Make the syslog forwarder's enterprise number configurable (currently the RFC 5612 documentation PEN)

[vladimirrott]

The syslog audit forwarder emits RFC 5424 structured-data frames whose SD-ID is hardcoded to the IANA documentation PEN:

// crates/sysknife-daemon/src/audit_forward.rs:309
let sd = format!(
    "[sysknife@32473 \
     seq=\"{}\" ...

32473 is RFC 5612's reserved documentation and test Private Enterprise Number. The code comment above the format string already flags this:

PEN 32473 is RFC 5612's documentation/test PEN, it MUST be replaced before production deployment. RFC 5424 §7.2.2 requires an IANA-assigned Private Enterprise Number on SD-IDs emitted in production frames. [...] Operators running a SIEM under a regulated framework should either patch SD@32473 to their own PEN at build time or treat this as a known gap (see issue tracker).

The comment points at "the issue tracker", and no such issue exists. This is that issue.

The problem

SyslogForwardSection in crates/sysknife-core/src/config.rs:207 carries only host and facility. There is no way to set the PEN short of editing the source and rebuilding. An operator forwarding SysKnife's audit trail into a compliance SIEM ships frames tagged with a documentation PEN, which a strict RFC 5424 parser is entitled to reject and which collides with anyone else using the reserved number.

Proposed change

Add an optional enterprise_number field to SyslogForwardSection, default 32473, and thread it into the SD-ID rather than hardcoding the literal. Reject a value of 0 and anything outside the u32 IANA range at config-parse time, next to the existing facility validation.

• crates/sysknife-core/src/config.rs:207: the new field and its default.
• crates/sysknife-daemon/src/audit_forward.rs:309: build sysknife@{pen} from the config value.
• The test sites that assert the literal sysknife@32473 (:483, :721, :722 and the surrounding frame checks) become assertions over the configured value, with one case at the default and one at a custom PEN.

Keep the comment, reworded: the default stays the documentation PEN, so the warning about production use still holds, but an operator now has a config knob instead of a source patch.

Difficulty

medium. One config field, one format string, and the frame is already byte-for-byte tested so a golden vector at a custom PEN pins the behaviour.

Getting started

CONTRIBUTING.md has the build and test commands. No CLA and no copyright waiver. The project is MIT.

[vladimirrott]

@atanishka308 reserved for you as a follow-up to your recent work; the why is on your PR thread. No pressure and no deadline. Reply here and it is formally yours.

[vladimirrott]

@atanishka308 I pointed you at this on 7 September and have not heard back, so I am putting it back in the pool for whoever has time this week. Nothing went wrong on your side, and there was no deadline to miss.

If you still want it, say so here and it is yours again. If something else on the tracker suits you better, tell me what you are in the mood for and I will find you one.

[atanishka308]

Sorry for the misunderstanding. It seems I didnt notice this issue.

I will definitely start working on this issue. So, Kindly assign it to me.

[vladimirrott]

@kragent66-glitch this one is yours if you want it, replacing the #336 offer I have just withdrawn after a PR overtook it.

Everything in the body still lands. I checked every reference this morning at b2c823e6:

$ sed -n '207,213p' crates/sysknife-core/src/config.rs
pub struct SyslogForwardSection {
    /// Receiver address (`host:port`). Mandatory.
    pub host: String,
    /// Syslog facility number (default 1 = user-level messages).
    #[serde(default = "default_syslog_facility")]
    pub facility: u8,
}
$ grep -rn 'enterprise_number' crates/ ; echo "rc=$?"
rc=1
$ grep -n 'sysknife@' crates/sysknife-daemon/src/audit_forward.rs
310:        "[sysknife@32473 \
483:        assert!(frame.contains("[sysknife@32473"));
716:        // Structured-data block: one SD element with id "sysknife@32473"
721:            .find(|s| s.id == "sysknife@32473")
722:            .expect("frame has the sysknife@32473 SD element");

So the shape is a new field on SyslogForwardSection with a default that keeps 32473, the format string reading it instead of the literal, and three test sites that currently pin the literal and want to pin the configured value. The daemon's own comment above the format string already says the PEN must be replaced, which makes this documented work rather than a judgement call.

It is medium rather than easy: Rust, a config field, serde defaults and the tests. Closer to #285 than #336 was, which is why I have moved you here.

No deadline. If you would rather have something smaller, say so and I will find one.

[vladimirrott]

Two corrections on this thread and both of them are mine.

@kragent66-glitch I offered you this issue yesterday and I should not have. @atanishka308 had claimed it the day before, in a comment on this thread, and #445 is open against it. I read the labels and the assignee field, both of which were empty, and did not read the conversation that should have filled them. Withdrawing the offer, with an apology for the day of attention it cost you.

There is a replacement waiting on #449, filed this morning, and it sits closer to your #285 than this one ever did. Nothing owed either way.

@atanishka308 you asked for this on 15 September, two hours after I released it, and I left you without an answer for two days:

I will definitely start working on this issue. So, Kindly assign it to me.

Done now, and late. You are assigned, the claimed label is on, and the issue finally reads the way it has actually been since Monday. #445 is next in my review queue.