redmine6476: Aborting on low entropy is too drastic.

Rather than reverting the whole commit involved, keep what we can of
it and Log() instead of UnexpectedError(), at least until Jimis can
invent some better way to respond to this.
(cherry picked from commit e7f0dc7983ff1242df8c9b602a0db08190097ae3)
re-enable acceptance tests which now pass on solaris
(cherry picked from commit b2dc9eb028ced32ff350d60e7f80034876f2cd26)
the detection of the package manager was wrong
(cherry picked from commit b68b49fe53540c1d9b9edebdd1d205bb8094b921)
the cache file is now valid, so we only have one package match
(cherry picked from commit 71af0b96568db065be5e7caa667f891aeddebd6f)
Pass the path to pcre.h to the compiler
(cherry picked from commit a8d82ab6d737100dea7992f1fcd9fe759cd14adc)
Correct return from BusyWith functions after ReceiveCollectCall().

Forwarding its return to our caller wasn't smart: we should return
false either way, because cf-serverd's side of the connection got
closed whether it succeeded (handed off to cf-hub) or failed
(abandoned).  Returning true was leading the caller to call the
BusyWith function again, producing a distracting TLS_Read failure.

In addition, on failure, BusyWithClassicConnection() would - due to a
misguided fall-through - wrongly report an unexpected command, if we
ever let it support call-collect.  Now it returns false.
(cherry picked from commit b1735f77faf3936230580b2b842a2cd99e3422db)
Include {admit,deny}_{ips,hostnames} in the relevant legacy lists.

Entries provided by admit are delivered both to the legacy ACL list
and to the new ACL system's relevant list for admit_ips or
admit_hostnames; likewise for deny.  However, entries given with these
new controls were only added to the new system's lists, not to the
legacy lists, so parts of the code that still use the legacy lists
were not honouring ACLs set using the new keywords.  Add also to the
legacy lists to fix this, until we're finally rid of the legacy code.
(cherry picked from commit 49258153202cfa131ef40d687ca08bc97f26f4aa)
Assert known constraints, log debug on any success.

ServerTLSPeek() would log the data it peeked, but only when deciding
it has TLS; I'd like to be able to see it also for classic.

As recv() definitely shouldn't return more than the buffer size it was
given, assert this, tweak the first check (any negative is failure,
not just -1, albeit only -1 should happen) and simplify the rest.  The
TLS case wasn't checking got == peek_size (as the CAUTH case did), but
can take this for granted (given the assertions) now.
(cherry picked from commit 0c10b9e0c00ac4a2db9f44d69bf4433abcc8e717)
Restructure ServerEntryPoint() to avoid duplication of tidy-up.

I'm about to complicate that tidy-up and I'd rather do it in one place
than five.
(cherry picked from commit c2be570c9fac109bc84d8b45f69f9addeeddb60c)
Don't mark call-collect as processed until it is.

In cf-serverd's StartServer, we were calling CollectCallMarkProcessed
right after the call to ServerEntryPoint; but that merely spawns a
thread to do the work, it doesn't wait for it to complete.  So mark
the connection info object and move the CollectCallMarkProcessed to
where that gets destroyed - when we've finished delivering our report,
or when we abandon the attempt for whatever reason.
(cherry picked from commit 07b76834628ed1dc99127a9dce5391fbdb8cf304)
Set policy_server everywhere we set am_policy_hub.

The recent change to replace am_policy_hub with policy_server broke
various things because cf-serverd wasn't seeing the new class defined.
So fix the places that set am_policy_hub without setting its
replacement also.  Also, various of those weren't using the right
metadata, so add a function that sets both classes, to be called by
all the places that used to set am_policy_hub, so that they all use
the right attributes and also set policy_server.
(cherry picked from commit ed7035e4b2459614f2a09f51686bbb7dfb410f45)
redmine6466: preserve order in readstringarrayidx

Reading the file's contents via a Set is harmless for the other
read*array functions, since they use data from each line as the key,
so naturally discard duplicates and have no other ordering than that
of the keys themselves; however, for readstringarrayidx, the order of
lines actually matters and duplicates are meaningful.  So convert
BuildLineArray to use an Rlist instead of a StringSet (and iterator);
and add an acceptance test (which was actually the hard part).
(cherry picked from commit 6e11153492f13ff2057101cb2d5e9726dad41f93)
Rewrote RlistFromSplitString() to not limit fragment lengths.

It previously restricted the sizes of fragments to 1024 bytes,
CF_MAXVARSIZE; it now uses a dynamically-sized buffer.  Also, instead
of appending fragments to the Rlist, prepend them and reverse the list
just before returning it; this reduces an O(len^2) to an O(len).
(cherry picked from commit b796914262747321fbd9fca67da5f2983ffdf039)
Un-suppress AIX, as it now works.

Builds of testing-enterprise-master were failing because
check_outputs.cf expected to fail and didn't ;-)
(cherry picked from commit 3411df88c8d7981b24d7cd8733d89f76de34dffa)
Refine old-ACL representation of new-ACL hostnames.

The old-style ACLs used regex matching on hostnames, alongside exact
matching; new-style uses only sub-domain and exact matching.  So map
sub-domain matches to regexes in the natural way.
(cherry picked from commit 52c72ceb900785353a1345be4d18ddf84571f634)
Handle old host-regex properly as sub-domain in new ACL.

This resolves
     TODO clean up possible regex, if it starts with ".*"
     then store two entries: entry, and *dot*entry.
from an old comment.  I'd inadvertently implemented this direction of
mapping by mistake when I set out to do the - much easier (see
previous commit) - reverse transform and got confused.  So, might as
well not waste it.

Note that a regex that doesn't make sense as either a sub-domain match
or a simple domain name shall now be ignored, where it was previously
added to the host-name ACL; but, since it wouldn't have matched
anything anyway in the new-style ACL, there should be no harm in
omitting it.
(cherry picked from commit 08dce3a22d1e5c97adb5f664beb552d2b58886b0)
Make regex tests accept const-qualified parameters.

The string passed to IsRegex or IsPathRegex is not modified, so allow
these to be passed a const pointer; likewise for IsRegexItemIn's regex
and the list of entries that's used to check.
(cherry picked from commit 11053e88b5f05b5a633236e83dc78ba0e293e129)
Allow copy of dead symbolic links, see https://dev.cfengine.com/issues/6175
(cherry picked from commit ac65bfc2e2dc3a044b72ddf343081c05259d7106)
Implemented all suggestions from @ediosyncratic. Thanks for the review
(cherry picked from commit 6d47af76cb253ae67d7e8a1033ed5534fbbd8aec)
obey coding style and changed log message
(cherry picked from commit 1e431118f36facb041df42c7a101d6191622e86b)