update platform version number for 0.5.1

Change-Id: I7d13d9395cd70b4de6fa7c6d5a9e5132d995ade1
update indentation to be standard

Change-Id: Ic0ac3a7e6c9ce0e5f95bab023dbbf890c31d9e1c
make sure concat fragments are put together before the openvpn service
is run, otherwise the openvpn service is restarted before config files
are deployed (#4154)

Change-Id: Ide38615714c1978bb90237986baea530c54153c3
change stunnel::service to 'subscribe' instead of 'require' the X509
cert/key. This has the same effect of 'require' because both make sure
that the mentioned resource(s) will be applied before this resource, but
subscribe will cause this resource to refresh anytime the subscribed
resources change (#4342)

Change-Id: I9470bb36f135b821b67a1da70c472d7687b08718
tor: provide a default 'nickname' (something like
"rabbitLKJYW23695JGLKJ" where rabbit is the node name). Stop shipping a
static 'family' and instead provide a comma separated list of node tor
nicknames. (#5220)

Change-Id: I479f460ab230ad440f72c78dc6362983387ce12a
create a /var/run/tapicero directory, owned by tapicero:tacpiero to hold
the pid file (#5577)

Change-Id: I2144e3d8c0ee18254fe3822098c87b2a8c57c2ce
initial firewall: allow port 22 by default. This is the most common port
that sshd will be listening to in a default setup. This needs to be
allowed so that you can have a different port configured in the
hiera and not get locked out during deployment (#5119)

Change-Id: Ie101eaaf440415ddb276621c369da7f67f409c2b
bring service_levels into webapp config - #5527

including the default_service_level
require json so we can use it to dumpt the service levels
nagios: make the check_procs tests for leap_mx and soledad be much more
specific, to avoid catching unrelated processes (#5327)

Change-Id: I63ffcd644a85137708712daac671b92898c70b7e
block DNS traffic at the OpenVPN gateway (#4164)

There are many different edge cases where mac and windows clients (and
maybe android too) will revert to using a different DNS server than the
one specified by openvpn.

This is bad news for security reasons. The client is being designed so
it doesn't leak DNS, however we don't want to put all of our eggs in one
basket, so this will block outgoing port 53 (udp and tcp) on the
gateway's firewall from any of the EIP interfaces (thus not blocking DNS
access on the gateway itself).

Change-Id: I84dcfec7fb591cf7e6b356b66b9721feda188177
fix missing semicolon, causing syntax error

Change-Id: Ic7d0f8cc8c0340fdc24cf5ffa4c7018ebac76c7f
fix incorrect shorewall parameter name 'protocol', should be 'proto'

Change-Id: I9c6c798b174228d44d01b55f2a4aa19458e2da8d
install openvpn from wheezy-backports, this will bring in openvpn 2.3,
which will provide us with proper ipv6 support

Change-Id: I0188732aae6cbc64ab57e95bf805d6158fa17e07
set the ipv6 configuration options on the server

some important things to note:

We are hard-coding the pushing of the ipv6 route '2000::/3' and
configuring the server-ipv6 to be 2001:db8:123::/64. This netblock is a
reserved ipv6 prefix that is used for documentation purposes
only (http://www.apnic.net/info/faq/ipv6-documentation-prefix-faq.html),
and the route being pushed redirects all internet-bound traffic.

When LEAP fully supports ipv6, these network values should be turned
into variables, but for now, to make sure we are blocking any clients
that have functional ipv6, this will work.

Change-Id: Icb65f3169264e0178a2e98825b266a779feac6b5
Change the initial firewall to subscribe to the rule file to be able to
trigger changes, make the default ipv6 firewall subscribe to shorewall6,
if it exists, and finally reject all outgoing IPv6 packets.

All of this will complete the platform-side of route IPv6 through
OpenVPN gateway, and block it. (Feature #4163)

Change-Id: Icf6d582063ed01d304658b740a565057ee4e6810
add the tun-ipv6 configuration to the eip-service (#4163)

Change-Id: I4781f0c3e1c74f5a45217a4d631603fa1a622fd6
update cipher configuration for openvpn to use the IANA name, due to
deprecation warning:

2014-05-06 18:10:23,594 - INFO     - L#826  : leap.openvpn:outReceived() - Tue May  6 18:10:23 2014 Deprecated TLS cipher name 'DHE-RSA-AES128-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-CBC-SHA'

Change-Id: I159b26604993d38806fcb7c2ed8f6de8138999f7
openvpn package resource needs to be ensure => latest to accommodate upgrades

Change-Id: I8caad9b4ac15dcce8ab74ad6d22dd6ad9f6efb14
add known issues, making this the canonical place, which we will bring
over to the website, when necessary (#4373)

Change-Id: I296dd9d3cee1b84bd141cbf63ccaecea24916cc1