mirror of https://github.com/moparisthebest/xeps
236 lines
12 KiB
XML
236 lines
12 KiB
XML
<?xml version='1.0' encoding='UTF-8'?>
|
|
<!DOCTYPE xep SYSTEM 'xep.dtd' [
|
|
<!ENTITY % ents SYSTEM 'xep.ent'>
|
|
%ents;
|
|
]>
|
|
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
|
|
<xep>
|
|
<header>
|
|
<title>SPIM Reporting</title>
|
|
<abstract>This document specifies an XMPP protocol extension for reporting unsolicited bulk instant messages (SPIM).</abstract>
|
|
&LEGALNOTICE;
|
|
<number>0161</number>
|
|
<status>Experimental</status>
|
|
<type>Standards Track</type>
|
|
<sig>Standards</sig>
|
|
<approver>Council</approver>
|
|
<dependencies>
|
|
<spec>XMPP Core</spec>
|
|
<spec>XMPP IM</spec>
|
|
<spec>XEP-0030</spec>
|
|
</dependencies>
|
|
<supersedes/>
|
|
<supersededby/>
|
|
<shortname>NOT YET ASSIGNED</shortname>
|
|
&stpeter;
|
|
<revision>
|
|
<version>0.3</version>
|
|
<date>2007-01-31</date>
|
|
<initials>psa</initials>
|
|
<remark><p>Specified that client recipient should not send a report to the server of a suspected spimmer; modified XML namespace name to conform to XEP-0053 processes; corrected several examples.</p></remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.2</version>
|
|
<date>2006-09-21</date>
|
|
<initials>psa</initials>
|
|
<remark><p>Modified business rules; added security considerations; defined XML schema.</p></remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.1</version>
|
|
<date>2005-10-19</date>
|
|
<initials>psa</initials>
|
|
<remark><p>Initial version.</p></remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.0.1</version>
|
|
<date>2005-09-28</date>
|
|
<initials>psa</initials>
|
|
<remark><p>First draft.</p></remark>
|
|
</revision>
|
|
</header>
|
|
<section1 topic='Introduction' anchor='intro'>
|
|
<p>Unsolicited bulk email, commonly called "spam", is a widespread problem on today's email network. We want to make sure that unsolicited bulk instant messaging, commonly called "SPIM" (short for "spam over IM"), does not become a widespread problem on the XMPP instant messaging network. To that end, this document specifies an XMPP protocol extension for reporting particular instances of SPIM.</p>
|
|
</section1>
|
|
<section1 topic='Protocol' anchor='proto'>
|
|
<section2 topic='Reporting a SPIM Stanza' anchor='proto-stanza'>
|
|
<p>The protocol for SPIM reporting is quite simple: wrap the complete SPIM stanza in a <spim/> element qualified by the 'http://www.xmpp.org/extensions/xep-0161.html#ns' namespace and send an IQ stanza of type "set" to the entity that shall receive the report. This protocol is intended to be used by recipients of SPIM stanzas and by other entities (e.g., servers or services) that wish to pass around SPIM reports. The following is an example:</p>
|
|
<example caption='Unsuspecting User Receives SPIM from Evil Bot'><![CDATA[
|
|
<presence from='makemoney@spimmersheaven.info'
|
|
to='unsuspectinguser@example.net'
|
|
type='subscribe'>
|
|
<status>
|
|
You too can be rich! Find out how at
|
|
http://spimmersheaven.info/makemoney
|
|
Let's chat to make your dreams
|
|
come true!
|
|
</status>
|
|
</presence>
|
|
]]></example>
|
|
<example caption='Unsuspecting User Reports SPIM'><![CDATA[
|
|
<iq from='unsuspectinguser@example.net/foo'
|
|
to='example.net'
|
|
type='set'
|
|
id='report1'>
|
|
<spim xmlns='http://www.xmpp.org/extensions/xep-0161.html#ns'>
|
|
<presence from='makemoney@spimmersheaven.info'
|
|
to='unsuspectinguser@example.net'
|
|
type='subscribe'
|
|
xmlns='jabber:client'>
|
|
<status>
|
|
You too can be rich! Find out how at
|
|
http://spimmersheaven.info/makemoney
|
|
Let's chat to make your dreams
|
|
come true!
|
|
</status>
|
|
</presence>
|
|
</spim>
|
|
</iq>
|
|
]]></example>
|
|
<p>If the entity that receives the report does not support the SPIM Reporting protocol, it MUST return a &unavailable; error to the reporting entity:</p>
|
|
<example caption='Service Unavailable'><![CDATA[
|
|
<iq from='example.net'
|
|
to='unsuspectinguser@example.net/foo'
|
|
type='error'
|
|
id='report1'>
|
|
<spim xmlns='http://www.xmpp.org/extensions/xep-0161.html#ns'>
|
|
<presence from='makemoney@spimmersheaven.info'
|
|
to='unsuspectinguser@example.net'
|
|
type='subscribe'
|
|
xmlns='jabber:client'>
|
|
<status>
|
|
You too can be rich! Find out how at
|
|
http://spimmersheaven.info/makemoney
|
|
Let's chat to make your dreams
|
|
come true!
|
|
</status>
|
|
</presence>
|
|
</spim>
|
|
<error type='cancel'>
|
|
<service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
|
|
</error>
|
|
</iq>
|
|
]]></example>
|
|
<p>If the entity that receives the report is able to process the report, it MUST return an IQ-result to the reporting entity:</p>
|
|
<example caption='Report Processed'><![CDATA[
|
|
<iq from='example.net'
|
|
to='unsuspectinguser@example.net'
|
|
type='result'
|
|
id='report1'/>
|
|
]]></example>
|
|
</section2>
|
|
<section2 topic='Reporting a Spimmer' anchor='proto-spimmer'>
|
|
<p>If an entity that processes SPIM reports determines that the suspected spimmer is indeed an actual spimmer, it SHOULD report its conclusions to appropriate other entities (e.g., the spimmer's server or dedicated SPIM reporting services). Here again, the protocol is quite simple: wrap the spimmer's JID in a <spimmer/> element qualified by the 'http://www.xmpp.org/extensions/xep-0161.html#ns' namespace and send an IQ stanza of type "set" to the entity that shall receive the report. This protocol SHOULD NOT be used by recipients of SPIM stanzas. The following is an example:</p>
|
|
<example caption='Server Reports Spimmer'><![CDATA[
|
|
<iq from='example.net'
|
|
to='spim.xmpp.net'
|
|
type='set'
|
|
id='spimmer1'>
|
|
<spimmer xmlns='http://www.xmpp.org/extensions/xep-0161.html#ns'>makemoney@spimmersheaven.info</spimmer>
|
|
</iq>
|
|
]]></example>
|
|
</section2>
|
|
</section1>
|
|
<section1 topic='Reporting SPIM' anchor='reporting'>
|
|
<p>The following rules and guidelines apply to the act of reporting SPIM.</p>
|
|
<ol start='1'>
|
|
<li><p>The recipient SHOULD NOT report the SPIM stanza to a server or service until it determines that the server or service supports the SPIM Reporting protocol (see the <link url='#disco'>Discovering Support</link> section of this document).</p></li>
|
|
<li><p>If the recipient's home server (i.e., the server with which it has a registered account or other trust relationship) supports the SPIM Reporting protocol, the recipient SHOULD report the offending stanza only to its own server.</p></li>
|
|
<li><p>If the recipient's home server does not support the SPIM Reporting protocol, the recipient SHOULD report the SPIM stanza to one or more dedicated SPIM reporting services if available.</p></li>
|
|
<li><p>The recipient SHOULD NOT report the SPIM stanza to the suspected spimmer's server.</p></li>
|
|
<li><p>The recipient SHOULD NOT report the SPIM stanza to the suspected spimmer.</p></li>
|
|
</ol>
|
|
</section1>
|
|
<section1 topic='Processing SPIM Reports' anchor='processing'>
|
|
<section2 topic='Initial Processing' anchor='processing-initial'>
|
|
<p>The following rules and guidelines apply to initial processing of a SPIM report:</p>
|
|
<ol>
|
|
<li>Before processing the report, the processor MAY respond to the report by sending a challenge to the sender (e.g., using &xep0158;) in order to make sure that the sender is not sending spurious reports or otherwise abusing the SPIM reporting system.</li>
|
|
<li>The processor MUST add the report to a list or database of pending SPIM reports.</li>
|
|
<li>If the suspected spimmer is not already on the processor's list of known spimmers, the processor SHOULD use the report in determining whether the suspected spimmer is an actual spimmer (see next section).</li>
|
|
<li>The processor MAY report the SPIM stanza to one or more dedicated SPIM reporting services if available.</li>
|
|
<li>The processor MAY report the SPIM stanza to other servers it trusts.</li>
|
|
<li>The processor MAY report the SPIM stanza to the suspected spimmer's server (if the server is otherwise trusted, i.e., is not considered a rogue server).</li>
|
|
<li>The processor SHOULD NOT report the SPIM stanza to the suspected spimmer.</li>
|
|
</ol>
|
|
</section2>
|
|
<section2 topic='Determining Spimmer Status' anchor='processing-spimmer'>
|
|
<p>Not all SPIM reports are valid, and not all JIDs that send stanzas reported as SPIM are spimmers. Care must be taken in correctly determining if a suspected spimmer is an actual spimmer. The following rules apply:</p>
|
|
<ol>
|
|
<li><p>The processor SHOULD NOT add a suspected spimmer to its list of known spimmers until it has received at least three (3) valid SPIM reports with regard to that suspected spimmer.</p></li>
|
|
<li><p>If the processor determines that the suspected spimmer is an actual spimmer, the processor:</p>
|
|
<ol>
|
|
<li>MUST add that JID to its list of known spimmers.</li>
|
|
<li>SHOULD send a spimmer report to the spimmer's server.</li>
|
|
<li>MAY send a spimmer report to SPIM reporting services or reputation services.</li>
|
|
<li>MAY send a spimmer report to other servers it trusts.</li>
|
|
<li>SHOULD NOT send a spimmer report to the spimmer.</li>
|
|
</ol>
|
|
</li>
|
|
</ol>
|
|
</section2>
|
|
</section1>
|
|
<section1 topic='Discovering Support' anchor='disco'>
|
|
<p>In order to discover whether another entity supports SPIM reporting, &xep0030; SHOULD be used. If an entity supports SPIM reporting, it MUST return a feature of "http://www.xmpp.org/extensions/xep-0161.html#ns" in responses to service discovery information requests, as shown in the following examples:</p>
|
|
<example caption='User Queries Server Regarding Protocol Support'><![CDATA[
|
|
<iq from='unsuspectinguser@example.net/foo'
|
|
to='example.net'
|
|
type='get'
|
|
id='disco1'>
|
|
<query xmlns='http://jabber.org/protocol/disco#info'/>
|
|
</iq>
|
|
]]></example>
|
|
<example caption='Server Replies Regarding Protocol Support'><![CDATA[
|
|
<iq from='example.net'
|
|
to='unsuspectinguser@example.net/foo'
|
|
type='result'
|
|
id='disco1'>
|
|
<query xmlns='http://jabber.org/protocol/disco#info'>
|
|
...
|
|
<feature var='http://www.xmpp.org/extensions/xep-0161.html#ns'/>
|
|
...
|
|
</query>
|
|
</iq>
|
|
]]></example>
|
|
</section1>
|
|
<section1 topic='Security Considerations' anchor='security'>
|
|
<p>Not all reported SPIM is actual SPIM, and not all reported spimmers are actual spimmers. Processors must take care to ensure that processing of one or a few reports does not result in branding of a legitimate sender as a spimmer, since otherwise the sender could effectively be the subject of a denial of service attack.</p>
|
|
<p>It is NOT RECOMMENDED for client recipients to send SPIM reports to the server of a suspected spimmer, since that server could be a rogue domain capable of sending SPIM from any JID at that domain.</p>
|
|
</section1>
|
|
<section1 topic='IANA Considerations' anchor='iana'>
|
|
<p>This document requires no interaction with &IANA;.</p>
|
|
</section1>
|
|
<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
|
|
<section2 topic='Protocol Namespaces' anchor='ns'>
|
|
<p>Until this specification advances to a status of Draft, its associated namespace shall be "http://www.xmpp.org/extensions/xep-00161.html#ns"; upon advancement of this specification, the ®ISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;.</p>
|
|
</section2>
|
|
</section1>
|
|
<section1 topic='XML Schema' anchor='schema'>
|
|
<code><![CDATA[
|
|
<?xml version='1.0' encoding='UTF-8'?>
|
|
|
|
<xs:schema
|
|
xmlns:xs='http://www.w3.org/2001/XMLSchema'
|
|
targetNamespace='http://www.xmpp.org/extensions/xep-0161.html#ns'
|
|
xmlns='http://www.xmpp.org/extensions/xep-0161.html#ns'
|
|
elementFormDefault='qualified'>
|
|
|
|
<xs:import
|
|
namespace='jabber:client'
|
|
schemaLocation='http://www.xmpp.org/schemas/jabber-client.xsd'/>
|
|
|
|
<xs:element name='spim'>
|
|
<xs:complexType>
|
|
<xs:choice xmlns:xmpp='jabber:client'>
|
|
<xs:element ref='xmpp:iq'/>
|
|
<xs:element ref='xmpp:message'/>
|
|
<xs:element ref='xmpp:presence'/>
|
|
</xs:choice>
|
|
</xs:complexType>
|
|
|
|
<xs:element name='spimmer' type='xs:string'/>
|
|
|
|
</xs:schema>
|
|
]]></code>
|
|
</section1>
|
|
</xep>
|