Fix a minor server memory leak on help

Fix a minor memory leak in the server when processing help commands.
We replaced the subcommand with the help subcommand without freeing
the previous one.

Change-Id: I3c1a1b50efcfb6d096bdb6269af6196b892eda47
Reviewed-on: https://gerrit.stanford.edu/1390
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Move more child processing into the event loop

The previous implementation of the child process handling raced
the child exit with the event loop setup.  Solve this problem by
setting up the event loop and the SIGCHLD handler first, and then
spawn the process via a one-time event inside the event loop.
This ensures that libevent is ready to catch the SIGCHLD signal
before it could possibly be sent.

Move all of the process handling code into a separate file and
use that refactoring to try to simplify the code and make it more
straightforward.  There's still quite a bit of work to do on this.

Fix an evbuffer leak when processing standard input.

Change-Id: I17c03b9e7ac4fabadd1c8f95d647407a7d0fae18
Reviewed-on: https://gerrit.stanford.edu/1391
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add NEWS and build documentation for new libevent dependency

Change-Id: Ifeb59b02d7b03ecfc642e3f4620539c7ba494395
Reviewed-on: https://gerrit.stanford.edu/1392
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Reorganize the process struct a bit

Make this somewhat clearer until I have a chance to do further
refactoring.

Change-Id: Ic027672af74ec5eb9c67ff4d2dbb4b468e24bf1f
Reviewed-on: https://gerrit.stanford.edu/1393
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Rename struct confline to struct rule

Since I'm making major sweeping server source changes anyway,
take advantage of the opportunity to fix terminology to something
that's less confusing.  It's better to think of each configuration
rule as a "rule" than a "configuration line."

Change-Id: I6755b7121e46265a6001def6edada299f2b31d69
Reviewed-on: https://gerrit.stanford.edu/1394
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Clean up assumptions about free(NULL) and NULL pointers

Stop checking whether something is non-NULL before freeing it.
POSIX guarantees you can just call the function without checking,
and several of our supporting data structures provide the same
guarantee.

Assume that memset/calloc will set all the pointers to NULL and
they don't have to be set explicitly.

Change-Id: Iea6529c1603aa7724647387f92fc5d4dc5dc708b
Reviewed-on: https://gerrit.stanford.edu/1395
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Ignore Perl tests for check-valgrind

Don't do valgrind analysis of any of the tests in perl/*-t, since
Perl just confuses valgrind.

Change-Id: Iddf33511140b08c882584aabb18a7a28953f2f46
Reviewed-on: https://gerrit.stanford.edu/1396
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Use a temporary file to write the server PID file

Use a temporary file and atomic rename when writing the server PID
file to avoid racing with a process monitor that tries to read the PID
out of the file before it's written.

Change-Id: I827d02438612af407d1496a1160377c283b4e0a4
Reviewed-on: https://gerrit.stanford.edu/1397
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
In the process TAP add-on, use named constant for startup delay

Make the code a bit more readable by using a #define for the number
of seconds to wait for a process to start up.

Change-Id: I99e3027b864c0fe59dadb81c9b73ac2030f8ea62
Reviewed-on: https://gerrit.stanford.edu/1398
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Be more careful about file descriptors in tests/runtests

Close standard input and reopen it to /dev/null when running a
test program from a test list.  Close the extra file descriptors
left behind when duping file descriptors to the standard numbers
so that they don't show up in valgrind file descriptor leak
analysis.

Change-Id: Id4b9168435c5abbb7a7371c84d90b2157cf7092d
Reviewed-on: https://gerrit.stanford.edu/1399
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add valgrind suppression for static MIT GSS-API error data

MIT Kerberos stashes the GSS-API error in a special buffer that
isn't freed in order to provide verbose error messages.  Suppress
that as reachable memory in valgrind analysis.

Change-Id: If4372fc01a23485634ffb5e9bb6181e8ccd60d0a
Reviewed-on: https://gerrit.stanford.edu/1400
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Call test cleanup functions for non-primary processes

Test cleanup functions must now take two parameters, not one, and are
called from all test processes, not just the primary one.  The new
second argument indicates whether the cleanup function was called in
the primary process (the one in which plan or plan_lazy was called).
External resources, such as files, should generally only be freed when
the cleanup function is called in the primary process, but tests may
want to free internal resources, like memory, in all processes to ease
analysis with tools like valgrind.

Imported from what will be C TAP Harness 2.5.

Change-Id: I3fac25b80e063789ec8b00c068c8532eeb85f514
Reviewed-on: https://gerrit.stanford.edu/1401
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Show reachable memory on check-valgrind

Time to be totally formal about this and clean out all of the
allocated memory on exit.

Change-Id: Id380cdcf0a02c238b1ac2dac1c576895df149217
Reviewed-on: https://gerrit.stanford.edu/1402
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Free our message handlers on exit with an atexit function

When setting custom message handlers, we allocate memory and stash
it in a static variable.  For easier valgrind analysis, free that
memory on process exit with an atexit function.

Change-Id: I0a49ebce5a955a7395697e00a53fadafaf1f8293
Reviewed-on: https://gerrit.stanford.edu/1403
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Multiple improvements to test process handling

When spawning subprocesses during a test, clean up the allocated
memory in child processes as well as the primary process (but only
stop the child when called from the primary test process).  Rather
than using alarm to die if the child doesn't stop, wait for it to
exit in a select delay loop, and bail if it doesn't stop.

Change-Id: Ie73f914f2fc1c1082e798630130876f048dcf76f
Reviewed-on: https://gerrit.stanford.edu/1404
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Convert Kerberos TAP cleanup to a cleanup function

Instead of using its own atexit handler, convert cleanup from the
Kerberos TAP helper functions to a C TAP Harness cleanup function.
Free allocated memory in non-primary processes for cleaner valgrind
analysis.

Change-Id: Iba09a62c9e401d9de2e354843b4015b43c751cae
Reviewed-on: https://gerrit.stanford.edu/1405
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Improve remctld -h and comments on the options struct

Some new command-line options weren't listed in the -h output.
Comment the options struct definition with the command-line
options that set each setting.

Change-Id: I31b1d000110cc498b52b3be9fcd7a94d4486f992
Reviewed-on: https://gerrit.stanford.edu/1406
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Free all resources on remctld exit or fork

Be more careful about resources and free everything on exit,
particularly the GSS-API credentials, which will close all the
replay cache file handles.  Also free as much as possible when
transferring control to the child process to handle an incoming
connection, and free the rest when that client has been handled.

This allows clean valgrind analysis of the remctld server,
including file descriptor tracking.

Change-Id: Ie4806e5b9374a9e6ad6d3c6c29f4b22fa2247dbc
Reviewed-on: https://gerrit.stanford.edu/1407
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
In the client/ccache test, put diag before the relevant test

This fits the normal style of TAP test output.

Change-Id: I91738f77314e9c4e997617954475d942f2b98b3d
Reviewed-on: https://gerrit.stanford.edu/1408
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Free resources in client/open and server/accept

Now that the Kerberos TAP add-on does the right thing with child
processes, stop working around it and calling _exit and let it do
its job.  Clean up some other memory handling so that all resources
are properly freed in these tests.

Change-Id: I436210db07fb535f9f667fa05b685307284b0492
Reviewed-on: https://gerrit.stanford.edu/1409
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>