]> Cisco Systems

Richtistrasse 7 Wallisellen 8304 Switzerland +41 44 878 9200 lear@cisco.com

Universität Bremen TZI

Postfach 330440 Bremen D-28359 Germany cabo@tzi.org

Internet-Draft This memo provides for an extension to RFC 8520 that allows MUD file authors to specify ownership and licensing of MUD files themselves. This memo updates RFC 8520. However, it can also be used for purposes outside of MUD, and the grouping is structured as such.

Introduction Manufacturer Usage Descriptions (MUD) can be used to describe devices and their requirements to the network infrastructure. The original version of the specification does not provide for a means to specify ownership and licensing of the MUD file itself. This can hinder those wishing to use, modify, or adapt MUD files for the purpose of offering them, when the manufacturer is not involved.

• Issue: Should this be an owner or an originator?

To avoid any confusion, we define an extension that allows for specifying of owners and licensing terms for MUD files. Those generating MUD files SHOULD use this extension, and thus this extension updates RFC 8520. There are two ways to specify a license: a URL pointing to the license itself or an SPDX tag . If an SPDX tag is supplied consumers MUST interpret that tag through its meaning as specified by .

• Issue: Should we simply say that a URI contains a colon and SPDX license identifier doesn't?

This grouping may be used for other YANG models that reside as static objects. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The owner-license extension and model Because the model is primarily motivated by MUD, and based on the way that YANG trees are formed, the model appears as an augmentation for MUD.

• Issue: Should different owners possibly have their own license types? (Logical and, derived works.)
• Issue: Should a single owner possibly have multiple license types? (Logical or, multi-licensing.)

The YANG schema for ownership and licensing The following grouping and augmentation are proposed. "; description "This YANG module to indicate ownership and licensing. Copyright (c) 2021 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Simplified BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). This version of this YANG module is part of RFC XXXX (https://www.rfc-editor.org/info/rfcXXXX); see the RFC itself for full legal notices. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. "; revision 2021-05-21 { description "Initial proposed standard."; reference "RFC XXXX: Extension for ownership and licensing"; } grouping ol-extension { description "OL extension grouping"; container ol { description "container relating to ownership and licensing."; leaf-list owners { type string; description "A list of owners, may be in the form of a copyright Example: Copyright (c) Jane Smith. All rights Reserved."; } choice license-type { description "Either choose a standard license type or point to one of your own."; case spdx-lt { leaf spdx-tag { type string; description "SPDX License Identifier, as indicated at https://spdx.org/licenses/"; } } case url { leaf license-info { type inet:uri; description "A URL pointing to licensing information."; } } } } } augment "/mud:mud" { description "Add extension for Ownership and licensing."; uses ol-extension; } } ]]>

Extension for MUD MUD files using this extension MUST include "ol" in the extensions array, as specified by .

Example In this example, the Frobmaster company is using the 0BSD SPDX tag to indicate a relatively open license. The "ol" extension and container are present. There is a single owner listed.

• Task: need Makefile for validating this against MUD. (Probably put this into a separate file, too.)
• Issue: Should we give an example for usage outside yang?

Security Considerations The security considerations of with respect to obtaining validation for information claimed in a MUD file do apply. While the information described in this specification is not intended to directly influence the behavior of protective infrastructure, it may be used by an aggregator as input for deciding the legal basis that enables providing aggregated information; depending on the juridical environment, false information in the MUD file may thus expose the aggregator to additional legal risk.

IANA Considerations

MUD Extension The IANA is requested to add "ol" to the of as follows:

Extension Name:

ol

Standard reference:

This document

Normative References This memo specifies a component-based architecture for Manufacturer Usage Descriptions (MUDs). The goal of MUD is to provide a means for end devices to signal to the network what sort of access and network functionality they require to properly function. The initial focus is on access control. Later work can delve into other aspects. This memo specifies two YANG modules, IPv4 and IPv6 DHCP options, a Link Layer Discovery Protocol (LLDP) TLV, a URL, an X.509 certificate extension, and a means to sign and verify the descriptions. Internet Assigned Numbers Authority The Linux Foundation In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.

Changes from Earlier Versions Draft -02:

• Small updates to the example

Draft -01:

• Format IANA considerations
• Discuss security considerations

Draft -00:

• Resubmit unchanged

Individual Draft -01:

• Add some issues
• correct spacing

Individual Draft -00:

• Initial revision