rfc9472.original | rfc9472.txt | |||
---|---|---|---|---|
Network Working Group E. Lear | Internet Engineering Task Force (IETF) E. Lear | |||
Internet-Draft Cisco Systems | Request for Comments: 9472 Cisco Systems | |||
Intended status: Standards Track S. Rose | Category: Standards Track S. Rose | |||
Expires: 30 October 2023 NIST | ISSN: 2070-1721 NIST | |||
28 April 2023 | October 2023 | |||
Discovering and Retrieving Software Transparency and Vulnerability | A YANG Data Model for Reporting Software Bills of Materials (SBOMs) and | |||
Information | Vulnerability Information | |||
draft-ietf-opsawg-sbom-access-18 | ||||
Abstract | Abstract | |||
To improve cybersecurity posture, automation is necessary to locate | To improve cybersecurity posture, automation is necessary to locate | |||
the software a device is using, and whether that software has known | the software a device is using, whether that software has known | |||
vulnerabilities, and what, if any recommendations suppliers may have. | vulnerabilities, and what, if any, recommendations suppliers may | |||
This memo extends the MUD YANG schema to provide the locations of | have. This memo extends the Manufacturer User Description (MUD) YANG | |||
software bills of materials (SBOMS) and to vulnerability information | schema to provide the locations of software bills of materials | |||
by introducing a transparency schema. | (SBOMs) and vulnerability information by introducing a transparency | |||
schema. | ||||
Status of This Memo | Status of This Memo | |||
This Internet-Draft is submitted in full conformance with the | This is an Internet Standards Track document. | |||
provisions of BCP 78 and BCP 79. | ||||
Internet-Drafts are working documents of the Internet Engineering | ||||
Task Force (IETF). Note that other groups may also distribute | ||||
working documents as Internet-Drafts. The list of current Internet- | ||||
Drafts is at https://datatracker.ietf.org/drafts/current/. | ||||
Internet-Drafts are draft documents valid for a maximum of six months | This document is a product of the Internet Engineering Task Force | |||
and may be updated, replaced, or obsoleted by other documents at any | (IETF). It represents the consensus of the IETF community. It has | |||
time. It is inappropriate to use Internet-Drafts as reference | received public review and has been approved for publication by the | |||
material or to cite them other than as "work in progress." | Internet Engineering Steering Group (IESG). Further information on | |||
Internet Standards is available in Section 2 of RFC 7841. | ||||
This Internet-Draft will expire on 30 October 2023. | Information about the current status of this document, any errata, | |||
and how to provide feedback on it may be obtained at | ||||
https://www.rfc-editor.org/info/rfc9472. | ||||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2023 IETF Trust and the persons identified as the | Copyright (c) 2023 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents (https://trustee.ietf.org/ | Provisions Relating to IETF Documents | |||
license-info) in effect on the date of publication of this document. | (https://trustee.ietf.org/license-info) in effect on the date of | |||
Please review these documents carefully, as they describe your rights | publication of this document. Please review these documents | |||
and restrictions with respect to this document. Code Components | carefully, as they describe your rights and restrictions with respect | |||
extracted from this document must include Revised BSD License text as | to this document. Code Components extracted from this document must | |||
described in Section 4.e of the Trust Legal Provisions and are | include Revised BSD License text as described in Section 4.e of the | |||
provided without warranty as described in the Revised BSD License. | Trust Legal Provisions and are provided without warranty as described | |||
in the Revised BSD License. | ||||
Table of Contents | Table of Contents | |||
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction | |||
1.1. How This Information Is Retrieved . . . . . . . . . . . . 5 | 1.1. Requirements Language | |||
1.2. Formats . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 1.2. How This Information is Retrieved | |||
2. The well-known transparency endpoint set . . . . . . . . . . 6 | 1.3. Formats | |||
3. The mud-transparency extension model extension . . . . . . . 6 | 2. The Well-Known Transparency Endpoint Set | |||
4. The mud-sbom augmentation to the MUD YANG model . . . . . . . 6 | 3. The mud-transparency Extension | |||
5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 11 | 4. The mud-sbom Augmentation to the MUD YANG Data Model | |||
5.1. Without ACLS . . . . . . . . . . . . . . . . . . . . . . 11 | 5. Examples | |||
5.2. SBOM Located on the Device . . . . . . . . . . . . . . . 12 | 5.1. Without ACLS | |||
5.3. Further contact required. . . . . . . . . . . . . . . . . 13 | 5.2. SBOM Located on the Device | |||
5.4. With ACLS . . . . . . . . . . . . . . . . . . . . . . . . 14 | 5.3. Further Contact Required | |||
6. Security Considerations . . . . . . . . . . . . . . . . . . . 16 | 5.4. With ACLS | |||
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 | 6. Security Considerations | |||
7.1. MUD Extension . . . . . . . . . . . . . . . . . . . . . . 18 | 7. IANA Considerations | |||
7.2. YANG Registration . . . . . . . . . . . . . . . . . . . . 18 | 7.1. MUD Extension | |||
7.3. Well-Known Prefix . . . . . . . . . . . . . . . . . . . . 18 | 7.2. YANG Registration | |||
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 19 | 7.3. Well-Known Prefix | |||
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 19 | 8. References | |||
9.1. Normative References . . . . . . . . . . . . . . . . . . 19 | 8.1. Normative References | |||
9.2. Informative References . . . . . . . . . . . . . . . . . 20 | 8.2. Informative References | |||
Appendix A. Changes from Earlier Versions . . . . . . . . . . . 20 | Acknowledgments | |||
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 | Authors' Addresses | |||
1. Introduction | 1. Introduction | |||
A number of activities have been working to improve visibility to | A number of activities have taken place to improve the visibility of | |||
what software is running on a system, and what vulnerabilities that | what software is running on a system and what vulnerabilities that | |||
software may have [EO2021]. | software may have [EO2021]. | |||
Put simply, this memo seeks to answer two classes of questions to the | Put simply, this memo seeks to answer two classes of questions for | |||
scale of tens of thousands of devices and a large variety of types of | tens of thousands of devices and a large variety of device types. | |||
devices. Those questions are as the following: | Those questions are as follows: | |||
* Is this system vulnerable to a particular vulnerability? | * Is this system susceptible to a particular vulnerability? | |||
* Which devices in a particular environment contain vulnerabilities | * Which devices in a particular environment contain vulnerabilities | |||
that require some action? | that require some action? | |||
This memo doesn't specify the format of this information, but rather | This memo doesn't specify the format of this information but rather | |||
only how to locate and retrieve these objects. That is, the model is | only how to locate and retrieve these objects. That is, the model is | |||
intended to facilitate discovery, and on its own provides no access | intended to facilitate discovery and on its own provides no access to | |||
to the underlying data. | the underlying data. | |||
Software bills of materials (SBOMs) are descriptions of what | Software bills of materials (SBOMs) are descriptions of what | |||
software, including versioning and dependencies, a device contains. | software, including versioning and dependencies, a device contains. | |||
There are different SBOM formats such as Software Package Data | There are different SBOM formats such as Software Package Data | |||
Exchange [SPDX] or CycloneDX[CycloneDX12]. | Exchange [SPDX] or CycloneDX [CycloneDX15]. | |||
System vulnerabilities may similarly be described using several data | System vulnerabilities may be similarly described using several data | |||
formats, including the aforementioned CycloneDX, Common Vulnerability | formats, including the aforementioned CycloneDX, the Common | |||
Reporting Framework [CVRF], the Common Security Advisory Format | Vulnerability Reporting Framework [CVRF], and the Common Security | |||
[CSAF]. This information is typically used to report to | Advisory Format [CSAF]. This information is typically used to report | |||
administrators the state of any known vulnerabilities on a system. | the state of any known vulnerabilities on a system to administrators. | |||
SBOM and vulnerability information can be used in concert with other | SBOM and vulnerability information can be used in concert with other | |||
sources of vulnerability information. For a network management tool | sources of vulnerability information. A network management tool | |||
could discover that a system makes use of a particular set of | could discover that a system uses a particular set of software | |||
software components, searches a national vulnerability database to | components, searches a national vulnerability database to determine | |||
determine known vulnerabilities, and then applies information | known vulnerabilities, and applies information provided by the | |||
provided the manufacturer through this mechanism to produce a | manufacturer through this mechanism to produce a vulnerability | |||
vulnerability report. That report may be used to indicate what if | report. That report may be used to indicate what, if any, versions | |||
any versions of software correct that vulnerability, or whether the | of software correct that vulnerability or whether the system | |||
system exercises the vulnerable code at all. | exercises the vulnerable code at all. | |||
Both classes of information elements are optional under the model | Both classes of information elements are optional under the model | |||
specified in this memo. One can provide only an SBOM, only | specified in this memo. One can provide only an SBOM, only | |||
vulnerability information, or both an SBOM and vulnerability | vulnerability information, or both an SBOM and vulnerability | |||
information. | information. | |||
Note that SBOM formats may also carry other information, the most | Note that SBOM formats may also carry other information, the most | |||
common being any licensing terms. Because this specification is | common being any licensing terms. Because this specification is | |||
neutral regarding content, it is left for format developers such as | neutral regarding content, it is left for format developers such as | |||
the Linux Foundation, OASIS, and ISO to decide what attributes they | the Linux Foundation, OASIS, and ISO to decide what attributes they | |||
will support. | will support. | |||
This memo does not specify how vulnerability information may be | This memo does not specify how vulnerability information may be | |||
retrieved directly from the endpoint. That's because vulnerability | retrieved directly from the endpoint. That is because vulnerability | |||
information changes occur at different rates to software updates. | information changes occur to software updates at different rates. | |||
However, some SBOM formats may also contain vulnerability | However, some SBOM formats may also contain vulnerability | |||
information. | information. | |||
SBOMs and vulnerability information are advertised and retrieved | SBOMs and vulnerability information are advertised and retrieved | |||
through the use of a YANG augmentation of the Manufacturer User | through the use of a YANG augmentation of the Manufacturer User | |||
Description (MUD) model [RFC8520]. Note that the schema creates a | Description (MUD) model [RFC8520]. Note that the schema creates a | |||
grouping that can also be used independently of MUD. Moreover, other | grouping that can also be used independently of MUD. Moreover, other | |||
MUD features, such as access controls, needn't be present. | MUD features, such as access controls, needn't be present. | |||
The mechanisms specified in this document are meant to address two | The mechanisms specified in this document are meant to address two | |||
use cases: | use cases: | |||
* A network-layer management system retrieving information from an | * A network-layer management system retrieving information from an | |||
IoT device as part of its ongoing lifecycle. Such devices may or | Internet of Things (IoT) device as part of its ongoing life cycle. | |||
may not have query interfaces available. | Such devices may or may not have query interfaces available. | |||
* An application-layer management system retrieving vulnerability or | * An application-layer management system retrieving vulnerability or | |||
SBOM information in order to evaluate the posture of an | SBOM information in order to evaluate the posture of an | |||
application server of some form. These application servers may | application server of some form. These application servers may | |||
themselves be containers or hypervisors. Discovery of the | themselves be containers or hypervisors. Discovery of the | |||
topology of a server is beyond the scope of this memo. | topology of a server is beyond the scope of this memo. | |||
To satisfy these two key use cases, objects may be found in one of | To satisfy these two key use cases, objects may be found in one of | |||
three methods: | three methods: | |||
* on devices themselves | 1. on the devices themselves | |||
* on a website (e.g., via URI) | 2. on a website (e.g., via a URI) | |||
* through some form of out-of-band contact with the supplier. | 3. through some form of out-of-band contact with the supplier | |||
Using the first method, devices will have interfaces that permit | Using the first method, devices will have interfaces that permit | |||
direct retrieval. Examples of these interfaces might be an HTTP | direct retrieval. Examples of these interfaces might be an HTTP | |||
[RFC9110], or COAP [RFC7252] endpoint for retrieval. There may also | [RFC9110] or Constrained Application Protocol (CoAP) [RFC7252] | |||
be private interfaces as well. | endpoint for retrieval. There may also be private interfaces as | |||
well. | ||||
Using the second method, when a device does not have an appropriate | Using the second method, when a device does not have an appropriate | |||
retrieval interface, but one is directly available from the | retrieval interface, but one is directly available from the | |||
manufacturer, a URI to that information is discovered through | manufacturer, a URI to that information is discovered through | |||
interfaces such as MUD via DHCP or bootstrapping and ownership | interfaces such as MUD via DHCP or bootstrapping and ownership | |||
transfer mechanisms. | transfer mechanisms. | |||
Using the third method, a supplier may wish to make an SBOM or | Using the third method, a supplier may wish to make an SBOM or | |||
vulnerability information available under certain circumstances, and | vulnerability information available under certain circumstances and | |||
may need to individually evaluate requests. The result of that | may need to individually evaluate requests. The result of that | |||
evaluation might be the SBOM or vulnerability itself or a restricted | evaluation might be the SBOM, the vulnerability itself, a restricted | |||
URL or no access. | URL, or no access. | |||
To enable application-layer discovery, this memo defines a well-known | To enable application-layer discovery, this memo defines a well-known | |||
URI [RFC8615]. Management or orchestration tools can query this | URI [RFC8615]. Management or orchestration tools can query this | |||
well-known URI to retrieve a system's SBOM information. Further | well-known URI to retrieve a system's SBOM information. Further | |||
queries may be necessary based on the content and structure of the | queries may be necessary based on the content and structure of the | |||
response. | response. | |||
1.1. Requirements Language | ||||
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | |||
"OPTIONAL" in this document are to be interpreted as described in BCP | "OPTIONAL" in this document are to be interpreted as described in | |||
14 [RFC2119] [RFC8174] when, and only when, they appear in all | BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all | |||
capitals, as shown here. | capitals, as shown here. | |||
1.1. How This Information Is Retrieved | 1.2. How This Information is Retrieved | |||
Section 4 describes a data model to extend the MUD file format to | Section 4 describes a data model to extend the MUD file format to | |||
carry SBOM and vulnerability information. Section 1.5 of RFC8520 | carry SBOM and vulnerability information. Section 1.5 of [RFC8520] | |||
describes mechanisms by which devices can emit a URL to point to this | describes mechanisms by which devices can emit a URL to point to this | |||
file. Additionally, devices can share this URL either through | file. Additionally, devices can share this URL either through | |||
documentation or within a QR code on a box. Section 2 describes a | documentation or within a QR code on a box. Section 2 describes a | |||
well-known URL from which an SBOM could be served from the local | well-known URL from which an SBOM could be served from the local | |||
device. | device. | |||
Note that vulnerability and SBOM information are likely to change at | Note that vulnerability and SBOM information are likely to change at | |||
different rates. MUD's cache-validity node provides a way for | different rates. MUD's cache-validity node provides a way for | |||
manufacturers to control how often tooling should check for those | manufacturers to control how often tooling should check for those | |||
changes through the cache-validity node. | changes through the cache-validity node. | |||
1.2. Formats | 1.3. Formats | |||
There are multiple ways to express both SBOMs and vulnerability | There are multiple ways to express both SBOMs and vulnerability | |||
information. When these are retrieved either from the device or from | information. When these are retrieved either from the device or from | |||
a remote web server, tools will need to observe the Content-Type | a remote web server, tools will need to observe the Content-Type | |||
header to determine precisely which format is being transmitted. | header to determine precisely which format is being transmitted. | |||
Because IoT devices in particular have limited capabilities, use of a | Because IoT devices in particular have limited capabilities, use of a | |||
specific Accept: header in HTTP or the Accept Option in CoAP is NOT | specific Accept: header in HTTP or the Accept Option in CoAP is NOT | |||
RECOMMENDED. Instead, backend tooling is encouraged to support all | RECOMMENDED. Instead, backend tooling is encouraged to support all | |||
known formats, and SHOULD silently discard SBOM information sent with | known formats and SHOULD silently discard SBOM information sent with | |||
a media type that is not understood. | a media type that is not understood. | |||
If multiple SBOMs are intended to be supported in the same file, the | If multiple SBOMs are intended to be supported in the same file, the | |||
media type should properly reflect that. For example, one might make | media type should properly reflect that. For example, one might make | |||
use of application/{someformat}+json-seq. It is left to those | use of application/{someformat}+json-seq. It is left to those | |||
supporting those formats to make the appropriate registrations in | supporting those formats to make the appropriate registrations in | |||
this case. | this case. | |||
Some formats may support both vulnerability and software inventory | Some formats may support both vulnerability and software inventory | |||
information. When both vulnerability and software inventory | information. When both vulnerability and software inventory | |||
information is available from the same URL, both sbom-url and members | information is available from the same URL, both sbom-url and members | |||
of the vuln-url list MUST indicate that. Network management systems | of the vuln-url list MUST indicate that. Network management systems | |||
retrieving this information MUST take note that the identical | MUST take note of when the SBOM and vulnerability information are | |||
resource is being retrieved rather than retrieving it twice. | accessible via the same resource and not retrieve the resource a | |||
second time. | ||||
2. The well-known transparency endpoint set | 2. The Well-Known Transparency Endpoint Set | |||
A well-known endpoint is defined: | A well-known endpoint is defined: | |||
* "/.well-known/sbom" retrieves an SBOM. | "/.well-known/sbom" retrieves an SBOM | |||
As discussed previously, the precise format of a response is based on | As discussed previously, the precise format of a response is based on | |||
the Content-type provided. | the Content-Type provided. | |||
3. The mud-transparency extension model extension | 3. The mud-transparency Extension | |||
We now formally define the mud-transparency extension; this is done | ||||
in two parts. | ||||
We now formally define this extension. This is done in two parts. | ||||
First, the extension name "transparency" is listed in the | First, the extension name "transparency" is listed in the | |||
"extensions" array of the MUD file. N.B., this schema extension is | "extensions" array of the MUD file. Note that this schema extension | |||
intended to be used wherever it might be appropriate (e.g., not just | is intended to be used wherever it might be appropriate (e.g., not | |||
MUD). | just with MUD). | |||
Second, the "mud" container is augmented with a list of SBOM sources. | Second, the "mud" container is augmented with a list of SBOM sources. | |||
This is done as follows: | This is done as follows: | |||
module: ietf-mud-transparency | module: ietf-mud-transparency | |||
augment /mud:mud: | augment /mud:mud: | |||
+--rw transparency | +--rw transparency | |||
+--rw (sbom-retrieval-method)? | +--rw (sbom-retrieval-method)? | |||
skipping to change at page 6, line 48 ¶ | skipping to change at line 279 ¶ | |||
| +--rw sbom-contact-uri? inet:uri | | +--rw sbom-contact-uri? inet:uri | |||
+--rw sbom-archive-list? inet:uri | +--rw sbom-archive-list? inet:uri | |||
+--rw (vuln-retrieval-method)? | +--rw (vuln-retrieval-method)? | |||
+--:(cloud) | +--:(cloud) | |||
| +--rw vuln-url* inet:uri | | +--rw vuln-url* inet:uri | |||
+--:(vuln-contact-info) | +--:(vuln-contact-info) | |||
+--rw vuln-contact-uri? inet:uri | +--rw vuln-contact-uri? inet:uri | |||
See [RFC8340] for a description of YANG trees. | See [RFC8340] for a description of YANG trees. | |||
4. The mud-sbom augmentation to the MUD YANG model | 4. The mud-sbom Augmentation to the MUD YANG Data Model | |||
<CODE BEGINS> | ||||
file "ietf-mud-transparency@2023-01-12.yang" | This YANG module references [RFC6991], [RFC7231], [RFC7252], | |||
[RFC8520], and [RFC9110]. | ||||
<CODE BEGINS> file "ietf-mud-transparency@2023-09-08.yang" | ||||
module ietf-mud-transparency { | module ietf-mud-transparency { | |||
yang-version 1.1; | yang-version 1.1; | |||
namespace "urn:ietf:params:xml:ns:yang:ietf-mud-transparency"; | namespace "urn:ietf:params:xml:ns:yang:ietf-mud-transparency"; | |||
prefix mudtx; | prefix mudtx; | |||
import ietf-inet-types { | import ietf-inet-types { | |||
prefix inet; | prefix inet; | |||
reference | reference | |||
"RFC 6991"; | "RFC 6991: Common YANG Data Types"; | |||
} | } | |||
import ietf-mud { | import ietf-mud { | |||
prefix mud; | prefix mud; | |||
reference | reference | |||
"RFC 8520"; | "RFC 8520: Manufacturer Usage Description Specification"; | |||
} | } | |||
organization | organization | |||
"IETF OPSAWG (Ops Area) Working Group"; | "IETF OPSAWG (Ops Area) Working Group"; | |||
contact | contact | |||
"WG Web: https://datatracker.ietf.org/wg/opsawg/ | "WG Web: <https://datatracker.ietf.org/wg/opsawg/> | |||
WG List: opsawg@ietf.org | WG List: <opsawg@ietf.org> | |||
Editor: Eliot Lear lear@cisco.com | Editor: Eliot Lear <lear@cisco.com> | |||
Editor: Scott Rose scott.rose@nist.gov"; | Editor: Scott Rose <scott.rose@nist.gov>"; | |||
description | description | |||
"This YANG module augments the ietf-mud model to provide for | "This YANG module augments the ietf-mud model to provide for | |||
reporting of SBOMs and vulnerability information. | reporting of SBOMs and vulnerability information. | |||
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL | ||||
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', | ||||
'MAY', and 'OPTIONAL' in this document are to be interpreted as | ||||
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, | ||||
they appear in all capitals, as shown here. | ||||
Copyright (c) 2023 IETF Trust and the persons identified as | Copyright (c) 2023 IETF Trust and the persons identified as | |||
authors of the code. All rights reserved. | authors of the code. All rights reserved. | |||
Redistribution and use in source and binary forms, with or | Redistribution and use in source and binary forms, with or | |||
without modification, is permitted pursuant to, and subject to | without modification, is permitted pursuant to, and subject to | |||
the license terms contained in, the Revised BSD License set | the license terms contained in, the Revised BSD License set | |||
forth in Section 4.c of the IETF Trust's Legal Provisions | forth in Section 4.c of the IETF Trust's Legal Provisions | |||
Relating to IETF Documents | Relating to IETF Documents | |||
(https://trustee.ietf.org/license-info). | (https://trustee.ietf.org/license-info). | |||
This version of this YANG module is part of RFC XXXX | This version of this YANG module is part of RFC 9472 | |||
(https://www.rfc-editor.org/info/rfcXXXX); | (https://www.rfc-editor.org/info/rfc9472); | |||
see the RFC itself for full legal notices. | see the RFC itself for full legal notices."; | |||
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL | ||||
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', | ||||
'MAY', and 'OPTIONAL' in this document are to be interpreted as | ||||
described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, | ||||
they appear in all capitals, as shown here. "; | ||||
revision 2023-01-12 { | revision 2023-09-08 { | |||
description | description | |||
"Initial proposed standard."; | "Initial proposed standard."; | |||
reference | reference | |||
"RFC XXXX: Discovering and Retrieving Software Transparency | "RFC 9472: A YANG Data Model for Reporting Software Bills | |||
and Vulnerability Information"; | of Materials (SBOMs) and Vulnerability Information"; | |||
} | } | |||
identity local-type { | identity local-type { | |||
description | description | |||
"Base identity for local-well-known choices"; | "Base identity for local well-known choices."; | |||
} | } | |||
identity http { | identity http { | |||
base mudtx:local-type; | base mudtx:local-type; | |||
description | description | |||
"Use http[RFC7231] (insecure) to retrieve SBOM information. | "Use http (RFC 7231) (insecure) to retrieve SBOM information. | |||
This method is NOT RECOMMENDED, but may be unavoidable for | This method is NOT RECOMMENDED but may be unavoidable for | |||
certain classes of deployment, where TLS has not or | certain classes of deployment where TLS has not or | |||
cannot be implemented"; | cannot be implemented."; | |||
reference | ||||
"RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): | ||||
Semantics and Content"; | ||||
} | } | |||
identity https { | identity https { | |||
base mudtx:local-type; | base mudtx:local-type; | |||
description | description | |||
"Use https (secure) to retrieve SBOM information. See | "Use https (secure) to retrieve SBOM information. See | |||
RFC 9110."; | RFC 9110."; | |||
reference | ||||
"RFC 9110: HTTP Semantics"; | ||||
} | } | |||
identity coap { | identity coap { | |||
base mudtx:local-type; | base mudtx:local-type; | |||
description | description | |||
"Use COAP [RFC7252] (insecure) to retrieve SBOM. This method | "Use COAP (RFC 7252) (insecure) to retrieve SBOM. This method | |||
is NOT RECOMMENDED, although it may be unavoidable | is NOT RECOMMENDED, although it may be unavoidable | |||
for certain classes of implementations/deployments."; | for certain classes of implementations/deployments."; | |||
reference | ||||
"RFC 7252: The Constrained Application Protocol (CoAP)"; | ||||
} | } | |||
identity coaps { | identity coaps { | |||
base mudtx:local-type; | base mudtx:local-type; | |||
description | description | |||
"Use COAPS (secure) to retrieve SBOM [RFC7252]"; | "Use COAPS (secure) to retrieve SBOM (RFC 7252)."; | |||
} | } | |||
grouping transparency-extension { | grouping transparency-extension { | |||
description | description | |||
"This grouping provides a means to describe the location of | "This grouping provides a means to describe the location of | |||
software bills of material and vulnerability descriptions."; | software bills of material and vulnerability descriptions."; | |||
container transparency { | container transparency { | |||
description | description | |||
"Container of methods to get SBOMs and vulnerability | "Container of methods to get SBOMs and vulnerability | |||
information."; | information."; | |||
choice sbom-retrieval-method { | choice sbom-retrieval-method { | |||
description | description | |||
"How to find SBOM information"; | "How to find SBOM information."; | |||
case cloud { | case cloud { | |||
list sboms { | list sboms { | |||
key "version-info"; | key "version-info"; | |||
description | description | |||
"A list of SBOMs tied to different software | "A list of SBOMs tied to different software | |||
or hardware versions."; | or hardware versions."; | |||
leaf version-info { | leaf version-info { | |||
type string; | type string; | |||
description | description | |||
"The version to which this SBOM refers."; | "The version to which this SBOM refers."; | |||
skipping to change at page 9, line 47 ¶ | skipping to change at line 429 ¶ | |||
description | description | |||
"Which communication protocol to choose."; | "Which communication protocol to choose."; | |||
} | } | |||
} | } | |||
case sbom-contact-info { | case sbom-contact-info { | |||
leaf sbom-contact-uri { | leaf sbom-contact-uri { | |||
type inet:uri { | type inet:uri { | |||
pattern '((mailto)|(https?)|(tel)):.*'; | pattern '((mailto)|(https?)|(tel)):.*'; | |||
} | } | |||
description | description | |||
"This MUST be either a tel, http, https, or | "This MUST be a tel, an http, an https, or | |||
mailto uri schema that customers can use to | a mailto uri schema that customers can use to | |||
contact someone for SBOM information."; | contact someone for SBOM information."; | |||
} | } | |||
} | } | |||
} | } | |||
leaf sbom-archive-list { | leaf sbom-archive-list { | |||
type inet:uri; | type inet:uri; | |||
description | description | |||
"This URI returns a JSON list of URLs that consist of | "This URI returns a JSON list of URLs that consist of | |||
SBOMs that were previously published for this | SBOMs that were previously published for this | |||
device. Publication dates can be found inside | device. Publication dates can be found inside | |||
the SBOMs."; | the SBOMs."; | |||
} | } | |||
choice vuln-retrieval-method { | choice vuln-retrieval-method { | |||
description | description | |||
"How to find vulnerability information"; | "How to find vulnerability information."; | |||
case cloud { | case cloud { | |||
leaf-list vuln-url { | leaf-list vuln-url { | |||
type inet:uri; | type inet:uri; | |||
description | description | |||
"List of statically located URLs that reference | "List of statically located URLs that reference | |||
vulnerability information"; | vulnerability information."; | |||
} | } | |||
} | } | |||
case vuln-contact-info { | case vuln-contact-info { | |||
leaf vuln-contact-uri { | leaf vuln-contact-uri { | |||
type inet:uri { | type inet:uri { | |||
pattern '((mailto)|(https?)|(tel)):.*'; | pattern '((mailto)|(https?)|(tel)):.*'; | |||
} | } | |||
description | description | |||
"This MUST be either a tel, http, https, or | "This MUST be a tel, an http, an https, or | |||
mailto uri schema that customers can use to | a mailto uri schema that customers can use to | |||
contact someone for vulnerability information."; | contact someone for vulnerability information."; | |||
} | } | |||
} | } | |||
} | } | |||
} | } | |||
} | } | |||
augment "/mud:mud" { | augment "/mud:mud" { | |||
description | description | |||
"Add extension for software transparency."; | "Add extension for software transparency."; | |||
uses transparency-extension; | uses transparency-extension; | |||
} | } | |||
} | } | |||
<CODE ENDS> | <CODE ENDS> | |||
5. Examples | 5. Examples | |||
In this example MUD file that uses a cloud service, the modelX | In this example MUD file that uses a cloud service, the modelX | |||
presents a location of the SBOM in a URL. Note, the ACLs in a MUD | presents a location of the SBOM in a URL. Note that the Access | |||
file are NOT required, although they are a very good idea for IP- | Control Lists (ACLs) in a MUD file are NOT required, although they | |||
based devices. | are a very good idea for IP-based devices. | |||
5.1. Without ACLS | 5.1. Without ACLS | |||
This first MUD file demonstrates how to get SBOM and vulnerability | This first MUD file demonstrates how to get SBOM and vulnerability | |||
information without ACLs. | information without ACLs. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
"extensions": [ | "extensions": [ | |||
"transparency" | "transparency" | |||
], | ], | |||
"mudtx:transparency": { | "mudtx:transparency": { | |||
"sbom-url": "https://iot.example.com/info/modelX/sbom.json", | sboms: [ { | |||
"version-info": "1.2", | ||||
"sbom-url": "https://iot.example.com/info/modelX/sbom.json" | ||||
} ], | ||||
"vuln-url" : [ | "vuln-url" : [ | |||
"https://iotd.example.com/info/modelX/csaf.json" | "https://iotd.example.com/info/modelX/csaf.json" | |||
] | ] | |||
}, | }, | |||
"mud-url": "https://iot.example.com/modelX.json", | "mud-url": "https://iot.example.com/modelX.json", | |||
"mud-signature": "https://iot.example.com/modelX.p7s", | "mud-signature": "https://iot.example.com/modelX.p7s", | |||
"last-update": "2022-01-05T13:29:12+00:00", | "last-update": "2022-01-05T13:29:12+00:00", | |||
"cache-validity": 48, | "cache-validity": 48, | |||
"is-supported": true, | "is-supported": true, | |||
"systeminfo": "retrieving vuln and SBOM info via a cloud service", | "systeminfo": "retrieving vuln and SBOM info via a cloud service", | |||
"mfg-name": "Example, Inc.", | "mfg-name": "Example, Inc.", | |||
"documentation": "https://iot.example.com/doc/modelX", | "documentation": "https://iot.example.com/doc/modelX", | |||
"model-name": "modelX" | "model-name": "modelX" | |||
} | } | |||
} | } | |||
The second example demonstrates that just SBOM information is | The second example demonstrates that just SBOM information is | |||
included from the cloud. | included from the cloud. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
"extensions": [ | "extensions": [ | |||
"transparency" | "transparency" | |||
], | ], | |||
"mudtx:transparency": { | "mudtx:transparency": { | |||
"sbom-url": "https://iot.example.com/info/modelX/sbom.json" | sboms: [ { | |||
}, | "version-info": "1.2", | |||
"mud-url": "https://iot.example.com/modelX.json", | "sbom-url": "https://iot.example.com/info/modelX/sbom.json" | |||
"mud-signature": "https://iot.example.com/modelX.p7s", | } ], | |||
"last-update": "2022-01-05T13:29:12+00:00", | }, | |||
"cache-validity": 48, | "mud-url": "https://iot.example.com/modelX.json", | |||
"is-supported": true, | "mud-signature": "https://iot.example.com/modelX.p7s", | |||
"systeminfo": "retrieving only SBOM info via a cloud service", | "last-update": "2022-01-05T13:29:12+00:00", | |||
"mfg-name": "Example, Inc.", | "cache-validity": 48, | |||
"documentation": "https://iot.example.com/doc/modelX", | "is-supported": true, | |||
"model-name": "modelX" | "systeminfo": "retrieving vuln and SBOM info via a cloud service", | |||
} | "mfg-name": "Example, Inc.", | |||
"documentation": "https://iot.example.com/doc/modelX", | ||||
"model-name": "modelX" | ||||
} | ||||
} | } | |||
5.2. SBOM Located on the Device | 5.2. SBOM Located on the Device | |||
In the next example, the SBOM is located on the device, and there is | In the next example, the SBOM is located on the device, and there is | |||
no vulnerability information provided. | no vulnerability information provided. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
skipping to change at page 13, line 4 ¶ | skipping to change at line 568 ¶ | |||
"mud-signature": "https://iot.example.com/modelX.p7s", | "mud-signature": "https://iot.example.com/modelX.p7s", | |||
"last-update": "2022-01-05T13:29:47+00:00", | "last-update": "2022-01-05T13:29:47+00:00", | |||
"cache-validity": 48, | "cache-validity": 48, | |||
"is-supported": true, | "is-supported": true, | |||
"systeminfo": "retrieving SBOM info from a local source", | "systeminfo": "retrieving SBOM info from a local source", | |||
"mfg-name": "Example, Inc.", | "mfg-name": "Example, Inc.", | |||
"documentation": "https://iot.example.com/doc/modelX", | "documentation": "https://iot.example.com/doc/modelX", | |||
"model-name": "modelX" | "model-name": "modelX" | |||
} | } | |||
} | } | |||
In this example, the SBOM is retrieved from the device, while | In this example, the SBOM is retrieved from the device, while | |||
vulnerability information is available from the cloud. This is | vulnerability information is available from the cloud. This is | |||
likely a common case, because vendors may learn of vulnerability | likely a common case because vendors may learn of vulnerability | |||
information more frequently than they update software. | information more frequently than they update software. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
"extensions": [ | "extensions": [ | |||
"transparency" | "transparency" | |||
], | ], | |||
"mudtx:transparency": { | "mudtx:transparency": { | |||
"sbom-local-well-known": "https", | "sbom-local-well-known": "https", | |||
"vuln-url" : [ | "vuln-url" : [ | |||
"https://iotd.example.com/info/modelX/csaf.json" | "https://iotd.example.com/info/modelX/csaf.json" | |||
] | ] | |||
skipping to change at page 13, line 31 ¶ | skipping to change at line 596 ¶ | |||
"mud-url": "https://iot-device.example.com/modelX.json", | "mud-url": "https://iot-device.example.com/modelX.json", | |||
"mud-signature": "https://iot-device.example.com/modelX.p7s", | "mud-signature": "https://iot-device.example.com/modelX.p7s", | |||
"last-update": "2022-01-05T13:25:14+00:00", | "last-update": "2022-01-05T13:25:14+00:00", | |||
"cache-validity": 48, | "cache-validity": 48, | |||
"is-supported": true, | "is-supported": true, | |||
"systeminfo": "mixed example: SBOM on device, vuln info in cloud", | "systeminfo": "mixed example: SBOM on device, vuln info in cloud", | |||
"mfg-name": "Example, Inc.", | "mfg-name": "Example, Inc.", | |||
"documentation": "https://iot-device.example.com/doc/modelX", | "documentation": "https://iot-device.example.com/doc/modelX", | |||
"model-name": "modelX" | "model-name": "modelX" | |||
} | } | |||
} | } | |||
5.3. Further contact required. | 5.3. Further Contact Required | |||
In this example, the network manager must take further steps to | In this example, the network manager must take further steps to | |||
retrieve SBOM information. Vulnerability information is still | retrieve SBOM information. Vulnerability information is still | |||
available. | available. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
"extensions": [ | "extensions": [ | |||
"transparency" | "transparency" | |||
], | ], | |||
"ietf-mud-transparency:transparency": { | "mudtx:transparency": { | |||
"contact-info": "https://iot-device.example.com/contact-info.html", | "contact-info": "https://iot-device.example.com/contact-info.html", | |||
"vuln-url" : [ | "vuln-url" : [ | |||
"https://iotd.example.com/info/modelX/csaf.json" | "https://iotd.example.com/info/modelX/csaf.json" | |||
] | ] | |||
}, | }, | |||
"mud-url": "https://iot-device.example.com/modelX.json", | "mud-url": "https://iot-device.example.com/modelX.json", | |||
"mud-signature": "https://iot-device.example.com/modelX.p7s", | "mud-signature": "https://iot-device.example.com/modelX.p7s", | |||
"last-update": "2021-07-09T06:16:42+00:00", | "last-update": "2021-07-09T06:16:42+00:00", | |||
"cache-validity": 48, | "cache-validity": 48, | |||
"is-supported": true, | "is-supported": true, | |||
"systeminfo": "retrieving vuln and SBOM info via a cloud service", | "systeminfo": "retrieving vuln and SBOM info via a cloud service", | |||
"mfg-name": "Example, Inc.", | "mfg-name": "Example, Inc.", | |||
"documentation": "https://iot-device.example.com/doc/modelX", | "documentation": "https://iot-device.example.com/doc/modelX", | |||
"model-name": "modelX" | "model-name": "modelX" | |||
} | } | |||
} | } | |||
5.4. With ACLS | 5.4. With ACLS | |||
Finally, here is a complete example where the device provides SBOM | Finally, here is a complete example where the device provides SBOM | |||
and vulnerability information, as well as access-control information. | and vulnerability information as well as access control information. | |||
{ | { | |||
"ietf-mud:mud": { | "ietf-mud:mud": { | |||
"mud-version": 1, | "mud-version": 1, | |||
"extensions": [ | "extensions": [ | |||
"transparency" | "transparency" | |||
], | ], | |||
"mudtx:transparency": { | "mudtx:transparency": { | |||
"sbom-local-well-known": "https", | "sbom-local-well-known": "https", | |||
"vuln-url" : [ | "vuln-url" : [ | |||
"https://iotd.example.com/info/modelX/csaf.json" | "https://iotd.example.com/info/modelX/csaf.json" | |||
] | ] | |||
skipping to change at page 16, line 19 ¶ | skipping to change at line 715 ¶ | |||
}, | }, | |||
"actions": { | "actions": { | |||
"forwarding": "accept" | "forwarding": "accept" | |||
} | } | |||
} | } | |||
] | ] | |||
} | } | |||
} | } | |||
] | ] | |||
} | } | |||
} | } | |||
At this point, the management system can attempt to retrieve the | At this point, the management system can attempt to retrieve the | |||
SBOM, and determine which format is in use through the content-type | SBOM, determine which format is in use through the Content-Type | |||
header on the response to a GET request, independently repeat the | header on the response to a GET request, independently repeat the | |||
process for vulnerability information, and apply ACLs, as | process for vulnerability information, and apply ACLs as appropriate. | |||
appropriate. | ||||
6. Security Considerations | 6. Security Considerations | |||
This document describes a schema for discovering the location of | This document describes a schema for discovering the location of | |||
information relating to software transparency, and does not specify | information relating to software transparency and does not specify | |||
the access model for the information itself. In particular, the YANG | the access model for the information itself. In particular, the YANG | |||
module specified in this document is not necessarily intended to be | module specified in this document is not necessarily intended to be | |||
accessed via regular network management protocols, such as the | accessed via regular network management protocols, such as NETCONF | |||
NETCONF [RFC6241] or RESTCONF [RFC8040], and hence the regular | [RFC6241] or RESTCONF [RFC8040], and hence the regular security | |||
security considerations for such usage are not considered here. | considerations for such usage are not considered here. | |||
We describe below protections relating to both discovery and some | Below, we describe protections relating to both discovery and some | |||
advice on protecting the underlying SBOM/vulnerability information. | advice on protecting the underlying SBOM and vulnerability | |||
information. | ||||
The model specifies both encrypted and unencrypted means to retrieve | The model specifies both encrypted and unencrypted means to retrieve | |||
information. This is a matter of pragmatism. Unencrypted | information. This is a matter of pragmatism. Unencrypted | |||
communications allow for manipulation of information being retrieved. | communications allow for manipulation of information being retrieved. | |||
Therefore, it is RECOMMENDED that implementations offer a means to | Therefore, it is RECOMMENDED that implementations offer a means to | |||
configure endpoints so that they may make use of TLS or DTLS. | configure endpoints so that they may make use of TLS or DTLS. | |||
The ietf-mud-transparency module has no operational impact on the | The ietf-mud-transparency module has no operational impact on the | |||
element itself, and is used to discover state information that may be | element itself and is used to discover state information that may be | |||
available on or off the element. In as much as the module itself is | available on or off the element. In as much as the module itself is | |||
made writeable, this only indicates a change in how to retrieve read- | made writeable, this only indicates a change in how to retrieve read- | |||
only elements. There is no means, for instance, to upload an SBOM. | only elements. There are no means, for instance, to upload an SBOM. | |||
Additional risks are discussed below, and are applicable to all nodes | Additional risks are discussed below and are applicable to all nodes | |||
within the transparency container. | within the transparency container. | |||
If an attacker modifies the elements, they may misdirect automation | If an attacker modifies the elements, they may misdirect automation | |||
to retrieve a different set of URLs than was intended by the | to retrieve a different set of URLs than was intended by the | |||
designer. This in turn leads to two specific sets of risks: | designer. This in turn leads to two specific sets of risks: | |||
* the information retrieved would be false. | * the information retrieved would be false | |||
* the URLs themselves point to malware. | * the URLs themselves point to malware | |||
To address either risk, any change in a URL, and in particular to the | To address either of these risks or any tampering of a URL: | |||
authority section, two approaches may be used: | ||||
* test any cloud-based URL against a reputation service. | * test any cloud-based URL against a reputation service | |||
* provide the administrator an opportunity to approve further | * provide the administrator an opportunity to approve further | |||
procesisng when the authority changes to one not known to be | processing when the authority changes to one not known to be | |||
reputable. | reputable | |||
SBOMs provide an inventory of software. Knowledge of which specific | SBOMs provide an inventory of software. Knowledge of which specific | |||
software is loaded on a system can aid an attacker in identifying an | software is loaded on a system can aid an attacker in identifying an | |||
appropriate exploit for a known vulnerability or guide the | appropriate exploit for a known vulnerability or guide the | |||
development of novel exploit against this system. However, if | development of novel exploit against this system. However, if | |||
software is available to an attacker, the attacker may well already | software is available to an attacker, the attacker may already be | |||
be able to derive this very same software inventory. When this | able to derive this very same software inventory. When this | |||
information resides on the endpoint itself, the endpoint SHOULD NOT | information resides on the endpoint itself, the endpoint SHOULD NOT | |||
provide unrestricted access to the well-known URL by default. | provide unrestricted access to the well-known URL by default. | |||
Other servers that offer the data MAY restrict access to SBOM | Other servers that offer the data MAY restrict access to SBOM | |||
information using appropriate authorization semantics within HTTP. | information using appropriate authorization semantics within HTTP. | |||
One way to do this would be to issue a certificate to the client for | One way to do this would be to issue a certificate to the client for | |||
this purpose after a registration process has taken place. Another | this purpose after a registration process has taken place. Another | |||
approach would involve the use of OAUTH in combination. In | approach would involve the use of OAuth in combination. In | |||
particular, if a system attempts to retrieve an SBOM via HTTP or COAP | particular, if a system attempts to retrieve an SBOM via HTTP or CoAP | |||
and the client is not authorized, the server MUST produce an | and the client is not authorized, the server MUST produce an | |||
appropriate error, with instructions on how to register a particular | appropriate error with instructions on how to register a particular | |||
client. | client. | |||
Another risk is a skew in the SBOM listing and the actual software | Another risk is a skew in the SBOM listing and the actual software | |||
inventory of a device/container. For example, a manufacturer may | inventory of a device/container. For example, a manufacturer may | |||
update the SBOM on its server, but an individual device has not been | update the SBOM on its server, but an individual device has not been | |||
upgraded yet. This may result in an incorrect policy being applied | upgraded yet. This may result in an incorrect policy being applied | |||
to a device. A unique mapping of a device's software version and its | to a device. A unique mapping of a device's software version and its | |||
SBOM can minimize this risk. | SBOM can minimize this risk. | |||
To further mitigate attacks against a device, manufacturers SHOULD | To further mitigate attacks against a device, manufacturers SHOULD | |||
skipping to change at page 18, line 26 ¶ | skipping to change at line 806 ¶ | |||
databases as NIST's National Vulnerability Database [NISTNVD]. It is | databases as NIST's National Vulnerability Database [NISTNVD]. It is | |||
possible that vendors may wish to release information early to some | possible that vendors may wish to release information early to some | |||
customers. We do not discuss here whether that is a good idea, but | customers. We do not discuss here whether that is a good idea, but | |||
if it is employed, then appropriate access controls and authorization | if it is employed, then appropriate access controls and authorization | |||
SHOULD be applied to that information. | SHOULD be applied to that information. | |||
7. IANA Considerations | 7. IANA Considerations | |||
7.1. MUD Extension | 7.1. MUD Extension | |||
The IANA is requested to add "transparency" to the MUD extensions | IANA has added "transparency" to the "MUD Extensions" registry | |||
registry as follows: | [RFC8520] as follows: | |||
Extension Name: transparency | Value: transparency | |||
Standard reference: This document | Reference: RFC 9472 | |||
7.2. YANG Registration | 7.2. YANG Registration | |||
The following YANG module should be registered in the "YANG Module | IANA has registered the following YANG module in the "YANG Module | |||
Names" registry: | Names" registry [RFC6020]: | |||
Name: ietf-mud | Name: ietf-mud-transparency | |||
URN: urn:ietf:params:xml:ns:yang:ietf-mud-transparency | Namespace: urn:ietf:params:xml:ns:yang:ietf-mud-transparency | |||
Prefix: mudtx | Maintained by IANA: N | |||
Registrant contact: The IESG | Prefix: mudtx | |||
Reference: This memo | Reference: RFC 9472 | |||
The following XML registration is requested: | The following URI has been registered in the "IETF XML Registry" | |||
[RFC3688]: | ||||
URI: urn:ietf:params:xml:ns:yang:ietf-mud-transparency | URI: urn:ietf:params:xml:ns:yang:ietf-mud-transparency | |||
Registrant Contact: IESG | Registrant Contact: IESG | |||
XML: None. Namespace URIs do not represent an XML specification. | XML: None. Namespace URIs do not represent an XML specification. | |||
7.3. Well-Known Prefix | 7.3. Well-Known Prefix | |||
The following well known URI is requested in accordance with | IANA has added the following URI suffix to the "Well-Known URIs" | |||
[RFC8615]: | registry in accordance with [RFC8615]: | |||
URI suffix: "sbom" | ||||
Change controller: "IETF" | ||||
Specification document: This memo | ||||
Related information: See ISO/IEC 5962:2021 and SPDX.org | ||||
8. Acknowledgments | ||||
Thanks to Russ Housley, Dick Brooks, Tom Petch, Nicolas Comstedt, who | URI Suffix: sbom | |||
provided review comments. | Change Controller: IETF | |||
Reference: RFC 9472 | ||||
Status: permanent | ||||
Related Information: See ISO/IEC 5962:2021 and SPDX.org | ||||
9. References | 8. References | |||
9.1. Normative References | 8.1. Normative References | |||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, | Requirement Levels", BCP 14, RFC 2119, | |||
DOI 10.17487/RFC2119, March 1997, | DOI 10.17487/RFC2119, March 1997, | |||
<https://www.rfc-editor.org/info/rfc2119>. | <https://www.rfc-editor.org/info/rfc2119>. | |||
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, | ||||
DOI 10.17487/RFC3688, January 2004, | ||||
<https://www.rfc-editor.org/info/rfc3688>. | ||||
[RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for | ||||
the Network Configuration Protocol (NETCONF)", RFC 6020, | ||||
DOI 10.17487/RFC6020, October 2010, | ||||
<https://www.rfc-editor.org/info/rfc6020>. | ||||
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., | [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., | |||
and A. Bierman, Ed., "Network Configuration Protocol | and A. Bierman, Ed., "Network Configuration Protocol | |||
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, | (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, | |||
<https://www.rfc-editor.org/info/rfc6241>. | <https://www.rfc-editor.org/info/rfc6241>. | |||
[RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types", | [RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types", | |||
RFC 6991, DOI 10.17487/RFC6991, July 2013, | RFC 6991, DOI 10.17487/RFC6991, July 2013, | |||
<https://www.rfc-editor.org/info/rfc6991>. | <https://www.rfc-editor.org/info/rfc6991>. | |||
[RFC7231] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer | ||||
Protocol (HTTP/1.1): Semantics and Content", RFC 7231, | ||||
DOI 10.17487/RFC7231, June 2014, | ||||
<https://www.rfc-editor.org/info/rfc7231>. | ||||
[RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained | [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained | |||
Application Protocol (CoAP)", RFC 7252, | Application Protocol (CoAP)", RFC 7252, | |||
DOI 10.17487/RFC7252, June 2014, | DOI 10.17487/RFC7252, June 2014, | |||
<https://www.rfc-editor.org/info/rfc7252>. | <https://www.rfc-editor.org/info/rfc7252>. | |||
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF | [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF | |||
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, | Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, | |||
<https://www.rfc-editor.org/info/rfc8040>. | <https://www.rfc-editor.org/info/rfc8040>. | |||
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | |||
skipping to change at page 20, line 14 ¶ | skipping to change at line 900 ¶ | |||
[RFC8615] Nottingham, M., "Well-Known Uniform Resource Identifiers | [RFC8615] Nottingham, M., "Well-Known Uniform Resource Identifiers | |||
(URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, | (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, | |||
<https://www.rfc-editor.org/info/rfc8615>. | <https://www.rfc-editor.org/info/rfc8615>. | |||
[RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, | [RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, | |||
Ed., "HTTP Semantics", STD 97, RFC 9110, | Ed., "HTTP Semantics", STD 97, RFC 9110, | |||
DOI 10.17487/RFC9110, June 2022, | DOI 10.17487/RFC9110, June 2022, | |||
<https://www.rfc-editor.org/info/rfc9110>. | <https://www.rfc-editor.org/info/rfc9110>. | |||
9.2. Informative References | 8.2. Informative References | |||
[CSAF] Rock, L., Ed., Hagen, S., Ed., and T. Schmidt, Ed., | [CSAF] Rock, L., Ed., Hagen, S., Ed., and T. Schmidt, Ed., | |||
"Common Security Advisory Framework Version 2.0", November | "Common Security Advisory Framework Version 2.0", OASIS | |||
2022, <https://docs.oasis-open.org/csaf/csaf/v2.0/csaf- | Standard, November 2022, <https://docs.oasis- | |||
v2.0.html>. | open.org/csaf/csaf/v2.0/csaf-v2.0.html>. | |||
[CVRF] Hagen, S., Ed., "Common Vulnerability Reporting Framework | [CVRF] Hagen, S., Ed., "CSAF Common Vulnerability Reporting | |||
(CVRF) Version 1.2", September 2017, <https://docs.oasis- | Framework (CVRF) Version 1.2", Committee Specification 01, | |||
open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.pdf>. | September 2017, <https://docs.oasis-open.org/csaf/csaf- | |||
cvrf/v1.2/csaf-cvrf-v1.2.pdf>. | ||||
[CycloneDX12] | [CycloneDX15] | |||
cyclonedx.org, "CycloneDX XML Reference v1.2", May 2020. | CycloneDX, "CycloneDX v1.5 JSON Reference", Version 1.5.0, | |||
<https://cyclonedx.org/docs/1.5/json>. | ||||
[EO2021] Biden, J., "Executive Order 14028, Improving the Nations | [EO2021] Biden, J., "Executive Order on Improving the Nation's | |||
Cybersecurity", May 2021. | Cybersecurity", EO 14028, May 2021. | |||
[NISTNVD] NIST, "National Vulnerability Database", n.d., | [NISTNVD] NIST, "National Vulnerability Database", | |||
<https://nvd.nist.gov>. | <https://nvd.nist.gov>. | |||
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", | [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", | |||
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, | BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, | |||
<https://www.rfc-editor.org/info/rfc8340>. | <https://www.rfc-editor.org/info/rfc8340>. | |||
[SPDX] The Linux Foundation, "SPDX Specification V2.3", 2022, | [SPDX] The Linux Foundation, "The Software Package Data Exchange | |||
(SPDX) Specification", Version 2.3, 2022, | ||||
<https://spdx.github.io/spdx-spec/v2.3/>. | <https://spdx.github.io/spdx-spec/v2.3/>. | |||
Appendix A. Changes from Earlier Versions | Acknowledgments | |||
[[This section to be removed by RFC Editor]] | ||||
Please see https://github.com/elear/mud-sbom for changes. | Thanks to Russ Housley, Dick Brooks, Tom Petch, and Nicolas Comstedt, | |||
who provided review comments. | ||||
Authors' Addresses | Authors' Addresses | |||
Eliot Lear | Eliot Lear | |||
Cisco Systems | Cisco Systems | |||
Richtistrasse 7 | Richtistrasse 7 | |||
CH-8304 Wallisellen | CH-8304 Wallisellen | |||
Switzerland | Switzerland | |||
Phone: +41 44 878 9200 | Phone: +41 44 878 9200 | |||
Email: lear@cisco.com | Email: lear@cisco.com | |||
Scott Rose | Scott Rose | |||
NIST | NIST | |||
100 Bureau Dr | 100 Bureau Dr. | |||
Gaithersburg MD, 20899 | Gaithersburg, MD 20899 | |||
United States of America | United States of America | |||
Phone: +1 301-975-8439 | Phone: +1 301-975-8439 | |||
Email: scott.rose@nist.gov | Email: scott.rose@nist.gov | |||
End of changes. 114 change blocks. | ||||
250 lines changed or deleted | 283 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. |