Ownership and licensing statements in YANG
Eliot Lear
Cisco Systems
Richtistrasse 7
Wallisellen
CH-8304
Switzerland
+41 44 878 9200
lear@cisco.com
Carsten Bormann
Universität Bremen TZI
Postfach 330440
Bremen
D-28359
Germany
cabo@tzi.org
27 April 2024
Internet-Draft
This memo provides for an extension to RFC 8520 that allows MUD file authors to specify ownership and licensing of MUD files themselves. This memo updates RFC 8520. However, it can also be used for purposes outside of MUD, and the grouping is structured as such.
Introduction
[RFC8520] Manufacturer Usage Descriptions (MUD) can be used to describe devices and their requirements to the network infrastructure. The original version of the specification does not provide for a means to specify ownership and licensing of the MUD file itself. This can hinder those wishing to use, modify, or adapt MUD files for the purpose of offering them, when the manufacturer is not involved.
- Issue: Should this be an owner or an originator?
To avoid any confusion, we define an extension that allows for specifying of owners and licensing terms for MUD files.
Those generating MUD files SHOULD use this extension, and thus this extension updates RFC 8520.
There are two ways to specify a license: a URL pointing to the license itself or an SPDX tag [SPDX]. If an SPDX tag is supplied consumers MUST interpret that tag through its meaning as specified by [SPDX].
- Issue: Should we simply say that a URI contains a colon and SPDX license identifier doesn't?
This grouping may be used for other YANG models that reside as static objects.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
The owner-license extension and model
Because the model is primarily motivated by MUD, and based on the way that YANG trees are formed, the model appears as an augmentation for MUD.

module: ietf-ol

  augment /ietf-mud:mud:
    +--rw ol
       +--rw licenses* [owner-name]
          +--rw owner-name            string
          +--rw (license-type)?
             +--:(spdx-lt)
             |  +--rw spdx-tags*      string
             +--:(url)
                +--rw license-info*   inet:uri

- Issue: Should different owners possibly have their own license types? (Logical and, derived works.)
- Issue: Should a single owner possibly have multiple license types? (Logical or, multi-licensing.)
The YANG schema for ownership and licensing
The following grouping and augmentation are proposed.

module ietf-ol {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-ol";
  prefix ol;

  import ietf-inet-types {
    prefix inet;
    reference
      "RFC 6991: Common Yang Data Types, Section 4";
  }
  import ietf-mud {
    prefix ietf-mud;
    reference
      "RFC 8520: Manufacturer Usage Description Specification";
  }

  organization
    "IETF OPSAWG (Ops Area) Working Group";
  contact
    "WG
     Web: http://tools.ietf.org/wg/opsawg/
     WG List: opsawg@ietf.org
     Author: Eliot Lear lear@cisco.com
     Author: Carsten Bormann <cabo@tzi.org>";
  description
    "This YANG module to indicate ownership and licensing.

     Copyright (c) 2024 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject to
     the license terms contained in, the Simplified BSD License set
     forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX
     (https://www.rfc-editor.org/info/rfcXXXX);
     see the RFC itself for full legal notices.";

  revision 2024-04-26 {
    description
      "Initial proposed standard.";
    reference
      "RFC XXXX: Extension for ownership and licensing";
  }

  grouping owner-license-grouping {
    description
      "A grouping expression ownership and license information";
    container ol {
      description
        "container relating to ownership and licensing.";
      list licenses {
        key "owner-name";
        description
          "list of licenses that may be applied.";
        leaf owner-name {
          type string {
            length "1..128";
          }
          description
            "name of the owner";
        }
        choice license-type {
          description
            "Either choose a standard license type or point
             to one of your own.";
          case spdx-lt {
            leaf-list spdx-tags {
              type string;
              description
                "SPDX License Identifier, as indicated at
                 https://spdx.org/licenses/";
            }
          }
          case url {
            leaf-list license-info {
              type inet:uri;
              description
                "A URL pointing to licensing information.";
            }
          }
        }
      }
    }
  }

  augment "/ietf-mud:mud" {
    description
      "Add extension for Ownership and licensing.";
    uses owner-license-grouping;
  }
}

Extension for MUD
MUD files using this extension MUST include "ol" in the extensions array, as specified by [RFC8520].
Example
In this example, the Frobmaster company is using the 0BSD SPDX tag to indicate a relatively open license. The "ol" extension and container are present. There is a single owner listed.

{
  "ietf-mud:mud": {
    "mud-version": 1,
    "extensions": [
      "ol"
    ],
    "ietf-ol:ol": {
      "licenses": [
        {
            "owner-name" : "Copyright 2024 Frobinator, Inc",
            "spdx-tags": [ "0BSD" ]
        }
      ]
    },
    "mud-url": "https://frobs.example.com/mud/Frob.json",
    "mud-signature": "https://frobs.example.com/mud/Frob.p7s",
    "last-update": "2021-05-24T11:26:04+00:00",
    "cache-validity": 48,
    "is-supported": true,
    "systeminfo": "This device helps produce frobs",
    "mfg-name": "FrobMaster",
    "documentation": "https://frobs.example.com/doc",
    "model-name": "Frobinator"
  }
}

- Task: need Makefile for validating this against MUD. (Probably put this into a separate file, too.)
- Issue: Should we give an example for usage outside yang?
Security Considerations
The security considerations of Section 16 of [RFC8520] with respect to obtaining validation for information claimed in a MUD file do apply. While the information described in this specification is not intended to directly influence the behavior of protective infrastructure, it may be used by an aggregator as input for deciding the legal basis that enables providing aggregated information; depending on the juridical environment, false information in the MUD file may thus expose the aggregator to additional legal risk.
IANA Considerations
MUD Extension
The IANA is requested to add "ol" to the MUD extensions registry of [IANA.mud] as follows:
Extension Name:
ol
Standard reference:
This document
XML Name Space Entry
This document requests IANA to register the following URI in the "ns" subregistry within the "IETF XML Registry" in accordance with [RFC3688]:
URI:
urn:ietf:params:xml:ns:yang:ietf-ol
Registrant Contact:
The IESG.
XML: N/A; the requested URI is an XML namespace.
YANG Module Names
This document requests IANA to register the following YANG module in the "YANG Module Names" subregistry in accordance with [RFC6020] within the "YANG Parameters" registry.
name:
ietf-ol namespace:
urn:ietf:params:xml:ns:yang:ietf-ol maintained by IANA:
N prefix:
ol reference:
RFC XXXX

Normative References
[RFC8520]

Manufacturer Usage Description Specification
E. Lear
R. Droms
D. Romascanu
March 2019
RFC 8520
DOI 10.17487/RFC8520
[IANA.mud]

Manufacturer Usage Description (MUD)
IANA
[SPDX]

The Software Package Data Exchange® (SPDX®) Specification Version 2.3
The Linux Foundation
2022
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
[RFC3688]

The IETF XML Registry
M. Mealling
January 2004
BCP 81
RFC 3688
DOI 10.17487/RFC3688
[RFC6020]

YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)
M. Bjorklund, Ed.
October 2010
RFC 6020
DOI 10.17487/RFC6020
Changes from Earlier Versions
Draft -02:
- Small updates to the example
Draft -01:
- Format IANA considerations
- Discuss security considerations
Draft -00:
- Resubmit unchanged
Individual Draft -01:
- Add some issues
- correct spacing
Individual Draft -00:
- Initial revision