Index: libabac/abac_verifier.c
===================================================================
--- libabac/abac_verifier.c	(revision 55c272b29649650dc810656846f188f57e497d31)
+++ libabac/abac_verifier.c	(revision 461541aae6382bb58dfb3c4a1679d2d48e8f9e64)
@@ -1,17 +1,16 @@
+
+/* abac_verifier.c */
 #include <assert.h>
 
-#include <library.h>
-#include <credentials/certificates/certificate.h>
-#include <credentials/certificates/x509.h>
-#include <credentials/certificates/ac.h>
-
-#include "abac_verifier.h"
+#include "libabac_common.h"
+#include "abac.h"
 
 #include "abac_list.h"
+#include "uthash.h"
 #include "abac_util.h"
 
 typedef struct _abac_id_cert_t {
-    char *keyid;
-    certificate_t *cert;
+    char *keyid; // using cert's keyid
+    abac_id_t *cert;
 
     UT_hash_handle hh;
@@ -21,15 +20,17 @@
     abac_role_t *head;
     abac_role_t *tail;
-    certificate_t *cert;
-    certificate_t *issuer;
+    abac_id_t *issuer; /* Acme of Acme.customer <- Coyote */
+    abac_attribute_t *cert;
 
     int refcount;
 };
 
+/* hash table of all the principal id credentials */
 abac_id_cert_t *id_certs = NULL;
 
+/***********************************************************************/
 // convert a chunk to a lowercase binary string
 // malloc's the string
-static char *_chunk_to_string(chunk_t chunk) {
+static char *_chunk_to_string(abac_chunk_t chunk) {
     int i;
 
@@ -44,9 +45,10 @@
 // verify that cert was issued by issuer
 // cert and issuer can be the same, in which case the self-sig is validated
-static int _verify_signature(certificate_t *issuer, certificate_t *cert) {
-    if (cert->issued_by(cert, issuer))
-        if (cert->get_validity(cert, NULL, NULL, NULL))
-            return 1;
-    return 0;
+static int _verify_cert(abac_id_t *cert) {
+
+    assert(cert); 
+    if(!abac_id_still_valid(cert))
+        return 0;
+    return 1;
 }
 
@@ -55,13 +57,6 @@
  */
 void abac_verifier_init(void) {
-    // silence all debugging
-    dbg_default_set_level(-1);
-
-    if (!library_init(NULL))
-        exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
-
-    if (!lib->plugins->load(lib->plugins, NULL,
-            lib->settings->get_str(lib->settings, "pki.load", PLUGINS)))
-        exit(SS_RC_INITIALIZATION_FAILED);
+    init_openssl();
+    init_xmlsec();
 }
 
@@ -76,9 +71,9 @@
 
         free(id->keyid);
-        id->cert->destroy(id->cert);
+        abac_id_free(id->cert);
         free(id);
     }
-
-    library_deinit();
+    deinit_xmlsec();
+    deinit_openssl();
 }
 
@@ -86,16 +81,13 @@
  * Load an ID certificate.
  */
-static int _load_id(certificate_t *cert) {
+static int _load_id(abac_id_t *cert) {
     abac_id_cert_t *id_cert = NULL;
     char *keyid = NULL;
-    chunk_t id;
     int ret;
-    x509_t *x509 = (x509_t *)cert;
-
-    assert(cert != NULL);
+
+    assert(cert);
 
     // get the key ID
-    id = x509->get_subjectKeyIdentifier(x509);
-    keyid = _chunk_to_string(id);
+    keyid = abac_id_keyid(cert);
 
     // if we already have this cert 'error' with success
@@ -106,8 +98,7 @@
     }
 
-    // validate sig
-    ret = _verify_signature(cert, cert);
+    ret = abac_id_still_valid(cert);
     if (!ret) {
-        ret = ABAC_CERT_BAD_SIG;
+        ret = ABAC_CERT_INVALID;
         goto error;
     }
@@ -115,5 +106,5 @@
     // success, add the key to the map of certificates
     id_cert = abac_xmalloc(sizeof(abac_id_cert_t));
-    id_cert->keyid = keyid;
+    id_cert->keyid = abac_xstrdup(keyid);
     id_cert->cert = cert;
     HASH_ADD_KEYPTR(hh, id_certs, id_cert->keyid, strlen(id_cert->keyid), id_cert);
@@ -123,24 +114,25 @@
 error:
     if (keyid != NULL) free(keyid);
-
     return ret;
 }
 
+abac_id_t *abac_verifier_lookup_id(char *keyid)
+{
+    abac_id_cert_t *id_cert;
+    HASH_FIND_STR(id_certs, keyid, id_cert);
+    if(id_cert == NULL) return NULL;
+    return id_cert->cert;
+}
+
 /**
  * Load an ID cert from a file.
  */
 int abac_verifier_load_id_file(char *filename) {
-    if (lib == NULL)
-        errx(1, "looks like you didn't call libabac_init() (lib is NULL)");
-
     // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_FROM_FILE, filename,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
+    abac_id_t *cert = abac_id_from_file(filename);
+
     if (cert == NULL)
         return ABAC_CERT_INVALID;
+
     return _load_id(cert);
 }
@@ -149,12 +141,9 @@
  * Load an ID cert from a chunk.
  */
-int abac_verifier_load_id_chunk(chunk_t chunk) {
+int abac_verifier_load_id_chunk(abac_chunk_t chunk) {
+
     // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
-        BUILD_END
-    );
+    abac_id_t *cert= abac_id_from_chunk(chunk);
+
     if (cert == NULL)
         return ABAC_CERT_INVALID;
@@ -167,28 +156,20 @@
  * authority.
  */
-static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
-    ietf_attributes_t *attr_cert = NULL;
+static int _load_attribute_cert(abac_attribute_t *cert, abac_credential_t **cred_ret) {
     abac_role_t *head_role = NULL;
     abac_role_t *tail_role = NULL;
-    abac_id_cert_t *issuer;
-    int ret, i;
-
-    // get the attr
-    ac_t *ac = (ac_t *)cert;
-    attr_cert = ac->get_groups(ac);
-    if (attr_cert == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    char *attr_string = attr_cert->get_string(attr_cert);
-    if (attr_string == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
+    abac_id_cert_t *issuer=NULL;
+    int ret;
+
+    char *attr_string=abac_attribute_role_string(cert);
+
+    if(attr_string == NULL) {
+       ret = ABAC_CERT_INVALID;
+       goto error;
     }
 
     // split into head/tail parts
     char *head_tail[2];
-    abac_split(attr_string, " <- ", head_tail, &ret);
+    abac_split(attr_string, "<-", head_tail, &ret);
     if (ret != 2) {
         ret = ABAC_CERT_INVALID;
@@ -211,5 +192,4 @@
     }
 
-    // get the issuer based on keyid
     char *principal = abac_role_principal(head_role);
     HASH_FIND_STR(id_certs, principal, issuer);
@@ -219,11 +199,16 @@
     }
 
-    // make sure the issuer's signed it
-    ret = _verify_signature(issuer->cert, cert);
-    if (!ret) {
-        ret = ABAC_CERT_BAD_SIG;
-        goto error;
-    }
-
+    // check if issuer is still valid
+    if (!abac_id_still_valid(issuer->cert)) {
+        ret = ABAC_CERT_INVALID_ISSUER;
+        goto error;
+    }
+
+    // make sure principal match up with keyid
+    if(!abac_id_has_keyid(issuer->cert,principal)) {
+        ret = ABAC_CERT_BAD_PRINCIPAL;
+        goto error;
+    }
+    
     // at this point we know we have a good attribute cert
     abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
@@ -231,16 +216,12 @@
     cred->tail = tail_role;
     cred->cert = cert;
-    cred->issuer = issuer->cert->get_ref(issuer->cert);
+    /* acme's cert */
+    cred->issuer = abac_id_dup(issuer->cert);
     cred->refcount = 1;
     *cred_ret = cred;
 
-    // free up some crap
-    attr_cert->destroy(attr_cert);
-
     return ABAC_CERT_SUCCESS;
 
 error:
-    if (cert != NULL) cert->destroy(cert);
-    if (attr_cert != NULL) attr_cert->destroy(attr_cert);
     if (head_role != NULL) abac_role_free(head_role);
     if (tail_role != NULL) abac_role_free(tail_role);
@@ -249,17 +230,35 @@
 }
 
+static int _load_attribute_certs(abac_list_t *attr_list, abac_list_t *cred_list) {
+
+    int sz=abac_list_size(attr_list);
+    abac_credential_t *cred_ret=NULL;
+    abac_attribute_t *attr;
+    if(sz) { 
+        abac_list_foreach(attr_list, attr,
+            int ret=_load_attribute_cert(attr, &cred_ret);
+            if(ret==ABAC_CERT_SUCCESS) {
+                abac_list_add(cred_list, cred_ret);
+            }
+        );
+    }
+    return sz;
+}
+
 /**
  * Load an attribute cert from a file.
  */
-int abac_verifier_load_attribute_cert_file(char *filename, abac_credential_t **cred) {
+int abac_verifier_load_attribute_cert_file(char *filename, abac_list_t *cred_list) {
+
     // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_FROM_FILE, filename,
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-    return _load_attribute_cert(cert, cred);
+    abac_list_t *attr_list = abac_attribute_certs_from_file(filename);
+
+    if (abac_list_size(attr_list) == 0)
+        return ABAC_CERT_INVALID;
+
+    int ret=_load_attribute_certs(attr_list, cred_list);
+
+    if(ret) return ABAC_CERT_SUCCESS;
+        return ABAC_CERT_INVALID;
 }
 
@@ -267,14 +266,12 @@
  * Load an attribute cert from a chunk.
  */
-int abac_verifier_load_attribute_cert_chunk(chunk_t chunk, abac_credential_t **cred) {
+int abac_verifier_load_attribute_cert_chunk(abac_chunk_t chunk, abac_list_t *cred_list) {
+
     // load the cert
-    certificate_t *cert = lib->creds->create(
-        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
-        BUILD_BLOB_ASN1_DER, chunk,
-        BUILD_END
-    );
-    if (cert == NULL)
-        return ABAC_CERT_INVALID;
-    return _load_attribute_cert(cert, cred);
+    abac_list_t *attr_list = abac_attribute_certs_from_chunk(chunk);
+
+    if (abac_list_size(attr_list) == 0)
+        return ABAC_CERT_INVALID;
+    return _load_attribute_certs(attr_list,cred_list);
 }
 
@@ -294,18 +291,17 @@
 
 /**
- * Return the encoding of the attribute cert.
+ * Return the xml chunk of the attribute cert.
  */
 abac_chunk_t abac_credential_attribute_cert(abac_credential_t *cred) {
-    chunk_t encoding = cred->cert->get_encoding(cred->cert);
-    abac_chunk_t ret = { encoding.ptr, encoding.len };
-    return ret;
-}
-
-/**
- * Return the encoding of the issuer cert.
+    assert(cred); assert(cred->cert);
+    return abac_attribute_cert(cred->cert);
+}
+
+/**
+ * Return the chunk of the issuer cert.
  */
 abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred) {
-    chunk_t encoding = cred->issuer->get_encoding(cred->issuer);
-    abac_chunk_t ret = { encoding.ptr, encoding.len };
+    assert(cred); assert(cred->issuer);
+    abac_chunk_t ret= abac_id_in_PEM(cred->issuer);
     return ret;
 }
@@ -334,6 +330,6 @@
     abac_role_free(cred->head);
     abac_role_free(cred->tail);
-    cred->cert->destroy(cred->cert);
-    cred->issuer->destroy(cred->issuer); // reference counted
+    abac_attribute_free(cred->cert);
+    abac_id_free(cred->issuer);
 
     free(cred);
