Python:我无法理解XML迭代是如何工作的

Question

感谢对我的XML解析问题的出色帮助，我迷失在XML元素的实际处理方式中（使用lxml）。

我的数据是 nmap 扫描的输出，由许多记录组成，如下所示：

<?xml version="1.0"?>
<?xml-stylesheet href="file:///usr/share/nmap/nmap.xsl" type="text/xsl"?>
<nmaprun scanner="nmap" args="nmap -sV -p135,12345 -oX 10.232.0.0.16.xml 10.232.0.0/16" start="1340201347" startstr="Wed Jun 20 16:09:07 2012" version="5.21" xmloutputversion="1.03">
  <host>
    <status state="down" reason="no-response"/>
    <address addr="10.232.0.1" addrtype="ipv4"/>
  </host>  
  <host starttime="1340201455" endtime="1340201930">
    <status state="up" reason="echo-reply"/>
    <address addr="10.232.49.2" addrtype="ipv4"/>
    <hostnames>
      <hostname name="host1.example.com" type="PTR"/>
    </hostnames>
    <ports>
      <port protocol="tcp" portid="135">
        <state state="open" reason="syn-ack" reason_ttl="123"/>
        <service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"/>
      </port>
      <port protocol="tcp" portid="12345">
        <state state="open" reason="syn-ack" reason_ttl="123"/>
        <service name="http" product="Trend Micro OfficeScan Antivirus http config" method="probed" conf="10"/>
      </port>
    </ports>
    <times srtt="890" rttvar="2835" to="100000"/>
  </host>
</nmaprun>

我正在考虑在以下情况下生成一条线

• 端口 12345 已打开或
端口 135
• 已打开，12345 已打开

我

为此使用以下代码，我根据我对事情进展的理解对其进行了评论：

from lxml import etree
import time
scanTime = str(int(time.time()))
d = etree.parse("10.233.85.0.22.xml")
# find all hosts records
for el_host in d.findall("host"):
    # only process hosts UP
    if el_host.find("status").attrib["state"] =="up":
         # here comes a piece of code which sets the variable hostname
         # used later - that part works fine (removed for clarity)
         # get the status of port 135 and 12345
         Open12345 = Open135 = False
         for el_port in el_host.findall("ports/port"):
             # we are now looping thought the <port> records for a given <host>
             if el_port.attrib["portid"] == "135":
                Open135 = el_host.find("ports/port/state").attrib["state"] == "open"
             if el_port.attrib["portid"] == "12345":
                Open12345 = el_host.find("ports/port/state").attrib["state"] == "open"
                # I want to get for port 12345 the description, so I search
                # for <service> within a given port - only 12345 in my case
                # I just search the first one as there is only one
                # this is the place I am not sure I get right
                el_service = el_host.find("ports/port/service")
                if el_service.get("product") is not None:
                   Type12345 = el_host.find("ports/port/service").attrib["product"]
         if Open12345:
            print "%s %s "%s"n" % (scanTime,hostname,Type12345)
         if not Open12345 and Open135:
            print "%s %s "%s"n" % (scanTime,hostname,"NO_OfficeScan")

我不确定的地方在评论中突出显示。使用此代码，我始终Microsoft Windows RPC 匹配，就像我在端口 135 的记录中一样（它在 XML 文件中排在第一位，在端口 12345 之前）。

我

确信问题出在我理解查找功能的方式的某个地方。它可能与所有内容相匹配，与我所在的地方无关。换句话说，没有递归（据我所知）。

在这种情况下，我如何编码"当您在端口 12345 的记录中获取服务名称"的概念？

谢谢。

---

编辑和解决方案：

我在代码中发现了问题。如果有一天有人偶然发现这个问题，我会重新发布整个脚本（输出来自 nmap，所以有人重用可能会很有趣 - 这是为了解释下面的大块代码:)：

#!/usr/bin/python
from lxml import etree
import time
import argparse
parser = argparse.ArgumentParser()
parser.add_argument("file", help="XML file to parse")
args = parser.parse_args()

scanTime = str(int(time.time()))
d = etree.parse(args.file)
f = open("OfficeScanComplianceDSCampus."+scanTime,"w")
print "Parsing "+ args.file
# find all hosts records
for el_host in d.findall("host"):
    # only process hosts UP
    if el_host.find("status").attrib["state"] =="up":
         # get the first hostname if it exists, otherwise IP
         el_hostname = el_host.find("hostnames/hostname")
         if el_hostname is not None:
            hostname = el_hostname.attrib["name"]
         else:
              hostname = el_host.find("address").attrib["addr"]
         # get the status of port 135 and 12345
         Open12345 = Open135 = False
         for el_port in el_host.findall("ports/port"):
             # we are now looping thought the <port> records for a given <host>
             if el_port.attrib["portid"] == "135":
                Open135 = el_port.find("state").attrib["state"] == "open"
             if el_port.attrib["portid"] == "12345":
                Open12345 = el_port.find("state").attrib["state"] == "open"
                # if port open get info about service
                if Open12345:
                   el_service = el_port.find("service")
                   if el_service is None:
                      Type12345 = "UNKNOWN"
                   elif el_service.get("method") == "probed":
                      Type12345 = el_service.get("product")
                   else:
                        Type12345 = "UNKNOWN"

         if Open12345:
            f.write("%s %s "%s"n" % (scanTime,hostname,Type12345))
         if not Open12345 and Open135:
            f.write("%s %s "%s"n" % (scanTime,hostname,"NO_OfficeScan"))
         if Open12345 and not Open135:
            f.write("%s %s "%s"n" % (scanTime,hostname,"Non-Windows with 12345"))
f.close()

我还将探讨Dikei和Ignacio Vazquez-Abrams给出的xpath想法。

谢谢大家！

Answer 1

使用 xpath 应该很容易

from lxml import etree
d = etree.parse("10.233.85.0.22.xml")
d.xpath('//port[@portid="12345"]/service/@name') // return name of service in portid=12345
d.xpath('//port[@portid="12345"]/service/@product') // return product in port with portid=12345