Index: libabac/abac.hh
===================================================================
--- libabac/abac.hh	(revision e3c7769053dca8eafe102086cebf103cea51504d)
+++ libabac/abac.hh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -14,4 +14,16 @@
     class ID;
 
+/***
+ABAC::dump_yap_db()
+   Dump the complete yap prolog database
+   (C:show_yap_db)
+ABAC::dump_debug_info()
+   Dump debug info on whole session
+   (C:show_debug_info)
+***/
+   void dump_yap_db()
+   { show_yap_db("dump_yap"); }
+   void dump_debug_info(const char *msg)
+   { show_debug_info(msg); }
 /*** 
 ABAC::Constraint
@@ -30,6 +42,8 @@
 f  Constraint(const Constraint &)
      copy constructor, used for cloning a constraint
+     (C:abac_condition_dup)
 f  ~Constraint()
      default destructor
+     (C:abac_condition_free)
 ***/
             Constraint() : m_constraint(NULL) { }
@@ -63,6 +77,6 @@
      (C:abac_constraint_create)
 ***/
-            Constraint(Role& role);
-            Constraint(Oset& oset);
+            Constraint(Role& role); /* defined later in the class */
+            Constraint(Oset& oset); /* defined later in the class */
             Constraint(char *vartype)
             { m_constraint=abac_constraint_create(vartype); }
@@ -70,4 +84,5 @@
 f  Constraint(abac_condition_t *)
      internal constructor that takes an abac_condition_t structure
+     (C:abac_condition_dup)
 **ii*/
             Constraint(abac_condition_t *constraint):
@@ -164,7 +179,7 @@
 f  abac_condition_t *constraint()
      internal returns internal constraint structure
+     (S:abac_condition_t)
 **ii*/
-            abac_condition_t *constraint()
-            { return m_constraint; }
+            abac_condition_t *constraint() { return m_constraint; }
         private:
             abac_condition_t *m_constraint;
@@ -186,4 +201,5 @@
      "principal"
      "anonymous"
+     "this"
 ***/
     class DataTerm {
@@ -194,6 +210,8 @@
 f  DataTerm(const DataTerm &)
      copy constructor, used for cloning a data term
+     (C:abac_term_dup)
 f  ~DataTerm()
      default destructor
+     (C:abac_term_free)
 ***/
             DataTerm() : m_term(NULL) { } // do not use: here for swig
@@ -207,4 +225,5 @@
 f  DataTerm(abac_term_t *)
      internal constructor to make data term from abac_term_t structure
+     (C:abac_term_dup)
 **ii*/
             DataTerm(abac_term_t *term)
@@ -213,14 +232,16 @@
 f  DataTerm(char*)
      constructor to make named principal data term for the oset RHS 
-     (C: abac_term_named_create)
+     if "this" is supplied, a term with tyep=e_TERM_THIS is created
+     if "anonymous" is supplied, a term with type=e_TERM_ANONYMOUS is created
+     (C:abac_term_named_create)
 f  DataTerm(const ID&)
      constructor to make named principal data term for parameter term
-     (C: abac_term_id_create)
+     (C:abac_term_id_create)
 f  DataTerm(char*, char*, Constraint*)
      constructor for making a variable data term 
-     (C: abac_term_create)
+     (C:abac_term_create)
 f  DataTerm(char*, char*)
      constructor for making an instantiated data term
-     (C: abac_term_create)
+     (C:abac_term_create)
 ***/
             DataTerm(char *name) {
@@ -228,5 +249,5 @@
               m_term=abac_term_named_create(name);
             }
-            DataTerm(ID& id);
+            DataTerm(ID& id); /* defined later in the class */
             DataTerm(char* typenm, char *name, Constraint *cond) {
               if(debug) printf("adding a Dataterm (%s)\n",name);
@@ -292,7 +313,7 @@
 f  abac_term_t *term()
      returns abac_term_t term structure
+     (S:abac_term_t)
 **ii*/
-            abac_term_t *term() 
-            { return m_term; }
+            abac_term_t *term() { return m_term; }
         private:
             abac_term_t *m_term;
@@ -311,6 +332,8 @@
 f  Role(const Role &)
      copy constructor, used for cloning a role
+     (C:abac_aspect_dup)
 f  ~Role()
      default destructor
+     (C:abac_aspect_free)
 ***/
             Role() : m_role(NULL) { } // do not use: here for swig
@@ -324,4 +347,5 @@
 f  Role(abac_aspect_t*)
      constructor that takes an abac_aspect_t structure
+     (C:abac_aspect_dup)
 **ii*/
             Role(abac_aspect_t *role): m_role(abac_aspect_dup(role))
@@ -440,4 +464,5 @@
      return the data terms bound to this role's linking role.
      (C:abac_role_get_linked_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -456,4 +481,5 @@
 f  abac_aspect_t *role()
      returns the interal libabac representation of this role
+     (S:abac_aspect_t)
 **ii*/
             abac_aspect_t *role() {return m_role;}
@@ -473,6 +499,8 @@
 f  Oset(const Oset &)
      copy constructor, used for cloning an oset
+     (C:abac_aspect_dup)
 f  ~Oset()
      default destructor
+     (C:abac_aspect_free)
 ***/
             Oset() : m_oset(NULL) { } // do not use: here for swig
@@ -484,4 +512,5 @@
 f  Oset(abac_aspect_t *)
      constructor that takes abac_aspect_t structure
+     (C:abac_aspect_dup)
 **ii*/
             Oset(abac_aspect_t *oset): m_oset(abac_aspect_dup(oset)) 
@@ -490,8 +519,8 @@
 f  Oset(char *)
      constructor that makes a principal oset, ie [keyid:B]
-     (C:abac_role_principal_create)
+     (C:abac_oset_principal_create)
 f  Oset(char *, char *)
      constructor that makes a regular oset, ie. [keyid:B].oset:o
-     (C:abac_role_create)
+     (C:abac_oset_create)
 f  Oset(char *, char*, char *)
      constructor that makes a linked oset, ie. [keyid:B].role:r.oset:o
@@ -595,4 +624,5 @@
      returns the data terms bound to this oset.  
      (C:abac_oset_get_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_data_terms(bool &success) {
@@ -620,4 +650,5 @@
      returns the data terms bound to this oset's linking role.  
      (C:abac_oset_get_linked_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -636,4 +667,5 @@
 f  abac_aspect_t *oset()
      internal returns the internal libabac representation of the oset
+     (S:abac_aspect_t)
 **ii*/
             abac_aspect_t *oset() {return m_oset;}
@@ -656,6 +688,8 @@
 f  ID(const ID &)
      copy constructor, used for cloning an ID
+     (C:abac_id_dup)
 f  ~ID()
      default destructor
+     (C:abac_id_free)
 ***/
             ID() : m_id(NULL) { } // do not use: here for swig
@@ -665,6 +699,9 @@
 f  ID(abac_id_t *)
      constructor from abac_id_t
+     (C:abac_id_dup)
 f  ID(abac_id_credential_t *)
      constructor from abac_id_credential_t
+     (C:abac_id_credential_id)
+     (S::abac_id_credential_t)
 **ii*/
             ID(abac_id_t *id): m_id(abac_id_dup(id)) 
@@ -721,4 +758,5 @@
      - CN must be alphanumeric and begin with a letter
      - validity must be at least one second
+     - optional passphrase is when the keyfile is encrypted
      will throw an exception if either of the above is violated 
      (C:abac_id_generate_with_key)
@@ -748,15 +786,8 @@
 ***/
             void id_load_encrypted_privkey_file(char *filename, char* pfile) {
-              int rt=abac_id_load_encrypted_privkey_file(m_id, filename, pfile);
+              int rt=abac_id_load_enc_privkey_file(m_id, filename, pfile);
               if(rt != 1) 
                 abac_errx(1, "Failed to load private key");
             }
-/*ii**
-f  abac_id_t *id()
-     returns the abac_id_t 
-     returns the interal libabac representation of this id
-**ii*/
-            abac_id_t *id() { return m_id; }
-
 /***
 f  char *id_keyid()
@@ -825,6 +856,4 @@
             abac_chunk_t id_privkey_chunk()
             { return abac_id_privkey_chunk(m_id); }
-            void print_key_chunk()
-            { abac_id_print_key_chunk(m_id); } 
 /***
 f  char *string()
@@ -834,5 +863,11 @@
             char *string()
             { return abac_id_string(m_id); }
-        public:
+/*ii**
+f  abac_id_t *id()
+     returns the interal libabac representation of this id
+     (S:abac_id_t)
+**ii*/
+            abac_id_t *id() { return m_id; }
+        private:
             abac_id_t *m_id;
     };
@@ -857,6 +892,8 @@
 f  Attribute(const Attribute &)
      copy constructor, used for cloning an attribute
+     (C:abac_attribute_dup)
 f  ~Attribute()
      default destructor
+     (C:abac_attribute_free)
 ***/
             Attribute() : m_attr(NULL) { } 
@@ -868,6 +905,10 @@
 f  Attribute(abac_attribute_t *)
      constructor that takes abac_attribute_t, locally used
+     (C:abac_attribute_dup)
 f  Attribute(abac_credential_t *)
      constructor that takes abac_credential_t, locally used 
+     (C:abac_attribute_dup)
+     (C::abac_credential_attribute)
+     (S::abac_credential_t)
 **ii*/
             Attribute(abac_attribute_t *attr): m_attr(abac_attribute_dup(attr)) 
@@ -924,4 +965,8 @@
       Add an oset tail.  Call multiple times for intersection
      (C:abac_attribute_add_tail)
+f  void attribute_set_using_this()
+      Allow user set whether this attribute has '?This' in its
+      attribute rule
+     (C:abac_attribute_set_using_this)
 ***/
             bool attribute_add_tail(Role& tail) {
@@ -935,4 +980,8 @@
                   else return 0;
             }
+            void attribute_set_using_this() {
+              abac_attribute_set_using_this(m_attr,1);
+            }
+/***
 /***
 f  char *head_string()
@@ -975,6 +1024,8 @@
 f  const Role &role_head()
      returns the head role
+     (C:abac_attribute_head)
 f  const Oset &oset_head()
      returns the oset head
+     (C:abac_attribute_head)
 ***/
             const Role &role_head() {
@@ -984,5 +1035,5 @@
             }
             const Oset &oset_head() {
-              abac_aspect_t *head=abac_attribute_tail(m_attr);
+              abac_aspect_t *head=abac_attribute_head(m_attr);
               static Oset oset=Oset(head);
               return oset;
@@ -992,7 +1043,11 @@
      retrieve tail role which maybe more than 1 if intersecting
      (C:abac_attribute_role_tails)
+     (C::abac_attribute_is_role)
+     (C::abac_aspects_free)
 f  std::vector<Oset> oset_tails(bool &)
      retrieve tail oset which maybe more than 1 if intersecting
      (C:abac_attribute_oset_tails)
+     (C::abac_attribute_is_role)
+     (C::abac_aspects_free)
 ***/
             std::vector<Role> role_tails(bool &success) {
@@ -1030,10 +1085,4 @@
               return osets;
             }
-/*ii**
-f  abac_attribute_t *attribute()
-      return libabac structure for attribute
-**ii*/
-            abac_attribute_t *attribute() { return m_attr; }
-
 /***
 f  bool attribute_bake()
@@ -1088,4 +1137,10 @@
             abac_chunk_t cert_chunk()
             { return abac_attribute_cert_chunk(m_attr); }
+/*ii**
+f  abac_attribute_t *attribute()
+      return libabac structure for attribute
+      (S:abac_attribute_t)
+**ii*/
+            abac_attribute_t *attribute() { return m_attr; }
       private:
             abac_attribute_t *m_attr;
@@ -1102,19 +1157,19 @@
 f  Context()
      default constructor
+     (C:abac_context_new)
 f  Context(const Context &)
      copy constructor, used for cloning the context
+     (C:abac_context_dup)
 f  ~Context()
      default destructor
-f  void free_context_now()
-     Explicitly freeing the the context. This is to prevent libstrongswan's 
-     mainthread from GC'ed by Java. Used with Java/Swig/JNI combination only. 
+     (C:abac_context_free)
 ***/
             Context() { 
               m_ctx = abac_context_new();
-              m_abac_version=strdup(abac_version());
+              m_abac_version=abac_xstrdup(abac_version());
             }
             Context(const Context &context) { 
               m_ctx = abac_context_dup(context.m_ctx);
-              m_abac_version=strdup(context.m_abac_version);
+              m_abac_version=abac_xstrdup(context.m_abac_version);
             }
             ~Context() { 
@@ -1122,21 +1177,4 @@
               if(m_ctx!=NULL) abac_context_free(m_ctx);
             }
-           void free_context_now() {
-              if(m_ctx!=NULL) {
-                  abac_context_free_now(m_ctx);
-                  m_ctx=NULL;
-              }
-              if(m_abac_version!=NULL) {
-                 free(m_abac_version);
-                 m_abac_version=NULL;
-              }
-            } 
-/***
-f  void dump_yap_db()
-     dump the complete yap prolog database
-     (C:show_yap_db)
-***/
-            void dump_yap_db()
-            { show_yap_db("dump_yap"); }
 /***
 f  int load_id(ABAC::ID&)
@@ -1146,5 +1184,5 @@
      load id cert from an idkey combo file. key retrieval will be attempted
      but won't fail if not found
-     (C:abac_context_load_id_file)
+     (C:abac_context_load_id_idkey_file)
 f  int load_id_encrypted_file(char *, char *)
      load id cert from an idkey combo file and a pfile. Encrypted key
@@ -1174,5 +1212,5 @@
             { return abac_context_load_id(m_ctx, id.id()); }
             int load_id_file(char *filename)
-            { return abac_context_load_id_file(m_ctx, filename); }
+            { return abac_context_load_id_idkey_file(m_ctx, filename); }
             int load_id_encrypted_file(char *filename, char *pfile)
             { return abac_context_load_encrypted_id_file(m_ctx, filename, pfile); }
@@ -1249,8 +1287,11 @@
      in non ABAC_CN mode  
      (C:abac_context_query)
+     (C::abac_free_credentials)
 f  std::vector<Attribute> query(Role &, Role &, bool &)
      (C:abac_context_query_with_structure)
+     (C::abac_free_credentials)
    std::vector<Attribute> query(Oset &, Oset &, bool &)
      (C:abac_context_query_with_structure)
+     (C::abac_free_credentials)
      runs the query:
        role <-?- principal
@@ -1267,4 +1308,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1274,5 +1317,5 @@
                if(debug) printf("query, got rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1286,4 +1329,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1292,5 +1337,5 @@
                std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1304,4 +1349,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1311,5 +1358,5 @@
                if(debug) printf("query, returning rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1319,4 +1366,5 @@
 f  std::vector<Attribute> next_proof(bool &)
      (C:abac_context_query_again)
+     (C::abac_free_credentials)
      force backtrack and try to get next solution proof:
      returns true/false in success
@@ -1337,5 +1385,5 @@
                if(debug) printf("repeat query, got rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1346,4 +1394,8 @@
      extracted from the internal data structure
      (C:abac_context_credentials)
+     (C::abac_free_credentials)
+f  int credential_count()
+     returns the number of credentials loaded in the context currently
+     (C:abac_context_credential_count()
 ***/
             std::vector<Attribute> context_credentials(bool &success) {
@@ -1360,9 +1412,11 @@
               if(debug) printf("credentials, got (%d)\n", i);
 
-              abac_context_credentials_free(creds);
+              abac_free_credentials(creds);
               if(debug) show_yap_db("calling from context_credentials");
               return attributes;
             }
 
+            int credential_count() const 
+              { return abac_context_credential_count(m_ctx); }
 /***
 f  std::vector<Attribute> context_principals(bool &)
@@ -1370,4 +1424,8 @@
      extracted from the internal data structure
      (C:abac_context_principals)
+     (C::abac_free_principals)
+f  int principal_count()
+     returns the number of principals loaded in the context currently
+     (C:abac_context_principal_count()
 ***/
             std::vector<ID> context_principals(bool &success) {
@@ -1384,10 +1442,13 @@
               if(debug) printf("principals, got (%d)\n", i);
 
-              abac_context_principals_free(ids);
+              abac_free_principals(ids);
               return principals;
             }
+            int principal_count() const 
+              { return abac_context_principal_count(m_ctx); }
 /***
 f  ID lookup_principal(char *)
      find a particular principal from the context
+     (C:abac_context_principal_lookup)
 ***/
             ID lookup_principal(char *name) const 
@@ -1406,4 +1467,10 @@
             char *version() const { return m_abac_version; }
 
+/*ii**
+f  abac_context_t *context()
+      return libabac structure for context
+      (S:abac_context_t)
+**ii*/
+            abac_context_t *context() { return m_ctx; }
         private:
             abac_context_t *m_ctx;
