Index: libabac/abac_m64.c
===================================================================
--- libabac/abac_m64.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_m64.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -1,3 +1,2 @@
-
 
 #include <stdio.h>
@@ -5,5 +4,5 @@
 #include <string.h>
 
-static int debug=1;
+static int debug=0;
 char* abac_decode_string(char *);
 
@@ -62,4 +61,5 @@
     if((len/3)*3 != len) {
         hops=(len/3)+1;
+        olen=hops*3;
         orig_string=malloc(sizeof(char)*olen); 
         strcpy(orig_string,string);
@@ -68,7 +68,7 @@
         } else {
         hops=len/3;
+        olen=hops*3;
         orig_string=strdup(string);
     }
-    olen=hops*3;
     nlen=(olen*4/3 +1);
     new_string = (char *) malloc(sizeof(char)*nlen);
@@ -76,4 +76,7 @@
     inbufptr=orig_string;
     outbufptr=new_string;
+    if(debug) {
+       printf("sizeof string %d\n", len);
+    }
 
     int idx=0;
Index: libabac/abac_param.c
===================================================================
--- libabac/abac_param.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_param.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -2,4 +2,7 @@
 /***********************************************************
    abac_param.c
+
+ dterm=data term of rt1
+ param is a kind of dterm
 ***********************************************************/
 #include <assert.h>
@@ -7,4 +10,5 @@
 #include <stdio.h>
 #include <string.h>
+#include <ctype.h>
 
 #include "abac_list.h"
@@ -13,9 +17,46 @@
 #include "abac_pl.h"
 
+typedef enum _termtype {
+    e_TERM_INTEGER = 1,
+    e_TERM_URN = 2,
+    e_TERM_FLOAT = 3,
+    e_TERM_BOOLEAN = 4,
+    e_TERM_STRING = 5,
+    e_TERM_TIME = 6,
+    e_TERM_PRINCIPAL = 7,
+    e_TERM_ANONYMOUS = 8
+} termtype_t;
+
+/* termname[dtermtype] */
+static char *const termname[] =
+{
+  "badterm",
+  "integer",
+  "urn",
+  "float",
+  "boolean",
+  "string",
+  "time" ,
+  "principal",
+  "anonymous",
+  0
+};
+static int termname_cnt=8;
+
+typedef enum _condtype_t {
+    e_COND_ROLE = 1,
+    e_COND_OSET = 2
+} condtype_t;
+
 struct _abac_condition_t {
+    int type;
     char *string;
+    union {
+       abac_role_t *of_role;
+       abac_oset_t *of_oset;
+    };
 };
 
-struct _abac_param_t {
+struct _abac_term_t {
     int type;
     char *name;
@@ -28,10 +69,68 @@
 };
 
+
 /******************************************************************/
-
-static abac_condition_t *abac_condition_new(char *condition)
-{
-     abac_condition_t *ptr=abac_xmalloc(sizeof(abac_condition_t));
-     ptr->string=condition;
+char *abac_term_name(abac_term_t *term)
+{
+    return term->name;
+}
+
+abac_condition_t *abac_term_constraint(abac_term_t *term)
+{
+    return term->constraint;
+}
+
+char *abac_term_type(int i)
+{
+    return termname[i];
+}
+
+int abac_term_is_time_type(int i)
+{
+    if (i == e_TERM_TIME) 
+       return 1;
+    return 0;
+}
+
+int abac_term_is_string_type(int i)
+{
+    if (i == e_TERM_STRING) 
+       return 1;
+    return 0;
+}
+
+int abac_term_is_integer_type(int i)
+{
+    if (i == e_TERM_INTEGER) 
+       return 1;
+    return 0;
+}
+
+int abac_term_is_urn_type(int i)
+{
+    if (i == e_TERM_URN) 
+       return 1;
+    return 0;
+}
+
+int abac_verify_term_type(char *type) {
+    int i;
+
+    if (type == NULL)
+        return 0;
+
+    for (i = 1; i <= termname_cnt ; i++)
+        if(strcmp(type,termname[i])==0)
+            return i;
+    return 0;
+}
+
+static abac_condition_t *abac_condition_new(int type,char* condstr,void *cptr)
+{
+     abac_condition_t *ptr=
+             (abac_condition_t *)abac_xmalloc(sizeof(abac_condition_t));
+     ptr->type=type;
+     ptr->string=strdup(condstr);
+     ptr->of_role=cptr;
      return ptr;
 }
@@ -39,22 +138,39 @@
 static void abac_condition_free(abac_condition_t *ptr)
 {
-     free(ptr->string);
+     if(ptr->type == e_COND_OSET)
+         abac_oset_free(ptr->of_oset);
+         else abac_role_free(ptr->of_role);
+     if(ptr->string) free(ptr->string);
      free(ptr);
 }
 
-abac_param_t *abac_param_new(int type, char *name, char *cond)
+/* always add p to the name except if its a variable and needed */
+abac_term_t *abac_term_new(int type, char *name, char *cond, void *cptr)
 {
      abac_condition_t *constraint=NULL;
      if (cond) {
-         constraint=abac_condition_new(cond);
+         if(type==e_TERM_PRINCIPAL)
+             constraint=abac_condition_new(e_COND_ROLE,cond,cptr);
+             else
+                 constraint=abac_condition_new(e_COND_OSET,cond,cptr);
      }
-     abac_param_t *ptr=abac_xmalloc(sizeof(abac_param_t));
+     abac_term_t *ptr=abac_xmalloc(sizeof(abac_term_t));
      ptr->type=type;
-     ptr->name=name;
+     /* add p to time term if needed and not a variable */
+     if((!constraint) && 
+              abac_term_is_time_type(type) && isdigit(name[0])) {
+         char *tmp;
+         asprintf(&tmp,"p%s",name);
+         ptr->name=tmp;
+         free(name);
+         } else {
+             ptr->name=strdup(name);
+     }
+
      ptr->constraint=constraint;
      return ptr;
 }
 
-void abac_param_free(abac_param_t *ptr)
+void abac_term_free(abac_term_t *ptr)
 {
     if(ptr->constraint) {
@@ -65,9 +181,9 @@
 }
 
-abac_param_list_t *abac_param_list_new(abac_param_t *param)
+abac_param_list_t *abac_param_list_new(abac_term_t *term)
 {
     abac_param_list_t *ptr=abac_xmalloc(sizeof(abac_param_list_t));
     ptr->list=abac_list_new();
-    abac_list_add(ptr->list, param);
+    abac_list_add(ptr->list, term);
     return ptr;
 }
@@ -76,7 +192,7 @@
 {
     abac_list_t *list=ptr->list;
-    abac_param_t  *cur;
+    abac_term_t  *cur;
     abac_list_foreach(list, cur,
-           abac_param_free(cur);
+           abac_term_free(cur);
     );
     abac_list_free(list);
@@ -84,12 +200,12 @@
 }
 
-abac_param_list_t *abac_param_list_add_param(abac_param_list_t *ptr, abac_param_t *param)
+abac_param_list_t *abac_param_list_add_term(abac_param_list_t *ptr, abac_term_t *term)
 {
     abac_list_t *list=ptr->list;
-    abac_list_add(list, param);
+    abac_list_add(list, term);
     return ptr;
 }
 
-abac_param_t *abac_param_add_constraint(abac_param_t *ptr, abac_condition_t *cond)
+abac_term_t *abac_term_add_constraint(abac_term_t *ptr, abac_condition_t *cond)
 {
     if(ptr->constraint) {
@@ -101,7 +217,25 @@
 
 /* name or name:cond */
-static char *abac_param_string_with_condition(abac_param_t *ptr)
+static char *abac_term_string_with_condition(abac_term_t *ptr)
 {
     char *tmp=NULL;
+    char *cond=NULL;
+    char *name=ptr->name;
+    int len=strlen(name)+1;
+    if(ptr->constraint) {
+       cond=ptr->constraint->string;
+       len=len+strlen(cond)+1;
+    }
+    tmp = abac_xmalloc(len);
+    if(cond)
+       sprintf(tmp,"%s:%s", name, cond);
+       else
+           sprintf(tmp,"%s", name);
+    return tmp;
+}
+
+/* len of name or name:cond */
+static int abac_term_len_with_condition(abac_term_t *ptr)
+{
     char *cond=NULL;
     char *name=ptr->name;
@@ -111,34 +245,27 @@
        len=len+strlen(cond)+1;
     }
-    tmp = abac_xmalloc(len);
-    if(cond)
-       sprintf(tmp,"%s:%s", name, cond);
-       else
-           sprintf(tmp,"%s", name);
-    return tmp;
-}
-
-/* len of name or name:cond */
-static int abac_param_len_with_condition(abac_param_t *ptr)
-{
-    char *cond=NULL;
-    char *name=ptr->name;
-    int len=strlen(name);
-    if(ptr->constraint) {
-       cond=ptr->constraint->string;
-       len=len+strlen(cond)+1;
-    }
     return len;
 }
 
 /* just name */
-static char *abac_param_string(abac_param_t *ptr)
-{
+static char *abac_term_string(abac_term_t *ptr)
+{
+    if(ptr->type == abac_verify_term_type("urn") ||
+              ptr->type == abac_verify_term_type("string") ) {
+        char *str;
+        asprintf(&str, "%s", ptr->name);
+        return str;
+    }
     return strdup(ptr->name);
 }
 
 /* just len of name */
-static int abac_param_len(abac_param_t *ptr)
-{
+static int abac_term_len(abac_term_t *ptr)
+{
+    /* including the 2 ' */
+    if(ptr->type == abac_verify_term_type("urn") ||
+              ptr->type == abac_verify_term_type("string") ) {
+        return strlen(ptr->name)+2; 
+    }
     return strlen(ptr->name);
 }
@@ -150,17 +277,17 @@
         return "";
 
-    abac_param_t  *cur;
+    abac_term_t  *cur;
     char *tmp;
     int len=0;
     /* collect up all the lens so can allocate once */
     abac_list_foreach(ptr->list, cur,
-           int l=abac_param_len_with_condition(cur);
+           int l=abac_term_len_with_condition(cur);
            len=len+l+1;
     );
-    tmp=abac_xmalloc(len * sizeof(char));
+    tmp=abac_xmalloc((len+1) * sizeof(char));
     /* collect up all the string */
     int first=1;
     abac_list_foreach(ptr->list, cur,
-           char *s=abac_param_string_with_condition(cur);
+           char *s=abac_term_string_with_condition(cur);
            if(first) {
                strcpy(tmp,s);
@@ -181,5 +308,5 @@
     if(list == NULL)
         return "";
-    abac_param_t  *cur;
+    abac_term_t  *cur;
     char *tmp;
     int len=0;
@@ -187,12 +314,12 @@
     abac_list_foreach(list, cur,
            // collect up the len
-           int l=abac_param_len(cur);
+           int l=abac_term_len(cur);
            len=len+l+1;
     );
-    tmp=abac_xmalloc(len * sizeof(char));
+    tmp=abac_xmalloc((len+1) * sizeof(char));
     /* collect up all the string */
     int first=1;
     abac_list_foreach(list, cur,
-           char *s=abac_param_string(cur);
+           char *s=abac_term_string(cur);
            if(first) {
                strcpy(tmp,s);
Index: libabac/abac_pl.c
===================================================================
--- libabac/abac_pl.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -11,8 +11,4 @@
 #include "abac_pl_yap.h"
 
-#ifdef DEBUG_IT
-#include "abac_pl_yap_dbg.h"
-#endif
-
 #include "abac_util.h"
 #include "abac_verifier.h"
@@ -22,8 +18,4 @@
 struct _abac_context_t {
     abac_pl_t *pl;
-#ifdef DEBUG_IT
-/* this is just for debugging */
-    abac_pl_yap_dbg_t *dpl;
-#endif
 };
 
@@ -58,9 +50,4 @@
     abac_context_t *ctx = abac_xmalloc(sizeof(abac_context_t));
     ctx->pl = abac_pl_new();
-#ifdef DEBUG_IT
-    if (debug) {
-        ctx->dpl = abac_pl_yap_dbg_new();
-    } else ctx->dpl = NULL;
-#endif
     return ctx;
 }
@@ -71,7 +58,5 @@
 abac_context_t *abac_context_dup(abac_context_t *ctx) {
     assert(ctx != NULL);
-
     abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
-
     return dup;
 }
@@ -85,8 +70,4 @@
 
     abac_pl_free(ctx->pl);
-#ifdef DEBUG_IT
-    if (ctx->dpl)
-        abac_pl_yap_dbg_free(ctx->dpl);
-#endif
     free(ctx);
 }
@@ -234,6 +215,6 @@
 abac_credential_t **abac_context_query(abac_context_t *ctx, char *role, char *principal, int *success) {
     abac_credential_t **credentials = NULL, *cur;
-
-    assert(ctx != NULL); assert(role != NULL); assert(principal != NULL); assert(success != NULL);
+    assert(ctx != NULL); assert(role != NULL);
+    assert(principal != NULL); assert(success != NULL);
 
     abac_stack_t *result = abac_pl_query(ctx->pl, role, principal);
@@ -261,5 +242,6 @@
     credentials[i] = NULL;
 
-    abac_stack_free(result);
+    if(result)
+        abac_stack_free(result);
 
     return credentials;
@@ -270,5 +252,27 @@
  */
 abac_credential_t **abac_context_credentials(abac_context_t *ctx) {
-    assert(ctx != NULL);
+    abac_credential_t **credentials = NULL, *cur;
+    assert(ctx != NULL);
+
+    abac_stack_t *result = abac_pl_credentials(ctx->pl);
+    int size = abac_stack_size(result);
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
+    int i = 0;
+    if(size) {
+        while(i<size) { 
+            cur=(abac_credential_t *) abac_stack_pop(result);
+            /* if not in there yet, add into it */
+            credentials[i++] = cur;
+        } 
+    }
+    credentials[i] = NULL;
+
+    if(result)
+        abac_stack_free(result);
+    return credentials;
 }
 
@@ -287,10 +291,2 @@
 }
 
-#ifdef DEBUG_IT
-// for debugging only
-void abac_context_debug_run(abac_context_t *ctx) {
-    if (ctx) {
-        abac_pl_yap_dbg_run_can(ctx->dpl);
-    }
-}
-#endif
Index: libabac/abac_pl.h
===================================================================
--- libabac/abac_pl.h	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl.h	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -9,8 +9,9 @@
 typedef struct _abac_credential_t abac_credential_t;
 typedef struct _abac_role_t abac_role_t;
+typedef struct _abac_oset_t abac_oset_t;
 typedef struct _abac_id_cert_t abac_id_cert_t;
 
 typedef struct _abac_condition_t abac_condition_t;
-typedef struct _abac_param_t abac_param_t;
+typedef struct _abac_term_t abac_term_t;
 typedef struct _abac_param_list_t abac_param_list_t;
 
@@ -75,4 +76,5 @@
 char *abac_role_linked_role(abac_role_t *role);
 char *abac_role_role_name(abac_role_t *role);
+char *abac_role_role_param_string(abac_role_t *role);
 char *abac_role_principal(abac_role_t *role);
 abac_list_t *abac_role_prereqs(abac_role_t *role);
@@ -82,13 +84,33 @@
 
 char *abac_role_attr_key(abac_role_t *head_role, abac_role_t *tail_role);
+char *abac_role_principal_cn(abac_role_t *role);
 
 /*
- * Operations on params.
+ * Operations on oset
  */
-abac_param_t *abac_param_new(int type, char *name, char *cond);
-void abac_param_free(abac_param_t *ptr);
-abac_param_list_t *abac_param_list_new(abac_param_t *param);
+char *abac_oset_principal_cn(abac_oset_t *oset);
+char *abac_oset_oset_name(abac_oset_t *oset);
+abac_param_list_t *abac_oset_oset_params(abac_oset_t *oset);
+int abac_oset_is_object(abac_oset_t *oset);
+char *abac_oset_object_cn(abac_oset_t *oset);
+char *abac_oset_linked_role(abac_oset_t *oset);
+abac_param_list_t *abac_oset_linked_role_params(abac_oset_t *oset);
+abac_list_t *abac_oset_prereqs(abac_oset_t *tail_oset);
+int abac_oset_is_intersection(abac_oset_t *tail_oset);
+abac_oset_t *abac_oset_intersection_new(char *name, abac_list_t *prereqs);
+abac_oset_t *abac_oset_oset_new(char *principal_name, char *oset_name);
+abac_oset_t *abac_oset_object_new(abac_term_t *object);
+abac_oset_t *abac_oset_linking_new(char *principal_name, char *linked_role_name, char *oset_name);
+
+/*
+ * Operations on term/params.
+ */
+abac_term_t *abac_term_new(int type, char *name, char *cond, void *cptr);
+void abac_term_free(abac_term_t *ptr);
+int abac_term_is_time_type(int);
+char *abac_term_name(abac_term_t *ptr);
+abac_param_list_t *abac_param_list_new(abac_term_t *term);
 abac_param_list_t *abac_param_list_free(abac_param_list_t *ptr);
-abac_param_list_t *abac_param_list_add_param(abac_param_list_t *, abac_param_t *param);
+abac_param_list_t *abac_param_list_add_term(abac_param_list_t *, abac_term_t *term);
 char* abac_param_list_string(abac_param_list_t *ptr);
 char* abac_param_list_string_with_condition(abac_param_list_t *ptr);
Index: libabac/abac_pl_gen.c
===================================================================
--- libabac/abac_pl_gen.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl_gen.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -16,10 +16,9 @@
 // index to generate C1,C2..
 static int cred_count=0;
-extern char* abac_yyfptr;
+extern char* abac_yyfptr_encoded;
 extern int abac_cnt_yy_id_certs();
 extern void abac_free_yy_id_certs();
 extern char *abac_string_yy_id_certs();
-char *abac_role_principal_cn(abac_role_t *role);
-char *abac_type_clauses=NULL;
+char *abac_addon_clauses=NULL;
 
 /***********************************************************************/
@@ -33,5 +32,5 @@
 static char *_compose_cred_list()
 {
-    int i=cred_count;;
+    int i=cred_count;
     if(cred_count==0) return "";
 
@@ -47,5 +46,4 @@
     return clist;
 }
-
 
 /* generate role(p_name, r_name, param..) */
@@ -161,54 +159,182 @@
 
 
-static char *generate_pl_rule_clause(char *head_role_string, abac_role_t *tail_role)
+/* generate oset(p_name, r_name, param..) */
+static char* generate_pl_head_oset_string(abac_oset_t *oset)
+{
+     char *tmp=NULL;
+     char *principalname=abac_oset_principal_cn(oset);
+     char *osetname=abac_oset_oset_name(oset);
+     char *param_string=NULL;
+     int cnt=0;
+
+     /* can not be a linked role */
+     abac_param_list_t *oset_params=abac_oset_oset_params(oset);
+     if(oset_params) {
+        param_string=abac_param_list_string(oset_params);
+     }
+
+     if (param_string != NULL) {
+         cnt=asprintf(&tmp,"oset(%s,%s,%s)", principalname, osetname, param_string);
+         free(param_string);
+         } else {
+             cnt=asprintf(&tmp,"oset(%s,%s)", principalname, osetname);
+     }
+     if(cnt>0)
+        return tmp;
+        else
+           return NULL;
+}
+
+/* generate oset(p_name, r_name, param..) with isMember call ?? */
+static char* generate_pl_tail_oset_string(abac_oset_t *oset)
+{
+     char *tmp;
+/*
+   A.oset <- B
+   A.oset <- Obj
+   A.oset <- B.oset
+   A.oset <- B.role.oset
+*/
+     /* o */
+     if(abac_oset_is_object(oset)) {
+         char *objectname=abac_oset_object_cn(oset);
+         tmp=abac_xstrdup(objectname);
+         return tmp;
+     } else {
+         char *principalname=abac_oset_principal_cn(oset);
+         char *osetname=abac_oset_oset_name(oset);
+         char *linkedname=abac_oset_linked_role(oset);
+
+         char *param_string=NULL;
+         char *linked_param_string=NULL;
+         int cnt=0;
+
+         abac_param_list_t *oset_params=abac_oset_oset_params(oset);
+         if(oset_params) {
+             param_string=abac_param_list_string(oset_params);
+         }
+
+         abac_param_list_t *linked_role_params=abac_oset_linked_role_params(oset);
+         if(linked_role_params) {
+             linked_param_string=abac_param_list_string(linked_role_params);
+         }
+
+         /* b.r.r */
+         if(linkedname!=NULL && osetname!=NULL && principalname!=NULL ) {
+             int fst=_get_next_cred_idx();
+             int snd=_get_next_cred_idx();
+             if(linked_param_string !=NULL) {
+                 if (param_string != NULL) {
+                     cnt=asprintf(&tmp,"isMember(Y,role(%s,%s,%s),C%d),isMember(X,oset(Y,%s,%s),C%d)",
+                                principalname,
+                                linkedname,linked_param_string,fst,
+                                osetname,param_string,snd);
+                     free(param_string);
+                     } else {
+                         cnt=asprintf(&tmp,"isMember(Y,role(%s,%s,%s),C%d),isMember(X,oset(Y,%s),C%d)",
+                                principalname,
+                                linkedname,linked_param_string,fst,
+                                osetname,snd);
+                 }
+                 free(linked_param_string);
+                 } else {
+                     if (oset_params != NULL) {
+                         cnt=asprintf(&tmp,"isMember(Y,role(%s,%s),C%d),isMember(X,oset(Y,%s,%s),C%d)",
+                                principalname,
+                                linkedname,fst,
+                                osetname,param_string,snd);
+                         free(param_string);
+                         } else {
+                             cnt=asprintf(&tmp,"isMember(Y,role(%s,%s),C%d),isMember(X,oset(Y,%s),C%d)",
+                                principalname,
+                                linkedname,fst,
+                                osetname,snd);
+                   }
+             }
+             if(cnt>0)
+                 return tmp;
+                 else
+                     return NULL;
+         } 
+         /* b.r */
+         if(linkedname==NULL && osetname!=NULL && principalname!=NULL ) {
+             int fst=_get_next_cred_idx();
+             if(param_string != NULL) {
+                 cnt=asprintf(&tmp,"isMember(X,oset(%s,%s,%s),C%d)",
+                              principalname, osetname, param_string, fst);
+                 free(param_string);
+                 } else {
+                     cnt=asprintf(&tmp,"isMember(X,oset(%s,%s),C%d)",
+                              principalname, osetname, fst);
+             }
+             if(cnt>0)
+                 return tmp;
+                 else
+                     return NULL;
+         } 
+         /* b */
+         if(linkedname==NULL && osetname==NULL && principalname!=NULL ) {
+             tmp=abac_xstrdup(principalname);
+             return tmp;
+         } 
+
+    }
+    return tmp;
+}
+
+
+/********************************************************************************/
+
+static char *_build_constraint_rule_clause(char *head_string, char *tail_string)
+{
+    /*only,  A.R <- B */
+    char *tmp;
+    int idx=_get_next_cred_idx();
+    asprintf(&tmp, "isMember(%s,%s,C%d)", tail_string,head_string,idx);
+    return tmp;
+}
+
+static char *_build_rule_clause(char *rolename, char *head_string, char *tail_string)
 {
     char *tmp=NULL;
-    char* tail_role_string=NULL;
-    char* rolename=abac_role_role_name(tail_role);
 
     if(rolename == NULL) {
         /* A.R <- B */
-        tail_role_string=generate_pl_tail_role_string(tail_role);
-        if(tail_role_string != NULL) {
-            if(abac_type_clauses==NULL) {
-                asprintf(&tmp, "isMember(%s,%s,['%s'])",
-                         tail_role_string,head_role_string,abac_yyfptr);
-                } else {
-                    asprintf(&tmp, "isMember(%s,%s,['%s']) :- %s",
-                         tail_role_string,head_role_string,abac_yyfptr,
-                         abac_type_clauses);
-                    free(abac_type_clauses);
-                    abac_type_clauses=NULL;
-            }
-            } else { 
-                goto error;
+        if(abac_addon_clauses==NULL) {
+            asprintf(&tmp, "isMember(%s,%s,['%s'])",
+                     tail_string,head_string,abac_yyfptr_encoded);
+            } else {
+                asprintf(&tmp, "isMember(%s,%s,['%s']) :- %s",
+                     tail_string,head_string,abac_yyfptr_encoded,
+                     abac_addon_clauses);
+                free(abac_addon_clauses);
+                abac_addon_clauses=NULL;
         }
         } else {
              /* A.R <- B.R */
              /* A.R <- B.R.R */
-             tail_role_string=generate_pl_tail_role_string(tail_role);
              if (cred_count==0) {
-                 if(abac_type_clauses==NULL) { 
+                 if(abac_addon_clauses==NULL) {
                      asprintf(&tmp,"isMember(X,%s,['%s']):-%s",
-                           head_role_string, abac_yyfptr, tail_role_string);
+                           head_string, abac_yyfptr_encoded, tail_string);
                      } else {
                          asprintf(&tmp,"isMember(X,%s,['%s']):-%s, %s",
-                                 head_role_string, abac_yyfptr,
-                                 tail_role_string, abac_type_clauses);
-                         free(abac_type_clauses);
-                         abac_type_clauses=NULL;
+                                 head_string, abac_yyfptr_encoded,
+                                 tail_string,abac_addon_clauses);
+                         free(abac_addon_clauses);
+                         abac_addon_clauses=NULL;
                  }
                  } else {
                      char *tmp_cred_list=_compose_cred_list();
-                     if(abac_type_clauses == NULL) {
-                         asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L)", 
-                                  head_role_string, tail_role_string,
-                                  abac_yyfptr, tmp_cred_list);
+                     if(abac_addon_clauses == NULL) {
+                         asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L)",
+                                  head_string, tail_string,
+                                  abac_yyfptr_encoded, tmp_cred_list);
                          } else {
-                             asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L), %s", 
-                                  head_role_string, tail_role_string,
-                                  abac_yyfptr, tmp_cred_list, abac_type_clauses);
-                             free(abac_type_clauses);
-                             abac_type_clauses=NULL;
+                             asprintf(&tmp,"isMember(X,%s,L):-%s, %s, appendL([['%s'],%s],L)",
+                                  head_string, tail_string, abac_addon_clauses,
+                                  abac_yyfptr_encoded, tmp_cred_list);
+                             free(abac_addon_clauses);
+                             abac_addon_clauses=NULL;
                      }
                      free(tmp_cred_list);
@@ -216,4 +342,15 @@
              }
     }
+    return tmp;
+}
+
+
+static char *generate_pl_rule_role_clause(char *head_role_string, abac_role_t *tail_role)
+{
+    char *rolename=abac_role_role_name(tail_role);
+    char *tail_role_string=generate_pl_tail_role_string(tail_role);
+    if(rolename == NULL && tail_role_string == NULL) 
+        goto error;
+    char *tmp=_build_rule_clause(rolename,head_role_string, tail_role_string);
     if(tail_role_string) free(tail_role_string);
     return tmp;
@@ -223,4 +360,20 @@
     return NULL;
 }
+
+static char *generate_pl_rule_oset_clause(char *head_oset_string, abac_oset_t *tail_oset)
+{
+    char *osetname=abac_oset_oset_name(tail_oset);
+    char *tail_oset_string=generate_pl_tail_oset_string(tail_oset);
+    if(osetname == NULL && tail_oset_string == NULL) 
+        goto error;
+    char *tmp=_build_rule_clause(osetname,head_oset_string, tail_oset_string);
+    if(tail_oset_string) free(tail_oset_string);
+    return tmp;
+
+error:
+    if(tail_oset_string) free(tail_oset_string);
+    return NULL;
+}
+
 
 static char *_add_string(char *dstr, char *nstr)
@@ -239,6 +392,39 @@
 }
 
-static char *generate_pl_intersecting_clause(char *head_role_string,
-                                                     abac_role_t *tail_role)
+static char *_build_intersecting_clause(char *head_role_string, char *tail_role_string)
+{
+    char *tmp;
+
+    if (cred_count==0) {
+        if(abac_addon_clauses ==NULL) {
+            asprintf(&tmp,"isMember(X,%s,['%s']):-%s",
+                   head_role_string, abac_yyfptr_encoded, tail_role_string);
+            } else {
+                asprintf(&tmp,"isMember(X,%s,['%s']):-%s, %s",
+                       head_role_string, abac_yyfptr_encoded, tail_role_string,
+                       abac_addon_clauses);
+                free(abac_addon_clauses);
+                abac_addon_clauses=NULL;
+        }
+        } else {
+            char *tmp_cred_list=_compose_cred_list();
+            if(abac_addon_clauses ==NULL) {
+                asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L)",
+                                head_role_string, tail_role_string,
+                                abac_yyfptr_encoded, tmp_cred_list);
+                } else {
+                    asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L), %s",
+                                head_role_string, tail_role_string,
+                                abac_yyfptr_encoded, tmp_cred_list,abac_addon_clauses);
+                    free(abac_addon_clauses);
+                    abac_addon_clauses=NULL;
+            }
+            free(tmp_cred_list);
+            cred_count=0;
+    }
+    return tmp;
+}
+
+static char *generate_pl_intersecting_role_clause(char *head_role_string, abac_role_t *tail_role)
 {
     char *tmp=NULL;
@@ -259,46 +445,55 @@
     }
 
-    if (cred_count==0) {
-        if(abac_type_clauses ==NULL) {
-            asprintf(&tmp,"isMember(X,%s,['%s']):-%s",
-                   head_role_string, abac_yyfptr, tail_role_string);
-            } else {
-                asprintf(&tmp,"isMember(X,%s,['%s']):-%s, %s",
-                       head_role_string, abac_yyfptr, tail_role_string,
-                       abac_type_clauses);
-                free(abac_type_clauses);
-                abac_type_clauses=NULL;
-        }
-        } else {
-            char *tmp_cred_list=_compose_cred_list();
-            if(abac_type_clauses ==NULL) {
-                asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L)", 
-                                head_role_string, tail_role_string,
-                                abac_yyfptr, tmp_cred_list);
-                } else {
-                    asprintf(&tmp,"isMember(X,%s,L):-%s, appendL([['%s'],%s],L), %s", 
-                                head_role_string, tail_role_string,
-                                abac_yyfptr, tmp_cred_list,abac_type_clauses);
-                    free(abac_type_clauses);
-                    abac_type_clauses=NULL;
-            }
-            free(tmp_cred_list);
-            cred_count=0;
-    }
+    tmp=_build_intersecting_clause(head_role_string, tail_role_string);
     if(tail_role_string) free(tail_role_string);
     return tmp;
 }
 
+static char *generate_pl_intersecting_oset_clause(char *head_oset_string, abac_oset_t *tail_oset)
+{
+    char *tmp=NULL;
+    char* tail_oset_string=NULL;
+    abac_list_t *list=abac_oset_prereqs(tail_oset);
+    /* A.O <- B.O & C.R.O */
+
+    if (list != NULL) {
+        abac_oset_t *cur;
+        abac_list_foreach(list, cur,
+            char *ntmp=generate_pl_tail_oset_string(cur);
+            if(tail_oset_string==NULL)
+                 asprintf(&tail_oset_string,"%s",ntmp);
+                 else
+                    asprintf(&tail_oset_string,"%s, %s",tail_oset_string,ntmp);
+            free(ntmp);
+        );
+    }
+
+    tmp=_build_intersecting_clause(head_oset_string, tail_oset_string);
+    if(tail_oset_string) free(tail_oset_string);
+    return tmp;
+}
+
 /* generate the yap isMember rule clause for the credential stmt */
-abac_list_t *generate_pl_clauses(abac_role_t *head_role, abac_role_t *tail_role)
+abac_list_t *generate_pl_role_clauses(abac_role_t *head_role, abac_role_t *tail_role)
 {
    char *tmp=NULL;
    abac_list_t *clauses=abac_list_new();
-
+  
    int cnt=abac_cnt_yy_id_certs();
    if(cnt > 0) { /* string it up */
-       abac_type_clauses=abac_string_yy_id_certs();
+       //abac_addon_clauses=abac_string_yy_id_certs();
+       tmp=abac_string_yy_id_certs();
        abac_free_yy_id_certs();
    }
+
+   cnt=abac_cnt_yy_constraints();
+   if(cnt > 0) {
+      char *ntmp=abac_string_yy_constraints();
+      abac_free_yy_constraints();
+      if(tmp)
+          asprintf(&tmp,"%s,%s",tmp,ntmp);
+          else tmp=ntmp;
+   }
+   abac_addon_clauses=tmp; 
 
 /* generate head's role string */
@@ -309,10 +504,11 @@
 /* tail side */
     if(abac_role_is_intersection(tail_role)) {
-       tmp=generate_pl_intersecting_clause(head_role_string, tail_role);
+       tmp=generate_pl_intersecting_role_clause(head_role_string, tail_role);
        } else {
-           tmp=generate_pl_rule_clause(head_role_string, tail_role);
+           tmp=generate_pl_rule_role_clause(head_role_string, tail_role);
     }
     if(tmp==NULL)
         goto error;
+ 
     abac_list_add(clauses,tmp);
     return clauses;
@@ -322,4 +518,98 @@
     return clauses;
 }
+
+abac_list_t *generate_pl_oset_clauses(abac_oset_t *head_oset, abac_oset_t *tail_oset)
+{
+   char *tmp=NULL;
+   abac_list_t *clauses=abac_list_new();
+
+   int cnt=abac_cnt_yy_id_certs();
+   if(cnt > 0) { /* string it up */
+       tmp=abac_string_yy_id_certs();
+       abac_free_yy_id_certs();
+   }
+
+   cnt=abac_cnt_yy_constraints();
+   if(cnt > 0) {
+      char *ntmp=abac_string_yy_constraints();
+      abac_free_yy_constraints();
+      if(tmp)
+          asprintf(&tmp,"%s,%s",tmp,ntmp);
+          else tmp=ntmp;
+   }
+   abac_addon_clauses=tmp; 
+
+/* generate head's oset string */
+    char *head_oset_string=generate_pl_head_oset_string(head_oset);
+    if(head_oset_string == NULL)
+        goto error;
+    
+/* tail side */
+    if(abac_oset_is_intersection(tail_oset)) {
+       tmp=generate_pl_intersecting_oset_clause(head_oset_string, tail_oset);
+       } else {
+           tmp=generate_pl_rule_oset_clause(head_oset_string, tail_oset);
+    }
+    if(tmp==NULL)
+        goto error;
+
+    abac_list_add(clauses,tmp);
+    return clauses;
+
+error:
+    if(head_oset_string) free(head_oset_string);
+    return clauses;
+}
+
+/* should be just 1 */
+char *generate_pl_role_constraint_clause(abac_role_t *head_role, char *tail_string)
+{
+/* generate head's role string */
+    char *head_role_string=generate_pl_head_role_string(head_role);
+    if(head_role_string == NULL)
+        goto error;
+
+/* tail side */
+    char *tmp=_build_constraint_rule_clause(head_role_string, tail_string);
+    if(tmp==NULL)
+        goto error;
+
+    return tmp;
+
+error:
+    if(head_role_string) free(head_role_string);
+    return NULL;
+}
+
+
+
+/* so far, for integer type only */
+char *generate_pl_range_constraint_clause(char *typestr,char *var,char *val,char *op)
+{
+   char *tmp=NULL;
+   asprintf(&tmp,"%s(%s)%s%s",typestr,var,op,val);
+   return tmp;
+}
+
+/* should just be 1 clause */
+char *generate_pl_oset_constraint_clause(abac_oset_t *head_oset,
+char *tail_string)
+{
+/* generate head's oset string */
+    char *head_oset_string=generate_pl_head_oset_string(head_oset);
+    if(head_oset_string == NULL)
+        goto error;
+
+/* tail side */
+    char *tmp=_build_constraint_rule_clause(head_oset_string, tail_string);
+    if(tmp==NULL)
+        goto error;
+
+    return tmp;
+error:
+    if(head_oset_string) free(head_oset_string);
+    return NULL;
+}
+
 
 /* generate the yap isType rule clause for the type,
Index: libabac/abac_pl_yap.c
===================================================================
--- libabac/abac_pl_yap.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl_yap.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -21,8 +21,11 @@
 
 extern char *abac_cn_with_role(abac_role_t *);
-extern abac_list_t *abac_credential_clauses(abac_credential_t *cred);
+extern char *abac_cn_with_oset(abac_oset_t *);
+extern abac_list_t *abac_credential_clauses(abac_credential_t *);
+extern char *abac_id_clause(abac_id_cert_t *);
+
 static int debug=0;
 
-// pl
+// pl -- place holder for now 
 struct _abac_pl_t {
     FILE *fptr;
@@ -56,5 +59,5 @@
 {
     char lstr[]="listing";
-    YAP_Term *eterm;
+    YAP_Term *eterm; /* error term */
 
     printf("\n\n========= yap db (%s)\n",msg);
@@ -164,5 +167,5 @@
 }
 
-/* cases,
+/* cases, 
      ['str']
      ['str1','str2']
@@ -197,5 +200,5 @@
              free(string); 
              if(cred) {
-                 abac_stack_push(credentials, cred);
+                 abac_stack_unique_push(credentials, cred);
                  cnt++;
                  } else {
@@ -211,5 +214,5 @@
                  free(string);
                  if(cred) {
-                     abac_stack_push(credentials, cred);
+                     abac_stack_unique_push(credentials, cred);
                      cnt++;
                      } else {
@@ -224,54 +227,166 @@
 }
 
-/* 2 types 
-      acme.buys_rocket <- coyote (coyote=prin, acme.buys_rocket=role)
-      acme.buys_rocket <- acme.preferred_customer  -- NOT DONE YET */
-static abac_stack_t *_query(abac_pl_t *pl, abac_role_t* role, abac_role_t* role_prin )
+
+static abac_stack_t *_make_yap_query(char *cn_prin, char *cn_rule, char* estring)
 {
     YAP_Term *eterm;
     YAP_Term arg[3];
-    char tmp[2000];
+    char tmp[5000];
     abac_stack_t *cred_list = abac_stack_new();
 
-    if(debug)
-        _show_yap_db("DEBUG:calling within _query");
-
-    char *cn_prin=abac_cn_with_role(role_prin);
-    char *cn_role=abac_cn_with_role(role);
-
-    if(abac_role_role_name(role_prin)!=NULL) {
-        printf("fail, a.r <- b.r query is not implemented yet !!!\n");
-        YAP_Exit(1);
-    }
-
-    if (cn_prin == NULL || cn_role == NULL) {
-        printf("fail, query's call got bad roles.. \n");
-        YAP_Exit(1);
-    }
-    sprintf(tmp,"role(%s,%s)", cn_role, abac_role_role_name(role));
+    if(debug) printf(" the role part(%s)\n", estring);
     arg[0]=YAP_MkAtomTerm(YAP_LookupAtom(cn_prin));
-    arg[1]=YAP_ReadBuffer(tmp,eterm);
+    if(debug) printf(" the principal part(%s)\n", cn_prin);
+    arg[1]=YAP_ReadBuffer(estring,eterm);
     arg[2]=YAP_MkVarTerm();
     YAP_Atom f = YAP_LookupAtom("isMember");
     YAP_Functor func = YAP_MkFunctor(f, 3);
     YAP_Term goal=YAP_MkApplTerm(func, 3, arg);
+
     int rc =YAP_RunGoal( goal );
     if (rc) {
-        printf("success, query call ok.. \n");
-        YAP_WriteBuffer(arg[2], tmp, 2000,YAP_WRITE_HANDLE_VARS);
-        /* printf("    answer : %s(%d)\n", tmp, strlen(tmp)); */
+        printf("YAP query succeed\n");
+        YAP_WriteBuffer(arg[2], tmp, 5000,YAP_WRITE_HANDLE_VARS);
+        if(debug) printf("    query answer : %s\n", tmp);
+        /* this is returned as ['string1','string2'] */
+        _credentials_from_string(cred_list,tmp); 
+/**** XXX somehow this got stuck in yap ???
+        while (YAP_RestartGoal()) {
+            if(debug) printf("another success\n");
+            YAP_WriteBuffer(arg[2], tmp, 5000,YAP_WRITE_HANDLE_VARS);
+            if(debug) printf("    query answer : %s\n", tmp); 
+            _credentials_from_string(cred_list,tmp); 
+        }
+***/
+    } else {
+        printf("YAP query failed\n");
+        /* YAP_Exit(1); */
+    }
+    return cred_list;
+}
+
+/* 2 types 
+      acme.buys_rocket <- coyote (coyote=prin, acme.buys_rocket=role)
+        ==> isMember(coyote,role(acme,buys_rocket), L)
+
+      acme.buys_rocket <- acme.preferred_customer  -- NOT DONE YET */
+static abac_stack_t *_query_with_role(abac_pl_t *pl, abac_role_t* role, abac_role_t* role_prin)
+{
+    char tmp[5000];
+    abac_stack_t *ret=NULL;
+
+    if(1)
+        _show_yap_db("DEBUG:calling within _query_with_role");
+
+    char *cn_prin=abac_cn_with_role(role_prin);
+    char *cn_role=abac_cn_with_role(role);
+
+    if(abac_role_role_name(role_prin)!=NULL) {
+        printf("fail, a.r <- b.r query is not implemented yet !!!\n");
+        YAP_Exit(1);
+    }
+
+    if (cn_prin == NULL || cn_role == NULL) {
+        printf("fail, query's call got bad roles.. \n");
+        YAP_Exit(1);
+    }
+
+    if(debug) printf("printing up the yap query ..\n");
+    char *pstring=abac_role_role_param_string(role);
+    if(pstring) {
+        sprintf(tmp,"role(%s,%s,%s)", cn_role, abac_role_role_name(role),pstring);
+        free(pstring);
+        } else {
+            sprintf(tmp,"role(%s,%s)", cn_role, abac_role_role_name(role));
+    }
+    ret=_make_yap_query(cn_prin,cn_role,tmp);
+    return ret;
+}
+
+static abac_stack_t *_query_with_oset(abac_pl_t *pl, abac_oset_t* oset, abac_oset_t* oset_obj)
+{
+    char tmp[5000];
+    abac_stack_t *ret=NULL;
+
+    if(debug)
+        _show_yap_db("DEBUG:calling within _query_with_oset");
+
+    char *cn_oset=abac_cn_with_oset(oset);
+    /* could be obj or principal */
+    char *cn_prin=NULL;
+    if(abac_oset_is_object(oset_obj)) {
+        cn_prin=abac_oset_object_cn(oset_obj);
+        } else {
+            cn_prin=abac_oset_principal_cn(oset_obj);
+    }
+
+    if(abac_oset_oset_name(oset_obj)!=NULL) {
+        printf("fail, a.o <- b.o query is not implemented yet !!!\n");
+        YAP_Exit(1);
+    }
+
+    if (cn_prin == NULL || cn_oset == NULL) {
+        printf("fail, query's call got bad oset.. \n");
+        YAP_Exit(1);
+    }
+
+    if(debug) printf("printing up the yap query ..\n");
+    char *pstring=abac_oset_oset_param_string(oset);
+    if(pstring) {
+        sprintf(tmp,"oset(%s,%s,%s)", cn_oset, abac_oset_oset_name(oset),pstring);
+        free(pstring);
+        } else {
+            sprintf(tmp,"oset(%s,%s)", cn_oset, abac_oset_oset_name(oset));
+    }
+
+    ret=_make_yap_query(cn_prin,cn_oset,tmp);
+    return ret;
+}
+
+static abac_stack_t *_dump(abac_pl_t *pl)
+{
+    YAP_Term *eterm;
+    YAP_Term arg[3];
+    char tmp[5000];
+    abac_stack_t *cred_list = abac_stack_new();
+
+    if(debug)
+        _show_yap_db("DEBUG:calling within _dump");
+
+    arg[0]=YAP_MkVarTerm();
+    arg[1]=YAP_MkVarTerm();
+    arg[2]=YAP_MkVarTerm();
+    YAP_Atom f = YAP_LookupAtom("isMember");
+    YAP_Functor func = YAP_MkFunctor(f, 3);
+    YAP_Term goal=YAP_MkApplTerm(func, 3, arg);
+
+    int rc =YAP_RunGoal( goal );
+    if (rc) {
+        printf("YAP dump succeed\n");
+        YAP_WriteBuffer(arg[2], tmp, 5000,YAP_WRITE_HANDLE_VARS);
+        if(debug) printf("    dump answer : %s\n", tmp);
         /* this is returned as ['string1','string2'] */
         _credentials_from_string(cred_list,tmp); 
         while (YAP_RestartGoal()) {
-            printf("another success\n");
-            YAP_WriteBuffer(arg[2], tmp, 2000,YAP_WRITE_HANDLE_VARS);
-            /* printf("    answer : %s\n", tmp); */
+            if(debug) printf("another dump success\n");
+            YAP_WriteBuffer(arg[2], tmp, 5000,YAP_WRITE_HANDLE_VARS);
+            if(debug) printf("    dump restart answer : %s\n", tmp);
             _credentials_from_string(cred_list,tmp); 
         }
     } else {
-        printf("fail, query's call is bad.. \n");
-        YAP_Exit(1);
+        printf("YAP _dump query failed\n");
+        /* YAP_Exit(1); */
     }
     return cred_list;
+}
+
+/**
+ * Get all the credentials (attribute/issuer cert pairs) from prolog
+ * (which returns in string form)
+ */
+abac_stack_t *abac_pl_credentials(abac_pl_t *pl)
+{
+    abac_stack_t *ret=_dump(pl);
+    return ret;
 }
 
@@ -280,29 +395,36 @@
 --role acme.preferred_customer --principal coyote
 --role acme.prefer_customer.buy_rockets --principlal coyote
+--oset acme.rockets -- object mrx-21 
+--oset acme.villans -- principal coyote
  */
-abac_stack_t *abac_pl_query(abac_pl_t *pl, char *role_name, char *principal)
-{
-    abac_role_t *role = abac_role_from_string(role_name);
-    abac_role_t *prin_role = abac_role_from_string(principal);
+abac_stack_t *abac_pl_query(abac_pl_t *pl, char *roleoset, char *prinobj)
+{
     abac_stack_t *ret=NULL;
-
-    // give up on bogus roles
-    if (role == NULL || prin_role == NULL) {
+    int len=strlen(roleoset)+strlen(prinobj)+5;
+    char* attr_string=(char *) abac_xmalloc(sizeof(char)*len);
+    sprintf(attr_string,"%s<-%s", roleoset, prinobj);
+
+    if(debug)
+        printf("abac_pl_query, query string is (%s)\n",attr_string);
+
+    /* call into yacc parser */
+    abac_reset_yyfptr(attr_string);
+    abac_yyinit();
+    int rc=yyparse();
+    if (rc) {
+        free(attr_string);
         return NULL;
     }
 
-    ret=_query(pl,role,prin_role);
-
+    if(abac_get_yap_is_oset()) {
+        abac_oset_t *head_oset = abac_get_yap_head_oset();
+        abac_oset_t *tail_oset = abac_get_yap_tail_oset();
+        ret=_query_with_oset(pl,head_oset,tail_oset);
+        } else {
+            abac_role_t *head_role = abac_get_yap_head_role();
+            abac_role_t *tail_role = abac_get_yap_tail_role();
+            ret=_query_with_role(pl,head_role,tail_role);
+    }
     return ret;
-}
-
-/**
- * Get all the credentials (attribute/issuer cert pairs) from prolog
- * (which returns in string form)
- */
-abac_stack_t *abac_pl_credentials(abac_pl_t *pl) {
-    abac_stack_t *credentials = abac_stack_new();
-    /* fix up a stream to stream the credentials from prolog engine */
-    return credentials;
 }
 
Index: libabac/abac_pl_yy.c
===================================================================
--- libabac/abac_pl_yy.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl_yy.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -4,16 +4,19 @@
 #include <string.h>
 #include <stdlib.h>
-
-#include "uthash.h"
+#include <assert.h>
+
 #include "abac_util.h"
-
 #include "abac_pl_yy.h"
 
 static int debug=0;
 
-extern abac_list_t *generate_pl_clauses(abac_role_t *, abac_role_t *);
+extern abac_list_t *generate_pl_role_clauses(abac_role_t *, abac_role_t *);
+extern abac_list_t *generate_pl_oset_clauses(abac_oset_t *, abac_oset_t *);
 extern void panic(char*);
 extern char *generate_pl_type_clause(char *, int);
 void _add_yy_id_certs(char *, int);
+static void _free_yy_oset(abac_yy_oset_t *ptr);
+static void _free_yy_term_data(abac_yy_term_data_t *ptr);
+abac_role_t *validate_head_role(abac_yy_expression_t *expr);
 
 abac_list_t *abac_yap_clauses=NULL;
@@ -21,31 +24,53 @@
 abac_stack_t *abac_yap_id_clauses=NULL;
 
+int abac_yap_is_oset=0;
 abac_role_t *abac_yap_head_role=NULL;
 abac_role_t *abac_yap_tail_role=NULL;
 
-/* XXX do we want to check whether the id cert is preexisting or not */
-/* this is to track id certs within a rule clause */
+abac_oset_t *abac_yap_head_oset=NULL;
+abac_oset_t *abac_yap_tail_oset=NULL;
+
+/* to track id certs within a rule clause */
 typedef struct _abac_yy_id_cert_t {
     char *principalname;
     int type; /* keyidtype */
     char *clause;
-
-    UT_hash_handle hh;
 } abac_yy_id_cert_t;
-
 abac_list_t *abac_yy_id_certs = NULL;
+
+/* structure to hold the range information
+   within a static constraints on few types of
+   oset types 
+   [a..b], [a..], [..b], [a],[a,b],[many a] 
+   e_yy_RANGE_MIN=1;
+   e_yy_RANGE_MAX=2;
+   e_yy_RANGE_TARGET=3;
+*/
+typedef struct _abac_yy_range_t {
+    int type;
+    char *val;
+} abac_yy_range_t;
+
+/* to track role/oset constraint clauses used within a rule clause,
+   collect them up in one place */
+typedef struct _abac_yy_constraint_t {
+    char *clause;
+} abac_yy_constraint_t;
+abac_list_t *abac_yy_constraints = NULL;
 
 /* local principal structure  [keyid:USC] */
 struct _abac_yy_principal_t {
     int type;
-    char *sha;
-    char *cn;
+    char *sha; // sha is null when this is of object type
+    char *cn; 
 };
 
-/* like  [principal:?Z]:..., must match a principal name */
-struct _abac_yy_param_principal_t {
+/* [principal:?Z]:..., must match a principal name */
+struct _abac_yy_term_principal_t {
     int type; /* this needs to be implicitly determined */
     char *name;
     char *condition;
+    void *cptr; // ptr to a saved abac_role_t
+    abac_yy_expression_t *cond_head_expr;
 };
 
@@ -57,21 +82,28 @@
     [int:10]
 */
-struct _abac_yy_param_data_t {
+struct _abac_yy_term_data_t {
     int is_variable;
     int type;
     char *name;
     char *condition;
+    void *cptr; // ptr to a saved abac_oset_t
+    abac_list_t *cond_range;
+    abac_yy_expression_t *cond_head_expr; // parking stub
 };
 
-/* local dterm structure, will distinguish it in the future */
-struct _abac_yy_dterm_t {
+/* local term structure, will distinguish it in the future */
+/* e_yy_DTERM_DATA,      all other types
+   e_yy_DTERM_NAMED,     keyid:bob
+   e_yy_DTERM_PRINCIPAL, principal:?P
+   e_yy_DTERM_ANONYMOUS  ? */
+struct _abac_yy_term_t {
     union {
          abac_yy_principal_t *n_ptr;
-         abac_yy_param_principal_t *p_ptr;
-         abac_yy_param_data_t *d_ptr;
+         abac_yy_term_principal_t *p_ptr;
+         abac_yy_term_data_t *d_ptr;
     } term;
     int type;
-    struct _abac_yy_dterm_t *next;
-    int bcnt; /* this is to track number of dterms in this linked up list */
+    struct _abac_yy_term_t *next;
+    int bcnt; /* this is to track number of terms in this linked up list */
 };
 
@@ -80,19 +112,150 @@
    int type;
    char *name;
-   abac_yy_dterm_t *dterms;
+   abac_yy_term_t *terms;
    struct _abac_yy_role_t *next;
    int bcnt; /* this is to track number of roles in this linked up list */
 };
 
-struct _abac_yy_role_expression_t {
-   int rtype;
-   abac_yy_principal_t *principal;
+/* local oset structure */
+struct _abac_yy_oset_t {
+   int type;
+   char *name;
+   abac_yy_term_t *terms;
+   struct _abac_yy_oset_t *next;
+   int bcnt; /* this is to track number of oset in this linked up list */
+};
+
+/* A, A.r, A.r.r */
+/* type: e_yy_EXPR_NAMED,e_yy_EXPR_ROLE,e_yy_EXPR_LINKED */
+/* A/obj, A.o, A.r.o */
+/* type: e_yy_EXPR_NAMED, e_yy_EXPR_OBJECT, e_yy_EXPR_OSET,e_yy_EXPR_LINKED */
+struct _abac_yy_expression_t {
+   int type;
+   union {
+       abac_yy_principal_t *principal;
+       abac_yy_term_data_t *object;
+   };
    abac_yy_role_t *linked_role;
-   abac_yy_role_t *role;
-   struct _abac_yy_role_expression_t *next;
+   union {
+       abac_yy_role_t *role;
+       abac_yy_oset_t *oset;
+   };
+   struct _abac_yy_expression_t *next;
    int bcnt;
 };
-
-static void _free_yy_dterm(abac_yy_dterm_t *ptr);
+static void _free_yy_term(abac_yy_term_t *ptr);
+
+/************************************************************************/
+static void _free_yy_range(abac_list_t *ptr) 
+{
+    if (ptr != NULL) {
+        abac_yy_range_t *cur;
+        abac_list_foreach(ptr, cur,
+            if(cur && cur->val) free(cur->val);
+            free(cur);
+        );
+        abac_list_free(ptr);
+    }
+}
+
+char *string_yy_cond_range(abac_list_t *ptr)
+{
+    assert(ptr);
+    char *tmp=NULL;
+    char *min=NULL;
+    char *max=NULL;
+    char *val=NULL;
+    int type;
+
+    abac_yy_range_t *cur;
+    abac_list_foreach(ptr, cur,
+        type=cur->type;
+        val=cur->val; 
+        switch (type) {
+            case e_yy_RANGE_MIN:
+                min=strdup(cur->val);
+                break;
+            case e_yy_RANGE_MAX:
+                max=strdup(cur->val);
+                break;
+            case e_yy_RANGE_TARGET:
+                if(val)
+                    asprintf(&val,"%s,%s",val,cur->val);
+                else val=strdup(cur->val);
+                break;
+        }
+    );
+    if(max && min) {
+         asprintf(&tmp,"[%s..%s]",min,max);
+         free(max);
+         free(min);
+         return tmp;
+    }
+    if(max) {
+         asprintf(&tmp,"[..%s]",max);
+         free(max);
+         return tmp;
+    }
+    if(min) {
+         asprintf(&tmp,"[%s..]",min);
+         free(min);
+         return tmp;
+    }
+    if(val) {
+         asprintf(&tmp,"[%s]",val);
+         free(val);
+         return tmp;
+    }
+    return NULL;
+}
+
+abac_list_t *addto_yy_val_range(abac_list_t *ptr, char * val)
+{
+    abac_yy_range_t *range= 
+         (abac_yy_range_t *) abac_xmalloc(sizeof(abac_yy_range_t));
+    range->type=e_yy_RANGE_TARGET;
+    range->val=strdup(val);
+    abac_list_add(ptr, range);
+    return ptr;
+}
+
+static abac_list_t *_addto_yy_range(abac_list_t *ptr, int type, char * val)
+{
+    abac_yy_range_t *range= 
+         (abac_yy_range_t *) abac_xmalloc(sizeof(abac_yy_range_t));
+    range->type=type;
+    range->val=strdup(val);
+    abac_list_add(ptr, range);
+    return ptr;
+}
+
+abac_list_t *make_yy_val_range(char *val)
+{
+    abac_list_t *ptr=abac_list_new();
+    addto_yy_val_range(ptr,val);
+    return ptr;
+}
+
+abac_list_t *make_yy_minmax_range(char *min, char *max)
+{
+    abac_list_t *ptr=abac_list_new();
+    _addto_yy_range(ptr, e_yy_RANGE_MIN, min);
+    _addto_yy_range(ptr, e_yy_RANGE_MAX, max);
+    return ptr;
+}
+
+abac_list_t *make_yy_min_range(char *min)
+{
+    abac_list_t *ptr=abac_list_new();
+    _addto_yy_range(ptr, e_yy_RANGE_MIN, min);
+    return ptr;
+}
+
+abac_list_t *make_yy_max_range(char *max)
+{
+    abac_list_t *ptr=abac_list_new();
+    _addto_yy_range(ptr, e_yy_RANGE_MAX, max);
+    return ptr;
+}
 
 /************************************************************************/
@@ -119,5 +282,5 @@
     if(debug) {
          printf("printing out abac_yap_clauses:\n");
-         abac_print_clauses(abac_yap_clauses);
+         abac_print_clauses(abac_yap_clauses,NULL);
     }
 }
@@ -139,4 +302,9 @@
 }
 
+int abac_get_yap_is_oset()
+{
+   return abac_yap_is_oset;
+}
+
 abac_role_t *abac_get_yap_head_role()
 {
@@ -149,4 +317,15 @@
 }
 
+abac_oset_t *abac_get_yap_head_oset()
+{
+    return abac_yap_head_oset;
+}
+
+abac_oset_t *abac_get_yap_tail_oset()
+{
+    return abac_yap_tail_oset;
+}
+
+/*******************************************************************/
 void abac_init_yy_id_certs()
 {
@@ -164,4 +343,5 @@
     );
     abac_list_free(abac_yy_id_certs);
+    abac_yy_id_certs = NULL;
 }
 
@@ -214,4 +394,53 @@
 
 /****************************************************************************/
+void abac_init_yy_constraints()
+{
+    abac_yy_constraints = abac_list_new();
+}
+
+void abac_free_yy_constraints()
+{
+    abac_yy_constraint_t *cur;
+    abac_list_foreach(abac_yy_constraints, cur,
+        if(cur && cur->clause) 
+            free(cur->clause);
+        free(cur);
+    );
+    abac_list_free(abac_yy_constraints);
+    abac_yy_constraints=NULL;
+}
+
+int abac_cnt_yy_constraints()
+{
+    return abac_list_size(abac_yy_constraints);
+}
+
+char *abac_string_yy_constraints()
+{
+    int first=1;
+    char *tmp=NULL;
+    abac_yy_constraint_t *cur;
+    abac_list_foreach(abac_yy_constraints, cur,
+        if(cur && cur->clause) 
+            if(first) {
+                tmp=abac_xstrdup(cur->clause);
+                first=0;
+                } else {
+                    int cnt=asprintf(&tmp,"%s,%s", tmp, cur->clause);
+            }
+    );
+    return tmp;
+}
+
+abac_yy_constraint_t *abac_add_yy_constraints(char *constraint)
+{
+    abac_yy_constraint_t *ptr=
+        (abac_yy_constraint_t *) abac_xmalloc(sizeof(abac_yy_constraint_t));
+    ptr->clause=strdup(constraint);
+    abac_list_add(abac_yy_constraints, ptr);
+    return ptr;
+}
+
+/****************************************************************************/
 abac_yy_principal_t *make_yy_principal(char *sha, char *cn, int type)
 {
@@ -232,9 +461,21 @@
 }
 
-abac_yy_role_t *make_yy_role(char *name, abac_yy_dterm_t *dterms)
+int get_yy_principal_type(abac_yy_principal_t *ptr)
+{
+    return ptr->type;
+}
+
+char *get_yy_principal_principalname(abac_yy_principal_t *ptr)
+{
+    if(ptr->sha == NULL)
+        return ptr->cn;
+    return ptr->sha;
+}
+
+abac_yy_role_t *make_yy_role(char *name, abac_yy_term_t *terms)
 {
     abac_yy_role_t *ptr=(abac_yy_role_t*)abac_xmalloc(sizeof(abac_yy_role_t));
     ptr->name=abac_xstrdup(name);
-    ptr->dterms=dterms;
+    ptr->terms=terms;
     ptr->next=NULL;
     ptr->bcnt=1;
@@ -245,6 +486,6 @@
 {
     free(ptr->name);
-    if(ptr->dterms)
-        _free_yy_dterm(ptr->dterms);
+    if(ptr->terms)
+        _free_yy_term(ptr->terms);
     if(ptr->next)
         _free_yy_role(ptr->next);
@@ -252,12 +493,20 @@
 }
 
-abac_yy_role_expression_t *make_yy_role_expression(int rtype,
-abac_yy_principal_t *principal, abac_yy_role_t *role, abac_yy_role_t *linked_role)
-{
-    abac_yy_role_expression_t *ptr=
-         (abac_yy_role_expression_t*)abac_xmalloc(sizeof(abac_yy_role_expression_t));
-    ptr->rtype = rtype;
-    ptr->principal = principal;
-    ptr->role = role;
+/* type: e_yy_EXPR_NAMED, e_yy_EXPR_OBJECT, e_yy_EXPR_OSET,e_yy_EXPR_LINKED */
+
+abac_yy_expression_t *make_yy_expression(int type,void *pptr, void *optr, abac_yy_role_t *linked_role)
+{
+    abac_yy_expression_t *ptr=
+         (abac_yy_expression_t*)abac_xmalloc(sizeof(abac_yy_expression_t));
+    ptr->type = type;
+    if(type == e_yy_EXPR_OBJECT) {
+        ptr->object=(abac_yy_term_data_t *)pptr;
+        } else {
+            ptr->principal = (abac_yy_principal_t *)pptr;
+    }
+    if(type == e_yy_EXPR_OSET)
+        ptr->oset = (abac_yy_oset_t *) optr;
+        else
+            ptr->role = (abac_yy_role_t *) optr;
     ptr->linked_role=linked_role;
     ptr->next=NULL;
@@ -266,6 +515,13 @@
 }
 
-abac_yy_role_expression_t *add_yy_role_expression(abac_yy_role_expression_t *nexpr,
-                                               abac_yy_role_expression_t *exprs)
+abac_yy_term_data_t *get_yy_expression_object(abac_yy_expression_t *ptr)
+{
+   if(ptr->type == e_yy_EXPR_OBJECT)
+       return ptr->object;
+   return NULL;
+}
+
+abac_yy_expression_t *add_yy_expression(abac_yy_expression_t *nexpr,
+                                             abac_yy_expression_t *exprs)
 {
     int i=exprs->bcnt;
@@ -275,65 +531,33 @@
 }
 
-
-static void _free_yy_role_expression(abac_yy_role_expression_t *ptr)
-{
-    if(ptr->principal)
-        _free_yy_principal(ptr->principal);
-    if(ptr->role)
-        _free_yy_role(ptr->role);
+static void _free_yy_expression(abac_yy_expression_t *ptr)
+{
+    if(ptr->type == e_yy_EXPR_OBJECT) {
+       if(ptr->object)
+           _free_yy_term_data(ptr->object);
+       } else {
+           if(ptr->principal)
+               _free_yy_principal(ptr->principal);
+    }
+    if(ptr->type == e_yy_EXPR_OSET) {
+        if(ptr->oset) 
+            _free_yy_oset(ptr->oset);
+        } else {
+            if(ptr->role)
+                 _free_yy_role(ptr->role);
+    }
     if(ptr->linked_role)
         _free_yy_role(ptr->linked_role);
     if(ptr->next)
-        _free_yy_role_expression(ptr->next);
+        _free_yy_expression(ptr->next);
 
     free(ptr);
 }
 
-abac_yy_param_data_t *make_yy_param_data(char* name, char* typestr)
-{
-    int type=abac_verify_dterm_type(typestr);
-    abac_yy_param_data_t *ptr=
-              (abac_yy_param_data_t*)abac_xmalloc(sizeof(abac_yy_param_data_t));
+abac_yy_oset_t *make_yy_oset(char *name, abac_yy_term_t *terms)
+{
+    abac_yy_oset_t *ptr=(abac_yy_oset_t*)abac_xmalloc(sizeof(abac_yy_oset_t));
     ptr->name=abac_xstrdup(name);
-    ptr->type=type;
-    ptr->condition=NULL;
-    ptr->is_variable=0;
-    return ptr;
-}
-
-void set_yy_param_data_is_variable(abac_yy_param_data_t *ptr)
-{
-    ptr->is_variable=1;
-}
-
-static void _free_yy_param_data(abac_yy_param_data_t *ptr)
-{
-    free(ptr->name);
-    if(ptr->condition)
-        free(ptr->condition);
-    free(ptr);
-}
-
-abac_yy_param_principal_t *make_yy_param_principal(char* name)
-{
-    abac_yy_param_principal_t *ptr=
-            (abac_yy_param_principal_t*)abac_xmalloc(sizeof(abac_yy_param_principal_t));
-    ptr->name=abac_xstrdup(name);
-    ptr->condition=NULL;
-    return ptr;
-}
-
-static void _free_yy_param_principal(abac_yy_param_principal_t *ptr)
-{
-    free(ptr->name);
-    if(ptr->condition)
-        free(ptr->condition);
-    free(ptr);
-}
-
-abac_yy_dterm_t *make_yy_dterm_anonymous()
-{
-    abac_yy_dterm_t *ptr=(abac_yy_dterm_t*)abac_xmalloc(sizeof(abac_yy_dterm_t));
-    ptr->type = DTERM_ANONYMOUS;
+    ptr->terms=terms;
     ptr->next=NULL;
     ptr->bcnt=1;
@@ -341,92 +565,44 @@
 }
 
-abac_yy_dterm_t *make_yy_dterm_principal(abac_yy_param_principal_t *pptr)
-{
-    abac_yy_dterm_t *ptr=(abac_yy_dterm_t*)abac_xmalloc(sizeof(abac_yy_dterm_t));
-    ptr->type = DTERM_PRINCIPAL;
-    ptr->term.p_ptr=pptr;
-    ptr->next=NULL;
-    ptr->bcnt=1;
-    return ptr;
-}
-
-abac_yy_dterm_t *make_yy_dterm_named(abac_yy_principal_t *nptr)
-{
-    abac_yy_dterm_t *ptr=(abac_yy_dterm_t*)abac_xmalloc(sizeof(abac_yy_dterm_t));
-    ptr->type = DTERM_NAMED;
-    ptr->term.n_ptr=nptr;
-    ptr->next=NULL;
-    ptr->bcnt=1;
-    return ptr;
-}
-
-abac_yy_dterm_t *make_yy_dterm_data(abac_yy_param_data_t *dptr)
-{
-    abac_yy_dterm_t *ptr=(abac_yy_dterm_t*)abac_xmalloc(sizeof(abac_yy_dterm_t));
-    ptr->type = DTERM_DATA;
-    ptr->term.d_ptr=dptr;
-    ptr->next=NULL;
-    ptr->bcnt=1;
-    return ptr;
-}
-
-abac_yy_dterm_t *add_yy_dterm(abac_yy_dterm_t *nterm, abac_yy_dterm_t *dterms)
-{
-    int i=dterms->bcnt;
-    nterm->next=dterms;
-    nterm->bcnt=i+1;
-    return nterm;
-}
-
-static void _free_yy_dterm(abac_yy_dterm_t *ptr)
-{
-    switch (ptr->type) {
-        case DTERM_DATA:
-            _free_yy_param_data(ptr->term.d_ptr);
-            break;
-        case DTERM_NAMED:
-            _free_yy_principal(ptr->term.n_ptr);
-            break;
-        case DTERM_PRINCIPAL:
-            _free_yy_param_principal(ptr->term.p_ptr);
-            break;
-        case DTERM_ANONYMOUS:
-            break;
-    }
+static void _free_yy_oset(abac_yy_oset_t *ptr)
+{
+    free(ptr->name);
+    if(ptr->terms)
+        _free_yy_term(ptr->terms);
     if(ptr->next)
-        _free_yy_dterm(ptr->next);
+        _free_yy_oset(ptr->next);
     free(ptr);
 }
 
-/****************************************************************/
-static void _role_add_dterms(int linked, abac_role_t *role, abac_yy_dterm_t *dterms)
-{
-    abac_yy_dterm_t *curr = dterms;
+/**********************************************************************/
+static void _oset_add_terms(int linked, abac_oset_t *oset, 
+abac_yy_term_t *terms)
+{
+    abac_yy_term_t *curr = terms;
     int type;
     char *name=NULL;
     char *cond=NULL;
+    void *ptr=NULL;
     while (curr) {
         switch (curr->type) {
-           case DTERM_DATA:
+           case e_yy_DTERM_DATA:
            {
-               abac_yy_param_data_t *ptr=curr->term.d_ptr;
+               abac_yy_term_data_t *ptr=curr->term.d_ptr;
                type=ptr->type;
                name=abac_xstrdup(ptr->name);
                cond=abac_xstrdup(ptr->condition);
-               if(ptr->is_variable) {
-/* XXX do some tracking */
-               }
+               ptr=ptr->cptr;
                break;
            }
-           case DTERM_PRINCIPAL:
+           case e_yy_DTERM_PRINCIPAL:
            {
-              abac_yy_param_principal_t *ptr=curr->term.p_ptr;
-              type=abac_verify_dterm_type("principal");
-              name=abac_xstrdup(ptr->name);
-              cond=abac_xstrdup(ptr->condition);
-/* XXX variable one, do some tracking */
-              break;
+               abac_yy_term_principal_t *ptr=curr->term.p_ptr;
+               type=abac_verify_term_type("principal");
+               name=abac_xstrdup(ptr->name);
+               cond=abac_xstrdup(ptr->condition);
+               ptr=ptr->cptr;
+               break;
            }
-           case DTERM_NAMED:
+           case e_yy_DTERM_NAMED:
            {
               abac_yy_principal_t *ptr=curr->term.n_ptr;
@@ -435,32 +611,632 @@
               name=abac_xstrdup(ptr->cn);
               cond=NULL;
+              ptr=NULL;
               break;
            }
-           case DTERM_ANONYMOUS:
+           case e_yy_DTERM_ANONYMOUS:
            {
               type=0;
               name=abac_xstrdup("_");
               cond=NULL;
+              ptr=NULL;
               break;
            }
        }
+
+       abac_term_t *param=abac_term_new(type,name,cond,ptr);
        if (linked) 
-           abac_role_role_add_linked_param(role, type, name, cond);
+           abac_oset_oset_add_linked_param(oset, param);
            else
-                abac_role_role_add_param(role, type, name, cond);
+                abac_oset_oset_add_param(oset, param);
        curr=curr->next;
    }
 }
 
-static void _role_add_linked_dterms(abac_role_t *role, abac_yy_dterm_t *dterms)
+static void _oset_add_linked_terms(abac_oset_t *oset, abac_yy_term_t *terms)
 {
     int linked=1;
-    _role_add_dterms(linked, role, dterms);
-}
-
-static void _role_add_role_dterms(abac_role_t *role, abac_yy_dterm_t *dterms)
+    _oset_add_terms(linked, oset, terms);
+}
+
+static void _oset_add_oset_terms(abac_oset_t *oset, abac_yy_term_t *terms)
 {
     int linked=0;
-    _role_add_dterms(linked, role, dterms);
+    _oset_add_terms(linked, oset, terms);
+}
+
+
+abac_oset_t *validate_intersected_tail_oset(abac_oset_t *oset)
+{
+    abac_oset_t *ret_oset=NULL;
+    abac_list_t *prereqs = abac_list_new();
+    abac_list_add(prereqs, oset);
+    ret_oset = abac_oset_intersection_new("intersectingOSET", prereqs);
+    return ret_oset;
+}
+
+/* A.oset */
+abac_oset_t *validate_head_oset(abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     abac_yy_oset_t *oset=expr->oset;
+    
+     char *principalname=get_yy_principal_principalname(principal);
+     char *osetname=oset->name;
+     abac_yy_term_t *terms=oset->terms;
+
+     abac_oset_t *ret_oset=abac_oset_oset_new(principalname, osetname);
+     if (ret_oset==NULL) {
+         set_error_code(ABAC_RT_ROLE_INVALID);
+         goto error;
+     }
+     if (!abac_oset_is_oset(ret_oset)) {
+         set_error_code(ABAC_RT_CERT_INVALID);
+         goto error;
+     }
+     // insert the params for the oset
+     if(terms) {
+          _oset_add_oset_terms(ret_oset, terms);
+     }
+     _add_yy_id_certs(principal->cn,principal->type);
+
+     return ret_oset;
+
+error:
+     return NULL;
+}
+
+/* B */
+abac_oset_t *validate_named_tail_oset(abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     char *principalname=principal->sha;
+     abac_oset_t *ret_oset=NULL;
+
+     ret_oset = abac_oset_principal_new(principalname);
+
+     _add_yy_id_certs(principal->cn,principal->type);
+
+     if (ret_oset==NULL)
+         goto error;
+     return ret_oset;
+
+error:
+     panic("can not generate a simple named tail oset");
+     return NULL;
+}
+
+
+/* [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] */
+abac_oset_t *validate_object_tail_oset(abac_yy_expression_t *expr)
+{
+     abac_yy_term_data_t *object=get_yy_expression_object(expr);
+     assert(object != NULL);
+
+     char *name=object->name;
+     int type=object->type;
+     char *cond=object->condition;
+     void *ptr=object->cptr;
+     abac_term_t *term=abac_term_new(type,name,cond,ptr);
+     abac_oset_t *ret_oset=abac_oset_object_new(term);
+
+     if(get_yy_term_data_is_variable(object))
+         _add_yy_id_certs(name,type);
+
+     if (ret_oset==NULL)
+         goto error;
+     return ret_oset;
+
+error:
+     panic("can not generate a simple object tail oset");
+     return NULL;
+}
+
+
+/* B.oset */
+abac_oset_t *validate_oset_tail_oset(abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     abac_yy_oset_t *oset=expr->oset;
+
+     char *principalname=principal->sha;
+
+     char *osetname=oset->name;
+     abac_yy_term_t *terms=oset->terms;
+
+     int ret;
+     abac_oset_t *ret_oset=NULL;
+
+     ret_oset = abac_oset_oset_new(principalname, osetname);
+     if (ret_oset==NULL)
+         goto error;
+
+     if(terms) {
+         _oset_add_oset_terms(ret_oset, terms);
+     }
+
+     _add_yy_id_certs(principal->cn,principal->type);
+
+     return ret_oset;
+
+error:
+     panic("can not generate a simple tail oset");
+     return NULL;
+}
+
+/* B.role.oset */
+abac_oset_t *validate_linked_tail_oset(abac_yy_expression_t *expr)
+{
+     abac_yy_principal_t *principal=expr->principal;
+     abac_yy_oset_t *oset=expr->oset;
+     abac_yy_role_t *linked_role=expr->linked_role;
+
+     char *principalname=principal->sha;
+
+     char *osetname=oset->name;
+     abac_yy_term_t *terms=oset->terms;
+
+     char *linkedrolename=linked_role->name;
+     abac_yy_term_t *linked_terms=linked_role->terms;
+
+     int ret;
+     abac_oset_t *ret_oset=abac_oset_linking_new(principalname,
+                                            linkedrolename, osetname);
+     if (ret_oset==NULL)
+         goto error;
+
+     if(linked_terms) {
+         _oset_add_linked_terms(ret_oset, linked_terms);
+     }
+     if(terms) {
+         _oset_add_oset_terms(ret_oset, terms);
+     }
+
+     _add_yy_id_certs(principal->cn,principal->type);
+
+     return ret_oset;
+
+error:
+     panic("can not generate linked tail oset");
+     return NULL;
+}
+
+
+
+abac_list_t *make_oset_statement(abac_yy_expression_t *headexpr,
+                       abac_yy_expression_t *tailexpr) 
+{ 
+    abac_oset_t *head_oset=NULL;
+    abac_oset_t *tail_oset=NULL;
+
+/* build up left side's abac oset structure */
+    head_oset=validate_head_oset(headexpr);
+    if(head_oset == NULL)
+        goto error;
+
+/* build up the right side's abac oset structure */
+    abac_yy_expression_t *curr_tail = tailexpr;
+    int intersecting=(tailexpr->next != NULL)? 1:0;
+    abac_oset_t *curr_oset = NULL;
+        while (curr_tail) {
+            switch(curr_tail->type) {
+                case e_yy_EXPR_OBJECT:
+                    curr_oset=validate_object_tail_oset(curr_tail);
+                    break;
+                case e_yy_EXPR_NAMED:
+                    curr_oset=validate_named_tail_oset(curr_tail);
+                    break;
+                case e_yy_EXPR_OSET:
+                    curr_oset=validate_oset_tail_oset(curr_tail);
+                    break;
+                case e_yy_EXPR_LINKED:
+                    curr_oset=validate_linked_tail_oset(curr_tail);
+                    break;
+            }
+            if(curr_oset==NULL)
+                goto error;
+
+            /* check if first one */
+            if(tail_oset==NULL) {
+                if(intersecting) 
+                    tail_oset=validate_intersected_tail_oset(curr_oset);
+                    else 
+                        tail_oset=curr_oset;
+                } else {  
+                    abac_oset_add_intersecting_oset(tail_oset,curr_oset);
+            }
+            curr_tail=curr_tail->next;
+        } /* while */
+
+/* XXX collect up type clauses, constraint clauses and 
+   generate rule clauses */
+        abac_list_t *tmp=generate_pl_oset_clauses(head_oset,tail_oset);
+        if(tmp == NULL)
+            goto error;
+
+        if(debug) {
+            abac_print_oset_string_with_condition(head_oset,NULL);
+            abac_print_oset_string_with_condition(tail_oset,NULL);
+        }
+
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
+        abac_yap_head_oset=head_oset;
+        abac_yap_tail_oset=tail_oset;
+        abac_yap_is_oset=1;
+        return tmp;
+
+error:
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
+        if(head_oset)
+            abac_oset_free(head_oset);
+        if(tail_oset)
+            abac_oset_free(tail_oset);
+        return NULL;
+}
+
+/***********************************************************************/
+/*
+struct _abac_yy_term_data_t {
+    int is_variable;
+    int type;
+    char *name;
+    char *condition;
+    void *cptr; // ptr to a saved abac_oset_t
+    abac_list_t *cond_range;
+    abac_yy_expression_t *cond_head_expr;
+};
+*/
+
+abac_yy_term_data_t *make_yy_term_data(char* name)
+{
+    abac_yy_term_data_t *ptr=
+              (abac_yy_term_data_t*)abac_xmalloc(sizeof(abac_yy_term_data_t));
+    ptr->name=abac_xstrdup(name);
+    ptr->type=0;
+    ptr->is_variable=0;
+    ptr->condition=NULL;
+    ptr->cond_head_expr=NULL;
+    ptr->cptr=NULL;
+    ptr->cond_range=NULL;
+    return ptr;
+}
+
+abac_list_t *get_yy_term_data_cond_range(abac_yy_term_data_t *ptr)
+{
+    return ptr->cond_range;
+}
+
+char *get_yy_term_data_name(abac_yy_term_data_t *ptr)
+{
+    return ptr->name;
+}
+
+int is_yy_term_data_has_constraint(abac_yy_term_data_t *ptr)
+{
+    if(ptr->cond_head_expr != NULL)
+        return 1;
+/* only select few */
+    if( ptr->cond_range != NULL && abac_term_is_integer_type(ptr->type))
+        return 1;
+    return 0;
+}
+
+void set_yy_term_data_cond_range(abac_yy_term_data_t *ptr,
+abac_list_t *range)
+{
+    ptr->cond_range=range;
+}
+
+void set_yy_term_data_cond_head_expr(abac_yy_term_data_t *ptr,
+abac_yy_expression_t *expr)
+{
+    ptr->cond_head_expr=expr;
+}
+
+abac_yy_expression_t *get_yy_term_data_cond_head_expr(abac_yy_term_data_t *ptr)
+{
+    return ptr->cond_head_expr;
+}
+
+void set_yy_term_data_type(abac_yy_term_data_t *ptr, char* typestr)
+{
+    int type=abac_verify_term_type(typestr);
+    ptr->type=type;
+}
+
+void set_yy_term_data_cptr(abac_yy_term_data_t *ptr, void *vptr)
+{
+    ptr->cptr=vptr;
+}
+
+void set_yy_term_data_condition(abac_yy_term_data_t *ptr, char *cond)
+{
+    ptr->condition=strdup(cond);
+}
+
+void set_yy_term_data_is_variable(abac_yy_term_data_t *ptr)
+{
+    ptr->is_variable=1;
+}
+
+int get_yy_term_data_is_variable(abac_yy_term_data_t *ptr)
+{
+    return ptr->is_variable;
+}
+
+static void _free_yy_term_data(abac_yy_term_data_t *ptr)
+{
+    free(ptr->name);
+    if(ptr->condition)
+        free(ptr->condition);
+    if(ptr->cond_head_expr)
+        _free_yy_expression(ptr->cond_head_expr);
+    if(ptr->cond_range);
+        _free_yy_range(ptr->cond_range);
+    free(ptr);
+}
+
+abac_yy_term_principal_t *make_yy_term_principal(char* name)
+{
+    abac_yy_term_principal_t *ptr=
+            (abac_yy_term_principal_t*)abac_xmalloc(sizeof(abac_yy_term_principal_t));
+    ptr->name=abac_xstrdup(name);
+    ptr->condition=NULL;
+    ptr->cond_head_expr=NULL;
+    return ptr;
+}
+
+void set_yy_term_principal_cptr(abac_yy_term_principal_t *ptr, void *vptr)
+{
+    ptr->cptr=vptr;
+}
+
+void set_yy_term_principal_condition(abac_yy_term_principal_t *ptr, char *cond)
+{
+    ptr->condition=abac_xstrdup(cond);
+}
+
+abac_yy_expression_t *get_yy_term_principal_cond_head_expr(abac_yy_term_principal_t *ptr)
+{
+    return ptr->cond_head_expr;
+}
+
+void set_yy_term_principal_cond_head_expr(abac_yy_term_principal_t *ptr, 
+abac_yy_expression_t *expr)
+{
+    ptr->cond_head_expr=expr;
+}
+
+static void _free_yy_term_principal(abac_yy_term_principal_t *ptr)
+{
+    free(ptr->name);
+    if(ptr->condition)
+        free(ptr->condition);
+    if(ptr->cond_head_expr)
+        _free_yy_expression(ptr->cond_head_expr);
+    free(ptr);
+}
+
+abac_yy_term_t *make_yy_term_dterm_anonymous()
+{
+    abac_yy_term_t *ptr=(abac_yy_term_t*)abac_xmalloc(sizeof(abac_yy_term_t));
+    ptr->type = e_yy_DTERM_ANONYMOUS;
+    ptr->next=NULL;
+    ptr->bcnt=1;
+    return ptr;
+}
+
+abac_yy_term_t *make_yy_term_dterm_principal(abac_yy_term_principal_t *pptr)
+{
+    abac_yy_term_t *ptr=(abac_yy_term_t*)abac_xmalloc(sizeof(abac_yy_term_t));
+    ptr->type = e_yy_DTERM_PRINCIPAL;
+    ptr->term.p_ptr=pptr;
+    ptr->next=NULL;
+    ptr->bcnt=1;
+    return ptr;
+}
+
+abac_yy_term_t *make_yy_term_dterm_named(abac_yy_principal_t *nptr)
+{
+    abac_yy_term_t *ptr=(abac_yy_term_t*)abac_xmalloc(sizeof(abac_yy_term_t));
+    ptr->type = e_yy_DTERM_NAMED;
+    ptr->term.n_ptr=nptr;
+    ptr->next=NULL;
+    ptr->bcnt=1;
+    return ptr;
+}
+
+abac_yy_term_t *make_yy_term_dterm_data(abac_yy_term_data_t *dptr)
+{
+    abac_yy_term_t *ptr=(abac_yy_term_t*)abac_xmalloc(sizeof(abac_yy_term_t));
+    ptr->type = e_yy_DTERM_DATA;
+    ptr->term.d_ptr=dptr;
+    ptr->next=NULL;
+    ptr->bcnt=1;
+    return ptr;
+}
+
+abac_yy_term_t *add_yy_term(abac_yy_term_t *nterm, abac_yy_term_t *terms)
+{
+    int i=terms->bcnt;
+    nterm->next=terms;
+    nterm->bcnt=i+1;
+    return nterm;
+}
+
+static void _free_yy_term(abac_yy_term_t *ptr)
+{
+    switch (ptr->type) {
+        case e_yy_DTERM_DATA:
+            _free_yy_term_data(ptr->term.d_ptr);
+            break;
+        case e_yy_DTERM_NAMED:
+            _free_yy_principal(ptr->term.n_ptr);
+            break;
+        case e_yy_DTERM_PRINCIPAL:
+            _free_yy_term_principal(ptr->term.p_ptr);
+            break;
+        case e_yy_DTERM_ANONYMOUS:
+            break;
+    }
+    if(ptr->next)
+        _free_yy_term(ptr->next);
+    free(ptr);
+}
+
+/****************************************************************/
+/* add the condition to constraint list */
+char *make_yy_oset_constraint(abac_yy_term_data_t *ptr, char *tail_string)
+{
+   abac_yy_expression_t *head_expr=get_yy_term_data_cond_head_expr(ptr);
+   if(head_expr) {
+       abac_oset_t *head_oset=validate_head_oset(head_expr);
+       if(head_oset == NULL)
+           goto error;
+
+       char *tmp=generate_pl_oset_constraint_clause(head_oset,tail_string);
+       set_yy_term_data_condition(ptr,tmp);
+       set_yy_term_data_cptr(ptr,head_oset);
+       abac_add_yy_constraints(tmp);
+       return tmp;
+   }
+   return NULL;
+error:
+   return NULL;
+} 
+/****************************************************************/
+/* add the range condition to constraint list */
+
+void make_yy_range_constraint(abac_yy_term_data_t *ptr, char *var)
+{
+   char *typestr=abac_term_type(ptr->type);
+   abac_list_t *rlist=get_yy_term_data_cond_range(ptr);
+   char *tmplist=NULL;
+   char *tmp=NULL;
+   int is_range=1; /* either , or | */
+   if(rlist) {
+       char *rstring=string_yy_cond_range(rlist);
+       set_yy_term_data_condition(ptr,rstring);
+       abac_yy_range_t *cur;
+     
+       abac_list_foreach(rlist, cur,
+           int type=cur->type;
+           char *val=cur->val; 
+           switch(type) {
+             case e_yy_RANGE_MIN:
+               tmp=generate_pl_range_constraint_clause(typestr,var,val,">");
+               break;
+             case e_yy_RANGE_MAX:
+               tmp=generate_pl_range_constraint_clause(typestr,var,val,"<");
+               break;
+             case e_yy_RANGE_TARGET:
+               tmp=generate_pl_range_constraint_clause(typestr,var,val,"=");
+               int is_range=0;
+               break;
+           }
+           if(tmplist) {
+               if(is_range)
+                   asprintf(&tmplist,"%s,%s",tmplist,tmp);
+                   else
+                       asprintf(&tmplist,"%s;%s",tmplist,tmp);
+               } else {
+                   tmplist=tmp;
+           }
+           tmp=NULL;
+       );
+       asprintf(&tmplist,"(%s)",tmplist);
+       abac_add_yy_constraints(tmplist);
+   }
+}
+
+char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char *tail_string)
+{
+   char *tmp=NULL;
+   abac_role_t *head_role=NULL;
+
+   abac_yy_expression_t *head_expr=get_yy_term_principal_cond_head_expr(ptr);
+/* build up left side's abac role constraint structure */
+   head_role=validate_head_role(head_expr);
+   if(head_role == NULL)
+       goto error;
+
+   tmp=generate_pl_role_constraint_clause(head_role,tail_string);
+   set_yy_term_principal_condition(ptr,tmp);
+   set_yy_term_principal_cptr(ptr,head_role);
+   abac_add_yy_constraints(tmp);
+   return tmp;
+
+error:
+   return NULL;
+}
+
+/****************************************************************/
+static void _role_add_terms(int linked, abac_role_t *role, 
+abac_yy_term_t *terms)
+{
+    abac_yy_term_t *curr = terms;
+    int type;
+    char *name=NULL;
+    char *cond=NULL;
+    void *ptr=NULL;
+    while (curr) {
+        switch (curr->type) {
+           case e_yy_DTERM_DATA:
+           {
+               abac_yy_term_data_t *ptr=curr->term.d_ptr;
+               type=ptr->type;
+               name=abac_xstrdup(ptr->name);
+               cond=abac_xstrdup(ptr->condition);
+               ptr=ptr->cptr;
+               break;
+           }
+           case e_yy_DTERM_PRINCIPAL:
+           {
+              abac_yy_term_principal_t *ptr=curr->term.p_ptr;
+              type=abac_verify_term_type("principal");
+              name=abac_xstrdup(ptr->name);
+              cond=abac_xstrdup(ptr->condition);
+              ptr=ptr->cptr;
+              break;
+           }
+           case e_yy_DTERM_NAMED:
+           {
+              abac_yy_principal_t *ptr=curr->term.n_ptr;
+              type=ptr->type;
+/* XXX should be switching to sha in the future */
+              name=abac_xstrdup(ptr->cn);
+              cond=NULL;
+              ptr=NULL;
+              break;
+           }
+           case e_yy_DTERM_ANONYMOUS:
+           {
+              type=0;
+              name=abac_xstrdup("_");
+              cond=NULL;
+              ptr=NULL;
+              break;
+           }
+       }
+       abac_term_t *param=abac_term_new(type,name,cond,ptr);
+       if (linked) 
+           abac_role_role_add_linked_param(role, param);
+           else
+                abac_role_role_add_param(role, param);
+       curr=curr->next;
+   }
+}
+
+static void _role_add_linked_terms(abac_role_t *role, abac_yy_term_t *terms)
+{
+    int linked=1;
+    _role_add_terms(linked, role, terms);
+}
+
+static void _role_add_role_terms(abac_role_t *role, abac_yy_term_t *terms)
+{
+    int linked=0;
+    _role_add_terms(linked, role, terms);
 }
 
@@ -475,12 +1251,12 @@
 }
 
-abac_role_t *validate_head_role(abac_yy_role_expression_t *expr)
+abac_role_t *validate_head_role(abac_yy_expression_t *expr)
 {
      abac_yy_principal_t *principal=expr->principal;
      abac_yy_role_t *role=expr->role;
 
-     char *principalname=principal->sha;
+     char *principalname=get_yy_principal_principalname(principal);
      char *rolename=role->name;
-     abac_yy_dterm_t *dterms=role->dterms;
+     abac_yy_term_t *terms=role->terms;
      abac_role_t *ret_role=NULL;
 
@@ -495,6 +1271,6 @@
      }
      // insert the params for the role
-     if(dterms) {
-          _role_add_role_dterms(ret_role, dterms);
+     if(terms) {
+          _role_add_role_terms(ret_role, terms);
      }
 
@@ -507,12 +1283,11 @@
 }
 
-abac_role_t *validate_named_tail_role(abac_yy_role_expression_t *expr)
+abac_role_t *validate_named_tail_role(abac_yy_expression_t *expr)
 {
      abac_yy_principal_t *principal=expr->principal;
-     char *principalname=principal->sha;
+     char *principalname=get_yy_principal_principalname(principal);
      abac_role_t *ret_role=NULL;
 
      ret_role = abac_role_principal_new(principalname);
-
      _add_yy_id_certs(principal->cn,principal->type);
 
@@ -526,13 +1301,13 @@
 }
 
-abac_role_t *validate_role_tail_role(abac_yy_role_expression_t *expr)
+abac_role_t *validate_role_tail_role(abac_yy_expression_t *expr)
 {
      abac_yy_principal_t *principal=expr->principal;
      abac_yy_role_t *role=expr->role;
 
-     char *principalname=principal->sha;
+     char *principalname=get_yy_principal_principalname(principal);
 
      char *rolename=role->name;
-     abac_yy_dterm_t *dterms=role->dterms;
+     abac_yy_term_t *terms=role->terms;
 
      int ret;
@@ -543,6 +1318,6 @@
          goto error;
 
-     if(dterms) {
-         _role_add_role_dterms(ret_role, dterms);
+     if(terms) {
+         _role_add_role_terms(ret_role, terms);
      }
 
@@ -556,5 +1331,5 @@
 }
 /* need to validate/generate a linked role out of this */
-abac_role_t *validate_linked_tail_role(abac_yy_role_expression_t *expr)
+abac_role_t *validate_linked_tail_role(abac_yy_expression_t *expr)
 {
      abac_yy_principal_t *principal=expr->principal;
@@ -562,11 +1337,11 @@
      abac_yy_role_t *linked_role=expr->linked_role;
 
-     char *principalname=principal->sha;
+     char *principalname=get_yy_principal_principalname(principal);
 
      char *rolename=role->name;
-     abac_yy_dterm_t *dterms=role->dterms;
+     abac_yy_term_t *terms=role->terms;
 
      char *linkedrolename=linked_role->name;
-     abac_yy_dterm_t *linked_dterms=linked_role->dterms;
+     abac_yy_term_t *linked_terms=linked_role->terms;
 
      int ret;
@@ -577,9 +1352,9 @@
          goto error;
 
-     if(linked_dterms) {
-         _role_add_linked_dterms(ret_role, linked_dterms);
+     if(linked_terms) {
+         _role_add_linked_terms(ret_role, linked_terms);
      }
-     if(dterms) {
-         _role_add_role_dterms(ret_role, dterms);
+     if(terms) {
+         _role_add_role_terms(ret_role, terms);
      }
 
@@ -594,6 +1369,8 @@
 
 
-abac_list_t *make_statement(abac_yy_role_expression_t *headexpr,
-                       abac_yy_role_expression_t *tailexpr) 
+/* build up the abac structure and also create the yap clause
+   and insert it into db */
+abac_list_t *make_role_statement(abac_yy_expression_t *headexpr,
+abac_yy_expression_t *tailexpr) 
 { 
     abac_role_t *head_role=NULL;
@@ -606,16 +1383,16 @@
 
 /* build up the right side's abac role structure */
-    abac_yy_role_expression_t *curr_tail = tailexpr;
+    abac_yy_expression_t *curr_tail = tailexpr;
     int intersecting=(tailexpr->next != NULL)? 1:0;
     abac_role_t *curr_role = NULL;
         while (curr_tail) {
-            switch(curr_tail->rtype) {
-                case EXPR_NAMED:
+            switch(curr_tail->type) {
+                case e_yy_EXPR_NAMED:
                     curr_role=validate_named_tail_role(curr_tail);
                     break;
-                case EXPR_ROLE:
+                case e_yy_EXPR_ROLE:
                     curr_role=validate_role_tail_role(curr_tail);
                     break;
-                case EXPR_LINKED:
+                case e_yy_EXPR_LINKED:
                     curr_role=validate_linked_tail_role(curr_tail);
                     break;
@@ -636,23 +1413,25 @@
         } /* while */
 
-/* collect up type clauses and generate rule clauses */
-        abac_list_t *tmp=generate_pl_clauses(head_role,tail_role);
+/* collect up type clauses, constraint clases and 
+   generate the final rule clauses */
+        abac_list_t *tmp=generate_pl_role_clauses(head_role,tail_role);
         if(tmp == NULL)
             goto error;
 
         if(debug) {
-            abac_print_role_string_with_condition(head_role);
-            abac_print_role_string_with_condition(tail_role);
+            abac_print_role_string_with_condition(head_role,NULL);
+            abac_print_role_string_with_condition(tail_role,NULL);
         }
 
-        _free_yy_role_expression(headexpr);
-        _free_yy_role_expression(tailexpr);
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
         abac_yap_head_role=head_role;
         abac_yap_tail_role=tail_role;
+        abac_yap_is_oset=0;
         return tmp;
 
 error:
-        _free_yy_role_expression(headexpr);
-        _free_yy_role_expression(tailexpr);
+        _free_yy_expression(headexpr);
+        _free_yy_expression(tailexpr);
         if(head_role)
             abac_role_free(head_role);
@@ -661,2 +1440,4 @@
         return NULL;
 }
+
+
Index: libabac/abac_pl_yy.h
===================================================================
--- libabac/abac_pl_yy.h	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_pl_yy.h	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -9,21 +9,30 @@
 
 typedef struct _abac_yy_principal_t abac_yy_principal_t;
-typedef struct _abac_yy_param_principal_t abac_yy_param_principal_t;
-typedef struct _abac_yy_param_data_t abac_yy_param_data_t;
-typedef struct _abac_yy_dterm_t abac_yy_dterm_t;
+typedef struct _abac_yy_term_principal_t abac_yy_term_principal_t;
+typedef struct _abac_yy_term_data_t abac_yy_term_data_t;
+typedef struct _abac_yy_term_t abac_yy_term_t;
 typedef struct _abac_yy_role_t abac_yy_role_t;
-typedef struct _abac_yy_role_expression_t abac_yy_role_expression_t;
+typedef struct _abac_yy_oset_t abac_yy_oset_t;
+typedef struct _abac_yy_expression_t abac_yy_expression_t;
 
 enum expr_rtype {
-    EXPR_NAMED=1,
-    EXPR_ROLE=2,
-    EXPR_LINKED=3
+    e_yy_EXPR_NAMED=1,
+    e_yy_EXPR_ROLE=2,
+    e_yy_EXPR_OSET=3,
+    e_yy_EXPR_LINKED=4,
+    e_yy_EXPR_OBJECT=5
 };
 
 enum dterm_type {
-    DTERM_PRINCIPAL=1,
-    DTERM_NAMED=2,
-    DTERM_DATA=3,
-    DTERM_ANONYMOUS=4
+    e_yy_DTERM_PRINCIPAL=1,
+    e_yy_DTERM_NAMED=2,
+    e_yy_DTERM_DATA=3,
+    e_yy_DTERM_ANONYMOUS=4
+};
+
+enum range_type {
+   e_yy_RANGE_MIN=1,
+   e_yy_RANGE_MAX=2,
+   e_yy_RANGE_TARGET=3 
 };
 
Index: libabac/abac_role.c
===================================================================
--- libabac/abac_role.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_role.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -193,10 +193,10 @@
         return;
 
-    free(role->principal_name);
-    free(role->linked_role_name);
-    free(role->role_name);
-
-    free(role->string);
-    free(role->linked);
+    if(role->principal_name) free(role->principal_name);
+    if(role->linked_role_name) free(role->linked_role_name);
+    if(role->role_name) free(role->role_name);
+
+    if(role->string) free(role->string);
+    if(role->linked) free(role->linked);
 
     if (role->role_params != NULL) {
@@ -219,11 +219,10 @@
 }
 
-abac_role_t *abac_role_role_add_param(abac_role_t *role, int type, char *name, char *cond)
+abac_role_t *abac_role_role_add_param(abac_role_t *role, abac_term_t *param)
 {
-     abac_param_t *param=abac_param_new(type,name,cond);
      if(role->role_params == NULL) {
         role->role_params=abac_param_list_new(param);
         } else {
-            abac_param_list_add_param(role->role_params, param);
+            abac_param_list_add_term(role->role_params, param);
      }
      return role;
@@ -236,11 +235,10 @@
 }
 
-abac_role_t *abac_role_role_add_linked_param(abac_role_t *role, int type, char *name, char *cond)
+abac_role_t *abac_role_role_add_linked_param(abac_role_t *role, abac_term_t *param)
 {
-     abac_param_t *param=abac_param_new(type,name,cond);
      if(role->linked_role_params == NULL) {
         role->linked_role_params=abac_param_list_new(param);
         } else {
-            abac_param_list_add_param(role->linked_role_params, param);
+            abac_param_list_add_term(role->linked_role_params, param);
      }
      return role;
@@ -486,8 +484,10 @@
 }
 
-void abac_print_role_string_with_condition(abac_role_t *role)
+void abac_print_role_string_with_condition(abac_role_t *role,FILE *fp)
 {
     char *string=abac_role_string_with_condition(role);
-    printf("%s",string);
+    if(fp==NULL)
+        printf("%s",string);
+        else fprintf(fp,"%s",string);
 }
 
@@ -499,4 +499,12 @@
     assert(role != NULL);
     return role->role_name;
+}
+
+char *abac_role_role_param_string(abac_role_t *role) {
+    assert(role != NULL);
+    if(role->role_params) {
+         return abac_param_list_string(role->role_params);
+    }
+    return NULL;
 }
 
Index: libabac/abac_rt.h
===================================================================
--- libabac/abac_rt.h	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_rt.h	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -21,4 +21,5 @@
 extern void abac_reset_yyfptr(char *);
 extern char* abac_get_yyfptr();
+extern char* abac_get_yyfptr_encoded();
 
 /* on error code */
Index: libabac/abac_stack.c
===================================================================
--- libabac/abac_stack.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_stack.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -9,4 +9,16 @@
     ret->size = 0;
     return ret;
+}
+
+/* push only if it is not in there still */
+void abac_stack_unique_push(abac_stack_t *stack, void *elt) {
+    if(!stack) return; 
+
+    void *cur;
+    abac_stack_foreach(stack, cur,
+        if(cur == elt)
+            return;
+        );
+    abac_stack_push(stack,elt);
 }
 
@@ -22,4 +34,6 @@
     abac_stack_element_t *cur;
     void *ret;
+   
+    if(!stack) return NULL;
 
     if(stack->size>0) {
@@ -36,9 +50,12 @@
 
 int abac_stack_size(abac_stack_t *stack) {
-    return stack->size;
+    if(stack) return stack->size;
+    return 0;
 }
 
 void abac_stack_free(abac_stack_t *stack) {
     abac_stack_element_t *elt, *tmp;
+
+    if(!stack) return; 
 
     // free everthing in the stack
Index: libabac/abac_stack.h
===================================================================
--- libabac/abac_stack.h	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_stack.h	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -19,4 +19,5 @@
 abac_stack_t *abac_stack_new(void);
 void abac_stack_push(abac_stack_t *stack, void *elt);
+void abac_stack_unique_push(abac_stack_t *stack, void *elt);
 void *abac_stack_pop(abac_stack_t *stack);
 int abac_stack_size(abac_stack_t *stack);
Index: libabac/abac_verifier.c
===================================================================
--- libabac/abac_verifier.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/abac_verifier.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -19,34 +19,27 @@
 extern abac_role_t *abac_get_yap_head_role();
 extern abac_role_t *abac_get_yap_tail_role();
+extern abac_oset_t *abac_get_yap_head_oset();
+extern abac_oset_t *abac_get_yap_tail_oset();
+extern int abac_get_yap_is_oset();
 extern abac_list_t *abac_get_yap_clauses();
+extern char* abac_decode_string(char *);
 
 /* keeping this a fixed enum is to have tighter control of
    what are acceptabletypes of keyid are we allowing */
 enum keyidtype {
-    KEYID = 1
+    e_KEYID = 1
 };
 /* keyidname[keyidtype] */
-static const char *const keyidname[] =
+static char * const keyidname[] =
 {
   "badidtype", "keyid", 0
 };
+
+enum credtype {
+   e_CREDTYPE_ROLE =1,
+   e_CREDTYPE_OSET =2
+};
+
 static int keyidname_cnt=1;
-
-enum dtermtype {
-    INT = 1,
-    URN = 2,
-    FLOAT = 3,
-    BOOLEAN = 4,
-    STRING = 5,
-    TIME = 6,
-    PRINCIPAL = 7,
-    ANONYMOUS = 8
-};
-/* dtermname[dtermtype] */
-static const char *const dtermname[] =
-{
-  "baddterm", "int", "urn", "float", "boolean", "string", "time" , "principal", "anonymous", 0
-};
-static int dtermname_cnt=8;
 
 struct _abac_id_cert_t {
@@ -60,8 +53,9 @@
 };
 
-
+/* can store either role or oset */
 struct _abac_credential_t {
-    abac_role_t *head;
-    abac_role_t *tail;
+    int type;
+    void *head;
+    void *tail;
     certificate_t *cert;
     certificate_t *issuer;
@@ -83,18 +77,27 @@
 static int debug=0;
 static void check_id_cert(abac_id_cert_t *id_cert);
-extern void abac_print_role_string_with_condition(abac_role_t *role);
+extern void abac_print_role_string_with_condition(abac_role_t *role, FILE*);
 
 //
-void abac_print_cred_info(abac_credential_t *cred)
-{
+void abac_print_cred_info(abac_credential_t *cred, FILE *fp)
+{
+    if(fp == NULL)
+        fp=stdout;
+
     if(debug) {
-        printf("---> printing out credential info cred(%d)..\n", (int) cred);
+        fprintf(fp,"---> printing out credential info cred(%d)..\n", (int) cred);
         if(cred->head) {
-            printf("  head role(%d):\n",(int)cred->head);
-            abac_print_role_string_with_condition(cred->head);
+            fprintf(fp,"  head cred(%d):\n",(int)cred->head);
+            if(cred->type == e_CREDTYPE_ROLE)
+               abac_print_role_string_with_condition((abac_role_t*)cred->head,fp);
+               else
+                   abac_print_oset_string_with_condition((abac_oset_t*)cred->head,fp);
         }
         if(cred->tail) {
-            printf("  tail role(%d):\n",(int)cred->tail);
-            abac_print_role_string_with_condition(cred->tail);
+            fprintf(fp,"\n  tail cred(%d):\n",(int)cred->tail);
+            if(cred->type == e_CREDTYPE_ROLE)
+                abac_print_role_string_with_condition((abac_role_t*)cred->tail,fp);
+                else
+                    abac_print_oset_string_with_condition((abac_oset_t*)cred->tail,fp);
         }
 
@@ -103,15 +106,19 @@
             char *cur=NULL;
             abac_list_foreach(clauses, cur,
-                printf("  a clause(%d):\n",(int)cur);
+                fprintf(fp,"\n  a clause(%d):\n",(int)cur);
                 if(cur)
-                    printf ("strlen(%d)loc(%d)(%s)\n", strlen(cur),(int)cur, cur);
+                    fprintf(fp,"strlen(%d)loc(%d)(%s)\n", strlen(cur),(int)cur, cur);
             );
         }
         } else {
-            printf(" ");
-            abac_print_role_string_with_condition(cred->head);
-            printf(" <- ");
-            abac_print_role_string_with_condition(cred->tail);
-            printf("\n");
+            fprintf(fp," ");
+            if(cred->type == e_CREDTYPE_ROLE)
+                abac_print_role_string_with_condition((abac_role_t *)cred->head,fp);
+                else abac_print_oset_string_with_condition((abac_oset_t *)cred->head,fp);
+            fprintf(fp," <- ");
+            if(cred->type == e_CREDTYPE_ROLE)
+                abac_print_role_string_with_condition((abac_role_t *)cred->tail,fp);
+                else abac_print_oset_string_with_condition((abac_oset_t *)cred->tail,fp);
+            fprintf(fp,"\n");
    }
 }
@@ -133,16 +140,4 @@
 {
     return keyidname[i];
-}
-
-int abac_verify_dterm_type(char *type) {
-    int i;
-
-    if (type == NULL)
-        return 0;
-
-    for (i = 1; i <= dtermname_cnt ; i++)
-        if(strcmp(type,dtermname[i])==0)
-            return i;
-    return 0;
 }
 
@@ -262,5 +257,5 @@
     id_cert->cn = cn;
     /* XXX default it to it now */
-    id_cert->type = KEYID;
+    id_cert->type = e_KEYID;
     id_cert->clause = generate_pl_type_clause(cn, id_cert->type);
 
@@ -290,5 +285,4 @@
  * Load an attribute cert as string.
  * have minimum syntax & validity check
-XXXX
  */
 static int _load_attribute_string(char* attr_string) {
@@ -333,52 +327,28 @@
 
 
-void abac_print_clauses(abac_list_t *clauses)
+void abac_print_clauses(abac_list_t *clauses, FILE *fp)
 {
     if (clauses != NULL) {
         char *cur;
         abac_list_foreach(clauses, cur,
-            if(cur)
-                printf ("a clause, %d(%s)\n", (int)cur,cur);
+            if(cur) {
+                if(fp)
+                    fprintf (fp,"a clause, %d(%s)\n", (int)cur,cur);
+                    else printf ("a clause, %d(%s)\n", (int)cur,cur);
+            }
         );
     }
 }
 
-/**
- * Load an attribute cert.
- * Returns true only if the certificate is valid and is issued by the proper
- * authority.
- */
-static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
-    ietf_attributes_t *attr_cert = NULL;
+static int _verify_valid_role_credential(certificate_t *cert,
+abac_credential_t **cred_ret, char *encoded_attr_string)
+{
     abac_role_t *head_role = NULL;
     abac_role_t *tail_role = NULL;
     abac_list_t *clauses=NULL;
     abac_id_cert_t *issuer;
-    char *attr_string_copy;
     int ret, i;
 
     // get the attr
-    ac_t *ac = (ac_t *)cert;
-    attr_cert = ac->get_groups(ac);
-    if (attr_cert == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    char *attr_string = attr_cert->get_string(attr_cert);
-    if (attr_string == NULL) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
-
-    /* call into yacc parser */
-    attr_string_copy = strdup(attr_string);
-    abac_reset_yyfptr(attr_string_copy);
-    abac_yyinit();
-    int rc=yyparse();
-    if (rc) {
-        ret = ABAC_CERT_INVALID;
-        goto error;
-    }
     head_role = abac_get_yap_head_role();
     tail_role = abac_get_yap_tail_role();
@@ -402,4 +372,5 @@
     // at this point we know we have a good attribute cert
     abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
+    cred->type= e_CREDTYPE_ROLE;
     cred->head = head_role;
     cred->tail = tail_role;
@@ -413,7 +384,116 @@
     abac_str_cred_t *str_cred;
     str_cred=abac_xmalloc(sizeof(abac_str_cred_t));
-    str_cred->strid=attr_string_copy;
+    str_cred->strid=strdup(encoded_attr_string);
     str_cred->cred=cred;
     HASH_ADD_KEYPTR(hh, str_creds, str_cred->strid, strlen(str_cred->strid), str_cred);
+
+    return ABAC_CERT_SUCCESS;
+
+error:
+    if (head_role) abac_role_free(head_role);
+    if (tail_role) abac_role_free(tail_role);
+    abac_free_yap_clauses();
+
+    return ret;
+}
+
+static int _verify_valid_oset_credential(certificate_t *cert,
+abac_credential_t **cred_ret, char *encoded_attr_string)
+{
+    abac_oset_t *head_oset = NULL;
+    abac_oset_t *tail_oset = NULL;
+    abac_list_t *clauses=NULL;
+    abac_id_cert_t *issuer;
+    int ret, i;
+
+    // get the attr
+    head_oset = abac_get_yap_head_oset();
+    tail_oset = abac_get_yap_tail_oset();
+    clauses = abac_get_yap_clauses();
+
+    // get the issuer based on keyid
+    char *principalname = abac_oset_principal(head_oset);
+    HASH_FIND_STR(id_certs, principalname, issuer);
+    if (issuer == NULL) {
+        ret = ABAC_CERT_MISSING_ISSUER;
+        goto error;
+    }
+
+    // make sure the issuer's signed it
+    ret = _verify_signature(issuer->cert, cert);
+    if (!ret) {
+        set_error_code(ABAC_RT_CERT_BAD_SIG);
+        goto error;
+    }
+
+    // at this point we know we have a good attribute cert
+    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
+    cred->type= e_CREDTYPE_OSET;
+    cred->head = head_oset;
+    cred->tail = tail_oset;
+    cred->cert = cert;
+    cred->issuer = issuer->cert->get_ref(issuer->cert);
+    cred->clauses = clauses;
+    cred->refcount = 1;
+    *cred_ret = cred;
+
+    // success, add the key to the map of certificates
+    abac_str_cred_t *str_cred;
+    str_cred=abac_xmalloc(sizeof(abac_str_cred_t));
+    str_cred->strid=strdup(encoded_attr_string);
+    str_cred->cred=cred;
+    HASH_ADD_KEYPTR(hh, str_creds, str_cred->strid, strlen(str_cred->strid), str_cred);
+
+    return ABAC_CERT_SUCCESS;
+
+error:
+    if (head_oset) abac_oset_free(head_oset);
+    if (tail_oset) abac_oset_free(tail_oset);
+    abac_free_yap_clauses();
+
+    return ret;
+}
+/**
+ * Load an attribute cert.
+ * Returns true only if the certificate is valid and is issued by the proper
+ * authority.
+ */
+static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
+    ietf_attributes_t *attr_cert = NULL;
+    abac_id_cert_t *issuer;
+    int ret, i;
+
+    // get the attr
+    ac_t *ac = (ac_t *)cert;
+    attr_cert = ac->get_groups(ac);
+    if (attr_cert == NULL) {
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    char *encoded_attr_string=attr_cert->get_string(attr_cert);
+    char *attr_string = abac_decode_string(encoded_attr_string);
+    if(debug)
+         printf("string to be yyparse..(%s)\n",attr_string);
+
+    if (attr_string == NULL) {
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    /* call into yacc parser */
+    abac_reset_yyfptr(attr_string);
+    abac_yyinit();
+    int rc=yyparse();
+    if (rc) {
+        ret = ABAC_CERT_INVALID;
+        goto error;
+    }
+
+    if(abac_get_yap_is_oset()) {
+        ret=_verify_valid_oset_credential(cert,cred_ret,encoded_attr_string);
+        } else {
+            ret=_verify_valid_role_credential(cert,cred_ret,encoded_attr_string);
+    }
 
     // free up some crap
@@ -425,9 +505,4 @@
     if (cert) cert->destroy(cert);
     if (attr_cert) attr_cert->destroy(attr_cert);
-    if (head_role) abac_role_free(head_role);
-    if (tail_role) abac_role_free(tail_role);
-    if (attr_string_copy) free(attr_string_copy);
-    abac_free_yap_clauses();
-
     return ret;
 }
@@ -490,18 +565,4 @@
 
 /**
- * Return the head role.
- */
-abac_role_t *abac_credential_head(abac_credential_t *cred) {
-    return cred->head;
-}
-
-/**
- * Return the tail role.
- */
-abac_role_t *abac_credential_tail(abac_credential_t *cred) {
-    return cred->tail;
-}
-
-/**
  * Return the encoding of the attribute cert.
  */
@@ -571,6 +632,11 @@
         return;
 
-    abac_role_free(cred->head);
-    abac_role_free(cred->tail);
+    if(cred->type == e_CREDTYPE_ROLE) {
+        abac_role_free((abac_role_t *)cred->head);
+        abac_role_free((abac_role_t *)cred->tail);
+        } else {
+            abac_oset_free((abac_oset_t *)cred->head);
+            abac_oset_free((abac_oset_t *)cred->tail);
+    }
     cred->cert->destroy(cred->cert);
     cred->issuer->destroy(cred->issuer); // reference counted
@@ -607,2 +673,9 @@
 }
 
+/* retrieve the cn that is associated with the principal of this oset */
+char *abac_cn_with_oset(abac_oset_t *oset) {
+
+    char *principal = abac_oset_principal(oset);
+    return abac_cn_with_sha(principal);
+}
+
Index: libabac/options.c
===================================================================
--- libabac/options.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/options.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -12,5 +12,9 @@
         "        --keystore <keystore> \\\n"
         "        --role <keyid.role> --principal <keyid>\n"
-        "    loads the keystore and runs the query role <-?- principal\n",
+        "        --oset <keyid.oset> --object <otype>\n"
+        "    loads the keystore and runs the query role <-?- principal\\\n"
+        "                                the query oset <-?- object\\\n"
+        "        --dump <file> \n"
+        "    extracts all credentials from the prolog db\n",
         name
     );
@@ -22,8 +26,14 @@
 #define OPT_ROLE        2
 #define OPT_PRINCIPAL   3
+#define OPT_DUMP        4
+#define OPT_OSET        5
+#define OPT_OBJECT      6
     struct option options[] = {
         { "keystore",   1, 0, OPT_KEYSTORE  },
         { "role",       1, 0, OPT_ROLE      },
         { "principal",  1, 0, OPT_PRINCIPAL },
+        { "dump",       1, 0, OPT_DUMP },
+        { "oset",       1, 0, OPT_OSET },
+        { "object",     1, 0, OPT_OBJECT },
         { 0 },
     };
@@ -44,4 +54,13 @@
                 opts->principal = strdup(optarg);
                 break;
+            case OPT_DUMP:
+                opts->filename = strdup(optarg);
+                break;
+            case OPT_OSET:
+                opts->oset = strdup(optarg);
+                break;
+            case OPT_OBJECT:
+                opts->object = strdup(optarg);
+                break;
 
             default:
@@ -50,5 +69,9 @@
     }
 
-    if (!(opts->keystore && opts->role && opts->principal))
+    if (!(opts->keystore && 
+                 ((opts->role && opts->principal && !opts->oset) ||
+                 (opts->oset && opts->principal && !opts->role) ||
+                 (opts->oset && opts->object && !opts->role) )) &&
+                         !(opts->filename))
         _usage(argv[0]);
 }
Index: libabac/options.h
===================================================================
--- libabac/options.h	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/options.h	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -10,4 +10,7 @@
     char *role;
     char *principal;
+    char *filename;
+    char *oset;
+    char *object;
 } options_t;
 
Index: libabac/prover_yap.c
===================================================================
--- libabac/prover_yap.c	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/prover_yap.c	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -2,4 +2,5 @@
 #include <err.h>
 #include <stdio.h>
+#include <assert.h>
 
 
@@ -8,9 +9,10 @@
 #include "options.h"
 
-extern void abac_print_cred_info(abac_credential_t *);
+extern void abac_print_cred_info(abac_credential_t*, FILE*);
 
 int main(int argc, char **argv) {
-    int i, success;
-    abac_credential_t *cred;
+    int i, success=0;
+    abac_credential_t *cred=NULL;
+    abac_credential_t **credentials=NULL;
 
     options_t opts = { 0, };
@@ -18,21 +20,55 @@
     abac_context_t *ctx = abac_context_new();
     abac_context_load_directory(ctx, opts.keystore);
-    abac_credential_t **credentials = abac_context_query(ctx,
-        opts.role, opts.principal,
-        &success
-    );
+
+    if(opts.filename) { 
+        credentials = abac_context_credentials(ctx);
+        FILE *fp=fopen(opts.filename,"w+");
+
+        if (credentials != NULL) {
+            for (i = 0; credentials[i] != NULL; ++i) {
+                cred = credentials[i];
+                abac_print_cred_info(cred,fp);
+            }
+            abac_context_credentials_free(credentials);
+        }
+        fclose(fp);
+        return 0;
+    }
+
+    char *query=NULL;
+    char *with=NULL;
+    if(opts.role && opts.principal) {
+        query=opts.role;
+        with=opts.principal;
+        } else {
+            if(opts.oset) {
+                query=opts.oset;
+            } else if(opts.principal) {
+                with=opts.principal;
+            } else if(opts.object) {
+                with=opts.object;
+            } else {
+                puts("XXXX eeekkk \n");
+                assert(0);
+            }
+    }
+    credentials = abac_context_query(ctx,
+                            query, with,
+                            &success);
     if (success)
         puts("prover success!!");
+        else puts("prover failed!!");
 
-    if (credentials != NULL)
+    if (credentials != NULL && success) {
         puts("credentials needed :");
         for (i = 0; credentials[i] != NULL; ++i) {
-            cred = credentials[i];
-            abac_print_cred_info(cred);
+           cred = credentials[i];
+           abac_print_cred_info(cred,NULL);
         }
-
-    abac_context_credentials_free(credentials);
+    }
+    if(credentials)
+        abac_context_credentials_free(credentials);
     abac_context_free(ctx);
-
+    
     return 0;
 }
Index: libabac/rt2.l
===================================================================
--- libabac/rt2.l	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/rt2.l	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -1,8 +1,18 @@
-%{
+%option stack
+%x BOOLEAN_S
+%x INTEGER_S 
+%x FLOAT_S
+%x TIME_S
+%x URN_S
+%x STRING_S
+%x KEYID_S
+%x RANGE_S
+
+%top{
 #include <stdio.h>
 #include <string.h>
 #include "rt2.h"
 
-static int debug=0;
+static int debug=1;
 
 /* with yacc */
@@ -14,4 +24,8 @@
 char INPUT_LINE[] = "usc.playground <- usc.employee.friend";
 char *yyfptr = INPUT_LINE; /* default */
+char *yyfptr_encoded=NULL;
+static void yy_push_state(int);
+static void yy_pop_state();
+extern char* abac_encode_string(char *);
 
 #undef YY_INPUT
@@ -30,10 +44,145 @@
     }
 
+}
+
+DIGIT    [0-9]
+ID	 [a-z][a-z0-9]*
+
+%%
+\.           { if(debug) fprintf(yyout, " DOT " );
+             return DOT; }
+keyid        { yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," KEYTYPE ");
+             return KEYTYPE; }
+<KEYID_S>[a-zA-Z0-9][a-zA-Z0-9]* {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," KEYID_CONSTANT ");
+             return KEYID_CONSTANT; }
+oset         { if(debug) fprintf(yyout," OSET ");
+             return OSET; }
+role         { if(debug) fprintf(yyout," ROLE ");
+             return ROLE; }
+principal    { if(debug) fprintf(yyout," PRINCIPAL ");
+             return PRINCIPAL; }
+integer      { yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(INTEGER) ");
+             return OTYPE; }
+<INTEGER_S>[0-9]+ {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(INTEGER) ");
+             return OTYPE_CONSTANT; }
+<INTEGER_S>[-][0-9]+ { 
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(INTEGER) ");
+             return OTYPE_CONSTANT; }
+boolean      { yylval.string =strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(BOOLEAN) ");
+             return OTYPE; }
+<BOOLEAN_S>true|false {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(BOOLEAN) ");
+             return OTYPE_CONSTANT; }
+<BOOLEAN_S,INTEGER_S,FLOAT_S,URN_S,STRING_S,TIME_S>[?][A-Z][_a-zA-Z0-9]* { 
+             yylval.string=strdup(yytext+1);
+             if(debug) fprintf(yyout," VARIABLE_CONSTANT(%s) ",yylval.string);
+             return VARIABLE_CONSTANT; }
+<BOOLEAN_S,INTEGER_S,FLOAT_S,URN_S,STRING_S,TIME_S>\[ { 
+             if(debug) fprintf(yyout," LSQUARE ");
+             return LSQUARE; }
+<BOOLEAN_S,INTEGER_S,FLOAT_S,URN_S,STRING_S,TIME_S>\] { 
+             if(debug) fprintf(yyout," RSQUARE ");
+             return RSQUARE; }
+<BOOLEAN_S,INTEGER_S,FLOAT_S,URN_S,STRING_S,TIME_S>\: { 
+             if(debug) fprintf(yyout," COLON ");
+             return COLON; }
+float        { yylval.string =strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(FLOAT) ");
+             return OTYPE; }
+<FLOAT_S>-[0-9]+"."[0-9]+ | 
+<FLOAT_S>[0-9]+"."[0-9]+ |
+<FLOAT_S>[0-9]+ |
+<FLOAT_S>-[0-9]+ {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(FLOAT) ");
+             return OTYPE_CONSTANT; }
+time         { yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(TIME) ");
+             return OTYPE; }
+<TIME_S>{DIGIT}{DIGIT}*"T"{DIGIT}* {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(TIME) ");
+             return OTYPE_CONSTANT; }
+urn          { yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(URN) ");
+             return OTYPE; }
+<URN_S>[']([^']|\\')*['] |
+<URN_S>["]([^"]|\")*["] {
+             yylval.string=strdup(yytext); 
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(URN)(%s) ",yylval.string);
+             return OTYPE_CONSTANT; }
+string       { yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," OTYPE(STRING) ");
+             return OTYPE; }
+<STRING_S>[']([^']|\\')*['] |
+<STRING_S>["]([^"]|\")*["] {
+             yylval.string=strdup(yytext); 
+             if(debug) fprintf(yyout," OTYPE_CONSTANT(STRING)(%s) ", yylval.string);
+             return OTYPE_CONSTANT; }
+<RANGE_S>\[ { 
+             if(debug) fprintf(yyout," LSQUARE ");
+             return LSQUARE; }
+<RANGE_S>\] { 
+             if(debug) fprintf(yyout," RSQUARE ");
+             return RSQUARE; }
+<RANGE_S>\.\. { 
+             if(debug) fprintf(yyout," DOTDOT ");
+             return DOTDOT; }
+<RANGE_S>[0-9]+ | 
+<RANGE_S>-[0-9]+ |
+<RANGE_S>[0-9]+T[0-9]+ {
+             yylval.string=strdup(yytext);
+             if(debug) fprintf(yyout," VALUE(%s) ",yylval.string);
+             return VALUE; }
+[a-zA-Z0-9][_a-zA-Z0-9]* { 
+             yylval.string=strdup(yytext); 
+             if(debug) fprintf(yyout," IDEN(%s) ", yylval.string);
+             return IDEN; }
+\<-          { if(debug) fprintf(yyout," DERIVE ");
+             return DERIVE; }
+&            { if(debug) fprintf(yyout, " AND " );
+             return AND; }
+,            { if(debug) fprintf(yyout, " COMMA ");
+             return COMMA; }
+\(           { if(debug) fprintf(yyout, " LPAREN ");
+             return LPAREN; }
+\)           { if(debug) fprintf(yyout, " RPAREN ");
+             return RPAREN; }
+\[           { if(debug) fprintf(yyout, " LSQUARE ");
+             return LSQUARE; }
+\]           { if(debug) fprintf(yyout, " RSQUARE ");
+             return RSQUARE; }
+\{           { if(debug) fprintf(yyout, " LWIGGLE ");
+             return LWIGGLE; }
+\}           { if(debug) fprintf(yyout, " RWIGGLE ");
+             return RWIGGLE; }
+\:           { if(debug) fprintf(yyout, " COLON ");
+             return COLON; }
+\?           { if(debug) fprintf(yyout, " QMARK ");
+             return QMARK; }
+\n           { /* ignore end-of-line */; }
+[ \t]+       { /* ignore whitespace */; }
+%%
+
 void abac_reset_yyfptr(char *str) {
     yyfptr=str;
+    yyfptr_encoded=abac_encode_string(str);
 }
 
 char* abac_get_yyfptr() {
     return yyfptr;
+}
+
+char *abac_get_yyfptr_encoded() {
+    return yyfptr_encoded;
 }
 
@@ -65,39 +214,68 @@
 }
 
-/* XXX need to add param's possible format and break it out from IDEN next */
-%}
-%%
-keyid                       { yylval.string=strdup(yytext);
-                              if(debug) fprintf(yyout," KEYTYPE ");
-                              return KEYTYPE; }
-role                        { if(debug) fprintf(yyout," ROLE ");
-                              return ROLE; }
-principal                   { if(debug) fprintf(yyout," PRINCIPAL ");
-                              return PRINCIPAL; }
-[a-zA-Z0-9][_a-zA-Z0-9]*    { yylval.string=strdup(yytext); 
-                              if(debug) fprintf(yyout," IDEN ");
-                                return IDEN; }
-\<-                         { if(debug) fprintf(yyout," DERIVE ");
-                                return DERIVE; }
-\.                          { if(debug) fprintf(yyout, " DOT " );
-                                return DOT; }
-&                           { if(debug) fprintf(yyout, " AND " );
-                                return AND; }
-,                           { if(debug) fprintf(yyout, " COMMA ");
-                                return COMMA; }
-\(                          { if(debug) fprintf(yyout, " LPAREN ");
-                                return LPAREN; }
-\)                          { if(debug) fprintf(yyout, " RPAREN ");
-                                return RPAREN; }
-\[                          { if(debug) fprintf(yyout, " LSQUARE ");
-                                return LSQUARE; }
-\]                          { if(debug) fprintf(yyout, " RSQUARE ");
-                                return RSQUARE; }
-\:                          { if(debug) fprintf(yyout, " COLON ");
-                                return COLON; }
-\?                          { if(debug) fprintf(yyout, " QMARK ");
-                                return QMARK; }
-\n                          { /* ignore end-of-line */; }
-[ \t]+                      { /* ignore whitespace */; }
-%%
-
+void abac_yy_push_keyid_state()
+{
+    if(debug) fprintf(yyout, "\n push keyid state\n");
+    yy_push_state(KEYID_S);
+}
+
+void abac_yy_push_range_state()
+{
+    if(debug) fprintf(yyout, "\n push range state\n");
+    yy_push_state(RANGE_S);
+}
+
+char* abac_yy_get_state_string(int t)
+{
+    switch (t) {
+     case BOOLEAN_S: return strdup("boolean");
+     case INTEGER_S: return strdup("integer");
+     case FLOAT_S: return strdup("float");
+     case TIME_S: return strdup("time");
+     case URN_S: return strdup("urn");
+     case STRING_S: return strdup("string");
+     default: return strdup("dumdum");
+   }
+}
+
+void abac_yy_push_state(char *str)
+{
+   if(strcmp(str,"boolean")==0) {
+      if(debug) fprintf(yyout, "\n push boolean state\n");
+      yy_push_state(BOOLEAN_S);
+      return;
+   }
+   if(strcmp(str,"integer")==0) {
+      if(debug) fprintf(yyout, "\n push integer state\n");
+      yy_push_state(INTEGER_S);
+      return;
+   }
+   if(strcmp(str,"float")==0) {
+      if(debug) fprintf(yyout, "\n push float state\n");
+      yy_push_state(FLOAT_S);
+      return;
+   }
+   if(strcmp(str,"time")==0) {
+      if(debug) fprintf(yyout, "\n push time state\n");
+      yy_push_state(TIME_S);
+      return;
+   }
+   if(strcmp(str,"urn")==0) {
+      if(debug) fprintf(yyout, "\n push urn state\n");
+      yy_push_state(URN_S);
+      return;
+   }
+   if(strcmp(str,"string")==0) {
+      if(debug) fprintf(yyout, "\n push string state\n");
+      yy_push_state(STRING_S);
+      return;
+   }
+   
+   if(debug) fprintf(yyout, "eek.. lost in push_state\n");
+}
+
+void abac_yy_pop_state()
+{
+   if(debug) fprintf(yyout, " pop a state\n");
+   yy_pop_state();
+}
Index: libabac/rt2.y
===================================================================
--- libabac/rt2.y	(revision a9494ad1c5e523f94b0d172045537662de58fd54)
+++ libabac/rt2.y	(revision da5afdf4d61c978dbd17b9d6f20e5a45dcab870a)
@@ -1,23 +1,6 @@
 
 /* bison grammar rules for process new rt1 statements */
-
 /*
-   [keyid:isi].role:employee <- [keyid:ted]
-   [keyid:ted].role:friend <- [keyid:mike]
-   [keyid:usc].role:employee <- [keyid:isi].role:employee
-   [keyid:usc].role:playground <- [keyid:usc].role:employee.role:friend
-   query,
-      [keyid:isi].role:playground <- [keyid:?Z]
-      [keyid:isi].role:playground <- [keyid:mike]
-
-USC.evaluatorOf(this)<-USC.managerOf(this)
-USC.managerOf(this)<-USC.employee
-ISI.managerOf(Maryann) <- John
-USC.employee <- ISI.employee
-ISI.employee  <- Maryann
-ISI.employee <- John
-
-USC.employee <-?- John
-USC.evaluatorOf(Maryann)<-?- John
+    [keyid:A].oset:r <- [urn:'file://dir/filename']
 */
 
@@ -32,4 +15,5 @@
 #include "abac_pl_yy.h"
 
+/* lex tie-ins flag */
 int yyerror (char *s);
 
@@ -37,4 +21,5 @@
 FILE *abac_yyout = NULL;
 char *abac_yyfptr = NULL;
+char *abac_yyfptr_encoded = NULL;
 
 static int sz_overhead = 0;
@@ -43,23 +28,33 @@
 void panic(char *msg);
  
+/* lex tie-ins functions*/
 extern void set_yap_clauses(abac_list_t *);
-extern abac_list_t *make_statement(abac_yy_role_expression_t *,
-           abac_yy_role_expression_t *);
-extern abac_yy_role_expression_t *make_yy_role_expression(int,
-           abac_yy_principal_t *, abac_yy_role_t *, abac_yy_role_t *);
+extern abac_list_t *make_role_statement(abac_yy_expression_t *,
+           abac_yy_expression_t *);
+extern abac_list_t *make_oset_statement(abac_yy_expression_t *,
+           abac_yy_expression_t *);
+extern abac_yy_expression_t *make_yy_expression(int,
+           void *, void *, abac_yy_role_t *);
 extern abac_yy_principal_t *make_yy_principal(char *, char *, int);
-extern abac_yy_role_t *make_yy_role(char *, abac_yy_dterm_t *);
-extern abac_yy_param_data_t *make_yy_param_data(char*, int);
-extern abac_yy_param_principal_t *make_yy_param_principal(char*);
-extern abac_yy_dterm_t *make_yy_dterm_anonymous();
-extern abac_yy_dterm_t *make_yy_dterm_principal(abac_yy_param_principal_t *);
-extern abac_yy_dterm_t *make_yy_dterm_named(abac_yy_principal_t *);
-extern abac_yy_dterm_t *make_yy_dterm_data(abac_yy_param_data_t *);
+extern abac_yy_role_t *make_yy_role(char *, abac_yy_term_t *);
+extern abac_yy_term_data_t *make_yy_term_data(char*);
+extern abac_yy_term_principal_t *make_yy_term_principal(char*);
+extern abac_yy_term_t *make_yy_term_dterm_anonymous();
+extern abac_yy_term_t *make_yy_term_dterm_principal(abac_yy_term_principal_t *);
+extern abac_yy_term_t *make_yy_term_dterm_named(abac_yy_principal_t *);
+extern abac_yy_term_t *make_yy_term_dterm_data(abac_yy_term_data_t *);
 extern char *abac_cn_with_sha(char*);
-extern abac_yy_dterm_t *add_yy_dterm(abac_yy_dterm_t *, abac_yy_dterm_t *);
-extern abac_yy_role_expression_t *add_yy_role_expression(
-                abac_yy_role_expression_t *, abac_yy_role_expression_t *);
-extern void set_yy_param_data_is_variable(abac_yy_param_data_t *);
+extern abac_yy_term_t *add_yy_term(abac_yy_term_t *, abac_yy_term_t *);
+extern abac_yy_expression_t *add_yy_expression(
+                abac_yy_expression_t *, abac_yy_expression_t *);
+extern void set_yy_term_data_is_variable(abac_yy_term_data_t *);
+extern void set_yy_term_data_type(abac_yy_term_data_t *,char*);
 extern void abac_init_yy_id_certs();
+extern void abac_init_yy_constraints();
+extern void make_yy_range_constraint(abac_yy_term_data_t *ptr, char*);
+extern char *make_yy_oset_constraint(abac_yy_term_data_t *ptr, char*);
+extern char *make_yy_role_constraint(abac_yy_term_principal_t *ptr, char*);
+
+
 
 %}
@@ -67,27 +62,46 @@
 %union {
 struct _abac_yy_principal_t *pstruct;
-struct _abac_yy_param_principal_t *ppstruct;
-struct _abac_yy_param_data_t *pdstruct;
+struct _abac_yy_term_principal_t *ppstruct;
+struct _abac_yy_term_data_t *pdstruct;
 struct _abac_yy_role_t *rstruct;
-struct _abac_yy_dterm_t *dstruct;
-struct _abac_yy_role_expression_t *estruct;
+struct _abac_yy_oset_t *ostruct;
+struct _abac_yy_term_t *dstruct;
+struct _abac_yy_expression_t *estruct;
 struct abac_list_t *lstruct;
 char *string;   /* For returning char strings */
+int intval; /* for returning some value */
 }
+
+%start input
+
 %type <lstruct> stmt
 %type <rstruct> rolepart 
-%type <estruct> left 
-%type <estruct> right 
+%type <estruct> roleleft 
+%type <estruct> roleright 
 %type <estruct> roleterm 
+%type <ostruct> osetpart 
+%type <estruct> osetleft 
+%type <estruct> osetright 
+%type <estruct> osetterm 
 %type <pstruct> keypart
-%type <dstruct> dterms
-%type <dstruct> dterm
+%type <dstruct> terms
+%type <dstruct> term
 %type <pdstruct> typedpart
+%type <pdstruct> otypetail
 %type <ppstruct> principalpart
-
-%token <string> IDEN            /* keyname or rolename */
-%token <string> ROLE            /* the word, role */
-%token <string> PRINCIPAL       /* the word, principal */
-%token <string> KEYTYPE         /* keyid | or something else */
+%type <lstruct> rangetype
+%type <lstruct> values
+
+%token <string> IDEN                /* keyname or rolename */
+%token <string> CAPIDEN             /* variable name */
+%token <string> ROLE                /* the word, role */
+%token <string> OSET                /* the word, oset */
+%token <string> PRINCIPAL           /* the word, principal */
+%token <string> OTYPE               /* integer,boolean,urn,time,string,float */
+%token <string> OTYPE_CONSTANT      
+%token <string> VARIABLE_CONSTANT   /* constant for ?AAA */
+%token <string> KEYTYPE             /* keyid | or something else */
+%token <string> KEYID_CONSTANT      /* keyid | or something else */
+%token <string> VALUE               /* range value in static constraint */
 
 %token  <operator>  DERIVE    "<-"
@@ -98,4 +112,6 @@
 %token  <operator>  LSQUARE   "["
 %token  <operator>  RSQUARE   "]"
+%token  <operator>  LWIGGLE   "{"
+%token  <operator>  RWIGGLE   "}"
 %token  <operator>  LANGLE    "<"
 %token  <operator>  RANGLE    ">"
@@ -103,4 +119,5 @@
 %token  <operator>  COMMA     ","
 %token  <operator>  QMARK     "?"
+%token  <operator>  DOTDOT    ".."
 
 %%
@@ -109,17 +126,18 @@
 input:      /* empty */
              { }
-        | stmt 
+     | stmt 
              {  
                set_yap_clauses($1);
              }
+     ;
  
 /* generate/concate prolog credentials clauses */
-stmt : left DERIVE right
-             { 
-               abac_yy_role_expression_t *headexpr=$1;
-               abac_yy_role_expression_t *tailexpr=$3;
-               abac_list_t *ret=make_statement(headexpr, tailexpr);
+stmt : roleleft DERIVE roleright
+             { 
+               abac_yy_expression_t *headexpr=$1;
+               abac_yy_expression_t *tailexpr=$3;
+               abac_list_t *ret=make_role_statement(headexpr, tailexpr);
                if(ret == NULL) {
-                   panic("unable to parse the rule statment");
+                   panic("unable to parse the role rule statment");
                    YYERROR;
                    } else {
@@ -127,24 +145,42 @@
                }
              }
+     | osetleft DERIVE osetright
+             { 
+               abac_yy_expression_t *headexpr=$1;
+               abac_yy_expression_t *tailexpr=$3;
+               abac_list_t *ret=make_oset_statement(headexpr, tailexpr);
+               if(ret == NULL) {
+                   panic("unable to parse the oset rule statment");
+                   YYERROR;
+                   } else {
+                       $$=ret;
+               }
+             }
+     ;
 /*
    [keyid:isi].role:modifyBy([keyid:mike])
    [keyid:acme].role:preferred
 */
-left : keypart DOT rolepart
+roleleft : keypart DOT rolepart
              { 
                abac_yy_principal_t *keypart=$1;
                abac_yy_role_t *rolepart=$3;
-               abac_yy_role_expression_t *expr=
-                         make_yy_role_expression(EXPR_ROLE,keypart,rolepart,NULL);
-               $$=expr;
-             }
+               abac_yy_expression_t *expr=
+                    make_yy_expression(e_yy_EXPR_ROLE,keypart,rolepart,NULL);
+               $$=expr;
+             }
+     ;
 
 /* [keyid:mike] */
-keypart : LSQUARE KEYTYPE COLON IDEN RSQUARE 
-             { 
-               char *cn=abac_cn_with_sha($4);
+keypart : LSQUARE KEYTYPE COLON
+             { abac_yy_push_keyid_state(); }
+          KEYID_CONSTANT
+             { abac_yy_pop_state(); }
+          RSQUARE 
+             { 
+               char *cn=abac_cn_with_sha($5);
                int idtype=abac_verify_keyid_type($2);
                if(cn && idtype)  {
-                 $$=make_yy_principal($4, cn, idtype);
+                 $$=make_yy_principal($5, cn, idtype);
                  } else {
                    panic("encountered an invalid SHA id");
@@ -152,4 +188,5 @@
                }
              }
+     ;
 /* 
    role:modifyBy([keyid:mike],[keyid:ted])
@@ -157,12 +194,13 @@
    role:preferred
 */
-rolepart : ROLE COLON IDEN LPAREN dterms RPAREN
+rolepart : ROLE COLON IDEN LPAREN terms RPAREN
              { 
                $$=make_yy_role($3,$5);
              }
-       | ROLE COLON IDEN
+     | ROLE COLON IDEN
              { 
                $$=make_yy_role($3,NULL);
              }
+     ;
 
 /*
@@ -175,62 +213,122 @@
    [?]
 */
-dterms : dterm COMMA dterms
-             {
-               abac_yy_dterm_t *nterm=$1;
-               abac_yy_dterm_t *dterms=$3;
-               $$=add_yy_dterm(nterm, dterms);
-             }
-      | dterm
+terms : term COMMA terms
+             {
+               abac_yy_term_t *nterm=$1;
+               abac_yy_term_t *terms=$3;
+               $$=add_yy_term(nterm, terms);
+             }
+     | term
              {
                $$=$1;
              }
-
-/* XX need to handdle principal:?X dterm ??? */
-dterm : LSQUARE QMARK RSQUARE 
-             { $$= make_yy_dterm_anonymous(); }
-      | keypart 
-             { $$= make_yy_dterm_named($1); }
-      | principalpart
-             { $$= make_yy_dterm_principal($1); }
-      | typedpart
-             { $$= make_yy_dterm_data($1); }
-
-typedpart : LSQUARE IDEN COLON IDEN RSQUARE 
-             {
-               int type=abac_verify_dterm_type($2); 
-               if (type) {
-                 $$ = make_yy_param_data($4, type); 
-                 } else {
-                   panic("wrong type in data dterm!!");
-                   YYERROR;
+     ;
+
+term : LSQUARE QMARK RSQUARE 
+             { $$= make_yy_term_dterm_anonymous(); }
+     | keypart 
+             { $$= make_yy_term_dterm_named($1); }
+     | principalpart
+             { $$= make_yy_term_dterm_principal($1); }
+     | typedpart
+             { $$= make_yy_term_dterm_data($1); }
+     ;
+
+values : VALUE COMMA values
+             { $$=addto_yy_val_range($3, $1); }
+       |  VALUE
+             { $$=make_yy_val_range($1); }
+       ;
+      
+
+rangetype : LSQUARE VALUE DOTDOT VALUE RSQUARE 
+             { $$=make_yy_minmax_range($2,$4); }
+          |  LSQUARE DOTDOT VALUE RSQUARE 
+             { $$=make_yy_max_range($3); }
+          |  LSQUARE VALUE DOTDOT RSQUARE 
+             { $$=make_yy_min_range($2); }
+          |  LSQUARE values RSQUARE
+             { $$=$2; }
+          ;
+
+/* [otype:?Z:{oset-constraint}] */
+/* [int:?I:[10 .. 20] */
+otypetail : | VARIABLE_CONSTANT COLON 
+             { 
+               abac_yy_pop_state();
+               abac_yy_push_range_state();
+             }
+            rangetype 
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_is_variable(ptr);
+              set_yy_term_data_cond_range(ptr,$4);
+              $$=ptr;
+            }
+     | VARIABLE_CONSTANT 
+            { abac_yy_pop_state(); }
+            osetleft 
+            {
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_cond_head_expr(ptr,$3);
+              set_yy_term_data_is_variable(ptr);
+              $$=ptr;
+            }
+     | VARIABLE_CONSTANT
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              set_yy_term_data_is_variable(ptr);
+              $$=ptr;
+            }
+     | OTYPE_CONSTANT
+            {
+              abac_yy_pop_state();
+              abac_yy_term_data_t *ptr=make_yy_term_data($1);
+              $$=ptr;
+            }
+     ;
+
+typedpart  : LSQUARE OTYPE COLON 
+             { abac_yy_push_state($2); }
+             otypetail RSQUARE
+             { 
+               abac_yy_term_data_t *ptr=$5;
+               char *tail_string=get_yy_term_data_name(ptr);
+               set_yy_term_data_type(ptr,$2);
+               if(is_yy_term_data_has_constraint(ptr)) {
+                  make_yy_oset_constraint(ptr,tail_string);
+                  make_yy_range_constraint(ptr,tail_string);
                }
-             }
-       | LSQUARE IDEN COLON QMARK IDEN RSQUARE 
-             {
-               int type=abac_verify_dterm_type($2); 
-               if (type) {
-                 abac_yy_param_data_t *ptr=make_yy_param_data($5, type); 
-                 set_yy_param_data_is_variable(ptr);
-                 $$=ptr;
-                 } else {
-                   panic("wrong type in data dterm!!");
-                   YYERROR;
-               }
-             }
+               $$=$5;
+             }
+     ; 
+
 
 /* [principal:?Z] */
-principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN RSQUARE 
-             {
-               $$ = make_yy_param_principal($5); 
-             }
-
-right : roleterm AND right
-             { 
-               abac_yy_role_expression_t *nexpr=$1;
-               abac_yy_role_expression_t *exprs=$3;
-               $$=add_yy_role_expression(nexpr,exprs);
-             }
-      | roleterm
+/* [principal:?Z{role-constraint}] */
+principalpart : LSQUARE PRINCIPAL COLON QMARK IDEN roleleft RSQUARE 
+                { 
+                  abac_yy_expression_t *expr=$6;
+                  char *tail_string=$5;
+                  abac_yy_term_principal_t *ptr=make_yy_term_principal(tail_string);
+                  set_yy_term_principal_cond_head_expr(ptr,expr);
+                  char *string=make_yy_role_constraint(ptr,tail_string);
+                  $$=ptr;
+                }
+              | LSQUARE PRINCIPAL COLON QMARK IDEN RSQUARE 
+                { $$ = make_yy_term_principal($5); }
+     ;
+
+roleright : roleterm AND roleright
+             { 
+               abac_yy_expression_t *nexpr=$1;
+               abac_yy_expression_t *exprs=$3;
+               $$=add_yy_expression(nexpr,exprs);
+             }
+     | roleterm
              { $$=$1; }
+     ;
 
 /* role at tail/right side 
@@ -244,24 +342,93 @@
                abac_yy_role_t *linked_rolepart=$3;
                abac_yy_role_t *rolepart=$5;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_LINKED,keypart,rolepart,linked_rolepart);
-               $$=expr;
-             }
-      | keypart DOT rolepart
+               abac_yy_expression_t *expr=
+                  make_yy_expression(e_yy_EXPR_LINKED,keypart,rolepart,linked_rolepart);
+               $$=expr;
+             }
+     | keypart DOT rolepart
              { 
                abac_yy_principal_t *keypart=$1;
                abac_yy_role_t *rolepart=$3;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_ROLE,keypart,rolepart,NULL);
-               $$=expr;
-             }
-      | keypart
-             { 
-               abac_yy_principal_t *keypart=$1;
-               abac_yy_role_expression_t *expr=
-                   make_yy_role_expression(EXPR_NAMED,keypart,NULL,NULL);
-               $$=expr;
-             }
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_ROLE,keypart,rolepart,NULL);
+               $$=expr;
+             }
+     | keypart
+             { 
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
+               $$=expr;
+             }
+     ;
+
+osetterm : keypart DOT rolepart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_role_t *linked_rolepart=$3;
+               abac_yy_oset_t *osetpart=$5;
+               abac_yy_expression_t *expr=
+                  make_yy_expression(e_yy_EXPR_LINKED,keypart,osetpart,linked_rolepart);
+               $$=expr;
+             }
+     | keypart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_oset_t *osetpart=$3;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
+               $$=expr;
+             }
+     | keypart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_NAMED,keypart,NULL,NULL);
+               $$=expr;
+             }
+     | typedpart 
+             {
+               abac_yy_term_data_t *objpart=$1;
+               abac_yy_expression_t *expr=
+                   make_yy_expression(e_yy_EXPR_OBJECT,objpart,NULL,NULL);
+               $$=expr;
+             }
+     ;
+
+/*
+   oset:access([urn:'fileA'])
+*/
+osetpart : OSET COLON IDEN LPAREN terms RPAREN
+             {
+               $$=make_yy_oset($3,$5);
+             }
+     | OSET COLON IDEN
+             {
+               $$=make_yy_oset($3,NULL);
+             }
+     ;
+
+
+osetleft : keypart DOT osetpart
+             {
+               abac_yy_principal_t *keypart=$1;
+               abac_yy_oset_t *osetpart=$3;
+               abac_yy_expression_t *expr=
+                    make_yy_expression(e_yy_EXPR_OSET,keypart,osetpart,NULL);
+               $$=expr;
+             }
+     ;
+
+osetright : osetterm AND osetright
+             {
+               abac_yy_expression_t *nexpr=$1;
+               abac_yy_expression_t *exprs=$3;
+               $$=add_yy_expression(nexpr,exprs);
+             }
+     | osetterm
+             { $$=$1; }
+     ;
 %%
+
 
 /* Additional C code */
@@ -283,7 +450,9 @@
     abac_yyout=abac_get_yyout();
     abac_yyfptr = abac_get_yyfptr();
+    abac_yyfptr_encoded = abac_get_yyfptr_encoded();
     sz_overhead = strlen(abac_yyfptr)+2000;
     abac_init_yap_id_clauses();
     abac_init_yy_id_certs();
+    abac_init_yy_constraints();
 } 
 
