<!--
    nmap.dtd
    This is the DTD for Nmap's XML output (-oX) format.
    $Id$

    Originally written by:
    William McVey <[email protected]> <[email protected]>

    Now maintained by Fyodor <[email protected]> as part of Nmap.     

    To validate using this file, simply add a DOCTYPE line similar to:
    <!DOCTYPE nmaprun SYSTEM "nmap.dtd">
    to the nmap output immediately below the prologue (the first line).  This
    should allow you to run a validating parser against the output (so long
    as the DTD is in your parser's DTD search path).

    Bugs:
    Most of the elements are "locked" into the specific order that nmap
    generates, when there really is no need for a specific ordering.
    This is primarily because I don't know the xml DTD construct to
    specify "one each of this list of elements, in any order".  If there
    is a construct similar to SGML's '&' operator, please let me know.

    Portions Copyright (c) 2001-2022 Nmap Software LLC
    Portions Copyright (c) 2001 by Cisco systems, Inc.
 
    Permission to use, copy, modify, and distribute modified and
    unmodified copies of this software for any purpose and without fee is
    hereby granted, provided that (a) this copyright and permission notice
    appear on all copies of the software and supporting documentation, (b)
    the name of Cisco Systems, Inc. not be used in advertising or
    publicity pertaining to distribution of the program without specific
    prior permission, and (c) notice be given in supporting documentation
    that use, modification, copying and distribution is by permission of
    Cisco Systems, Inc.
 
    Cisco Systems, Inc. makes no representations about the suitability
    of this software for any purpose.  THIS SOFTWARE IS PROVIDED ``AS
    IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
    WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
    FITNESS FOR A PARTICULAR PURPOSE.
-->

<!-- parameter entities to specify common "types" used elsewhere in the DTD -->
<!ENTITY % attr_alpha "CDATA" >
<!ENTITY % attr_numeric "CDATA" >
<!ENTITY % attr_ipaddr "CDATA" >
<!ENTITY % attr_percent "CDATA" >
<!ENTITY % attr_type "(ipv4 | ipv6 | mac)" >
<!ENTITY % attr_bool "(true | false)" >

<!ENTITY % host_states "(up|down|unknown|skipped)" >

<!-- see: nmap.c:statenum2str for list of port states -->
<!-- Maybe they should be enumerated as in scan_types below , but I -->
<!-- don't know how to escape states like open|filtered -->
<!ENTITY % port_states "CDATA" >

<!ENTITY % hostname_types "(user|PTR)" >

<!-- see output.c:output_xml_scaninfo_records for scan types -->
<!ENTITY % scan_types "(syn|ack|bounce|connect|null|xmas|window|maimon|fin|udp|sctpinit|sctpcookieecho|ipproto)" >

<!-- <!ENTITY % ip_versions "(ipv4)" > -->

<!ENTITY % port_protocols "(ip|tcp|udp|sctp)" >

<!-- Service detection confidence level (portlist.h:struct serviceDeductions)
--> 
<!ENTITY % service_confs  "( 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10)" >

<!-- This element was started in nmap.c:nmap_main().
     It represents to the topmost element of the output document.
-->
<!ELEMENT nmaprun      (scaninfo*, verbose, debugging,
                        ( target | taskbegin | taskprogress | taskend | hosthint |
                            prescript | postscript | host | output)*,
                            runstats) >
<!ATTLIST nmaprun
scanner (nmap) #REQUIRED
args CDATA #IMPLIED
start %attr_numeric; #IMPLIED
startstr CDATA         #IMPLIED
version CDATA #REQUIRED
profile_name CDATA #IMPLIED
xmloutputversion CDATA #REQUIRED
>

<!-- this element is written in output.c:doscaninfo() -->
<!ELEMENT scaninfo EMPTY >
<!ATTLIST scaninfo
type %scan_types;  #REQUIRED
scanflags CDATA  #IMPLIED
protocol %port_protocols; #REQUIRED
numservices %attr_numeric;  #REQUIRED
services CDATA  #REQUIRED
>

<!-- these elements are written in nmap.c:nmap_main() -->
<!ELEMENT verbose EMPTY >
<!ATTLIST verbose level %attr_numeric; #IMPLIED >


<!ELEMENT debugging  EMPTY >
<!ATTLIST debugging level %attr_numeric; #IMPLIED >

<!ELEMENT target EMPTY >
<!ATTLIST target specification CDATA #REQUIRED
status (skipped) #IMPLIED
reason (invalid) #IMPLIED
>

<!-- this element is written in timing.c:beginOrEndTask() -->
<!ELEMENT taskbegin EMPTY >
<!ATTLIST taskbegin
task CDATA #REQUIRED
time %attr_numeric; #REQUIRED
extrainfo CDATA #IMPLIED
>

<!-- this element is written in timing.c:printStats() -->
<!ELEMENT taskprogress EMPTY >
<!ATTLIST taskprogress
task CDATA #REQUIRED
time %attr_numeric; #REQUIRED
percent %attr_percent; #REQUIRED
remaining %attr_numeric; #IMPLIED
etc %attr_numeric; #IMPLIED
>

<!-- this element is written in timing.c:beginOrEndTask() -->
<!ELEMENT taskend EMPTY >
<!ATTLIST taskend
task CDATA #REQUIRED
time %attr_numeric; #REQUIRED
extrainfo CDATA #IMPLIED
>

<!-- 
     this element is started in nmap.c:nmap_main() and filled by
     output.c:write_host_status(), output.c:printportoutput(), and
     output.c:printosscanoutput()
-->
<!ELEMENT host ( status, address , (address | hostnames |
                          smurf | ports | os | distance | uptime | 
                          tcpsequence | ipidsequence | tcptssequence |
                          hostscript | trace)*, times? ) >
<!ATTLIST host
starttime %attr_numeric; #IMPLIED
endtime %attr_numeric; #IMPLIED
timedout %attr_bool; #IMPLIED
comment CDATA #IMPLIED
>

<!-- these elements are written by scan_engine.c:ultrascan_host_pspec_update() -->
<!ELEMENT hosthint (status,address+,hostnames?) >

<!-- these elements are written by output.c:write_xml_initial_hostinfo() -->
<!ELEMENT status EMPTY >
<!ATTLIST status state %host_states; #REQUIRED 
  reason     CDATA #REQUIRED 
  reason_ttl CDATA #REQUIRED
 >

<!ELEMENT address EMPTY >
<!ATTLIST address
addr %attr_ipaddr; #REQUIRED
addrtype %attr_type; "ipv4"
vendor CDATA #IMPLIED
>

<!ELEMENT hostnames (hostname)* >
<!ELEMENT hostname EMPTY >
<!ATTLIST hostname
name CDATA #IMPLIED
type %hostname_types; #IMPLIED
>


<!-- this element is written by output.c:write_host_status() -->
<!ELEMENT smurf EMPTY >
<!ATTLIST smurf responses %attr_numeric; #REQUIRED >

<!-- these elements are written by output.c:printportoutput() -->

<!ELEMENT ports (extraports* , port*) >

<!ELEMENT extraports (extrareasons)* >
<!ATTLIST extraports
state %port_states; #REQUIRED
count %attr_numeric;  #REQUIRED
>

<!ELEMENT extrareasons EMPTY >
<!ATTLIST extrareasons
reason CDATA #REQUIRED
count CDATA #REQUIRED
proto %port_protocols; #IMPLIED
ports CDATA #IMPLIED
>

<!ELEMENT port (state , owner? , service?, script*) >
<!ATTLIST port
protocol %port_protocols; #REQUIRED
portid %attr_numeric; #REQUIRED
>

<!ELEMENT state EMPTY >
<!ATTLIST state
state %port_states; #REQUIRED 
reason CDATA #REQUIRED
reason_ttl CDATA #REQUIRED
reason_ip CDATA #IMPLIED
>

<!ELEMENT owner EMPTY >
<!ATTLIST owner name CDATA #REQUIRED >

<!ELEMENT service (cpe*) >
<!ATTLIST service
name CDATA #REQUIRED
conf %service_confs; #REQUIRED
                        method          (table|probed)  #REQUIRED
                        version         CDATA           #IMPLIED
                        product         CDATA           #IMPLIED
                        extrainfo       CDATA           #IMPLIED
tunnel (ssl) #IMPLIED
proto (rpc) #IMPLIED
rpcnum %attr_numeric; #IMPLIED
lowver %attr_numeric; #IMPLIED
highver %attr_numeric; #IMPLIED
                        hostname        CDATA           #IMPLIED
                        ostype          CDATA           #IMPLIED
                        devicetype      CDATA           #IMPLIED
                        servicefp       CDATA           #IMPLIED
>

<!ELEMENT cpe (#PCDATA)>

<!ELEMENT script (#PCDATA|table|elem)* >
<!ATTLIST script
id CDATA #REQUIRED
output CDATA #REQUIRED
>

<!ELEMENT table (table|elem)* >
<!ATTLIST table
    key CDATA #IMPLIED
>

<!ELEMENT elem (#PCDATA)>
<!ATTLIST elem
    key CDATA #IMPLIED
>

<!ELEMENT os ( portused* , osmatch*, osfingerprint* ) >

<!ELEMENT portused EMPTY >
<!ATTLIST portused
state  %port_states; #REQUIRED
proto  %port_protocols; #REQUIRED
portid  %attr_numeric; #REQUIRED
>
<!ELEMENT osclass      (cpe*) >
<!ATTLIST osclass
                       vendor          CDATA           #REQUIRED
                       osgen           CDATA           #IMPLIED
                       type            CDATA           #IMPLIED
                       accuracy        CDATA           #REQUIRED
                       osfamily        CDATA           #REQUIRED
>


<!ELEMENT osmatch (osclass*) >
<!ATTLIST osmatch
name CDATA #REQUIRED
accuracy %attr_numeric; #REQUIRED
line     %attr_numeric; #REQUIRED
>

<!ELEMENT osfingerprint EMPTY >
<!ATTLIST osfingerprint
fingerprint CDATA #REQUIRED
>

<!ELEMENT distance EMPTY >
<!ATTLIST distance
value %attr_numeric; #REQUIRED
>

<!ELEMENT uptime EMPTY >
<!ATTLIST uptime
seconds %attr_numeric; #REQUIRED
lastboot CDATA #IMPLIED
>

<!ELEMENT tcpsequence EMPTY >
<!ATTLIST tcpsequence
index %attr_numeric; #REQUIRED
difficulty CDATA #REQUIRED
values CDATA #REQUIRED
>

<!ELEMENT ipidsequence EMPTY >
<!ATTLIST ipidsequence
class CDATA #REQUIRED
values CDATA #REQUIRED
>

<!ELEMENT tcptssequence EMPTY >
<!ATTLIST tcptssequence
class CDATA #REQUIRED
values CDATA #IMPLIED
>

<!ELEMENT trace (hop*) >
<!ATTLIST trace
      proto   CDATA   #IMPLIED
      port    CDATA   #IMPLIED
>

<!ELEMENT hop EMPTY>
<!ATTLIST hop
      ttl     CDATA   #REQUIRED
      rtt     CDATA   #IMPLIED
      ipaddr  CDATA   #IMPLIED
      host    CDATA   #IMPLIED
>

<!ELEMENT times EMPTY>
<!ATTLIST times
srtt CDATA #REQUIRED
rttvar CDATA #REQUIRED
to CDATA #REQUIRED
>

<!-- For embedding another type of output (screen output) like Zenmap does. -->
<!ELEMENT output (#PCDATA)>
<!ATTLIST output type  (interactive)  #IMPLIED>

<!-- these elements are generated in output.c:printfinaloutput() -->
<!ELEMENT runstats (finished, hosts)>

<!ELEMENT finished EMPTY >
<!ATTLIST finished time %attr_numeric; #REQUIRED 
                        timestr CDATA         #IMPLIED
elapsed %attr_numeric; #REQUIRED
                        summary CDATA         #IMPLIED
                        exit (error|success) #IMPLIED
                        errormsg CDATA         #IMPLIED
>

<!ELEMENT hosts EMPTY >
<!ATTLIST hosts
up %attr_numeric; "0"
down %attr_numeric; "0"
total %attr_numeric; #REQUIRED
>

<!ELEMENT hostscript ( script+ )>
<!ELEMENT prescript ( script+ )>
<!ELEMENT postscript ( script+ )>