other non-multimedia facilities does the UA support?
3.12 What secure mail protocols does the UA support (in-line):
- PEM (Privacy Enhanced Mail)
- PGP (Pretty Good Privacy)
- Other.....
Huizer Informational [Page 5]
RFC 1844 MIME User Agent Checklist August 1995
4. MIME support
4.1 Does the UA support:
- viewing a MIME content (either in-line or through launching
an external viewer)?
- saving a MIME content in a file?
- saving one part of a multipart message in a file?
- printing a MIME content?
4.2 Does the UA support receipt of the following basic MIME
content types? Does it display them in-line and does it
support printing of such a content type? If an external
viewer is needed, is a viewer pre-configured? Is the viewer
included in the software distribution?
In-line Printing External Preconfig Included
- text/plain
- text/enriched
- image/gif
- image/jpeg
- audio/basic
- video/mpeg
- application/octet-stream
- application/postscript
- message/rfc822
- message/partial
Does the UA support ftp and/or mail access for:
- message/external
Describe how the UA supports the basic multipart types:
- multipart/mixed
- multipart/parallel
- multipart/digest
- multipart/alternative
How does the UA handle:
- X-<bilateraly defined>
- unknown/unconfigured content-types
4.3 Does the UA allow configuration for receipt of additional
content-types? If so describe the configuration procedure
and possibilities. (Is it complex/easy, give example
configuration, can you add external viewers etc.). E.g.
- application/wordperfect5.1
- application/msword
- multipart/appledouble (Macintosh systems only)
4.4 Does the UA support composition of the following basic MIME
content types? Describe how easy/complex composition of a
message with a MIME content-type is.
- text/plain
- text/enriched
- image/gif
- image/jpeg
- audio/basic
Huizer Informational [Page 6]
RFC 1844 MIME User Agent Checklist August 1995
- video/mpeg
- application/octet-stream
- application/postscript
- message/rfc822
- message/partial
- message/external
- multipart/mixed
- multipart/parallel
- multipart/digest
- multipart/alternative
Does the UA generate X-<bilaterally defined> content-types
(when and why)
4.5 Does the UA support compostion of additional content-types?
If so describe how to do this (configuration and/or
compostion), e.g.:
- application/wordperfect5.1
- application/msword
- multipart/appledouble (Macintosh systems only)
4.6 What content-encodings does the UA support:
- 7bit
- quoted printable
- base64
- binary
- 8bit
- X-<bilateraly defined> (when and why)
4.7 What encoding is used for the following content-types:
7bit QP B64 Binary 8-bit Other
- text/plain
- text/enriched
- image/gif
- image/jpeg
- audio/basic
- video/mpeg
- application/octet-stream
- application/postscript
- message/rfc822
- message/partial
- message/external
- multipart/mixed
- multipart/parallel
- multipart/digest
- multipart/alternative
4.8 Does the UA generate the correct Mime version header:
Mime-Version: 1.0
4.9 In multipart messages, give an example of the sort of
boundary string generated.
4.10 Does the UA support the use of non-ascii characters in the
headers (in subject, free form part of address etc.)?
Huizer Informational [Page 7]
RFC 1844 MIME User Agent Checklist August 1995
4.11 With the content type text/plain it is possible to have a
charset parameter, indicating that a specific character set is
used in the content type text plain. What character sets (like
iso-8859-1) does the UA support (standard or configurable)?
Security Considerations
Testing a MIME UA against this checklist involves the security risks
that are described in the MIME specification (RFC 1521). Most notably
the automatic execution of general-purpose PostScript interpreters
entails serious security risks. The reader is encouraged to read RFC
1521 for more detail on these security risks.
Author's Address
Erik Huizer
SURFnet bv
P.O. Box 19035
3501 DA Utrecht
The Netherlands
Phone: +31 30 305305
Fax: +31 30 305329
EMail: Erik.Huizer@SURFnet.nl
Huizer Informational [Page 8]