NTP: Print kiss codes relevant for NTP debugging

NTPv4 (RFC 5905, section 7.4) formalizes that if the stratum value
is zero, the refid _may_ contain a printable ("designed for
character displays and log files"), four-character, left justified,
zero filled ASCII string for status reporting and debugging ("kiss
code"). RFC 5905 establishes a registry at IANA for kiss codes,
initially populated with values defined in the RFC, but the list
may be modified or extended in the future, and unregistered kiss
codes, e.g., for experimentation and development, are possible (and
are being seen in the field).

Thus, IF the stratum value is zero AND the refid field begins with
a printable character, assume the refid field contains a kiss code
and print it (instead of current "(unspec)").

Author: demsbjf8

CHANGES

@@ -24,6 +24,7 @@ DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
       NetFlow: Use tcp_flag_values[] for TCP flags.
       NTP: Check that the entire extension field is in the capture even
         if it isn't printed
+      NTP: Print kiss codes relevant for NTP debugging.
       MPTCP: parse MPC data_len field, print flags from MP_CAPABLE option.
       OSPF: Fix printing of Traffic Engineering Link TLVs to correctly
         advance the packet data pointer

print-ntp.c

@@ -35,6 +35,7 @@
 #include <config.h>
 
 #include "netdissect-stdinc.h"
+#include "netdissect-ctype.h"
 
 #define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
@@ -268,8 +269,20 @@ ntp_time_print(netdissect_options *ndo,
 	switch (stratum) {
 
 	case UNSPECIFIED:
-		ND_PRINT("(unspec)");
-		ND_TCHECK_4(bp->refid);
+		/* NTPv4 (RFC 5905, section 7.4) formalizes that refid _may_
+		 * contain a printable, four-character, left justified, zero
+		 * filled ASCII string ("kiss code") for status reporting
+		 * and debugging. Some kiss codes are defined in the RFC as
+		 * initial set for a new IANA registry, but the list may be
+		 * modified or extended in the future, and unregistered kiss
+		 * codes are possible (and are being seen in the field).
+		 */
+		if (!ND_ASCII_ISPRINT((bp->refid)[0])) {
+			ND_PRINT("(unspec)");
+			ND_TCHECK_4(bp->refid);
+		} else {
+			nd_printjn(ndo, (const u_char *)&(bp->refid), 4);
+		}
 		break;
 
 	case PRIM_REF:

tests/ntp-v.out

@@ -13,7 +13,7 @@
     2  2017-06-19 14:12:10.231082 IP (tos 0xb8, ttl 64, id 24722, offset 0, flags [DF], proto UDP (17), length 80)
     192.168.100.1.123 > 192.168.100.2.58054: NTPv4, Server, length 52
 	Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 3 (8s), precision -23
-	Root Delay: 0.000000, Root dispersion: 0.001373, Reference-ID: (unspec)
+	Root Delay: 0.000000, Root dispersion: 0.001373, Reference-ID: STEP
 	  Reference Timestamp:  0.000000000
 	  Originator Timestamp: 2763234513.007738396 (1987-07-25T21:08:33Z)
 	  Receive Timestamp:    3706870329.516015118 (2017-06-19T14:12:09Z)
@@ -68,7 +68,7 @@
     7  2017-06-19 14:47:12.800853 IP (tos 0xc0, ttl 64, id 4575, offset 0, flags [DF], proto UDP (17), length 96)
     192.168.100.2.123 > 192.168.100.1.123: NTPv4, Client, length 68
 	Leap indicator: clock unsynchronized (192), Stratum 0 (unspecified), poll 6 (64s), precision -25
-	Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
+	Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: INIT
 	  Reference Timestamp:  0.000000000
 	  Originator Timestamp: 0.000000000
 	  Receive Timestamp:    0.000000000