Index: libabac/abac_pl_yy.c
===================================================================
--- libabac/abac_pl_yy.c	(revision d037f549d30de12f67357bdeb76c05f548342399)
+++ libabac/abac_pl_yy.c	(revision 440ba2094bb609dfd219413fa918cf7369999c9e)
@@ -16,11 +16,6 @@
 
 /* from abac_pl_gen.c */
-extern char *generate_pl_range_constraint(char *,char *,char *,char *);
-extern char *generate_pl_range_time_constraint(char *,char *,char *);
 extern abac_list_t *generate_pl_clauses(abac_aspect_t *, abac_aspect_t *);
-extern char* generate_pl_constraint_clause(abac_aspect_t *, char *);
-extern char *generate_pl_type_clause(char *, int);
-/* from abac_pl_yap.c */
-extern char *abac_pl_add_range_constraint_clause(char *var, char *tmplist);
+
 /* from rt2.y */
 extern void abac_yyinit();
@@ -34,11 +29,4 @@
 abac_aspect_t *abac_rule_tail_aspect=NULL;
 
-/* to track id certs within a rule clause */
-typedef struct _abac_yy_id_cert_t {
-    char *principalname;
-    int type; /* keyidtype */
-    char *clause;
-} abac_yy_id_cert_t;
-abac_list_t *abac_yy_id_certs = NULL;
 
 /* structure to hold the range information
@@ -55,11 +43,4 @@
 } abac_yy_range_t;
 
-/* to track role/oset constraint clauses used within a rule clause,
-   collect them up in one place, these are for conjunction clauses */
-typedef struct _abac_yy_constraint_t {
-    char *clause;
-} abac_yy_constraint_t;
-abac_list_t *abac_yy_constraints = NULL;
-
 /* local principal structure  [keyid:USC] */
 struct _abac_yy_principal_t {
@@ -74,6 +55,7 @@
     int is_anonymous;
     char *name;
-    char *cond_str;
-    void *cond_ptr; // ptr to a saved abac_aspect_t
+    int isrange;
+    char *cond_str;  // range string ???  not sure if this is possible
+    void *cond_ptr; // ptr to a saved abac_aspect_t or a list(item_t)
     abac_yy_expression_t *cond_head_expr;
 };
@@ -92,6 +74,6 @@
     int type;
     char *name;
-    char *cond_str;
-    void *cond_ptr; // ptr to a saved abac_aspect_t
+    char *cond_str; // range string
+    void *cond_ptr; // ptr to a saved abac_aspect_t 
     abac_list_t *cond_range;
     abac_yy_expression_t *cond_head_expr; // parking stub
@@ -186,10 +168,5 @@
 {
     if (abac_rule_clauses != NULL) {
-        char *cur;
-        if(abac_yy_id_certs) {
-            abac_list_foreach(abac_yy_id_certs, cur,
-                if(cur) free(cur);
-            );
-        }
+        abac_pl_free_id_certs();
         abac_list_free(abac_rule_clauses);
     }
@@ -213,80 +190,4 @@
 
 /************************************************************************/
-void abac_yy_init_yy_id_certs()
-{
-    abac_yy_id_certs = abac_list_new();
-}
-
-void abac_yy_free_yy_id_certs()
-{
-    abac_yy_id_cert_t *id;
-    abac_list_foreach(abac_yy_id_certs, id,
-        if(id) 
-            free(id->principalname);
-            free(id->clause);
-            free(id);
-    );
-    abac_list_free(abac_yy_id_certs);
-    abac_yy_id_certs = NULL;
-}
-
-int abac_yy_cnt_yy_id_certs()
-{
-    return abac_list_size(abac_yy_id_certs);
-}
-
-char *abac_yy_string_yy_id_certs()
-{
-    int first=1;
-    char *tmp=NULL;
-    abac_yy_id_cert_t *cur;
-    abac_list_foreach(abac_yy_id_certs, cur,
-        if(cur) 
-            if(first) {
-                tmp=abac_xstrdup(cur->clause);
-                first=0;
-                } else {
-                    int cnt=asprintf(&tmp,"%s,%s", tmp, cur->clause);
-            }
-    );
-    return tmp;
-}
-
-static void _add_yy_id_certs(char *principalname, int type)
-{
-    abac_yy_id_cert_t *id_cert=NULL;
-
-    if(debug) {
-         printf("add_yy_id_certs: adding --> (%s)\n", principalname);
-    }
-    int found=0;
-    abac_yy_id_cert_t *cur;
-    abac_list_foreach(abac_yy_id_certs, cur,
-        if(cur) 
-            if(strcmp(cur->principalname,principalname)==0) {
-               found=1;
-               break;
-            }
-    );
-
-    if (found) {
-        return;
-        } else {
-            id_cert=abac_xmalloc(sizeof(abac_yy_id_cert_t));
-            id_cert->principalname=abac_xstrdup(principalname);
-            id_cert->type=type;
-            if(USE("ABAC_CN")) {
-                 id_cert->clause=generate_pl_type_clause(principalname,type);
-                 } else {
-                    int *tmp=NULL;
-                    asprintf(&tmp,"p%s",principalname);
-                    id_cert->clause=generate_pl_type_clause(tmp,type);
-                    free(tmp);
-            }
-            abac_list_add(abac_yy_id_certs, id_cert);
-    }
-}
-
-/***********************************************************************/
 static void _free_yy_cond_range(abac_list_t *ptr) 
 {
@@ -459,5 +360,5 @@
 void set_yy_term_data_type(abac_yy_term_data_t *ptr, char* typestr)
 {
-    int type=abac_term_verify_term_type(typestr);
+    int type=abac_verify_term_type(typestr);
     ptr->type=type;
 }
@@ -470,6 +371,6 @@
 bool is_yy_term_data_type_numeric(abac_yy_term_data_t *ptr)
 {
-    if(ptr->type==abac_term_verify_term_type("integer") ||
-          ptr->type==abac_term_verify_term_type("float"))
+    if(ptr->type==abac_verify_term_type("integer") ||
+          ptr->type==abac_verify_term_type("float"))
         return 1;
     return 0;
@@ -478,5 +379,5 @@
 bool is_yy_term_data_type_time(abac_yy_term_data_t *ptr)
 {
-    if(ptr->type==abac_term_verify_term_type("time"))
+    if(ptr->type==abac_verify_term_type("time"))
         return 1;
     return 0;
@@ -485,7 +386,7 @@
 bool is_yy_term_data_type_alpha(abac_yy_term_data_t *ptr)
 {
-    if(ptr->type==abac_term_verify_term_type("string") ||
-        ptr->type==abac_term_verify_term_type("urn") ||
-         ptr->type==abac_term_verify_term_type("boolean"))
+    if(ptr->type==abac_verify_term_type("string") ||
+        ptr->type==abac_verify_term_type("urn") ||
+         ptr->type==abac_verify_term_type("boolean"))
         return 1;
     return 0;
@@ -531,5 +432,7 @@
     ptr->is_anonymous=0;
     ptr->name=NULL;
+    ptr->isrange=0;
     ptr->cond_str=NULL;
+    ptr->cond_ptr=NULL;
     ptr->cond_head_expr=NULL;
     return ptr;
@@ -539,4 +442,9 @@
 {
     using_this=1;
+}
+
+void set_yy_term_principal_isrange(abac_yy_term_principal_t *ptr, int isrange)
+{
+    ptr->isrange=isrange;
 }
 
@@ -627,53 +535,4 @@
     ptr->next=NULL;
     ptr->bcnt=1;
-    return ptr;
-}
-
-/************************************************************************/
-void abac_yy_init_yy_constraints()
-{
-    abac_yy_constraints = abac_list_new();
-}
-
-void abac_yy_free_yy_constraints()
-{
-    abac_yy_constraint_t *cur;
-    abac_list_foreach(abac_yy_constraints, cur,
-        if(cur && cur->clause) 
-            free(cur->clause);
-        free(cur);
-    );
-    abac_list_free(abac_yy_constraints);
-    abac_yy_constraints=NULL;
-}
-
-int abac_yy_cnt_yy_constraints()
-{
-    return abac_list_size(abac_yy_constraints);
-}
-
-char *abac_yy_string_yy_constraints()
-{
-    int first=1;
-    char *tmp=NULL;
-    abac_yy_constraint_t *cur;
-    abac_list_foreach(abac_yy_constraints, cur,
-        if(cur && cur->clause) 
-            if(first) {
-                tmp=abac_xstrdup(cur->clause);
-                first=0;
-                } else {
-                    int cnt=asprintf(&tmp,"%s,%s", tmp, cur->clause);
-            }
-    );
-    return tmp;
-}
-
-abac_yy_constraint_t *abac_yy_add_yy_constraints(char *constraint)
-{
-    abac_yy_constraint_t *ptr=
-        (abac_yy_constraint_t *) abac_xmalloc(sizeof(abac_yy_constraint_t));
-    ptr->clause=abac_xstrdup(constraint);
-    abac_list_add(abac_yy_constraints, ptr);
     return ptr;
 }
@@ -846,208 +705,32 @@
 /***************************************************************************/
 /* add the oset condition to constraint list */
-char *make_yy_oset_constraint(abac_yy_term_data_t *ptr, char *tail_string)
+void make_yy_oset_constraint(abac_yy_term_data_t *ptr, char *tail_string)
 {
    abac_yy_expression_t *head_expr=get_yy_term_data_cond_head_expr(ptr);
    if(head_expr) {
        abac_aspect_t *head_aspect=validate_head(e_yy_OSET_TYPE,head_expr);
-       if(head_aspect == NULL)
-           goto error;
-
-       char *tmp=generate_pl_constraint_clause(head_aspect,tail_string);
-       set_yy_term_data_cond_str(ptr,tmp);
-       set_yy_term_data_cond_ptr(ptr,head_aspect);
-       abac_yy_add_yy_constraints(tmp);
-       return tmp;
+       if(head_aspect != NULL) {
+           if(debug) printf("make_yy_oset_constraint..\n");
+           set_yy_term_data_cond_ptr(ptr,head_aspect);
+       }
    }
-
-error:
-   return NULL;
 } 
+
 /* add the role condition to constraint list */
-char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
+void make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
 {
    abac_yy_expression_t *head_expr=get_yy_term_principal_cond_head_expr(ptr);
    if(head_expr) {
        abac_aspect_t *head_aspect=validate_head(e_yy_ROLE_TYPE,head_expr);
-       if(head_aspect == NULL)
-           goto error;
-
-       char *tmp=generate_pl_constraint_clause(head_aspect,tail_string);
-       set_yy_term_principal_cond_str(ptr,tmp);
-       set_yy_term_principal_cond_ptr(ptr,head_aspect);
-       abac_yy_add_yy_constraints(tmp);
-       if(debug) {
-           printf("make_yy_role_constraint, adding (%s) \n",tmp);
+       if(head_aspect != NULL) {
+          if(debug) printf("make_yy_role_constraint..\n");
+          set_yy_term_principal_cond_ptr(ptr,head_aspect);
+          set_yy_term_principal_isrange(ptr,0);
        }
-       return tmp;
    }
-
-error:
-   return NULL;
 }
 
 
 /****************************************************************/
-/* add the range condition to constraint list */
-/* this is for integer and float only */
-void make_yy_range_numeric_constraint(abac_yy_term_data_t *ptr, char *var)
-{
-   char *typestr=abac_termtype_string(ptr->type);
-   abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
-   char *tmplist=NULL;
-   char *tmp=NULL;
-   int as_range=1; /* either , or ; */
-   if(rlist) {
-       char *rstring=_string_yy_cond_range(rlist);
-       set_yy_term_data_cond_str(ptr,rstring);
-       abac_yy_range_t *cur;
-     
-       /* a list of values -- in chars */
-       abac_list_foreach(rlist, cur,
-           int type=cur->type;
-           char *val=cur->val; 
-           switch(type) {
-             case e_yy_RANGE_MIN:
-               tmp=generate_pl_range_constraint(typestr,var,val,">=");
-               break;
-             case e_yy_RANGE_MAX:
-               tmp=generate_pl_range_constraint(typestr,var,val,"=<");
-               break;
-             case e_yy_RANGE_TARGET:
-               tmp=generate_pl_range_constraint(NULL,var,val,"=");
-               as_range=0;
-               break;
-           }
-           /* ; is prolog's disjunction built in predicate */
-           if(tmplist) {
-               if(as_range)
-                   asprintf(&tmplist,"%s,%s",tmplist,tmp);
-                   else
-                       asprintf(&tmplist,"%s;%s",tmplist,tmp);
-               } else {
-                   tmplist=tmp;
-           }
-           tmp=NULL;
-       );
-       asprintf(&tmplist,"(%s)",tmplist);
-       abac_yy_add_yy_constraints(tmplist);
-   }
-}
-
-/****************************************************************/
-/* this is for time only */
-void make_yy_range_time_constraint(abac_yy_term_data_t *ptr, char *var)
-{
-   char *typestr=abac_termtype_string(ptr->type);
-   abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
-   char *tmplist=NULL;
-   char *tmp=NULL;
-   char *ttmp=NULL;
-   char *tlist=NULL;
-   int as_range=1; /* either , or ; */
-   if(rlist) {
-       char *rstring=_string_yy_cond_range(rlist);
-       set_yy_term_data_cond_str(ptr,rstring);
-       abac_yy_range_t *cur;
-     
-       /* a list of values -- in chars */
-       abac_list_foreach(rlist, cur,
-           int type=cur->type;
-           char *tval=cur->val; 
-           char *val=abac_term_to_time(tval);
-           switch(type) {
-             case e_yy_RANGE_MIN:
-               ttmp=generate_pl_range_time_constraint(var,val,">");
-               tmp=generate_pl_range_time_constraint(var,val,"=");
-               asprintf(&tlist,"(%s;%s)",ttmp,tmp);
-               tmp=tlist;
-               break;
-             case e_yy_RANGE_MAX:
-               ttmp=generate_pl_range_time_constraint(var,val,"=");
-               tmp=generate_pl_range_time_constraint(var,val,"<");
-               asprintf(&tlist,"(%s;%s)",ttmp,tmp);
-               tmp=tlist;
-               break;
-             case e_yy_RANGE_TARGET:
-               tmp=generate_pl_range_time_constraint(var,val,"=");
-               as_range=0;
-               break;
-           }
-           free(val);
-           /* ; is prolog's disjunction built in predicate */
-           if(tmplist) {
-               if(as_range)
-                   asprintf(&tmplist,"%s,%s",tmplist,tmp);
-                   else
-                       asprintf(&tmplist,"%s;%s",tmplist,tmp);
-               } else {
-                   tmplist=tmp;
-           }
-           tmp=NULL;
-       );
-
-       asprintf(&tmplist,"(%s)",tmplist);
-       /* generate a clause with above and add into db */
-       tmp=abac_pl_add_range_constraint_clause(var,tmplist);
-       abac_yy_add_yy_constraints(tmp);
-   }
-}
-
-/****************************************************************/
-/* this is for string and urn only */
-void make_yy_range_string_constraint(abac_yy_term_data_t *ptr, char *var)
-{
-   char *typestr=abac_termtype_string(ptr->type);
-   abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
-   char *tmplist=NULL;
-   char *tmp=NULL;
-   if(rlist) {
-       char *rstring=_string_yy_cond_range(rlist);
-       set_yy_term_data_cond_str(ptr,rstring);
-       abac_yy_range_t *cur;
-     
-       /* a list of values -- in chars */
-       abac_list_foreach(rlist, cur,
-           int type=cur->type;
-           char *val=cur->val; 
-           switch(type) {
-             case e_yy_RANGE_MIN:
-               panic("make_yy_range_string_constraint, invalid range type - min"); 
-               break;
-             case e_yy_RANGE_MAX:
-               /* invalid range type */
-               panic("make_yy_range_string_constraint, invalid range type - max"); 
-               break;
-             case e_yy_RANGE_TARGET:
-               tmp=generate_pl_range_constraint(NULL,var,val,"=");
-               break;
-           }
-           /* ; is prolog's disjunction built in predicate */
-           if(tmplist)
-               asprintf(&tmplist,"%s;%s",tmplist,tmp);
-               else tmplist=tmp;
-           tmp=NULL;
-       );
-       asprintf(&tmplist,"(%s)",tmplist);
-       /* generate a clause with above and add into db */
-       tmp=abac_pl_add_range_constraint_clause(var,tmplist);
-       abac_yy_add_yy_constraints(tmp);
-   }
-}
-
-void make_yy_range_constraint(abac_yy_term_data_t *ptr, char *var)
-{
-    if(is_yy_term_data_type_numeric(ptr)) {
-        make_yy_range_numeric_constraint(ptr, var);
-        } else if (is_yy_term_data_type_alpha(ptr)) {
-            make_yy_range_string_constraint(ptr, var);
-            } else if (is_yy_term_data_type_time(ptr)) {
-                make_yy_range_time_constraint(ptr, var);
-    }
-}
-
-
-/************************************************************************/
-
 static void _aspect_add_terms(int linked, abac_aspect_t *aspect_ptr, 
 abac_yy_term_t *terms)
@@ -1056,4 +739,5 @@
     int type;
     int isnamed;
+    int isrange;
     char *name;
     char *cond;
@@ -1065,4 +749,5 @@
         ptr=NULL;
         isnamed=0; 
+        isrange=0;
         switch (curr->type) {
            case e_yy_DTERM_DATA:
@@ -1071,8 +756,8 @@
                type=dptr->type;
                name=abac_xstrdup(dptr->name);
-               if(dptr->cond_str) {
+               if(dptr->cond_str)
                   cond=abac_xstrdup(dptr->cond_str);
-                  ptr=dptr->cond_ptr;
-               }
+               ptr=dptr->cond_ptr;
+               isrange=(dptr->cond_range!=NULL)?1:0;
                break;
            }
@@ -1080,10 +765,10 @@
            {
                abac_yy_term_principal_t *pptr=curr->term.p_ptr;
-               type=abac_term_verify_term_type("principal");
+               type=abac_verify_term_type("principal");
                name=abac_xstrdup(pptr->name);
-               if(pptr->cond_str) {
+               if(pptr->cond_str)
                   cond=abac_xstrdup(pptr->cond_str);
-                  ptr=pptr->cond_ptr;
-               }
+               ptr=pptr->cond_ptr;
+               isrange=pptr->isrange;
                break;
            }
@@ -1098,5 +783,5 @@
            case e_yy_DTERM_ANONYMOUS:
            {
-              type=abac_term_verify_term_type("anonymous");
+              type=abac_verify_term_type("anonymous");
               name=abac_xstrdup("_");
               break;
@@ -1106,5 +791,5 @@
        if(isnamed)
            param=abac_term_named_new(type,name);
-           else param=abac_term_new(type,name,cond,ptr);
+           else param=abac_term_new(type,name,isrange,cond,ptr);
        if (linked) 
            abac_aspect_add_linked_param(aspect_ptr, param);
@@ -1140,5 +825,4 @@
     
      char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
      char *name=ptr->name;
      abac_yy_term_t *terms=ptr->terms;
@@ -1158,5 +842,4 @@
           _aspect_add_aspect_terms(aptr, terms);
      }
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
      return aptr;
 
@@ -1181,5 +864,4 @@
      abac_yy_principal_t *principal=expr->principal;
      char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
 
      abac_aspect_t *ptr=NULL;
@@ -1187,5 +869,4 @@
          ptr=abac_aspect_oset_principal_new(principalname);
          else ptr=abac_aspect_role_principal_new(principalname);
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
      if (ptr==NULL)
          goto error;
@@ -1208,5 +889,6 @@
      char *cond=object->cond_str;
      void *ptr=object->cond_ptr;
-     abac_term_t *term=abac_term_new(type,name,cond,ptr);
+     int isrange=(object->cond_range!=NULL)?1:0;
+     abac_term_t *term=abac_term_new(type,name,isrange,cond,ptr);
      abac_aspect_t *aptr=NULL;
      if(yytype==e_yy_OSET_TYPE)
@@ -1214,8 +896,4 @@
          else
              goto error; /* can not be a role expression with obj */
-
-     if(get_yy_term_data_is_variable(object))
-         _add_yy_id_certs(name,type);
-
      if (aptr==NULL)
          goto error;
@@ -1235,6 +913,4 @@
 
      char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
      char *name=eptr->name;
      abac_yy_term_t *terms=eptr->terms;
@@ -1251,7 +927,4 @@
          _aspect_add_aspect_terms(ptr, terms);
      }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
-
      return ptr;
 
@@ -1270,6 +943,4 @@
 
      char *principalname=get_yy_principal_sha(principal);
-     char *othername=get_yy_principal_name(principal);
-
      char *name=eptr->name;
      abac_yy_term_t *terms=eptr->terms;
@@ -1293,6 +964,4 @@
          _aspect_add_aspect_terms(ptr, terms);
      }
-
-     _add_yy_id_certs(othername,get_yy_principal_type(principal));
 
      return ptr;
@@ -1351,4 +1020,7 @@
         } /* while */
 
+        preprocess_pl_head(head_oset);
+        preprocess_pl_tail(tail_oset);
+
 /* XXX collect up type clauses, constraint clauses and 
    generate rule clauses */
@@ -1381,4 +1053,39 @@
 }
 
+/*****************************************************************************/
+abac_list_t *validate_range(abac_list_t *ptr)
+{
+    abac_list_t *nlist=abac_list_new();
+
+    abac_item_t *nitem;
+    abac_yy_range_t *cur;
+    char *val;
+    int type;
+    abac_list_foreach(ptr, cur,
+        if(cur) {
+            type=cur->type;
+            val=cur->val;
+            if(type==e_yy_RANGE_MIN) nitem=abac_item_new("min",val);
+            if(type==e_yy_RANGE_MAX) nitem=abac_item_new("max",val);
+            if(type==e_yy_RANGE_TARGET) nitem=abac_item_new("target",val);
+            abac_list_add(nlist,nitem);
+        }
+    );
+    return nlist;
+}
+
+/****************************************************************/
+void make_yy_range_constraint(abac_yy_term_data_t *ptr)
+{
+    if(is_yy_term_data_type_numeric(ptr) ||
+        is_yy_term_data_type_alpha(ptr) ||
+           is_yy_term_data_type_time(ptr)) {
+       abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
+       if(rlist) {
+           abac_list_t *nlist=validate_range(rlist);
+           set_yy_term_data_cond_ptr(ptr,nlist);
+       }
+    }
+}
 /*****************************************************************************/
 /* build up the abac structure and also create the yap clause
@@ -1426,4 +1133,7 @@
         } /* while */
 
+        preprocess_pl_head(head_role);
+        preprocess_pl_tail(tail_role);
+
 /* collect up type clauses, constraint clauses and 
    generate the final rule clauses */
@@ -1461,7 +1171,5 @@
    abac_yyinit();
    abac_yy_init_rule_id_clauses();
-   abac_yy_init_yy_id_certs();
-   abac_yy_init_yy_constraints();
-}
-
-
+}
+
+
