Index: libabac/abac_verifier.c
===================================================================
--- libabac/abac_verifier.c	(revision 53e540d5b3ba8b09dcdf1f90cf514182a491d9d3)
+++ libabac/abac_verifier.c	(revision 202a7f97d0dc5cb5eb2b43332f0711eafa4d7170)
@@ -4,4 +4,5 @@
 
 #include <assert.h>
+#include <stdio.h>
 
 #include <library.h>
@@ -14,13 +15,48 @@
 #include "abac_list.h"
 #include "abac_util.h"
-#include "abac_rt0.h"
-
-typedef struct _abac_id_cert_t {
+#include "abac_rt.h"
+
+extern abac_role_t *abac_get_yap_head_role();
+extern abac_role_t *abac_get_yap_tail_role();
+extern abac_list_t *abac_get_yap_clauses();
+
+/* keeping this a fixed enum is to have tighter control of
+   what are acceptabletypes of keyid are we allowing */
+enum keyidtype {
+    KEYID = 1
+};
+/* keyidname[keyidtype] */
+static const char *const keyidname[] =
+{
+  "badidtype", "keyid", 0
+};
+static int keyidname_cnt=1;
+
+enum dtermtype {
+    INT = 1,
+    URN = 2,
+    FLOAT = 3,
+    BOOLEAN = 4,
+    STRING = 5,
+    TIME = 6,
+    PRINCIPAL = 7,
+    ANONYMOUS = 8
+};
+/* dtermname[dtermtype] */
+static const char *const dtermname[] =
+{
+  "baddterm", "int", "urn", "float", "boolean", "string", "time" , "principal", "anonymous", 0
+};
+static int dtermname_cnt=8;
+
+struct _abac_id_cert_t {
     char *keyid;
     char *cn;
+    int type; /* keyidtype */
     certificate_t *cert;
+    char *clause;
 
     UT_hash_handle hh;
-} abac_id_cert_t;
+};
 
 
@@ -30,5 +66,5 @@
     certificate_t *cert;
     certificate_t *issuer;
-    char *clause;
+    abac_list_t *clauses;
 
     int refcount;
@@ -44,4 +80,70 @@
 abac_id_cert_t *id_certs = NULL;
 abac_str_cred_t *str_creds = NULL;
+
+static int debug=0;
+static void check_id_cert(abac_id_cert_t *id_cert);
+extern void abac_print_role_string_with_condition(abac_role_t *role);
+
+//
+void abac_print_cred_info(abac_credential_t *cred)
+{
+    if(debug) {
+        printf("---> printing out credential info cred(%d)..\n", (int) cred);
+        if(cred->head) {
+            printf("  head role(%d):\n",(int)cred->head);
+            abac_print_role_string_with_condition(cred->head);
+        }
+        if(cred->tail) {
+            printf("  tail role(%d):\n",(int)cred->tail);
+            abac_print_role_string_with_condition(cred->tail);
+        }
+
+        abac_list_t *clauses=cred->clauses;
+        if (clauses != NULL) {
+            char *cur=NULL;
+            abac_list_foreach(clauses, cur,
+                printf("  a clause(%d):\n",(int)cur);
+                if(cur)
+                    printf ("strlen(%d)loc(%d)(%s)\n", strlen(cur),(int)cur, cur);
+            );
+        }
+        } else {
+            printf(" ");
+            abac_print_role_string_with_condition(cred->head);
+            printf(" <- ");
+            abac_print_role_string_with_condition(cred->tail);
+            printf("\n");
+   }
+}
+
+// 
+int abac_verify_keyid_type(char *type) {
+    int i;
+
+    if (type == NULL)
+        return 0;
+
+    for (i = 1; i <= keyidname_cnt ; i++)
+        if(strcmp(type,keyidname[i])==0)
+            return i;
+    return 0;
+}
+
+char *abac_keyid_type(int i)
+{
+    return keyidname[i];
+}
+
+int abac_verify_dterm_type(char *type) {
+    int i;
+
+    if (type == NULL)
+        return 0;
+
+    for (i = 1; i <= dtermname_cnt ; i++)
+        if(strcmp(type,dtermname[i])==0)
+            return i;
+    return 0;
+}
 
 // convert a chunk to a lowercase binary string
@@ -109,5 +211,5 @@
  * Load an ID certificate.
  */
-static int _load_id(certificate_t *cert) {
+static int _load_id(certificate_t *cert, abac_id_cert_t **id_cert_ret) {
     abac_id_cert_t *id_cert = NULL;
     char *keyid = NULL;
@@ -122,14 +224,8 @@
     keyid = _chunk_to_string(id);
 
-/* XXX MEI */
-/**
-    identification_t *issuer=cert->get_subject(cert);
-    char *str=(char *)abac_xmalloc(strlen((char *)issuer));
-    sprintf(str,"%Y",issuer);
-**/
     char *str;
     int rv = asprintf(&str, "%Y", cert->get_issuer(cert));
 
-    char *cn=(char *)abac_xmalloc(strlen(str)+1);
+    char *cn=(char *)abac_xmalloc(strlen(str)+2);
     cn[0]='p';
     int n=sscanf(str,"CN=%s", &(cn[1]));
@@ -139,7 +235,9 @@
     }
 
-    printf ("XXX keyid %s \n", keyid);
-    printf( "XXX issuer '%s' \n", str);
-    printf ("XXX cn %s \n", cn);
+    if(debug) {
+        printf ("DEBUG:keyid %s \n", keyid);
+        printf( "DEBUG:issuer '%s' \n", str);
+        printf ("DEBUG:cn %s \n", cn);
+    }
     free(str);
 
@@ -163,5 +261,11 @@
     id_cert->cert = cert;
     id_cert->cn = cn;
+    /* XXX default it to it now */
+    id_cert->type = KEYID;
+    id_cert->clause = generate_pl_type_clause(cn, id_cert->type);
+
     HASH_ADD_KEYPTR(hh, id_certs, id_cert->keyid, strlen(id_cert->keyid), id_cert);
+
+    *id_cert_ret=id_cert;
 
     return ABAC_CERT_SUCCESS;
@@ -174,8 +278,27 @@
 }
 
+static void check_id_cert(abac_id_cert_t *id_cert)
+{
+    if(id_cert) {
+        printf("checking on this id_cert %d\n", (int)id_cert);
+        printf("  --> sha is (%s)\n", id_cert->keyid);
+        printf("  --> cn is (%s)\n", id_cert->cn);
+    }
+}
+
+/**
+ * Load an attribute cert as string.
+ * have minimum syntax & validity check
+XXXX
+ */
+static int _load_attribute_string(char* attr_string) {
+    printf("NOT implemented yet!!!");
+    return ABAC_CERT_INVALID;
+}
+
 /**
  * Load an ID cert from a file.
  */
-int abac_verifier_load_id_file(char *filename) {
+int abac_verifier_load_id_file(char *filename, abac_id_cert_t **id_cert_ret) {
     if (lib == NULL)
         errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
@@ -190,5 +313,5 @@
     if (cert == NULL)
         return ABAC_CERT_INVALID;
-    return _load_id(cert);
+    return _load_id(cert,id_cert_ret);
 }
 
@@ -196,5 +319,5 @@
  * Load an ID cert from a chunk.
  */
-int abac_verifier_load_id_chunk(chunk_t chunk) {
+int abac_verifier_load_id_chunk(chunk_t chunk, abac_id_cert_t **id_cert_ret) {
     // load the cert
     certificate_t *cert = lib->creds->create(
@@ -206,7 +329,18 @@
     if (cert == NULL)
         return ABAC_CERT_INVALID;
-    return _load_id(cert);
-}
-
+    return _load_id(cert,id_cert_ret);
+}
+
+
+void abac_print_clauses(abac_list_t *clauses)
+{
+    if (clauses != NULL) {
+        char *cur;
+        abac_list_foreach(clauses, cur,
+            if(cur)
+                printf ("a clause, %d(%s)\n", (int)cur,cur);
+        );
+    }
+}
 
 /**
@@ -219,4 +353,5 @@
     abac_role_t *head_role = NULL;
     abac_role_t *tail_role = NULL;
+    abac_list_t *clauses=NULL;
     abac_id_cert_t *issuer;
     char *attr_string_copy;
@@ -237,5 +372,4 @@
     }
 
-    printf("YYY-->attr_string(%s)%d\n", attr_string, strlen(attr_string));
     /* call into yacc parser */
     attr_string_copy = strdup(attr_string);
@@ -247,30 +381,11 @@
         goto error;
     }
-
-    char *head_tail[2];
-    abac_split(attr_string, " <- ", head_tail, &ret);
-    if (ret != 2) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // must be a role
-    head_role = abac_role_from_string(head_tail[0]);
-    if (head_role == NULL) goto error;
-    if (!abac_role_is_role(head_role)) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // make sure the tail's valid too
-    tail_role = abac_role_from_string(head_tail[1]);
-    if (tail_role == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
+    head_role = abac_get_yap_head_role();
+    tail_role = abac_get_yap_tail_role();
+    clauses = abac_get_yap_clauses();
 
     // get the issuer based on keyid
-    char *principal = abac_role_principal(head_role);
-    HASH_FIND_STR(id_certs, principal, issuer);
+    char *principalname = abac_role_principal(head_role);
+    HASH_FIND_STR(id_certs, principalname, issuer);
     if (issuer == NULL) {
         ret = ABAC_CERT_MISSING_ISSUER;
@@ -281,5 +396,5 @@
     ret = _verify_signature(issuer->cert, cert);
     if (!ret) {
-        ret = ABAC_CERT_BAD_SIG;
+        set_error_code(ABAC_RT_CERT_BAD_SIG);
         goto error;
     }
@@ -291,5 +406,5 @@
     cred->cert = cert;
     cred->issuer = issuer->cert->get_ref(issuer->cert);
-    cred->clause = abac_get_yap_clause();
+    cred->clauses = clauses;
     cred->refcount = 1;
     *cred_ret = cred;
@@ -308,106 +423,13 @@
 
 error:
-    if (cert != NULL) cert->destroy(cert);
-    if (attr_cert != NULL) attr_cert->destroy(attr_cert);
-    if (head_role != NULL) abac_role_free(head_role);
-    if (tail_role != NULL) abac_role_free(tail_role);
-    if (attr_string_copy != NULL) free(attr_string_copy);
-    abac_free_yap_clause();
+    if (cert) cert->destroy(cert);
+    if (attr_cert) attr_cert->destroy(attr_cert);
+    if (head_role) abac_role_free(head_role);
+    if (tail_role) abac_role_free(tail_role);
+    if (attr_string_copy) free(attr_string_copy);
+    abac_free_yap_clauses();
 
     return ret;
 }
-
-#ifdef OLD
-/**
- * Load an attribute cert.
- * Returns true only if the certificate is valid and is issued by the proper
- * authority.
- */
-static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
-    ietf_attributes_t *attr_cert = NULL;
-    abac_role_t *head_role = NULL;
-    abac_role_t *tail_role = NULL;
-    abac_id_cert_t *issuer;
-    int ret, i;
-
-    // get the attr
-    ac_t *ac = (ac_t *)cert;
-    attr_cert = ac->get_groups(ac);
-    if (attr_cert == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    char *attr_string = attr_cert->get_string(attr_cert);
-    if (attr_string == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    printf("YYY-->attr_string(%s)%d\n", attr_string, strlen(attr_string));
-
-    // split into head/tail parts
-    char *head_tail[2];
-    abac_split(attr_string, " <- ", head_tail, &ret);
-    if (ret != 2) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // must be a role
-    head_role = abac_role_from_string(head_tail[0]);
-    if (head_role == NULL) goto error;
-    if (!abac_role_is_role(head_role)) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // make sure the tail's valid too
-    tail_role = abac_role_from_string(head_tail[1]);
-    if (tail_role == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // get the issuer based on keyid
-    char *principal = abac_role_principal(head_role);
-    HASH_FIND_STR(id_certs, principal, issuer);
-    if (issuer == NULL) {
-        ret = ABAC_CERT_MISSING_ISSUER;
-        goto error;
-    }
-
-    printf("YYY principal found is %s\n", principal);
-
-    // make sure the issuer's signed it
-    ret = _verify_signature(issuer->cert, cert);
-    if (!ret) {
-        ret = ABAC_CERT_BAD_SIG;
-        goto error;
-    }
-
-    // at this point we know we have a good attribute cert
-    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
-    cred->head = head_role;
-    cred->tail = tail_role;
-    cred->cert = cert;
-    cred->issuer = issuer->cert->get_ref(issuer->cert);
-    cred->refcount = 1;
-    *cred_ret = cred;
-
-    // free up some crap
-    attr_cert->destroy(attr_cert);
-
-    return ABAC_CERT_SUCCESS;
-
-error:
-    if (cert != NULL) cert->destroy(cert);
-    if (attr_cert != NULL) attr_cert->destroy(attr_cert);
-    if (head_role != NULL) abac_role_free(head_role);
-    if (tail_role != NULL) abac_role_free(tail_role);
-
-    return ret;
-}
-#endif
 
 /**
@@ -427,4 +449,30 @@
 
 /**
+ * Load attribute cert rules from a file. (this should only be used to test) 
+ */
+int abac_verifier_load_certs_file(char *filename) {
+    size_t nbytes=0;
+    char *input=NULL;
+    FILE *fp;
+    int ret;
+
+    fp=fopen(filename, "r");
+
+    if(fp == NULL)
+        return ABAC_CERT_INVALID;
+
+    while( (ret=getline(&input, &nbytes, fp)) != -1 ) {
+        ret=_load_attribute_string(input);
+        free(input);
+        if(ret != ABAC_CERT_SUCCESS )
+            fclose(fp);
+            return ret;
+    }
+    fclose(fp);
+    return ABAC_CERT_SUCCESS;
+}
+
+
+/**
  * Load an attribute cert from a chunk.
  */
@@ -476,7 +524,8 @@
  * Return the clause of the cert
  */
-char * abac_credential_clause(abac_credential_t *cred) {
-    return cred->clause;
-}
+abac_list_t *abac_credential_clauses(abac_credential_t *cred) {
+    return cred->clauses;
+}
+
 
 /**
@@ -493,10 +542,15 @@
  *  lookup for a credential.
  */
-abac_credential_t *abac_credential_lookup(char* cred_string) {
+abac_credential_t *abac_credential_lookup(char* cred_string)
+{
+    if(debug)
+        printf("DEBUG:doing abac_crendential_lookup ... (%s)\n", cred_string);
     abac_str_cred_t *str_cred;
     HASH_FIND_STR(str_creds, cred_string, str_cred);
     if (str_cred == NULL) {
+        if(debug) printf("DEBUG:NOT FOUND..\n");
         return NULL;
     }
+    if(debug) printf("DEBUG:FOUND..(%d)\n", (int) str_cred->cred);
     return str_cred->cred;
 }
@@ -505,5 +559,9 @@
  * Decrease the reference count of a credential, freeing it when it reaches 0.
  */
-void abac_credential_free(abac_credential_t *cred) {
+void abac_credential_free(abac_credential_t *cred)
+{
+    if(debug)
+        printf("DEBUG:freeing cred(%d)clause(%d)\n", (int)cred, (int)cred->clauses);
+
     if (cred == NULL)
         return;
@@ -517,8 +575,13 @@
     cred->cert->destroy(cred->cert);
     cred->issuer->destroy(cred->issuer); // reference counted
-    if (cred->clause)
-        free(cred->clause);
-
+    /* no need to free yap_clauses here */
     free(cred);
+}
+
+char *abac_id_clause(abac_id_cert_t *id_cert)
+{
+    if(id_cert)
+        return id_cert->clause;
+    return NULL;
 }
 
@@ -532,12 +595,13 @@
         return NULL;
     }
+    if(debug)
+        check_id_cert(id_cert);
     return id_cert->cn;
 }
 
 /* retrieve the cn that is associated with the principal of this role */
-char *abac_cn_with_role(abac_role_t *head_role) {
-
-    // get the issuer based on keyid
-    char *principal = abac_role_principal(head_role);
+char *abac_cn_with_role(abac_role_t *role) {
+
+    char *principal = abac_role_principal(role);
     return abac_cn_with_sha(principal);
 }
