Skip to content

feat: add a private enterprise SD-ELEMENT for the log pipeline - #45

Merged
DavidCozens merged 1 commit into
mainfrom
stage/pipeline-sd
Jul 30, 2026
Merged

feat: add a private enterprise SD-ELEMENT for the log pipeline#45
DavidCozens merged 1 commit into
mainfrom
stage/pipeline-sd

Conversation

@DavidCozens

@DavidCozens DavidCozens commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Pull request

What this stage adds

A worked example of the one part of RFC 5424 structured data that is yours to
define. SyslogPipelineSd implements the library's StructuredData extension point
directly, in its own translation unit, and emits logPipeline@32473 naming the
transport and the at-rest policy.

Flash +13,548 B (+124 on the previous stage)
RAM +35,688 B (+4)
Log stack +712 B (unchanged)
Service +3,800 B (unchanged)

The IANA elements say what any device can say; a private one says what only this
product knows. What it reports here is the integrity of the logging path itself,
which a collector can use to confirm a record arrived over TLS and was sealed at
rest, and to alert on a device whose pipeline has weakened.

Four bytes of static RAM is the whole instance. A stateless SD source needs no
_Create and no pool slot: the library never allocates one, so it is a vtable the
application owns and points at.

The enterprise number is what makes the SD-ID private — _Begin emits "name@number"
for a non-zero one and a bare IANA "name" for 0. This is the stage that needs the
number rather than the string, so SyslogEnterprise.h now defines the number and
derives the string origin's enterpriseId carries. The two forms cannot drift, and
adopting a real enterprise number stays a one-line edit.

Its own file rather than more of Syslog.c: this is an object implementing a library
interface, not wiring, and a reader after "how do I write my own SD source" should
find one file that is only that. It costs nothing to separate — the figures are
identical either way.

The record is 316 bytes against the 512-byte cap.

Files

 CMakeLists.txt                |  1 +
 README.md                     | 17 +++++++++++------
 app/syslog/Syslog.c           |  4 +++-
 app/syslog/SyslogEnterprise.h | 12 ++++++++----
 app/syslog/SyslogPipelineSd.c | 30 ++++++++++++++++++++++++++++++
 app/syslog/SyslogPipelineSd.h | 13 +++++++++++++
 measurements/pipeline-sd.csv  | 13 +++++++++++++
 measurements/stages.tsv       |  1 +
 run-report.md                 | 22 +++++++++++-----------
 9 files changed, 91 insertions(+), 22 deletions(-)

Checklist

  • The diff touches build infra (1 file(s)) — see Files above; deliberate for this stage.
  • measurements/pipeline-sd.csv committed.
  • Row added to measurements/stages.tsv.
  • README regenerated: python3 scripts/gen-cost-table.py.
  • ./run.sh green (build + QEMU + baseline self-check) — run-report.md committed.

Context for review: 18 of 21 sequential single-commit PRs replaying the integration on top of the Baseline root. Each lands green and reviewed before the next is built on it, because a change to an early commit would force every commit above it to be re-run and re-measured.

Summary by CodeRabbit

  • New Features

    • Added syslog pipeline structured data reporting with private SD-ELEMENT support, including transport and data-at-rest protection parameters.
  • Documentation

    • Updated README to describe the new Private SD-ELEMENT stage and corresponding memory/flash cost metrics.
  • Chores

    • Updated build configuration and test reports with refreshed baseline metrics.

A worked example of the one part of RFC 5424 structured data that is yours to
define. SyslogPipelineSd implements the library's StructuredData extension point
directly, in its own translation unit, and emits logPipeline@32473 naming the
transport and the at-rest policy.

  Flash      +13,548 B    (+124 on the previous stage)
  RAM        +35,688 B           (+4)
  Log stack     +712 B  (unchanged)
  Service     +3,800 B  (unchanged)

The IANA elements say what any device can say; a private one says what only this
product knows. What it reports here is the integrity of the logging path itself,
which a collector can use to confirm a record arrived over TLS and was sealed at
rest, and to alert on a device whose pipeline has weakened.

Four bytes of static RAM is the whole instance. A stateless SD source needs no
_Create and no pool slot: the library never allocates one, so it is a vtable the
application owns and points at.

The enterprise number is what makes the SD-ID private — _Begin emits "name@number"
for a non-zero one and a bare IANA "name" for 0. This is the stage that needs the
number rather than the string, so SyslogEnterprise.h now defines the number and
derives the string origin's enterpriseId carries. The two forms cannot drift, and
adopting a real enterprise number stays a one-line edit.

Its own file rather than more of Syslog.c: this is an object implementing a library
interface, not wiring, and a reader after "how do I write my own SD source" should
find one file that is only that. It costs nothing to separate — the figures are
identical either way.

The record is 316 bytes against the 512-byte cap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1deb5636-4365-4e3e-a3b4-3829b2b55847

📥 Commits

Reviewing files that changed from the base of the PR and between 4270f5b and 3d16120.

⛔ Files ignored due to path filters (2)
  • measurements/pipeline-sd.csv is excluded by !**/*.csv
  • measurements/stages.tsv is excluded by !**/*.tsv
📒 Files selected for processing (7)
  • CMakeLists.txt
  • README.md
  • app/syslog/Syslog.c
  • app/syslog/SyslogEnterprise.h
  • app/syslog/SyslogPipelineSd.c
  • app/syslog/SyslogPipelineSd.h
  • run-report.md

📝 Walkthrough

Walkthrough

Adds a private RFC 5424 logPipeline structured-data element with fixed TLS and HMAC-SHA256 parameters, registers it in syslog output, includes it in the baseline build, and updates documentation and run-report measurements.

Changes

Pipeline structured data

Layer / File(s) Summary
Define pipeline SD provider
app/syslog/SyslogEnterprise.h, app/syslog/SyslogPipelineSd.h, app/syslog/SyslogPipelineSd.c
Defines the enterprise number and stringification helpers, declares the provider getter, and formats the logPipeline SD-ELEMENT.
Register pipeline SD provider
app/syslog/Syslog.c, CMakeLists.txt
Adds the implementation to the baseline target and registers it as the fourth structured-data provider.
Document and validate pipeline SD output
README.md, run-report.md
Documents the Private SD-ELEMENT stage and updates measured costs, captured output, and self-check values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Syslog_Start
  participant SyslogPipelineSd_Get
  participant SyslogSender
  participant RFC5424Collector
  Syslog_Start->>SyslogPipelineSd_Get: register pipeline SD provider
  Syslog_Start->>SyslogSender: configure four structured-data providers
  SyslogSender->>RFC5424Collector: emit logPipeline with transport=tls and atRest=hmac-sha256
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly matches the main change: adding a private enterprise SD-ELEMENT for the syslog pipeline.
Description check ✅ Passed The description follows the template and includes the stage summary plus a complete checklist with the required verification items.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch stage/pipeline-sd

Comment @coderabbitai help to get the list of available commands.

@DavidCozens
DavidCozens merged commit 8cd4b90 into main Jul 30, 2026
2 checks passed
@DavidCozens
DavidCozens deleted the stage/pipeline-sd branch July 30, 2026 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant