Re: [nmap-svn] r32452 - nmap/todo

[Daniel Miller <bonsaiviking () gmail com>]

On 10/18/2013 03:16 PM, commit-mailer () nmap org wrote:
> Author: dmiller
> Date: Fri Oct 18 20:16:27 2013
> New Revision: 32452
>
> Log:
> Suggest creating nmap.xsd schema
>
> Modified:
>     nmap/todo/nmap.txt
>
> Modified: nmap/todo/nmap.txt
> ==============================================================================
> --- nmap/todo/nmap.txt  (original)
> +++ nmap/todo/nmap.txt  Fri Oct 18 20:16:27 2013
> @@ -1,5 +1,9 @@
>   TODO $Id: TODO 11866 2009-01-24 23:10:05Z fyodor $ -*-text-*-
>   
> +o Add a W3C XML Schema Definition (XSD) for Nmap XML output. Keeping the DTD
> +  around is also helpful, but XSD is widely supported and could help improve
> +  support for Nmap XML in other tools.
> +
>   o Web: figure out why autogeneration of nmap.org/nsedoc/ doesn't seem
>     to be working.  I think we had a cron job which was supposed to be
>     doing it.
>
> _______________________________________________
> Sent through the svn mailing list
> http://nmap.org/mailman/listinfo/svn
List,

This bears further discussion. There are several competing standards for 
XML schema definitions. The oldest is the DTD, which is what Nmap 
currently ships with. A few folks over the years have requested a W3C 
XML Schema Definition (XSD) file instead, since the more explicit 
definition works well for auto-generating parsing code.

In 2000, Fredrick Eisele posted an example XSD 
(http://seclists.org/nmap-dev/2000/q4/15) that worked for Nmap 
2.54BETA6. It received no replies on the mailing list.

In February 2013, Simon Harrop sent a request to the list for a 
maintained XSD (http://seclists.org/nmap-dev/2013/q1/207). He mentioned 
that there were existing ones out on the web, but none worked with the 
current version.

Fyodor just noted in the TODO file that we have 3 options:

1) switch from DTD to XSD,
2) stick with just a DTD, or
3) try to support both.

For my part, I think 3) is the best option. Schema definitions of any 
kind are valuable as machine-readable documentation. They can be used in 
testing to avoid regressions, and they make Nmap's XML output more 
accessible to writers of other software. The DTD is mostly stable 
(though it could perhaps be tightened up), so the burden of maintaining 
it would not be very great, even if we added XSD.

One final point: Nmap already "versions" its XML output via the 
xmloutputversion attribute to the nmaprun element. For the purpose of 
publishing a DOCTYPE (http://seclists.org/nmap-dev/2013/q4/48) and 
allowing validation of older versions, the schemas (DTD and XSD) for 
older versions should continue to be available, preferably at a URL that 
contains the applicable xmloutputversion.

I think that this kind of project would be a great entry point for 
someone new to Nmap to start contributing. Even if the list discussion 
determines that Nmap will not ship with an XSD, the exercise would give 
the contributor invaluable understanding of how Nmap's XML is 
structured, as well as some of the lesser-known features (e.g. port 
reasons and ttls).

Please respond, especially if you have experience with XSD and XML 
validation.

Dan
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/