ntp: create tx for all modes; log version, mode and stratum

Add logging for version, mode and stratum as these will be the first
keywords we will add.

Ticket: #8425

etc/schema.json

@@ -4471,9 +4471,21 @@
             "type": "object",
             "additionalProperties": false,
             "properties": {
+                "mode": {
+                    "type": "integer",
+                    "description": "The mode of the NTP message"
+                },
                 "reference_id": {
                     "type": "integer",
                     "description": "Identifies specific server or reference clock"
+                },
+                "stratum": {
+                    "type": "integer",
+                    "description": "Indicates distance from the reference clock"
+                },
+                "version": {
+                    "type": "integer",
+                    "description": "The NTP version number, typically 3 or 4"
                 }
             }
         },

rust/src/ntp/log.rs

@@ -20,6 +20,9 @@ use crate::jsonbuilder::{JsonBuilder, JsonError};
 
 fn log(jb: &mut JsonBuilder, tx: &NTPTransaction) -> Result<(), JsonError> {
     jb.open_object("ntp")?;
+    jb.set_uint("version", tx.version)?;
+    jb.set_uint("mode", tx.mode)?;
+    jb.set_uint("stratum", tx.stratum)?;
     jb.set_uint("reference_id", tx.reference_id)?;
     jb.close()?;
     Ok(())

rust/src/ntp/ntp.rs

@@ -61,6 +61,10 @@ pub struct NTPTransaction {
     /// The NTP reference ID
     pub reference_id: u32,
 
+    pub version: u8,
+    pub mode: u8,
+    pub stratum: u8,
+
     /// The internal transaction id
     id: u64,
 
@@ -97,14 +101,23 @@ impl NTPState {
         match parse_ntp(i) {
             Ok((_, ref msg)) => {
                 // SCLogDebug!("parse_ntp: {:?}",msg);
-                let (mode, ref_id) = match msg {
+                let tx = match msg {
-                    NtpPacket::V3(pkt) => (pkt.mode, pkt.ref_id),
+                    NtpPacket::V3(p) => {
-                    NtpPacket::V4(pkt) => (pkt.mode, pkt.ref_id),
+                        let mut tx = self.new_tx(direction, p.ref_id);
+                        tx.version = 3;
+                        tx.mode = p.mode.0;
+                        tx.stratum = p.stratum;
+                        tx
+                    }
+                    NtpPacket::V4(p) => {
+                        let mut tx = self.new_tx(direction, p.ref_id);
+                        tx.version = 4;
+                        tx.mode = p.mode.0;
+                        tx.stratum = p.stratum;
+                        tx
+                    }
                 };
-                if mode == NtpMode::SymmetricActive || mode == NtpMode::Client {
-                    let tx = self.new_tx(direction, ref_id);
                 self.transactions.push(tx);
-                }
                 0
             }
             Err(Err::Incomplete(_)) => {
@@ -158,6 +171,7 @@ impl NTPTransaction {
             reference_id,
             id,
             tx_data: applayer::AppLayerTxData::for_direction(direction),
+            ..Default::default()
         }
     }
 }