Skip to content

feat: add a private enterprise SD-ELEMENT for the log pipeline - #15

Merged
DavidCozens merged 1 commit into
mainfrom
stage-15-pipeline-sd
Aug 16, 2026
Merged

feat: add a private enterprise SD-ELEMENT for the log pipeline#15
DavidCozens merged 1 commit into
mainfrom
stage-15-pipeline-sd

Conversation

@DavidCozens

Copy link
Copy Markdown
Contributor

Write a private enterprise SD-ELEMENT. RFC 5424 reserves this form for definitions of your own, and
SyslogPipelineSd.c is a complete example of one: it implements the library's structured-data
extension point in its own translation unit.

static void SyslogPipelineSd_Format(struct SolidSyslogStructuredData* base, struct SolidSyslogSdElement* element)
{
    (void) base;

    SolidSyslogSdElement_Begin(element, "logPipeline", SYSLOG_ENTERPRISE_NUMBER);
    SolidSyslogSdValue_String(SolidSyslogSdElement_Param(element, "transport"), "tls");
    SolidSyslogSdValue_String(SolidSyslogSdElement_Param(element, "atRest"), "hmac-sha256");
    SolidSyslogSdElement_End(element);
}

static struct SolidSyslogStructuredData s_pipelineSd = {SyslogPipelineSd_Format};
... [logPipeline@32473 transport="tls" atRest="hmac-sha256"] device started

The vtable has one entry, Format, and the library never allocates the object. A stateless source
therefore needs no _Create and no pool slot; it is a static this application owns and points the
config at. A source with per-instance state puts that state alongside the vtable in the same struct
and reads it back from the base parameter.

A non-zero enterprise number is what produces a private SD-ID: _Begin emits name@number for one
and a bare IANA name for zero. SyslogEnterprise.h now defines the number and derives the string
that origin's enterpriseId carries, so the two forms cannot drift.

What the element reports is the state of the logging path. A collector can confirm that a record
arrived over TLS and was sealed at rest, and can alert on a device whose pipeline has weakened.
The remaining stages change both values as the protection changes.

When you need it. If a collector has to verify the protection a record travelled and rested
under rather than assume it.

@DavidCozens

Copy link
Copy Markdown
Contributor Author

@coderabbitai pause

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cc8fdebd-876e-4466-8e7e-7a0fec0f8d5c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Note

Reviews paused

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown
✅ Action performed

Reviews paused.

SyslogPipelineSd implements the library's StructuredData extension point in its
own translation unit and emits logPipeline@32473, naming the transport and the
at-rest policy. It is a worked example of the one part of RFC 5424 structured
data that an integrator defines.

  Flash      +13,556 B  (+124 on the previous stage)
  RAM        +37,472 B      (+4)
  Log stack     +680 B  (unchanged)
  Service     +3,768 B  (unchanged)

Four bytes of static RAM is the whole instance. The vtable has one entry and the
library never allocates the object, so a stateless source needs no _Create and no
pool slot.

A non-zero enterprise number is what produces a private SD-ID: _Begin emits
"name@number" for one and a bare IANA "name" for 0. This stage needs the number
rather than the string, so SyslogEnterprise.h defines the number and derives the
string origin's enterpriseId carries. Adopting a registered number stays a
one-line edit.

Its own file rather than more of Syslog.c: this is an object implementing a
library interface rather than wiring, and a reader looking for how to write an SD
source should find one file that is only that. The figures are identical either
way. The build gains that one source.

A collector can use the element to confirm that a record arrived over TLS and was
sealed at rest, and to alert on a device whose pipeline has weakened.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@DavidCozens
DavidCozens force-pushed the stage-15-pipeline-sd branch from 29a36ee to bfc82fd Compare August 16, 2026 21:51
@DavidCozens
DavidCozens changed the base branch from stage-14-hmac to main August 16, 2026 21:51
@DavidCozens
DavidCozens merged commit c654709 into main Aug 16, 2026
1 check passed
@DavidCozens
DavidCozens deleted the stage-15-pipeline-sd branch August 16, 2026 21:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant