CM V2 (and thus the AM) now accept a type=speaksfor credential along
with regular credentials. When supplied, the speaksfor caller must be
equal to the owner of the speaksfor credential and the target must be
equal to the owner of the regular credential(s). All operations take
place in the context of the spokenfor user.

Added speaksfor slots to geni_slices,geni_aggregates and geni_tickets.
Also to the history table. But these are just the most recent data.
Each transaction is logged as normal, and the metadata now includes
the speaksfor data and the log always includes all of the credentials.

For testing, there is a new script in the scripts directory to
generate a speaksfor credential. Not installed since it is really
a hack. But to create one:

  perl genspeaksfor urn:publicid:IDN+emulab.net+user+leebee \
	urn:publicid:IDN+emulab.net+user+stoller

which generates a speaksfor credential that says stoller is speaking
for leebee.

Given a slice credential issued to leebee, the test scripts can be
invoked as follows (by stoller):

  createsliver.py -S speaksfor.cred -s slice.cred -c leebee.cred

A copy of leebee's self credential is needed simply cause of the test
script's desire to talk to the SA (which does not support speaksfor).
Not otherwise needed.

Oh, not tested on the AM interface yet.

Also an upcall to add speaksfor metadata to logfile.

This completes linkdelay support for linux, dropping IMQ in favor
of IFB and netem (so that we do not need to build a special kernel).

In this prototype, a speaksfor credential has type=speaksfor,
owner=speaker/tool, target=user, and is signed by the user.

Add -S option to supply a speaksfor credential.
Other small changes to prevent superfluous calls to SA, which
does not support speaksfor.

When processing config options, we now treat these strings as
'1' and '0' so that they can be used as booleans. (Previously,
'false' would evaluate to true by perl string rules.)

Be sure to added the other side of the tunnel to the topomap, when the
tunnel spans aggregates, so that the host/route calculators on the
client do the right thing.

... seems useful enough that we ought to just do it by default.

Works fine on our server because the hostname is set right and the
path works out fine. Might work less well on servers configured
differently.

correct.

Have sdcollectd log the IP address associated with the incoming packet when
it can't map it to a node id.