Index: libabac/abac.c
===================================================================
--- libabac/abac.c	(revision e3c7769053dca8eafe102086cebf103cea51504d)
+++ libabac/abac.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,4 +1,6 @@
-
-/* abac.c using prolog */
+/**
+** abac.c
+** original abac.c using prolog 
+**/
 
 #include <assert.h>
@@ -8,7 +10,4 @@
 #include <chunk.h>
 
-#include "abac_internal.h"
-
-#include "abac_pl_yap.h"
 #include "abac_util.h"
 #include "abac_verifier.h"
@@ -16,8 +15,5 @@
 static int debug=0;
 
-struct _abac_context_t {
-    abac_pl_t *pl;
-};
-
+/**************************************************************************/
 /**
  * Init the library.
@@ -25,9 +21,9 @@
 void libabac_init(void) {
 
-    if(debug) fprintf(stderr, "libabac_init, calling init\n");
+    DEBUG_PRINTF("libabac_init, calling init\n");
     void libabac_deinit(void);
     static int has_been_init = 0;
 
-    // called every time a context is created, so only do it once
+    // called every time a verifier session is created, so only do it once
     if (!has_been_init) {
         abac_verifier_init();
@@ -35,5 +31,5 @@
         has_been_init = 1;
         } else {
-           if(debug) fprintf(stderr, "libabac_init, can only be called once\n");
+           DEBUG_PRINTF("libabac_init, can only be called once\n");
     }
 }
@@ -42,564 +38,13 @@
  * Deinit the library.
  */
-static int has_been_deinit = 0;
 void libabac_deinit(void) {
-    if(debug) fprintf(stderr, "libabac_deinit, calling take down (%d)\n", has_been_deinit);
+    static int has_been_deinit = 0;
+    DEBUG_PRINTF("libabac_deinit, calling take down (%d)\n", has_been_deinit);
     if(!has_been_deinit) {
         abac_verifier_deinit();
         has_been_deinit = 1;
         } else {
-           if(debug) fprintf(stderr, "libabac_deinit, can only be called once\n");
+           DEBUG_PRINTF("libabac_deinit, can only be called once\n");
     }
 }
 
-/**
- * Create a new abac context.
- */
-abac_context_t *abac_context_new(void) {
-    libabac_init();
-
-    abac_context_t *ctx = abac_xmalloc(sizeof(abac_context_t));
-    ctx->pl = abac_pl_new();
-    return ctx;
-}
-
-/**
- * Deep copy an abac context. -- XXX dummy stub
- */
-abac_context_t *abac_context_dup(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
-    return dup;
-}
-
-/**
- * Free an abac context.
- */
-void abac_context_free(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_pl_free(ctx->pl);
-    free(ctx);
-}
-
-/* This is only used for swig/jni/abac setup, called from
-abac.hh's free_context_now(). Used by other setup actually
-could result in segfaults in libstrongswan if not careful */
-void abac_context_free_now(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_pl_free(ctx->pl);
-    free(ctx);
-    libabac_deinit();
-}
-
-/**
- * Load an ID cert from an abac_id_t.
- */
-int abac_context_load_id_id(abac_context_t *ctx, abac_id_t *id) {
-    assert(ctx != NULL); assert(id);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_id_id(id,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file.
- */
-int abac_context_load_id_id_file_key_file(abac_context_t *ctx, char *filename,
-char *keyfilename)
-{
-    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_id_file_key_file(filename,keyfilename,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-int abac_context_load_id_enc_id_file_key_file(abac_context_t *ctx, char *filename,
-char *keyfilename, char *pfile)
-{
-    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_enc_id_file_key_file(filename,keyfilename, pfile, &id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file, it may contain key part but not necessary.
- */
-int abac_context_load_id_idkey_file(abac_context_t *ctx, char *filename) {
-    assert(ctx != NULL); assert(filename != NULL); 
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_idkey_file(filename,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file, it may contain encrypted key part but not necessary.
- */
-int abac_context_load_id_enc_idkey_file(abac_context_t *ctx, char *filename, char *pfile) {
-    assert(ctx != NULL); assert(filename != NULL); 
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_enc_idkey_file(filename, pfile,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a chunk.
- */
-int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-    int ret=abac_verifier_load_id_chunk(cert_chunk,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-
-/**
- * Load an ID cert and privkey from chunks.
- */
-int abac_context_load_id_privkey_chunk(abac_context_t *ctx, abac_chunk_t cert, abac_chunk_t privkey) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-/*A HACK/SWIG, this is to work around the swig's stub that seems to 
-  mess up the transformation from abac_chunk_t to chunk_t and calling of 
-  load_id_chunks to here */
-/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
-    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
-/* another way,
-    chunk_t tmp = { privkey.ptr, privkey.len };
-    char *ptr = abac_xmalloc(sizeof(unsigned char) * privkey.len);
-    chunk_t privkey_chunk = chunk_create_clone(ptr,tmp);
-*/
-    if(debug) {
-        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey ptr, loc(%d)\n",
-                                                           (int)privkey.ptr);
-        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey_chunk ptr, loc(%d)\n",
-                                                           (int)privkey_chunk.ptr);
-    }
-    int ret=abac_verifier_load_id_privkey_chunk(cert_chunk, privkey_chunk, &id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert and privkey from chunks.
- */
-int abac_context_load_id_enc_privkey_chunk(abac_context_t *ctx,
-abac_chunk_t cert, abac_chunk_t privkey, char *pfile) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-/*A HACK/SWIG, this is to work around the swig's stub that seems to 
-  mess up the transformation from abac_chunk_t to chunk_t and calling of 
-  load_id_chunks to here */
-/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
-    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
-    int ret=abac_verifier_load_id_enc_privkey_chunk(cert_chunk, privkey_chunk, pfile, &id_cert);
-
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-
-
-/**
- * Load an attribute cert from an abac_attribute_t.
- */
-int abac_context_load_attribute_attribute(abac_context_t *ctx, abac_attribute_t *ptr)
-{
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL);
-
-    ret = abac_verifier_load_attribute_cert_attribute(ptr, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-
-}
-
-/**
- * Load an attribute cert from a file.
- */
-int abac_context_load_attribute_file(abac_context_t *ctx, char *filename) {
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL); assert(filename != NULL);
-
-    ret = abac_verifier_load_attribute_cert_file(filename, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-}
-
-/**
- * Load an attribute cert from a chunk.
- */
-int abac_context_load_attribute_chunk(abac_context_t *ctx, abac_chunk_t cert) {
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL);
-
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-
-    ret = abac_verifier_load_attribute_cert_chunk(cert_chunk, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-}
-
-#define KEY_PAT "/*_private.{der,pem}"
-#define ID_PAT "/*_ID.{der,pem}"
-#define ATTR_PAT "/*_attr.der"
-#define IDKEY_PAT "/*_IDKEY.{der,pem}"
-
-char *_make_key_filename(char *cert_file)
-{
-    char *p=strstr(cert_file,"_ID.");
-    char *head=strndup(cert_file,p-cert_file);
-    char *tail=p+4;
-    char *keyfile=NULL;
-    asprintf(&keyfile,"%s_private.%s",head,tail);
-    free(head);
-    return keyfile;
-}
-
-/**
- * Load a directory full of principal certs.
- */
-void abac_context_load_principals(abac_context_t *ctx, char *path) {
-    char *glob_pat, *key_pat;
-    glob_t glob_buf;
-    int i, ret;
-
-    assert(ctx != NULL); assert(path != NULL);
-
-    int dirlen = strlen(path);
-
-    /* make sure pick the larger one */
-    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
-    memcpy(glob_pat, path, dirlen);
-
-    // load ID certs
-    memcpy(glob_pat + dirlen, ID_PAT, sizeof(ID_PAT));
-    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        /* blah_ID.pem */
-        char *cert_file = glob_buf.gl_pathv[i];
-        /* blah_private.pem */
-        char *key_file=_make_key_filename(cert_file);
-        if(debug) {
-            fprintf(stderr,"--> ID cert... %s\n", cert_file);
-            fprintf(stderr,"--> KEY cert... %s\n", key_file);
-        }
-        ret = abac_context_load_id_id_file_key_file(ctx, cert_file, key_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load ID cert %s", cert_file);
-    }
-    globfree(&glob_buf);
-
-    // next load IDKEY certs
-    memcpy(glob_pat + dirlen, IDKEY_PAT, sizeof(IDKEY_PAT));
-    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        /* blah_IDKEY.pem */
-        char *certkey_file = glob_buf.gl_pathv[i];
-        if(debug) fprintf(stderr, "--> IDKEY certkey... %s\n", certkey_file);
-        ret = abac_context_load_id_idkey_file(ctx, certkey_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load ID/KEY IDKEY cert %s", certkey_file);
-    }
-    globfree(&glob_buf);
-
-    free(glob_pat);
-}
-
-/**
- * Load a directory full of certs.
- */
-void abac_context_load_directory(abac_context_t *ctx, char *path) {
-    char *glob_pat, *key_pat;
-    glob_t glob_buf;
-    int i, ret;
-
-    abac_context_load_principals(ctx,path);
-    int dirlen = strlen(path);
-
-    /* make sure pick the larger one */
-    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
-    memcpy(glob_pat, path, dirlen);
-
-    memcpy(glob_pat + dirlen, ATTR_PAT, sizeof(ATTR_PAT));
-    glob(glob_pat, 0, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        char *cert_file = glob_buf.gl_pathv[i];
-
-        if(debug) fprintf(stderr,"--> attr file... (%s)\n", cert_file);
-        ret = abac_context_load_attribute_file(ctx, cert_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load attribute cert --%s", cert_file);
-        if(debug) fprintf(stderr,"Loaded.. (%s)\n", cert_file);
-    }
-    globfree(&glob_buf);
-
-    free(glob_pat);
-}
-
-/**
- * Run a query on the data in an abac context. Returns a NULL-terminated array
- * of abac_credential_t. Success/failure in *success.
- * queryfor(either role or oset), with(either keyid or object type)
- */
-abac_credential_t **abac_context_query(abac_context_t *ctx, char *queryfor, char *with, int *success) {
-    if(debug) fprintf(stderr,"abac_context_query about(%s) with(%s)\n", queryfor, with);
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL); assert(queryfor != NULL);
-    assert(with != NULL); assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query(ctx->pl, queryfor, with);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-       if(!abac_pl_returning_partial(ctx->pl))
-            *success = 1;
-            else *success = 0;
-    } else {
-	*success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-/**
- * Run a repeated query on the data in an abac context to get the next
- * solution proof. Returns a NULL-terminated array
- * of abac_credential_t. Success/failure in *success.
- */
-abac_credential_t **abac_context_query_again(abac_context_t *ctx, int *success)
-{
-    if(debug) fprintf(stderr,"abac_context_query_again\n");
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL);
-    assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query_again(ctx->pl);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-        *success = 1;
-        } else {
-            *success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-
-abac_credential_t **abac_context_query_with_structure(abac_context_t *ctx,
-abac_aspect_t *queryfor, abac_aspect_t *with, int *success)
-{
-    if(debug) fprintf(stderr,"abac_context_query_with_structure\n");
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL); assert(queryfor != NULL);
-    assert(with != NULL); assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query_with_structure(ctx->pl, queryfor, with);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-        *success = 1;
-    } else {
-    // XXX NOT SURE YET..
-    // return partial proof
-	*success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-/**
- * A NULL-terminated array of all the credentials in the context.
- */
-abac_credential_t **abac_context_credentials(abac_context_t *ctx) {
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL);
-
-    abac_stack_t *result = abac_pl_credentials(ctx->pl);
-    int size = abac_stack_size(result);
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            /* if not in there yet, add into it */
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-    return credentials;
-}
-
-/**
- * Frees a NULL-terminated list of credentials.
- */
-void abac_context_credentials_free(abac_credential_t **credentials) {
-    int i;
-
-    if (credentials == NULL)
-        return;
-
-    for (i = 0; credentials[i] != NULL; ++i)
-        abac_credential_free(credentials[i]);
-    free(credentials);
-}
-
-/**
- * A NULL-terminated array of all the principals in the context.
- */
-abac_id_credential_t **abac_context_principals(abac_context_t *ctx) {
-    abac_id_credential_t **principals = NULL, *cur;
-    assert(ctx != NULL);
-
-    abac_stack_t *result = abac_pl_principals(ctx->pl);
-
-    int size = abac_stack_size(result);
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    principals = abac_xmalloc(sizeof(abac_id_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_id_credential_t *) abac_stack_pop(result);
-            /* if not in there yet, add into it */
-            principals[i++] = cur;
-        } 
-    }
-    principals[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-    return principals;
-}
-
-/**
- * Frees a NULL-terminated list of principals.
- */
-void abac_context_principals_free(abac_id_credential_t **principals) {
-    int i;
-
-    if (principals == NULL)
-        return;
-
-    for (i = 0; principals[i] != NULL; ++i)
-        abac_id_credential_free(principals[i]);
-    free(principals);
-}
-
-/**
- * 
- */
-abac_id_credential_t *abac_context_principal_lookup(abac_context_t *ctx, char *name)
-{
-    assert(ctx != NULL);
-    abac_id_credential_t *principal=abac_id_credential_lookup(name);
-    return principal;
-}
-
-void abac_context_set_no_partial_proof(abac_context_t *ctx)
-{ abac_pl_set_no_partial(ctx->pl); }
-
-void abac_context_set_want_partial_proof(abac_context_t *ctx)
-{ abac_pl_set_want_partial(ctx->pl); }
-
