1 files changed, 139 insertions, 0 deletions
diff --git a/ndiff/docs/ndiff.dtd b/ndiff/docs/ndiff.dtd
new file mode 100644
index 0000000..087ab33
--- /dev/null
+++ b/ndiff/docs/ndiff.dtd
@@ -0,0 +1,139 @@
+<!--
+DTD for the Ndiff XML output format.
+David Fifield <david@bamsoftware.com>
+
+Ndiff XML output is similar to Nmap XML output. Inside of the root
+nmapdiff element, the scandiff element represents a single diff of two
+scans. Inside scandiff, host differences are within hostdiff elements
+and port differences are within portdiff elements. These may appear
+anywhere where host and port elements would appear, respectively.
+
+Within a hostdiff or portdiff, differences are shown with a and b
+elements, which show the state of things in the A and B
+scan, respectively. These elements can appear most places in the output.
+
+The output may contain hosts and ports that haven't changed. These are
+stored in normal host and port elements.
+
+Examples:
+A host in the A scan but not in the B scan.
+    <hostdiff>
+        <a>
+            <host>...</host>
+        </a>
+    </hostdiff>
+A host in the B scan but not in the A scan.
+    <hostdiff>
+        <b>
+            <host>...</host>
+        </b>
+    </hostdiff>
+A host that gained a hostname and had a port change state. Port 22 is
+unchanged.
+    <hostdiff>
+        <host>
+            <hostnames>
+                <hostname name="abc.example.com/>
+                <b>
+                    <hostname name="xyz.example.com/>
+                </b>
+            </hostnames>
+            <ports>
+                <portdiff>
+                    <a>
+                        <port portid="10" protocol="tcp">
+                            <state state="open"/>
+                        </port>
+                    </a>
+                    <b>
+                        <port portid="10" protocol="tcp">
+                            <state state="closed"/>
+                        </port>
+                    </b>
+                    <port portid="22" protocol="tcp">
+                        <state state="open"/>
+                    </port>
+                </portdiff>
+            </ports>
+        </host>
+    </hostdiff>
+-->
+
+<!-- Parameter entities defining "data types" used in the rest of the
+     DTD. -->
+<!ENTITY % host-state "(unknown | up | down)">
+<!ENTITY % address-type "(ipv4 | ipv6 | mac)">
+<!ENTITY % protocol "(ip | tcp | udp)">
+<!ENTITY % port-state "CDATA">
+
+<!ELEMENT nmapdiff (scandiff)>
+<!-- The current version is "1". Lack of a version attribute indicates
+version 0, which was rather different. -->
+<!ATTLIST nmapdiff version CDATA #IMPLIED>
+
+<!ELEMENT scandiff (prescript | hostdiff | host | postscript | (a, b?) | b)*>
+
+<!ELEMENT nmaprun EMPTY>
+<!ATTLIST nmaprun
+    scanner CDATA #REQUIRED
+    args CDATA #IMPLIED
+    start CDATA #IMPLIED
+    startstr CDATA #IMPLIED
+    version CDATA #REQUIRED>
+
+<!ELEMENT prescript (script* | (a, b?) | b)>
+<!ELEMENT postscript (script* | (a, b?) | b)>
+
+<!ELEMENT hostdiff (host | (a, b?) | b)>
+
+<!ELEMENT host (status | address | hostnames | ports | os | hostscript | a | b)*>
+
+<!ELEMENT status EMPTY>
+<!ATTLIST status state %host-state; #REQUIRED>
+
+<!ELEMENT hostnames (hostname | a | b)*>
+
+<!ELEMENT address EMPTY>
+<!ATTLIST address addr CDATA #REQUIRED
+                  addrtype %address-type; "ipv4">
+
+<!ELEMENT hostname EMPTY>
+<!ATTLIST hostname name CDATA #REQUIRED>
+
+<!ELEMENT ports ((extraports* | (a, b))?, (portdiff | port)*)>
+
+
+<!ELEMENT portdiff (port | (a, b?) | b)>
+
+<!ELEMENT extraports EMPTY>
+<!ATTLIST extraports state %port-state; #REQUIRED
+                     count CDATA #REQUIRED>
+
+<!ELEMENT port (state | service | script | a | b)*>
+<!ATTLIST port protocol %protocol; #REQUIRED
+               portid CDATA #REQUIRED>
+
+<!ELEMENT state EMPTY>
+<!ATTLIST state state %port-state; #REQUIRED>
+
+<!ELEMENT service EMPTY>
+<!ATTLIST service name CDATA #IMPLIED
+                  product CDATA #IMPLIED
+                  version CDATA #IMPLIED
+                  extrainfo CDATA #IMPLIED
+                  tunnel CDATA #IMPLIED>
+
+<!ELEMENT script EMPTY>
+<!ATTLIST script id CDATA #REQUIRED
+                 output CDATA #REQUIRED>
+
+<!ELEMENT os (osmatch | a | b)*>
+
+<!ELEMENT osmatch EMPTY>
+<!ATTLIST osmatch name CDATA #REQUIRED>
+
+<!ELEMENT hostscript (script | a | b)*>
+
+<!ENTITY % diff-elem "(nmaprun | prescript | postscript | host | status | address | hostname | extraports* | port | state | service | script | os | osmatch* | hostscript)">
+<!ELEMENT a %diff-elem;>
+<!ELEMENT b %diff-elem;>