Ownership and licensing statements in YANG

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 31 December 2026.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

[RFC8520] Manufacturer Usage Descriptions (MUD) can be used to describe devices and their requirements to the network infrastructure. The original version of the specification does not provide for a means to specify ownership and licensing of the MUD file itself. This can hinder those wishing to use, modify, or adapt MUD files for the purpose of offering them, when the manufacturer is not involved.¶

To avoid any confusion, we define an extension that allows for specifying of owners and licensing terms for MUD files.¶

Those generating MUD files SHOULD use this extension, and thus this extension updates RFC 8520.¶

There are two ways to specify a license: a URL pointing to the license itself or an SPDX tag [SPDX]. These alternatives are expressed as distinct cases of a YANG choice, so each license entry unambiguously carries either one or more SPDX tags or one or more license URLs. If an SPDX tag is supplied consumers MUST interpret that tag through its meaning as specified by [SPDX].¶

This grouping may be used for other YANG models that reside as static objects.¶

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

2. The owner-license extension and model

Because the model is primarily motivated by MUD, and based on the way that YANG trees are formed, the model appears as an augmentation for MUD. The tree diagram below uses the notation defined in [RFC8340].¶

module: ietf-owner-license

  augment /ietf-mud:mud:
    +--rw owner-license
       +--rw license* [owner-name]
          +--rw owner-name            string
          +--rw (license-type)
             +--:(spdx)
             |  +--rw spdx-tag*       string
             +--:(url)
                +--rw license-info*   inet:uri

Each license list entry is keyed by owner-name, so different owners can declare different licenses. The license-type choice is mandatory, so every entry carries either one or more SPDX tags or one or more license URLs (but not a mix of both kinds under a single owner; multi-licensing across kinds is expressed by adding additional entries with distinct owner names).¶

3. The YANG schema for ownership and licensing

The following grouping and augmentation are proposed. The module imports ietf-inet-types [RFC9911] for the inet:uri type used to carry license URLs, and ietf-mud [RFC8520] for the augmentation point.¶

<CODE BEGINS> file "ietf-owner-license@2026-06-28.yang"

module ietf-owner-license {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-owner-license";
  prefix ol;

  import ietf-inet-types {
    prefix inet;
    reference
      "RFC 9911: Common Yang Data Types, Section 4";
  }
  import ietf-mud {
    prefix ietf-mud;
    reference
      "RFC 8520: Manufacturer Usage Description Specification";
  }

  organization
    "IETF IOTOPS (IoT Operations) Working Group";
  contact
    "WG Web:   <http://datatracker.ietf.org/wg/iotops/>
     WG List:  <mailto:iotops@ietf.org>

     Editor:   Eliot Lear
               <mailto:lear@cisco.com>

     Editor:   Carsten Bormann
               <mailto:cabo@tzi.org>";
  description
    "This YANG module defines a grouping for expressing ownership
     and licensing information for YANG-described static objects,
     and augments the MUD model (RFC 8520) with that grouping.

     Copyright (c) 2026 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject to
     the license terms contained in, the Revised BSD License set
     forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX
     (https://www.rfc-editor.org/info/rfcXXXX);
     see the RFC itself for full legal notices.";

  revision 2026-06-28 {
    description
      "Initial revision.";
    reference
      "RFC XXXX: Ownership and Licensing Statements in YANG";
  }

  grouping owner-license {
    description
      "A grouping expressing ownership and license information.";
    container owner-license {
      description
        "Container relating to ownership and licensing.";
      list license {
        key "owner-name";
        description
          "List of licenses that may be applied.";
        leaf owner-name {
          type string {
            length "1..128";
          }
          description
            "Name of the owner.";
        }
        choice license-type {
          mandatory true;
          description
            "Either choose a standard license type or point
             to one of your own.";
          case spdx {
            leaf-list spdx-tag {
              type string;
              min-elements 1;
              description
                "SPDX License Identifier.";
              reference
                "https://spdx.org/licenses/: SPDX License List";
            }
          }
          case url {
            leaf-list license-info {
              type inet:uri;
              min-elements 1;
              description
                "A URL pointing to licensing information.";
            }
          }
        }
      }
    }
  }

  augment "/ietf-mud:mud" {
    description
      "Add extension for ownership and licensing.";
    uses owner-license;
  }
}

<CODE ENDS>

4. Extension for MUD

MUD files using this extension MUST include the string "ol" in the extensions array, as specified by [RFC8520]. Note that "ol" is the MUD extension token registered with IANA (see Section 7.1); it is distinct from the YANG container name owner-license and from the YANG module name ietf-owner-license.¶

5. Example

In this example, the Frobmaster company is using the 0BSD SPDX tag to indicate a relatively open license. The "ol" extension and the owner-license container are present. There is a single owner listed.¶

{
  "ietf-mud:mud": {
    "mud-version": 1,
    "extensions": [
      "ol"
    ],
    "ietf-owner-license:owner-license": {
      "license": [
        {
          "owner-name": "Copyright 2024 Frobinator, Inc",
          "spdx-tag": [
            "0BSD"
          ]
        }
      ]
    },
    "mud-url": "https://frobs.example.com/mud/Frob.json",
    "mud-signature": "https://frobs.example.com/mud/Frob.p7s",
    "last-update": "2021-05-24T11:26:04+00:00",
    "cache-validity": 48,
    "is-supported": true,
    "systeminfo": "This device helps produce frobs",
    "mfg-name": "FrobMaster",
    "documentation": "https://frobs.example.com/doc",
    "model-name": "Frobinator"
  }
}

6. Security Considerations

The YANG module specified in this document defines a schema for data that is designed to be accessed via network management protocols such as NETCONF [RFC6241] or RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure transport is TLS [RFC8446].¶

The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content.¶

In practice, instance data conforming to this module is most often carried inside a MUD file [RFC8520] rather than served from a NETCONF/RESTCONF server; the considerations of Section 16 of [RFC8520] for obtaining and validating MUD files therefore apply.¶

There are a number of data nodes defined in this YANG module that are writeable/creatable/deletable (i.e., config true, which is the default). All data nodes under the augmented container /ietf-mud:mud/ol:owner-license fall in this category. Unauthorized modification of these data nodes can falsify the asserted ownership or licensing terms of a MUD file. This is not expected to directly influence the behavior of protective network infrastructure, but it may be used by an aggregator as input for deciding the legal basis that enables providing aggregated information; depending on the juridical environment, false information in the MUD file may thus expose the aggregator to additional legal risk.¶

The data nodes defined in this YANG module are not considered sensitive or vulnerable from a disclosure (read) standpoint: ownership and licensing statements are intended to be publicly readable.¶

This YANG module does not define any RPC or action operations.¶

7. IANA Considerations

8. References

Appendix A. Changes from Earlier Versions

Draft -04:¶

• Address RFC 8407 review:¶

  • Rename the module to ietf-owner-license (namespace urn:ietf:params:xml:ns:yang:ietf-owner-license); the ol prefix is preserved. Update the example, the IANA registrations, and the file name accordingly.¶

  • Improve the module description.¶

  • Move the SPDX URL out of the leaf-list description into a reference substatement.¶

  • Update the copyright year in the module to 2026.¶

  • Expand "IOTOPS" as "IoT Operations" in the organization statement.¶

  • Rewrite the Security Considerations to follow the YANG Security Considerations template (NETCONF/RESTCONF transports, NACM, writable subtree analysis, readability statement, RPC/action statement).¶

  • Add a normative reference to RFC 9911 (imported by the module).¶

  • Add a normative reference to RFC 8340 (for the tree diagram).¶

  • Note in the prose that the MUD extension token "ol" is distinct from the YANG module name and container name.¶

  • Normalise heading style in the IANA Considerations section.¶

  • Resolve the outstanding Issue and Task markers.¶

Draft -03:¶

• Address YANG doctors review:¶

  • Reformat the YANG contact statement per RFC 8407bis.¶

  • Rename the container from ol to owner-license.¶

  • Rename the SPDX case from spdx-lt to spdx.¶

  • Drop the -grouping suffix from the grouping name.¶

  • Make the license-type choice mandatory so that every license entry carries either an SPDX tag or a URL.¶

  • Correct the example to use the singular leaf-list name spdx-tag and the renamed container.¶

Draft -02:¶

• Small updates to the example¶

Draft -01:¶

• Format IANA considerations¶

• Discuss security considerations¶

Draft -00:¶

• Resubmit unchanged¶

Individual Draft -01:¶

• Add some issues¶

• correct spacing¶

Individual Draft -00:¶

• Initial revision¶

Authors' Addresses