Document versions for interfaces and features

Add version and compatibility information to all manual pages.
Command-line and configuration options, ACL methods, environment
variables, client library APIs, and other major features are now
annotated with the version of remctl in which they were added.

Change-Id: I739e0d1fbb60f4c02cf309bb5d81561fa494bdad
Reviewed-on: https://gerrit.stanford.edu/1429
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Clean up various bugs and wording issues in protocol specs

Make sure that the protocol documents are consistent in how they
refer to various protocol versions.  Warn that the permitted behavior
of splitting argument size across MESSAGE_COMMAND continuations is
not guaranteed to continue to be supported.  Fix documentation that
said MESSAGE_NOOP couldn't be sent by the client.  Fix various other
minor issues and wording problems.

Change-Id: I0f77f5adb780632aa990b376593fad9472662731
Reviewed-on: https://gerrit.stanford.edu/1431
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add TODO item to not allow weird MESSAGE_COMMAND splitting

Change-Id: Ib7ec05e75af9a8be8e7a57b283909719e11f4500
Reviewed-on: https://gerrit.stanford.edu/1432
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Reset SIGPIPE before running processes

Reset the SIGPIPE signal handler before running a command.  The server
sets SIGPIPE to SIG_IGN, which unlike all other signal handlers is
inherited across an exec.  Reset the handler to SIG_DFL so that
commands get default SIGPIPE handling.

Change-Id: Id8ac960ca1d53bbeafd03142a4b34bb3b3d088db
Reviewed-on: https://gerrit.stanford.edu/1433
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Increase buffer size for timeout tests

Linux has apparently increased the amount of data it's willing to
buffer on network writes, so increase our data size to 8MB from 4MB
to force a timeout.

Change-Id: Iad69b496eece9b543aa77aa4ec9c2e1f98b6e06d
Reviewed-on: https://gerrit.stanford.edu/1477
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update module versions for the new package version

Change-Id: I591aa7c606f8afe7f87c65e56fa15cefa7973fc8
Reviewed-on: https://gerrit.stanford.edu/1478
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update to rra-c-util 5.4

* Use Lancaster Consensus environment variables to control tests.
* Work around perltidy bug that leaves behind stray log files.

Change-Id: I2b41884f3bedfd899b202ee277bcad90e44c379f
Reviewed-on: https://gerrit.stanford.edu/1479
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add more stopwords in the POD documentation

Change-Id: I7b6ea2acfb3e3e6e9cd463cfe2c81208205c52bf
Reviewed-on: https://gerrit.stanford.edu/1480
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update to rra-c-util 5.5 and C TAP Harness 3.1

Update to rra-c-util 5.5:

* Use calloc or reallocarray for protection against integer overflows.
* Suppress warnings from Kerberos headers in non-system paths.

Update to C TAP Harness 3.1:

* Add breallocarray API for error-checked reallocarray in tests.
* Check for integer overflow on memory allocations.

Change-Id: Ib2f407c1d65ed4e8a4abbe45e0db543dd9ac07ba
Reviewed-on: https://gerrit.stanford.edu/1489
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Turn off more warnings for language bindings

Perl, Python, and PHP can't cope with some of the warnings that
are now enabled.

Change-Id: I1e4afcde7d291be22083477f7a748c3bfe69d29e
Reviewed-on: https://gerrit.stanford.edu/1490
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Use calloc and reallocarray and add malloc overflow checks

Use calloc in preference to calculating a malloc size with
multiplication everywhere, and reallocarray in preference to
calculating a realloc size.  In most places this caution was probably
not necessary, but uniformity is easier to audit and no one will ever
notice the speed difference between malloc and calloc.  Add explicit
overflow checks before every remaining malloc call with a calculated
size.

Change-Id: Ifc8e577b32d45751b9d64955aa1cace8a5dedde0
Reviewed-on: https://gerrit.stanford.edu/1491
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add ACL scheme for checking that user belongs to nss group

* Add documentation for *unxgrp* ACL scheme
* Add *unxgrp* in supported ACL scheme in usage message
* Add test suite for acl-unxgrp

Change-Id: I7ed3008953e7751c02d81323e3c08cc9dddb9e49
Reviewed-on: https://gerrit.stanford.edu/1492
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Remove useless debug message from fake getgrnam_r source code

Change-Id: I983ab9f11313f0ac0eacc35bf1f30d9f4c1a76a6
Reviewed-on: https://gerrit.stanford.edu/1493
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Remove test only directive that shouldn't have been pushed on this PR

Change-Id: I77284d44749531a91b011760a37511e64c2d11c9
Reviewed-on: https://gerrit.stanford.edu/1494
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
New implementation of `unxgrp` ACL scheme.

* As suggested by @rra, the principal is now converted to local
user name with `krb5_aname_to_localname`.
* Fix LICENSE issue by removing CeCILL headers and falling back
to global remctl license.
* Improve test suite to check for proper error handling.

Implementation remarks:

* As `krb5_aname_to_localname` requires principal to be from a known
realm to work, test suite now had to be run with a kerberos configuration
file that defines at least the realm `EXAMPLE.ORG`. I'd liked to use
function `kerberos_generate_conf()` defined in `tests/tap/kerberos.c`
but I wasn't able to find the script `tests/data/generate-krb5-conf`.
My solution was to use the sample configuration file provided with the java
bindings `java/k5.conf`.

If no realm `EXAMPLE.ORG` could be found in kerberos configuration file,
tests will fail like this:

```bash
$ ./tests/runtests -o ./tests/server/acl-unxgrp
1..14
ok 1 - ... with empty group
not ok 2 - ... with user within group
ok 3 - ... with user not in group
ok 4 - ... with principal with instances but main user in group
ok 5 - ... with long_principal very very long
ok 6 - ... match error message with principal too long
ok 7 - ... with user from not supported REALM
ok 8 - ... with getgrnam_r failing
ok 9 - ... with getgrnam_r error handling
ok 10 - ... with denied user in group
ok 11 - ... with user not in denied group but not allowed
not ok 12 - ... with user within group plus a deny pragma
ok 13 - ... with user in denied group plus a allow group pragma
ok 14 - ... with user neither in allowed or denied group
```
but with the sample configuration file shipped with the java bindings:

```bash
$ KRB5_CONFIG=../java/k5.conf ./tests/runtests -o ./tests/server/acl-unxgrp
1..14
ok 1 - ... with empty group
ok 2 - ... with user within group
ok 3 - ... with user not in group
ok 4 - ... with principal with instances but main user in group
ok 5 - ... with long_principal very very long
ok 6 - ... match error message with principal too long
ok 7 - ... with user from not supported REALM
ok 8 - ... with getgrnam_r failing
ok 9 - ... with getgrnam_r error handling
ok 10 - ... with denied user in group
ok 11 - ... with user not in denied group but not allowed
ok 12 - ... with user within group plus a deny pragma
ok 13 - ... with user in denied group plus a allow group pragma
ok 14 - ... with user neither in allowed or denied group
```

Change-Id: Iadb1b5f9f4e18297f08ac25cdc6c3a5510ecc584
Reviewed-on: https://gerrit.stanford.edu/1495
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix some unxgrp memory leaks

Forgot to release memory allocated with `krb5_init_context`
and `krb5_parse_name`.

Change-Id: I0a5ad0e34d325875a94846726d03c183787e7b0f
Reviewed-on: https://gerrit.stanford.edu/1496
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Continue to track down memory leaks

When running full test suite with valgrind, found that I forgot
to free kerberos error message that was used to log error message.

Change-Id: Iceca1172007b3bc3297b824c074cd147b11a5973
Reviewed-on: https://gerrit.stanford.edu/1497
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add stopwords and markup for spelling test of remctld.pod

Change-Id: I0849685dff2f5bc97a5315f770a83b2fd3c94f48
Reviewed-on: https://gerrit.stanford.edu/1498
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix compilation and setup errors with acl-unxgrp check

Ensure that the test uses a krb5.conf file that has the default
realm set to EXAMPLE.ORG.  Fix lots of compilation errors under
make warnings, although this will need further attention.  Change
how conditional compilation is handled to not depend on a lot of
Autoconf machinery.

Change-Id: I16e4f599afd0d3116cddbb55356647769665f03f
Reviewed-on: https://gerrit.stanford.edu/1499
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Change how unxgrp support is optionally built

Avoid extra configure machinery to just check for the combination
of HAVE_KRB5 and the existence of the getgrnam_r function.

Change-Id: I95a621da39d40f80a3b3a187810cc7e2be20c29c
Reviewed-on: https://gerrit.stanford.edu/1500
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>