Redmine#5776: pluck all the cp and dcp bodies
Redmine#5776: remove sync_cp usage due to conflicts
Added some more new variables to the "new section":
 * sys.logdir
 * sys.piddir
pass the exact lenght of release_id in to xstrndup to avoid memory corruption on aix
Merge pull request #1724 from McAtte/loading-aix-xstrndup

pass the exact length of release_id to xstrndup
Redmine #5864: Users promises: Work around group setting bug on SUSE.

If you set the same group as a secondary group, which is already the
primary group of the user, the group will not be set. This might be
expected behavior, but the problem is that it also happens if you
change the primary group at the same time.

Work around the issue by setting the primary group first, together
with an empty secondary group list, and then setting the secondary
group list afterwards.
Merge pull request #1725 from kacfengine/suse_group_setting_bug

Redmine #5864: Users promises: Work around group setting bug on SUSE.
Make help string for --show-vars accurate.

The output includes variables discovered by the agent, and those
defined in policy that do not have a dependency to user-defined
classes (as those are evaluated after variables).
Remove redundant test. It is 100% identical to 101.cf.
Add: Example for users promise type, used in docs
Merge pull request #1726 from nickanderson/redmine/5872

Add: Example for users promise type, used in docs
examples/readtcp.cf: adjust example URL
Force method compliance from skipped to kept if callee bundle is skipped

Close #5762
Fix corner case in JSON escaped string parsing.

Add a few more unit tests. Redmine #5773
Redmine#5776: pluck more edit_line bodies and adjust tests
Serverd now fails handshake from early on, if no client certificate is presented by the peer.
Beatify source.
tls_generic_test now creates a different directory on each run.

Previously every time it failed we had to manually remove the
/tmp/tls_test directory, else it failed with different errors when
rerunning the test!
Update tls_generic_test.
Fortify the TLS handshake callback.

Up to now the TLS handshake callback was always returning success, and
key checks were performed manually after a small identification
dialog. Today this is still the case, with some extra checks in the
handshake.

The reason is that the same callback is used not only for the initial
handshake, but for any "TLS renegotiation" handshake. During such a
handshake, either the client or the server can change almost every
parameter of the secure session, even their certificates. For our custom
usage of the TLS protocol this shouldn't be an issue, since we disregard
anything about certificates and only care about the first presented key
which we compare to the one in ppkeys directory.

However an attack was recently published ("triple handshake" attack, see
[1]), which is applicable to the TLS protocol up to and including
version 1.2, that requires an /active/ and /trusted server/ as man in
the middle attacker exploiting session resumption and renegotiation,
both standard TLS features. CFEngine is using TLS in a very custom
manner and is not in danger from that attack.

[1] https://www.secure-resumption.com/

Nevertheless, this patchset employs the countermeasures suggested by the
authors of the attack. In particular, if any change of certificate is
detected during renegotiation, the renegotiation handshake is denied. In
addition, many rigorous sanity tests were added in the handshake
callback, and CFEngine refuses the connection if anything seems to be
fishy. All checks were added in both server and client side.