Index: libabac/abac.c
===================================================================
--- libabac/abac.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,4 +1,6 @@
-
-/* abac.c using prolog */
+/**
+** abac.c
+** original abac.c using prolog 
+**/
 
 #include <assert.h>
@@ -8,7 +10,4 @@
 #include <chunk.h>
 
-#include "abac_internal.h"
-
-#include "abac_pl_yap.h"
 #include "abac_util.h"
 #include "abac_verifier.h"
@@ -16,8 +15,5 @@
 static int debug=0;
 
-struct _abac_context_t {
-    abac_pl_t *pl;
-};
-
+/**************************************************************************/
 /**
  * Init the library.
@@ -25,9 +21,9 @@
 void libabac_init(void) {
 
-    if(debug) fprintf(stderr, "libabac_init, calling init\n");
+    DEBUG_PRINTF("libabac_init, calling init\n");
     void libabac_deinit(void);
     static int has_been_init = 0;
 
-    // called every time a context is created, so only do it once
+    // called every time a verifier session is created, so only do it once
     if (!has_been_init) {
         abac_verifier_init();
@@ -35,5 +31,5 @@
         has_been_init = 1;
         } else {
-           if(debug) fprintf(stderr, "libabac_init, can only be called once\n");
+           DEBUG_PRINTF("libabac_init, can only be called once\n");
     }
 }
@@ -42,564 +38,13 @@
  * Deinit the library.
  */
-static int has_been_deinit = 0;
 void libabac_deinit(void) {
-    if(debug) fprintf(stderr, "libabac_deinit, calling take down (%d)\n", has_been_deinit);
+    static int has_been_deinit = 0;
+    DEBUG_PRINTF("libabac_deinit, calling take down (%d)\n", has_been_deinit);
     if(!has_been_deinit) {
         abac_verifier_deinit();
         has_been_deinit = 1;
         } else {
-           if(debug) fprintf(stderr, "libabac_deinit, can only be called once\n");
+           DEBUG_PRINTF("libabac_deinit, can only be called once\n");
     }
 }
 
-/**
- * Create a new abac context.
- */
-abac_context_t *abac_context_new(void) {
-    libabac_init();
-
-    abac_context_t *ctx = abac_xmalloc(sizeof(abac_context_t));
-    ctx->pl = abac_pl_new();
-    return ctx;
-}
-
-/**
- * Deep copy an abac context. -- XXX dummy stub
- */
-abac_context_t *abac_context_dup(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
-    return dup;
-}
-
-/**
- * Free an abac context.
- */
-void abac_context_free(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_pl_free(ctx->pl);
-    free(ctx);
-}
-
-/* This is only used for swig/jni/abac setup, called from
-abac.hh's free_context_now(). Used by other setup actually
-could result in segfaults in libstrongswan if not careful */
-void abac_context_free_now(abac_context_t *ctx) {
-    assert(ctx != NULL);
-    abac_pl_free(ctx->pl);
-    free(ctx);
-    libabac_deinit();
-}
-
-/**
- * Load an ID cert from an abac_id_t.
- */
-int abac_context_load_id_id(abac_context_t *ctx, abac_id_t *id) {
-    assert(ctx != NULL); assert(id);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_id_id(id,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file.
- */
-int abac_context_load_id_id_file_key_file(abac_context_t *ctx, char *filename,
-char *keyfilename)
-{
-    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_id_file_key_file(filename,keyfilename,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-int abac_context_load_id_enc_id_file_key_file(abac_context_t *ctx, char *filename,
-char *keyfilename, char *pfile)
-{
-    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_enc_id_file_key_file(filename,keyfilename, pfile, &id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file, it may contain key part but not necessary.
- */
-int abac_context_load_id_idkey_file(abac_context_t *ctx, char *filename) {
-    assert(ctx != NULL); assert(filename != NULL); 
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_idkey_file(filename,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a file, it may contain encrypted key part but not necessary.
- */
-int abac_context_load_id_enc_idkey_file(abac_context_t *ctx, char *filename, char *pfile) {
-    assert(ctx != NULL); assert(filename != NULL); 
-    abac_id_credential_t *id_cert=NULL;
-    int ret = abac_verifier_load_enc_idkey_file(filename, pfile,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert from a chunk.
- */
-int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-    int ret=abac_verifier_load_id_chunk(cert_chunk,&id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-
-/**
- * Load an ID cert and privkey from chunks.
- */
-int abac_context_load_id_privkey_chunk(abac_context_t *ctx, abac_chunk_t cert, abac_chunk_t privkey) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-/*A HACK/SWIG, this is to work around the swig's stub that seems to 
-  mess up the transformation from abac_chunk_t to chunk_t and calling of 
-  load_id_chunks to here */
-/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
-    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
-/* another way,
-    chunk_t tmp = { privkey.ptr, privkey.len };
-    char *ptr = abac_xmalloc(sizeof(unsigned char) * privkey.len);
-    chunk_t privkey_chunk = chunk_create_clone(ptr,tmp);
-*/
-    if(debug) {
-        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey ptr, loc(%d)\n",
-                                                           (int)privkey.ptr);
-        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey_chunk ptr, loc(%d)\n",
-                                                           (int)privkey_chunk.ptr);
-    }
-    int ret=abac_verifier_load_id_privkey_chunk(cert_chunk, privkey_chunk, &id_cert);
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-/**
- * Load an ID cert and privkey from chunks.
- */
-int abac_context_load_id_enc_privkey_chunk(abac_context_t *ctx,
-abac_chunk_t cert, abac_chunk_t privkey, char *pfile) {
-    assert(ctx != NULL);
-    abac_id_credential_t *id_cert=NULL;
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-/*A HACK/SWIG, this is to work around the swig's stub that seems to 
-  mess up the transformation from abac_chunk_t to chunk_t and calling of 
-  load_id_chunks to here */
-/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
-    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
-    int ret=abac_verifier_load_id_enc_privkey_chunk(cert_chunk, privkey_chunk, pfile, &id_cert);
-
-    if(id_cert) {
-        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
-    }
-    return ret;
-}
-
-
-
-/**
- * Load an attribute cert from an abac_attribute_t.
- */
-int abac_context_load_attribute_attribute(abac_context_t *ctx, abac_attribute_t *ptr)
-{
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL);
-
-    ret = abac_verifier_load_attribute_cert_attribute(ptr, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-
-}
-
-/**
- * Load an attribute cert from a file.
- */
-int abac_context_load_attribute_file(abac_context_t *ctx, char *filename) {
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL); assert(filename != NULL);
-
-    ret = abac_verifier_load_attribute_cert_file(filename, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-}
-
-/**
- * Load an attribute cert from a chunk.
- */
-int abac_context_load_attribute_chunk(abac_context_t *ctx, abac_chunk_t cert) {
-    int ret, add_ret;
-    abac_credential_t *cred=NULL;
-
-    assert(ctx != NULL);
-
-    chunk_t cert_chunk = { cert.ptr, cert.len };
-
-    ret = abac_verifier_load_attribute_cert_chunk(cert_chunk, &cred);
-    if (ret == ABAC_CERT_SUCCESS) {
-        add_ret = abac_pl_add_credential(ctx->pl, cred);
-        assert(add_ret != ABAC_PL_CRED_INVALID);
-    }
-
-    return ret;
-}
-
-#define KEY_PAT "/*_private.{der,pem}"
-#define ID_PAT "/*_ID.{der,pem}"
-#define ATTR_PAT "/*_attr.der"
-#define IDKEY_PAT "/*_IDKEY.{der,pem}"
-
-char *_make_key_filename(char *cert_file)
-{
-    char *p=strstr(cert_file,"_ID.");
-    char *head=strndup(cert_file,p-cert_file);
-    char *tail=p+4;
-    char *keyfile=NULL;
-    asprintf(&keyfile,"%s_private.%s",head,tail);
-    free(head);
-    return keyfile;
-}
-
-/**
- * Load a directory full of principal certs.
- */
-void abac_context_load_principals(abac_context_t *ctx, char *path) {
-    char *glob_pat, *key_pat;
-    glob_t glob_buf;
-    int i, ret;
-
-    assert(ctx != NULL); assert(path != NULL);
-
-    int dirlen = strlen(path);
-
-    /* make sure pick the larger one */
-    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
-    memcpy(glob_pat, path, dirlen);
-
-    // load ID certs
-    memcpy(glob_pat + dirlen, ID_PAT, sizeof(ID_PAT));
-    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        /* blah_ID.pem */
-        char *cert_file = glob_buf.gl_pathv[i];
-        /* blah_private.pem */
-        char *key_file=_make_key_filename(cert_file);
-        if(debug) {
-            fprintf(stderr,"--> ID cert... %s\n", cert_file);
-            fprintf(stderr,"--> KEY cert... %s\n", key_file);
-        }
-        ret = abac_context_load_id_id_file_key_file(ctx, cert_file, key_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load ID cert %s", cert_file);
-    }
-    globfree(&glob_buf);
-
-    // next load IDKEY certs
-    memcpy(glob_pat + dirlen, IDKEY_PAT, sizeof(IDKEY_PAT));
-    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        /* blah_IDKEY.pem */
-        char *certkey_file = glob_buf.gl_pathv[i];
-        if(debug) fprintf(stderr, "--> IDKEY certkey... %s\n", certkey_file);
-        ret = abac_context_load_id_idkey_file(ctx, certkey_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load ID/KEY IDKEY cert %s", certkey_file);
-    }
-    globfree(&glob_buf);
-
-    free(glob_pat);
-}
-
-/**
- * Load a directory full of certs.
- */
-void abac_context_load_directory(abac_context_t *ctx, char *path) {
-    char *glob_pat, *key_pat;
-    glob_t glob_buf;
-    int i, ret;
-
-    abac_context_load_principals(ctx,path);
-    int dirlen = strlen(path);
-
-    /* make sure pick the larger one */
-    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
-    memcpy(glob_pat, path, dirlen);
-
-    memcpy(glob_pat + dirlen, ATTR_PAT, sizeof(ATTR_PAT));
-    glob(glob_pat, 0, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        char *cert_file = glob_buf.gl_pathv[i];
-
-        if(debug) fprintf(stderr,"--> attr file... (%s)\n", cert_file);
-        ret = abac_context_load_attribute_file(ctx, cert_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load attribute cert --%s", cert_file);
-        if(debug) fprintf(stderr,"Loaded.. (%s)\n", cert_file);
-    }
-    globfree(&glob_buf);
-
-    free(glob_pat);
-}
-
-/**
- * Run a query on the data in an abac context. Returns a NULL-terminated array
- * of abac_credential_t. Success/failure in *success.
- * queryfor(either role or oset), with(either keyid or object type)
- */
-abac_credential_t **abac_context_query(abac_context_t *ctx, char *queryfor, char *with, int *success) {
-    if(debug) fprintf(stderr,"abac_context_query about(%s) with(%s)\n", queryfor, with);
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL); assert(queryfor != NULL);
-    assert(with != NULL); assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query(ctx->pl, queryfor, with);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-       if(!abac_pl_returning_partial(ctx->pl))
-            *success = 1;
-            else *success = 0;
-    } else {
-	*success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-/**
- * Run a repeated query on the data in an abac context to get the next
- * solution proof. Returns a NULL-terminated array
- * of abac_credential_t. Success/failure in *success.
- */
-abac_credential_t **abac_context_query_again(abac_context_t *ctx, int *success)
-{
-    if(debug) fprintf(stderr,"abac_context_query_again\n");
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL);
-    assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query_again(ctx->pl);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-        *success = 1;
-        } else {
-            *success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-
-abac_credential_t **abac_context_query_with_structure(abac_context_t *ctx,
-abac_aspect_t *queryfor, abac_aspect_t *with, int *success)
-{
-    if(debug) fprintf(stderr,"abac_context_query_with_structure\n");
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL); assert(queryfor != NULL);
-    assert(with != NULL); assert(success != NULL);
-
-    abac_stack_t *result = abac_pl_query_with_structure(ctx->pl, queryfor, with);
-
-    int size = abac_stack_size(result);
-    if (size > 0) {
-        *success = 1;
-    } else {
-    // XXX NOT SURE YET..
-    // return partial proof
-	*success = 0;
-    }
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-
-    return credentials;
-}
-
-/**
- * A NULL-terminated array of all the credentials in the context.
- */
-abac_credential_t **abac_context_credentials(abac_context_t *ctx) {
-    abac_credential_t **credentials = NULL, *cur;
-    assert(ctx != NULL);
-
-    abac_stack_t *result = abac_pl_credentials(ctx->pl);
-    int size = abac_stack_size(result);
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_credential_t *) abac_stack_pop(result);
-            /* if not in there yet, add into it */
-            credentials[i++] = cur;
-        } 
-    }
-    credentials[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-    return credentials;
-}
-
-/**
- * Frees a NULL-terminated list of credentials.
- */
-void abac_context_credentials_free(abac_credential_t **credentials) {
-    int i;
-
-    if (credentials == NULL)
-        return;
-
-    for (i = 0; credentials[i] != NULL; ++i)
-        abac_credential_free(credentials[i]);
-    free(credentials);
-}
-
-/**
- * A NULL-terminated array of all the principals in the context.
- */
-abac_id_credential_t **abac_context_principals(abac_context_t *ctx) {
-    abac_id_credential_t **principals = NULL, *cur;
-    assert(ctx != NULL);
-
-    abac_stack_t *result = abac_pl_principals(ctx->pl);
-
-    int size = abac_stack_size(result);
-
-    // make the array (leave space to NULL terminate it)
-    //      n.b., even if the list is empty, we still return an array that
-    //            only contains the NULL terminator
-    principals = abac_xmalloc(sizeof(abac_id_credential_t *) * (size + 1));
-    int i = 0;
-    if(size) {
-        while(i<size) { 
-            cur=(abac_id_credential_t *) abac_stack_pop(result);
-            /* if not in there yet, add into it */
-            principals[i++] = cur;
-        } 
-    }
-    principals[i] = NULL;
-
-    if(result)
-        abac_stack_free(result);
-    return principals;
-}
-
-/**
- * Frees a NULL-terminated list of principals.
- */
-void abac_context_principals_free(abac_id_credential_t **principals) {
-    int i;
-
-    if (principals == NULL)
-        return;
-
-    for (i = 0; principals[i] != NULL; ++i)
-        abac_id_credential_free(principals[i]);
-    free(principals);
-}
-
-/**
- * 
- */
-abac_id_credential_t *abac_context_principal_lookup(abac_context_t *ctx, char *name)
-{
-    assert(ctx != NULL);
-    abac_id_credential_t *principal=abac_id_credential_lookup(name);
-    return principal;
-}
-
-void abac_context_set_no_partial_proof(abac_context_t *ctx)
-{ abac_pl_set_no_partial(ctx->pl); }
-
-void abac_context_set_want_partial_proof(abac_context_t *ctx)
-{ abac_pl_set_want_partial(ctx->pl); }
-
Index: libabac/abac.h
===================================================================
--- libabac/abac.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -2,226 +2,10 @@
 #define __ABAC_H__
 
+/* libabac routines called from abac.hh */
 #include <stdlib.h>
 #include <stdbool.h>
-#include <abac_common.h>
 
-typedef struct _abac_context_t abac_context_t;
-
-typedef struct _abac_credential_t abac_credential_t;
-typedef struct _abac_aspect_t abac_aspect_t;
-typedef struct _abac_attribute_t abac_attribute_t;
-typedef struct _abac_id_t abac_id_t;
-typedef struct _abac_id_credential_t abac_id_credential_t;
-
-typedef struct _abac_condition_t abac_condition_t;
-typedef struct _abac_term_t abac_term_t;
-typedef struct _abac_item_t abac_item_t;
-typedef struct _abac_param_list_t abac_param_list_t;
-typedef struct _abac_key_t abac_key_t;
-
-/* called within abac.hh */
-char *abac_version();
-void abac_errx(int,const char *);
-abac_condition_t *abac_condition_dup(abac_condition_t *ptr);
-void abac_condition_free(abac_condition_t *ptr);
-char *abac_constraint_string(abac_condition_t *ptr);
-char *abac_constraint_typed_string(abac_condition_t *ptr);
-int file_exist(char *filename);
-
-void abac_terms_free(abac_term_t **terms);
-abac_term_t *abac_term_dup(abac_term_t *ptr);
-void abac_term_free(abac_term_t *);
-abac_term_t *abac_term_named_create(char*);
-abac_term_t *abac_term_create(char*, char*, abac_condition_t*);
-abac_term_t *abac_term_id_create(abac_id_t *ptr);
-abac_term_t *abac_term_dup(abac_term_t *ptr);
-char *abac_term_typed_string(abac_term_t *ptr);
-char *abac_term_string(abac_term_t *ptr);
-int abac_term_is_time(abac_term_t *);
-int abac_term_is_urn(abac_term_t *term);
-int abac_term_is_integer(abac_term_t *term);
-int abac_term_is_string(abac_term_t *term);
-abac_term_t *abac_term_add_constraint(abac_term_t *ptr, abac_condition_t *cond);
-int abac_term_type(abac_term_t *term);
-char *abac_term_name(abac_term_t *);
-
-void abac_aspects_free(abac_aspect_t **aspects);
-abac_aspect_t *abac_aspect_dup(abac_aspect_t *ptr);
-void abac_aspect_free(abac_aspect_t *);
-char *abac_aspect_string(abac_aspect_t *ptr);
-char *abac_aspect_typed_string(abac_aspect_t *ptr);
-
-abac_param_list_t *abac_aspect_aspect_params(abac_aspect_t *ptr);
-abac_term_t **abac_param_list_vectorize(abac_param_list_t *ptr);
-abac_param_list_t *abac_aspect_linked_role_params(abac_aspect_t *ptr);
-char *abac_oset_string(abac_aspect_t *ptr);
-char *abac_oset_typed_string(abac_aspect_t *ptr);
-char *abac_role_string(abac_aspect_t *ptr);
-char *abac_role_typed_string(abac_aspect_t *ptr);
-
-void abac_id_print_key_chunk(abac_id_t *id);
-char *abac_id_cert_filename(abac_id_t *id);
-char *abac_id_privkey_filename(abac_id_t *id);
-char *abac_id_subject(abac_id_t *id);
-char *abac_id_issuer(abac_id_t *id);
-abac_id_t *abac_id_dup(abac_id_t *id);
-abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr);
-abac_id_t *abac_id_from_file(char *filename);
-abac_id_t *abac_id_from_chunk(abac_chunk_t);
-int abac_id_generate(abac_id_t **ret, char *cn, int validity);
-int abac_id_generate_with_key(abac_id_t **ret, char *cn, int validity, char *keyfile, char *pfile);
-char *abac_id_keyid(abac_id_t *id);
-char *abac_id_cn(abac_id_t *id);
-void abac_id_free(abac_id_t *id);
-int abac_id_has_privkey(abac_id_t *id);
-void abac_id_write_cert(abac_id_t *id, FILE *out);
-int abac_id_write_privkey(abac_id_t *id, FILE *out);
-abac_chunk_t abac_id_cert_chunk(abac_id_t *id);
-abac_chunk_t abac_id_privkey_chunk(abac_id_t *id);
-char *abac_id_string(abac_id_t *id);
-int abac_id_load_privkey_file(abac_id_t *id, char *filename);
-void abac_id_write_cert_fname(abac_id_t *id, char *filename);
-void abac_id_write_privkey_fname(abac_id_t *id, char *filename);
-int abac_id_load_encrypted_privkey_file(abac_id_t *ptr, char *filename, 
-char *pfile);
-
-abac_key_t *abac_key_generate();
-
-abac_attribute_t *abac_attribute_dup(abac_attribute_t *ptr);
-void abac_attribute_free(abac_attribute_t *ptr);
-abac_attribute_t *abac_credential_attribute(abac_credential_t *cred);
-int abac_attribute_create(abac_attribute_t **ret,abac_aspect_t *head, abac_aspect_t *tail,int validity);
-abac_attribute_t *abac_attribute_add_tail(abac_attribute_t *ptr, abac_aspect_t *);
-char *abac_attribute_string(abac_attribute_t *ptr);
-char *abac_attribute_typed_string(abac_attribute_t *ptr);
-abac_attribute_t *abac_attribute_from_chunk(abac_chunk_t achunk);
-
-abac_aspect_t *abac_attribute_head(abac_attribute_t *ptr);
-abac_aspect_t *abac_attribute_tail(abac_attribute_t *ptr);
-
-int abac_attribute_is_role(abac_attribute_t *ptr);
-abac_aspect_t **abac_attribute_tail_vectorized(abac_attribute_t *ptr);
-int abac_attribute_bake(abac_attribute_t *ptr);
-int abac_attribute_baked(abac_attribute_t *ptr);
-int abac_attribute_write_cert(abac_attribute_t *ptr, FILE *out);
-abac_chunk_t abac_attribute_cert_chunk(abac_attribute_t *ptr);
-void abac_attribute_write_cert_fname(abac_attribute_t *,char*);
-
-abac_id_credential_t *abac_context_principal_lookup(abac_context_t *ctx, char *name);
-void abac_context_principals_free(abac_id_credential_t **principals);
-abac_context_t *abac_context_new(void);
-abac_context_t *abac_context_dup(abac_context_t *ctx);
-void abac_context_free(abac_context_t *ctx);
-void abac_context_free_now(abac_context_t *ctx);
-int abac_context_load_encrypted_id_file(abac_context_t *ptr, char *filename,
-char *pfile);
-int abac_context_load_encrypted_id_files(abac_context_t *ptr, char *filename,
-char *keyfilename, char *pfile);
-int abac_context_load_id_enc_privkey_chunk(abac_context_t *ctx,
-abac_chunk_t cert, abac_chunk_t privkey, char *pfile); 
-
-void show_yap_db(const char *msg);
-
-abac_credential_t **abac_context_query(abac_context_t *ctx, char *role, char *principal, int *success);
-abac_credential_t **abac_context_query_again(abac_context_t *ctx, int *success);
-abac_credential_t **abac_context_query_with_structure(abac_context_t *, abac_aspect_t*, abac_aspect_t*, int*);
-void abac_context_credentials_free(abac_credential_t **);
-abac_credential_t **abac_context_credentials(abac_context_t *);
-abac_id_credential_t **abac_context_principals(abac_context_t *);
-
-/*
- * Error codes for loading certificates.
- */
-#define ABAC_CERT_SUCCESS           0   // certificate loaded, all is well
-#define ABAC_CERT_INVALID           -1  // invalid format; also file not found
-#define ABAC_CERT_BAD_SIG           -2  // invalid signature
-#define ABAC_CERT_MISSING_ISSUER    -3  // missing ID cert that issued the attribute cert
-#define ABAC_CERT_BAD_CN            -4  // ID cert is not matching CN=principal format
-#define ABAC_CERT_BAD_YAP           -5  // failed to insert into prolog engine
-#define ABAC_CERT_EXISTS            1   // ID already exists (does not default to a failure)
-
-#define ABAC_ID_SUCCESS                     0
-#define ABAC_ID_GENERATE_INVALID_CN        -1
-#define ABAC_ID_GENERATE_INVALID_VALIDITY  -2
-
-#define ABAC_ATTRIBUTE_SUCCESS              0
-#define ABAC_ATTRIBUTE_INVALID_ROLE        -1
-#define ABAC_ATTRIBUTE_INVALID_VALIDITY    -2
-#define ABAC_ATTRIBUTE_ISSUER_NOKEY        -3
-#define ABAC_ATTRIBUTE_FAIL                -4
-
-#define ABAC_TERM_SUCCESS                   0
-#define ABAC_TERM_FAIL                     -1
-
-#define USE(evalue) ((getenv(evalue)!=NULL)?1:0)
-
-/* from abac_c.c, the c interface */
-void abac_constraint_add_integer_max(abac_condition_t *cond,int val);
-void abac_constraint_add_integer_min(abac_condition_t *cond,int val);
-void abac_constraint_add_integer_target(abac_condition_t *cond,int val);
-void abac_constraint_add_float_max(abac_condition_t *cond,float val);
-void abac_constraint_add_float_min(abac_condition_t *cond,float val);
-void abac_constraint_add_float_target(abac_condition_t *cond,float val);
-void abac_constraint_add_time_max(abac_condition_t *cond,char* val);
-void abac_constraint_add_time_min(abac_condition_t *cond,char* val);
-void abac_constraint_add_time_target(abac_condition_t *cond,char* val);
-void abac_constraint_add_urn_target(abac_condition_t *cond,char* val);
-void abac_constraint_add_string_target(abac_condition_t *cond,char* val);
-void abac_constraint_add_boolean_target(abac_condition_t *cond, char* val);
-abac_condition_t *abac_constraint_from_role(abac_aspect_t *ptr);
-abac_condition_t *abac_constraint_from_oset(abac_aspect_t *ptr);
-abac_condition_t *abac_constraint_create(char *vtype);
-
-abac_aspect_t *abac_role_principal_create(char *principal_name);
-abac_aspect_t *abac_oset_principal_create(char *principal_name);
-abac_aspect_t *abac_oset_create(char *principal_name, char *oset_name);
-abac_aspect_t *abac_role_create(char *principal_name, char *role_name);
-abac_aspect_t *abac_oset_linked_create(char *principal_name, char* linked_role_name, char *oset_name);
-abac_aspect_t *abac_role_linked_create(char *principal_name, char* linked_role_name, char *role_name);
-abac_aspect_t *abac_oset_object_create(abac_term_t *object);
-abac_aspect_t *abac_oset_create(char *principal_name, char *oset_name);
-int abac_oset_is_object(abac_aspect_t *ptr);
-int abac_oset_is_principal(abac_aspect_t *ptr);
-int abac_role_is_principal(abac_aspect_t *ptr);
-int abac_oset_is_linking(abac_aspect_t *ptr);
-int abac_role_is_linking(abac_aspect_t *ptr);
-char *abac_role_linked_role(abac_aspect_t *ptr);
-char *abac_oset_linked_role(abac_aspect_t *ptr);
-char *abac_role_name(abac_aspect_t *ptr);
-char *abac_oset_name(abac_aspect_t *ptr);
-char *abac_role_principal(abac_aspect_t *ptr);
-char *abac_oset_principal(abac_aspect_t *ptr);
-void abac_role_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
-void abac_oset_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
-void abac_role_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
-void abac_oset_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
-char *abac_oset_object(abac_aspect_t *ptr);
-abac_term_t **abac_role_get_linked_data_terms(abac_aspect_t *ptr);
-abac_term_t **abac_role_get_data_terms(abac_aspect_t *ptr);
-abac_term_t **abac_oset_get_linked_data_terms(abac_aspect_t *ptr);
-abac_term_t **abac_oset_get_data_terms(abac_aspect_t *ptr);
-abac_aspect_t **abac_attribute_role_tails(abac_attribute_t *ptr);
-abac_aspect_t **abac_attribute_oset_tails(abac_attribute_t *ptr);
-
-
-char *abac_head_string(abac_attribute_t *ptr);
-char *abac_tail_string(abac_attribute_t *ptr);
-char *abac_head_typed_string(abac_attribute_t *ptr);
-char *abac_tail_typed_string(abac_attribute_t *ptr);
-
-int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert);
-int abac_context_load_id_privkey_chunk(abac_context_t *ctx, abac_chunk_t cert, abac_chunk_t privkey);
-int abac_context_load_attribute_file(abac_context_t *ctx, char *filename);
-int abac_context_load_id(abac_context_t *ptr, abac_id_t *id);
-int abac_context_load_id_file(abac_context_t *ptr, char *filename);
-int abac_context_load_id_files(abac_context_t *ptr, char *filename, char *keyfilename);
-int abac_context_load_attribute(abac_context_t *ptr, abac_attribute_t *attr);
-void abac_context_load_directory(abac_context_t *ctx, char *path);
-void abac_context_load_principals(abac_context_t *ctx, char *path);
-int abac_context_load_attribute_chunk(abac_context_t *ctx, abac_chunk_t cert);
-void abac_context_set_no_partial_proof(abac_context_t *ctx);
-void abac_context_set_want_partial_proof(abac_context_t *ctx);
-
-int file_exist(char *filename);
+#include "abac_defines.h"
+#include "abac_external.h"
 
 #endif /* __ABAC_H__ */
Index: libabac/abac.hh
===================================================================
--- libabac/abac.hh	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac.hh	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -14,4 +14,16 @@
     class ID;
 
+/***
+ABAC::dump_yap_db()
+   Dump the complete yap prolog database
+   (C:show_yap_db)
+ABAC::dump_debug_info()
+   Dump debug info on whole session
+   (C:show_debug_info)
+***/
+   void dump_yap_db()
+   { show_yap_db("dump_yap"); }
+   void dump_debug_info(const char *msg)
+   { show_debug_info(msg); }
 /*** 
 ABAC::Constraint
@@ -30,6 +42,8 @@
 f  Constraint(const Constraint &)
      copy constructor, used for cloning a constraint
+     (C:abac_condition_dup)
 f  ~Constraint()
      default destructor
+     (C:abac_condition_free)
 ***/
             Constraint() : m_constraint(NULL) { }
@@ -63,6 +77,6 @@
      (C:abac_constraint_create)
 ***/
-            Constraint(Role& role);
-            Constraint(Oset& oset);
+            Constraint(Role& role); /* defined later in the class */
+            Constraint(Oset& oset); /* defined later in the class */
             Constraint(char *vartype)
             { m_constraint=abac_constraint_create(vartype); }
@@ -70,4 +84,5 @@
 f  Constraint(abac_condition_t *)
      internal constructor that takes an abac_condition_t structure
+     (C:abac_condition_dup)
 **ii*/
             Constraint(abac_condition_t *constraint):
@@ -164,7 +179,7 @@
 f  abac_condition_t *constraint()
      internal returns internal constraint structure
+     (S:abac_condition_t)
 **ii*/
-            abac_condition_t *constraint()
-            { return m_constraint; }
+            abac_condition_t *constraint() { return m_constraint; }
         private:
             abac_condition_t *m_constraint;
@@ -186,4 +201,5 @@
      "principal"
      "anonymous"
+     "this"
 ***/
     class DataTerm {
@@ -194,6 +210,8 @@
 f  DataTerm(const DataTerm &)
      copy constructor, used for cloning a data term
+     (C:abac_term_dup)
 f  ~DataTerm()
      default destructor
+     (C:abac_term_free)
 ***/
             DataTerm() : m_term(NULL) { } // do not use: here for swig
@@ -207,4 +225,5 @@
 f  DataTerm(abac_term_t *)
      internal constructor to make data term from abac_term_t structure
+     (C:abac_term_dup)
 **ii*/
             DataTerm(abac_term_t *term)
@@ -213,14 +232,16 @@
 f  DataTerm(char*)
      constructor to make named principal data term for the oset RHS 
-     (C: abac_term_named_create)
+     if "this" is supplied, a term with tyep=e_TERM_THIS is created
+     if "anonymous" is supplied, a term with type=e_TERM_ANONYMOUS is created
+     (C:abac_term_named_create)
 f  DataTerm(const ID&)
      constructor to make named principal data term for parameter term
-     (C: abac_term_id_create)
+     (C:abac_term_id_create)
 f  DataTerm(char*, char*, Constraint*)
      constructor for making a variable data term 
-     (C: abac_term_create)
+     (C:abac_term_create)
 f  DataTerm(char*, char*)
      constructor for making an instantiated data term
-     (C: abac_term_create)
+     (C:abac_term_create)
 ***/
             DataTerm(char *name) {
@@ -228,5 +249,5 @@
               m_term=abac_term_named_create(name);
             }
-            DataTerm(ID& id);
+            DataTerm(ID& id); /* defined later in the class */
             DataTerm(char* typenm, char *name, Constraint *cond) {
               if(debug) printf("adding a Dataterm (%s)\n",name);
@@ -292,7 +313,7 @@
 f  abac_term_t *term()
      returns abac_term_t term structure
+     (S:abac_term_t)
 **ii*/
-            abac_term_t *term() 
-            { return m_term; }
+            abac_term_t *term() { return m_term; }
         private:
             abac_term_t *m_term;
@@ -311,6 +332,8 @@
 f  Role(const Role &)
      copy constructor, used for cloning a role
+     (C:abac_aspect_dup)
 f  ~Role()
      default destructor
+     (C:abac_aspect_free)
 ***/
             Role() : m_role(NULL) { } // do not use: here for swig
@@ -324,4 +347,5 @@
 f  Role(abac_aspect_t*)
      constructor that takes an abac_aspect_t structure
+     (C:abac_aspect_dup)
 **ii*/
             Role(abac_aspect_t *role): m_role(abac_aspect_dup(role))
@@ -440,4 +464,5 @@
      return the data terms bound to this role's linking role.
      (C:abac_role_get_linked_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -456,4 +481,5 @@
 f  abac_aspect_t *role()
      returns the interal libabac representation of this role
+     (S:abac_aspect_t)
 **ii*/
             abac_aspect_t *role() {return m_role;}
@@ -473,6 +499,8 @@
 f  Oset(const Oset &)
      copy constructor, used for cloning an oset
+     (C:abac_aspect_dup)
 f  ~Oset()
      default destructor
+     (C:abac_aspect_free)
 ***/
             Oset() : m_oset(NULL) { } // do not use: here for swig
@@ -484,4 +512,5 @@
 f  Oset(abac_aspect_t *)
      constructor that takes abac_aspect_t structure
+     (C:abac_aspect_dup)
 **ii*/
             Oset(abac_aspect_t *oset): m_oset(abac_aspect_dup(oset)) 
@@ -490,8 +519,8 @@
 f  Oset(char *)
      constructor that makes a principal oset, ie [keyid:B]
-     (C:abac_role_principal_create)
+     (C:abac_oset_principal_create)
 f  Oset(char *, char *)
      constructor that makes a regular oset, ie. [keyid:B].oset:o
-     (C:abac_role_create)
+     (C:abac_oset_create)
 f  Oset(char *, char*, char *)
      constructor that makes a linked oset, ie. [keyid:B].role:r.oset:o
@@ -595,4 +624,5 @@
      returns the data terms bound to this oset.  
      (C:abac_oset_get_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_data_terms(bool &success) {
@@ -620,4 +650,5 @@
      returns the data terms bound to this oset's linking role.  
      (C:abac_oset_get_linked_data_terms)
+     (C::abac_terms_free)
 ***/
             std::vector<DataTerm> get_linked_data_terms(bool &success) {
@@ -636,4 +667,5 @@
 f  abac_aspect_t *oset()
      internal returns the internal libabac representation of the oset
+     (S:abac_aspect_t)
 **ii*/
             abac_aspect_t *oset() {return m_oset;}
@@ -656,6 +688,8 @@
 f  ID(const ID &)
      copy constructor, used for cloning an ID
+     (C:abac_id_dup)
 f  ~ID()
      default destructor
+     (C:abac_id_free)
 ***/
             ID() : m_id(NULL) { } // do not use: here for swig
@@ -665,6 +699,9 @@
 f  ID(abac_id_t *)
      constructor from abac_id_t
+     (C:abac_id_dup)
 f  ID(abac_id_credential_t *)
      constructor from abac_id_credential_t
+     (C:abac_id_credential_id)
+     (S::abac_id_credential_t)
 **ii*/
             ID(abac_id_t *id): m_id(abac_id_dup(id)) 
@@ -721,4 +758,5 @@
      - CN must be alphanumeric and begin with a letter
      - validity must be at least one second
+     - optional passphrase is when the keyfile is encrypted
      will throw an exception if either of the above is violated 
      (C:abac_id_generate_with_key)
@@ -748,15 +786,8 @@
 ***/
             void id_load_encrypted_privkey_file(char *filename, char* pfile) {
-              int rt=abac_id_load_encrypted_privkey_file(m_id, filename, pfile);
+              int rt=abac_id_load_enc_privkey_file(m_id, filename, pfile);
               if(rt != 1) 
                 abac_errx(1, "Failed to load private key");
             }
-/*ii**
-f  abac_id_t *id()
-     returns the abac_id_t 
-     returns the interal libabac representation of this id
-**ii*/
-            abac_id_t *id() { return m_id; }
-
 /***
 f  char *id_keyid()
@@ -825,6 +856,4 @@
             abac_chunk_t id_privkey_chunk()
             { return abac_id_privkey_chunk(m_id); }
-            void print_key_chunk()
-            { abac_id_print_key_chunk(m_id); } 
 /***
 f  char *string()
@@ -834,5 +863,11 @@
             char *string()
             { return abac_id_string(m_id); }
-        public:
+/*ii**
+f  abac_id_t *id()
+     returns the interal libabac representation of this id
+     (S:abac_id_t)
+**ii*/
+            abac_id_t *id() { return m_id; }
+        private:
             abac_id_t *m_id;
     };
@@ -857,6 +892,8 @@
 f  Attribute(const Attribute &)
      copy constructor, used for cloning an attribute
+     (C:abac_attribute_dup)
 f  ~Attribute()
      default destructor
+     (C:abac_attribute_free)
 ***/
             Attribute() : m_attr(NULL) { } 
@@ -868,6 +905,10 @@
 f  Attribute(abac_attribute_t *)
      constructor that takes abac_attribute_t, locally used
+     (C:abac_attribute_dup)
 f  Attribute(abac_credential_t *)
      constructor that takes abac_credential_t, locally used 
+     (C:abac_attribute_dup)
+     (C::abac_credential_attribute)
+     (S::abac_credential_t)
 **ii*/
             Attribute(abac_attribute_t *attr): m_attr(abac_attribute_dup(attr)) 
@@ -924,4 +965,8 @@
       Add an oset tail.  Call multiple times for intersection
      (C:abac_attribute_add_tail)
+f  void attribute_set_using_this()
+      Allow user set whether this attribute has '?This' in its
+      attribute rule
+     (C:abac_attribute_set_using_this)
 ***/
             bool attribute_add_tail(Role& tail) {
@@ -935,4 +980,8 @@
                   else return 0;
             }
+            void attribute_set_using_this() {
+              abac_attribute_set_using_this(m_attr,1);
+            }
+/***
 /***
 f  char *head_string()
@@ -975,6 +1024,8 @@
 f  const Role &role_head()
      returns the head role
+     (C:abac_attribute_head)
 f  const Oset &oset_head()
      returns the oset head
+     (C:abac_attribute_head)
 ***/
             const Role &role_head() {
@@ -984,5 +1035,5 @@
             }
             const Oset &oset_head() {
-              abac_aspect_t *head=abac_attribute_tail(m_attr);
+              abac_aspect_t *head=abac_attribute_head(m_attr);
               static Oset oset=Oset(head);
               return oset;
@@ -992,7 +1043,11 @@
      retrieve tail role which maybe more than 1 if intersecting
      (C:abac_attribute_role_tails)
+     (C::abac_attribute_is_role)
+     (C::abac_aspects_free)
 f  std::vector<Oset> oset_tails(bool &)
      retrieve tail oset which maybe more than 1 if intersecting
      (C:abac_attribute_oset_tails)
+     (C::abac_attribute_is_role)
+     (C::abac_aspects_free)
 ***/
             std::vector<Role> role_tails(bool &success) {
@@ -1030,10 +1085,4 @@
               return osets;
             }
-/*ii**
-f  abac_attribute_t *attribute()
-      return libabac structure for attribute
-**ii*/
-            abac_attribute_t *attribute() { return m_attr; }
-
 /***
 f  bool attribute_bake()
@@ -1088,4 +1137,10 @@
             abac_chunk_t cert_chunk()
             { return abac_attribute_cert_chunk(m_attr); }
+/*ii**
+f  abac_attribute_t *attribute()
+      return libabac structure for attribute
+      (S:abac_attribute_t)
+**ii*/
+            abac_attribute_t *attribute() { return m_attr; }
       private:
             abac_attribute_t *m_attr;
@@ -1102,19 +1157,19 @@
 f  Context()
      default constructor
+     (C:abac_context_new)
 f  Context(const Context &)
      copy constructor, used for cloning the context
+     (C:abac_context_dup)
 f  ~Context()
      default destructor
-f  void free_context_now()
-     Explicitly freeing the the context. This is to prevent libstrongswan's 
-     mainthread from GC'ed by Java. Used with Java/Swig/JNI combination only. 
+     (C:abac_context_free)
 ***/
             Context() { 
               m_ctx = abac_context_new();
-              m_abac_version=strdup(abac_version());
+              m_abac_version=abac_xstrdup(abac_version());
             }
             Context(const Context &context) { 
               m_ctx = abac_context_dup(context.m_ctx);
-              m_abac_version=strdup(context.m_abac_version);
+              m_abac_version=abac_xstrdup(context.m_abac_version);
             }
             ~Context() { 
@@ -1122,21 +1177,4 @@
               if(m_ctx!=NULL) abac_context_free(m_ctx);
             }
-           void free_context_now() {
-              if(m_ctx!=NULL) {
-                  abac_context_free_now(m_ctx);
-                  m_ctx=NULL;
-              }
-              if(m_abac_version!=NULL) {
-                 free(m_abac_version);
-                 m_abac_version=NULL;
-              }
-            } 
-/***
-f  void dump_yap_db()
-     dump the complete yap prolog database
-     (C:show_yap_db)
-***/
-            void dump_yap_db()
-            { show_yap_db("dump_yap"); }
 /***
 f  int load_id(ABAC::ID&)
@@ -1146,5 +1184,5 @@
      load id cert from an idkey combo file. key retrieval will be attempted
      but won't fail if not found
-     (C:abac_context_load_id_file)
+     (C:abac_context_load_id_idkey_file)
 f  int load_id_encrypted_file(char *, char *)
      load id cert from an idkey combo file and a pfile. Encrypted key
@@ -1174,5 +1212,5 @@
             { return abac_context_load_id(m_ctx, id.id()); }
             int load_id_file(char *filename)
-            { return abac_context_load_id_file(m_ctx, filename); }
+            { return abac_context_load_id_idkey_file(m_ctx, filename); }
             int load_id_encrypted_file(char *filename, char *pfile)
             { return abac_context_load_encrypted_id_file(m_ctx, filename, pfile); }
@@ -1249,8 +1287,11 @@
      in non ABAC_CN mode  
      (C:abac_context_query)
+     (C::abac_free_credentials)
 f  std::vector<Attribute> query(Role &, Role &, bool &)
      (C:abac_context_query_with_structure)
+     (C::abac_free_credentials)
    std::vector<Attribute> query(Oset &, Oset &, bool &)
      (C:abac_context_query_with_structure)
+     (C::abac_free_credentials)
      runs the query:
        role <-?- principal
@@ -1267,4 +1308,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1274,5 +1317,5 @@
                if(debug) printf("query, got rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1286,4 +1329,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1292,5 +1337,5 @@
                std::vector<Attribute> attributes = std::vector<Attribute>(creds, end);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1304,4 +1349,6 @@
                success = success_int;
 
+               if(debug) printf("query, returning success(%d)\n", success_int);
+
                for (i = 0; creds[i] != NULL; ++i)
                   ;
@@ -1311,5 +1358,5 @@
                if(debug) printf("query, returning rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1319,4 +1366,5 @@
 f  std::vector<Attribute> next_proof(bool &)
      (C:abac_context_query_again)
+     (C::abac_free_credentials)
      force backtrack and try to get next solution proof:
      returns true/false in success
@@ -1337,5 +1385,5 @@
                if(debug) printf("repeat query, got rules(%d)\n", i);
 
-               abac_context_credentials_free(creds);
+               abac_free_credentials(creds);
 
                return attributes;
@@ -1346,4 +1394,8 @@
      extracted from the internal data structure
      (C:abac_context_credentials)
+     (C::abac_free_credentials)
+f  int credential_count()
+     returns the number of credentials loaded in the context currently
+     (C:abac_context_credential_count()
 ***/
             std::vector<Attribute> context_credentials(bool &success) {
@@ -1360,9 +1412,11 @@
               if(debug) printf("credentials, got (%d)\n", i);
 
-              abac_context_credentials_free(creds);
+              abac_free_credentials(creds);
               if(debug) show_yap_db("calling from context_credentials");
               return attributes;
             }
 
+            int credential_count() const 
+              { return abac_context_credential_count(m_ctx); }
 /***
 f  std::vector<Attribute> context_principals(bool &)
@@ -1370,4 +1424,8 @@
      extracted from the internal data structure
      (C:abac_context_principals)
+     (C::abac_free_principals)
+f  int principal_count()
+     returns the number of principals loaded in the context currently
+     (C:abac_context_principal_count()
 ***/
             std::vector<ID> context_principals(bool &success) {
@@ -1384,10 +1442,13 @@
               if(debug) printf("principals, got (%d)\n", i);
 
-              abac_context_principals_free(ids);
+              abac_free_principals(ids);
               return principals;
             }
+            int principal_count() const 
+              { return abac_context_principal_count(m_ctx); }
 /***
 f  ID lookup_principal(char *)
      find a particular principal from the context
+     (C:abac_context_principal_lookup)
 ***/
             ID lookup_principal(char *name) const 
@@ -1406,4 +1467,10 @@
             char *version() const { return m_abac_version; }
 
+/*ii**
+f  abac_context_t *context()
+      return libabac structure for context
+      (S:abac_context_t)
+**ii*/
+            abac_context_t *context() { return m_ctx; }
         private:
             abac_context_t *m_ctx;
Index: libabac/abac_aspect.c
===================================================================
--- libabac/abac_aspect.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_aspect.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -4,13 +4,17 @@
 **/
 
-
 #include <assert.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "abac_internal.h"
+
+#include "abac_defines.h"
+#include "abac_util.h"
+#include "abac_term.h"
+#include "abac_verifier.h"
+#include "abac_list.h"
+#include "abac_context.h"
+#include "abac_id.h"
 
 static int debug=0;
+extern int ABAC_IN_PROLOG;
+
 /*
    A.role <- B
@@ -45,48 +49,10 @@
 };
 
+/* local */
+char *abac_aspect_string_with_condition(abac_aspect_t *);
+char *abac_aspect_typed_string_with_condition(abac_aspect_t *);
+static abac_aspect_t *_abac_aspect_init();
+
 /**************************************************************/
-void abac_aspect_dump(abac_aspect_t *ptr, char* offset)
-{
-    char *tmp=NULL;
-    asprintf(&tmp,"  %s",offset);
-    if(ptr->prereqs != 0) {
-        abac_aspect_t *cur;
-        abac_list_foreach(ptr->prereqs, cur,
-            if(cur)
-               abac_aspect_dump(cur, tmp);
-        );
-        return;
-    }
-
-    printf("\n..... an aspect .....\n");
-    printf("%s aspect_type: %d(%s)\n", offset, ptr->aspect_type, abac_aspect_type_string(ptr));
-    printf("%s is_object: %d\n", offset, ptr->is_object);
-    printf("%s principal_name: %s\n", offset, ptr->principal_name);
-    if(ptr->principal_name_p)
-       printf("%s principal_name_p: %s\n", offset, ptr->principal_name_p);
-       else printf("%s principal_name_p: --\n", offset);
-    if(ptr->principal_object)
-       abac_term_dump(ptr->principal_object, tmp);
-       else ("%s principal_object: --\n", offset);
-    if(ptr->linked_role_name) 
-       printf("%s linked_role_name: %s\n", offset, ptr->linked_role_name);
-       else printf("%s linked_role_name: --\n", offset);
-    if(ptr->linked_role_params)
-       abac_param_dump(ptr->linked_role_params, tmp);
-       else printf("%s linked_role_params: --\n", offset);
-     if(ptr->aspect_name)
-       printf("%s aspect_name: %s\n", offset, ptr->aspect_name);
-       else printf("%s aspect_name: --\n", offset);
-    if(ptr->aspect_params)
-       abac_param_dump(ptr->aspect_params, tmp);
-       else printf("%s aspect_params: --\n", offset);
-    if(ptr->type_string)
-       printf("%s type_string:- %s\n", offset, ptr->type_string);
-       else printf("%s type_string: --\n", offset);
-    printf("%s refcount:- %d\n", offset, ptr->refcount);
-    printf("..................................");
-    free(tmp);
-}
-
 int abac_aspect_is_oset(abac_aspect_t *ptr)
 {
@@ -96,5 +62,4 @@
     return 0;
 }
-
 
 int abac_aspect_is_role(abac_aspect_t *ptr)
@@ -303,4 +268,8 @@
 }
 
+/* currently the issuer's id is extracted from session's
+   master copy instead of checking through context's list first
+   This might allow some loopholes of incomplete validation  somewhere..
+   need to revisit again XXX */
 char* abac_aspect_get_issuer_keytype(abac_aspect_t *ptr)
 {
@@ -344,4 +313,44 @@
 }
 /**
+ * deep copy of aspect
+ */
+abac_aspect_t *abac_aspect_copy(abac_aspect_t *ptr)
+{
+    if(ptr == NULL) return NULL;
+
+    abac_aspect_t *nptr=_abac_aspect_init();
+    nptr->aspect_type=ptr->aspect_type;
+    nptr->is_object=ptr->is_object;
+
+    if(ptr->principal_name)
+        nptr->principal_name=abac_xstrdup(ptr->principal_name);
+    if(ptr->principal_name_p)
+        nptr->principal_name_p=abac_xstrdup(ptr->principal_name_p);
+    if(ptr->principal_object)
+        nptr->principal_object=abac_term_copy(ptr->principal_object);
+
+    if(ptr->linked_role_name)
+        nptr->linked_role_name=abac_xstrdup(ptr->linked_role_name);
+    nptr->linked_role_params=abac_param_list_copy(ptr->linked_role_params);
+
+    if(ptr->aspect_name)
+        nptr->aspect_name=abac_xstrdup(ptr->aspect_name);
+    nptr->aspect_params=abac_param_list_copy(ptr->aspect_params);
+
+    if(ptr->type_string)
+        nptr->type_string=abac_xstrdup(ptr->type_string);
+
+    if (ptr->prereqs != NULL) {
+        nptr->prereqs=abac_list_new();
+        abac_aspect_t *cur=NULL;
+        abac_aspect_t *ncur=NULL;
+        abac_list_foreach(ptr->prereqs, cur,
+            ncur=abac_aspect_copy(cur);
+            abac_list_add(nptr->prereqs,ncur);
+        );
+    }
+    return nptr;
+}
+/**
  * Increase a aspect's reference count.
  */
@@ -440,8 +449,10 @@
     abac_aspect_t *ptr = (abac_aspect_t *) abac_xmalloc(sizeof(abac_aspect_t));
 
+    ptr->aspect_type=e_ASPECTTYPE_NULL;
     ptr->is_object=0;
+
     ptr->principal_name = NULL;
     ptr->principal_name_p = NULL;
-    ptr->aspect_type=e_ASPECTTYPE_NULL;
+    ptr->principal_object = NULL;
 
     ptr->aspect_name = NULL;
@@ -469,5 +480,5 @@
     abac_aspect_t *ptr = _abac_aspect_init();
     ptr->aspect_type=type;
-    ptr->principal_name = strdup(principal_name);
+    ptr->principal_name = abac_xstrdup(principal_name);
     ptr->principal_name_p =  prologIt(principal_name);
     if(type==e_ASPECTTYPE_ROLE)
@@ -531,5 +542,5 @@
     abac_aspect_t *ptr = _abac_aspect_init();
 
-    ptr->principal_name = strdup(principal_name);
+    ptr->principal_name = abac_xstrdup(principal_name);
     ptr->principal_name_p = prologIt(principal_name);
     ptr->aspect_type=type;
@@ -543,6 +554,6 @@
   
     if(debug)
-        fprintf(stderr,"DEBUG:adding a new aspect (%s) to principal (%s)\n",
-                  ptr->aspect_name, ptr->principal_name);
+        fprintf(stderr,"abac_aspect_new:adding a new aspect type(%d) (%s) to principal (%s)\n",
+                  type, ptr->aspect_name, ptr->principal_name);
     return ptr;
 }
@@ -586,10 +597,9 @@
     ptr->is_object=0;
     ptr->aspect_type=type;
-    ptr->principal_name = strdup(principal_name);
+    ptr->principal_name = abac_xstrdup(principal_name);
     ptr->principal_name_p = prologIt(principal_name);
 
-    ptr->linked_role_name = strdup(linked_role_name);
-    ptr->aspect_name = strdup(aspect_name);
-    ptr->aspect_params = NULL;
+    ptr->linked_role_name = abac_xstrdup(linked_role_name);
+    ptr->aspect_name = abac_xstrdup(aspect_name);
 
     if(debug)
@@ -628,5 +638,4 @@
     abac_list_add(prereqs, abac_aspect_dup(aspect));
     ptr->prereqs = prereqs;
-    ptr->refcount = 1;
     return ptr;
 }
@@ -745,4 +754,12 @@
 }
 
+void abac_print_aspect_typed_string_with_condition(abac_aspect_t *ptr,FILE *fp)
+{
+    char *string=abac_aspect_typed_string_with_condition(ptr);
+    if(fp==NULL)
+        printf("%s ",string);
+        else fprintf(fp,"%s ",string);
+}
+
 int abac_aspect_aspect_param_cnt(abac_aspect_t *ptr) {
     if(ptr->aspect_params) {
@@ -798,5 +815,6 @@
     /* the principal id is probably not in the idcreds list */
     if(principal_name_type == NULL) {
-        errx(1,"Can not find idtype for principal_name, wrong filename suffix?");
+        if(debug)fprintf(stderr,"THIS IS BAD, %s \n", principal_name);
+        errx(1,"Can not find idtype for principal_name, don't see it in context?");
     }
 
Index: libabac/abac_aspect.h
===================================================================
--- libabac/abac_aspect.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_aspect.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,35 @@
+#ifndef __ABAC_ASPECT_H__
+#define __ABAC_ASPECT_H__
+
+#include "abac_defines.h"
+#include "abac_list.h"
+
+/* exported */
+/* for abac_term */
+extern char *abac_aspect_string_with_condition(abac_aspect_t *);
+extern char *abac_aspect_typed_string_with_condition(abac_aspect_t *);
+extern char *abac_aspect_string_with_condition(abac_aspect_t *);
+extern char *abac_aspect_principal_principalname(abac_aspect_t *);
+extern char* abac_aspect_type_string(abac_aspect_t *);
+extern abac_list_t *abac_aspect_prereqs(abac_aspect_t *);
+extern abac_aspect_t *abac_aspect_intersection_new(abac_aspect_t *);
+
+extern int abac_aspect_get_issuer_idtype(abac_aspect_t *);
+extern abac_id_t *abac_aspect_get_issuer_id(abac_aspect_t *);
+extern abac_term_t *abac_aspect_object_term(abac_aspect_t *ptr);
+extern abac_aspect_t *abac_aspect_oset_principal_new(char *);
+extern abac_aspect_t *abac_aspect_role_principal_new(char *);
+extern abac_aspect_t *abac_aspect_oset_object_new(abac_term_t *);
+extern abac_aspect_t *abac_aspect_oset_linking_new(char *, char *, char *);
+extern abac_aspect_t *abac_aspect_role_linking_new(char *, char *, char *);
+extern char *abac_aspect_aspect_param_string(abac_aspect_t *ptr);
+
+extern void abac_print_aspect_string_with_condition(abac_aspect_t *ptr,FILE *fp);
+extern void abac_print_aspect_typed_string_with_condition(abac_aspect_t *ptr,FILE *fp);
+
+extern abac_aspect_t *abac_aspect_copy(abac_aspect_t *);
+extern char *abac_aspect_aspect_name(abac_aspect_t *);
+extern abac_aspect_t *abac_aspect_dup(abac_aspect_t *ptr);
+
+
+#endif /* __ABAC_ASPECT_H__ */
Index: libabac/abac_attribute.c
===================================================================
--- libabac/abac_attribute.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_attribute.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,3 +1,2 @@
-
 /**
 **  abac_attribute.c
@@ -9,23 +8,23 @@
 #include <time.h>
 
-#include "abac_internal.h"
+#include <credentials/certificates/x509.h>
+#include <credentials/certificates/certificate.h>
+#include <credentials/certificates/ac.h>
+
 #include "abac_util.h"
-#include "abac_rt.h"
-
-#define SHA1_LENGTH 40
-
-extern char* abac_encode_string(char*);
-extern abac_key_t *abac_id_keyptr(abac_id_t *id);
-extern abac_aspect_t *abac_yy_get_rule_head_aspect();
-extern abac_aspect_t *abac_yy_get_rule_tail_aspect();
-extern abac_list_t *abac_yy_get_rule_clauses();
-extern char* abac_decode_string(char *);
-extern void abac_yy_free_rule_clauses();
-extern int verify_signature(certificate_t *issuer_cert, certificate_t *cert);
-
-abac_attribute_t *abac_attribute_set_head(abac_attribute_t *ptr, abac_aspect_t *head);
-
+#include "abac_aspect.h"
+#include "abac_m64.h"
+#include "abac_id.h"
+#include "abac_pl_yy.h"
+#include "rt2_yy.h"
+#include "abac_verifier.h"
+#include "abac_util_cert.h"
+#include "abac_id.h"
+
+/*****************************************************************/
 static int debug=0;
 
+/* the correct setting of using_this depends on user if the attribute is
+   not generate from yyparse call */
 struct _abac_attribute_t {
     abac_id_t *issuer_id; 
@@ -33,4 +32,5 @@
     abac_aspect_t *tail;
     int validity;
+    int using_this; /* tracking use of (?This) */
     certificate_t *cert; // NULL until baked
     certificate_t *issuer_cert;
@@ -39,5 +39,13 @@
 };
 
+/* local */
+abac_attribute_t *abac_attribute_set_head(abac_attribute_t *ptr, abac_aspect_t *head);
+abac_aspect_t *abac_attribute_head(abac_attribute_t *ptr);
+abac_aspect_t *abac_attribute_tail(abac_attribute_t *ptr);
+abac_attribute_t *abac_attribute_add_tail(abac_attribute_t *ptr, abac_aspect_t *tail);
+void abac_attribute_set_using_this(abac_attribute_t *ptr, int using_this);
+
 /********************************************************************/
+/* currently the hashkeyid is the uuencoded 'sha attribute string'  */
 char *get_cred_encoding(abac_attribute_t *ptr)
 {
@@ -48,4 +56,16 @@
     assert(ptr->tail != NULL);
 
+    if(ptr->cert != NULL) { /* already a baked one */
+        ac_t *ac = (ac_t *)ptr->cert;
+        ietf_attributes_t *attr_cert = ac->get_groups(ac);
+        char *encoded_attr_string=attr_cert->get_string(attr_cert);
+        return encoded_attr_string;
+    }
+
+    /* not a baked one should not be in ABAC_CN mode at all !!! */
+    /* needs to be the one with sha */
+    if(USE("ABAC_CN")) {
+        fprintf(stderr,"get_cred_encoding, MIGHT be BAD..\n");
+    } 
     char *head_string=abac_aspect_typed_string_with_condition(ptr->head);
     char *tail_string=abac_aspect_typed_string_with_condition(ptr->tail);
@@ -54,5 +74,7 @@
     char* base64_encoding=abac_encode_string(encoding);
 
-    if(debug) fprintf(stderr,"XXX abac_attribute_bake (%s)\n", encoding);
+    if(USE("ABAC_CN")) {
+        fprintf(stderr,"    --> (%s)\n", encoding);
+    }
 
     free(encoding);
@@ -62,23 +84,35 @@
 }
 
+static abac_attribute_t *_abac_attribute_init()
+{
+    abac_attribute_t *ptr = abac_xmalloc(sizeof(abac_attribute_t));
+    ptr->issuer_id = NULL;
+    ptr->head = NULL;
+    ptr->tail = NULL;
+    ptr->validity= 365 * 86400; // default
+    // NULL until baked
+    ptr->using_this=0;
+    ptr->cert= NULL;
+    ptr->issuer_cert= NULL;
+    ptr->refcount=1;
+    return ptr;
+}
+
 /********************************************************************/
 abac_attribute_t *abac_attribute_new(abac_id_t *issuer, certificate_t *cert,
 certificate_t *issuer_cert)
 {
-    abac_attribute_t *ptr = abac_xmalloc(sizeof(abac_attribute_t));
+    abac_attribute_t *ptr = _abac_attribute_init();
     ptr->issuer_id = abac_id_dup(issuer);
-    ptr->head = NULL;
-    ptr->tail = NULL;
-    ptr->validity= 365 * 86400; // default
     ptr->cert=cert; // already baked..
     ptr->issuer_cert=issuer_cert;
     ptr->refcount=1;
-
     return ptr;
 }
 
 // validity is measured in seconds (as of 0.2.0)
-int abac_attribute_create(abac_attribute_t **ret, 
-abac_aspect_t *head, abac_aspect_t *tail, int validity)
+// remember using_this,
+int abac_attribute_create(abac_attribute_t **ret, abac_aspect_t *head, 
+abac_aspect_t *tail, int validity)
 {
     abac_id_t *issuer_id=abac_aspect_get_issuer_id(head);
@@ -95,14 +129,11 @@
         return ABAC_ATTRIBUTE_INVALID_VALIDITY;
 
-    abac_attribute_t *ptr = abac_xmalloc(sizeof(abac_attribute_t));
+    abac_attribute_t *ptr = _abac_attribute_init();
     ptr->issuer_id = abac_id_dup(issuer_id);
     ptr->head = abac_aspect_dup(head);
-    ptr->tail = (tail!=NULL) ? abac_aspect_dup(tail):NULL;
+    if(tail)
+        ptr->tail = abac_aspect_dup(tail);
     ptr->validity=(validity==0?(365 * 86400):validity);
 
-    // NULL until baked
-    ptr->cert=NULL;
-    ptr->issuer_cert=NULL;
-    ptr->refcount=1;
     *ret = ptr;
     return ABAC_ATTRIBUTE_SUCCESS;
@@ -111,5 +142,6 @@
 // validity is measured in seconds (as of 0.2.0)
 int abac_attribute_create_creddy(abac_attribute_t **ret, abac_id_t *issuer, 
-abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect, char *name, int validity)
+abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect, char *name,
+int validity)
 {
     if (!abac_id_has_privkey(issuer))
@@ -120,16 +152,41 @@
         return ABAC_ATTRIBUTE_INVALID_VALIDITY;
 
-    abac_attribute_t *ptr = abac_xmalloc(sizeof(abac_attribute_t));
+    abac_attribute_t *ptr = _abac_attribute_init();
     ptr->issuer_id = abac_id_dup(issuer);
-
     ptr->head=head_aspect;
     ptr->tail=tail_aspect;
     ptr->validity = validity;
 
-    // NULL until baked
-    ptr->cert = NULL;
-    ptr->issuer_cert = NULL;
     *ret = ptr;
     return ABAC_ATTRIBUTE_SUCCESS;
+}
+
+static void _check_cert_group(certificate_t *cert, char *estring)
+{
+    ietf_attributes_t *attr_cert = NULL;
+    int ret, i;
+
+    // get the attr
+    ac_t *ac = (ac_t *)cert;
+    attr_cert = ac->get_groups(ac);
+    if(attr_cert == NULL) {
+        fprintf(stderr,"BAD group from the cert !!!\n");
+        return;
+    }
+    char *encoded_attr_string=attr_cert->get_string(attr_cert);
+    if(encoded_attr_string==NULL) {
+        fprintf(stderr,"BAD empty, encoded attr string from the cert !!!\n");
+/*
+    chunk_t b64 = chunk_to_base64(chunk, NULL);
+    chunk_t chk = chunk_from_base64(base64, NULL);
+*/
+       int len = strlen(estring);
+       chunk_t b64 = { estring, len };
+       chunk_t chk= chunk_from_base64(b64, NULL);
+       chk.ptr[chk.len]='\0';
+       fprintf(stderr,"new convert: (%s)\n", chk.ptr);
+       chunk_t nb64 = chunk_to_base64(chk, NULL);
+       fprintf(stderr,"back again: (%d)(%s)\n", strlen(nb64.ptr), nb64.ptr);
+    }
 }
 
@@ -148,4 +205,10 @@
     if(private==NULL)
         errx(1,"can not bake without a private key!!!"); 
+
+/**** XXX this needs to be removed !!!!! limitation from strongswan... ****/
+    if(strlen(cred_encoding) > 512) {
+        fprintf(stderr,"due to BUILD_IETF_GROUP_ATTR buffer size limit, can not bake this attribute (%d)!!\n", strlen(cred_encoding));
+        return 0;
+    }
 
     certificate_t *attr_cert = lib->creds->create(lib->creds,
@@ -161,4 +224,6 @@
     );
 
+    _check_cert_group(attr_cert, cred_encoding);
+
     DESTROY_IF(private);
 
@@ -189,9 +254,6 @@
 
     libabac_init();
-    certificate_t *cert = lib->creds->create(lib->creds,
-        CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_FROM_FILE, filename,
-        BUILD_END
-    );
+
+    certificate_t *cert = cert_get_attr_cert_from_file(filename);
     if (cert == NULL)
         errx(1, "Couldn't load attribute cert %s", filename);
@@ -209,9 +271,5 @@
 
     libabac_init();
-    certificate_t *cert = lib->creds->create(lib->creds,
-        CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_END
-    );
+    certificate_t *cert = cert_get_attr_cert_from_chunk(chunk);
     if (cert == NULL)
         errx(1, "Couldn't load attribute chunk");
@@ -227,7 +285,9 @@
  * attribute string is parsed via yyparse call
  */
-static abac_attribute_t *_load_attribute_from_cert(certificate_t *cert) {
+static abac_attribute_t *_load_attribute_from_cert(certificate_t *cert)
+{
     ietf_attributes_t *attr_cert = NULL;
     int ret, i;
+    int using_this=0;
 
     // get the attr
@@ -249,23 +309,15 @@
     }
 
-    /* call into yacc parser */
-    abac_reset_yyfptr(attr_string);
-    abac_yy_init();
-    int rc=yyparse();
+    abac_id_credential_t *id_cred;
+    abac_id_t *issuer_id;
+
+    /* reset lex input line, call into yacc parser */
+    abac_aspect_t *head_aspect = NULL;
+    abac_aspect_t *tail_aspect = NULL;
+    int rc=abac_yy_parse(NULL, attr_string, &head_aspect, &tail_aspect, &using_this);
     if (rc) {
         ret = ABAC_CERT_INVALID;
         goto error;
     }
-
-    abac_aspect_t *head_aspect = NULL;
-    abac_aspect_t *tail_aspect = NULL;
-    abac_list_t *clauses=NULL;
-    abac_id_credential_t *id_cred;
-    abac_id_t *issuer_id;
-
-    // get the attr
-    head_aspect = abac_yy_get_rule_head_aspect();
-    tail_aspect = abac_yy_get_rule_tail_aspect();
-    clauses = abac_yy_get_rule_clauses();
 
     // get the issuer based on keyid
@@ -300,4 +352,5 @@
     abac_attribute_set_head(attr, head_aspect);
     abac_attribute_add_tail(attr, tail_aspect);
+    abac_attribute_set_using_this(attr, using_this);
 
     // free up some stuff
@@ -344,6 +397,39 @@
 {
     assert(ptr);
+    abac_id_dup(ptr->issuer_id);
     ++ptr->refcount;
     return ptr;
+}
+
+static certificate_t *_cert_copy(certificate_t *cert)
+{
+    if(cert==NULL) return NULL;
+    chunk_t encoding = chunk_empty;
+    int rc=cert->get_encoding(cert,CERT_ASN1_DER,&encoding);
+    certificate_t *ncert = cert_get_attr_cert_from_chunk(encoding);
+    return ncert;
+}
+
+/* deep copy of a attribute structure, this is used by libabac
+   api so that we can have a local control of the data within
+   libabac
+*/
+abac_attribute_t *abac_attribute_copy(abac_attribute_t *ptr)
+{
+    assert(ptr);
+    abac_aspect_t *tmp;
+    abac_attribute_t *nptr = _abac_attribute_init();
+    nptr->issuer_id = abac_id_copy(ptr->issuer_id);
+    nptr->head=abac_aspect_copy(abac_attribute_head(ptr));
+    nptr->tail=abac_aspect_copy(abac_attribute_tail(ptr));
+
+    nptr->validity= ptr->validity;
+    nptr->using_this = ptr->using_this;
+    certificate_t *attr_cert=_cert_copy(ptr->cert);
+    nptr->cert=attr_cert; // already baked..
+    if(attr_cert) 
+        nptr->issuer_cert= attr_cert->get_ref(attr_cert);
+    nptr->refcount=ptr->refcount+1;
+    return nptr;
 }
 
@@ -364,5 +450,4 @@
     if(ptr->cert) DESTROY_IF(ptr->cert);
     if(ptr->issuer_cert) DESTROY_IF(ptr->issuer_cert);
-
     free(ptr);
 }
@@ -415,4 +500,16 @@
     ptr->head=head;
     return ptr;
+}
+
+void abac_attribute_set_using_this(abac_attribute_t *ptr, int using_this)
+{
+    assert(ptr);
+    ptr->using_this=using_this;
+}
+
+int abac_attribute_get_this(abac_attribute_t *ptr)
+{
+    assert(ptr);
+    return ptr->using_this;
 }
 
Index: libabac/abac_attribute.h
===================================================================
--- libabac/abac_attribute.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_attribute.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,16 @@
+#ifndef __ABAC_ATTR_H__
+#define __ABAC_ATTR_H__
+
+#include "abac_defines.h"
+
+#include <credentials/certificates/certificate.h>
+
+/* exported */
+extern char *get_cred_encoding(abac_attribute_t *);
+extern certificate_t *abac_attribute_issuer_cert(abac_attribute_t *ptr);
+extern certificate_t *abac_attribute_cert(abac_attribute_t *ptr);
+extern abac_attribute_t *abac_attribute_new(abac_id_t *, certificate_t *, certificate_t *);
+extern abac_attribute_t *abac_attribute_dup(abac_attribute_t *);
+extern abac_attribute_t *abac_attribute_copy(abac_attribute_t *);
+
+#endif /* __ABAC_ATTR_H__ */
Index: libabac/abac_c.c
===================================================================
--- libabac/abac_c.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_c.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,7 +1,18 @@
+/**
+** abac_c.c
+** a very thin layer to libabac calls so c interface 
+** and c++ interface looks about the same 
+**
+** This should be 'macrotized' when we go to beta to minimumize
+** runtime function call cost
+**/
 
 #include "abac_internal.h"
-
-/* a very thin layer to libabac calls so c interface and c++ interface
-   looks about the same */
+#include "abac_util.h"
+
+/**************************************************************************/
+/* utility */
+char *abac_get_version()
+{ return abac_xstrdup(abac_version()); }
 
 /* CONSTRAINT->abac_condition_t */
@@ -164,29 +175,27 @@
 
 /* CONTEXT -> abac_context_t */
-int abac_context_load_id(abac_context_t *ptr, abac_id_t *id)
-{ return abac_context_load_id_id(ptr, id); }
+int abac_context_principal_count(abac_context_t *ptr)
+{ return abac_context_id_creds_count(ptr); }
+int abac_context_credential_count(abac_context_t *ptr)
+{ return abac_context_creds_count(ptr); }
 int abac_context_load_id_file(abac_context_t *ptr, char *filename)
 { return abac_context_load_id_idkey_file(ptr, filename); }
 int abac_context_load_id_files(abac_context_t *ptr, char *filename, char *keyfilename)
-{ return abac_context_load_id_id_file_key_file(ptr, filename, keyfilename); }
-int abac_context_load_attribute(abac_context_t *ptr, abac_attribute_t *attr)
-{ return abac_context_load_attribute_attribute(ptr, attr); }
+{ return abac_context_load_id_id_key_files(ptr, filename, keyfilename); }
 
 /* encrypted version */
-int abac_context_load_encrypted_id_file(abac_context_t *ptr, char *filename,
-char *pfile)
+int abac_context_load_encrypted_id_file(abac_context_t *ptr, char *filename, char *pfile)
 { return abac_context_load_id_enc_idkey_file(ptr, filename, pfile); }
-int abac_context_load_encrypted_id_files(abac_context_t *ptr, char *filename,
-char *keyfilename, char *pfile)
-{ return abac_context_load_id_enc_id_file_key_file(ptr, filename, keyfilename, pfile); }
-
-
-
-
-
-
-
-
-
-
-
+int abac_context_load_encrypted_id_files(abac_context_t *ptr, char *filename, char *keyfilename, char *pfile)
+{ return abac_context_load_id_enc_id_key_files(ptr, filename, keyfilename, pfile); }
+abac_id_credential_t *abac_context_principal_lookup(abac_context_t *ptr,char *nm)
+{ return abac_context_id_credential_lookup(ptr,nm); }
+
+
+
+
+
+
+
+
+
Index: libabac/abac_c.h
===================================================================
--- libabac/abac_c.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_c.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,70 @@
+#ifndef __ABAC_C_H__
+#define __ABAC_C_H__
+
+/* export visible routines from abac_c.c */
+extern void abac_constraint_add_integer_max(abac_condition_t *cond,int val);
+extern void abac_constraint_add_integer_min(abac_condition_t *cond,int val);
+extern void abac_constraint_add_integer_target(abac_condition_t *cond,int val);
+extern void abac_constraint_add_float_max(abac_condition_t *cond,float val);
+extern void abac_constraint_add_float_min(abac_condition_t *cond,float val);
+extern void abac_constraint_add_float_target(abac_condition_t *cond,float val);
+extern void abac_constraint_add_time_max(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_time_min(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_time_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_urn_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_string_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_boolean_target(abac_condition_t *cond, char* val);
+extern abac_condition_t *abac_constraint_from_role(abac_aspect_t *ptr);
+extern abac_condition_t *abac_constraint_create(char *vtype);
+extern abac_condition_t *abac_constraint_from_oset(abac_aspect_t *ptr);
+extern char *abac_constraint_typed_string(abac_condition_t *ptr);
+extern char *abac_constraint_string(abac_condition_t *ptr);
+extern abac_aspect_t *abac_role_principal_create(char *principal_name);
+extern abac_aspect_t *abac_oset_principal_create(char *principal_name);
+extern abac_aspect_t *abac_oset_create(char *principal_name, char *oset_name);
+extern abac_aspect_t *abac_role_create(char *principal_name, char *role_name);
+extern abac_aspect_t *abac_oset_linked_create(char *principal_name, char *linked_role_name, char *oset_name);
+extern abac_aspect_t *abac_role_linked_create(char *principal_name, char *linked_role_name, char *role_name);
+extern abac_aspect_t *abac_oset_object_create(abac_term_t *object);
+extern int abac_oset_is_object(abac_aspect_t *ptr);
+extern int abac_oset_is_principal(abac_aspect_t *ptr);
+extern int abac_role_is_principal(abac_aspect_t *ptr);
+extern int abac_oset_is_linking(abac_aspect_t *ptr);
+extern int abac_role_is_linking(abac_aspect_t *ptr);
+extern char *abac_role_linked_role(abac_aspect_t *ptr);
+extern char *abac_oset_linked_role(abac_aspect_t *ptr);
+extern char *abac_role_name(abac_aspect_t *ptr);
+extern char *abac_oset_name(abac_aspect_t *ptr);
+extern char *abac_role_principal(abac_aspect_t *ptr);
+extern char *abac_oset_principal(abac_aspect_t *ptr);
+extern void abac_role_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_oset_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_role_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_oset_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern char *abac_oset_object(abac_aspect_t *ptr);
+extern char *abac_oset_typed_string(abac_aspect_t *ptr);
+extern char *abac_oset_string(abac_aspect_t *ptr);
+extern char *abac_role_typed_string(abac_aspect_t *ptr);
+extern char *abac_role_string(abac_aspect_t *ptr);
+extern abac_term_t **abac_oset_get_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_oset_get_linked_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_role_get_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_role_get_linked_data_terms(abac_aspect_t *ptr);
+extern void abac_id_write_cert_fname(abac_id_t *ptr,char *filename);
+extern void abac_id_write_privkey_fname(abac_id_t *ptr,char *filename);
+extern int abac_id_load_encrypted_privkey_file(abac_id_t *ptr, char *filename, char *pfile);
+extern char *abac_head_string(abac_attribute_t *ptr);
+extern char *abac_tail_string(abac_attribute_t *ptr);
+extern char *abac_head_typed_string(abac_attribute_t *ptr);
+extern char *abac_tail_typed_string(abac_attribute_t *ptr);
+extern void abac_attribute_write_cert_fname(abac_attribute_t *ptr,char *filename);
+extern abac_aspect_t **abac_attribute_role_tails(abac_attribute_t *ptr);
+extern abac_aspect_t **abac_attribute_oset_tails(abac_attribute_t *ptr);
+extern int abac_context_load_id(abac_context_t *ptr, abac_id_t *id);
+extern int abac_context_load_id_idkey_file(abac_context_t *ptr, char *filename);
+extern int abac_context_load_id_files(abac_context_t *ptr, char *filename, char *keyfilename);
+extern int abac_context_load_attribute(abac_context_t *ptr, abac_attribute_t *attr);
+extern int abac_context_load_encrypted_id_file(abac_context_t *ptr, char *filename, char *pfile);
+extern int abac_context_load_encrypted_id_files(abac_context_t *ptr, char *filename, char *keyfilename, char *pfile);
+
+#endif /* __ABAC_C_H__ */
Index: libabac/abac_common.h
===================================================================
--- libabac/abac_common.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ 	(revision )
@@ -1,83 +1,0 @@
-#ifndef __ABAC_COMMON_H__
-#define __ABAC_COMMON_H__
-
-typedef struct _abac_chunk_t {
-    unsigned char *ptr;
-    int len;
-} abac_chunk_t;
-
-typedef enum _idtype_t {
-    e_KEYID = 1,
-} abac_idtype_t;
-/* idtypename[idtype] */
-static const char * const _idtypename[] =
-{
-  "badidtype", "keyid"
-};
-static int _idtypename_cnt=1;
-
-typedef enum _termtype {
-    e_TERM_INTEGER = 1,
-    e_TERM_URN = 2,
-    e_TERM_FLOAT = 3,
-    e_TERM_BOOLEAN = 4,
-    e_TERM_STRING = 5,
-    e_TERM_TIME = 6,
-    e_TERM_PRINCIPAL = 7,
-    e_TERM_ANONYMOUS = 8
-} abac_termtype_t;
-/* termname[dtermtype] */
-static const char *const _termname[] =
-{
-  "badterm",
-  "integer",
-  "urn",
-  "float",
-  "boolean",
-  "string",
-  "time" ,
-  "principal",
-  "anonymous"
-};
-static int _termname_cnt=8;
-
-typedef enum _condtype_t {
-    e_COND_ROLE = 1,
-    e_COND_OSET = 2,
-    e_COND_RANGE = 3
-} abac_condtype_t;
-
-/* condname[condtype] */
-static const char *const _condname[] =
-{
-  "badcondition",
-  "role",
-  "oset",
-  "range"
-};
-static int _condname_cnt=3;
-
-typedef enum _aspecttype_t {
-    e_ASPECTTYPE_NULL = 0,
-    e_ASPECTTYPE_ROLE = 1,
-    e_ASPECTTYPE_OSET = 2,
-    e_ASPECTTYPE_INTERSECTING = 3
-} abac_aspecttype_t;
-
-typedef enum _itemtype_t {
-    e_ITEM_MIN = 1,
-    e_ITEM_MAX = 2,
-    e_ITEM_TARGET = 3
-} abac_itemtype_t;
-
-/* itemname[itemtype] */
-static const char *const _itemname[] =
-{
-  "baditem",
-  "min",
-  "max",
-  "target"
-};
-static int _itemname_cnt=3;
-
-#endif
Index: libabac/abac_context.c
===================================================================
--- libabac/abac_context.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_context.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,1566 @@
+/**
+**  abac_context.c
+**/
+
+#include <assert.h>
+#include <err.h>
+#include <glob.h>
+#include <stdio.h>
+#include <regex.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <chunk.h>
+
+#include "abac_util.h"
+
+#include "abac_context.h"
+#include "abac_list.h"
+#include "abac_stack.h"
+#include "abac_pl_yap.h"
+#include "abac_pl_yy.h"
+#include "uthash.h"
+#include "abac_id.h"
+#include "abac_verifier.h"
+#include "abac_id.h"
+#include "abac_pl_gen.h"
+#include "abac_attribute.h"
+#include "abac_aspect.h"
+#include "abac_m64.h"
+#include "rt2_yy.h"
+#include "abac_util_cert.h"
+
+static int debug=0;
+
+#define KEY_PAT "/*_private.{der,pem}"
+#define ID_PAT "/*_ID.{der,pem}"
+#define ATTR_PAT "/*_attr.der"
+#define IDKEY_PAT "/*_IDKEY.{der,pem}"
+
+struct _abac_context_t {
+    char *namespace;
+    abac_pl_t *pl; /* prolog query structure */
+
+    abac_list_t *context_pl_clauses;
+
+/* linked list of all the ids's hashkeyid */
+    abac_list_t *context_id_hashkeyid_list;
+
+/* linked list of all the attr's hashkeyid */
+    abac_list_t *context_attr_hashkeyid_list;
+};
+
+/* local */
+int abac_context_load_id_id(abac_context_t *ctxt,abac_id_t *id);
+static chunk_t _extract_chunk(char *data, char* startline, char* endline);
+int abac_context_load_attribute_credential(abac_context_t *, abac_attribute_t *, abac_credential_t *);
+/****************************************************************/
+/**
+ * Create a new abac context.
+ */
+abac_context_t *abac_context_new(void)
+{
+    libabac_init();
+
+    DEBUG_PRINTF("creating a new context... \n");
+
+    abac_context_t *ctxt = abac_xmalloc(sizeof(abac_context_t));
+    ctxt->namespace=abac_verifier_session_next_namespace();
+    ctxt->pl = abac_pl_new(ctxt);
+    ctxt->context_attr_hashkeyid_list = abac_list_new();
+    ctxt->context_id_hashkeyid_list = abac_list_new();
+    ctxt->context_pl_clauses = abac_list_new();
+    abac_verifier_session_add_context(ctxt);
+    return ctxt;
+}
+
+/* create a new context with a specific namespace */
+abac_context_t *abac_context_named_new(char *namespace)
+{
+    assert(namespace!=NULL);
+    libabac_init();
+
+    abac_context_t *ctxt = abac_xmalloc(sizeof(abac_context_t));
+    ctxt->namespace=abac_xstrdup(namespace);
+    ctxt->pl = abac_pl_new(ctxt);
+    ctxt->context_attr_hashkeyid_list = abac_list_new();
+    ctxt->context_id_hashkeyid_list = abac_list_new();
+    ctxt->context_pl_clauses = abac_list_new();
+    abac_verifier_session_add_context(ctxt);
+    return ctxt;
+}
+
+char *abac_context_namespace(abac_context_t *ctxt)
+{
+    assert(ctxt!=NULL);
+    return abac_xstrdup(ctxt->namespace);
+}
+
+/**
+ * Deep copy an abac context. --
+ */
+abac_context_t *abac_context_dup(abac_context_t *ctxt)
+{
+    assert(ctxt!=NULL);
+    abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
+    dup->namespace=abac_verifier_session_next_namespace();
+    dup->pl = abac_pl_new(dup);
+
+    dup->context_attr_hashkeyid_list = abac_list_new();
+    dup->context_id_hashkeyid_list = abac_list_new();
+    dup->context_pl_clauses = abac_list_new();
+
+/* copy over and build up the prolog */
+   if(ctxt->context_id_hashkeyid_list) {
+        abac_id_credential_t *id_cred;
+        abac_id_t *id;
+        char *cur;
+        abac_list_foreach(ctxt->context_id_hashkeyid_list, cur,
+            if(cur) {
+/* id_cred=abac_check_id_cred(cur); */
+                id_cred=abac_id_credential_lookup(cur);
+                id=abac_id_credential_id(id_cred);
+                assert(id!=NULL);
+                /* id=abac_id_dup(id); */
+                abac_context_load_id_id(dup,id);
+            }
+        );
+    }
+    if(ctxt->context_attr_hashkeyid_list) {
+        abac_credential_t *attr_cred;
+        abac_attribute_t *attr;
+        char *cur;
+        int sz=abac_list_size(ctxt->context_attr_hashkeyid_list);
+        abac_list_foreach(ctxt->context_attr_hashkeyid_list, cur,
+            if(cur) { /* cur is the hash key */
+/* attr_cred=abac_check_cred(cur); */
+                attr_cred=abac_credential_lookup(cur);
+                assert(attr_cred);
+                attr=abac_credential_attribute(attr_cred);
+                assert(attr);
+                /* attr=abac_attribute_dup(attr); 
+                abac_context_load_attribute_credential(dup,attr,attr_cred);
+                */
+                abac_context_load_attribute_attribute(dup,attr);
+            }
+        );
+    }
+    abac_verifier_session_add_context(dup);
+    return dup;
+}
+
+/**************************************************************/
+abac_id_credential_t *abac_context_add_id_credential(abac_context_t *ctxt, abac_id_t *a_id)
+{ 
+    char *cn=abac_id_cn(a_id);
+    char *keyid=abac_id_keyid(a_id);
+
+    /* see if it already exist */
+    abac_id_credential_t *id_cred;
+    id_cred=abac_id_credential_lookup(keyid);
+
+    /* add to master list if new */
+    if(id_cred == NULL) {
+        id_cred=abac_id_credential_new(a_id);
+        abac_add_id_cred(id_cred); 
+        } else { /* increment the reference count */
+            id_cred=abac_id_credential_dup(id_cred);
+    }
+
+    DEBUG_PRINTF("abac_context_add_id_credential, cn(%s)keyid(%s)\n",cn,keyid);
+    /* special handling here */
+    char *tmp;
+    if(USE("ABAC_CN")) {
+        tmp=generate_pl_type_clause(ctxt, cn, abac_id_idtype(a_id));
+        } else {
+           tmp=generate_pl_type_clause(ctxt, prologIt(keyid), abac_id_idtype(a_id));
+    }
+    abac_list_add(ctxt->context_pl_clauses,tmp);
+
+    /* insert into db */
+   int rc=abac_pl_add_type_credential(tmp);
+   
+    /* add to local hash list */
+    abac_list_add(ctxt->context_id_hashkeyid_list,
+                   abac_xstrdup(abac_id_credential_hashkey(id_cred)));
+
+    return id_cred;
+}
+
+/* have to find the last cn 
+   CN=test/emailAddress=abac.isi.edu, CN=12345678
+   CN=client
+   ..CN=255a03f3-ed30/emailAddress=..
+*/
+static char* _extract_cn(char *string)
+{
+    /* find the first CN= */
+    char *ptr=strstr(string,"CN=");
+    if(ptr == NULL) return NULL;
+
+    /* look for last CN= */
+    while(1) {
+       char *tptr=ptr+3;
+       char *p=strstr(tptr,"CN=");
+       if(p) ptr=p;
+           else break;
+    }
+
+    /* remove the possible additional stuff */
+    char *cn=abac_xstrdup(ptr); /* it would get write over */
+    char *nptr=strtok(cn,"/");
+    char *pcn=abac_xmalloc(sizeof(char) * strlen(nptr));
+    pcn[0]='p';
+    /* special case.. replace empty space with _ */
+    int i=strlen(nptr);
+    while(i--) 
+       if(nptr[i]==' ') nptr[i]='_';
+    sscanf(nptr,"CN=%s", &pcn[1]);
+    free(cn);
+    return pcn;
+}
+
+// convert a chunk to a lowercase binary string
+// malloc's the string
+static char *_chunk_to_string(chunk_t chunk) {
+    int i;
+
+    char *ret = abac_xmalloc(chunk.len * 2 + 1);
+
+    for (i = 0; i < chunk.len; ++i)
+        sprintf(ret + 2 * i, "%02x", chunk.ptr[i]);
+
+    return ret;
+}
+
+// verify that cert is still valid
+static int _verify_validity(certificate_t *cert) {
+    if (cert->get_validity(cert, NULL, NULL, NULL))
+        return 1;
+    return 0;
+}
+
+/**
+ * Load an ID 
+ */
+static int _load_id(abac_context_t *ctxt, abac_id_t **a_id,certificate_t *cert)
+{
+    int ret;
+    abac_id_credential_t *id_cred = NULL;
+
+    assert(cert != NULL);
+
+    // get the key ID, add p to keyid SHA here */
+    char *keyid =cert_get_keyid(cert);
+
+    /* Mike said this is the way it is */
+    char *str=NULL;
+    int rv = asprintf(&str, "%Y", cert->get_issuer(cert));
+
+    /* add p to cn name here, if there is no useable one
+       reuse keyid */
+    char *cn=_extract_cn(str);
+    if(cn == NULL) {
+        DEBUG_PRINTF("DEBUG:did not find usable cn, reuse keyid\n");
+        cn=abac_xstrdup(keyid);
+    }
+
+    DEBUG_PRINTF("DEBUG:keyid %s \n", keyid);
+    DEBUG_PRINTF("DEBUG:issuer '%s' \n", str);
+    DEBUG_PRINTF("DEBUG:cn %s \n", cn);
+    free(str);
+
+    // validate validity
+    ret = _verify_validity(cert);
+    if (!ret) {
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    // validate sig
+    ret = verify_signature(cert, cert);
+    if (!ret) {
+        /* well.. this is not a self signed cert, don't fault it anymore */
+        DEBUG_PRINTF("This is not a self-signed cert \n");
+        } else {
+            DEBUG_PRINTF("This is a self-signed cert \n");
+    }
+
+    // if we already have this cert in the context, 'error' with success
+    id_cred=abac_context_id_credential_lookup(ctxt, keyid);
+    if (id_cred != NULL) {
+        DEBUG_PRINTF("existing cert \n");
+        /* needs to increment the ref count */
+        abac_id_credential_dup(id_cred);
+        ret = ABAC_CERT_EXISTS;
+        goto error;
+        } else {
+            // if we don't have it in context but in session, then
+            // we need to insert into the local context
+            abac_id_credential_t *icred=abac_id_credential_lookup(keyid);
+            if(icred!=NULL) {
+                *a_id=abac_id_credential_id(icred);
+                 DEBUG_PRINTF("_load_id:already exists in session.(%s)\n",abac_id_cn(*a_id));
+                } else  {
+                   // all else fail.. insert as a new id 
+                   if(*a_id==NULL) *a_id=abac_id_keyid_new(keyid,cn,cert);
+            }
+            id_cred=abac_context_add_id_credential(ctxt,*a_id);
+    }
+
+    if (keyid != NULL) free(keyid);
+    if (cn != NULL) free(cn);
+    return ABAC_CERT_SUCCESS;
+
+error:
+    if (keyid != NULL) free(keyid);
+    if (cn != NULL) free(cn);
+
+    return ret;
+}
+
+
+int abac_context_creds_count(abac_context_t *ctxt)
+{
+    int sz=abac_list_size(ctxt->context_attr_hashkeyid_list);
+    return sz;
+}
+
+int abac_context_id_creds_count(abac_context_t *ctxt)
+{
+    int sz=abac_list_size(ctxt->context_id_hashkeyid_list);
+    return sz;
+}
+
+/* collect all the creds for this context */
+abac_stack_t *abac_context_dump_creds(abac_context_t *ctxt)
+{
+    abac_stack_t *cred_list = abac_stack_new();
+
+    int cnt=0;
+    if(ctxt->context_attr_hashkeyid_list) {
+        char *keyid=NULL;
+        abac_credential_t *cred=NULL;
+        abac_list_foreach(ctxt->context_attr_hashkeyid_list, keyid,
+            cred=abac_credential_lookup(keyid);
+            if(cred!=NULL)
+                abac_stack_push(cred_list, abac_credential_dup(cred));
+                else {
+                    char *btmp=abac_decode_string(keyid);
+                    fprintf(stderr,"??? BADDD (%s)\n", btmp);
+                    assert(0);
+                }
+            cnt++;
+        );
+    }
+    DEBUG_PRINTF("abac_context_dump_creds: %d\n",cnt);
+    return cred_list;
+}
+
+/* collect all the id stored for this context */
+abac_stack_t *abac_context_dump_principals(abac_context_t *ctxt)
+{
+    abac_stack_t *id_list = abac_stack_new();
+
+    int cnt=0;
+    int sz=abac_list_size(ctxt->context_id_hashkeyid_list);
+
+    if(ctxt->context_id_hashkeyid_list) {
+        char *keyid;
+        abac_id_credential_t *id;
+        abac_list_foreach(ctxt->context_id_hashkeyid_list, keyid,
+            id=abac_id_credential_lookup(keyid);
+            abac_stack_push(id_list, abac_id_credential_dup(id));
+            cnt++;
+        );
+    }
+    DEBUG_PRINTF("abac_context_dump_principals: %d\n",cnt);
+    return id_list;
+}
+
+/**
+ * Load an attribute cert as string.
+ * have minimum syntax & validity check
+ */
+static int _load_attribute_string(abac_context_t *ctxt, char* attr_string) {
+    printf("NOT implemented yet!!!");
+    return ABAC_CERT_INVALID;
+}
+
+/**
+ * Load an ID cert from a file and key from a file.
+ */
+int abac_context_load_id_id_key_files(abac_context_t *ctxt, char *filename,
+char *keyfilename)
+{
+    struct stat sb;
+
+    assert(ctxt != NULL);
+    assert(filename != NULL);
+
+    abac_id_t *id=NULL;
+    if (lib == NULL)
+        errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
+
+    DEBUG_PRINTF("loading id & key files... %s\n", filename);
+    certificate_t *cert = cert_get_id_cert_from_file(filename);
+
+    if (cert == NULL)
+        return ABAC_CERT_INVALID;
+
+    int rc=_load_id(ctxt,&id,cert);
+
+    if(rc==ABAC_CERT_EXISTS) {
+        DEBUG_PRINTF("abac_context_load_id_id_key_files: id already exists\n");
+        return ABAC_CERT_SUCCESS;
+    } 
+
+    /* try to load the private key if it is there */
+    if((rc==ABAC_CERT_SUCCESS) && keyfilename!=NULL && file_exist(keyfilename)) {
+        DEBUG_PRINTF("loading... %s\n", keyfilename);
+        int keyrc=abac_id_load_privkey_file(id, keyfilename);
+        if(keyrc == 1)
+            DEBUG_PRINTF("..load id: load(%s) with a private key\n",filename)
+
+            else DEBUG_PRINTF("..load id: load(%s) without a private key\n",filename)
+    }
+
+    return ABAC_CERT_SUCCESS;
+}
+
+/**
+ * Load an ID cert from files.
+ */
+int abac_context_load_id_enc_id_key_files(abac_context_t *ctxt, char *filename,
+char *keyfilename, char *pfile)
+{
+    abac_id_t *id=NULL;
+    assert(ctxt != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
+
+    if (lib == NULL)
+        errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
+
+    DEBUG_PRINTF("loading enc id & key files... %s\n", filename);
+
+    // load the cert, with public key
+    certificate_t *cert = cert_get_id_cert_from_file(filename);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int rc=_load_id(ctxt,&id,cert);
+    if(rc==ABAC_CERT_EXISTS) {
+        DEBUG_PRINTF("abac_context_load_id_id_key_files: id already exists\n");
+        return ABAC_CERT_SUCCESS;
+    } 
+
+    /* try to load the private key if it is there */
+    if((rc==ABAC_CERT_SUCCESS) && keyfilename!=NULL && file_exist(keyfilename)) {
+        DEBUG_PRINTF("loading... %s\n", keyfilename);
+        int keyrc=abac_id_load_enc_privkey_file(id, keyfilename, pfile);
+        if(keyrc == 1) 
+            DEBUG_PRINTF("..load id: load(%s) with a private key\n",filename)
+           else DEBUG_PRINTF("..load id: load(%s) without a private key\n",filename)
+    }
+    return ABAC_CERT_SUCCESS;
+}
+
+/**
+ * Load an ID cert from a abac_id_t, used from abac.hh and actually
+ * makes a separate copy
+ */
+int abac_context_load_id(abac_context_t *ctxt,abac_id_t *id)
+{
+    assert(ctxt != NULL); assert(id);
+    abac_id_t *nid = abac_id_copy(id);
+    certificate_t *cert = abac_id_cert(nid);
+    int ret=_load_id(ctxt,&nid,cert);
+    return ret;
+}
+
+/**
+ * Load an ID cert from a abac_id_t 
+ */
+int abac_context_load_id_id(abac_context_t *ctxt,abac_id_t *id)
+{
+    assert(ctxt != NULL); assert(id);
+
+    certificate_t *cert = abac_id_cert(id);
+    int ret=_load_id(ctxt,&id,cert);
+    return ret;
+}
+
+/**
+ * Load an ID cert from a pem chunk.
+ */
+int abac_context_load_id_pem_chunk(abac_context_t *ctxt, chunk_t chunk)
+{
+    abac_id_t *id=NULL;
+
+    // load the cert
+    certificate_t *cert = cert_get_id_cert_from_pem_chunk(chunk);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    return _load_id(ctxt,&id,cert);
+}
+
+/* used locally */
+static int _abac_context_load_id_pem_chunk(abac_context_t *ctxt, abac_id_t **a_id, chunk_t chunk)
+{
+    // load the cert
+    certificate_t *cert = cert_get_id_cert_from_pem_chunk(chunk);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    return _load_id(ctxt,a_id,cert);
+}
+
+/**
+ * Load an ID cert from a chunk, Note, this only loads the id cert part
+ * and so it is not suitable for creating an attribute credential with. 
+ * Only a complete id cert + privkey could create attribute credential.
+ */
+int abac_context_load_id_chunk(abac_context_t *ctxt, abac_chunk_t ccert)
+{
+    assert(ctxt != NULL);
+
+    chunk_t cert_chunk = { ccert.ptr, ccert.len };
+    abac_id_t *id=NULL;
+
+    // load the cert
+    certificate_t *cert = cert_get_id_cert_from_chunk(cert_chunk);
+
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int ret=_load_id(ctxt,&id,cert);
+    return ret;
+}
+
+/**
+ * Load an ID cert from a cert chunk and a privkey chunk,
+ * this complete id cert + privkey could create attribute credential.
+ */
+int abac_context_load_id_privkey_chunk(abac_context_t *ctxt,abac_chunk_t ccert,
+abac_chunk_t privkey)
+{
+    assert(ctxt != NULL);
+    chunk_t cert_chunk = { ccert.ptr, ccert.len };
+/*A HACK/SWIG, this is to work around the swig's stub that seems to
+  mess up the transformation from abac_chunk_t to chunk_t and calling of
+  load_id_chunks to here */
+    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
+
+    abac_id_t *id=NULL;
+
+    // load the cert
+    certificate_t *cert = cert_get_id_cert_from_chunk(cert_chunk);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int rc=_load_id(ctxt,&id,cert);
+    if(rc == ABAC_CERT_SUCCESS) {
+        rc=abac_id_load_privkey_chunk(id, privkey_chunk);
+    }
+
+    return rc;
+}
+
+/**
+ * Load an ID cert and privkey from chunks.
+ */
+int 
+abac_context_load_id_enc_privkey_chunk(abac_context_t *ctxt, abac_chunk_t ccert,
+abac_chunk_t privkey, char* pfile) {
+
+    assert(ctxt != NULL);
+    chunk_t cert_chunk = { ccert.ptr, ccert.len };
+/*A HACK/SWIG, this is to work around the swig's stub that seems to
+  mess up the transformation from abac_chunk_t to chunk_t and calling of
+  load_id_chunks to here */
+    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
+
+    abac_id_t *id=NULL;
+    certificate_t *cert = cert_get_id_cert_from_chunk(cert_chunk);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int rc=_load_id(ctxt,&id,cert);
+    if(rc == ABAC_CERT_SUCCESS) {
+        rc=abac_id_load_enc_privkey_chunk(id, privkey_chunk, pfile);
+    }
+    return rc;
+}
+
+
+static int matchex(const char *subject, const char *pattern, int *so, int *eo)
+{
+    int rc; // Returned code
+    regmatch_t pmatch;
+
+    regex_t re; // Compiled regexp pattern
+
+    if (regcomp(&re, pattern, 0) != 0) return 0;
+
+    rc = regexec(&re, subject, 1 , &pmatch, 0);
+    regfree(&re); 
+
+    if (rc == REG_NOMATCH ) return 0; 
+
+    *so=pmatch.rm_so;
+    *eo=pmatch.rm_eo;
+
+    return 1;
+}
+
+
+static chunk_t _extract_chunk(char *data, char* startline, char* endline)
+{
+    int found=0;
+    int startos=0;
+    int endos=0;
+    regex_t re;
+    regmatch_t pm;
+    int rc;
+
+    int st;
+    int et;
+
+    rc=matchex(data, startline, &st, &et);
+    if(rc==0) return chunk_empty;
+    startos=st;
+
+    rc=matchex(data, endline, &st, &et);
+    if(rc==0) return chunk_empty;
+    endos=et;
+    
+    int len=endos - startos; 
+
+    DEBUG_PRINTF("making a chunk of size (%d) from %d and %d\n",len, startos,endos);
+    char *ptr=strndup(data+startos,len);
+
+    chunk_t ret = { ptr, len };
+    return ret;
+}
+
+/**
+ * Load an ID cert from a file, it may contain key part but not necessary.
+ */
+int abac_context_load_id_idkey_file(abac_context_t *ctxt, char *filename)
+{
+    struct stat sb;
+    int fd;
+    int rc;
+    assert(ctxt != NULL); assert(filename != NULL);
+    abac_id_t *id=NULL;
+
+    DEBUG_PRINTF("abac_context_load_id_idkey_file(%s)\n", filename);
+
+    fd = open(filename, O_RDONLY);
+    if (fd == -1) { return 1; }
+    if(stat(filename, &sb) == -1) {
+        close(fd);
+        return 1;
+    }
+    char* data = (char *)mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+    if(data == MAP_FAILED) {
+        close(fd);
+        return 1;
+    }
+    close(fd);
+
+    chunk_t key_pem_chunk=_extract_chunk(data,
+               "-----BEGIN RSA PRIVATE KEY-----","-----END RSA PRIVATE KEY-----");
+    chunk_t cert_pem_chunk=_extract_chunk(data,
+                   "-----BEGIN CERTIFICATE-----","-----END CERTIFICATE-----");
+
+    /* key=0, cert=0 */
+    if(key_pem_chunk.len==0 && cert_pem_chunk.len==0) {
+        DEBUG_PRINTF("abac_context_load_id_idkey_file: no key or id in idkey_file\n");
+        goto error;
+    }
+
+    /* key=0, cert=1 */
+    if(key_pem_chunk.len==0) {
+        DEBUG_PRINTF("abac_context_load_id_idkey_file: no key in idkey_file\n");
+        munmap(data, sb.st_size);
+        chunk_free(&key_pem_chunk);
+        return abac_context_load_id_id_key_files(ctxt,filename,NULL);
+    }
+
+    /* key=1, cert=1 */
+    if(cert_pem_chunk.len!=0) {
+        DEBUG_PRINTF("loading cert pem chunk len(%d)\n", cert_pem_chunk.len);
+        rc=_abac_context_load_id_pem_chunk(ctxt,&id,cert_pem_chunk);
+        if(rc != 0) {
+            DEBUG_PRINTF("abac_context_load_id_idkey_file: fail to load the id\n");
+            goto error;
+        }
+    /* key=1, cert=0 */
+        } else {
+            DEBUG_PRINTF("abac_context_load_id_idkey_file: there is no id info in there\n");
+            goto error;
+    }
+    
+    /* handle the key_pem_chunk */
+    DEBUG_PRINTF("loading key pem chunk len(%d)\n", key_pem_chunk.len);
+    rc=abac_id_load_privkey_chunk(id, key_pem_chunk);
+    if(rc==0) {
+        printf("abac_context_load_id_idkey_file:failed to load priv key!!!\n");
+        goto error;
+    }
+
+    munmap(data, sb.st_size);
+    return 0;
+
+error:
+    munmap(data, sb.st_size);
+    return 1;
+}
+
+/**
+ * Load an ID cert from a file, it may contain encrypted key part but not necessary.
+ */
+int abac_context_load_id_enc_idkey_file(abac_context_t *ctxt, char *filename, char *pfile)
+{
+    struct stat sb;
+    int fd;
+    int rc;
+    abac_id_t *id=NULL;
+
+    assert(ctxt != NULL); assert(filename != NULL);
+    abac_id_credential_t *id_cert=NULL;
+
+    fd = open(filename, O_RDONLY);
+    if (fd == -1) { return 1; }
+    if(stat(filename, &sb) == -1) {
+        close(fd);
+        return 1;
+    }
+    char* data = (char *)mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+    if(data == MAP_FAILED) {
+    
+        return 1;
+    }
+    close(fd);
+
+    chunk_t key_pem_chunk=_extract_chunk(data,
+               "-----BEGIN RSA PRIVATE KEY-----","-----END RSA PRIVATE KEY-----");
+    chunk_t cert_pem_chunk=_extract_chunk(data,
+                   "-----BEGIN CERTIFICATE-----","-----END CERTIFICATE-----");
+
+    /* key=0, cert=0 */
+    if(key_pem_chunk.len==0 && cert_pem_chunk.len==0) {
+        DEBUG_PRINTF("abac_context_load_id_idkey_file: no key or id in idkey_file\n");
+        goto error;
+    }
+
+    /* key=0, cert=1 */
+    if(key_pem_chunk.len==0) {
+        DEBUG_PRINTF("abac_context_load_id_idkey_file: no key in idkey_file\n");
+        munmap(data, sb.st_size);
+        chunk_free(&key_pem_chunk);
+        return abac_context_load_id_id_key_files(ctxt,filename,NULL);
+    }
+
+    /* key=1, cert=1 */
+    if(cert_pem_chunk.len!=0) {
+        DEBUG_PRINTF("loading cert pem chunk len(%d)\n", cert_pem_chunk.len);
+        rc=_abac_context_load_id_pem_chunk(ctxt,&id,cert_pem_chunk);
+        if(rc != 0) {
+            DEBUG_PRINTF("abac_context_load_id_idkey_file: fail to load the id\n");
+            goto error;
+        }
+    /* key=1, cert=0 */
+        } else {
+            DEBUG_PRINTF("abac_context_load_id_idkey_file: there is no id info in there\n");
+            goto error;
+    }
+    
+    /* handle the key_pem_chunk */
+    DEBUG_PRINTF("loading key pem chunk len(%d)\n", key_pem_chunk.len);
+
+    rc=abac_id_load_enc_privkey_chunk(id, key_pem_chunk, pfile);
+    if(rc==0) {
+        printf("abac_context_load_id_idkey_file:failed to load priv key!!!\n");
+        goto error;
+    }
+
+    munmap(data, sb.st_size);
+    return 0;
+
+error:
+    munmap(data, sb.st_size);
+    return 1;
+}
+
+/* not duplicated */
+abac_id_credential_t *abac_context_id_credential_lookup(abac_context_t *ctxt,char *pname)
+{
+    int cnt=0;
+    assert(pname);
+    if(ctxt->context_id_hashkeyid_list) {
+        char *keyid;
+        abac_id_credential_t *id_cred;
+        abac_list_foreach(ctxt->context_id_hashkeyid_list, keyid,
+            if(strcmp(keyid,pname)==0) {
+                id_cred=abac_id_credential_lookup(keyid);
+                return id_cred;
+            }
+        );
+    }
+    return NULL;
+}
+
+void abac_context_id_credential_free(abac_context_t *ctxt, abac_id_credential_t *ptr)
+{
+    if (ptr == NULL)
+        return;
+
+    char *keyid=abac_id_credential_hashkey(ptr);
+
+    /* make sure it belongs to this context */
+    char *cur=NULL;
+    abac_list_foreach(ctxt->context_id_hashkeyid_list, cur,
+        if(strcmp(cur,keyid)==0) 
+            break;
+    );
+    assert(cur!=NULL);
+    abac_list_remove(ctxt->context_id_hashkeyid_list, cur);
+    free(cur);
+
+    abac_id_credential_free(ptr);
+}
+
+/****************************************************************************/
+static char *_get_keyid_from_cert(certificate_t *cert)
+{
+    assert(cert);
+    ac_t *ac=(ac_t *)cert;
+    ietf_attributes_t *attr_cert=ac->get_groups(ac);
+    if(attr_cert == NULL) {
+        char *tmp=NULL;
+        asprintf(&tmp,"_get_keyid_from_cert: fail to get keyid from certificate_t");
+        panic(tmp);
+    }
+    char *encoded_attr_string=attr_cert->get_string(attr_cert);
+    attr_cert->destroy(attr_cert);
+    return encoded_attr_string;
+}
+
+static int _verify_valid_credential_issuer(abac_context_t *ctxt, char* keyid,
+certificate_t *cert, abac_id_t **issuer_id)
+{
+    abac_id_credential_t *id_cred;
+    int ret, i;
+
+    // get the issuer based on keyid
+    id_cred=abac_context_id_credential_lookup(ctxt,keyid);
+    if(id_cred == NULL) {
+        ret = ABAC_CERT_MISSING_ISSUER;
+        DEBUG_PRINTF("_verify_valid_credential_issuer:can not find %s in id_creds\n", keyid);
+        goto error;
+    }
+
+    *issuer_id=abac_id_credential_id(id_cred);
+    if (*issuer_id == NULL) {
+        ret = ABAC_CERT_MISSING_ISSUER;
+        DEBUG_PRINTF("_verify_valid_credential_issuer:can not find %s in id_creds\n", keyid);
+        goto error;
+    }
+
+    // make sure the issuer's signed it
+    ret = verify_signature(abac_id_cert(*issuer_id), cert);
+    if (!ret) {
+        abac_yy_set_error_code(ABAC_RT_CERT_BAD_SIG);
+        ret=ABAC_CERT_BAD_SIG;
+        DEBUG_PRINTF("_verify_valid_credential_issuer:signing policy failed for %s \n", keyid);
+        goto error;
+    }
+
+    return ABAC_CERT_SUCCESS;
+
+error:
+    return ret;
+}
+
+/* at this point we know we have a good attribute cert baked it in */
+static int _insert_valid_cred(abac_context_t *ctxt, abac_id_t *issuer_id,
+abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect, certificate_t *cert,
+abac_credential_t **cred_ret, char *encoded_attr_string, int using_this)
+{
+    abac_list_t *clauses=NULL;
+    abac_id_credential_t *id_cred;
+    int ret, i;
+
+    // generate prolog clauses from aspect structures
+    clauses = generate_pl_clauses(ctxt,head_aspect, tail_aspect, encoded_attr_string,using_this);
+
+    // make a new credential if only is first
+    if(*cred_ret == NULL) {
+        abac_attribute_t *attr=abac_attribute_new(issuer_id, cert, cert->get_ref(cert));
+        abac_attribute_set_head(attr, head_aspect);
+        abac_attribute_add_tail(attr, tail_aspect);
+        if(using_this) abac_attribute_set_using_this(attr,using_this);
+        *cred_ret=abac_credential_new(abac_attribute_copy(attr),encoded_attr_string); /* need a deep copy ? */
+        abac_add_cred(*cred_ret);
+    }
+
+    // add clauses
+    char *cur=NULL;
+    abac_list_foreach(clauses, cur,
+        abac_list_add(ctxt->context_pl_clauses, abac_xstrdup(cur));
+    );
+
+    /* add locally */
+    abac_list_add(ctxt->context_attr_hashkeyid_list, abac_xstrdup(encoded_attr_string));
+    /* insert into db */
+    int add_ret=abac_pl_add_credential(clauses);
+
+    DEBUG_PRINTF("-->adding into context attr_creds, [%s]hashkey(%s)..cnt(%d)\n",
+       ctxt->namespace,
+       encoded_attr_string, abac_list_size(ctxt->context_attr_hashkeyid_list));
+
+    return ABAC_CERT_SUCCESS;
+
+error:
+    if(head_aspect) abac_aspect_free(head_aspect);
+    if(tail_aspect) abac_aspect_free(tail_aspect);
+    return ABAC_CERT_INVALID;
+}
+
+/**
+ * Load an attribute cert.
+ * Returns true only if the certificate is valid and is issued by the proper
+ * authority.
+ * attribute string is parsed via yyparse call
+ */
+static int _load_attribute_cert(abac_context_t *ctxt, certificate_t *cert,
+abac_credential_t **cred_ret)
+{
+    int ret, i;
+    abac_aspect_t *head_aspect = NULL;
+    abac_aspect_t *tail_aspect = NULL;
+    int using_this=0;
+    assert(cert);
+
+    char *encoded_attr_string=_get_keyid_from_cert(cert);
+    if(encoded_attr_string==NULL ) {
+       fprintf(stderr,"this is bad in loading the cert, empty encoded_attr_string\n");
+       goto error;
+    }
+    /* see if it already exists in context */
+    abac_credential_t *cred=abac_context_credential_lookup(ctxt,encoded_attr_string);
+    if(cred != NULL) {
+        if(debug) fprintf(stderr,"trying to insert identical attribute into a context\n");
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    char *attr_string = abac_decode_string(encoded_attr_string);
+    if (attr_string == NULL) {
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    /* see if it exist ... */
+    *cred_ret=abac_credential_lookup(encoded_attr_string);
+    if(*cred_ret != NULL ) {
+       //already exist in session
+       abac_attribute_t *attr=abac_credential_attribute(*cred_ret);
+       head_aspect=abac_attribute_head(attr);
+       tail_aspect=abac_attribute_tail(attr);
+       using_this=abac_attribute_get_this(attr);
+       } else {
+           /* call into yacc parser */
+           int rc=abac_yy_parse(ctxt, attr_string, &head_aspect, &tail_aspect, &using_this);
+           if(rc) {
+               ret = ABAC_CERT_INVALID;
+               goto error;
+           }
+    }
+
+    char *keyid=abac_aspect_principal_principalname(head_aspect);
+    abac_id_t *issuer_id=NULL;
+    ret= _verify_valid_credential_issuer(ctxt,keyid,cert,&issuer_id);
+    if(ret != ABAC_CERT_SUCCESS) {
+        char *tmp=NULL;
+        asprintf(&tmp,"_load_attribute_cert: fail to verify credential's issuer (%s)",attr_string);
+        panic(tmp);
+    }
+
+    ret=_insert_valid_cred(ctxt, issuer_id, head_aspect, tail_aspect,
+                                    cert,cred_ret,encoded_attr_string, using_this);
+
+    if(ret != ABAC_CERT_SUCCESS) {
+        char *tmp=NULL;
+        asprintf(&tmp,"_load_attribute_cert: fail to verify credential (%s)",attr_string);
+        panic(tmp);
+    }
+
+    return ABAC_CERT_SUCCESS;
+
+error:
+    return ret;
+}
+
+void abac_print_clauses(abac_list_t *clauses, FILE *fp)
+{
+    if (clauses != NULL) {
+        char *cur;
+        printf("total-- %d clauses\n", abac_list_size(clauses));
+        abac_list_foreach(clauses, cur,
+            if(cur) {
+                if(fp)
+                    fprintf (fp,"a clause, %d(%s)\n", (int)cur,cur);
+                    else printf ("a clause, %d(%s)\n", (int)cur,cur);
+            }
+        );
+    }
+}
+
+/**
+ * Load an attribute cert from a abac_attribute_t.
+ * attr should be all checked out before arriving here
+ * but because of preloading of id, need to check the issuer id's
+ * validity in this context
+ */
+int abac_context_load_attribute_attribute(abac_context_t *ctxt, abac_attribute_t *ptr)
+{
+    assert(ctxt != NULL);
+    abac_credential_t *cred=NULL;
+
+    certificate_t *cert=abac_attribute_cert(ptr);
+    return _load_attribute_cert(ctxt, cert, &cred);
+}
+
+/* this is especially made for abac_context_dup to avoid trying to do
+   yyparse again */
+int abac_context_load_attribute_credential(abac_context_t *ctxt, abac_attribute_t *ptr,
+abac_credential_t *cred)
+{
+    assert(ctxt != NULL);
+    certificate_t *cert=abac_attribute_cert(ptr);
+    return _load_attribute_cert(ctxt, cert, &cred);
+}
+
+
+/**
+ * Load an attribute cert from a abac_attribute_t.
+ * attr should be all checked out before arriving here
+ * this is called from abac.hh and so must make a 
+ * separate copy of attr 
+ */
+int abac_context_load_attribute(abac_context_t *ctxt, abac_attribute_t *ptr)
+{
+    assert(ctxt != NULL);
+    abac_attribute_t *nptr=abac_attribute_copy(ptr);
+    int ret= abac_context_load_attribute_attribute(ctxt, nptr);
+    return ret;
+}
+
+/**
+ * Load an attribute cert from a file.
+ */
+int abac_context_load_attribute_file(abac_context_t *ctxt, char *filename)
+{
+    abac_credential_t *cred=NULL;
+    assert(ctxt != NULL); assert(filename != NULL);
+
+    // load the cert
+    DEBUG_PRINTF("..loading attr file %s\n", filename);
+    certificate_t *cert = cert_get_attr_cert_from_file(filename);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int ret=_load_attribute_cert(ctxt, cert, &cred);
+    return ret;
+}
+
+/**
+ * Load an attribute cert from a chunk.
+ */
+int abac_context_load_attribute_chunk(abac_context_t *ctxt, abac_chunk_t ccert)
+{
+    abac_credential_t *cred=NULL;
+    assert(ctxt != NULL);
+    chunk_t chunk = { ccert.ptr, ccert.len };
+
+    // load the cert
+    certificate_t *cert = cert_get_attr_cert_from_chunk(chunk);
+    if (cert == NULL) return ABAC_CERT_INVALID;
+
+    int ret=_load_attribute_cert(ctxt, cert, &cred);
+    return ret;
+}
+
+
+/**
+ *  lookup for a credential/duplicated.
+ */
+abac_credential_t *abac_context_credential_lookup(abac_context_t *ctxt, char* cred_string)
+{
+    assert(cred_string); 
+    abac_credential_t *attr_cred=NULL;
+    int sz=abac_list_size(ctxt->context_attr_hashkeyid_list);
+    if(ctxt->context_attr_hashkeyid_list) {
+        char *keyid;
+        abac_list_foreach(ctxt->context_attr_hashkeyid_list, keyid,
+            if(strcmp(keyid,cred_string)==0) {
+                attr_cred=abac_credential_lookup(keyid);
+                break;
+            }
+        );
+    }
+    if (attr_cred == NULL) {
+        DEBUG_PRINTF("DEBUG:credential_lookup, NOT FOUND..(%d)(%s)\n",sz,abac_decode_string(cred_string));
+        return NULL;
+    }
+    abac_credential_t *rt=abac_credential_dup(attr_cred);
+    DEBUG_PRINTF("DEBUG:crential_lookup, FOUND.. (%d)(%s) \n", sz,abac_decode_string(cred_string));
+    return rt;
+}
+
+void abac_context_credential_free(abac_context_t *ctxt, abac_credential_t *ptr)
+{
+    if (ptr == NULL)
+        return;
+
+    char *keyid=abac_credential_hashkey(ptr);
+
+    /* make sure it belongs to this context */
+    char *cur=NULL;
+    abac_list_foreach(ctxt->context_attr_hashkeyid_list, cur,
+        if(strcmp(cur,keyid)==0)
+            break;
+    );
+    assert(cur!=NULL);
+    abac_list_remove(ctxt->context_attr_hashkeyid_list, cur);
+    free(cur);
+
+    abac_credential_free(ptr);
+}
+
+/**************************************************************/
+char *_make_key_filename(char *cert_file)
+{
+    char *p=strstr(cert_file,"_ID.");
+    char *head=strndup(cert_file,p-cert_file);
+    char *tail=p+4;
+    char *keyfile=NULL;
+    asprintf(&keyfile,"%s_private.%s",head,tail);
+    free(head);
+    return keyfile;
+}
+
+/**
+ * Load a directory full of principal certs.
+ */
+void abac_context_load_principals(abac_context_t *ctxt, char *path) {
+    char *glob_pat, *key_pat;
+    glob_t glob_buf;
+    int i, ret;
+
+    assert(ctxt != NULL); assert(path != NULL);
+
+    int dirlen = strlen(path);
+
+    /* make sure pick the larger one */
+    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
+    memcpy(glob_pat, path, dirlen);
+
+    // load ID certs
+    memcpy(glob_pat + dirlen, ID_PAT, sizeof(ID_PAT));
+    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
+    for (i = 0; i < glob_buf.gl_pathc; ++i) {
+        /* blah_ID.pem */
+        char *cert_file = glob_buf.gl_pathv[i];
+        /* blah_private.pem */
+        char *key_file=_make_key_filename(cert_file);
+        DEBUG_PRINTF("--> ID cert... %s\n", cert_file);
+        DEBUG_PRINTF("--> KEY cert... %s\n", key_file);
+        ret = abac_context_load_id_id_key_files(ctxt, cert_file, key_file);
+        if (ret != ABAC_CERT_SUCCESS)
+            warnx("Couldn't load ID cert %s", cert_file);
+    }
+    globfree(&glob_buf);
+
+    // next load IDKEY certs
+    memcpy(glob_pat + dirlen, IDKEY_PAT, sizeof(IDKEY_PAT));
+    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
+    for (i = 0; i < glob_buf.gl_pathc; ++i) {
+        /* blah_IDKEY.pem */
+        char *certkey_file = glob_buf.gl_pathv[i];
+        DEBUG_PRINTF("--> IDKEY certkey... %s\n", certkey_file);
+        ret = abac_context_load_id_idkey_file(ctxt, certkey_file);
+        if (ret != ABAC_CERT_SUCCESS)
+            warnx("Couldn't load ID/KEY IDKEY cert %s", certkey_file);
+    }
+    globfree(&glob_buf);
+
+    free(glob_pat);
+}
+
+/**
+ * Load a directory full of certs.
+ */
+void abac_context_load_directory(abac_context_t *ctxt, char *path) {
+    char *glob_pat, *key_pat;
+    glob_t glob_buf;
+    int i, ret;
+
+    abac_context_load_principals(ctxt,path);
+    int dirlen = strlen(path);
+
+    /* make sure pick the larger one */
+    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
+    memcpy(glob_pat, path, dirlen);
+
+    memcpy(glob_pat + dirlen, ATTR_PAT, sizeof(ATTR_PAT));
+    glob(glob_pat, 0, NULL, &glob_buf); // TODO check for error
+    DEBUG_PRINTF("glob_pat is (%s)\n", glob_pat);
+    for (i = 0; i < glob_buf.gl_pathc; ++i) {
+        char *cert_file = glob_buf.gl_pathv[i];
+
+        DEBUG_PRINTF("--> attr file... (%s)\n", cert_file);
+        ret = abac_context_load_attribute_file(ctxt, cert_file);
+        if (ret != ABAC_CERT_SUCCESS)
+            warnx("Couldn't load attribute cert --(%d)%s", ret,cert_file);
+        DEBUG_PRINTF("Loaded.. (%s)\n", cert_file);
+    }
+    globfree(&glob_buf);
+
+    free(glob_pat);
+}
+
+/**
+ * Run a query on the data in an abac context. Returns a NULL-terminated array
+ * of abac_credential_t. Success/failure in *success.
+ * queryfor(either role or oset), with(either keyid or object type)
+ */
+abac_credential_t **abac_context_query(abac_context_t *ctxt, char *queryfor, char *with, int *success) {
+    DEBUG_PRINTF("abac_context_query about(%s) with(%s)\n", queryfor, with);
+    abac_credential_t **credentials = NULL, *cur;
+    assert(ctxt != NULL); assert(queryfor != NULL);
+    assert(with != NULL); assert(success != NULL);
+
+    abac_stack_t *result = abac_pl_query(ctxt->pl, queryfor, with);
+
+    int size = abac_stack_size(result);
+    if (size > 0) {
+       if(!abac_pl_returning_partial(ctxt->pl))
+            *success = 1;
+            else *success = 0;
+    } else {
+	*success = 0;
+    }
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) { 
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            credentials[i++] = cur;
+        } 
+    }
+    credentials[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+
+    return credentials;
+}
+
+/**
+ * Run a repeated query on the data in an abac context to get the next
+ * solution proof. Returns a NULL-terminated array
+ * of abac_credential_t. Success/failure in *success.
+ */
+abac_credential_t **abac_context_query_again(abac_context_t *ctxt, int *success)
+{
+    DEBUG_PRINTF("abac_context_query_again\n");
+    abac_credential_t **credentials = NULL, *cur;
+    assert(ctxt != NULL);
+    assert(success != NULL);
+
+    abac_stack_t *result = abac_pl_query_again(ctxt->pl);
+
+    int size = abac_stack_size(result);
+    if (size > 0) {
+        *success = 1;
+        } else {
+            *success = 0;
+    }
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) { 
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            credentials[i++] = cur;
+        } 
+    }
+    credentials[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+
+    return credentials;
+}
+
+
+abac_credential_t **abac_context_query_with_structure(abac_context_t *ctxt,
+abac_aspect_t *queryfor, abac_aspect_t *with, int *success)
+{
+    DEBUG_PRINTF("abac_context_query_with_structure\n");
+    abac_credential_t **credentials = NULL, *cur;
+    assert(ctxt != NULL); assert(queryfor != NULL);
+    assert(with != NULL); assert(success != NULL);
+
+    abac_stack_t *result = abac_pl_query_with_structure(ctxt->pl, queryfor, with);
+
+    int size = abac_stack_size(result);
+    if (size > 0) {
+        *success = 1;
+    } else {
+    // XXX NOT SURE YET..
+    // return partial proof
+	*success = 0;
+    }
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) { 
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            credentials[i++] = cur;
+        } 
+    }
+    credentials[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+
+    return credentials;
+}
+
+/**
+ * A NULL-terminated array of all the credentials in the context.
+ */
+abac_credential_t **abac_context_credentials(abac_context_t *ctxt) {
+    abac_credential_t **credentials = NULL, *cur;
+    assert(ctxt != NULL);
+
+    abac_stack_t *result = abac_context_dump_creds(ctxt);
+    int size = abac_stack_size(result);
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) { 
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            /* if not in there yet, add into it */
+            credentials[i++] = cur;
+        } 
+    }
+    credentials[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+    return credentials;
+}
+
+/**
+ * Frees a NULL-terminated list of credentials. context independent
+ */
+void abac_free_credentials(abac_credential_t **credentials) {
+    int i;
+
+    if (credentials == NULL)
+        return;
+
+    for (i = 0; credentials[i] != NULL; ++i)
+        abac_credential_free(credentials[i]);
+    free(credentials);
+}
+
+/**
+ * A NULL-terminated array of all the principals in the context.
+ */
+abac_id_credential_t **abac_context_principals(abac_context_t *ctxt)
+{
+    abac_id_credential_t **principals = NULL, *cur;
+    assert(ctxt != NULL);
+
+    abac_stack_t *result = abac_context_dump_principals(ctxt);
+
+    int size = abac_stack_size(result);
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    principals = abac_xmalloc(sizeof(abac_id_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) {
+            cur=(abac_id_credential_t *) abac_stack_pop(result);
+            /* if not in there yet, add into it */
+            principals[i++] = cur;
+        }
+    }
+    principals[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+    return principals;
+}
+
+/**
+ * Frees a NULL-terminated list of principals, context independent
+ */
+void abac_free_principals(abac_id_credential_t **principals)
+{
+    int i;
+
+    if (principals == NULL)
+        return;
+
+    for (i = 0; principals[i] != NULL; ++i)
+        abac_id_credential_free(principals[i]);
+    free(principals);
+}
+
+
+
+/**
+ * Free an abac context.
+ */
+void abac_context_free(abac_context_t *ctxt) 
+{
+    assert(ctxt != NULL);
+    DEBUG_PRINTF("abac_conext_free..\n");
+
+    abac_verifier_session_remove_context(ctxt);
+
+    if(ctxt->namespace) free(ctxt->namespace);
+    abac_pl_free(ctxt->pl);
+
+    DEBUG_PRINTF("looking to free context_attr_hashkeyid_list..\n");
+    if(ctxt->context_attr_hashkeyid_list) { 
+        if( abac_list_size(ctxt->context_attr_hashkeyid_list)>0) {
+           /* free all the keys */
+           char *cur;
+           abac_list_foreach(ctxt->context_attr_hashkeyid_list, cur,
+              if(cur) { 
+                 DEBUG_PRINTF("hum.. attr hashkey being freed.. %s\n", cur);
+                 abac_credential_t *attr=abac_credential_lookup(cur);
+/* XXX abac_check_cred(cur); */
+                 assert(attr!=NULL);
+                 abac_credential_free(attr);
+                 free(cur);
+              }
+           );
+        }
+        abac_list_free(ctxt->context_attr_hashkeyid_list);
+    }
+
+    DEBUG_PRINTF("looking to free context_id_hashkeyid_list..\n");
+    if(ctxt->context_id_hashkeyid_list) {
+ 
+        if(abac_list_size(ctxt->context_id_hashkeyid_list)) {
+            char *cur;
+            abac_list_foreach(ctxt->context_id_hashkeyid_list, cur,
+                if(cur) {
+                    DEBUG_PRINTF("hum.. id hashkey being freed.. %s\n", cur);
+/* abac_id_credential_t *id=abac_check_id_cred(cur); */
+                    abac_id_credential_t *id=abac_id_credential_lookup(cur);
+                    assert(id!=NULL);
+                    abac_id_credential_free(id);
+                    free(cur);
+                }
+            );
+        }
+        abac_list_free(ctxt->context_id_hashkeyid_list);
+    }
+
+    DEBUG_PRINTF("looking to free context_pl_clauses..\n");
+    if(ctxt->context_pl_clauses) {
+        if(abac_list_size(ctxt->context_pl_clauses)) {
+            abac_pl_remove_credential(ctxt->context_pl_clauses);
+            char *cur;
+            abac_list_foreach(ctxt->context_pl_clauses, cur,
+                if(cur) free(cur);
+            );
+        }
+        abac_list_free(ctxt->context_pl_clauses);
+    }
+    free(ctxt);
+}
+
+void abac_context_set_no_partial_proof(abac_context_t *ctxt)
+{ abac_pl_set_no_partial(ctxt->pl); }
+
+void abac_context_set_want_partial_proof(abac_context_t *ctxt)
+{ abac_pl_set_want_partial(ctxt->pl); }
+
+/****************************************************************************/
+void abac_context_dump_clauses(abac_context_t *ctxt)
+{
+    printf("===YAP clauses for [%s]===\n", ctxt->namespace);
+    if(ctxt->context_pl_clauses) {
+        char *cur;
+        abac_list_foreach(ctxt->context_pl_clauses, cur,
+            if(cur) {
+               printf("%s\n", cur);
+            }
+        );
+        } else {
+            DEBUG_PRINTF("abac_contxt_dump_clauses: no yap clauses!!!!\n");
+    }
+    printf("==========================\n");
+}
+
+
+void abac_context_dump(abac_context_t *ctxt)
+{
+    abac_stack_t *result = abac_context_dump_creds(ctxt);
+    int size = abac_stack_size(result);
+    int i=0;
+
+    printf("CONTEXT: [%s]\n", ctxt->namespace); 
+
+    if(size) {
+        abac_credential_t *cur;
+        while(i<size) {
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            abac_print_typed_cred_info(cur,NULL);
+            abac_credential_free(cur);
+            i++; 
+        }
+    }
+    abac_stack_free(result);
+
+    result = abac_context_dump_principals(ctxt);
+    size = abac_stack_size(result);
+    i=0;
+    if(size) {
+        abac_id_credential_t *cur;
+        while(i<size) {
+            cur=(abac_id_credential_t *) abac_stack_pop(result);
+            abac_print_prin_info(cur,NULL);
+            abac_id_credential_free(cur);
+            i++; 
+        }
+    }
+    abac_stack_free(result);
+    abac_context_dump_clauses(ctxt);
+
+}
Index: libabac/abac_context.h
===================================================================
--- libabac/abac_context.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_context.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,20 @@
+#ifndef __ABAC_CONTEXT_H__
+#define __ABAC_CONTEXT_H__
+
+#include <stdio.h>
+#include "abac_defines.h"
+#include "abac_list.h"
+
+/* export */
+extern abac_id_credential_t *abac_context_id_creds(abac_context_t *ctxt);
+extern abac_credential_t *abac_context_attr_creds(abac_context_t *ctxt);
+extern char *abac_context_namespace(abac_context_t *ctxt);
+extern abac_id_credential_t *abac_context_id_credential_lookup(abac_context_t *,char *);
+extern abac_credential_t *abac_context_credential_lookup(abac_context_t *, char*);
+
+extern void abac_print_clauses(abac_list_t *clauses, FILE *fp);
+extern void abac_context_dump(abac_context_t *ctxt);
+
+
+
+#endif /* __ABAC_CONTEXT_H__ */
Index: libabac/abac_external.h
===================================================================
--- libabac/abac_external.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_external.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,152 @@
+#ifndef __ABAC_X_H__
+#define __ABAC_X_H__
+
+/* forward from abac_util */
+extern char *abac_version();
+extern char *abac_xstrdup(char*);
+extern void abac_errx(int eval, const char *msg);
+
+/* abac functions that are used in abac.hh */
+extern void show_yap_db(const char *);
+extern void show_debug_info(const char *);
+extern void abac_constraint_add_integer_max(abac_condition_t *cond,int val);
+extern void abac_constraint_add_integer_min(abac_condition_t *cond,int val);
+extern void abac_constraint_add_integer_target(abac_condition_t *cond,int val);
+extern void abac_constraint_add_float_max(abac_condition_t *cond,float val);
+extern void abac_constraint_add_float_min(abac_condition_t *cond,float val);
+extern void abac_constraint_add_float_target(abac_condition_t *cond,float val);
+extern void abac_constraint_add_time_max(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_time_min(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_time_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_urn_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_string_target(abac_condition_t *cond,char* val);
+extern void abac_constraint_add_boolean_target(abac_condition_t *cond, char* val);
+extern abac_condition_t *abac_constraint_from_role(abac_aspect_t *ptr);
+extern abac_condition_t *abac_constraint_create(char *vtype);
+extern abac_condition_t *abac_constraint_from_oset(abac_aspect_t *);
+extern char *abac_constraint_typed_string(abac_condition_t *);
+extern char *abac_constraint_string(abac_condition_t *);
+extern abac_aspect_t *abac_role_principal_create(char *);
+extern abac_aspect_t *abac_role_create(char *, char *);
+extern abac_aspect_t *abac_oset_create(char *, char *);
+extern abac_aspect_t *abac_oset_linked_create(char *principal_name, char *linked_role_name, char *oset_name);
+extern abac_aspect_t *abac_role_linked_create(char *principal_name, char *linked_role_name, char *role_name);
+extern abac_aspect_t *abac_oset_object_create(abac_term_t *object);
+extern int abac_oset_is_object(abac_aspect_t *ptr);
+extern int abac_oset_is_principal(abac_aspect_t *ptr);
+extern int abac_role_is_principal(abac_aspect_t *ptr);
+extern int abac_oset_is_linking(abac_aspect_t *ptr);
+extern int abac_role_is_linking(abac_aspect_t *ptr);
+extern char *abac_role_linked_role(abac_aspect_t *ptr);
+extern char *abac_oset_linked_role(abac_aspect_t *ptr);
+extern char *abac_role_name(abac_aspect_t *ptr);
+extern char *abac_oset_name(abac_aspect_t *ptr);
+extern char *abac_role_principal(abac_aspect_t *ptr);
+extern char *abac_oset_principal(abac_aspect_t *ptr);
+extern void abac_role_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_oset_add_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_role_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_oset_add_linked_data_term(abac_aspect_t *ptr, abac_term_t *param);
+extern char *abac_oset_object(abac_aspect_t *ptr);
+extern char *abac_oset_typed_string(abac_aspect_t *ptr);
+extern char *abac_oset_string(abac_aspect_t *ptr);
+extern char *abac_role_typed_string(abac_aspect_t *ptr);
+extern char *abac_role_string(abac_aspect_t *ptr);
+extern abac_term_t **abac_oset_get_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_oset_get_linked_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_role_get_data_terms(abac_aspect_t *ptr);
+extern abac_term_t **abac_role_get_linked_data_terms(abac_aspect_t *ptr);
+extern void abac_id_write_cert_fname(abac_id_t *ptr,char *filename);
+extern void abac_id_write_privkey_fname(abac_id_t *ptr,char *filename);
+extern char *abac_head_string(abac_attribute_t *ptr);
+extern char *abac_tail_string(abac_attribute_t *ptr);
+extern char *abac_head_typed_string(abac_attribute_t *ptr);
+extern char *abac_tail_typed_string(abac_attribute_t *ptr);
+extern void abac_attribute_write_cert_fname(abac_attribute_t *ptr,char *filename);
+extern abac_aspect_t **abac_attribute_role_tails(abac_attribute_t *ptr);
+extern abac_aspect_t **abac_attribute_oset_tails(abac_attribute_t *ptr);
+extern int abac_context_principal_count(abac_context_t *ptr);
+extern int abac_context_credential_count(abac_context_t *ptr);
+extern int abac_context_load_id(abac_context_t *ptr, abac_id_t *id);
+extern int abac_context_load_id_idkey_file(abac_context_t *ptr, char *filename);
+extern int abac_context_load_id_files(abac_context_t *ptr, char *filename, char *keyfilename);
+extern int abac_context_load_encrypted_id_file(abac_context_t *ptr, char *filename, char *pfile);
+extern int abac_context_load_encrypted_id_files(abac_context_t *ptr, char *filename, char *keyfilename, char *pfile);
+extern abac_aspect_t *abac_aspect_dup(abac_aspect_t*);
+extern void abac_aspect_free(abac_aspect_t*);
+extern void abac_aspects_free(abac_aspect_t **);
+extern abac_attribute_t *abac_attribute_add_tail(abac_attribute_t*, abac_aspect_t *);
+extern int abac_attribute_bake(abac_attribute_t*);
+extern int abac_attribute_baked(abac_attribute_t*);
+extern abac_chunk_t abac_attribute_cert_chunk(abac_attribute_t*);
+extern int abac_attribute_create(abac_attribute_t **ret,abac_aspect_t *head, abac_aspect_t *tail,int validity);
+extern abac_attribute_t *abac_attribute_dup(abac_attribute_t *);
+extern void abac_attribute_free(abac_attribute_t *);
+extern abac_attribute_t *abac_attribute_from_chunk(abac_chunk_t achunk);
+extern abac_aspect_t *abac_attribute_head(abac_attribute_t *);
+extern int abac_attribute_is_role(abac_attribute_t *);
+extern char *abac_attribute_string(abac_attribute_t*);
+extern char *abac_attribute_typed_string(abac_attribute_t*);
+extern int abac_attribute_write_cert(abac_attribute_t*, FILE *out);
+extern abac_condition_t *abac_condition_dup(abac_condition_t *);
+extern void abac_condition_free(abac_condition_t *);
+extern abac_credential_t **abac_context_credentials(abac_context_t *);
+extern void abac_free_credentials(abac_credential_t **);
+extern abac_context_t *abac_context_dup(abac_context_t *);
+extern void abac_context_free(abac_context_t*);
+extern int abac_context_load_attribute_chunk(abac_context_t*, abac_chunk_t);
+extern void abac_context_load_directory(abac_context_t*, char*);
+extern void abac_context_load_principals(abac_context_t*, char*);
+extern abac_context_t *abac_context_new();
+extern abac_context_t *abac_context_named_new(char*);
+extern abac_id_credential_t *abac_context_principal_lookup(abac_context_t*, char*);
+extern abac_id_credential_t **abac_context_principals(abac_context_t *);
+extern void abac_free_principals(abac_id_credential_t **);
+extern abac_credential_t **abac_context_query(abac_context_t*, char*, char*, int*);
+extern void abac_context_set_no_partial_proof(abac_context_t*);
+extern void abac_context_set_want_partial_proof(abac_context_t*);
+extern abac_attribute_t *abac_credential_attribute(abac_credential_t *);
+extern abac_chunk_t abac_id_cert_chunk(abac_id_t *);
+extern char *abac_id_cn(abac_id_t *);
+extern abac_id_t *abac_id_credential_id(abac_id_credential_t*);
+extern abac_id_t *abac_id_dup(abac_id_t *);
+extern void abac_id_free(abac_id_t *);
+extern abac_id_t *abac_id_from_chunk(abac_chunk_t);
+extern abac_id_t *abac_id_from_file(char *filename);
+extern int abac_id_generate(abac_id_t **ret, char *cn, int validity);
+extern int abac_id_generate_with_key(abac_id_t **ret, char *cn, int validity, char *keyfile, char *pfile);
+extern int abac_id_has_privkey(abac_id_t *id);
+extern char *abac_id_keyid(abac_id_t *id);
+extern int abac_id_load_privkey_file(abac_id_t *id, char *filename);
+extern abac_chunk_t abac_id_privkey_chunk(abac_id_t *id);
+extern char *abac_id_string(abac_id_t *id);
+extern void abac_id_write_cert(abac_id_t *id, FILE *out);
+extern int abac_id_write_privkey(abac_id_t *id, FILE *out);
+extern abac_term_t *abac_term_add_constraint(abac_term_t*, abac_condition_t*);
+extern abac_term_t *abac_term_create(char*,char*,abac_condition_t*);
+extern abac_term_t *abac_term_dup(abac_term_t*);
+extern void abac_term_free(abac_term_t*);
+extern abac_term_t *abac_term_id_create(abac_id_t *);
+extern int abac_term_is_integer(abac_term_t*);
+extern int abac_term_is_string(abac_term_t*);
+extern int abac_term_is_time(abac_term_t*);
+extern int abac_term_is_urn(abac_term_t*);
+extern void abac_terms_free(abac_term_t **);
+extern char *abac_term_string(abac_term_t*);
+extern int abac_context_load_attribute_file(abac_context_t *ctx, char *filename);
+extern int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert);
+extern int abac_context_load_id_enc_privkey_chunk(abac_context_t *ctx,abac_chunk_t cert, abac_chunk_t privkey, char *pfile);
+extern int abac_context_load_id_privkey_chunk(abac_context_t *ctx, abac_chunk_t cert, abac_chunk_t privkey);
+extern abac_credential_t **abac_context_query_again(abac_context_t *ctx, int *success);
+extern abac_credential_t **abac_context_query_with_structure(abac_context_t*, abac_aspect_t*, abac_aspect_t*, int*);
+extern int abac_id_load_enc_privkey_file(abac_id_t *ptr, char *keyfile, char *pfile);
+extern abac_term_t *abac_term_named_create(char *name);
+extern char *abac_term_typed_string(abac_term_t *ptr);
+extern int abac_term_type(abac_term_t *term);
+extern abac_aspect_t *abac_oset_principal_create(char *principal_name);
+extern int abac_context_load_attribute(abac_context_t *ptr, abac_attribute_t *attr);
+extern char *abac_term_name(abac_term_t *term);
+
+extern void abac_attribute_set_using_this(abac_attribute_t *,int);
+
+#endif /* __ABAC_X_H__ */
Index: libabac/abac_id.c
===================================================================
--- libabac/abac_id.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_id.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,60 +1,73 @@
-
 /**
 **  abac_id.c
 **/
 
-#include <assert.h>
-#include <err.h>
-#include <time.h>
-
-// include the GNU extension of asprintf
 #define _GNU_SOURCE
 #include <stdio.h>
 #include <err.h>
-
-#include "abac_internal.h"
+#include <assert.h>
+#include <time.h>
+
 #include "abac_util.h"
+#include "abac_key.h"
+#include "abac_verifier.h"
+#include "abac_util_cert.h"
 
 static int debug=0;
+
+/* load id into a session when id is being created instead
+   of when id is added into a context */
+static int early_load_id=1;
+
+/* idtypename[idtype] */
+static const char * const _idtypename[] =
+{
+  "badidtype", "keyid"
+};
+static int _idtypename_cnt=1;
+
+
+// abac_id object
+struct _abac_id_t {
+    int idtype;    /* default to string 'keyid' for now */
+    char *keyid; /* sha */
+    char *cn;
+    certificate_t *cert;
+    abac_key_t *key;
+    int refcount;
+};
 
 #define KEY_SUFFIX  "_private.pem"
 #define CERT_SUFFIX "_ID.pem"
 
-extern private_key_t *abac_key_private_key(abac_key_t *ptr);
-extern abac_key_t *abac_key_file_new(char *filename, chunk_t potato);
-extern abac_key_t *abac_key_chunk_new(chunk_t keyblob, chunk_t potato);
-extern chunk_t abac_key_chunk(abac_key_t *);
-
-static int _abac_id_set_cn(abac_id_t *id, char* cn);
-
-//
-// abac_id object
-//
-struct _abac_id_t {
-    int idtype;    /* default to string 'keyid' for now */
-
-    char *keyid; /* sha */
-    char *cn;
-
-    certificate_t *cert;
-    abac_key_t *key;
-
-    int refcount;
-};
-
+
+/* local */
+char *abac_id_keyid(abac_id_t*);
+abac_id_t *abac_id_copy(abac_id_t *id);
 /****************************************************************/
 //
 // Helper functions below
 //
-static char *_get_keyid(certificate_t *cert) {
-    // get the keyid
-    x509_t *x509 = (x509_t *)cert;
-    chunk_t keyid = x509->get_subjectKeyIdentifier(x509);
-    chunk_t string = chunk_to_hex(keyid, NULL, 0);
-    return (char *)string.ptr;
-}
-
-static char *_create_dn(char *cn) {
-
+int abac_idtype_lookup(char *type)
+{
+    int i;
+    for (i = 1; i <= _idtypename_cnt ; i++)
+        if(strcmp(type,_idtypename[i])==0)
+            return i;
+    return 0;
+}
+
+char *abac_idtype_string(int i)
+{
+    if(i > _idtypename_cnt) {
+        printf("bad idtypename idx %d\n", i);
+        panic("abac_idtype_string: went out of range on idtypename");
+    }
+    return (char*) _idtypename[i];
+}
+
+
+static char *_create_dn(char *cn)
+{
 #define DN "cn="
 
@@ -64,4 +77,51 @@
 
     return dn;
+}
+
+void abac_id_dump_from_id(abac_id_t *id)
+{
+    fprintf(stderr,"abac_id_dump_id: \n");
+    fprintf(stderr,"idtype: %d\n",id->idtype); 
+    fprintf(stderr,"keyid: %s\n",id->keyid);
+    fprintf(stderr,"cn: %s\n", id->cn);
+    fprintf(stderr,"refcount: %d\n",id->refcount);
+    if(id->key !=NULL) fprintf(stderr,"has private key\n");
+    if(id->cert !=NULL) fprintf(stderr,"has cert\n");
+}
+
+void abac_id_dump_from_cert(certificate_t *cert)
+{
+    char *ret;
+    fprintf(stderr,"abac_id_dump_from_cert: \n");
+    int rv = asprintf(&ret, "%Y", cert->get_issuer(cert));
+    fprintf(stderr,"issuer: %s\n",ret);
+    fprintf(stderr,"keyid: %s\n",cert_get_keyid(cert));
+}
+
+
+/**
+ *
+ * Preload ID into sessions' master list before being
+ * loaded into some context
+ *
+**/
+
+static int _add_into_id_credentials(abac_id_t *id)
+{
+    char *keyid=abac_id_keyid(id);
+    abac_id_credential_t *idcred=abac_id_credential_lookup(keyid);
+    if(idcred !=NULL) {
+       if(debug) fprintf(stderr,"_add_into_id_credentials: something in there for %s\n",keyid);
+       idcred=abac_id_credential_dup(idcred);
+       } else {
+          if(debug) fprintf(stderr,"_add_into_id_credentials: adding %s\n",keyid);
+          if(early_load_id) {
+             /* this id needed to be deep copyed, because it is going into our
+                session id credential list */
+             abac_id_t *nid = abac_id_copy(id);
+             idcred=abac_id_credential_new(nid);
+             abac_add_id_cred(idcred);
+          }
+    }
 }
 
@@ -76,6 +136,8 @@
     libabac_init();
 
-    identification_t *id = identification_create_from_string(dn_string);
-    if (id == NULL)
+    DEBUG_PRINTF("\n_generate_cert: id cert for cn(%s)with dn(%s)\n", cn, dn_string);
+
+    identification_t *iden = identification_create_from_string(dn_string);
+    if (iden == NULL)
         errx(1, "couldn't create ID from DN %s", dn_string);
     free(dn_string);
@@ -107,5 +169,5 @@
         BUILD_SIGNING_KEY, private,
         BUILD_PUBLIC_KEY, public,
-        BUILD_SUBJECT, id,
+        BUILD_SUBJECT, iden,
         BUILD_NOT_BEFORE_TIME, not_before,
         BUILD_NOT_AFTER_TIME, not_after,
@@ -119,5 +181,5 @@
         errx(1, "couldn't build cert :(");
 
-    DESTROY_IF(id);
+    DESTROY_IF(iden);
     DESTROY_IF(public);
     DESTROY_IF(private);
@@ -127,4 +189,10 @@
 }
 
+/* from libstrongswan, chunk.h
+chunk_t chunk_from_base64(chunk_t base64, char *buf);
+chunk_t chunk_to_base64(chunk_t chunk, char *buf);
+    chunk_t b64 = chunk_to_base64(chunk, NULL);
+    chunk_t chk = chunk_from_base64(base64, NULL); 
+*/
 #define BYTES_PER_LINE 64
 
@@ -242,10 +310,12 @@
 }
 
-certificate_t *abac_id_cert(abac_id_t *id) {
+certificate_t *abac_id_cert(abac_id_t *id)
+{
     assert(id != NULL);
     return id->cert;
 }
 
-private_key_t *abac_id_privkey(abac_id_t *id) {
+private_key_t *abac_id_privkey(abac_id_t *id)
+{
     assert(id != NULL);
     if(id->key !=0)
@@ -256,13 +326,27 @@
 abac_key_t *abac_id_keyptr(abac_id_t *id)
 {
+    assert(id!=NULL);
     return id->key;
 }
 
-int abac_id_has_privkey(abac_id_t *id) {
-    if(id->key !=0)
+int abac_id_has_privkey(abac_id_t *id)
+{
+    if(id && id->key !=0)
        return 1;
     return 0;
 }
 
+// convert a chunk to a lowercase binary string
+// malloc's the string
+static char *_chunk_to_string(chunk_t chunk) {
+    int i;
+
+    char *ret = abac_xmalloc(chunk.len * 2 + 1);
+
+    for (i = 0; i < chunk.len; ++i)
+        sprintf(ret + 2 * i, "%02x", chunk.ptr[i]);
+
+    return ret;
+}
 
 /**
@@ -276,5 +360,4 @@
     if(rc) {
         _encode_base64(out, encoding);
-        free(encoding.ptr);
     }
 }
@@ -321,5 +404,6 @@
  * Copy an abac ID. Actually just increases its reference count.
  */
-abac_id_t *abac_id_dup(abac_id_t *id) {
+abac_id_t *abac_id_dup(abac_id_t *id)
+{
     if(id)
         ++id->refcount;
@@ -328,6 +412,9 @@
 
 void abac_id_free(abac_id_t *id) {
+
     if (id == NULL)
         return;
+
+    DEBUG_PRINTF("\nabac_id_free: deleting id with cn(%s)with sha(%s) at(%ld)\n", id->cn, id->keyid, (long)id);
 
     --id->refcount;
@@ -335,10 +422,11 @@
         return;
 
-    if(debug)
-        fprintf(stderr,"making abac_id_free call on (%s)!!!\n", id->cn);
     // free once the reference count reaches 0
     DESTROY_IF(id->cert);
 
-    if(id->key) abac_key_free(id->key);
+    if(id->key) {
+         DEBUG_PRINTF("abac_id_free: deleting id with cn(%s)at(%ld)key(%ld)\n", id->cn, (long)id, (long)id->key);
+         abac_key_free(id->key);
+    }
 
     free(id->keyid);
@@ -384,4 +472,8 @@
 certificate_t *cert)
 {
+if(debug)
+   fprintf(stderr,"abac_id_new, keyid(%s), cn(%s) keyid from cert(%s)\n",
+           keyid,cn, cert_get_keyid(cert));
+
     abac_id_t *id = abac_xmalloc(sizeof(abac_id_t));
     id->idtype = idtype;
@@ -391,8 +483,40 @@
     id->key = NULL;
     id->refcount = 1;
-    if(debug) fprintf(stderr,"abac_id_new: made a new id, %ld\n",(long) id);
+    _add_into_id_credentials(id);
     return id;
 }
 
+static certificate_t *_certificate_copy(certificate_t *cert)
+{
+    chunk_t encoding = chunk_empty;
+    int rc=cert->get_encoding(cert,CERT_ASN1_DER,&encoding);
+    certificate_t *ncert = cert_get_id_cert_from_chunk(encoding);
+    return ncert;
+}
+
+/*
+    hard duplicate of an id 
+    This is used by the libabac interface for case the where
+    abac_context_load_id(abac_id_t *id) is called. We want
+    the structure being kept in libabac to be locally held
+    so that we are not subject to destructor being called on
+    the structure by some other system or being called in
+    certain way that is not fully controlled by libabac.
+*/
+abac_id_t *abac_id_copy(abac_id_t *id)
+{
+    assert(id);
+    abac_id_t *nid = abac_xmalloc(sizeof(abac_id_t));
+    nid->idtype = id->idtype;
+    nid->keyid = abac_xstrdup(id->keyid);
+    nid->cn = abac_xstrdup(id->cn);
+    nid->cert = _certificate_copy(id->cert);
+    if(id->key)
+        nid->key = abac_key_copy(id->key); 
+        else nid->key=NULL;
+    nid->refcount = id->refcount+1;
+    return nid;
+}
+
 abac_id_t *abac_id_keyid_new(char *keyid, char *cn, certificate_t *cert)
 {
@@ -400,5 +524,6 @@
 }
 
-static abac_id_t *_abac_id_from_cert(certificate_t *cert) {
+static abac_id_t *_abac_id_from_cert(certificate_t *cert)
+{
     abac_id_t *id = abac_xmalloc(sizeof(abac_id_t));
     id->idtype = e_KEYID;
@@ -408,5 +533,5 @@
     id->key = NULL;
 
-    id->keyid = _get_keyid(id->cert);
+    id->keyid = cert_get_keyid(id->cert);
     // get the CN from the cert
     id_part_t type;
@@ -435,5 +560,5 @@
 
     id->refcount = 1;
-
+    _add_into_id_credentials(id);
     return id;
 }
@@ -449,13 +574,7 @@
 
     libabac_init();
-    certificate_t *cert = lib->creds->create(lib->creds,
-        CRED_CERTIFICATE, CERT_X509,
-        BUILD_FROM_FILE, filename,
-        BUILD_X509_FLAG, X509_AA,
-        BUILD_END
-    );
-
-    if (cert == NULL)
-        return NULL;
+    certificate_t *cert = cert_get_id_cert_from_file(filename);
+
+    if (cert == NULL) return NULL;
 
     return _abac_id_from_cert(cert);
@@ -465,16 +584,10 @@
  * Create an ID cert from a chunk.
  */
-abac_id_t *abac_id_from_chunk(abac_chunk_t achunk) {
+abac_id_t *abac_id_from_chunk(abac_chunk_t achunk)
+{
     chunk_t chunk = { .ptr = achunk.ptr, .len = achunk.len };
-
-    certificate_t *cert = lib->creds->create(lib->creds,
-        CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_X509_FLAG, X509_AA,
-        BUILD_END
-    );
-
-    if (cert == NULL)
-        return NULL;
+    certificate_t *cert = cert_get_id_cert_from_chunk(chunk);
+
+    if (cert == NULL) return NULL;
 
     return _abac_id_from_cert(cert);
@@ -491,5 +604,5 @@
         return ABAC_ID_GENERATE_INVALID_CN;
 
-    if(debug) fprintf(stderr,"abac_id_generate: generating id with cn(%s)\n",cn);
+    DEBUG_PRINTF("abac_id_generate: generating id with cn(%s)\n",cn);
 
     if (validity < 0)
@@ -506,7 +619,8 @@
     id->key = abac_key_generate();
     id->cert = _generate_cert(id->key, cn, validity);
-    id->keyid = _get_keyid(id->cert);
+    id->keyid = cert_get_keyid(id->cert);
 
     id->refcount = 1;
+    _add_into_id_credentials(id);
 
     *ret = id;
@@ -550,16 +664,29 @@
     id->key = abac_key_file_new(filename,pp);
     id->cert = _generate_cert(id->key, cn, validity);
-    id->keyid = _get_keyid(id->cert);
+    id->keyid = cert_get_keyid(id->cert);
 
     id->refcount = 1;
-
+    _add_into_id_credentials(id);
     *ret = id;
     return ABAC_ID_SUCCESS;
 }
 
+/* special handling, need to update the key of the id copy stored in
+   session's id credential list */
+static void _load_privkey_to_master_list(char *keyid, abac_key_t *key)
+{
+    abac_id_credential_t *idcred=abac_id_credential_lookup(keyid);
+    if(idcred==NULL) {
+        panic(1,"_load_privkey_to_master_list: missing id in masterlist(%s)\n", keyid);
+    }
+    abac_id_t *id=abac_id_credential_id(idcred);
+    id->key = abac_key_copy(key);
+}
+
 int abac_id_load_privkey_file(abac_id_t *ptr, char *keyfile)
 {
     assert(ptr);
     ptr->key=abac_key_file_new(keyfile, chunk_empty);
+    _load_privkey_to_master_list(abac_id_keyid(ptr), ptr->key);
     return 1;
 }
@@ -570,4 +697,5 @@
     chunk_t pp=extract_potato(keyfile,pfile);
     ptr->key=abac_key_file_new(keyfile, pp);
+    _load_privkey_to_master_list(abac_id_keyid(ptr), ptr->key);
     return 1;
 }
@@ -577,6 +705,5 @@
     assert(ptr);
     ptr->key=abac_key_chunk_new(keychunk, chunk_empty);
-    if(debug)
-        print_abac_key("after abac_id_load_privkey_chunk", ptr->key);
+    _load_privkey_to_master_list(abac_id_keyid(ptr), ptr->key);
     return 1;
 }
@@ -587,4 +714,5 @@
     chunk_t pp=extract_potato(NULL,pfile);
     ptr->key=abac_key_chunk_new(keychunk, pp);
+    _load_privkey_to_master_list(abac_id_keyid(ptr), ptr->key);
     return 1;
 }
Index: libabac/abac_id.h
===================================================================
--- libabac/abac_id.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_id.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,22 @@
+#ifndef __ABAC_ID_H__
+#define __ABAC_ID_H__
+
+#include "abac_defines.h"
+
+#include <credentials/keys/private_key.h>
+
+/* exported */
+extern int abac_id_has_privkey(abac_id_t *id);
+extern char* abac_id_name(abac_id_t *);
+extern private_key_t* abac_id_privkey(abac_id_t *);
+extern char* abac_id_idtype_string(abac_id_t *id);
+extern abac_id_t *abac_id_keyid_new(char *, char *, certificate_t *);
+extern certificate_t *abac_id_cert(abac_id_t *);
+extern char *abac_id_keyid(abac_id_t *id);
+extern abac_id_t *abac_id_dup(abac_id_t *);
+extern abac_id_t *abac_id_copy(abac_id_t *);
+extern char *abac_id_cn(abac_id_t *);
+extern int abac_idtype_lookup(char *);
+extern char *abac_idtype_string(int);
+
+#endif /* __ABAC_ID_H__ */
Index: libabac/abac_internal.h
===================================================================
--- libabac/abac_internal.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_internal.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -8,113 +8,53 @@
 #include <credentials/sets/mem_cred.h>
 
-#include "abac_list.h"
-#include "abac_stack.h"
-#include "abac_util.h"
+#include "abac_defines.h"
 
-#include "abac.h"
-
-char *abac_condition_typed_string(abac_condition_t *ptr);
-char *abac_condition_string(abac_condition_t *ptr);
-abac_condition_t *abac_condition_create(char *);
-abac_condition_t *abac_condition_create_from_aspect(abac_aspect_t *ptr);
-int abac_condition_set_aspect_ptr(abac_condition_t *ptr, abac_aspect_t *aptr);
-int abac_condition_set_aspect_string(abac_condition_t *ptr, char *str);
-int abac_condition_set_range_string(abac_condition_t *ptr);
-int abac_condition_is_range(abac_condition_t *ptr);
-abac_aspect_t *abac_condition_of_aspect(abac_condition_t *ptr);
-void abac_condition_add_range_integer_item(abac_condition_t *ptr, int itype, int val);
-void abac_condition_add_range_float_item(abac_condition_t *ptr, int itype, float val);
-void abac_condition_add_range_time_item(abac_condition_t *ptr, int itype, char* val);
-void abac_condition_add_range_urn_item(abac_condition_t *ptr, char *val);
-void abac_condition_add_range_string_item(abac_condition_t *ptr, char *val);void abac_condition_add_range_boolean_item(abac_condition_t *ptr, char* val);
-
-abac_aspect_t *abac_aspect_role_principal_new(char *principal_name);
-int abac_aspect_aspect_param_cnt(abac_aspect_t *ptr);
-char *abac_aspect_aspect_param_string(abac_aspect_t *ptr);
-abac_aspect_t *abac_aspect_linking_new(int, char*,char*, char*);
-abac_aspect_t *abac_aspect_oset_linking_new(char *, char *, char *);
-abac_aspect_t *abac_aspect_role_linking_new(char *, char *, char *);
-abac_aspect_t *abac_aspect_oset_object_new(abac_term_t *object);
-abac_aspect_t *abac_aspect_oset_principal_new(char *principal_name);
-abac_aspect_t *abac_aspect_oset_new(char *principal_name, char *oset_name);
-abac_aspect_t *abac_aspect_role_new(char *principal_name, char *role_name);
-abac_list_t *abac_aspect_prereqs(abac_aspect_t *ptr);
-abac_aspect_t *abac_aspect_intersection_new(abac_aspect_t *);
-abac_id_t *abac_aspect_get_issuer_id(abac_aspect_t *ptr);
-char *abac_aspect_object_name(abac_aspect_t *ptr);
-char *abac_aspect_linked_role_name(abac_aspect_t *ptr);
-char *abac_aspect_principal_name(abac_aspect_t *ptr);
-char *abac_aspect_aspect_name(abac_aspect_t *ptr);
-abac_aspect_t *abac_aspect_role_principal_create(char *principal_name);
-abac_aspect_t *abac_aspect_principal_new(int type, char *principal_name);
-abac_aspect_t *abac_aspect_new(int type, char *principal_name, char *aspect_name);
-abac_aspect_t *abac_aspect_object_new(int type, abac_term_t *object);
-void abac_aspect_dump(abac_aspect_t *ptr, char* offset);
-abac_term_t *abac_aspect_object_term(abac_aspect_t *ptr);
-char* abac_aspect_type_string(abac_aspect_t *ptr);
-char *abac_aspect_string_with_condition(abac_aspect_t *ptr);
-char* abac_aspect_get_issuer_keytype(abac_aspect_t *ptr);
-int abac_aspect_get_issuer_idtype(abac_aspect_t *ptr);
-char *abac_aspect_typed_string_with_condition(abac_aspect_t *ptr);
-char *abac_aspect_principal_principalname(abac_aspect_t *ptr);
-
-int abac_term_is_time_type(abac_term_t *term);
-char *abac_time_to_term(char *string);
-abac_term_t *abac_term_new(int, char *, int, char *, void *);
-abac_term_t *abac_term_named_new(int idtype, char *name);
-char *abac_item_val(abac_item_t *ptr);
-char *abac_term_to_time(char *string);
-char *abac_cn_with_sha(char*);
-char *abac_idtype_with_sha(char*);
-char *abac_term_type_name(abac_term_t *term);
-abac_condition_t *abac_term_constraint(abac_term_t *term);
-abac_term_t *abac_term_create(char*, char*, abac_condition_t*);
-
-void abac_condition_dump(abac_condition_t *ptr, char *offset);
-abac_list_t *abac_condition_range_list(abac_condition_t *ptr);
-
-void abac_term_dump(abac_term_t *ptr, char *offset);
-
-abac_item_t *abac_item_new(int itype, char *val);
-int abac_item_type(abac_item_t *);
-char* abac_item_val(abac_item_t *);
-
-int abac_param_list_cnt(abac_param_list_t *ptr);
-char* abac_param_list_string(abac_param_list_t *ptr);
-void abac_param_dump(abac_param_list_t *ptr, char *offset);
-char* abac_param_list_string_with_condition(abac_param_list_t *ptr);
-char* abac_param_list_typed_string_with_condition(abac_param_list_t *ptr);
-abac_list_t *abac_param_list(abac_param_list_t *ptr);
-abac_param_list_t *abac_param_list_new(abac_term_t *term);
-
-certificate_t *abac_attribute_issuer_cert(abac_attribute_t *ptr);
-certificate_t *abac_attribute_cert(abac_attribute_t *ptr);
-abac_attribute_t *abac_attribute_new(abac_id_t *issuer, certificate_t *cert, certificate_t *issuer_cert);
-abac_aspect_t *abac_attribute_tail(abac_attribute_t *ptr);
-abac_aspect_t *abac_attribute_head(abac_attribute_t *ptr);
-
-abac_id_credential_t *abac_id_credential_lookup(char *pname);
-abac_id_t *abac_id_new(int idtype,char *keyid, char *cn, certificate_t *cert);
-private_key_t *abac_id_privkey(abac_id_t *id);
-certificate_t *abac_id_cert(abac_id_t *id);
-abac_id_t *abac_id_keyid_new(char *keyid, char *cn, certificate_t *cert);
-char* abac_id_idtype_string(abac_id_t *id);
-char *abac_id_name(abac_id_t *id);
-
-char *abac_termtype_string(int i);
-char *abac_idtype_string(int);
-
-abac_credential_t *abac_credential_lookup(char *cred_string);
-abac_stack_t *abac_verifier_dump_creds();
-abac_stack_t *abac_verifier_dump_principals();
-
-extern int ABAC_IN_PROLOG;
-extern char *prologIt(char*);
-
-#define PROLOG(BODY) {  \
-    ABAC_IN_PROLOG++;      \
-    { BODY }               \
-    ABAC_IN_PROLOG--;      \
-} 
+/* used by abac_c */
+extern int abac_context_creds_count(abac_context_t *);
+extern int abac_context_id_creds_count(abac_context_t *);
+extern void abac_aspect_add_linked_param(abac_aspect_t *ptr, abac_term_t *param);
+extern void abac_aspect_add_param(abac_aspect_t *ptr, abac_term_t *param);
+extern char *abac_aspect_aspect_name(abac_aspect_t*);
+extern int abac_aspect_is_linking(abac_aspect_t *ptr) ;
+extern int abac_aspect_is_object(abac_aspect_t *ptr);
+extern int abac_aspect_is_principal(abac_aspect_t *ptr);
+extern char *abac_aspect_linked_role_name(abac_aspect_t*);
+extern abac_aspect_t *abac_aspect_linking_new(int, char*,char*, char*);
+extern abac_aspect_t *abac_aspect_new(int, char*, char*);
+extern char *abac_aspect_object_name(abac_aspect_t*);
+extern abac_aspect_t *abac_aspect_object_new(int type, abac_term_t *object);
+extern char *abac_aspect_principal_name(abac_aspect_t*);
+extern abac_aspect_t *abac_aspect_principal_new(int, char*);
+extern abac_aspect_t *abac_aspect_role_principal_create(char*);
+extern char *abac_aspect_string(abac_aspect_t*);
+extern char *abac_aspect_typed_string(abac_aspect_t*);
+extern abac_aspect_t *abac_attribute_head(abac_attribute_t *ptr);
+extern abac_aspect_t *abac_attribute_tail(abac_attribute_t *ptr);
+extern abac_aspect_t **abac_attribute_tail_vectorized(abac_attribute_t*);
+extern int abac_attribute_write_cert(abac_attribute_t*, FILE *out);
+extern void abac_condition_add_range_boolean_item(abac_condition_t *ptr, char* val);
+extern void abac_condition_add_range_float_item(abac_condition_t *ptr, int itype, float val);
+extern void abac_condition_add_range_integer_item(abac_condition_t *ptr, int itype, int val);
+extern void abac_condition_add_range_string_item(abac_condition_t *ptr, char *val);
+extern void abac_condition_add_range_time_item(abac_condition_t *ptr, int itype, char* val);
+extern void abac_condition_add_range_urn_item(abac_condition_t *ptr, char *val);
+extern abac_condition_t *abac_condition_create(char*);
+extern abac_condition_t *abac_condition_create_from_aspect(abac_aspect_t*);
+extern char *abac_condition_string(abac_condition_t*);
+extern char *abac_condition_typed_string(abac_condition_t*);
+extern abac_id_credential_t *abac_context_id_credential_lookup(abac_context_t *ctx, char *);
+extern int abac_context_load_attribute_attribute(abac_context_t *ctx, abac_attribute_t *ptr);
+extern int abac_context_load_id_enc_id_file_key_file(abac_context_t *ctx, char *filename, char *keyfilename, char *pfile);
+extern int abac_context_load_id_enc_idkey_file(abac_context_t *ctx, char *filename, char *pfile);
+extern int abac_context_load_id(abac_context_t *ctx, abac_id_t *id);
+extern int abac_context_load_id_id_key_files(abac_context_t *ctx, char *filename, char *keyfilename);
+extern int abac_context_load_id_idkey_file(abac_context_t *ctx, char *filename);
+extern int abac_id_load_enc_privkey_file(abac_id_t *ptr, char *keyfile, char *pfile);
+extern void abac_id_write_cert(abac_id_t *id, FILE *out);
+extern int abac_id_write_privkey(abac_id_t *id, FILE *out);
+extern abac_term_t **abac_param_list_vectorize(abac_param_list_t*);
+extern abac_param_list_t *abac_aspect_aspect_params(abac_aspect_t *);
+extern abac_param_list_t *abac_aspect_linked_role_params(abac_aspect_t *);
+extern abac_param_list_t *abac_aspect_aspect_params(abac_aspect_t *);
 
 
Index: libabac/abac_key.c
===================================================================
--- libabac/abac_key.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_key.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,13 +1,6 @@
-
 /**
 **  abac_key.c
 **  holding a private_key 
 **/
-
-// include the GNU extension of asprintf
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <time.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -15,15 +8,14 @@
 #include <fcntl.h>
 #include <sys/mman.h>
-#include <assert.h>
-
-#include "abac_internal.h"
+
+#include <credentials/keys/private_key.h>
+#include <credentials/sets/mem_cred.h>
+
+#include "abac_defines.h"
 #include "abac_util.h"
 
-extern chunk_t abac_get_potato_cb(int try, char *name);
-
 static int debug=0;
-//
+
 // abac_key object
-//
 // keyblob and potato are 'cleaned' explicitly
 struct _abac_key_t {
@@ -32,4 +24,7 @@
     chunk_t potato; // you know what, just as a hint
 };
+
+/* from abac_util */
+extern chunk_t abac_get_potato_cb(int, char*);
 
 /****************************************************************/
@@ -59,8 +54,6 @@
 static private_key_t *_load_privkey_chunk(chunk_t chunk)
 {
-    if(debug) { 
-        fprintf(stderr,"_load_privkey_chunk, ptr loc(%d):(%d)\n",
-                             (int) chunk.ptr, chunk.len);
-    }
+    DEBUG_PRINTF("_load_privkey_chunk, ptr loc(%d):(%d)\n",
+                                   (int) chunk.ptr, chunk.len);
     private_key_t *key = lib->creds->create(lib->creds,
         CRED_PRIVATE_KEY, KEY_RSA,
@@ -73,8 +66,6 @@
 static private_key_t *_load_enc_privkey_chunk(chunk_t chunk, chunk_t potato)
 {
-    if(debug) { 
-        fprintf(stderr,"_load_enc_privkey_chunk, ptr loc(%d):(%d)\n",
+    DEBUG_PRINTF("_load_enc_privkey_chunk, ptr loc(%d):(%d)\n",
                                       (int) chunk.ptr, chunk.len);
-    }
     mem_cred_t *mem;
     shared_key_t *shared;
@@ -240,12 +231,41 @@
 }
 
+static chunk_t _copy(chunk_t ptr)
+{
+    chunk_t blob=chunk_empty;
+    blob.ptr=strndup(ptr.ptr, ptr.len);
+    blob.len=ptr.len;
+    return blob;
+}
+
+
+abac_key_t *abac_key_copy(abac_key_t *ptr)
+{
+    abac_key_t *nptr = abac_xmalloc(sizeof(abac_key_t));
+
+    if(ptr->potato.len==0)
+        nptr->potato=chunk_empty;
+        else nptr->potato=_copy(ptr->potato);
+
+    if(ptr->filename!=NULL)
+        nptr->filename=abac_xstrdup(ptr->filename);
+        else nptr->filename=NULL;
+
+    if(ptr->keyblob.len==0)
+        nptr->keyblob=chunk_empty;
+        else nptr->keyblob=_copy(ptr->keyblob);
+    return nptr;
+}
+
 void abac_key_free(abac_key_t *ptr)
 {
-    if(ptr->potato.len != 0)
+    if(ptr->potato.len != 0) {
         chunk_clear(&ptr->potato);
-    if(debug) {
-         fprintf(stderr,"FREEEEE abac_key loc(%d)\n",(int)ptr->keyblob.ptr);
-    }
-    chunk_clear(&ptr->keyblob);
+    }
+    if(ptr->keyblob.len !=0) {
+        chunk_clear(&ptr->keyblob);
+    }
+    if(ptr->filename!=NULL)
+        free(ptr->filename);
     free(ptr);
 }
Index: libabac/abac_key.h
===================================================================
--- libabac/abac_key.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_key.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,17 @@
+#ifndef __ABAC_KEY_H__
+#define __ABAC_KEY_H__
+
+#include "abac_defines.h"
+
+#include <credentials/keys/private_key.h>
+
+/* exported */
+/* for abac_id */
+extern private_key_t *abac_key_private_key(abac_key_t*);
+extern chunk_t abac_key_chunk(abac_key_t *);
+extern abac_key_t *abac_key_generate();
+extern abac_key_t *abac_key_copy(abac_key_t *);
+extern abac_key_t *abac_key_file_new(char *, chunk_t);
+extern abac_key_t *abac_key_chunk_new(chunk_t, chunk_t);
+
+#endif /* __ABAC_KEY_H__ */
Index: libabac/abac_list.c
===================================================================
--- libabac/abac_list.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_list.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,7 +1,8 @@
 #include <stdlib.h>
 
+#include "abac_util.h"
 #include "abac_list.h"
-#include "abac_util.h"
 
+/****************************************************************/
 abac_list_t *abac_list_new(void) {
     abac_list_t *ret = abac_xmalloc(sizeof(abac_list_t));
Index: libabac/abac_list.h
===================================================================
--- libabac/abac_list.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_list.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,4 +1,4 @@
-#ifndef __LIST_H__
-#define __LIST_H__
+#ifndef __ABAC_LIST_H__
+#define __ABAC_LIST_H__
 
 #include "utlist.h"
@@ -17,12 +17,4 @@
 };
 
-abac_list_t *abac_list_new(void);
-void abac_list_add(abac_list_t *list, void *elt);
-int abac_list_unique_add(abac_list_t *list, void *elt);
-void abac_list_prepend(abac_list_t *list, void *elt);
-int abac_list_remove(abac_list_t *list, void *elt);
-int abac_list_size(abac_list_t *list);
-void abac_list_free(abac_list_t *list);
-
 #define abac_list_foreach(LIST, CURRENT, BODY) do {  \
     abac_list_element_t *_elt;                  \
@@ -33,3 +25,12 @@
 } while (0)
 
-#endif /* __LIST_H__ */
+/* exported */
+extern abac_list_t *abac_list_new(void);
+extern void abac_list_add(abac_list_t *list, void *elt);
+extern int abac_list_unique_add(abac_list_t *list, void *elt);
+extern void abac_list_prepend(abac_list_t *list, void *elt);
+extern int abac_list_remove(abac_list_t *list, void *elt);
+extern int abac_list_size(abac_list_t *list);
+extern void abac_list_free(abac_list_t *list);
+
+#endif /* __ABAC_LIST_H__ */
Index: libabac/abac_m64.c
===================================================================
--- libabac/abac_m64.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_m64.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,186 +1,96 @@
+/**
+**  abac_m64.c
+**/
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <assert.h>
+
+#include <credentials/certificates/certificate.h>
+
+#include "zlib.h"
+#define CHUNK 1024 /* 16384 */
 
 static int debug=0;
-char* abac_decode_string(char *);
+static int zip=1; /* to choose to compress/decompress */
 
-/* encode table */
-static const char encode64url[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+/* 
+using strongswan's m64 utility so we can stay within the
+buf len size that strongwan set in using its certifiate 
+generation code (512)
+    chunk_t b64 = chunk_to_base64(chunk, NULL);
+    chunk_t chk = chunk_from_base64(base64, NULL);
+*/
 
-/* decode table Tables */
-/*
-static const char decode64url[]="=====rstuvwxyz========>?@ABCDEFGHIJKLMNOPQRSTUVW======XYZ[\\]^_=abcdefghijklmnopq";
-*/
-/*                                    6       14          26                   48      5557      65              81*/
-
-static const char decode64url[]="|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\\]^_`abcdefghijklmnopq";
-
-/* in 3, out 4 */
-static void _encode_block( char in[3], char out[4] , int len )
+static int _compress(char *string, int ilen, char*ostring)
 {
-    out[0] = encode64url[ in[0] >> 2 ];
-    out[1] = encode64url[ ((in[0] & 0x03) << 4) | ((in[1] & 0xf0) >> 4) ];
-    out[2] = (unsigned char) (len > 1 ? encode64url[ ((in[1] & 0x0f) << 2) | ((in[2] & 0xc0) >> 6) ] : '=');
-    out[3] = (unsigned char) (len > 2 ? encode64url[ in[2] & 0x3f ] : '=');
-if(0) {
-    printf("len: %d\n", len);
-    printf("IN: (%c)  (%c)  (%c)\n", in[0], in[1], in[2]);
-    printf("OUT: (%c)  (%c)  (%c) (%c)\n", out[0], out[1], out[2], out[3]);
-}
+    int olen=CHUNK;
+    int rc=compress(ostring,&olen,string,ilen); 
+    if(rc==Z_OK) { 
+        if(debug) fprintf(stderr,"compress from %d to %d\n", ilen, olen);
+        return olen;
+    }
+    return 0;
 }
 
-/* in 4, out 3 */
-void _decode_block( char in[4], char out[3] )
-{   
-    out[0] = (unsigned char ) (in[0] << 2 | in[1] >> 4);
-    out[1] = (unsigned char ) (in[1] << 4 | in[2] >> 2);
-    out[2] = (unsigned char ) (((in[2] << 6) & 0xc0) | in[3]);
-if(0) {
-    printf("IN: (%c)  (%c)  (%c) (%c)\n", in[0], in[1], in[2], in[3]);
-    printf("OUT: (%c)  (%c)  (%c)\n", out[0], out[1], out[2]);
-}
+/* all of these are deep copy of a string */
+char* abac_encode_string(char *string)
+{
+    assert(string);
+    char *ret=NULL;
+    char *ptr=string;;
+    int len=strlen(ptr);
+    char ostring[CHUNK];
+    if(zip) {
+        int olen=_compress(ptr, len,  ostring);
+        if(olen==0) { /* can not do the compress */
+           return NULL;
+        } else {
+           ptr=ostring;
+           len=olen;
+        }
+    } 
+    chunk_t orig = { ptr, len };
+    chunk_t b64 = chunk_to_base64(orig, NULL);
+    if(debug) fprintf(stderr,"abac_encode_string: (%s)\n",b64.ptr);
+    ret=strndup(b64.ptr,b64.len);
+    chunk_free(&b64);
+    return ret;
 }
 
-
-/*
-return a deep copy of encoded string
-*/
-char* abac_encode_string(char* string)
+static int _uncompress(char *string, int ilen, char *ostring)
 {
-    char *inbufptr, *outbufptr;
-    int len=strlen(string);
-    int olen, nlen;
-    char *orig_string, *new_string;
-    int hops;
-    int i;
-
-    if(len == 0) return strdup("");
-
-    if((len/3)*3 != len) {
-        hops=(len/3)+1;
-        olen=hops*3;
-        orig_string=malloc(sizeof(char)*olen); 
-        strcpy(orig_string,string);
-        for(i=len; i< olen; i++)
-            orig_string[i]=0;
-        } else {
-        hops=len/3;
-        olen=hops*3;
-        orig_string=strdup(string);
+    int olen=CHUNK;
+    int rc=uncompress(ostring,&olen,string,ilen); 
+    if(rc==Z_OK) { 
+        if(debug) fprintf(stderr,"uncompress from %d to %d\n", ilen, olen);
+        return olen;
     }
-    nlen=(olen*4/3 +1);
-    new_string = (char *) malloc(sizeof(char)*nlen);
- 
-    inbufptr=orig_string;
-    outbufptr=new_string;
-    if(debug) {
-       fprintf(stderr,"sizeof string %d\n", len);
-    }
-
-    int idx=0;
-    for(i=1; i<=hops;i++) {
-        int v=(len>(i*3))?3:(len-((i-1)*3));
-        _encode_block(inbufptr,outbufptr,v);
-        inbufptr=inbufptr+3;
-        outbufptr=outbufptr+4;
-        idx=idx+3;
-    }
-    free(orig_string);
-    new_string[nlen-1]='\0';
-
-    if(debug) {
-        char *d=abac_decode_string(new_string);
-        if(strcmp(d,string) !=0) {
-            fprintf(stderr,"ERROR, base64 encoding NOT OKAY\n");
-            fprintf(stderr,"orig,(%s)\n", string);
-            fprintf(stderr,"new,(%s)\n", new_string);
-            fprintf(stderr,"decode,(%s)\n",d);
-        } else fprintf(stderr," base64 encoding OKAY\n");
-        /* free(d); */
-    }
-    return new_string;
+    return 0;
 }
 
 char* abac_decode_string(char *string)
 {
-    char *inbufptr, *outbufptr;
+    assert(string);
+
+    char *ret=NULL;
     int len=strlen(string);
-    int nlen;
-    char *new_string;
-    char *orig_string;
-    int idx=0;
-    int v=0;
+    chunk_t b64 = { string, len };
+    chunk_t chk= chunk_from_base64(b64, NULL);
 
-    if(len==0) return strdup("");
-    int hops=len/4; // ignore any that is not in the size 4 blocks
-    new_string=(char *)malloc(sizeof(char)*(hops*3+1));
-    new_string[hops*3]='\0';
-    orig_string=strdup(string);
+    if(debug) fprintf(stderr,"abac_decode_string: (%s)\n",chk.ptr);
 
-    inbufptr=orig_string;
-    outbufptr=new_string;
-    char inbuf[4];
-    int i, j;
-
-    for(i=1; i<=hops; i++) {
-        for(j=0; j<4; j++) {
-            char c=inbufptr[j];
-            if(c > 122 || c <43) {
-                c=0;
-                } else {
-                   if(0) printf("from %d, (%c)\n", c, c);
-                   c=decode64url[c-43];
-                   if(0) printf("to %d, (%c)\n", c, c);
-            }
-            if(c) { 
-                if(c=='$') c=0;
-                    else c=c-61;
-            }
-            if(c) {
-                inbufptr[j]=(c-1);
-                } else {
-                    inbufptr[j]=0;
-            }              
-        }
-        _decode_block( inbufptr, outbufptr );
-        outbufptr=outbufptr+3;
-        inbufptr=inbufptr+4;
+    if(zip) {
+        char ostring[CHUNK];
+        int olen=_uncompress(chk.ptr, chk.len, ostring);
+        if(olen==0) { /* unable to uncompress the string!! */
+            ret=NULL;
+        } else ret=strndup(ostring,olen);
+    } else {
+        ret=strndup(chk.ptr, chk.len);
     }
-    free(orig_string);
-    return new_string;
+    chunk_free(&chk);
+    return ret;
 }
 
-
-/*****************
-int main( int argc, char **argv )
-{
- 
-    if(argc != 2) return 1;
-
-    FILE *infile = fopen( argv[1], "r" );
-
-    int num=1000;
-    char *string=(char *)malloc(sizeof(char)*num);
-
-    int cnt=getline(&string,&num,infile);
-    fclose(infile);
-    if(cnt==0) return 0;
-    if(string[cnt-1]=='\n')
-        string[cnt-1]='\0';
-
-    char *i=abac_encode_string(string);
-    printf("encoding into (%s)\n", i);
-    char *o=abac_decode_string(i);
-    printf("decode into (%s)\n", o);
-
-    printf(" %d:%d:%d\n", strlen(string),strlen(i), strlen(o));
-    if(strcmp(string,o)==0)
-         printf("OKAY \n");
-         else
-              printf("NOT OKAY \n");
-    free(string);
-    free(o);
-}
-****************/
Index: libabac/abac_m64.h
===================================================================
--- libabac/abac_m64.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_m64.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,8 @@
+#ifndef __ABAC_M64_H__
+#define __ABAC_M64_H__
+
+/* exported */
+extern char* abac_decode_string(char *);
+extern char* abac_encode_string(char *);
+
+#endif /* __ABAC_M64_H__ */
Index: libabac/abac_pl_gen.c
===================================================================
--- libabac/abac_pl_gen.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_gen.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -12,7 +12,12 @@
 #include <stdlib.h>
 
+#include "abac_pl_gen.h"
 #include "abac_internal.h"
-#include "abac_set.h"
+#include "abac_list.h"
 #include "abac_util.h"
+#include "abac_context.h"
+#include "abac_aspect.h"
+#include "abac_term.h"
+#include "abac_verifier.h"
 
 #include "uthash.h"
@@ -30,33 +35,51 @@
     char *principalname;
     int type; /* keyidtype */
-    char *clause;
 } abac_id_cert_t;
 abac_list_t *abac_pl_id_certs = NULL;
 
-extern int using_this;
-
-extern char* abac_yyfptr_encoded;
-
-void generate_pl_set_abac_yyfptr_encoded(char *string)
-{
-   abac_yyfptr_encoded=abac_xstrdup(string);
-}
-
-char *generate_pl_type_clause(char *principalname, int type);
-
-
+static int gg_using_this=0;
+char* yyfptr_encode=NULL;
+
+
+/* local */
+char *generate_pl_type_clause(abac_context_t *,char *, int);
 /***********************************************************************/
-char *prologIt(char *str)
-{
-    char *tmp=NULL;
-    asprintf(&tmp,"p%s",str);
-    return tmp;
-}
-
+/* this is called by creddy as a shortcut */
+int generate_pl_clauses_dump(abac_context_t *ctxt, abac_aspect_t *head_aspect, 
+abac_aspect_t *tail_aspect, char *attr_string, char *encoded_attr_string, 
+char *filename, int using_this)
+{
+    FILE *out;
+    abac_list_t *clauses = generate_pl_clauses(ctxt,head_aspect, tail_aspect, encoded_attr_string,using_this);
+
+    int cnt=abac_list_size(clauses);
+    out = fopen(filename, "a+");
+    char *cur=NULL;
+    fprintf(out,"##########################################\n");
+    fprintf(out,"## %s <- %s\n", abac_aspect_string_with_condition(head_aspect),
+                                         abac_aspect_string_with_condition(tail_aspect));
+    fprintf(out,"## %s\n",attr_string);
+    abac_list_foreach(clauses, cur,
+        fprintf(out,"##\n%s\n",cur);
+        if(cur) free(cur);
+    );
+    fprintf(out,"\n");
+    fclose(out);
+    abac_list_free(clauses);
+    return cnt;
+}
+
+/***********************************************************************/
+static void _set_yyfptr_encode(char *string)
+{
+   yyfptr_encode=abac_xstrdup(string);
+}
+
+/***********************************************************************/
 static char* isX()
 {
-    static char x_string[2]="X";
-    static char this_string[5]="This";
-    if(using_this)
+static char x_string[2]="X";
+static char this_string[5]="This";
+    if(gg_using_this)
         return this_string;
         else 
@@ -156,5 +179,4 @@
         if(id) 
             free(id->principalname);
-            free(id->clause);
             free(id);
     );
@@ -168,16 +190,15 @@
 }
 
-char *abac_pl_string_id_certs()
-{
-    int first=1;
+char *abac_pl_string_id_certs(abac_context_t *ctxt)
+{
     char *tmp=NULL;
     abac_id_cert_t *cur;
     abac_list_foreach(abac_pl_id_certs, cur,
         if(cur) 
-            if(first) {
-                tmp=abac_xstrdup(cur->clause);
-                first=0;
+            if(tmp==NULL) {
+                tmp=generate_pl_type_clause(ctxt,cur->principalname,cur->type);
                 } else {
-                    int cnt=asprintf(&tmp,"%s,%s", tmp, cur->clause);
+                    asprintf(&tmp,"%s,%s", tmp,
+                        generate_pl_type_clause(ctxt,cur->principalname,cur->type));
             }
     );
@@ -213,5 +234,4 @@
             id_cert->principalname=abac_xstrdup(principalname);
             id_cert->type=type;
-            id_cert->clause=generate_pl_type_clause(principalname,type);
             abac_list_add(abac_pl_id_certs, id_cert);
     }
@@ -221,4 +241,5 @@
 /* generate role(p_name, r_name, param..)                              */
 /*          or oset(p_name, r_name, param..)                           */
+/* mainly for aspect that is if A.R <- B format                        */
 static char* generate_pl_head_string(abac_aspect_t *ptr)
 {
@@ -255,8 +276,9 @@
 /* generate role(p_name, r_name, param..) with isMember call ?? */
 /* generate oset(p_name, r_name, param..) with isMember call ?? */
-static char* generate_pl_tail_string(abac_aspect_t *ptr)
-{
-
+/* for aspect that could also be with linked role               */
+static char* generate_pl_tail_string(abac_context_t *ctxt,abac_aspect_t *ptr, char *varX)
+{
      char *tmp=NULL;
+     char *namespace=abac_context_namespace(ctxt);
 
 /* for oset case,
@@ -298,32 +320,24 @@
              if(linked_param_string !=NULL) {
                  if (param_string != NULL) {
-                     cnt=asprintf(&tmp,"isMember(Y,role(%s,%s,%s),C%d),isMember(%s,%s(Y,%s,%s),C%d)",
-                            principalname,
-                            linkedname,linked_param_string,fst,
-                            isX(), typestring,
-                            aspectname,param_string,snd);
+                     cnt=asprintf(&tmp,"isMember(%s,Y,role(%s,%s,%s),C%d),isMember(%s,%s,%s(Y,%s,%s),C%d)",
+                            namespace, principalname, linkedname,linked_param_string,fst,
+                            namespace,varX, typestring, aspectname,param_string,snd);
                      free(param_string);
                      } else {
-                         cnt=asprintf(&tmp,"isMember(Y,role(%s,%s,%s),C%d),isMember(%s,%s(Y,%s),C%d)",
-                            principalname,
-                            linkedname,linked_param_string,fst,
-                            isX(), typestring,
-                            aspectname,snd);
+                         cnt=asprintf(&tmp,"isMember(%s,Y,role(%s,%s,%s),C%d),isMember(%s,%s,%s(Y,%s),C%d)",
+                            namespace, principalname, linkedname,linked_param_string,fst,
+                            namespace, varX, typestring, aspectname,snd);
                  }
                  free(linked_param_string);
                  } else {
                      if (aspect_params != NULL) {
-                         cnt=asprintf(&tmp,"isMember(Y,role(%s,%s),C%d),isMember(%s,%s(Y,%s,%s),C%d)",
-                            principalname,
-                            linkedname,fst,
-                            isX(),typestring,
-                            aspectname,param_string,snd);
+                         cnt=asprintf(&tmp,"isMember(%s,Y,role(%s,%s),C%d),isMember(%s,%s,%s(Y,%s,%s),C%d)",
+                            namespace, principalname,linkedname,fst,
+                            namespace, varX,typestring, aspectname,param_string,snd);
                          free(param_string);
                          } else {
-                             cnt=asprintf(&tmp,"isMember(Y,role(%s,%s),C%d),isMember(%s,%s(Y,%s),C%d)",
-                                principalname,
-                                linkedname,fst,
-                                isX(),typestring,
-                                aspectname,snd);
+                             cnt=asprintf(&tmp,"isMember(%s,Y,role(%s,%s),C%d),isMember(%s,%s,%s(Y,%s),C%d)",
+                                namespace, principalname, linkedname,fst,
+                                namespace, varX,typestring, aspectname,snd);
                    }
              }
@@ -337,11 +351,11 @@
              int fst=_get_next_cred_idx();
              if(param_string != NULL) {
-                 cnt=asprintf(&tmp,"isMember(%s,%s(%s,%s,%s),C%d)",
-                              isX(),typestring,
+                 cnt=asprintf(&tmp,"isMember(%s,%s,%s(%s,%s,%s),C%d)",
+                              namespace,varX,typestring,
                               principalname, aspectname, param_string, fst);
                  free(param_string);
                  } else {
-                     cnt=asprintf(&tmp,"isMember(%s,%s(%s,%s),C%d)",
-                              isX(), typestring,
+                     cnt=asprintf(&tmp,"isMember(%s,%s,%s(%s,%s),C%d)",
+                              namespace,varX, typestring,
                               principalname, aspectname, fst);
              }
@@ -365,36 +379,38 @@
 /********************************************************************************/
 
-static char *_build_constraint_rule_clause(char *head_string, char *tail_string)
-{
-    /*only,  A.R <- B */
+static char *_build_constraint_rule_clause(abac_context_t *ctxt,char *head_string, char *tail_string)
+{
+    /*for  A.R <- B */
     if(debug) 
          fprintf(stderr,"calling _build_constraint_rule_clause (%s)(%s)\n", head_string, tail_string);
     char *tmp;
     int idx=_get_next_cred_idx();
-    asprintf(&tmp, "isMember(%s,%s,C%d)", tail_string,head_string,idx);
-    return tmp;
-}
-
-static char *_build_rule_clause(char *aspectname, char *head_string,
-char *tail_string, char *id_string, char *constraint_string)
+    asprintf(&tmp, "isMember(%s,%s,%s,C%d)", 
+              abac_context_namespace(ctxt),tail_string,head_string,idx);
+    return tmp;
+}
+
+static char *_build_rule_clause(abac_context_t *ctxt, char *aspectname, char *head_string,
+char *tail_string, char *id_string, char *constraint_string, char *varX)
 {
     char *tmp=NULL;
+    char *namespace=abac_context_namespace(ctxt);
 
     if(aspectname == NULL) {
         /* A.R <- B */
         if(id_string == NULL && constraint_string == NULL) {
-            asprintf(&tmp, "isMember(%s,%s,['%s'])",
-                     tail_string,head_string,abac_yyfptr_encoded);
+            asprintf(&tmp, "isMember(%s,%s,%s,['%s'])",
+                     namespace, tail_string,head_string,yyfptr_encode);
             } else {
                 if(id_string == NULL) {
-                    asprintf(&tmp, "isMember(%s,%s,['%s']) :- %s",
-                         tail_string,head_string,abac_yyfptr_encoded,
+                    asprintf(&tmp, "isMember(%s,%s,%s,['%s']) :- %s",
+                         namespace, tail_string,head_string,yyfptr_encode,
                          constraint_string);
                 } else if(constraint_string == NULL) {
-                    asprintf(&tmp, "isMember(%s,%s,['%s']) :- %s",
-                         tail_string,head_string,abac_yyfptr_encoded,
+                    asprintf(&tmp, "isMember(%s,%s,%s,['%s']) :- %s",
+                         namespace, tail_string,head_string,yyfptr_encode,
                          id_string);
-                } else { asprintf(&tmp, "isMember(%s,%s,['%s']) :- %s,%s",
-                         tail_string,head_string,abac_yyfptr_encoded,
+                } else { asprintf(&tmp, "isMember(%s,%s,%s,['%s']) :- %s,%s",
+                         namespace, tail_string,head_string,yyfptr_encode,
                          id_string, constraint_string);
                 }
@@ -405,22 +421,22 @@
              if (cred_count==0) {
                  if(id_string == NULL && constraint_string == NULL) {
-                     asprintf(&tmp,"isMember(%s,%s,['%s']):-%s",
-                           isX(),
-                           head_string, abac_yyfptr_encoded, tail_string);
+                     asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s",
+                           namespace,varX,
+                           head_string, yyfptr_encode, tail_string);
                      } else {
                          if(id_string == NULL) {
-                             asprintf(&tmp,"isMember(%s,%s,['%s']):-%s,%s",
-                                 isX(),
-                                 head_string, abac_yyfptr_encoded, tail_string,
+                             asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s,%s",
+                                 namespace,varX,
+                                 head_string, yyfptr_encode, tail_string,
                                  constraint_string);
                          } else if(constraint_string == NULL) {
-                             asprintf(&tmp,"isMember(%s,%s,['%s']):-%s,%s",
-                                 isX(),
-                                 head_string, abac_yyfptr_encoded, id_string,
+                             asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s,%s",
+                                 namespace,varX,
+                                 head_string, yyfptr_encode, id_string,
                                  tail_string);
                          } else { 
-                             asprintf(&tmp,"isMember(%s,%s,['%s']):-%s,%s,%s",
-                                 isX(),
-                                 head_string, abac_yyfptr_encoded, id_string,
+                             asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s,%s,%s",
+                                 namespace,varX,
+                                 head_string, yyfptr_encode, id_string,
                                  tail_string, constraint_string);
                          }
@@ -429,25 +445,25 @@
                      char *tmp_cred_list=_compose_cred_list();
                      if(id_string == NULL && constraint_string == NULL) {
-                         asprintf(&tmp,"isMember(%s,%s,L):-%s, appendL([['%s'],%s],L)",
-                                  isX(),
+                         asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, appendL([['%s'],%s],L)",
+                                  namespace,varX,
                                   head_string, tail_string,
-                                  abac_yyfptr_encoded, tmp_cred_list);
+                                  yyfptr_encode, tmp_cred_list);
                          } else {
                             if(id_string == NULL) {
-                               asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
-                                  isX(),
+                               asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
+                                  namespace,varX,
                                   head_string, tail_string, constraint_string,
-                                  abac_yyfptr_encoded, tmp_cred_list);
+                                  yyfptr_encode, tmp_cred_list);
                             } else if(constraint_string == NULL) {
-                               asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
-                                  isX(),
+                               asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
+                                  namespace,varX,
                                   head_string, id_string, tail_string,
-                                  abac_yyfptr_encoded, tmp_cred_list);
+                                  yyfptr_encode, tmp_cred_list);
                             } else { 
-                               asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, %s, appendL([['%s'],%s],L)",
-                                  isX(),
+                               asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, %s, appendL([['%s'],%s],L)",
+                                  namespace,varX,
                                   head_string, id_string, tail_string,
                                   constraint_string,
-                                  abac_yyfptr_encoded, tmp_cred_list);
+                                  yyfptr_encode, tmp_cred_list);
                             }
                      }
@@ -460,13 +476,13 @@
 
 
-static char *generate_pl_rule_clause(char *head_rule_string,
-abac_aspect_t *tail_rule, char *id_string, char *constraint_string)
+static char *generate_pl_rule_clause(abac_context_t *ctxt,char *head_rule_string,
+abac_aspect_t *tail_rule, char *id_string, char *constraint_string, char* varX)
 {
     char *aspectname=abac_aspect_aspect_name(tail_rule);
-    char *tail_rule_string=generate_pl_tail_string(tail_rule);
+    char *tail_rule_string=generate_pl_tail_string(ctxt,tail_rule,varX);
     if(aspectname == NULL && tail_rule_string == NULL) 
         goto error;
-    char *tmp=_build_rule_clause(aspectname,head_rule_string, tail_rule_string,
-                                          id_string, constraint_string);
+    char *tmp=_build_rule_clause(ctxt,aspectname,
+                head_rule_string, tail_rule_string, id_string, constraint_string, varX);
     if(tail_rule_string) free(tail_rule_string);
     return tmp;
@@ -492,29 +508,31 @@
 }
 
-static char *_build_intersecting_clause(char *head_role_string,
-char *tail_role_string, char* id_string, char* constraint_string)
+static char *_build_intersecting_clause(abac_context_t *ctxt, 
+char *head_role_string, char *tail_role_string, char* id_string,
+char* constraint_string,char *varX)
 {
     char *tmp;
+    char *namespace=abac_context_namespace(ctxt);
 
     if (cred_count==0) {
         if(id_string == NULL && constraint_string == NULL) {
-            asprintf(&tmp,"isMember(%s,%s,['%s']):-%s",
-                   isX(),
-                   head_role_string, abac_yyfptr_encoded, tail_role_string);
+            asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s",
+                   namespace,varX,
+                   head_role_string, yyfptr_encode, tail_role_string);
             } else {
              if(id_string == NULL) {
-                asprintf(&tmp,"isMember(%s,%s,['%s']):-%s, %s",
-                       isX(),
-                       head_role_string, abac_yyfptr_encoded, 
+                asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s, %s",
+                       namespace,varX,
+                       head_role_string, yyfptr_encode, 
                        tail_role_string, constraint_string);
              } else if(constraint_string == NULL) {
-                asprintf(&tmp,"isMember(%s,%s,['%s']):-%s, %s",
-                       isX(),
-                       head_role_string, abac_yyfptr_encoded, 
+                asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s, %s",
+                       namespace,varX,
+                       head_role_string, yyfptr_encode, 
                        id_string, tail_role_string);
              } else {    
-                asprintf(&tmp,"isMember(%s,%s,['%s']):-%s, %s, %s",
-                       isX(),
-                       head_role_string, abac_yyfptr_encoded, 
+                asprintf(&tmp,"isMember(%s,%s,%s,['%s']):-%s, %s, %s",
+                       namespace,varX,
+                       head_role_string, yyfptr_encode, 
                        id_string, tail_role_string, constraint_string);
              }           
@@ -523,24 +541,24 @@
             char *tmp_cred_list=_compose_cred_list();
             if(id_string == NULL && constraint_string == NULL) {
-                asprintf(&tmp,"isMember(%s,%s,L):-%s, appendL([['%s'],%s],L)",
-                                isX(),
+                asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, appendL([['%s'],%s],L)",
+                                namespace,varX,
                                 head_role_string, tail_role_string,
-                                abac_yyfptr_encoded, tmp_cred_list);
+                                yyfptr_encode, tmp_cred_list);
                 } else {
                     if(id_string == NULL) {
-                        asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
-                            isX(),
+                        asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
+                            namespace,varX,
                             head_role_string, tail_role_string, constraint_string,
-                            abac_yyfptr_encoded, tmp_cred_list);
+                            yyfptr_encode, tmp_cred_list);
                     } else if(constraint_string == NULL) {
-                        asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
-                            isX(),
+                        asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, appendL([['%s'],%s],L)",
+                            namespace,varX,
                             head_role_string, id_string, tail_role_string,
-                            abac_yyfptr_encoded, tmp_cred_list);
+                            yyfptr_encode, tmp_cred_list);
                     } else {    
-                        asprintf(&tmp,"isMember(%s,%s,L):-%s, %s, %s, appendL([['%s'],%s],L)",
-                            isX(),
+                        asprintf(&tmp,"isMember(%s,%s,%s,L):-%s, %s, %s, appendL([['%s'],%s],L)",
+                            namespace,varX,
                             head_role_string, id_string, tail_role_string, constraint_string,
-                            abac_yyfptr_encoded, tmp_cred_list);
+                            yyfptr_encode, tmp_cred_list);
                     }           
             }
@@ -551,6 +569,7 @@
 }
 
-static char *generate_pl_intersecting_clause(char *head_role_string,
-abac_aspect_t *tail_role, char* id_string, char* constraint_string)
+static char *generate_pl_intersecting_clause(abac_context_t *ctxt,
+char *head_role_string, abac_aspect_t *tail_role, char* id_string,
+char* constraint_string, char *varX)
 {
     char *tmp=NULL;
@@ -563,5 +582,5 @@
         abac_aspect_t *cur;
         abac_list_foreach(list, cur,
-            char *ntmp=generate_pl_tail_string(cur);
+            char *ntmp=generate_pl_tail_string(ctxt,cur,varX);
             if(debug) fprintf(stderr,"  intersecting tail: (%s)\n",ntmp);
             if(tail_role_string==NULL) {
@@ -578,11 +597,15 @@
 
     if(debug) fprintf(stderr,"      final intersecting tail: (%s)\n",tail_role_string);
-    tmp=_build_intersecting_clause(head_role_string, tail_role_string, id_string,constraint_string);
+    tmp=_build_intersecting_clause(ctxt,head_role_string, tail_role_string,
+                                                 id_string,constraint_string, varX);
     if(tail_role_string) free(tail_role_string);
     return tmp;
 }
 
+/**** THIS NEEDS TO BE LOCKED *****/
+/* XXXX */
 /* generate the prolog isMember rule clause for the credential stmt */
-abac_list_t *generate_pl_clauses(abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect)
+abac_list_t *generate_pl_clauses(abac_context_t *ctxt,abac_aspect_t *head_aspect,
+abac_aspect_t *tail_aspect,char *encoded_attr_string, int using_this)
 {
    char *tmp=NULL;
@@ -590,8 +613,17 @@
    char *constraint_clauses_string=NULL;
    abac_list_t *clauses=abac_list_new();
-  
+ 
+   gg_using_this=using_this;
+
+   if(encoded_attr_string!=NULL)
+       _set_yyfptr_encode(encoded_attr_string);
+
+   /* preprocess both sides first */
+   preprocess_pl_head(ctxt,head_aspect);
+   preprocess_pl_tail(ctxt,tail_aspect);
+
    int cnt=abac_pl_cnt_id_certs();
    if(cnt > 0) { /* string it up */
-       id_clauses_string=abac_pl_string_id_certs();
+       id_clauses_string=abac_pl_string_id_certs(ctxt);
        abac_pl_free_id_certs();
    }
@@ -611,9 +643,9 @@
 /* tail side */
     if(abac_aspect_is_intersection(tail_aspect)) {
-       tmp=generate_pl_intersecting_clause(head_string, tail_aspect,
-                    id_clauses_string, constraint_clauses_string);
+       tmp=generate_pl_intersecting_clause(ctxt,head_string, tail_aspect,
+                    id_clauses_string, constraint_clauses_string, isX());
        } else {
-           tmp=generate_pl_rule_clause(head_string, tail_aspect,
-                    id_clauses_string, constraint_clauses_string);
+           tmp=generate_pl_rule_clause(ctxt,head_string, tail_aspect,
+                    id_clauses_string, constraint_clauses_string, isX());
     }
     if(tmp==NULL)
@@ -630,22 +662,26 @@
 }
 
-/* should be just 1 */
-char *generate_pl_constraint_clause(abac_aspect_t *head_aspect, char *tail_string)
-{
-/* generate head's role or oset string */
-    char *head_string=generate_pl_head_string(head_aspect);
-    if(head_string == NULL)
-        goto error;
-
-/* tail side */
-    char *tmp=_build_constraint_rule_clause(head_string, tail_string);
-    if(tmp==NULL)
-        goto error;
-
-    return tmp;
+char *generate_pl_constraint_clause(abac_context_t *ctxt,abac_aspect_t *head_aspect, char *tail_string)
+{
+    char *tmp=NULL;
+    char *head_string=NULL;
+
+    if(abac_aspect_is_linking(head_aspect)) { /* leverage on its b.r.r gen code */
+        tmp= generate_pl_tail_string(ctxt,head_aspect,tail_string); 
+        } else {
+            /* generate head's role or oset string */
+            char *head_string=generate_pl_head_string(head_aspect);
+            if(head_string == NULL)
+                goto error;
+
+            /* tail side */
+           tmp=_build_constraint_rule_clause(ctxt,head_string, tail_string);
+           if(tmp==NULL) goto error;
+           if(head_string) free(head_string);
+    }
 
 error:
     if(head_string) free(head_string);
-    return NULL;
+    return tmp;
 }
 
@@ -671,6 +707,6 @@
 
 /* generate the prolog isType rule clause for the type,
-   isType(Acme, keyid); */
-char *generate_pl_type_clause(char *principalname, int type)
+   isType(namespace,Acme, keyid); */
+char *generate_pl_type_clause(abac_context_t *ctxt,char *principalname, int type)
 {
     char *tmp=NULL;
@@ -680,7 +716,7 @@
     if(debug)
         fprintf(stderr,"generate type clause, (%s)\n", principalname);
-    int cnt=asprintf(&tmp,"isType(%s,%s)",
-                                principalname, typeid);
-    return tmp;
-}
-
+    int cnt=asprintf(&tmp,"isType(%s,%s,%s)",
+                 abac_context_namespace(ctxt),principalname, typeid);
+    return tmp;
+}
+
Index: libabac/abac_pl_gen.h
===================================================================
--- libabac/abac_pl_gen.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_pl_gen.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,26 @@
+#ifndef __ABAC_PL_GEN_H__
+#define __ABAC_PL_GEN_H__
+
+#include "abac_internal.h"
+#include "abac_list.h"
+
+#define PROLOG(BODY) {  \
+    ABAC_IN_PROLOG++;   \
+    { BODY }            \
+    ABAC_IN_PROLOG--;   \
+}
+
+/* exported */
+extern int ABAC_IN_PROLOG;
+
+extern abac_list_t *generate_pl_clauses(abac_context_t *,abac_aspect_t*, abac_aspect_t*, char *,int);
+
+/* used by abac_pl_pre only */
+extern char *generate_pl_range_constraint(char*,char*,char*,char*);
+extern char *generate_pl_range_time_constraint(char*,char*,char*);
+extern char* generate_pl_constraint_clause(abac_context_t *,abac_aspect_t*, char*);
+extern char *generate_pl_type_clause(abac_context_t *,char *, int);
+
+extern void abac_pl_add_constraints(char *constraint);
+
+#endif /* __ABAC_PL_GEN_H__ */
Index: libabac/abac_pl_pre.c
===================================================================
--- libabac/abac_pl_pre.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_pre.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -9,18 +9,14 @@
 #include <stdlib.h>
 
-#include "abac_internal.h"
 #include "abac_util.h"
+
+#include "abac_pl_pre.h"
+#include "abac_term.h"
+#include "abac_aspect.h"
 #include "abac_list.h"
-
-#include "uthash.h"
+#include "abac_pl_gen.h"
+#include "abac_pl_yap.h"
 
 static int debug=0;
-
-extern char *abac_pl_add_range_constraint_clause(char *var, char *tmplist);
-extern char *generate_pl_range_constraint(char *,char *,char *,char *);
-extern char *generate_pl_range_time_constraint(char *,char *,char *);
-extern char* generate_pl_constraint_clause(abac_aspect_t *, char *);
-
-void preprocess_pl_head(abac_aspect_t *ptr);
 
 /****************************************************************/
@@ -182,5 +178,5 @@
 
 /***********************************************************************/
-void preprocess_pl_term(abac_term_t *ptr)
+void preprocess_pl_term(abac_context_t *ctxt,abac_term_t *ptr)
 {
         /* add id */
@@ -205,9 +201,11 @@
           } 
           } else {
+/* special handling of role/oset constraining condition */
              if(debug) fprintf(stderr,"expecting either oset/role constraint with %s\n",name); 
              abac_aspect_t *cptr=abac_condition_of_aspect(cond);
-             preprocess_pl_head(cptr);
+             preprocess_pl_head(ctxt,cptr);
+
              /* generate the prolog clause */
-             char *tmp=generate_pl_constraint_clause(cptr,name);
+             char *tmp=generate_pl_constraint_clause(ctxt,cptr,name);
              abac_condition_set_aspect_string(cond,tmp);
              abac_pl_add_constraints(tmp);
@@ -216,5 +214,5 @@
 }
 
-void preprocess_pl_params(abac_param_list_t *ptr)
+void preprocess_pl_params(abac_context_t *ctxt,abac_param_list_t *ptr)
 {
    abac_list_t *list=abac_param_list(ptr);
@@ -222,9 +220,9 @@
    abac_term_t *cur;
    abac_list_foreach(list, cur,
-       preprocess_pl_term(cur);
+       preprocess_pl_term(ctxt,cur);
    );
 }
 
-void preprocess_pl_head(abac_aspect_t *ptr)
+void preprocess_pl_head(abac_context_t *ctxt,abac_aspect_t *ptr)
 {
     char *principalname;
@@ -237,10 +235,14 @@
     abac_param_list_t *aspect_params=abac_aspect_aspect_params(ptr);
     if(aspect_params) {
-       preprocess_pl_params(aspect_params);
-    }
-
-}
-
-void preprocess_pl_tail(abac_aspect_t *ptr)
+       preprocess_pl_params(ctxt,aspect_params);
+    }
+    abac_param_list_t *linked_role_params=abac_aspect_linked_role_params(ptr);
+    if(linked_role_params) {
+       preprocess_pl_params(ctxt,linked_role_params);
+    }
+
+}
+
+void preprocess_pl_tail(abac_context_t *ctxt,abac_aspect_t *ptr)
 {
     /* if it is an intersection, preprocess each one */
@@ -251,5 +253,5 @@
         abac_list_foreach(list, cur,
             if(cur)
-               preprocess_pl_tail(cur);
+               preprocess_pl_tail(ctxt,cur);
         );
         return;
@@ -266,5 +268,5 @@
         abac_term_t *tptr=abac_aspect_object_term(ptr);
         if(tptr)
-            preprocess_pl_term(tptr);
+            preprocess_pl_term(ctxt,tptr);
         } else {
             char *principalname;
@@ -276,10 +278,10 @@
             abac_param_list_t *aspect_params=abac_aspect_aspect_params(ptr);
             if(aspect_params) {
-               preprocess_pl_params(aspect_params);
+               preprocess_pl_params(ctxt,aspect_params);
             }
     
             abac_param_list_t *linked_role_params=abac_aspect_linked_role_params(ptr);
             if(linked_role_params) {
-               preprocess_pl_params(linked_role_params);
+               preprocess_pl_params(ctxt,linked_role_params);
             }
     }
Index: libabac/abac_pl_pre.h
===================================================================
--- libabac/abac_pl_pre.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_pl_pre.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,12 @@
+#ifndef __ABAC_PL_PRE_H__
+#define __ABAC_PL_PRE_H__
+
+#include "abac_internal.h"
+
+/* exported */
+void preprocess_pl_term(abac_context_t *,abac_term_t *ptr);
+void preprocess_pl_params(abac_context_t *,abac_param_list_t *ptr);
+void preprocess_pl_head(abac_context_t *,abac_aspect_t *ptr);
+void preprocess_pl_tail(abac_context_t *,abac_aspect_t *ptr);
+
+#endif /* __ABAC_PL_PRE_H__ */
Index: libabac/abac_pl_yap.c
===================================================================
--- libabac/abac_pl_yap.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_yap.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -12,16 +12,15 @@
 #include <Yap/YapInterface.h>
 
-#include "abac_internal.h"
-
-#include "abac_pl_yap.h"
+#include "abac_defines.h"
 #include "abac_util.h"
+#include "abac_stack.h"
+#include "abac_context.h"
+#include "abac_list.h"
+#include "abac_pl_gen.h"
+#include "abac_pl_yy.h"
+#include "abac_aspect.h"
+#include "abac_m64.h"
 
 #include "uthash.h"
-
-extern abac_credential_t *abac_credential_dup(abac_credential_t *cred);
-extern abac_list_t *abac_credential_clauses(abac_credential_t *);
-extern char *abac_id_clause(abac_id_credential_t *);
-extern abac_aspect_t *abac_yy_get_rule_tail_aspect();
-extern abac_aspect_t *abac_yy_get_rule_head_aspect();
 
 static int debug=0;
@@ -63,7 +62,8 @@
 static int _queryname_cnt=6;
 
-
-// pl -- place holder for now 
+/* this is the prolog query structure */
+
 struct _abac_pl_t {
+    abac_context_t *ctxt;
    /* a_term <- prin */
     char *whom;
@@ -85,4 +85,7 @@
 };
 
+/* the arg term for extracting ruleset is the 4th */
+#define RULES_ARG_OF_TERM  4
+
 /***********************************************************/
 /* default to Yap2 */
@@ -90,5 +93,5 @@
 {
 #ifdef  YAP_VERSION 
-    if(YAP_VERSION == "6.3.2") 
+    if(strncmp(YAP_VERSION,"6.3.",4)==0)
         return 1;
 #endif
@@ -108,4 +111,22 @@
 
 /***********************************************************/
+/* retract( (clause) ) */
+static int _remove_clause(char *str)
+{
+    int rc=0;
+    char *tmp=NULL;
+    YAP_Term eterm;
+    asprintf(&tmp,"retract( (%s) ).", str);
+    YAP_Term goalArgs=YAP_ReadBuffer(tmp, &eterm);
+    int res=YAP_RunGoal(goalArgs);
+    if (!res) { 
+        printf("error: result of removing clause (%s)\n", tmp);
+        rc=1;
+        } else {
+            DEBUG_PRINTF("okay: result of removing clause (%s)\n", tmp);
+    }
+    free(tmp);
+    return rc;
+}
 
 static int _insert_clause(char *str)
@@ -122,8 +143,28 @@
 }
 
+/* assert( (clause) ) */
+static int _assert_clause(char *str)
+{
+    int rc=0;
+    YAP_Term eterm;
+    char *tmp=NULL;
+    asprintf(&tmp,"assert( (%s) )", str);
+    YAP_Term goalArgs=YAP_ReadBuffer(tmp, &eterm);
+    int res=YAP_RunGoal(goalArgs);
+    if (!res) { /* something is wrong */
+        printf("error: result of assert clause (%d)(%s)\n", res, tmp);
+        rc=1;
+        } else {
+            DEBUG_PRINTF("okay: result of assert clause (%d)(%s)\n", res, tmp);
+    }
+    free(tmp);
+    return rc;
+}
+
+
 static int _insert_cred_clause(char *cstr)
 {
     int ret=ABAC_CERT_SUCCESS;
-    int rc=_insert_clause(cstr);
+    int rc=_assert_clause(cstr);
     if (rc)
         return ABAC_CERT_BAD_YAP;
@@ -133,5 +174,5 @@
 void show_yap_db(const char *msg)
 {
-    char lstr[]="listing";
+    char lstr[]="listing.";
     YAP_Term eterm; /* error term */
 
@@ -150,5 +191,6 @@
  * Include some utility routines
  */
-abac_pl_t *abac_pl_utility(void) {
+abac_pl_t *abac_pl_utility(void)
+{
 /*
 append([],L,L).
@@ -169,9 +211,6 @@
 }
 
-/**
- * Create a new yap structure.
- */
-abac_pl_t *abac_pl_new(void) {
-
+abac_pl_t *abac_pl_init()
+{
     YAP_Term eterm;
 
@@ -181,14 +220,25 @@
     int rc=YAP_RunGoalOnce(YAP_ReadBuffer("source",&eterm));
     if(rc) {
-        if(debug) fprintf(stderr, "calling source..\n");
+        DEBUG_PRINTF( "calling source..\n");
         } else {
-            if(debug) fprintf(stderr,"calling source failed..\n");
+            DEBUG_PRINTF("PANIC: calling source failed..\n");
             YAP_Exit(1);
     }
-
     abac_pl_utility();
+}
+
+/* nothing in deinit right now */
+void abac_pl_deinit()
+{
+}
   
+/**
+ * Create a new yap query structure.
+ */
+abac_pl_t *abac_pl_new(abac_context_t *ctxt)
+{
     abac_pl_t *pl = abac_xmalloc(sizeof(abac_pl_t));
 
+    pl->ctxt=ctxt;
     pl->who=NULL;
     pl->whom = NULL;
@@ -328,8 +378,7 @@
  * don't try to free it after this call.
  */
-int abac_pl_add_credential(abac_pl_t *pl, abac_credential_t *cred)
+int abac_pl_add_credential(abac_list_t *clauses)
 {
     int rc=0;
-    abac_list_t *clauses=abac_credential_clauses(cred);
     if (clauses != NULL) {
         char *cur;
@@ -344,7 +393,26 @@
 }
 
-int abac_pl_add_type_credential(abac_pl_t *pl, abac_id_credential_t *id_cert)
-{
-    char *clause=abac_id_clause(id_cert);
+/**
+ * Delete a list of credentials from db,
+ */
+int abac_pl_remove_credential(abac_list_t *clauses)
+{
+    int rc=0;
+    if (clauses != NULL) {
+        char *cur;
+        abac_list_foreach(clauses, cur,
+            if(cur) {
+                if(debug) fprintf(stderr,"deleting =>%s\n",cur);
+                rc=_remove_clause(cur);
+            }
+        );
+    }
+    return rc;
+}
+
+
+
+int abac_pl_add_type_credential(char *clause)
+{
     if (clause != NULL) {
         int rc=_insert_cred_clause(clause);
@@ -368,61 +436,91 @@
 }
 
+/* chop a 'string' or bare-string out of istring */
+static char* _chop(char **istring)
+{
+   char *ret=NULL;
+   char *cptr=*istring;
+   char *nptr=cptr; /* next */
+   int yesQ=0;
+
+   if(strlen(*istring)==0) return ret;
+   if(cptr[0]==']') return ret;
+   if(cptr[0]=='\'') { /* take a step */
+      yesQ=1;
+      cptr++; 
+      nptr=cptr;
+   }
+   while(1) {
+       if(yesQ) { /* look for ',' or ', or '] */
+           nptr=strstr(cptr,"',");
+           if(nptr!=NULL) { 
+              *istring=nptr+2;
+              break;
+           }
+           nptr=strstr(cptr,"']");
+           if(nptr!=NULL) { 
+              *istring=nptr+2;
+              break;
+           }
+           } else { /* yesQ=no */
+              nptr=strstr(cptr,",");
+              if(nptr!=NULL) { 
+                  *istring=nptr+1;
+                  break;
+              }
+              nptr=strstr(cptr,"]");
+              if(nptr!=NULL) { 
+                  *istring=nptr+1;
+                  break;
+              }
+       }
+   }
+   if(nptr==NULL) {
+       fprintf(stderr,"BAD,  format not as expected!!\n");
+       } else {
+          int len=(nptr-cptr);
+          ret=strndup(cptr,len);
+   }
+   return ret;
+}
+
 /* cases, for YAP 6.2.x 
      ['str']
      ['str1','str2']
+     [str1,'str2']
+     ['str1',str2]
      ([] is not possible, and don't care)
 */
-static void _credentials_from_string_2(abac_list_t *credentials,char *slist) 
+static void _credentials_from_string_2(abac_context_t *ctxt,abac_list_t *credentials,char *slist) 
 {
     char *cptr=slist; /* current ptr */
-    char *sptr; /* string ptr */
-    char *ptr;
-    int len=0;
     char *string;
     abac_credential_t *cred=NULL;
     int cnt=0;
-
-    /* find first [' */  
-    ptr=strstr(cptr,"['");
-    if(ptr == NULL) 
-         return;
-    cptr=ptr+2;
-    sptr=cptr;
-    while (1) {
-        /* find next ',' or '] */
-        if(debug) fprintf(stderr,"START with %d\n", strlen(cptr));
-        ptr=strstr(cptr,"','");
-        if(ptr!=NULL) {
-             cptr=ptr+3;
-             len=(ptr-sptr);
-             string=strndup(sptr,len);
-             cred=abac_credential_lookup(string);
-             free(string); 
-             if(cred) {
-                 int i=abac_list_unique_add(credentials, cred);
-                 if(i) cnt++;
-                 } else {
-                 printf("BAD BAD\n");
-             }
-             sptr=cptr;
+    char *ptr=NULL;
+
+/* it looks like the first one could be [abc,'def'] */
+    /* find first [' or [ */  
+    ptr=strstr(cptr,"[");
+    if(ptr==NULL) { 
+        return;
+    }
+
+/* it looks like the last one could be  'abc',efg] in addition to 'abac','efg'] */
+/* it looks like the first one could be [abc,'def'] */
+    cptr++;
+    string=_chop(&cptr); /* first one */
+    while (string!=NULL) {
+        cred=abac_context_credential_lookup(ctxt,string);
+        if(cred) {
+             int i=abac_list_unique_add(credentials, cred);
+             if(i) cnt++;
              } else {
-             ptr=strstr(cptr,"']");
-             if(ptr!=NULL) {
-                 len=(ptr-sptr);
-                 string=strndup(sptr,len);
-                 cred=abac_credential_lookup(string);
-                 free(string);
-                 if(cred) {
-                     int i=abac_list_unique_add(credentials, cred);
-                     if(i) cnt++;
-                     } else {
-                     printf("BAD BAD BAD\n");
-                 }
-                 break;
-             }
+                 printf("BAD -did not find(%s)(%s)\n", abac_decode_string(string),string); 
         }
-    }
-    if(debug)
-        fprintf(stderr,"DEBUG:total %d credentials\n", cnt);
+        free(string); 
+        string=_chop(&cptr);
+    }
+    DEBUG_PRINTF("DEBUG:total %d credentials\n", cnt);
 }
 
@@ -432,5 +530,5 @@
      ([] is not possible, and don't care)
 */
-static void _credentials_from_string_3(abac_list_t *credentials,char *slist)
+static void _credentials_from_string_3(abac_context_t *ctxt,abac_list_t *credentials,char *slist)
 {
     char *cptr=slist; /* current ptr */
@@ -450,5 +548,5 @@
     while (1) {
         /* find next "," or "]" */
-        if(debug) fprintf(stderr,"START with %d\n", strlen(cptr));
+        DEBUG_PRINTF("START with %d\n", strlen(cptr));
         ptr=strstr(cptr,",");
         if(ptr!=NULL) {
@@ -456,5 +554,5 @@
              len=(ptr-sptr);
              string=strndup(sptr,len);
-             cred=abac_credential_lookup(string);
+             cred=abac_context_credential_lookup(ctxt,string);
              free(string); 
              if(cred) {
@@ -462,5 +560,5 @@
                  if(i) cnt++;
                  } else {
-                 printf("BAD BAD\n");
+                   printf("BAD 2 -did not find(%s)\n", abac_decode_string(string)); 
              }
              sptr=cptr;
@@ -470,5 +568,5 @@
                  len=(ptr-sptr);
                  string=strndup(sptr,len);
-                 cred=abac_credential_lookup(string);
+                 cred=abac_context_credential_lookup(ctxt,string);
                  free(string);
                  if(cred) {
@@ -476,5 +574,5 @@
                      if(i) cnt++;
                      } else {
-                     printf("BAD BAD BAD\n");
+                         printf("BAD BAD 2 -did not find(%s)\n", abac_decode_string(string)); 
                  }
                  break;
@@ -482,13 +580,13 @@
         }
     }
-    if(debug)
-        fprintf(stderr,"DEBUG:total %d credentials\n", cnt);
-}
-
-static void _credentials_from_string(abac_list_t *credentials,char *slist) {
-    if(isYAP3())
-         _credentials_from_string_3(credentials,slist);
-    else
-         _credentials_from_string_2(credentials,slist);
+    DEBUG_PRINTF("DEBUG:total %d credentials\n", cnt);
+}
+
+static void _credentials_from_string(abac_context_t *ctxt,abac_list_t *credentials,char *slist) {
+    if(isYAP3()) {
+         _credentials_from_string_3(ctxt,credentials,slist);
+    } else {
+         _credentials_from_string_2(ctxt,credentials,slist);
+    }
 }
 
@@ -504,5 +602,5 @@
        size = (sizeof(char) * (blk+1));
        } else {
-           if(debug) fprintf(stderr,"calling try_again needing extra space!!\n");
+           DEBUG_PRINTF("calling try_again needing extra space!!\n");
            if (sz>=max) {
                size=0;
@@ -525,4 +623,5 @@
 static int _check_buffer(char *tmp)
 {
+    if(tmp==NULL) return 0;
     int len=strlen(tmp); /* just for reference :-( */
     if (len < 3) return 0;
@@ -540,6 +639,5 @@
         }
     }
-    if(debug)
-        fprintf(stderr," _check_buffer, did not find the closing square bracket ..\n");
+    DEBUG_PRINTF(" _check_buffer, did not find the closing square bracket ..\n");
     return 0;
 }
@@ -549,9 +647,9 @@
     abac_list_t *cred_list=abac_list_new();
     YAP_Atom f = YAP_LookupAtom("isMember");
-    YAP_Functor func = YAP_MkFunctor(f, 3);
-    YAP_Term goal=YAP_MkApplTerm(func, 3, arg);
+    YAP_Functor func = YAP_MkFunctor(f, 4);
+    YAP_Term goal=YAP_MkApplTerm(func, 4, arg);
 
     pl->safe_t = YAP_InitSlot(goal);
-if(debug) fprintf(stderr," run_goal, safe_t is %ld\n", pl->safe_t);
+DEBUG_PRINTF(" run_goal, safe_t is %ld\n", pl->safe_t);
     pl->query_rc =YAP_RunGoal(goal);
     goal=YAP_GetFromSlot(pl->safe_t);
@@ -566,13 +664,10 @@
         if(!isYAP3())
             tmp_sz=try_again(0, &tmp);
-        YAP_Term argterm=YAP_ArgOfTerm(3,goal);
+        YAP_Term argterm=YAP_ArgOfTerm(RULES_ARG_OF_TERM,goal);
         while(1) {
-            int rc=1; /* XXX rc does not seems to be right... */
-/* for 6.3 series .. 
-     rc=YAP_WriteBuffer(argterm, tmp, tmp_sz,YAP_WRITE_HANDLE_VARS);
-*/
-            YAP_WriteBuffer(argterm, tmp, tmp_sz,YAP_WRITE_HANDLE_VARS); 
-
-/** it seems that 6.3 gives me some garbage at the back.. */
+            int rc=YAP_WriteBuffer(argterm, tmp, tmp_sz,YAP_WRITE_HANDLE_VARS);
+            if(YAP_VERSION == "6.2.2" || YAP_VERSION == "6.2.3") 
+               rc=1; /* XXX rc does not seems to be right for 6.2.x */
+/** it seems that 6.3 might give me some garbage at the back.. */
             if(rc==1 && _check_buffer(tmp)) {
                 break;
@@ -586,8 +681,8 @@
         }
         /* this is returned as ['string1','string2'] */
-        if(debug) fprintf(stderr,"    query answer : %s(%d)\n", tmp, strlen(tmp));
-        _credentials_from_string(cred_list,tmp); 
+        DEBUG_PRINTF("    query answer : %s(%d)\n", tmp, strlen(tmp));
+        _credentials_from_string(pl->ctxt,cred_list,tmp); 
         if(abac_list_size(cred_list)==0) {
-            fprintf(stderr,"CAN NOT retrieve result properly from YAP!!!\n");
+            fprintf(stderr,"CAN NOT retrieve result properly from YAP(1)!!!\n");
             YAP_Exit(1);
         }
@@ -614,5 +709,5 @@
 }
 
-// isMember(who,aspect(whom,what,whatwith)) 
+// isMember(namespace, who,aspect(whom,what,whatwith)) 
 /* aspect(whom, what, whatwith) */
 YAP_Term _aspect_base(char *whom,char *aspect, char *what, char *whatwith)
@@ -625,5 +720,5 @@
        asprintf(&estring, "%s(%s,%s,%s)",aspect,whom,what,whatwith);
        else asprintf(&estring, "%s(%s,%s)",aspect,whom,what);
-    if(debug) fprintf(stderr,"_aspect_base, doing %s\n",estring);
+    DEBUG_PRINTF("_aspect_base, doing %s\n",estring);
     ret=YAP_ReadBuffer(estring,&eterm);
     free(estring);
@@ -679,55 +774,60 @@
 
 // Whom.What <- ladybug
-// isMember(ladybug, role(W1, W2), R)
-static void _arg_for_what_whom(YAP_Term *arg,char *who, char *whom,
+// isMember(namespace,ladybug, role(W1, W2), R)
+static void _arg_for_what_whom(YAP_Term *arg,char *namespace, char *who, char *whom,
 char *aspect, char*what, char *whatwith, int pcnt)
 {
-    arg[0] = _make_term(who);
+    arg[0] = _make_term(namespace);
+    arg[1] = _make_term(who);
     char *tmp=_make_whatwith_var(whatwith,pcnt); 
-    arg[1] = _aspect_what_whom(who,aspect,what,tmp);
+    arg[2] = _aspect_what_whom(who,aspect,what,tmp);
     if(tmp) free(tmp);
-    arg[2] = YAP_MkVarTerm();
+    arg[3] = YAP_MkVarTerm();
 }
 
 // pAcme.What <- ladybug
-// isMember(ladybug, role(pAcme, W), R)
-static void _arg_for_what(YAP_Term *arg,char *who, char* whom, 
+// isMember(namespace, ladybug, role(pAcme, W), R)
+static void _arg_for_what(YAP_Term *arg,char *namespace,char *who, char* whom, 
 char *aspect, char*what, char*whatwith, int pcnt)
 {
-    arg[0] = _make_term(who);
+    arg[0] = _make_term(namespace);
+    arg[1] = _make_term(who);
     char *tmp=_make_whatwith_var(whatwith,pcnt); 
-    arg[1] = _aspect_what(whom,aspect,what,tmp);
+    arg[2] = _aspect_what(whom,aspect,what,tmp);
     if(tmp) free(tmp);
-    arg[2] = YAP_MkVarTerm();
+    arg[3] = YAP_MkVarTerm();
 }
 
 // W.rocket <- ladybug
-// isMember(ladybug, role(W, buy_rockets), R)
-static void _arg_for_whom(YAP_Term *arg, char *who, char*whom,
+// isMember(namespace, ladybug, role(W, buy_rockets), R)
+static void _arg_for_whom(YAP_Term *arg, char *namespace,char *who, char*whom,
 char *aspect, char *what, char*whatwith)
 {
-    arg[0] = _make_term(who);
-    arg[1] = _aspect_whom(whom,aspect,what,whatwith);
-    arg[2] = YAP_MkVarTerm();
+    arg[0] = _make_term(namespace);
+    arg[1] = _make_term(who);
+    arg[2] = _aspect_whom(whom,aspect,what,whatwith);
+    arg[3] = YAP_MkVarTerm();
 }
 
 // Acme.rocket <- V
-// isMember(V, role(pAcme, buy_rockets), R)
-static int _arg_for_who(YAP_Term *arg, char *who,char *whom, 
+// isMember(namespace, V, role(pAcme, buy_rockets), R)
+static int _arg_for_who(YAP_Term *arg, char* namespace, char *who,char *whom, 
 char *aspect, char* what, char*whatwith)
 {
-    arg[0] = YAP_MkVarTerm();
-    arg[1] = _aspect_fact(whom, aspect, what, whatwith);
-    arg[2] = YAP_MkVarTerm();
+    arg[0] = _make_term(namespace);
+    arg[1] = YAP_MkVarTerm();
+    arg[2] = _aspect_fact(whom, aspect, what, whatwith);
+    arg[3] = YAP_MkVarTerm();
 }
 
 // Acme.rocket <- x 
-// isMember(x, role(pAcme, buy_rockets), R)
-static void _arg_for_fact(YAP_Term *arg,char *who,char *whom, 
+// isMember(namespace,x, role(pAcme, buy_rockets), R)
+static void _arg_for_fact(YAP_Term *arg, char* namespace, char *who,char *whom, 
 char* aspect, char *what, char*whatwith)
 {
-    arg[0] = _make_term(who);
-    arg[1] = _aspect_fact(whom, aspect, what, whatwith);
-    arg[2] = YAP_MkVarTerm();
+    arg[0] = _make_term(namespace);
+    arg[1] = _make_term(who);
+    arg[2] = _aspect_fact(whom, aspect, what, whatwith);
+    arg[3] = YAP_MkVarTerm();
 }
 
@@ -737,4 +837,5 @@
     abac_list_t *ret=abac_list_new();
     pl->is_partial=1;
+    char *namespace=abac_context_namespace(pl->ctxt);
     char *who=pl->who;
     char *whom=pl->whom;
@@ -743,13 +844,13 @@
     char *whatwith=pl->whatwith;
     int pcnt=pl->pcnt;
-    if(debug) fprintf(stderr,"making make_partial_query..\n");
+    DEBUG_PRINTF("making make_partial_query..\n");
 
     switch (pl->query_type) { 
         case e_PL_FACT: /* try what */
             {
-            YAP_Term arg[3];
-            if(debug) fprintf(stderr,"... 1st partial attempt\n");
+            YAP_Term arg[4];
+            DEBUG_PRINTF("... 1st partial attempt\n");
             pl->query_type = e_PL_WHAT;
-            _arg_for_what(arg,who,whom, aspect, what, whatwith, pcnt);
+            _arg_for_what(arg,namespace,who,whom, aspect, what, whatwith, pcnt);
             ret=run_goal(pl,arg);
             if(pcnt==0) pl->query_type= e_PL_WHAT_DFLT;
@@ -759,8 +860,8 @@
         case e_PL_WHAT: /* try what with no params if need to */
             {
-            YAP_Term arg[3];
-            if(debug) fprintf(stderr,"... 2nd partial attempt\n");
+            YAP_Term arg[4];
+            DEBUG_PRINTF("... 2nd partial attempt\n");
             pl->query_type = e_PL_WHAT_DFLT;
-            _arg_for_what(arg,who,whom, aspect, what, whatwith, 0);
+            _arg_for_what(arg,namespace,who,whom, aspect, what, whatwith, 0);
             ret=run_goal(pl,arg);
             if(pl->query_rc) return ret;
@@ -769,8 +870,8 @@
         case e_PL_WHAT_DFLT: /* try who */
             {
-            YAP_Term arg[3];
-            if(debug) fprintf(stderr,"... 2nd half partial attempt\n");
+            YAP_Term arg[4];
+            DEBUG_PRINTF("... 2nd half partial attempt\n");
             pl->query_type = e_PL_WHO;
-            _arg_for_who(arg,who,whom, aspect, what, whatwith);
+            _arg_for_who(arg,namespace,who,whom, aspect, what, whatwith);
             ret=run_goal(pl,arg);
             if(pl->query_rc) return ret;
@@ -779,8 +880,8 @@
         case e_PL_WHO: /* try whom */
             {
-            YAP_Term arg[3];
-            if(debug) fprintf(stderr,"... 3rd partial attempt\n");
+            YAP_Term arg[4];
+            DEBUG_PRINTF("... 3rd partial attempt\n");
             pl->query_type = e_PL_WHOM;
-            _arg_for_whom(arg,who,whom, aspect, what, whatwith);
+            _arg_for_whom(arg,namespace,who,whom, aspect, what, whatwith);
             ret=run_goal(pl,arg);
             if(pl->query_rc) return ret;
@@ -789,8 +890,8 @@
         case e_PL_WHOM: /* try what-whom */
             {
-            YAP_Term arg[3];
-            if(debug) fprintf(stderr,"... 4th partial attempt\n");
+            YAP_Term arg[4];
+            DEBUG_PRINTF("... 4th partial attempt\n");
             pl->query_type = e_PL_WHAT_WHOM;
-            _arg_for_what_whom(arg,who,whom, aspect, what, whatwith,pcnt);
+            _arg_for_what_whom(arg,namespace,who,whom, aspect, what, whatwith,pcnt);
             ret=run_goal(pl,arg);
             if(pl->query_rc) return ret;
@@ -799,5 +900,5 @@
         default :
             {
-            if(debug) fprintf(stderr,"... no more partial query to try\n");
+            DEBUG_PRINTF("... no more partial query to try\n");
             pl->query_type = e_PL_NOMORE;
             }
@@ -817,18 +918,12 @@
 char *whom, char *aspect, char *what, char *whatwith, int pcnt)
 {
-    if(debug) { 
-       fprintf(stderr,"_make_yap_query: the who part(%s)\n", who);
-       fprintf(stderr,"_make_yap_query: whom part(%s)\n", whom);
-       fprintf(stderr,"_make_yap_query: the role/oset (%s)\n", aspect);
-       fprintf(stderr,"_make_yap_query: aspect what (%s)\n", what);
-       fprintf(stderr,"_make_yap_query: pcnt (%d)\n", pcnt);
-       if(whatwith)
-           fprintf(stderr,"_make_yap_query: aspect what part(%s)\n", whatwith);
-    } 
-    if(debug) fprintf(stderr,"making a yap query..\n");
+    DEBUG_PRINTF("_make_yap_query: \n who(%s)\n whom(%s)\n role/oset(%s)\n aspect what(%s)\n pcnt(%d)\n",
+                 who, whom, aspect, what, pcnt);
+    if(whatwith) { DEBUG_PRINTF(" aspect what(%s)\n", whatwith); }
 
 /* run query on fact goal */
-    YAP_Term arg[3];
-    _arg_for_fact(arg, who,whom, aspect, what, whatwith);
+    YAP_Term arg[4];
+    char* namespace=abac_context_namespace(pl->ctxt);
+    _arg_for_fact(arg, namespace,who,whom, aspect, what, whatwith);
     abac_list_t *ret=run_goal(pl,arg);
 
@@ -849,5 +944,5 @@
     abac_list_t *cred_list=abac_list_new();
 
-    if(debug) fprintf(stderr,"making query_again call..\n");
+    DEBUG_PRINTF("making query_again call..\n");
     pl->next_rc=YAP_RestartGoal();
     pl->query_made++;
@@ -856,12 +951,14 @@
     char *tmp=NULL;
     int tmp_sz=try_again(0, &tmp);
-    YAP_Term argterm=YAP_ArgOfTerm(3,goal);
+    YAP_Term argterm=YAP_ArgOfTerm(RULES_ARG_OF_TERM,goal);
     if(pl->next_rc) {
-        if(debug) fprintf(stderr,"query_again: another success\n");
+        DEBUG_PRINTF("query_again: another success\n");
         if(pl->is_partial)
             printf("A partial proof(type:%s)\n",_queryname[pl->query_type]);
         while(1) {
-            YAP_WriteBuffer(argterm, tmp, tmp_sz,YAP_WRITE_HANDLE_VARS);
-            if(strlen(tmp) > 5 && tmp[0]=='\[')
+            int rc=YAP_WriteBuffer(argterm, tmp, tmp_sz,YAP_WRITE_HANDLE_VARS);
+            if(YAP_VERSION == "6.2.2" || YAP_VERSION == "6.2.3") 
+               rc=1; /* XXX rc does not seems to be right for 6.2.x */
+            if(rc==1 && _check_buffer(tmp)) 
                 break;
             tmp_sz=try_again(tmp_sz,&tmp);
@@ -872,8 +969,8 @@
         }
         /* this is returned as ['string1','string2'] */
-        if(debug) fprintf(stderr,"    query answer : %s(%d)\n", tmp, strlen(tmp));
-        _credentials_from_string(cred_list,tmp); 
+        DEBUG_PRINTF("    query answer : %s(%d)\n", tmp, strlen(tmp));
+        _credentials_from_string(pl->ctxt,cred_list,tmp); 
         if(abac_list_size(cred_list)==0) {
-            fprintf(stderr,"CAN NOT retrieve result properly from YAP!!!\n");
+            fprintf(stderr,"CAN NOT retrieve result properly from YAP(2)!!!\n");
             YAP_Exit(1);
         }
@@ -881,5 +978,5 @@
         YAP_FreeSpaceFromYap(tmp);
         } else {
-            if(debug) fprintf(stderr,"query_again: fail finding next\n");
+            DEBUG_PRINTF("query_again: fail finding next\n");
             if(pl->is_partial) { /* if there is more partial query to make */
                 while(pl->query_type != e_PL_NOMORE) {
@@ -896,9 +993,9 @@
 void _print_cred_list(abac_list_t *p)
 {
-    if(debug) fprintf(stderr,"_print_cred_list(%d)items:\n",abac_list_size(p));
+    DEBUG_PRINTF("_print_cred_list(%d)items:\n",abac_list_size(p));
     if(abac_list_size(p) != 0) {
         abac_credential_t *cur=NULL;
         abac_list_foreach(p, cur,
-            if(debug) fprintf(stderr,"printing (%d),\n",(int)cur);
+            DEBUG_PRINTF("printing (%d),\n",(int)cur);
             abac_print_cred_info(cur, NULL);
         );
@@ -929,5 +1026,5 @@
 /* 2 types 
       acme.buys_rocket <- coyote (coyote=prin, acme.buys_rocket=role)
-        ==> isMember(coyote,role(acme,buys_rocket), L)
+        ==> isMember(namespace, coyote,role(acme,buys_rocket), L)
       acme.buys_rocket <- acme.preferred_customer  -- NOT valid 
 */
@@ -961,5 +1058,5 @@
     }
 
-    if(debug) fprintf(stderr,"printing up the yap query ..\n");
+    DEBUG_PRINTF("printing up the yap query ..\n");
 
     char *pstring;
@@ -986,25 +1083,13 @@
 
 /**
- * Get all the credentials (attribute/issuer cert pairs) from prolog
- * (which returns in string form)
- */
-abac_stack_t *abac_pl_credentials(abac_pl_t *pl)
-{
-    abac_stack_t *ret=abac_verifier_dump_creds();
-    return ret;
-}
-
-abac_stack_t *abac_pl_principals(abac_pl_t *pl)
-{
-    abac_stack_t *ret=abac_verifier_dump_principals();
-    return ret;
-}
-
-/**
  * Make a query into prolog db
 --role acme.preferred_customer --principal coyote
---role acme.prefer_customer.buy_rockets --principlal coyote
---oset acme.rockets -- object mrx-21 
+         acme.preferred_customer <-?- coyote
+--role acme.preferred_customer.buy_rockets --principlal coyote
+         acme.preferred_customer.buy_rockets <-?- coyote
+--oset acme.rockets -- object mrx_21 
+         acme.rockets <-?- mrx_21
 --oset acme.villans -- principal coyote
+         acme.villans <-?- coyote
  */
 abac_stack_t *abac_pl_query(abac_pl_t *pl, char *roleoset, char *prinobj)
@@ -1013,21 +1098,18 @@
     int len=strlen(roleoset)+strlen(prinobj)+5;
     char* attr_string=(char *) abac_xmalloc(sizeof(char)*len);
+    /* compose the query statement string */
     sprintf(attr_string,"%s<-%s", roleoset, prinobj);
 
-    if(debug)
-        fprintf(stderr,"abac_pl_query, query string is (%s)\n",attr_string);
+    DEBUG_PRINTF("abac_pl_query, query string is (%s)\n",attr_string);
 
     /* call into yacc parser */
-    abac_reset_yyfptr(attr_string);
-    abac_yy_init();
-    int rc=yyparse();
-    if (rc) {
-        free(attr_string);
+    abac_aspect_t *head_aspect = NULL;
+    abac_aspect_t *tail_aspect = NULL;
+    int using_this=0;
+    int rc=abac_yy_parse(pl->ctxt, attr_string, &head_aspect, &tail_aspect, &using_this);
+    if(rc) { /* ABAC_CERT_INVALID; */
         return NULL;
     }
 
-    abac_aspect_t *head_aspect = abac_yy_get_rule_head_aspect();
-    abac_aspect_t *tail_aspect = abac_yy_get_rule_tail_aspect();
-
     ret=_query_with_aspect(pl,head_aspect,tail_aspect);
 
@@ -1035,5 +1117,6 @@
 }
 
-abac_stack_t *abac_pl_query_with_structure(abac_pl_t *pl, abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect)
+abac_stack_t *abac_pl_query_with_structure(abac_pl_t *pl,
+abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect)
 {
     abac_stack_t *ret=NULL;
Index: libabac/abac_pl_yap.h
===================================================================
--- libabac/abac_pl_yap.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_yap.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,7 +1,7 @@
-#ifndef __PL_YAP_H__
-#define __PL_YAP_H__
+#ifndef __ABAC_PL_YAP_H__
+#define __ABAC_PL_YAP_H__
 
 #include "abac_internal.h"
-#include "abac_verifier.h"
+#include "abac_stack.h"
 
 #define ABAC_PL_CRED_OK          0   // adding a credential succeeded
@@ -9,24 +9,13 @@
 #define ABAC_PL_CRED_DUP         -2  // the credential is already present 
 
-typedef struct _abac_pl_t abac_pl_t;
 
-abac_pl_t *abac_pl_new(void);
+/* export */
+extern abac_pl_t *abac_pl_new(abac_context_t *);
+extern abac_stack_t *abac_pl_query_with_structure(abac_pl_t *pl, abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect);
+extern abac_stack_t *abac_pl_query_again(abac_pl_t *);
+extern abac_stack_t *abac_pl_query(abac_pl_t *, char *, char *);
+extern char *abac_pl_add_range_constraint_clause(char *var, char *tmplist);
+extern int abac_pl_remove_credential(abac_list_t *clauses);
+extern void abac_pl_init();
 
-int abac_pl_add_credential(abac_pl_t *pl, abac_credential_t *cred);
-abac_pl_t *abac_pl_dup(abac_pl_t *pl);
-/* return a list of credentials */
-abac_stack_t *abac_pl_query(abac_pl_t *pl, char *role, char *principal);
-abac_stack_t *abac_pl_query_again(abac_pl_t *pl);
-abac_stack_t *abac_pl_query_with_structure(abac_pl_t *pl, abac_aspect_t *head_aspect, abac_aspect_t *tail_aspect);
-void abac_pl_set_no_partial(abac_pl_t *pl);
-void abac_pl_set_want_partial(abac_pl_t *pl);
-int abac_pl_returning_partial(abac_pl_t *pl);
-
-/* return a list of all credentials in the pl file */
-abac_stack_t *abac_pl_credentials(abac_pl_t *pl);
-abac_stack_t *abac_pl_principals(abac_pl_t *pl);
-
-void abac_pl_free(abac_pl_t *pl);
-
-
-#endif /* __PL_YAP_H__ */
+#endif /* __ABAC_PL_YAP_H__ */
Index: libabac/abac_pl_yy.c
===================================================================
--- libabac/abac_pl_yy.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_yy.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,2 +1,5 @@
+/**
+** abac_pl_yy.c 
+**/
 
 /* C declarations */
@@ -6,27 +9,22 @@
 #include <assert.h>
 
+#include "abac_stack.h"
+
+#include "abac_pl_yy.h"
 #include "abac_util.h"
-#include "abac_pl_yy.h"
+#include "abac_pl_gen.h"
+#include "abac_list.h"
+#include "abac_term.h"
+#include "abac_aspect.h"
 
 static int debug=0;
 
-int using_this=0;
-
-extern void panic(char*);
-
-/* from abac_pl_gen.c */
-extern abac_list_t *generate_pl_clauses(abac_aspect_t *, abac_aspect_t *);
-
-/* from rt2.y */
-extern void abac_yyinit();
-
-int abac_yy_error_code = 0; /* keeping last error code */
-
+abac_context_t *abac_context=NULL; /* context used for this parsing */
+static int yy_using_this=0;
+int abac_yy_error_code=0; /* keeping last error code */
 int abac_rule_is_oset=0;
-abac_list_t *abac_rule_clauses=NULL;
-abac_stack_t *abac_rule_id_clauses=NULL; /* tracking individual id credentials */
+
 abac_aspect_t *abac_rule_head_aspect=NULL;
 abac_aspect_t *abac_rule_tail_aspect=NULL;
-
 
 /* structure to hold the range information
@@ -84,4 +82,5 @@
    e_yy_DTERM_NAMED,     keyid:bob
    e_yy_DTERM_PRINCIPAL, principal:?P
+   e_yy_DTERM_THIS,      ?this 
    e_yy_DTERM_ANONYMOUS  ? */
 struct _abac_yy_term_t {
@@ -125,5 +124,8 @@
 };
 
+/* local */
 static void _free_yy_expression(abac_yy_expression_t *);
+abac_aspect_t *validate_head(int yytype, abac_yy_expression_t *expr);
+abac_aspect_t *validate_linked_tail(int yytype, abac_yy_expression_t *expr);
 
 /************************************************************************/
@@ -133,50 +135,4 @@
 }
 
-/************************************************************************/
-abac_stack_t *abac_yy_get_rule_id_clauses()
-{
-    return abac_rule_id_clauses;
-}
-
-abac_stack_t *abac_yy_init_rule_id_clauses()
-{
-    abac_rule_id_clauses=abac_stack_new();
-    return abac_rule_id_clauses;
-}
-
-void abac_yy_free_rule_id_clauses()
-{
-    if (abac_rule_id_clauses != NULL)
-        abac_stack_free(abac_rule_id_clauses);
-}
-
-void abac_yy_set_rule_clauses(abac_list_t *clauses)
-{
-    abac_rule_clauses=clauses;
-    if(debug) {
-         fprintf(stderr,"printing out abac_rule_clauses:\n");
-         abac_print_clauses(abac_rule_clauses,stderr);
-    }
-}
-
-abac_list_t *abac_yy_get_rule_clauses()
-{
-    return abac_rule_clauses;
-}
-
-void abac_yy_free_rule_clauses()
-{
-    if (abac_rule_clauses != NULL) {
-        abac_pl_free_id_certs();
-        abac_list_free(abac_rule_clauses);
-    }
-}
-
-/* just set it to NULL without freeing the structure */
-void abac_yy_reset_rule_clauses()
-{
-    abac_rule_clauses=NULL;
-}
-
 int abac_yy_get_rule_is_oset()
 {
@@ -193,5 +149,4 @@
     return abac_rule_tail_aspect;
 }
-
 
 /************************************************************************/
@@ -447,5 +402,10 @@
 static void _set_using_this()
 {
-    using_this=1;
+    yy_using_this=1;
+}
+
+int abac_yy_get_using_this()
+{
+    return yy_using_this;
 }
 
@@ -457,14 +417,5 @@
 void set_yy_term_principal_name(abac_yy_term_principal_t *ptr, char *name)
 {
-    /* handle special case when the name=this, change it to This */
-    if(strcmp(name,"this")==0) {
-       ptr->name=abac_xstrdup("This");
-       _set_using_this();
-       } else {
-         ptr->name=abac_xstrdup(name);
-         /* just in case name came in as This already */
-         if(strcasecmp(name,"this")==0) 
-           _set_using_this();
-    }
+    ptr->name=abac_xstrdup(name);
 }
 
@@ -503,4 +454,14 @@
         _free_yy_expression(ptr->cond_head_expr);
     free(ptr);
+}
+
+abac_yy_term_t *make_yy_term_dterm_this()
+{
+    abac_yy_term_t *ptr=(abac_yy_term_t*)abac_xmalloc(sizeof(abac_yy_term_t));
+    ptr->type = e_yy_DTERM_THIS;
+    ptr->next=NULL;
+    ptr->bcnt=1;
+    _set_using_this();
+    return ptr;
 }
 
@@ -615,4 +576,5 @@
             break;
         case e_yy_DTERM_ANONYMOUS:
+        case e_yy_DTERM_THIS:
             break;
     }
@@ -718,10 +680,13 @@
 void make_yy_oset_constraint(abac_yy_term_data_t *ptr, char *tail_string)
 {
-   abac_yy_expression_t *head_expr=get_yy_term_data_cond_head_expr(ptr);
-   if(head_expr) {
-       abac_aspect_t *head_aspect=validate_head(e_yy_OSET_TYPE,head_expr);
-       if(head_aspect != NULL) {
+   abac_yy_expression_t *cond_expr=get_yy_term_data_cond_head_expr(ptr);
+   if(cond_expr) {
+       abac_aspect_t *cond_aspect=NULL;
+       if(cond_expr->type == e_yy_EXPR_LINKED)
+           cond_aspect=validate_linked_tail(e_yy_OSET_TYPE,cond_expr);
+       else cond_aspect=validate_head(e_yy_OSET_TYPE,cond_expr);
+       if(cond_aspect != NULL) {
            if(debug) fprintf(stderr,"make_yy_oset_constraint..\n");
-           set_yy_term_data_cond_ptr(ptr,head_aspect);
+           set_yy_term_data_cond_ptr(ptr,cond_aspect);
        }
    }
@@ -731,10 +696,13 @@
 void make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
 {
-   abac_yy_expression_t *head_expr=get_yy_term_principal_cond_head_expr(ptr);
-   if(head_expr) {
-       abac_aspect_t *head_aspect=validate_head(e_yy_ROLE_TYPE,head_expr);
-       if(head_aspect != NULL) {
+   abac_yy_expression_t *cond_expr=get_yy_term_principal_cond_head_expr(ptr);
+   if(cond_expr) {
+       abac_aspect_t *cond_aspect=NULL;
+       if(cond_expr->type == e_yy_EXPR_LINKED)
+           cond_aspect=validate_linked_tail(e_yy_ROLE_TYPE,cond_expr);
+       else cond_aspect=validate_head(e_yy_ROLE_TYPE,cond_expr);
+       if(cond_aspect != NULL) {
           if(debug) fprintf(stderr,"make_yy_role_constraint..\n");
-          set_yy_term_principal_cond_ptr(ptr,head_aspect);
+          set_yy_term_principal_cond_ptr(ptr,cond_aspect);
           set_yy_term_principal_isrange(ptr,0);
        }
@@ -798,4 +766,10 @@
               break;
            }
+           case e_yy_DTERM_THIS:
+           {
+              type=abac_verify_term_type("this");
+              name=abac_xstrdup("This");
+              break;
+           }
        }
        abac_term_t *param=NULL;
@@ -985,8 +959,7 @@
 
 /**********************************************************************/
-
-abac_list_t *make_oset_statement(abac_yy_expression_t *headexpr,
-                       abac_yy_expression_t *tailexpr) 
+int make_oset_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr) 
 { 
+    int rc=0;
     abac_aspect_t *head_oset=NULL;
     abac_aspect_t *tail_oset=NULL;
@@ -994,6 +967,8 @@
 /* build up left side's abac oset structure */
     head_oset=validate_head(e_yy_OSET_TYPE, headexpr);
-    if(head_oset == NULL)
+    if(head_oset == NULL) {
+        rc=1;
         goto error;
+    }
 
 /* build up the right side's abac oset structure */
@@ -1016,6 +991,8 @@
                     break;
             }
-            if(curr_oset==NULL)
+            if(curr_oset==NULL) {
+                rc=1;
                 goto error;
+            }
 
             /* check if first one */
@@ -1031,13 +1008,4 @@
         } /* while */
 
-        preprocess_pl_head(head_oset);
-        preprocess_pl_tail(tail_oset);
-
-/* XXX collect up type clauses, constraint clauses and 
-   generate rule clauses */
-        abac_list_t *tmp=generate_pl_clauses(head_oset,tail_oset);
-        if(tmp == NULL)
-            goto error;
-
         if(debug) {
             fprintf(stderr,"aspect head_oset: ");
@@ -1049,4 +1017,5 @@
         }
 
+error:
         _free_yy_expression(headexpr);
         _free_yy_expression(tailexpr);
@@ -1054,14 +1023,5 @@
         abac_rule_tail_aspect=tail_oset;
         abac_rule_is_oset=1;
-        return tmp;
-
-error:
-        _free_yy_expression(headexpr);
-        _free_yy_expression(tailexpr);
-        if(head_oset)
-            abac_aspect_free(head_oset);
-        if(tail_oset)
-            abac_aspect_free(tail_oset);
-        return NULL;
+    return rc;
 }
 
@@ -1102,9 +1062,14 @@
 }
 /*****************************************************************************/
-/* build up the abac structure and also create the yap clause
-   and insert it into db */
-abac_list_t *make_role_statement(abac_yy_expression_t *headexpr,
-abac_yy_expression_t *tailexpr) 
+abac_context_t *get_abac_context()
+{
+    assert(abac_context);
+    return abac_context;
+}
+
+/* build up the abac structure */
+int make_role_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr) 
 { 
+    int rc=0;
     abac_aspect_t *head_role=NULL;
     abac_aspect_t *tail_role=NULL;
@@ -1112,6 +1077,8 @@
 /* build up left side's abac role structure */
     head_role=validate_head(e_yy_ROLE_TYPE,headexpr);
-    if(head_role == NULL)
+    if(head_role == NULL) {
+        rc=1;
         goto error;
+    }
 
 /* build up the right side's abac role structure */
@@ -1131,6 +1098,8 @@
                     break;
             }
-            if(curr_role==NULL)
+            if(curr_role==NULL) {
+                rc=1;
                 goto error;
+            }
 
             /* check if first one */
@@ -1146,13 +1115,4 @@
         } /* while */
 
-        preprocess_pl_head(head_role);
-        preprocess_pl_tail(tail_role);
-
-/* collect up type clauses, constraint clauses and 
-   generate the final rule clauses */
-        abac_list_t *tmp=generate_pl_clauses(head_role,tail_role);
-        if(tmp == NULL)
-            goto error;
-
         if(debug) {
             fprintf(stderr,"aspect head_role: ");
@@ -1164,4 +1124,5 @@
         }
 
+error:
         _free_yy_expression(headexpr);
         _free_yy_expression(tailexpr);
@@ -1169,22 +1130,37 @@
         abac_rule_tail_aspect=tail_role;
         abac_rule_is_oset=0;
-        return tmp;
-
-error:
-        _free_yy_expression(headexpr);
-        _free_yy_expression(tailexpr);
-        if(head_role)
-            abac_aspect_free(head_role);
-        if(tail_role)
-            abac_aspect_free(tail_role);
-        return NULL;
+
+        return rc;
 }
 
 /************************************************************************/
-void abac_yy_init()
-{
+void abac_yy_init(abac_context_t *ctxt)
+{
+   yy_using_this=0;
+   abac_context=ctxt;
    abac_yyinit();
-   abac_yy_init_rule_id_clauses();
-}
-
-
+}
+
+/************************************************************************/
+/* this is called to parse a string into 2 aspect structures            */
+/* NEED TO BE LOCKED HERE XXX */
+int abac_yy_parse(abac_context_t *ctxt, char* attr_string, abac_aspect_t **head_aspect, abac_aspect_t **tail_aspect, int *using_this)
+{
+    /*ctxt could be null*/
+    abac_ll_reset_yyfptr(attr_string);
+    abac_yy_init(ctxt);
+    int rc=yyparse();
+    if (rc) {
+        free(attr_string);
+        abac_yy_set_error_code(ABAC_RT_CERT_INVALID);
+        return 1;
+    }
+    *head_aspect = abac_yy_get_rule_head_aspect();
+    *tail_aspect = abac_yy_get_rule_tail_aspect();
+    *using_this= abac_yy_get_using_this();
+    return 0;
+}
+
+
+
+
Index: libabac/abac_pl_yy.h
===================================================================
--- libabac/abac_pl_yy.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_pl_yy.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -2,9 +2,9 @@
 #define __ABAC_PL_YY_H__
 
-/* C declarations */
-#include "abac_internal.h"
+#include "abac_defines.h"
 #include "abac_list.h"
-#include "abac_rt.h"
+#include "rt2_yy.h"
 
+/* from abac_pl_yy */
 typedef struct _abac_yy_principal_t abac_yy_principal_t;
 typedef struct _abac_yy_term_principal_t abac_yy_term_principal_t;
@@ -32,5 +32,6 @@
     e_yy_DTERM_NAMED=2,
     e_yy_DTERM_DATA=3,
-    e_yy_DTERM_ANONYMOUS=4
+    e_yy_DTERM_ANONYMOUS=4,
+    e_yy_DTERM_THIS=5
 };
 
@@ -41,5 +42,6 @@
 };
 
-abac_yy_expression_t *make_yy_expression(int type,void *pptr,
+/* exported */
+extern abac_yy_expression_t *make_yy_expression(int type,void *pptr,
               abac_yy_roleoset_t *optr, abac_yy_roleoset_t *linked_role);
 extern abac_list_t *make_yy_max_range(char *max);
@@ -56,4 +58,5 @@
 extern void set_yy_term_data_is_anonymous(abac_yy_term_data_t *ptr);
 extern abac_yy_term_t *make_yy_term_dterm_anonymous();
+extern abac_yy_term_t *make_yy_term_dterm_this();
 extern abac_yy_term_t *make_yy_term_dterm_data(abac_yy_term_data_t *dptr);
 extern abac_yy_term_t *make_yy_term_dterm_named(abac_yy_principal_t *nptr);
@@ -64,19 +67,17 @@
 extern abac_list_t *make_yy_val_range(char *val);
 
-extern abac_list_t *make_role_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr);
-extern abac_list_t *make_oset_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr);
-extern char *get_yy_term_data_name(abac_yy_term_data_t *ptr);
-extern abac_yy_term_data_t *get_yy_expression_object(abac_yy_expression_t *ptr);
-extern abac_yy_expression_t *add_yy_expression(abac_yy_expression_t *nexpr, abac_yy_expression_t *exprs);
 extern abac_yy_term_t *add_yy_term(abac_yy_term_t *nterm, abac_yy_term_t *terms);
 extern abac_list_t *add_yy_val_range(abac_list_t *ptr, char * val);
+extern char *get_yy_term_data_name(abac_yy_term_data_t *ptr);
+extern abac_yy_expression_t *add_yy_expression(abac_yy_expression_t *nexpr,
+                                             abac_yy_expression_t *exprs);
 
-extern abac_aspect_t *validate_head(int yytype, abac_yy_expression_t *expr);
-extern abac_aspect_t *validate_named_tail(int yytype, abac_yy_expression_t *expr);
-extern abac_aspect_t *validate_object_tail(int yytype,abac_yy_expression_t *expr);
-extern abac_aspect_t *validate_some_tail(int yytype, abac_yy_expression_t *expr);
-extern abac_aspect_t *validate_linked_tail(int yytype, abac_yy_expression_t *expr);
 
-#define ABAC_YY_INVALID_HEAD        -1
+extern int make_role_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr);
+extern int make_oset_statement(abac_yy_expression_t *headexpr, abac_yy_expression_t *tailexpr);
+
+extern abac_context_t *get_abac_context();
+extern void abac_yy_set_error_code(int v);
+extern int abac_yy_get_using_this();
 
 #endif /* __ABC_PL_YY_H__ */
Index: libabac/abac_rt.h
===================================================================
--- libabac/abac_rt.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ 	(revision )
@@ -1,29 +1,0 @@
-
-/************************************************
- abac_rt.h
-************************************************/
-/* from bison, rt2.y */
-extern FILE *abac_yyin, *abac_yyout;
-extern int yyparse();
-extern void abac_init_yy();
-extern char *abac_get_yap_clause();
-extern void abac_free_yap_clause();
-
-/* from flex, rt2.l */
-extern void abac_rest_yyin(FILE *);
-extern void abac_rest_yyout(FILE *);
-extern FILE *abac_get_yyin();
-extern FILE *abac_get_yyout();
-extern void abac_reset_yyfptr(char *);
-extern char* abac_get_yyfptr();
-extern char* abac_get_yyfptr_encoded();
-extern void abac_push_keyid_yystate();
-extern void abac_push_range_yystate();
-extern void abac_push_yystate(char *);
-extern void abac_pop_yystate();
-
-/* on error code */
-#define ABAC_RT_ROLE_INVALID           -1  /* */
-#define ABAC_RT_CERT_INVALID           -2  /* */
-#define ABAC_RT_CERT_BAD_SIG           -3  /* */
-#define ABAC_RT_CERT_MISSING_ISSUER    -4  /* */
Index: libabac/abac_set.c
===================================================================
--- libabac/abac_set.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_set.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,8 +1,13 @@
+/**
+** abac_set.c
+**/
+
 #include <stdlib.h>
 
+#include "abac_util.h"
+#include "abac_list.h"
+#include "uthash.h"
+
 #include "abac_set.h"
-#include "abac_util.h"
-
-#include "uthash.h"
 
 typedef struct _abac_set_element_t {
@@ -16,4 +21,5 @@
 };
 
+/****************************************************************/
 /**
  * Create a new struct.
Index: libabac/abac_set.h
===================================================================
--- libabac/abac_set.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_set.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,16 +1,9 @@
-#ifndef __SET_H__
-#define __SET_H__
-
-#include "abac_list.h"
+#ifndef __ABAC_SET_H__
+#define __ABAC_SET_H__
 
 typedef struct _abac_set_t abac_set_t;
 
-abac_set_t *abac_set_new(void);
-int abac_set_add(abac_set_t *set, char *value);
-int abac_set_contains(abac_set_t *set, char *value);
-abac_list_t *abac_set_elements(abac_set_t *set);
-int abac_set_size(abac_set_t *set);
-void abac_set_intersect(abac_set_t *l, abac_set_t *r);
-void abac_set_free(abac_set_t *set);
+/* exported */
+/* none at this point */
 
-#endif /* __SET_H__ */
+#endif /* __ABAC_SET_H__ */
Index: libabac/abac_stack.c
===================================================================
--- libabac/abac_stack.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_stack.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,2 +1,6 @@
+/**
+** abac_stack.c
+**/
+
 #include <stdlib.h>
 
@@ -4,4 +8,15 @@
 #include "abac_util.h"
 
+struct _abac_stack_element_t {
+    void *ptr;
+    abac_stack_element_t *prev, *next;
+};
+
+struct _abac_stack_t {
+    abac_stack_element_t *elts;
+    int size;
+};
+
+/****************************************************************/
 abac_stack_t *abac_stack_new(void) {
     abac_stack_t *ret = abac_xmalloc(sizeof(abac_stack_t));
Index: libabac/abac_stack.h
===================================================================
--- libabac/abac_stack.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_stack.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,4 +1,4 @@
-#ifndef __STACK_H__
-#define __STACK_H__
+#ifndef __ABAC_STACK_H__
+#define __ABAC_STACK_H__
 
 #include "utlist.h"
@@ -6,21 +6,4 @@
 typedef struct _abac_stack_t abac_stack_t;
 typedef struct _abac_stack_element_t abac_stack_element_t;
-
-struct _abac_stack_element_t {
-    void *ptr;
-    abac_stack_element_t *prev, *next;
-};
-
-struct _abac_stack_t {
-    abac_stack_element_t *elts;
-    int size;
-};
-
-abac_stack_t *abac_stack_new(void);
-void abac_stack_push(abac_stack_t *stack, void *elt);
-int abac_stack_unique_push(abac_stack_t *stack, void *elt);
-void *abac_stack_pop(abac_stack_t *stack);
-int abac_stack_size(abac_stack_t *stack);
-void abac_stack_free(abac_stack_t *stack);
 
 #define abac_stack_foreach(STACK, CURRENT, BODY) do {  \
@@ -32,3 +15,11 @@
 } while (0)
 
-#endif /* __STACK_H__ */
+/* exported */
+extern abac_stack_t *abac_stack_new(void);
+extern void abac_stack_push(abac_stack_t *stack, void *elt);
+extern int abac_stack_unique_push(abac_stack_t *stack, void *elt);
+extern void *abac_stack_pop(abac_stack_t *stack);
+extern int abac_stack_size(abac_stack_t *stack);
+extern void abac_stack_free(abac_stack_t *stack);
+
+#endif /* __ABAC_STACK_H__ */
Index: libabac/abac_term.c
===================================================================
--- libabac/abac_term.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_term.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,5 +1,4 @@
 /***********************************************************
    abac_term.c
-
  dterm=data term of rt1
  term is a kind of dterm
@@ -12,14 +11,58 @@
 #include <time.h>
 
-#include "abac_internal.h"
 #include "abac_util.h"
+#include "abac_aspect.h"
+#include "abac_verifier.h"
+#include "abac_id.h"
+#include "abac_list.h"
 
 static int debug=0;
+
 extern char *strptime(const char *s, const char *format, struct tm *tm);
+extern int ABAC_IN_PROLOG;
+
+/* termname[dtermtype] */
+static const char *const _termname[] =
+{
+  "badterm",
+  "integer",
+  "urn",
+  "float",
+  "boolean",
+  "string",
+  "time" ,
+  "principal",
+  "anonymous",
+  "this"
+};
+static int _termname_cnt=9;
+
+typedef enum _condtype_t {
+    e_COND_ROLE = 1,
+    e_COND_OSET = 2,
+    e_COND_RANGE = 3
+} abac_condtype_t;
+
+/* condname[condtype] */
+static const char *const _condname[] =
+{
+  "badcondition",
+  "role",
+  "oset",
+  "range"
+};
+static int _condname_cnt=3;
+
+/* itemname[itemtype] */
+static const char *const _itemname[] =
+{
+  "baditem",
+  "min",
+  "max",
+  "target"
+};
+static int _itemname_cnt=3;
 
 /* itemtype is
-     e_ITEM_MIN=1,
-     e_ITEM_MAX=2,
-     e_ITEM_TARGET=3,
  [a..b], [a..], [..b], [a],[a,b],[many a]
 */
@@ -68,5 +111,5 @@
 };
 
-/******************************************************************/
+/****************************************************************/
 char *abac_condtype_string(int i)
 {
@@ -134,5 +177,5 @@
             case e_ITEM_TARGET:
                 if(val)
-                    asprintf(&val,"%s,%s",val,cur->val);
+                    asprintf(&val,"%s,%s",cur->val,val);
                 else val=abac_xstrdup(cur->val);
                 break;
@@ -181,4 +224,14 @@
 
 abac_item_t *abac_item_dup(abac_item_t *ptr)
+{
+     abac_item_t *nptr=
+             (abac_item_t *)abac_xmalloc(sizeof(abac_item_t));
+     nptr->itemtype=ptr->itemtype;
+     nptr->val=abac_xstrdup(ptr->val);
+     return nptr;
+}
+
+/* deep copy/same as dup */
+abac_item_t *abac_item_copy(abac_item_t *ptr)
 {
      abac_item_t *nptr=
@@ -288,5 +341,5 @@
 }
 
-/* make a copy */
+/* make a shallow copy */
 abac_condition_t *abac_condition_dup(abac_condition_t *ptr)
 {
@@ -308,4 +361,34 @@
          abac_list_foreach(ptr->range_list, cur,
            nitem=abac_item_dup(cur);
+           abac_list_add(nptr->range_list,nitem); 
+         );
+         } else {
+             nptr->range_list=NULL;
+     }
+     return nptr;
+}
+
+/* make a deep copy */
+abac_condition_t *abac_condition_copy(abac_condition_t *ptr)
+{
+     abac_condition_t *nptr=
+             (abac_condition_t *)abac_xmalloc(sizeof(abac_condition_t));
+     nptr->condtype=ptr->condtype;
+     nptr->vartype=ptr->vartype;
+     if(ptr->string) {
+         nptr->string=abac_xstrdup(ptr->string);
+     } else {
+         nptr->string=NULL;
+     }
+     if(ptr->of_aspect)
+         nptr->of_aspect=abac_aspect_copy(ptr->of_aspect);
+         else nptr->of_aspect=NULL;
+
+     if(ptr->range_list!=NULL) {
+         nptr->range_list=abac_list_new();
+         abac_item_t *cur;
+         abac_item_t *nitem;
+         abac_list_foreach(ptr->range_list, cur,
+           nitem=abac_item_copy(cur);
            abac_list_add(nptr->range_list,nitem); 
          );
@@ -452,27 +535,4 @@
 }
 
-void abac_condition_dump(abac_condition_t *ptr, char *offset)
-{
-   printf("...constraint...\n");
-   printf("%s condtype: %d(%s)\n",
-                offset, ptr->condtype,abac_condtype_string(ptr->condtype));
-   printf("%s vartype: %d(%s)\n",
-                offset, ptr->vartype,abac_termtype_string(ptr->vartype));
-   if(ptr->string)
-       printf("%s string: %s\n", offset, ptr->string);
-       else printf("%s string: --\n", offset);
-   if(ptr->range_list)
-       printf("%s range_list: %s\n",
-                     offset, abac_range_string(ptr->range_list));
-       else printf("%s range_list: --\n", offset);
-   if(ptr->of_aspect) {
-       char *tmp=NULL;
-       asprintf(&tmp,"  %s",offset);
-       abac_aspect_dump(ptr->of_aspect,tmp);
-       free(tmp);
-       } else printf("%s of_aspect: --\n", offset);
-   printf("................\n");
-}
-
 /******************************************************************/
 int abac_term_isvar(abac_term_t *term)
@@ -521,4 +581,10 @@
 {
     if(ptr->type == e_TERM_ANONYMOUS)
+        return 1;
+    return 0;
+}
+int abac_term_is_this(abac_term_t *ptr)
+{
+    if(ptr->type == e_TERM_THIS)
         return 1;
     return 0;
@@ -607,5 +673,5 @@
     strptime(string, "%Y%m%dT%H%M%S", &tm1);
     strftime(buf, sizeof(buf), "time(%Y,%m,%d,%H,%M,%S)", &tm1);
-    return strdup(buf);
+    return abac_xstrdup(buf);
 }
 
@@ -617,7 +683,18 @@
     char* rt=strptime(string, "time(%Y,%m,%d,%H,%M,%S)", &tm1);
     if(rt==NULL)
-        return strdup(string);
+        return abac_xstrdup(string);
     strftime(buf, sizeof(buf), "%Y%m%dT%H%M%S", &tm1);
     return strdup(buf);
+}
+
+static abac_term_t *_abac_term_init()
+{
+    abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+    ptr->type;
+    ptr->name=NULL;
+    ptr->isnamed=0;
+    ptr->p_name=NULL;
+    ptr->cn=NULL;
+    ptr->constraint=NULL;
 }
 
@@ -652,8 +729,7 @@
          }
      }
-     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+     abac_term_t *ptr=_abac_term_init();
      ptr->isnamed=0;
      ptr->type=type;
-     ptr->p_name=NULL;
      /* reformat the term name if it is a time type */
      if((!constraint) && _abac_termtype_is_time_type(type) && isdigit(name[0])) {
@@ -664,5 +740,4 @@
      }
      ptr->constraint=constraint;
-     ptr->cn=NULL;
      return ptr;
 }
@@ -680,8 +755,7 @@
      }
 
-     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+     abac_term_t *ptr=_abac_term_init();
      ptr->isnamed=0;
      ptr->type=type;
-     ptr->p_name=NULL;
      /* reformat the term name if it is a time type */
      if((!cptr) && _abac_termtype_is_time_type(type) && isdigit(name[0])) {
@@ -691,6 +765,6 @@
              ptr->name=abac_xstrdup(name);
      }
-     ptr->constraint=(cptr==NULL)?NULL:abac_condition_dup(cptr);
-     ptr->cn=NULL;
+     if(cptr)
+          ptr->constraint=abac_condition_dup(cptr);
      return ptr;
 }
@@ -699,40 +773,49 @@
 abac_term_t *abac_term_named_new(int idtype, char *name)
 {
-     if(debug) {
-         fprintf(stderr,"abac_term_named_new: \n");
-         fprintf(stderr,"  type is %d(%s)\n", idtype, abac_idtype_string(idtype));
-         fprintf(stderr,"  name is (%s)\n", name);
-     }
-     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+     DEBUG_PRINTF("abac_term_named_new: \n  type is %d(%s)\n", 
+                              idtype, abac_idtype_string(idtype));
+     DEBUG_PRINTF("  name is (%s)\n", name);
+     abac_term_t *ptr=_abac_term_init();
      ptr->isnamed=1;
      ptr->type=idtype;
      ptr->name=abac_xstrdup(name);
-     ptr->p_name=NULL;
      /* if ABAC_CN, no need to attach p */
      if(!USE("ABAC_CN"))
          asprintf(&ptr->p_name,"p%s",name);
-     ptr->constraint=NULL;
-     ptr->cn=NULL;
      return ptr;
 }
 
-/* seems to be always idtype==e_TERM_PRINCIPAL */
+abac_term_t *abac_term_this_create()
+{
+     DEBUG_PRINTF("abac_term_this_create:\n");
+     abac_term_t *ptr=_abac_term_init();
+     ptr->type=e_TERM_THIS;
+     ptr->name=abac_xstrdup("This");
+     return ptr;
+}
+
+
+/* seems to be always idtype==e_TERM_PRINCIPAL except for ?This*/
 abac_term_t *abac_term_named_create(char *name)
 {
-     if(debug) {
-         fprintf(stderr,"abac_term_named_create: \n");
-         fprintf(stderr,"  name is (%s)\n", name);
-     }
-
-     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+     DEBUG_PRINTF("abac_term_named_create: name is (%s)\n",name);
+     abac_term_t *ptr=_abac_term_init();
+     /* special case when it is a ?this */
+     if(strcasecmp(name,"this")==0) {
+        ptr->type=e_TERM_THIS;
+        ptr->name=abac_xstrdup("This");
+        return ptr;
+     }  
+     if(strcasecmp(name,"anonymous")==0) {
+        ptr->type=e_TERM_ANONYMOUS;
+        ptr->name=abac_xstrdup("_");
+        return ptr;
+     }  
      ptr->isnamed=1;
      ptr->type=e_TERM_PRINCIPAL;
      ptr->name=abac_xstrdup(name);
-     ptr->p_name=NULL;
      /* if ABAC_CN, no need to attach p */
      if(!USE("ABAC_CN"))
          asprintf(&ptr->p_name,"p%s",name);
-     ptr->constraint=NULL;
-     ptr->cn=NULL;
      return ptr;
 }
@@ -741,19 +824,12 @@
 abac_term_t *abac_term_id_create(abac_id_t *idptr)
 {
-     if(debug) {
-         fprintf(stderr,"abac_term_id_create: \n");
-         fprintf(stderr,"  name is (%s)\n", abac_id_name(idptr));
-     }
-
-     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
+     DEBUG_PRINTF("abac_term_named_id_create: name is (%s)\n", abac_id_name(idptr));
+     abac_term_t *ptr=_abac_term_init();
      ptr->isnamed=1;
      ptr->type=abac_id_idtype(idptr);
      ptr->name=abac_xstrdup(abac_id_name(idptr));
-     ptr->p_name=NULL;
      /* if ABAC_CN, no need to attach p */
      if(!USE("ABAC_CN"))
          asprintf(&ptr->p_name,"p%s",ptr->name);
-     ptr->constraint=NULL;
-     ptr->cn=NULL;
      return ptr;
 }
@@ -763,13 +839,31 @@
 {
      assert(ptr);
-     abac_term_t *nptr=abac_xmalloc(sizeof(abac_term_t));
+     abac_term_t *nptr=_abac_term_init();
      nptr->isnamed=ptr->isnamed;
      nptr->type=ptr->type;
      nptr->name=abac_xstrdup(ptr->name);
-     nptr->p_name=(ptr->p_name==NULL)?NULL:abac_xstrdup(ptr->p_name);
+     if(ptr->p_name)
+         nptr->p_name=abac_xstrdup(ptr->p_name);
      if(ptr->constraint!=NULL)
         nptr->constraint=abac_condition_dup(ptr->constraint);
-        else nptr->constraint=NULL;
-     nptr->cn=(ptr->cn)==NULL?NULL:abac_xstrdup(ptr->cn);
+     if(ptr->cn)
+        nptr->cn=abac_xstrdup(ptr->cn);
+     return nptr;
+}
+
+/* a deep copy */
+abac_term_t *abac_term_copy(abac_term_t *ptr)
+{
+     if(ptr == NULL) return NULL;
+     abac_term_t *nptr=_abac_term_init();
+     nptr->isnamed=ptr->isnamed;
+     nptr->type=ptr->type;
+     if(ptr->name)
+         nptr->name=abac_xstrdup(ptr->name);
+     if(ptr->p_name)
+         nptr->p_name=abac_xstrdup(ptr->p_name);
+     if(ptr->constraint!=NULL)
+        nptr->constraint=abac_condition_copy(ptr->constraint);
+     if(ptr->cn)
         nptr->cn=abac_xstrdup(ptr->cn);
      return nptr;
@@ -838,5 +932,5 @@
     if(abac_term_is_time_type(ptr) && !ABAC_IN_PROLOG ) {
        name=abac_time_to_term(name); /* this should be freed */
-       if(debug) fprintf(stderr,"abac_term_typed_string_with_condition: trying to turn the time back\n");
+       DEBUG_PRINTF("abac_term_typed_string_with_condition: trying to turn the time back\n");
        free_name=1;
     }
@@ -849,11 +943,15 @@
            if(abac_term_is_anonymous(ptr)) {
                asprintf(&tmp,"[?]");
+           } else {
+               if(abac_term_is_this(ptr)) {
+                   asprintf(&tmp,"[?This]");
                } else {
                    if(isupper(name[0])) 
                        asprintf(&tmp,"[%s:?%s]", type, name);
                    else asprintf(&tmp,"[%s:%s]", type, name);
+               }
            }
     }
-    if(debug) fprintf(stderr,"abac_term_typed_string_with_condition: (%s)\n",tmp);
+    DEBUG_PRINTF("abac_term_typed_string_with_condition: (%s)\n",tmp);
     if(free_name) free(name);
     return tmp;
@@ -884,12 +982,16 @@
 }
 
-void abac_param_dump(abac_param_list_t *ptr, char *offset)
-{
-    printf("===params===\n");
+abac_param_list_t *abac_param_list_copy(abac_param_list_t *ptr)
+{
+    if(ptr == NULL) return NULL;
+    abac_param_list_t *nptr=abac_xmalloc(sizeof(abac_param_list_t));
+    nptr->list=abac_list_new();
     abac_term_t  *cur;
+    abac_term_t  *ncur;
     abac_list_foreach(ptr->list, cur,
-           abac_term_dump(cur, offset);
+        ncur=abac_term_copy(cur);
+        abac_list_add(nptr->list, ncur);
     );
-    printf("============\n");
+    return nptr;
 }
 
@@ -960,10 +1062,10 @@
                   final=NULL;
                   asprintf(&final,"%s,%s",tmp,s);
-                  if(debug) fprintf(stderr,"typed param so far, %s\n", final);
+                  DEBUG_PRINTF("typed param so far, %s\n", final);
                   free(tmp);
            }
            free(s);
     );
-    if(debug) fprintf(stderr,"typed param so far, %s\n", final);
+    DEBUG_PRINTF("typed param so far, %s\n", final);
     return final;
 }
@@ -988,10 +1090,10 @@
                   final=NULL;
                   asprintf(&final,"%s,%s",tmp,s);
-                  if(debug) fprintf(stderr,"param so far, %s\n", final);
+                  DEBUG_PRINTF("param so far, %s\n", final);
                   free(tmp);
            }
            free(s);
     );
-    if(debug) fprintf(stderr,"param so far, %s\n", final);
+    DEBUG_PRINTF("param so far, %s\n", final);
     return final;
 }
@@ -1034,23 +1136,2 @@
 }
 
-void abac_term_dump(abac_term_t *ptr, char *offset)
-{
-    printf("--- term---\n");
-    printf("%s type : %s\n",offset, abac_term_type_name(ptr));
-    printf("%s name : %s\n",offset, abac_term_name(ptr));
-    printf("%s isnamed: %d\n",offset,ptr->isnamed);
-    if(ptr->p_name)
-        printf("%s p_name: %s\n",offset,ptr->p_name);
-        else printf("%s p_name: --\n",offset);
-    if(ptr->cn)
-        printf("%s cn: %s\n",offset,ptr->cn);
-        else printf("%s cn: --\n",offset);
-    if(ptr->constraint) {
-        char *tmp=NULL;
-        asprintf(&tmp,"  %s", offset);
-        abac_condition_dump(ptr->constraint,offset);
-        free(tmp);
-        } else printf("%s constraint: --\n",offset);
-    printf("-----------\n");
-}
-
Index: libabac/abac_term.h
===================================================================
--- libabac/abac_term.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_term.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,33 @@
+#ifndef __ABAC_TERM_H__
+#define __ABAC_TERM_H__
+
+#include "abac_defines.h"
+#include "abac_list.h"
+
+/* exported */
+/* for abac_aspect */
+extern char *abac_term_type_name(abac_term_t*);
+extern abac_condition_t *abac_term_constraint(abac_term_t*);
+extern abac_param_list_t *abac_param_list_new(abac_term_t *);
+extern char* abac_time_to_term(char*);
+extern char* abac_param_list_string_with_condition(abac_param_list_t *);
+extern char* abac_param_list_typed_string_with_condition(abac_param_list_t *);
+extern char* abac_param_list_string(abac_param_list_t *ptr);
+extern abac_list_t *abac_condition_range_list(abac_condition_t *ptr);
+extern int abac_item_type(abac_item_t *);
+extern char *abac_item_val(abac_item_t *);
+extern char *abac_term_to_time(char *);
+extern abac_aspect_t *abac_condition_of_aspect(abac_condition_t *ptr);
+extern abac_list_t *abac_param_list(abac_param_list_t *ptr);
+extern abac_term_t *abac_term_named_new(int idtype, char *name);
+extern char *abac_term_name(abac_term_t *term);
+extern abac_term_t *abac_term_new(int type, char *name, int isrange, char *cond, void *cptr);
+extern abac_aspect_t *abac_aspect_oset_new(char *principal_name, char *oset_name);
+extern abac_aspect_t *abac_aspect_role_new(char *principal_name, char *oset_name);
+extern abac_item_t *abac_item_new(int itype, char *val);
+
+extern abac_term_t *abac_term_copy(abac_term_t *);
+extern abac_param_list_t *abac_param_list_copy(abac_param_list_t *);
+
+
+#endif /* __ABAC_TERM_H__ */
Index: libabac/abac_util.c
===================================================================
--- libabac/abac_util.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_util.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,7 +1,5 @@
-
 /**
 ** abac_util.c
 **/
-
 #include <err.h>
 #include <stdlib.h>
@@ -13,4 +11,9 @@
 #include <termios.h>
 #include <unistd.h>
+#include <sys/types.h>
+
+#include <credentials/certificates/certificate.h>
+#include <credentials/certificates/x509.h>
+#include <credentials/keys/private_key.h>
 
 #include "abac_util.h"
@@ -20,21 +23,28 @@
 /* Callback configuration */
 struct cb_opts {
-    int use_prompt;    /* Print a prompt to stderr */
-    int use_echo;      /* If true, turn off input echo on stdin */
-    unsigned int tries; /* Number of attempts allowed */
-    char prompt[20];    /* The prompt to display if use_echo is true */
+    int use_prompt;                   /* Print a prompt to stderr */
+    int use_echo;        /* If true, turn off input echo on stdin */
+    unsigned int tries;             /* Number of attempts allowed */
+    char prompt[20]; /* The prompt to display if use_echo is true */
 };
 
-
+/**  potato pw length */
+#define PWLEN 128
+
+/** SHA string length */
 #define SHA1_LENGTH 40
-#ifndef ABAC_VERSION
-#define ABAC_VERSION "0.2.3"
-#endif
-
+
+/****************************************************************/
 char *abac_version()
 {
-   if(debug)
-       fprintf(stderr,"abac_version is %s\n", ABAC_VERSION);
+   DEBUG_PRINTF("abac_version is %s\n", ABAC_VERSION);
    return ABAC_VERSION;
+}
+
+char *prologIt(char *str)
+{
+    char *tmp=NULL;
+    asprintf(&tmp,"p%s",str);
+    return tmp;
 }
 
@@ -175,6 +185,5 @@
     rng->destroy(rng);
 
-    if(debug)
-        fprintf(stderr,"abac_generate_serial, serial generated is %#B\n", &serial);
+    DEBUG_PRINTF("abac_generate_serial, serial generated is %#B\n", &serial);
     return serial;
 }
@@ -275,5 +284,5 @@
    chunk_t pp=chunk_empty;
    if(file_exist(filename)) {
-       if(debug) fprintf(stderr,"trying to open %s\n", filename);
+       DEBUG_PRINTF("trying to open %s\n", filename);
        FILE *fp=fopen(filename,"r");
        char str[PWLEN]; 
Index: libabac/abac_util.h
===================================================================
--- libabac/abac_util.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_util.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,33 +1,35 @@
-#ifndef __UTIL_H__
-#define __UTTL_H__
+#ifndef __ABAC_UTIL_H__
+#define __ABAC_UTIL_H__
 
 #include <sys/types.h>
 
-#include <credentials/certificates/certificate.h>
-#include <credentials/certificates/x509.h>
-#include <credentials/keys/private_key.h>
-
 #include <chunk.h>
 
-#define PWLEN 128
-
-void *abac_xmalloc(size_t size);
-void *abac_xrealloc(void *ptr, size_t size);
-char *abac_xstrdup(char *source);
-char *abac_trim_quotes(char *string);
-void abac_split(char *string, char *delim, char **ret, int *num);
-int abac_validate_clean_name(char *string);
-int abac_validate_clean_aspect_name(char *string);
-chunk_t abac_generate_serial();
-void abac_clean_string(char *);
-
-int file_exist(char *filename);
-chunk_t extract_potato(char *filename, char *pfile);
+#ifndef ABAC_VERSION
+#define ABAC_VERSION "0.2.4"
+#endif
 
 #ifdef DEBUG
-#define debug_printf(...) fprintf(stderr, __VA_ARGS__)
+#define DEBUG_PRINTF(...) {if(debug) fprintf(stderr, __VA_ARGS__); }
 #else
-#define debug_printf(...) do { } while (0)
+#define DEBUG_PRINTF(...) {/*no op*/}
 #endif
 
-#endif /* __UTIL_H__ */
+/* exported from abac_util */
+extern char *abac_version();
+extern char *prologIt(char *);
+extern void *abac_xmalloc(size_t);
+extern void *abac_xrealloc(void*,size_t);
+extern char *abac_xstrdup(char*);
+extern char *abac_trim_quotes(char*);
+extern void abac_split(char*, char*, char**, int*);
+extern int abac_validate_clean_name(char*);
+extern int abac_validate_clean_aspect_name(char*);
+extern chunk_t abac_generate_serial();
+extern void abac_clean_string(char *);
+
+extern int file_exist(char*);
+extern chunk_t extract_potato(char*, char*);
+extern void abac_errx(int eval, const char *msg);
+
+#endif /* __ABAC_UTIL_H__ */
Index: libabac/abac_util_cert.c
===================================================================
--- libabac/abac_util_cert.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_util_cert.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,86 @@
+/**
+** abac_util_cert.c
+** utility code related process/handling of certificate_t
+**/
+#include <err.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <assert.h>
+#include <stdarg.h>
+#include <sys/stat.h>
+#include <termios.h>
+#include <unistd.h>
+#include <sys/types.h>
+
+#include <credentials/certificates/certificate.h>
+#include <credentials/certificates/x509.h>
+#include <credentials/keys/private_key.h>
+
+#include "abac_util.h"
+
+static int debug=0;
+
+char *cert_get_keyid(certificate_t *cert) {
+    // get the keyid
+    x509_t *x509 = (x509_t *)cert;
+    chunk_t keyid = x509->get_subjectKeyIdentifier(x509);
+    chunk_t string = chunk_to_hex(keyid, NULL, 0);
+    return (char *)string.ptr;
+}
+
+certificate_t *cert_get_id_cert_from_file(char *filename)
+{
+    certificate_t *cert = lib->creds->create(lib->creds,
+        CRED_CERTIFICATE, CERT_X509,
+        BUILD_FROM_FILE, filename,
+        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
+        BUILD_END
+    );
+    return cert;
+}
+
+certificate_t *cert_get_id_cert_from_chunk(chunk_t chunk)
+{
+    certificate_t *cert = lib->creds->create(lib->creds,
+        CRED_CERTIFICATE, CERT_X509,
+        BUILD_BLOB_ASN1_DER, chunk,
+        BUILD_X509_FLAG, X509_AA,
+        BUILD_END
+    );
+    return cert;
+}
+
+certificate_t *cert_get_id_cert_from_pem_chunk(chunk_t chunk)
+{
+    certificate_t *cert = lib->creds->create(lib->creds,
+        CRED_CERTIFICATE, CERT_X509,
+        BUILD_BLOB_PEM, chunk,
+        BUILD_X509_FLAG, X509_AA,
+        BUILD_END
+    );
+    return cert;
+}
+
+certificate_t *cert_get_attr_cert_from_file(char *filename)
+{
+    certificate_t *cert = lib->creds->create(lib->creds,
+        CRED_CERTIFICATE, CERT_X509_AC,
+        BUILD_FROM_FILE, filename,
+        BUILD_END
+    );
+    return cert;
+}
+
+
+certificate_t *cert_get_attr_cert_from_chunk(chunk_t chunk)
+{
+    certificate_t *cert = lib->creds->create(lib->creds,
+        CRED_CERTIFICATE, CERT_X509_AC,
+        BUILD_BLOB_ASN1_DER, chunk,
+        BUILD_END
+    );
+    return cert;
+}
+
+
Index: libabac/abac_util_cert.h
===================================================================
--- libabac/abac_util_cert.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
+++ libabac/abac_util_cert.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -0,0 +1,17 @@
+#ifndef __ABAC_CERT_UTIL_H__
+#define __ABAC_CERT_UTIL_H__
+
+#include <sys/types.h>
+
+#include <credentials/certificates/certificate.h>
+#include <credentials/certificates/x509.h>
+#include <credentials/keys/private_key.h>
+
+extern char *cert_get_keyid(certificate_t *cert);
+extern certificate_t *cert_get_id_cert_from_file(char *filename);
+extern certificate_t *cert_get_id_cert_from_chunk(chunk_t chunk);
+extern certificate_t *cert_get_id_cert_from_pem_chunk(chunk_t chunk);
+extern certificate_t *cert_get_attr_cert_from_file(char *filename);
+extern certificate_t *cert_get_attr_cert_from_chunk(chunk_t chunk);
+
+#endif /* __ABAC_CERT_UTIL_H__ */
Index: libabac/abac_verifier.c
===================================================================
--- libabac/abac_verifier.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_verifier.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -7,52 +7,30 @@
 
 #include <stdio.h>
-#include <regex.h>
-#include <sys/mman.h>
-#include <fcntl.h>
 #include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-
 #include <assert.h>
-#include <stdio.h>
 
 #include <library.h>
 
+#include <chunk.h>
 #include "abac_internal.h"
-#include "abac_verifier.h"
-
 #include "abac_util.h"
-#include "abac_rt.h"
+#include "abac_context.h"
+#include "abac_list.h"
+#include "abac_stack.h"
+#include "uthash.h"
+#include "abac_id.h"
+#include "abac_attribute.h"
+#include "abac_pl_yap.h"
 
 static int debug=0;
-
-/* from abac_attribute.c */
-extern char *get_cred_encoding(abac_attribute_t *ptr);
-
-extern abac_aspect_t *abac_yy_get_rule_head_aspect();
-extern abac_aspect_t *abac_yy_get_rule_tail_aspect();
-extern abac_list_t *abac_yy_get_rule_clauses();
-extern char* abac_decode_string(char *);
-extern void abac_yy_free_rule_clauses();
-extern char *generate_pl_type_clause(char *, int);
-extern abac_list_t *generate_pl_clauses(abac_aspect_t *, abac_aspect_t *);
-extern void generate_pl_set_abac_yyfptr_encoded(char *string);
-
-extern void abac_print_aspect_string_with_condition(abac_aspect_t *role, FILE*);
-
-extern int abac_id_load_privkey_chunk(abac_id_t *ptr, chunk_t keychunk);
-
+static int hack=1;
+
+/* need to add locks onto theseXXX */
+/* hash table base on sha with a p */
 struct _abac_id_credential_t {
-    char *hashkeyid; 
+    char *hashkeyid;
     abac_id_t *id;
-    char *pl_clause;
-
     UT_hash_handle hh;
 };
-/* hash table base on sha with a p */
-abac_id_credential_t *id_creds = NULL;
-/* linked list of all the ids's hashkeyid */
-abac_list_t *id_hashkeyid_list = NULL;
 
 /* can store either role or oset */
@@ -60,14 +38,271 @@
     char *hashkeyid;
     abac_attribute_t *attr;
-    abac_list_t *pl_clauses;
-
     UT_hash_handle hh;
 };
+
+typedef struct _abac_verifier_session_t {
+    abac_list_t *contexts;
+    char *stub; /* namespace stub */
+
+    abac_id_credential_t *id_creds;
+/* linked list of all the ids's hashkeyid */
+    abac_list_t *id_hashkeyid_list;
+
 /* hash table base on encoded attr rule */
-abac_credential_t *attr_creds = NULL;
-/* linked list of all the attr's hashkeyid */
-abac_list_t *attr_hashkeyid_list = NULL;
-
-/*****************************************************************************/
+/* can store either role or oset */
+    abac_credential_t *attr_creds;
+    abac_list_t *attr_hashkeyid_list;
+
+} abac_verifier_session_t;
+
+
+/* **GLOBAL** the one and only */
+abac_verifier_session_t *abac_session=NULL;
+
+/* local */
+abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr);
+char *abac_idtype_string(int i);
+/****************************************************************/
+void show_debug_info(const char *msg)
+{
+    int ctxt_sz=0;
+    int id_sz=0;
+    int attr_sz=0;
+    if(abac_session !=NULL) {
+        ctxt_sz=abac_list_size(abac_session->contexts);
+        id_sz=abac_list_size(abac_session->id_hashkeyid_list);
+        attr_sz=abac_list_size(abac_session->attr_hashkeyid_list);
+    }
+    fprintf(stderr,"/* ===== %s ======== */\n",msg);
+    fprintf(stderr,"  number of contexts: %d\n",ctxt_sz);
+    fprintf(stderr,"  number of principals: %d\n",id_sz);
+    fprintf(stderr,"  number of attributes: %d\n",attr_sz);
+    
+}
+
+static void _check_id_cred(abac_id_credential_t *id_cred)
+{
+    if(id_cred) {
+        printf("checking on this id_cred location %d\n", (int)id_cred);
+        printf("  --> sha is (%s)\n", abac_id_keyid(id_cred->id));
+        printf("  --> cn is (%s)\n", abac_id_cn(id_cred->id));
+    }
+}
+
+/* retrieve the cn that is associated with this sha_string, checking
+   with just the master list */
+char *abac_cn_with_sha(char *sha_string)
+{
+   // get the issuer based on keyid
+    abac_id_credential_t *id_cred;
+    HASH_FIND_STR(abac_session->id_creds, sha_string, id_cred);
+    if (id_cred == NULL) {
+        return NULL;
+    }
+    if(debug)
+        _check_id_cred(id_cred);
+    return abac_id_cn(id_cred->id);
+}
+
+char *abac_idtype_with_sha(char* sha_string)
+{
+    // get the issuer based on keyid
+    abac_id_credential_t *id_cred;
+    HASH_FIND_STR(abac_session->id_creds, sha_string, id_cred);
+    if (id_cred == NULL) {
+        // this id, sha string is not in the db...
+        DEBUG_PRINTF("abac_idtype_with_sha: this id is not in the id_creds list\n");
+        return NULL;
+    }
+    int idtype=abac_id_idtype(id_cred->id);
+    return abac_idtype_string(idtype);
+}
+
+/****************************************************************/
+/**
+ * abac_credential_t                                
+**/
+abac_id_credential_t *abac_id_credential_new(abac_id_t *a_id)
+{
+    char *keyid=abac_id_keyid(a_id);
+
+    abac_id_credential_t *id_cred = abac_xmalloc(sizeof(abac_id_credential_t));
+    id_cred->hashkeyid = abac_xstrdup(keyid);
+    id_cred->id=abac_id_dup(a_id);
+    return id_cred;
+}
+
+abac_id_credential_t *abac_id_credential_dup(abac_id_credential_t *ptr)
+{
+    assert(ptr != NULL);
+    DEBUG_PRINTF("calling abac_id_credential_dup, increment id ref count\n");
+    abac_id_dup(ptr->id);
+    return ptr;
+}
+
+abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr)
+{
+    assert(ptr);
+    return ptr->id;
+}
+
+char *abac_id_credential_hashkey(abac_id_credential_t *ptr)
+{
+    assert(ptr);
+    return ptr->hashkeyid;
+}
+
+/* XXX needs to lock this !! */
+void abac_add_id_cred(abac_id_credential_t *id_cred)
+{
+    HASH_ADD_KEYPTR(hh, abac_session->id_creds, id_cred->hashkeyid,
+                                     strlen(id_cred->hashkeyid), id_cred);
+    abac_list_add(abac_session->id_hashkeyid_list,
+                                        abac_xstrdup(id_cred->hashkeyid));
+
+    DEBUG_PRINTF("-->adding into master id_creds, key(%s)..idx(%d)sz(%d)\n",
+       id_cred->hashkeyid, HASH_COUNT(abac_session->id_creds),
+       abac_list_size(abac_session->id_hashkeyid_list));
+}
+
+abac_id_credential_t *abac_check_id_cred(char *keyid)
+{
+    abac_id_credential_t *id_cred=NULL;
+    HASH_FIND_STR(abac_session->id_creds, keyid, id_cred);
+    return id_cred;
+}
+
+void abac_id_credential_free(abac_id_credential_t *ptr)
+{
+    char *keyid=ptr->hashkeyid;
+    int found=0;
+
+    DEBUG_PRINTF("abac_id_credential_free: keyid(%s)\n", keyid);
+
+    char *cur=NULL;
+    abac_list_foreach(abac_session->id_hashkeyid_list, cur,
+        if(strcmp(cur,keyid)==0) {
+            found=1;
+            break;
+        }
+    );
+    assert(found==1); // big panic
+
+    // this is very tricky...
+    int last=abac_id_lastone(ptr->id);
+    if(!last) {
+        abac_id_free(ptr->id);
+        } else {
+            DEBUG_PRINTF("abac_id_credential_free: deleting id (%s)(%s)\n",abac_id_name(ptr->id), cur);
+            abac_list_remove(abac_session->id_hashkeyid_list, cur);
+            free(cur);
+
+            free(ptr->hashkeyid);
+            abac_id_free(ptr->id);
+            HASH_DEL(abac_session->id_creds, ptr);
+            free(ptr);
+    }
+}
+
+/****************************************************************/
+/**
+ * abac_credential_t                                
+**/
+
+abac_credential_t *abac_credential_new(abac_attribute_t *attr, char* key)
+{
+    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
+    cred->hashkeyid=abac_xstrdup(key);
+    cred->attr=abac_attribute_dup(attr);
+    return cred;
+}
+
+abac_attribute_t *abac_credential_attribute(abac_credential_t *ptr)
+{
+    assert(ptr!=NULL);
+    return ptr->attr;
+}
+
+abac_credential_t *abac_credential_dup(abac_credential_t *ptr)
+{
+    assert(ptr != NULL);
+    abac_attribute_dup(ptr->attr);
+    return ptr;
+}
+
+void abac_add_cred(abac_credential_t *cred)
+{
+    HASH_ADD_KEYPTR(hh, abac_session->attr_creds, cred->hashkeyid,
+                                         strlen(cred->hashkeyid), cred);
+    abac_list_add(abac_session->attr_hashkeyid_list,
+                                     abac_xstrdup(cred->hashkeyid));
+
+    DEBUG_PRINTF("-->adding into master attr_creds, key(%s)..idx(%d)sz(%d)\n",
+          abac_decode_string(cred->hashkeyid), HASH_COUNT(abac_session->attr_creds),
+          abac_list_size(abac_session->attr_hashkeyid_list));
+}
+
+
+abac_aspect_t *abac_credential_head(abac_credential_t *cred)
+{
+    return abac_attribute_head(cred->attr);
+}
+
+abac_aspect_t *abac_credential_tail(abac_credential_t *cred) 
+{
+    return abac_attribute_tail(cred->attr);
+}
+
+char *abac_credential_hashkey(abac_credential_t *ptr)
+{
+    assert(ptr);
+    return ptr->hashkeyid;
+}
+
+abac_credential_t *abac_check_cred(char *keyid)
+{
+    abac_credential_t *cred=NULL;
+    HASH_FIND_STR(abac_session->attr_creds, keyid, cred);
+    return cred;
+}
+
+/**
+ * Decrease the reference count of a credential, freeing it when it reaches 0.
+ */
+void abac_credential_free(abac_credential_t *ptr)
+{
+    /* first make sure it is there */
+    char *keyid=ptr->hashkeyid;
+    int found=0;
+
+    DEBUG_PRINTF("abac_credential_free: keyid(%s)\n", keyid);
+
+    char *cur;
+    abac_list_foreach(abac_session->attr_hashkeyid_list, cur,
+        if(strcmp(cur,keyid)==0) {
+            found=1;
+            break;
+        }
+    );
+    assert(found==1); // big panic
+
+    // this is very tricky...
+    int last=abac_attribute_lastone(ptr->attr);
+    if(!last) {
+        abac_attribute_free(ptr->attr);
+        } else {
+
+            abac_list_remove(abac_session->attr_hashkeyid_list, cur);
+            free(cur);
+
+            DEBUG_PRINTF("abac_credential_free: real free for (%d)\n",(int) ptr);
+            free(ptr->hashkeyid);
+            abac_attribute_free(ptr->attr);
+            HASH_DEL(abac_session->attr_creds, ptr);
+            free(ptr);
+    }
+}
+
+/****************************************************************/
 void abac_print_cred_info(abac_credential_t *cred, FILE *fp)
 {
@@ -79,29 +314,9 @@
     abac_aspect_t *tail=abac_attribute_tail(ptr);
 
-    if(debug) {
-        fprintf(fp,"---> printing out credential info cred(%d)..\n", (int) cred);
-        if(head) {
-            abac_print_aspect_string_with_condition(head,fp);
-        }
-        if(tail) {
-            abac_print_aspect_string_with_condition(tail,fp);
-        }
-
-        abac_list_t *clauses=cred->pl_clauses;
-        if (clauses != NULL) {
-            char *cur=NULL;
-            abac_list_foreach(clauses, cur,
-                fprintf(fp,"\n  a clause(%d):\n",(int)cur);
-                if(cur)
-                    fprintf(fp,"strlen(%d)loc(%d)(%s)\n", strlen(cur),(int)cur, cur);
-            );
-        }
-        } else {
-            fprintf(fp," ");
-            abac_print_aspect_string_with_condition(head,fp);
-            fprintf(fp," <- ");
-            abac_print_aspect_string_with_condition(tail,fp);
-            fprintf(fp,"\n");
-   }
+    fprintf(fp," ");
+    abac_print_aspect_string_with_condition(head,fp);
+    fprintf(fp," <- ");
+    abac_print_aspect_string_with_condition(tail,fp);
+    fprintf(fp,"\n");
 }
 
@@ -109,300 +324,72 @@
 {
     if(fp == NULL)
-        return;
+        fp=stdout;
 
     abac_id_t *ptr=abac_id_credential_id(prin);
-
-    if(debug) fprintf(fp,"---> printing out principal info ..\n");
     if(abac_id_has_privkey(ptr))
-        fprintf(fp," (%s,%s,y)\n",abac_id_name(ptr),abac_id_idtype_string(ptr));
+        fprintf(fp," [%s,%s] #y\n",abac_id_idtype_string(ptr), abac_id_name(ptr));
         else
-            fprintf(fp," (%s,%s,n)\n",abac_id_name(ptr),abac_id_idtype_string(ptr));
-}
-
-// 
-int abac_verify_idtype_type(char *type) {
-    int i;
-
-    if (type == NULL)
-        return 0;
-
-    for (i = 1; i <= _idtypename_cnt ; i++)
-        if(strcmp(type,_idtypename[i])==0)
-            return i;
-    return 0;
-}
-
-char *abac_idtype_string(int i)
-{
-    if(i > _idtypename_cnt) {
-        printf("bad idtypename idx %d\n", i);
-        panic("abac_idtype_string: went out of range on idtypename");
-    }
-    return (char*) _idtypename[i];
-}
-
-// convert a chunk to a lowercase binary string
-// malloc's the string
-static char *_chunk_to_string(chunk_t chunk) {
-    int i;
-
-    char *ret = abac_xmalloc(chunk.len * 2 + 1);
-
-    for (i = 0; i < chunk.len; ++i)
-        sprintf(ret + 2 * i, "%02x", chunk.ptr[i]);
-
-    return ret;
-}
-
-// verify that cert was issued by issuer
-// cert and issuer can be the same, in which case the self-sig is validated
-int verify_signature(certificate_t *issuer_cert, certificate_t *cert) {
-/** XXX for 5.0.1 
-    if (cert->issued_by(cert, issuer_cert, NULL))
-*/
-    if (cert->issued_by(cert, issuer_cert))
-        if (cert->get_validity(cert, NULL, NULL, NULL))
-            return 1;
-    return 0;
-}
-
-// verify that cert is still valid
-static int _verify_validity(certificate_t *cert) {
-    if (cert->get_validity(cert, NULL, NULL, NULL))
-        return 1;
-    return 0;
-}
-
-/**
- * Init the verifier subsystem.
- */
-void abac_verifier_init(void) {
-    // silence all debugging
-
-    if(debug)fprintf(stderr, "abac_verifier_init... init strongswan..\n");
-    if (!library_init(NULL))
-        exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
-
-    if (!lib->plugins->load(lib->plugins, NULL,
-            lib->settings->get_str(lib->settings, "pki.load", PLUGINS)))
-        exit(SS_RC_INITIALIZATION_FAILED);
-
-    attr_hashkeyid_list = abac_list_new();
-    id_hashkeyid_list = abac_list_new();
-}
-
-/**
- * Uninitialize the system, free up any allocated memory.
- */
-void abac_verifier_deinit(void) {
-    if(debug)fprintf(stderr, "abac_verifier_deinit... being called..\n");
-
-    abac_id_credential_t *ptr;
-    while ((ptr = id_creds) != NULL) {
-        if(debug) fprintf(stderr, "abac_verifier_deinit: deleting id (%s)\n",abac_id_name(ptr->id));
-        HASH_DEL(id_creds, ptr);
-
-        free(ptr->hashkeyid); 
-        free(ptr->pl_clause);
-        abac_id_free(ptr->id); 
-        free(ptr);
-    }
-
-    abac_credential_t *ptr2;
-    while ((ptr2 = attr_creds) != NULL) {
-        HASH_DEL(attr_creds, ptr2);
-        if(debug) {
-           fprintf(stderr, "abac_verifier_deinit: deleting attr hashkey(%s)\n",ptr2->hashkeyid); 
-        }
-        free(ptr2->hashkeyid);
-        abac_attribute_free(ptr2->attr);
-        char *cur=NULL;
-        abac_list_foreach(ptr2->pl_clauses, cur,
-              free(cur);
-        );
-        free(ptr2->pl_clauses);
-        free(ptr2);
-    }
-
-    if(attr_hashkeyid_list) { 
-        if(debug) fprintf(stderr, "looking to free attr_hashkeyid_list..\n");
-        char *cur;
-        abac_list_foreach(attr_hashkeyid_list, cur,
-            if(cur) free(cur);
-        );
-        abac_list_free(attr_hashkeyid_list);
-    }
-
-    if(id_hashkeyid_list) { 
-        if(debug) fprintf(stderr, "looking to free id_hashkeyid_list..\n");
-        char *cur;
-        abac_list_foreach(id_hashkeyid_list, cur,
-            if(cur) {
-               if(debug) fprintf(stderr, "hum.. id hashkey being freed.. %s\n", cur); 
-               free(cur);
-            }
-        );
-        abac_list_free(id_hashkeyid_list);
-    }
-
-    if(debug) fprintf(stderr, "now it is time to deinit strongswan lib..\n");
-    library_deinit();
-}
-
-abac_id_credential_t *abac_verifier_add_id_credential(abac_id_t *a_id)
-{ 
+            fprintf(fp," [%s,%s] #n\n", abac_id_idtype_string(ptr), abac_id_name(ptr));
+}
+
+void abac_print_typed_cred_info(abac_credential_t *cred, FILE *fp)
+{
+    if(fp == NULL)
+        fp=stdout;
+
+    abac_attribute_t *ptr=cred->attr;
+    abac_aspect_t *head=abac_attribute_head(ptr);
+    abac_aspect_t *tail=abac_attribute_tail(ptr);
+
+    fprintf(fp," ");
+    abac_print_aspect_typed_string_with_condition(head,fp);
+    fprintf(fp," <- ");
+    abac_print_aspect_typed_string_with_condition(tail,fp);
+    fprintf(fp,"\n");
+}
+
+
+/* not duplicated */
+abac_credential_t *abac_credential_lookup(char* cred_string)
+{
+    assert(cred_string);
+    DEBUG_PRINTF("abac_credential_lookup: looking for (%s)\n", cred_string);
+    abac_credential_t *attr_cred;
+    HASH_FIND_STR(abac_session->attr_creds, cred_string, attr_cred);
+    if (attr_cred == NULL) {
+        DEBUG_PRINTF("abac_credential_lookup:NOT FOUND..\n");
+        return NULL;
+    }
+    DEBUG_PRINTF("abac_credential_lookup:FOUND, looking for (%s)\n", cred_string);
+    abac_credential_t *rt=attr_cred;
+    return rt;
+}
+
+/* not duplicated */
+abac_id_credential_t *abac_id_credential_lookup(char* name)
+{
+    assert(name);
+    DEBUG_PRINTF("abac_id_credential_lookup: looking for (%s)\n", name);
     abac_id_credential_t *id_cred;
-    char *cn=abac_id_cn(a_id);
-    char *keyid=abac_id_keyid(a_id);
-
-    if(debug) {
-         fprintf(stderr, "abac_verifier_add_id_credential, cn(%s),keyid(%s)\n",
-                cn, keyid);
-    }
-
-    // add the abac_id to the map of id credentials
-    id_cred = abac_xmalloc(sizeof(abac_id_credential_t));
-    id_cred->hashkeyid = abac_xstrdup(keyid);
-    id_cred->id=abac_id_dup(a_id);
-
-    /* special handling here */
-    if(USE("ABAC_CN")) {
-        id_cred->pl_clause = generate_pl_type_clause(cn, abac_id_idtype(a_id));
-        } else {
-           id_cred->pl_clause=generate_pl_type_clause(prologIt(keyid), abac_id_idtype(a_id));
-    }
-    HASH_ADD_KEYPTR(hh, id_creds, id_cred->hashkeyid, strlen(id_cred->hashkeyid), id_cred);
-    if(debug)
-        fprintf(stderr, "-->adding into id_creds, (%s)..cnt(%d)(%d)\n",
-                                   id_cred->hashkeyid, HASH_COUNT(id_creds),(int)id_cred);
-
-    assert(id_hashkeyid_list);
-    abac_list_add(id_hashkeyid_list, abac_xstrdup(id_cred->hashkeyid));
+    HASH_FIND_STR(abac_session->id_creds, name, id_cred);
+    if (id_cred == NULL) {
+        DEBUG_PRINTF("abac_id_credential_lookup:NOT FOUND..\n");
+        return NULL;
+    }
+    DEBUG_PRINTF("  --> sha is (%s)\n", abac_id_keyid(id_cred->id));
+    DEBUG_PRINTF("  --> cn is (%s)\n", abac_id_cn(id_cred->id));
     return id_cred;
 }
 
-/* have to find the last cn 
-   CN=test/emailAddress=abac.isi.edu, CN=12345678
-   CN=client
-   ..CN=255a03f3-ed30/emailAddress=..
-*/
-static char* _extract_cn(char *string)
-{
-  /* find the first CN= */
-  char *ptr=strstr(string,"CN=");
-  if(ptr == NULL) return NULL;
-
-  /* look for last CN= */
-  while(1) {
-     char *tptr=ptr+3;
-     char *p=strstr(tptr,"CN=");
-     if(p) ptr=p;
-         else break;
-  }
-
-  /* remove the possible additional stuff */
-  char *cn=abac_xstrdup(ptr); /* it would get write over */
-  char *nptr=strtok(cn,"/");
-  char *pcn=abac_xmalloc(sizeof(char) * strlen(nptr));
-  pcn[0]='p';
-  /* special case.. replace empty space with _ */
-  int i=strlen(nptr);
-  while(i--) 
-     if(nptr[i]==' ') nptr[i]='_';
-  sscanf(nptr,"CN=%s", &pcn[1]);
-  free(cn);
-  return pcn;
-}
-
-/**
- * Load an ID 
- */
-static int _load_id(abac_id_t **a_id,certificate_t *cert, abac_id_credential_t **id_cred_ret) {
-    abac_id_credential_t *id_cred = NULL;
-    char *keyid = NULL;
-    chunk_t id;
-    int ret;
-    x509_t *x509 = (x509_t *)cert;
-
-    assert(cert != NULL);
-
-    // get the key ID, add p to keyid SHA here */
-    id = x509->get_subjectKeyIdentifier(x509);
-    keyid = _chunk_to_string(id);
-
-    /* Mike said this is the way it is */
-    char *str=NULL;
-    int rv = asprintf(&str, "%Y", cert->get_issuer(cert));
-
-    /* add p to cn name here, if there is no useable one
-       reuse keyid */
-    char *cn=_extract_cn(str);
-    if(cn == NULL) {
-        if(debug)
-            fprintf(stderr, "DEBUG:did not find usable cn, reuse keyid\n");
-        cn=abac_xstrdup(keyid);
-    }
-
-    if(debug) {
-        fprintf(stderr, "DEBUG:keyid %s \n", keyid);
-        fprintf(stderr, "DEBUG:issuer '%s' \n", str);
-        fprintf(stderr, "DEBUG:cn %s \n", cn);
-    }
-    free(str);
-
-    // if we already have this cert 'error' with success
-    HASH_FIND_STR(id_creds, keyid, id_cred);
-    if (id_cred != NULL) {
-        if(debug) fprintf(stderr, "existing cert \n");
-        ret = ABAC_CERT_EXISTS;
-        goto error;
-    }
-
-    // validate validity
-    ret = _verify_validity(cert);
-    if (!ret) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    // validate sig
-    ret = verify_signature(cert, cert);
-    if (!ret) {
-        /* well.. this is not a self signed cert, don't fault it anymore */
-        if(debug) fprintf(stderr, "This is not a self-signed cert \n");
-        } else {
-            if(debug) fprintf(stderr, "This is a self-signed cert \n");
-    }
-
-    // success, add a new abac_id
-    if(*a_id==NULL) {
-        *a_id=abac_id_keyid_new(keyid,cn,cert);
-    }
-
-    abac_id_credential_t *n_id_cred=abac_verifier_add_id_credential(*a_id);
-    *id_cred_ret=n_id_cred;
-
-    if (keyid != NULL) free(keyid);
-    if (cn != NULL) free(cn);
-
-    return ABAC_CERT_SUCCESS;
-
-error:
-    if (keyid != NULL) free(keyid);
-    if (cn != NULL) free(cn);
-
-    return ret;
-}
-
-/* collect all the creds stored so far */
-abac_stack_t *abac_verifier_dump_creds()
+/* collect all the creds stored so far for the session */
+abac_stack_t *abac_dump_creds()
 {
     abac_stack_t *cred_list = abac_stack_new();
 
     int cnt=0;
-    if(attr_hashkeyid_list) {
+    if(abac_session->attr_hashkeyid_list) {
         char *keyid;
         abac_credential_t *cred;
-        abac_list_foreach(attr_hashkeyid_list, keyid,
+        abac_list_foreach(abac_session->attr_hashkeyid_list, keyid,
             cred=abac_credential_lookup(keyid);
             abac_stack_push(cred_list, cred);
@@ -410,18 +397,19 @@
         );
     }
-    if(debug) fprintf(stderr, "abac_verifier_dump_cred: %d\n",cnt);
+    DEBUG_PRINTF("abac_dump_cred: %d\n",cnt);
     return cred_list;
 }
 
-/* collect all the id stored so far */
-abac_stack_t *abac_verifier_dump_principals()
+
+/* collect all the id creds stored so far for the session */
+abac_stack_t *abac_dump_principals()
 {
     abac_stack_t *id_list = abac_stack_new();
 
     int cnt=0;
-    if(id_hashkeyid_list) {
+    if(abac_session->id_hashkeyid_list) {
         char *keyid;
         abac_id_credential_t *id;
-        abac_list_foreach(id_hashkeyid_list, keyid,
+        abac_list_foreach(abac_session->id_hashkeyid_list, keyid,
             id=abac_id_credential_lookup(keyid);
             abac_stack_push(id_list, id);
@@ -429,679 +417,6 @@
         );
     }
-    if(debug) fprintf(stderr, "abac_verifier_dump_principals: %d\n",cnt);
+    DEBUG_PRINTF("abac_dump_principals: %d\n",cnt);
     return id_list;
-}
-
-
-static void check_id_cred(abac_id_credential_t *id_cred)
-{
-    if(id_cred) {
-        printf("checking on this id_cred location %d\n", (int)id_cred);
-        printf("  --> sha is (%s)\n", abac_id_keyid(id_cred->id));
-        printf("  --> cn is (%s)\n", abac_id_cn(id_cred->id));
-    }
-}
-
-/**
- * Load an attribute cert as string.
- * have minimum syntax & validity check
- */
-static int _load_attribute_string(char* attr_string) {
-    printf("NOT implemented yet!!!");
-    return ABAC_CERT_INVALID;
-}
-
-/**
- * Load an ID cert from a file.
- */
-int abac_verifier_load_id_file_key_file(char *filename, char *keyfilename,
-abac_id_credential_t **id_cred_ret)
-{
-    abac_id_t *id=NULL;
-    if (lib == NULL)
-        errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
-
-    if(debug) fprintf(stderr, "loading id file... %s\n", filename);
-
-    // load the cert, with public key
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_FROM_FILE, filename,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-
-    int rc=_load_id(&id,cert,id_cred_ret);
-    if(rc==ABAC_CERT_EXISTS) {
-        if(debug) fprintf(stderr, "abac_verifier_load_id_files: id already exists\n");
-        return ABAC_CERT_SUCCESS;
-    } 
-
-    /* try to load the private key if it is there */
-    if((rc==ABAC_CERT_SUCCESS) && keyfilename!=NULL && file_exist(keyfilename)) {
-        if(debug) fprintf(stderr, "loading... %s\n", keyfilename);
-        int keyrc=abac_id_load_privkey_file(id, keyfilename);
-        if(debug) {
-           if(keyrc == 1) fprintf(stderr, "..load_id_file: load(%s) with a private key\n",filename);
-               else printf("..load_id_file: load(%s) without a private key\n",filename);
-        }
-    }
-    return ABAC_CERT_SUCCESS;
-}
-
-int abac_verifier_load_enc_id_file_key_file(char *filename, char *keyfilename,
-char *pfile, abac_id_credential_t **id_cred_ret)
-{
-    abac_id_t *id=NULL;
-    if (lib == NULL)
-        errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
-
-    if(debug) fprintf(stderr, "loading id file... %s\n", filename);
-
-    // load the cert, with public key
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_FROM_FILE, filename,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-
-    int rc=_load_id(&id,cert,id_cred_ret);
-    if(rc==ABAC_CERT_EXISTS) {
-        if(debug) fprintf(stderr, "abac_verifier_load_id_files: id already exists\n");
-        return ABAC_CERT_SUCCESS;
-    } 
-
-    /* try to load the private key if it is there */
-    if((rc==ABAC_CERT_SUCCESS) && keyfilename!=NULL && file_exist(keyfilename)) {
-        if(debug) fprintf(stderr, "loading... %s\n", keyfilename);
-        int keyrc=abac_id_load_enc_privkey_file(id, keyfilename, pfile);
-        if(debug) {
-           if(keyrc == 1) fprintf(stderr, "..load_id_file: load(%s) with a private key\n",filename);
-               else printf("..load_id_file: load(%s) without a private key\n",filename);
-        }
-    }
-    return ABAC_CERT_SUCCESS;
-}
-
-/**
- * Load an ID cert from a abac_id_t 
- */
-int abac_verifier_load_id_id(abac_id_t *id, abac_id_credential_t **id_cred_ret) {
-    certificate_t *cert = abac_id_cert(id);
-    return _load_id(&id,cert,id_cred_ret);
-}
-
-/**
- * Load an ID cert from a chunk.
- */
-int abac_verifier_load_id_pem_chunk(chunk_t chunk, abac_id_credential_t **id_cred_ret) {
-    abac_id_t *id=NULL;
-    // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_PEM, chunk,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-    return _load_id(&id, cert,id_cred_ret);
-}
-/**
- * Load an ID cert from a chunk, Note, this only loads the id cert part
- * and so it is not suitable for creating an attribute credential with. 
- * Only a complete id cert + privkey could create attribute credential.
- */
-int abac_verifier_load_id_chunk(chunk_t chunk, abac_id_credential_t **id_cred_ret) {
-    abac_id_t *id=NULL;
-    // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-    return _load_id(&id, cert,id_cred_ret);
-}
-
-/**
- * Load an ID cert from a cert chunk and a privkey chunk,
- * this complete id cert + privkey could create attribute credential.
- */
-int abac_verifier_load_id_privkey_chunk(chunk_t chunk, chunk_t privkey_chunk,
-abac_id_credential_t **id_cred_ret) {
-
-    abac_id_t *id=NULL;
-    // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-
-    int rc=_load_id(&id, cert,id_cred_ret);
-    if(rc == ABAC_CERT_SUCCESS) {
-        rc=abac_id_load_privkey_chunk(id, privkey_chunk);
-    }
-
-    return rc;
-}
-
-int abac_verifier_load_id_enc_privkey_chunk(chunk_t chunk, chunk_t privkey_chunk,
-char* pfile, abac_id_credential_t **id_cred_ret) {
-
-    abac_id_t *id=NULL;
-    // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-
-    int rc=_load_id(&id, cert,id_cred_ret);
-    if(rc == ABAC_CERT_SUCCESS) {
-        rc=abac_id_load_enc_privkey_chunk(id, privkey_chunk, pfile);
-    }
-
-    return rc;
-}
-
-
-
-abac_id_t *abac_verifier_load_issuer(char *filename, char *keyfilename)
-{
-    abac_id_credential_t *id_cred=NULL;
-    int ret=abac_verifier_load_id_file_key_file(filename,keyfilename,&id_cred);
-    if(ret !=ABAC_CERT_SUCCESS)
-        return NULL;
-    abac_id_t *issuer=abac_id_credential_id(id_cred);
-    return issuer;
-}
-
-
-static int matchex(const char *subject, const char *pattern, int *so, int *eo)
-{
-int rc; // Returned code
-regmatch_t pmatch;
-
-regex_t re; // Compiled regexp pattern
-
-if (regcomp(&re, pattern, 0) != 0) return 0;
-
-rc = regexec(&re, subject, 1 , &pmatch, 0);
-regfree(&re); 
-
-if (rc == REG_NOMATCH ) return 0; 
-
-*so=pmatch.rm_so;
-*eo=pmatch.rm_eo;
-
-return 1;
-}
-
-
-
-static chunk_t _extract_chunk(char *data, char* startline, char* endline)
-{
-    int found=0;
-    int startos=0;
-    int endos=0;
-    regex_t re;
-    regmatch_t pm;
-    int rc;
-
-    int st;
-    int et;
-
-    rc=matchex(data, startline, &st, &et);
-    if(rc==0) return chunk_empty;
-    startos=st;
-
-    rc=matchex(data, endline, &st, &et);
-    if(rc==0) return chunk_empty;
-    endos=et;
-    
-    int len=endos - startos; 
-
-    if(debug) fprintf(stderr, "making a chunk of size (%d) from %d and %d\n",len, startos,endos);
-    char *ptr=strndup(data+startos,len);
-
-    chunk_t ret = { ptr, len };
-    return ret;
-}
-
-    
-int abac_verifier_load_idkey_file(char *filename, abac_id_credential_t **id_cred_ret)
-{
-    struct stat sb;
-    int fd;
-    int rc;
-
-    fd = open(filename, O_RDONLY);
-    if (fd == -1) { return 1; }
-    if(stat(filename, &sb) == -1) {
-        close(fd);
-        return 1;
-    }
-    char* data = (char *)mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-    if(data == MAP_FAILED) {
-        close(fd);
-        return 1;
-    }
-    close(fd);
-
-    chunk_t key_pem_chunk=_extract_chunk(data,
-               "-----BEGIN RSA PRIVATE KEY-----","-----END RSA PRIVATE KEY-----");
-    chunk_t cert_pem_chunk=_extract_chunk(data,
-                   "-----BEGIN CERTIFICATE-----","-----END CERTIFICATE-----");
-
-    /* key=0, cert=0 */
-    if(key_pem_chunk.len==0 && cert_pem_chunk.len==0) {
-        if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: no key or id in idkey_file\n");
-        goto error;
-    }
-
-    /* key=0, cert=1 */
-    if(key_pem_chunk.len==0) {
-        if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: no key in idkey_file\n");
-        munmap(data, sb.st_size);
-        chunk_free(&key_pem_chunk);
-        return abac_verifier_load_id_file_key_file(filename,NULL,id_cred_ret);
-    }
-
-    /* key=1, cert=1 */
-    if(cert_pem_chunk.len!=0) {
-        if(debug) {
-            fprintf(stderr, "loading cert pem chunk %d\n", cert_pem_chunk.len);
-            printf("(%s)\n",cert_pem_chunk.ptr);
-        }
-        rc=abac_verifier_load_id_pem_chunk(cert_pem_chunk, id_cred_ret);
-        if(rc != 0) {
-            if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: fail to load the id\n");
-            goto error;
-        }
-    /* key=1, cert=0 */
-        } else {
-            if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: there is no id info in there\n");
-            goto error;
-    }
-    
-    /* handle the key_pem_chunk */
-    if(debug)  {
-        fprintf(stderr, "loading key pem chunk %d\n", key_pem_chunk.len);
-        printf("(%s)\n",key_pem_chunk.ptr);
-    }
-    abac_id_t *id=abac_id_credential_id(*id_cred_ret);
-    rc=abac_id_load_privkey_chunk(id, key_pem_chunk);
-    if(rc==0) {
-        printf("abac_verifier_load_idkey_file:failed to load priv key!!!\n");
-        goto error;
-    }
-
-    munmap(data, sb.st_size);
-    return 0;
-
-error:
-    munmap(data, sb.st_size);
-    return 1;
-}
-
-
-int abac_verifier_load_enc_idkey_file(char *filename, char *pfile, 
-abac_id_credential_t **id_cred_ret)
-{
-    struct stat sb;
-    int fd;
-    int rc;
-
-    fd = open(filename, O_RDONLY);
-    if (fd == -1) { return 1; }
-    if(stat(filename, &sb) == -1) {
-        close(fd);
-        return 1;
-    }
-    char* data = (char *)mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-    if(data == MAP_FAILED) {
-        close(fd);
-        return 1;
-    }
-    close(fd);
-
-    chunk_t key_pem_chunk=_extract_chunk(data,
-               "-----BEGIN RSA PRIVATE KEY-----","-----END RSA PRIVATE KEY-----");
-    chunk_t cert_pem_chunk=_extract_chunk(data,
-                   "-----BEGIN CERTIFICATE-----","-----END CERTIFICATE-----");
-
-    /* key=0, cert=0 */
-    if(key_pem_chunk.len==0 && cert_pem_chunk.len==0) {
-        if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: no key or id in idkey_file\n");
-        goto error;
-    }
-
-    /* key=0, cert=1 */
-    if(key_pem_chunk.len==0) {
-        if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: no key in idkey_file\n");
-        munmap(data, sb.st_size);
-        chunk_free(&key_pem_chunk);
-        return abac_verifier_load_id_file_key_file(filename,NULL,id_cred_ret);
-    }
-
-    /* key=1, cert=1 */
-    if(cert_pem_chunk.len!=0) {
-        if(debug) {
-            fprintf(stderr, "loading cert pem chunk %d\n", cert_pem_chunk.len);
-            printf("(%s)\n",cert_pem_chunk.ptr);
-        }
-        rc=abac_verifier_load_id_pem_chunk(cert_pem_chunk, id_cred_ret);
-        if(rc != 0) {
-            if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: fail to load the id\n");
-            goto error;
-        }
-    /* key=1, cert=0 */
-        } else {
-            if(debug) fprintf(stderr, "abac_verifier_load_idkey_file: there is no id info in there\n");
-            goto error;
-    }
-    
-    /* handle the key_pem_chunk */
-    if(debug)  {
-        fprintf(stderr, "loading key pem chunk %d\n", key_pem_chunk.len);
-        printf("(%s)\n",key_pem_chunk.ptr);
-        printf("(%d)\n",strlen(key_pem_chunk.ptr));
-    }
-    abac_id_t *id=abac_id_credential_id(*id_cred_ret);
-    rc=abac_id_load_enc_privkey_chunk(id, key_pem_chunk, pfile);
-    if(rc==0) {
-        printf("abac_verifier_load_idkey_file:failed to load priv key!!!\n");
-        goto error;
-    }
-
-    munmap(data, sb.st_size);
-    return 0;
-
-error:
-    munmap(data, sb.st_size);
-    return 1;
-}
-
-void abac_print_clauses(abac_list_t *clauses, FILE *fp)
-{
-    if (clauses != NULL) {
-        char *cur;
-        printf("total-- %d clauses\n", abac_list_size(clauses));
-        abac_list_foreach(clauses, cur,
-            if(cur) {
-                if(fp)
-                    fprintf (fp,"a clause, %d(%s)\n", (int)cur,cur);
-                    else printf ("a clause, %d(%s)\n", (int)cur,cur);
-            }
-        );
-    }
-}
-
-abac_id_credential_t *abac_id_credential_dup(abac_id_credential_t *ptr) {
-    assert(ptr != NULL);
-    if(debug)
-       fprintf(stderr, "calling abac_id_credential_dup, increment id ref count\n");
-    abac_id_dup(ptr->id);
-    return ptr;
-}
-
-abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr)
-{
-    assert(ptr);
-    return ptr->id;
-}
-
-
-abac_id_credential_t *abac_id_credential_lookup(char *pname)
-{
-    abac_id_credential_t *id_cred=NULL;
-    HASH_FIND_STR(id_creds, pname, id_cred);
-    if(id_cred != NULL)
-        return abac_id_credential_dup(id_cred);
-    else return NULL;
-}
-
-void abac_id_credential_free(abac_id_credential_t *ptr)
-{
-    if (ptr == NULL)
-        return;
-
-    if(debug)
-        fprintf(stderr, "abac_id_credential_free:freeing (%s)\n", abac_id_name(ptr->id));
-
-    // this is very hacky...
-    int last=abac_id_lastone(ptr->id);
-    if(!last) {
-        if(debug) fprintf(stderr, "abac_id_credential_free:not last one\n");
-        abac_id_free(ptr->id);
-        } else {
-            if(debug) fprintf(stderr, "abac_id_credential_free: deleting id (%s)\n",abac_id_name(ptr->id));
-            free(ptr->hashkeyid);
-            if(ptr->pl_clause)
-                free(ptr->pl_clause);
-            abac_id_free(ptr->id);
-            HASH_DEL(id_creds, ptr);
-            free(ptr);
-    }
-}
-
-/****************************************************************************/
-
-static int _verify_valid_credential_string(certificate_t *cert,
-abac_credential_t **cred_ret, char *encoded_attr_string)
-{
-    abac_aspect_t *head_aspect = NULL;
-    abac_aspect_t *tail_aspect = NULL;
-    abac_list_t *clauses=NULL;
-    abac_id_credential_t *id_cred;
-    abac_id_t *issuer_id;
-    int ret, i;
-
-    // get the attr
-    head_aspect = abac_yy_get_rule_head_aspect();
-    tail_aspect = abac_yy_get_rule_tail_aspect();
-    clauses = abac_yy_get_rule_clauses();
-
-    // get the issuer based on keyid
-    char *principalname = abac_aspect_principal_principalname(head_aspect);
-    if(debug) fprintf(stderr, "LOOKING for %s\n", principalname);
-
-    HASH_FIND_STR(id_creds, principalname, id_cred);
-    if(id_cred == NULL) {
-        ret = ABAC_CERT_MISSING_ISSUER;
-        if(debug)
-             fprintf(stderr, "can not find %s in id_creds\n", principalname);
-        goto error;
-    }
-    issuer_id=id_cred->id;
-    if (issuer_id == NULL) {
-        ret = ABAC_CERT_MISSING_ISSUER;
-        if(debug)
-             fprintf(stderr, "can not find %s in id_creds\n", principalname);
-        goto error;
-    }
-
-    // make sure the issuer's signed it
-    ret = verify_signature(abac_id_cert(issuer_id), cert);
-    if (!ret) {
-        abac_yy_set_error_code(ABAC_RT_CERT_BAD_SIG);
-        ret=ABAC_CERT_BAD_SIG;
-        goto error;
-    }
-
-    // at this point we know we have a good attribute cert baked it in
-    abac_attribute_t *attr=abac_attribute_new(issuer_id, cert, cert->get_ref(cert));
-    abac_attribute_set_head(attr, head_aspect);
-    abac_attribute_add_tail(attr, tail_aspect);
-
-    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
-    cred->hashkeyid=abac_xstrdup(encoded_attr_string);
-    cred->attr=attr;
-    cred->pl_clauses = clauses;
-    *cred_ret = cred;
-
-    // success, add the key to the map of certificates
-    HASH_ADD_KEYPTR(hh, attr_creds, cred->hashkeyid, strlen(cred->hashkeyid), cred);
-
-    assert(attr_hashkeyid_list);
-    abac_list_add(attr_hashkeyid_list, abac_xstrdup(cred->hashkeyid));
-
-    if(debug)
-        fprintf(stderr, "-->adding into attr_creds 2, (%s)..cnt(%d)\n",
-                                   cred->hashkeyid, HASH_COUNT(attr_creds));
-
-    return ABAC_CERT_SUCCESS;
-
-error:
-    if (head_aspect) abac_aspect_free(head_aspect);
-    if (tail_aspect) abac_aspect_free(tail_aspect);
-    abac_yy_free_rule_clauses();
-
-    return ret;
-}
-
-/**
- * Load an attribute cert.
- * Returns true only if the certificate is valid and is issued by the proper
- * authority.
- * attribute string is parsed via yyparse call
- */
-static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
-    ietf_attributes_t *attr_cert = NULL;
-    int ret, i;
-
-    // get the attr
-    ac_t *ac = (ac_t *)cert;
-    attr_cert = ac->get_groups(ac);
-    if (attr_cert == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    char *encoded_attr_string=attr_cert->get_string(attr_cert);
-    char *attr_string = abac_decode_string(encoded_attr_string);
-    if(debug)
-         fprintf(stderr, "string to be yyparse..(%d)(%s)\n",strlen(attr_string),attr_string);
-
-    if (attr_string == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    /* call into yacc parser */
-    abac_reset_yyfptr(attr_string);
-    abac_yy_init();
-    int rc=yyparse();
-    if (rc) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    ret=_verify_valid_credential_string(cert,cred_ret,encoded_attr_string);
-
-    if(ret != ABAC_CERT_SUCCESS) {
-        char *tmp=NULL;
-        asprintf(&tmp,"_load_attribute_cert: fail to verify credential (%s)",attr_string);
-        panic(tmp);
-    }
-
-    // free up some crap
-    attr_cert->destroy(attr_cert);
-
-    return ret;
-
-error:
-    if (cert) cert->destroy(cert);
-    if (attr_cert) attr_cert->destroy(attr_cert);
-    return ret;
-}
-
-/**
- * Load an attribute cert from a abac_attribute_t.
- * attr should be all checked out before arriving here
- */
-int abac_verifier_load_attribute_cert_attribute(abac_attribute_t *ptr, abac_credential_t **cred_ret) {
-    // get the attr
-    abac_aspect_t *head=abac_attribute_head(ptr);
-    abac_aspect_t *tail=abac_attribute_tail(ptr);
-
-    // preprocess for constraint part
-    preprocess_pl_head(head);
-    preprocess_pl_tail(tail);
-
-/* setup the encoded attribute string */
-    char *encoded_attr_string=get_cred_encoding(ptr);
-    generate_pl_set_abac_yyfptr_encoded(encoded_attr_string);
-/* collect up type clauses, constraint clauses and
-   generate rule clauses */
-    abac_list_t *clauses=generate_pl_clauses(head,tail);
-
-    if(debug) abac_print_clauses(clauses,NULL);
-
-    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
-    cred->hashkeyid=abac_xstrdup(encoded_attr_string);
-    cred->attr=abac_attribute_dup(ptr);
-    cred->pl_clauses = clauses;
-    *cred_ret = cred;
-
-    // success, add the key to the map of certificates
-    HASH_ADD_KEYPTR(hh, attr_creds, cred->hashkeyid, strlen(cred->hashkeyid), cred);
-
-    assert(attr_hashkeyid_list);
-    abac_list_add(attr_hashkeyid_list, abac_xstrdup(cred->hashkeyid));
-
-    if(debug)
-        fprintf(stderr, "-->adding into attr_creds, (%s)..cnt(%d)\n",
-                                   cred->hashkeyid, HASH_COUNT(attr_creds));
-    return ABAC_CERT_SUCCESS;
-}
-
-/**
- * Load an attribute cert from a file.
- */
-int abac_verifier_load_attribute_cert_file(char *filename, abac_credential_t **cred) {
-    // load the cert
-    if(debug) fprintf(stderr, "..loading attr file %s\n", filename);
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_FROM_FILE, filename,
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-    return _load_attribute_cert(cert, cred);
-}
-
-/**
- * Load an attribute cert from a chunk.
- */
-int abac_verifier_load_attribute_cert_chunk(chunk_t chunk, abac_credential_t **cred) {
-    // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-
-    return _load_attribute_cert(cert, cred);
 }
 
@@ -1121,5 +436,6 @@
  * Return the encoding of the issuer cert.
  */
-abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred) {
+abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred)
+{
     certificate_t *issuer_cert=abac_attribute_issuer_cert(cred->attr);
     assert(issuer_cert);
@@ -1131,117 +447,180 @@
 }
 
-/**
- * Return the clause of the cert
+
+/****************************************************************/
+
+void abac_verifier_session_new() 
+{
+    assert(abac_session==NULL);
+    abac_session = abac_xmalloc(sizeof(abac_verifier_session_t));
+    abac_session->stub=abac_xstrdup("abac_");
+    abac_session->contexts=abac_list_new();
+
+    abac_session->attr_hashkeyid_list = abac_list_new();
+    abac_session->id_hashkeyid_list = abac_list_new();
+    abac_session->id_creds=NULL;
+    abac_session->attr_creds=NULL;
+ 
+    abac_pl_init();
+}
+
+void abac_verifier_session_free() 
+{
+    DEBUG_PRINTF("abac_verifier_session_free: freeing...\n");
+    if(abac_session->stub) free(abac_session->stub);
+
+    int size=abac_list_size(abac_session->contexts);
+    if(size) {
+        abac_context_t *cur;
+        abac_stack_t *tmp=abac_stack_new();
+        abac_list_foreach(abac_session->contexts, cur,
+            if(cur) abac_stack_push(tmp,cur);
+        );
+        while(size) {
+            cur=(abac_context_t *) abac_stack_pop(tmp);
+            abac_context_free(cur);
+            size--;
+        }
+        abac_stack_free(tmp);
+    }
+    abac_list_free(abac_session->contexts);
+
+    abac_id_credential_t *ptr;
+    int id_sz=abac_list_size(abac_session->id_hashkeyid_list);
+    DEBUG_PRINTF("abac_verifier_session_free: number of ids(%d)\n",id_sz);
+    while ((ptr = abac_session->id_creds) != NULL) {
+        DEBUG_PRINTF("abac_verifier_session_free: deleting id (%s)\n",abac_id_name(ptr->id));
+        HASH_DEL(abac_session->id_creds, ptr);
+        free(ptr->hashkeyid);
+        abac_id_free(ptr->id);
+        free(ptr);
+    }
+
+    abac_credential_t *ptr2;
+    int attr_sz=abac_list_size(abac_session->attr_hashkeyid_list);
+    DEBUG_PRINTF("abac_verifier_session_free: number of attrs(%d)\n",attr_sz);
+    while ((ptr2 = abac_session->attr_creds) != NULL) {
+        HASH_DEL(abac_session->attr_creds, ptr2);
+        DEBUG_PRINTF("abac_verifier_session_free: deleting attr hashkey(%s)\n",ptr2->hashkeyid);
+        free(ptr2->hashkeyid); 
+        abac_attribute_free(ptr2->attr); 
+        free(ptr2);
+    }
+
+    if(abac_session->attr_hashkeyid_list) {
+        DEBUG_PRINTF("looking to free attr_hashkeyid_list..\n");
+        char *cur;
+        abac_list_foreach(abac_session->attr_hashkeyid_list, cur,
+            if(cur) free(cur);
+        );
+        abac_list_free(abac_session->attr_hashkeyid_list);
+    }
+
+    if(abac_session->id_hashkeyid_list) {
+        DEBUG_PRINTF("looking to free id_hashkeyid_list..\n");
+        char *cur;
+        abac_list_foreach(abac_session->id_hashkeyid_list, cur,
+            if(cur) {
+               DEBUG_PRINTF("hum.. id hashkey being freed.. %s\n", cur);
+               free(cur);
+            }
+        );
+        abac_list_free(abac_session->id_hashkeyid_list);
+    }
+    free(abac_session);
+    abac_session=NULL;
+}
+
+/* long int random(void); */
+char *abac_verifier_session_next_namespace()
+{
+    char *tmp=NULL;
+    asprintf(&tmp,"%s_%ld",abac_session->stub,random());
+    return tmp;
+}
+
+void abac_verifier_session_add_context(abac_context_t *ctx)
+{
+    abac_list_add(abac_session->contexts, ctx);
+}
+
+void abac_verifier_session_dump()
+{
+     printf("....SESSION....\n");
+     int cnt=abac_list_size(abac_session->contexts);
+     abac_context_t *cur;
+     abac_list_foreach(abac_session->contexts, cur,
+        if(cur) abac_context_dump(cur);
+     );
+}
+
+int abac_verifier_session_remove_context(abac_context_t *ctx)
+{
+    int rc=abac_list_remove(abac_session->contexts, ctx);
+    if(rc!=1) {
+        DEBUG_PRINTF("abac_verifier_session_remove_context, ??? did not find context\n");
+        exit(ABAC_VERIFIER_UNKNOWN_CONTEXT);
+    }
+    return rc;
+}
+
+abac_context_t *abac_verifier_session_context_lookup(char *namespace)
+{
+    abac_context_t  *cur;
+    abac_list_foreach(abac_session->contexts, cur,
+           if(strcmp(abac_context_namespace(cur),namespace)==0)
+               return cur;
+    );
+    return NULL;
+}
+
+/****************************************************************/
+int abac_verify_idtype_type(char *type) {
+    if (type == NULL) return 0;
+    return abac_idtype_lookup(type);
+}
+
+// verify that cert was issued by issuer
+// cert and issuer can be the same, in which case the self-sig is validated
+int verify_signature(certificate_t *issuer_cert, certificate_t *cert)
+{
+/** XXX for strongswan 5.0.1 
+    if (cert->issued_by(cert, issuer_cert, NULL))
+*/
+    if (cert->issued_by(cert, issuer_cert))
+        if (cert->get_validity(cert, NULL, NULL, NULL)) {
+            return 1;
+        }
+    return 0;
+}
+
+/**
+ * Init the verifier subsystem.
  */
-abac_list_t *abac_credential_clauses(abac_credential_t *cred) {
-    return cred->pl_clauses;
-}
-
-abac_attribute_t *abac_credential_attribute(abac_credential_t *cred) {
-    assert(cred);
-    return cred->attr;
-}
-
-/**
- * Increase the ref count of a credential.
+void abac_verifier_init(void) {
+    // silence all debugging
+
+    DEBUG_PRINTF("abac_verifier_init... init strongswan..\n");
+    if (!library_init(NULL))
+        exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
+
+    if (!lib->plugins->load(lib->plugins, NULL,
+            lib->settings->get_str(lib->settings, "pki.load", PLUGINS)))
+        exit(SS_RC_INITIALIZATION_FAILED);
+
+    abac_verifier_session_new();
+}
+
+/**
+ * Uninitialize the system, free up any allocated memory.
  */
-abac_credential_t *abac_credential_dup(abac_credential_t *cred) {
-    assert(cred != NULL);
-
-    abac_attribute_dup(cred->attr);
-    return cred;
-}
-
-/**
- *  lookup for a credential.
- */
-abac_credential_t *abac_credential_lookup(char* cred_string)
-{
-    if(debug)
-        fprintf(stderr, "abac_credential_lookup: looking for (%s)\n", cred_string);
-    abac_credential_t *attr_cred;
-
-    HASH_FIND_STR(attr_creds, cred_string, attr_cred);
-    if (attr_cred == NULL) {
-        if(debug) fprintf(stderr, "DEBUG:NOT FOUND..\n");
-        return NULL;
-    }
-    abac_credential_t *rt=abac_credential_dup(attr_cred);
-    if(debug) fprintf(stderr, "DEBUG:FOUND.. (%d) returning, (%d)\n", (int)attr_cred, (int) rt);
-    return rt;
-}
-
-/**
- * Decrease the reference count of a credential, freeing it when it reaches 0.
- */
-void abac_credential_free(abac_credential_t *cred)
-{
-    if(debug)
-        fprintf(stderr, "abac_credential_free:freeing cred(%d)clause(%d)\n", (int)cred, (int)cred->pl_clauses);
-
-    if (cred == NULL)
-        return;
-
-    // this is very hacky...
-    int last=abac_attribute_lastone(cred->attr);
-    if(!last) {
-        abac_attribute_free(cred->attr);
-        } else {
-            if(debug) fprintf(stderr, "abac_credential_free: real free for (%d)\n",(int) cred);
-            free(cred->hashkeyid);
-            char *cur=NULL;
-            abac_list_foreach(cred->pl_clauses, cur,
-                free(cur);
-            );
-            abac_attribute_free(cred->attr);
-            HASH_DEL(attr_creds, cred);
-            free(cred);
-    }
-}
-
-char *abac_id_clause(abac_id_credential_t *id_cred)
-{
-    if(id_cred)
-        return id_cred->pl_clause;
-    return NULL;
-}
-
-/* retrieve the cn that is associated with this sha_string */
-char *abac_cn_with_sha(char *sha_string)
-{
-    // get the issuer based on keyid
-    abac_id_credential_t *id_cred;
-    HASH_FIND_STR(id_creds, sha_string, id_cred);
-    if (id_cred == NULL) {
-        return NULL;
-    }
-    if(debug)
-        check_id_cred(id_cred);
-    return abac_id_cn(id_cred->id);
-}
-
-char *abac_idtype_with_sha(char* sha_string)
-{ 
-    // get the issuer based on keyid
-    abac_id_credential_t *id_cred;
-    HASH_FIND_STR(id_creds, sha_string, id_cred);
-    if (id_cred == NULL) {
-        // this id, sha string is not in the db...
-        if(debug) 
-           fprintf(stderr,"abac_idtype_with_sha: this id is not in the id_creds list\n");
-        return NULL;
-    }
-    int idtype=abac_id_idtype(id_cred->id);
-    
-    return abac_idtype_string(idtype);
-}
-
-abac_aspect_t *abac_credential_head(abac_credential_t *cred) {
-    return abac_attribute_head(cred->attr); 
-}
-
-abac_aspect_t *abac_credential_tail(abac_credential_t *cred) {
-    return abac_attribute_tail(cred->attr); 
-}
-
-
+void abac_verifier_deinit(void) {
+    DEBUG_PRINTF("abac_verifier_deinit... being called..\n");
+    abac_verifier_session_free();
+/* XXX crashs in swig/python?java, it is as some threads before
+   getting into library deinit */
+    if(!hack) {
+        DEBUG_PRINTF("now it is time to deinit strongswan lib..\n");
+        library_deinit();
+    }
+}
Index: libabac/abac_verifier.h
===================================================================
--- libabac/abac_verifier.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/abac_verifier.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,23 +1,32 @@
-#ifndef __VERIFIER_H__
-#define __VERIFIER_H__
+#ifndef __ABAC_VERIFIER_H__
+#define __ABAC_VERIFIER_H__
 
-#include <chunk.h>
+#include "abac_defines.h"
 
-#include "abac_internal.h"
+/* exported */
+extern char *abac_cn_with_sha(char *);
+extern char *abac_idtype_with_sha(char*);
+extern char *abac_idtype_string(int); 
+extern int abac_verifier_session_remove_context(abac_context_t *);
+extern void abac_verifier_session_add_context(abac_context_t *);
+extern abac_id_credential_t *abac_id_credential_dup(abac_id_credential_t *);
+extern abac_id_credential_t *abac_id_credential_lookup(char *);
+extern char *abac_verifier_session_next_namespace();
+extern void abac_add_cred(abac_credential_t *cred);
+extern abac_id_credential_t *abac_check_id_cred(char *);
+extern abac_credential_t *abac_check_cred(char *);
+extern abac_id_credential_t *abac_id_credential_new(abac_id_t *a_id);
+extern abac_credential_t *abac_credential_lookup(char* cred_string);
+extern char *abac_credential_hashkey(abac_credential_t *ptr);
+extern char *abac_id_credential_hashkey(abac_id_credential_t *ptr);
+extern abac_credential_t *abac_credential_dup(abac_credential_t *ptr);
+extern abac_credential_t *abac_credential_new(abac_attribute_t *attr, char*);
+extern abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr);
+extern void abac_print_cred_info(abac_credential_t *cred, FILE *fp);
+extern void abac_print_typed_cred_info(abac_credential_t *cred, FILE *fp);
+extern abac_attribute_t *abac_credential_attribute(abac_credential_t *ptr);
+extern void abac_verifier_session_dump();
 
-#include "uthash.h"
 
-void abac_verifier_init(void);
-void abac_verifier_deinit(void);
 
-int abac_verifier_load_id_id(abac_id_t*, abac_id_credential_t **id_cert);
-int abac_verifier_load_id_file(char *filename, char*, abac_id_credential_t **id_cert);
-int abac_verifier_load_id_chunk(chunk_t chunk, abac_id_credential_t **id_cert);
-int abac_verifier_load_id_privkey_chunk(chunk_t chunk, chunk_t, abac_id_credential_t **id_cert);
-
-int abac_verifier_load_attribute_cert_attribute(abac_attribute_t *, abac_credential_t **cred);
-int abac_verifier_load_attribute_cert_file(char *filename, abac_credential_t **cred);
-int abac_verifier_load_attribute_cert_chunk(chunk_t chunk, abac_credential_t **cred);
-abac_id_credential_t *abac_id_credential_dup(abac_id_credential_t *ptr);
-
-#endif /* __VERIFIER_H__ */
+#endif /* __ABAC_VERIFIER_H__ */
Index: libabac/options.c
===================================================================
--- libabac/options.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/options.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,2 +1,5 @@
+/**
+** options.h
+**/
 
 #include <stdio.h>
@@ -6,4 +9,6 @@
 
 #include "options.h"
+
+/****************************************************************/
 
 static void _usage(char *name) {
Index: libabac/options.h
===================================================================
--- libabac/options.h	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/options.h	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,4 +1,4 @@
-#ifndef __OPTIONS_H__
-#define __OPTIONS_H__
+#ifndef __ABAC_OPTIONS_H__
+#define __ABAC_OPTIONS_H__
 
 #ifdef __cplusplus
@@ -23,3 +23,3 @@
 #endif
 
-#endif /* __OPTIONS_H__ */
+#endif /* __ABAC_OPTIONS_H__ */
Index: libabac/prover_yap.c
===================================================================
--- libabac/prover_yap.c	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/prover_yap.c	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -1,2 +1,6 @@
+/**
+** prover_yap.c
+** implement a C prover using the libabac C interface
+**/
 
 #include <err.h>
@@ -4,11 +8,6 @@
 #include <assert.h>
 
-
-#include "abac_internal.h"
-
+#include "abac.h"
 #include "options.h"
-
-extern void abac_print_cred_info(abac_credential_t*, FILE*);
-extern void abac_print_prin_info(abac_id_credential_t*, FILE*);
 
 int main(int argc, char **argv) {
@@ -33,5 +32,5 @@
                 abac_print_cred_info(cred,fp);
             }
-            abac_context_credentials_free(credentials);
+            abac_free_credentials(credentials);
         }
 
@@ -42,5 +41,5 @@
                 abac_print_prin_info(prin,fp);
             }
-            abac_context_principals_free(principals);
+            abac_free_principals(principals);
         }
         fclose(fp);
@@ -89,5 +88,5 @@
     }
     if(credentials)
-        abac_context_credentials_free(credentials);
+        abac_free_credentials(credentials);
 
 /** limit at most 2 more fact solution proof **/
@@ -107,5 +106,5 @@
             }
             if(credentials)
-                abac_context_credentials_free(credentials);
+                abac_free_credentials(credentials);
             n=n-1;
         }
Index: libabac/rt2.l
===================================================================
--- libabac/rt2.l	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/rt2.l	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -12,9 +12,11 @@
 #include <stdio.h>
 #include <string.h>
+/* lex generated one */
 #include "rt2.h"
+#include "abac_m64.h"
 
 static int debug=0;
 
-/* if using canned fixed test string */
+/* when using canned test string */
 char INPUT_LINE[] = "usc.playground <- usc.employee.friend";
 char *yyfptr = INPUT_LINE; /* assigned with default */
@@ -23,5 +25,4 @@
 /* with yacc */
 extern YYSTYPE yylval; 
-extern char* abac_encode_string(char *);
 
 #undef YY_INPUT
@@ -61,4 +62,8 @@
 principal    { if(debug) fprintf(yyout," PRINCIPAL ");
              return PRINCIPAL; }
+this         { if(debug) fprintf(yyout," THIS ");
+             return THIS; }
+This         { if(debug) fprintf(yyout," THIS ");
+             return THIS; }
 integer      { yylval.string=strdup(yytext);
              if(debug) fprintf(yyout," OTYPE(INTEGER) ");
@@ -184,23 +189,23 @@
 %%
 
-void abac_reset_yyfptr(char *str) {
+void abac_ll_reset_yyfptr(char *str) {
     yyfptr=str;
     yyfptr_encoded=abac_encode_string(str);
 }
 
-char* abac_get_yyfptr() {
+char* abac_ll_get_yyfptr() {
     return yyfptr;
 }
 
-char *abac_get_yyfptr_encoded() {
+char *abac_ll_get_yyfptr_encoded() {
     return yyfptr_encoded;
 }
 
 /* if using external file input, output */
-void abac_reset_yyin(FILE *new_yyin) {
+void abac_ll_reset_yyin(FILE *new_yyin) {
     yyin=new_yyin;
 }
 
-void abac_reset_yyout(FILE *new_yyout) {
+void abac_ll_reset_yyout(FILE *new_yyout) {
     if(yyout) {
       fflush(yyout);
@@ -210,19 +215,19 @@
 }
 
-void abac_flush_yyout() {
+void abac_ll_flush_yyout() {
     if(yyout)
       fflush(yyout);
 }
 
-FILE *abac_get_yyin() {
+FILE *abac_ll_get_yyin() {
     if(yyin) return yyin;
     else return stdin;
 }
-FILE *abac_get_yyout() {
+FILE *abac_ll_get_yyout() {
     if(yyout) return yyout;
     else return stdout;
 }
 
-void abac_push_keyid_yystate()
+void abac_ll_push_keyid_yystate()
 {
     if(debug) fprintf(yyout, "\n push keyid state\n");
@@ -230,5 +235,5 @@
 }
 
-void abac_push_range_yystate()
+void abac_ll_push_range_yystate()
 {
     if(debug) fprintf(yyout, "\n push range state\n");
@@ -236,5 +241,5 @@
 }
 
-void abac_push_yystate(char *str)
+void abac_ll_push_yystate(char *str)
 {
    if(strcmp(str,"boolean")==0) {
@@ -272,5 +277,5 @@
 }
 
-void abac_pop_yystate()
+void abac_ll_pop_yystate()
 {
    if(debug) fprintf(yyout, " pop a state\n");
Index: libabac/rt2.y
===================================================================
--- libabac/rt2.y	(revision 4f40c3e6cf53f7c95a2a544455682c85f601e846)
+++ libabac/rt2.y	(revision 2e9455f11fea0205b8b4b1306b5d0804cda72e10)
@@ -11,5 +11,6 @@
 
 #include "abac_pl_yy.h"
-#include "abac_list.h"
+#include "abac_verifier.h"
+#include "rt2.h"
 
 /* lex tie-ins flag */
@@ -19,7 +20,8 @@
 FILE *abac_yyout = NULL;
 char *abac_yyfptr = NULL;
-char *abac_yyfptr_encoded = NULL;
+void *abac_yyctxt=NULL;
 
 #define USE(evalue) ((getenv(evalue)!=NULL)?1:0)
+#define OUT(msg) { if(debug) fprintf(abac_yyout,"\n===%s\n",msg); }
 
 void panic(char *msg);
@@ -41,5 +43,5 @@
 %start input
 
-%type <lstruct> stmt
+%type <intval> stmt
 %type <rostruct> rolepart 
 %type <estruct> roleleft 
@@ -64,4 +66,5 @@
 %token <string> OSET                /* the word, oset */
 %token <string> PRINCIPAL           /* the word, principal */
+%token <string> THIS                /* the word, this */
 %token <string> OTYPE               /* integer,boolean,urn,time,string,float */
 %token <string> OTYPE_CONSTANT      
@@ -92,5 +95,5 @@
      | stmt 
              {  
-               abac_yy_set_rule_clauses($1);
+               /* SUCCESS */
              }
      ;
@@ -101,10 +104,10 @@
                abac_yy_expression_t *headexpr=$1;
                abac_yy_expression_t *tailexpr=$3;
-               abac_list_t *ret=make_role_statement(headexpr, tailexpr);
-               if(ret == NULL) {
+               int rc=make_role_statement(headexpr, tailexpr);
+               if(rc) {
                    panic("unable to parse the role rule statment");
                    YYERROR;
                    } else {
-                       $$=ret;
+                       $$=rc;
                }
              }
@@ -113,10 +116,10 @@
                abac_yy_expression_t *headexpr=$1;
                abac_yy_expression_t *tailexpr=$3;
-               abac_list_t *ret=make_oset_statement(headexpr, tailexpr);
-               if(ret == NULL) {
+               int rc=make_oset_statement(headexpr, tailexpr);
+               if(rc) {
                    panic("unable to parse the oset rule statment");
                    YYERROR;
                    } else {
-                       $$=ret;
+                       $$=rc;
                }
              }
@@ -138,7 +141,7 @@
 /* [keyid:mike] */
 keypart : LSQUARE KEYTYPE COLON
-             { abac_push_keyid_yystate(); }
+             { abac_ll_push_keyid_yystate(); }
           KEYID_CONSTANT
-             { abac_pop_yystate(); }
+             { abac_ll_pop_yystate(); }
           RSQUARE 
              { 
@@ -146,9 +149,10 @@
                char *tmp=NULL;
                asprintf(&tmp,"%s",$5);
+               $$=make_yy_principal(tmp, tmp, idtype);
                char *cn=abac_cn_with_sha(tmp);
                if(cn && idtype)  {
                  $$=make_yy_principal(tmp, cn, idtype);
                  } else {
-                     if((USE("ABAC_CN")) && cn==NULL) {
+                     if((USE("ABAC_CN")) && (cn==NULL)) {
                          if(debug)
                              asprintf(&tmp,"encountered an invalid SHA id(%s)",$5);
@@ -181,7 +185,7 @@
    [keyid:mike]
    [principal:?Z]
-   [principal:?this]
    [int:99]
    [int:?Z]
+   [?this], this could be any of type...
    [?]
 */
@@ -198,5 +202,7 @@
      ;
 
-term : LSQUARE QMARK RSQUARE 
+term : LSQUARE QMARK THIS RSQUARE 
+             { $$= make_yy_term_dterm_this(); }
+     | LSQUARE QMARK RSQUARE 
              { $$= make_yy_term_dterm_anonymous(); }
      | keypart 
@@ -231,12 +237,16 @@
 /* urn same as string */
 /* time like int but with quoted string values */
+/* XXX would have to extend this if want the linked oset in the
+   constraints..
+   [otype:?Z{linked oset-constraint}]
+*/
 otypetail :  VARIABLE_CONSTANT COLON 
              { 
-               abac_pop_yystate();
-               abac_push_range_yystate();
+               abac_ll_pop_yystate();
+               abac_ll_push_range_yystate();
              }
             rangetype 
             {
-              abac_pop_yystate();
+              abac_ll_pop_yystate();
               abac_yy_term_data_t *ptr=make_yy_term_data();
               set_yy_term_data_name(ptr,$1);
@@ -244,8 +254,9 @@
               set_yy_term_data_cond_range(ptr,$4);
               $$=ptr;
+              OUT("otypetail_1");
             }
      | VARIABLE_CONSTANT 
-            { abac_pop_yystate(); }
-            osetleft 
+            { abac_ll_pop_yystate(); }
+            osetterm 
             {
               abac_yy_term_data_t *ptr=make_yy_term_data();
@@ -254,23 +265,26 @@
               set_yy_term_data_cond_head_expr(ptr,$3);
               $$=ptr;
+              OUT("otypetail_2");
             }
      | VARIABLE_CONSTANT
             {
-              abac_pop_yystate();
+              abac_ll_pop_yystate();
               abac_yy_term_data_t *ptr=make_yy_term_data();
               set_yy_term_data_name(ptr,$1);
               set_yy_term_data_is_variable(ptr);
               $$=ptr;
+              OUT("otypetail_3");
             }
      | OTYPE_CONSTANT
             {
-              abac_pop_yystate();
+              abac_ll_pop_yystate();
               abac_yy_term_data_t *ptr=make_yy_term_data();
               set_yy_term_data_name(ptr,$1);
               $$=ptr;
+              OUT("otypetail_4");
             }
      | QMARK
             {
-              abac_pop_yystate();
+              abac_ll_pop_yystate();
               abac_yy_term_data_t *ptr=make_yy_term_data();
               set_yy_term_data_is_anonymous(ptr);
@@ -280,5 +294,5 @@
 
 typedpart  : LSQUARE OTYPE COLON 
-             { abac_push_yystate($2); }
+             { abac_ll_push_yystate($2); }
              otypetail RSQUARE
              { 
@@ -295,9 +309,14 @@
 
 
+
 /* [principal:?] */
 /* [principal:?Z] */
 /* [principal:?This] */
-/* [principal:?Z:{role-constraint}] */
-principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN roleleft RSQUARE 
+/* [principal:?Z{role-constraint}] */
+/* XXX if want to allow linked role constraint need to swap roleleft
+       into roleterm.. but make sure the tree is right
+3/21/13, [principal:?Z[keyid:A].role:roleA.role:roleB([string:?P])] 
+*/
+principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN roleterm RSQUARE 
                 { 
                   abac_yy_expression_t *expr=$6;
@@ -308,4 +327,5 @@
                   make_yy_role_constraint(ptr,tail_string);
                   $$=ptr;
+                  OUT("principalpart_1");
                 }
               | LSQUARE PRINCIPAL COLON QMARK IDEN RSQUARE 
@@ -314,4 +334,5 @@
                   set_yy_term_principal_name(ptr,$5);
                   $$ = ptr;
+                  OUT("principalpart_2");
                 }
               | LSQUARE PRINCIPAL COLON QMARK RSQUARE 
@@ -320,4 +341,5 @@
                   set_yy_term_principal_is_anonymous(ptr);
                   $$ = ptr;
+                  OUT("principalpart_3");
                 }
      ;
@@ -346,4 +368,5 @@
                   make_yy_expression(e_yy_EXPR_LINKED,keypart,rolepart,linked_rolepart);
                $$=expr;
+               OUT("roleterm_1");
              }
      | keypart DOT rolepart
@@ -354,4 +377,5 @@
                    make_yy_expression(e_yy_EXPR_ROLE,keypart,rolepart,NULL);
                $$=expr;
+               OUT("roleterm_2");
              }
      | keypart
@@ -361,4 +385,5 @@
                    make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
                $$=expr;
+               OUT("roleterm_3");
              }
      ;
@@ -372,4 +397,5 @@
                   make_yy_expression(e_yy_EXPR_LINKED,keypart,osetpart,linked_rolepart);
                $$=expr;
+               OUT("osetterm_1");
              }
      | keypart DOT osetpart
@@ -380,4 +406,5 @@
                    make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
                $$=expr;
+               OUT("osetterm_2");
              }
      | keypart
@@ -387,4 +414,5 @@
                    make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
                $$=expr;
+               OUT("osetterm_3");
              }
      | typedpart 
@@ -394,4 +422,5 @@
                    make_yy_expression(e_yy_EXPR_OBJECT,objpart,NULL,NULL);
                $$=expr;
+               OUT("osetterm_4");
              }
      ;
@@ -418,4 +447,5 @@
                     make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
                $$=expr;
+               OUT("osetleft");
              }
      ;
@@ -426,7 +456,11 @@
                abac_yy_expression_t *exprs=$3;
                $$=add_yy_expression(nexpr,exprs);
+               OUT("osetright_1");
              }
      | osetterm
-             { $$=$1; }
+             { 
+               $$=$1; 
+               OUT("osetright_2");
+             }
      ;
 %%
@@ -448,13 +482,12 @@
 void abac_yyinit()
 {
-    abac_yyout=abac_get_yyout();
-    abac_yyfptr = abac_get_yyfptr();
-    abac_yyfptr_encoded = abac_get_yyfptr_encoded();
-    if(debug)
-        fprintf (abac_yyout,"\n=======================================\n");
+    abac_yyout=abac_ll_get_yyout();
+    abac_yyfptr = abac_ll_get_yyfptr();
+    OUT("======================================");
 }
 
 void panic(char *msg) 
 {
+     OUT("panic, EEEEKKKKKK...");
      yyerror(msg);
 }
