gentoo Easter resync : 12.04.2020

37 files changed, 752 insertions, 485 deletions

diff --git a/net-firewall/Manifest.gz b/net-firewall/Manifest.gz
index b1d7e9a20f34..279f505f8a62 100644
--- a/net-firewall/Manifest.gz
+++ b/net-firewall/Manifest.gz
diff --git a/net-firewall/conntrack-tools/Manifest b/net-firewall/conntrack-tools/Manifest
index aef39eaa8198..377ec013ea9a 100644
--- a/net-firewall/conntrack-tools/Manifest
+++ b/net-firewall/conntrack-tools/Manifest
@@ -1,9 +1,8 @@
-AUX conntrack-tools-1.4.4-rpc.patch 1749 BLAKE2B 25b23da8f1aa491de037621977ca40e118307bc3593e21b9047632d050ed97ea57b0e63452092f5565138a2c5ff1d2fec5075e40568573f71ea8f0692f6cde65 SHA512 a31e0e7d756055689cf009a9f7efaf6d50131b7d02780632dbce1e3e7b5c854ea2f00d1f2744a8905a6e1001e7f157b90a482ad49f1cfaa5220a1c9f228904d7
 AUX conntrack-tools-1.4.5-rpc.patch 1555 BLAKE2B d92009c2bc4de820956ad2d7459a19cde970356aff4e960e3c17808a28a76483a104df7beaf437dfa30b124d5a2b90bd41db27b4b3b76ab57c3dd2e8bf6bad5f SHA512 55cf7451c3e36e414c8bdc43c46b235259f259b0f7c0b5a11d6543438308ed74621b363ae157160634d00bf45d6115e06badc06848951157facec6b8d496026c
 AUX conntrackd.confd-r2 441 BLAKE2B 5898c470f1d99beb47d01c9215c8e3da2e624455f65c3c41e77dbf26db3ebfa4624ac6556098f303c4f4588e093b7f94ae29921b1a6cdc4a881060eaf0dc425c SHA512 3d72d56d44094593f6ff1eac421fe6a4f0d20450ce698c175adf1b18a859b1a24c7120fa60431b2a00da62ae3749c4619106c8e93fb8fc763ceefc26a82d2ed2
 AUX conntrackd.initd-r3 2238 BLAKE2B 711bf4ab403f61d5d528e0dc504d272a7e410be70c529d8f7a624f742ca66f4692b683f3283b79f000589bdab7f83598130e4ca1a0ae2bed9afce80ec78d00c8 SHA512 445c19ad42e92136e9dfd6b7885334075e72971b73ff7178c6bf16a31e0c037f17d9d039394fa8002f0ad5182a353f7c803d3f900e8873b671eecca94ced78fe
-DIST conntrack-tools-1.4.4.tar.bz2 1010504 BLAKE2B 4190672f017f434b6b4a1841022d64256eac1953c6f62aecb087e2ef0f5c83ad57809c9170de816eb7e0f934c41de0a541328bab7e064243e48e9f18ade3f5fb SHA512 f53bd620bfd4e854e792416527a3090d883c5f00d1d8365e52ce3ba204218dc431490703985d3fdae44decbcddb24ed610bf81a6a99bd7ea01482f95f71df0f5
 DIST conntrack-tools-1.4.5.tar.bz2 479562 BLAKE2B 229531d1c6c237e539df5b83525dca5ce0b009a76a2a5f873282eabc73cc00095c15c686bc68f9364e81efc846bfa8eac8b08f7fd476199d10d0c25190ca2456 SHA512 480fe2cc4420bc8477a2ba67b3d052bcb39c6b3ec000cff27fc12db70b42ec94fa3b5fe12ee35d439e88d9a631a33cd12ae470b69dde6d371d4e53af62a2eed1
-EBUILD conntrack-tools-1.4.4-r1.ebuild 2085 BLAKE2B f763d3e30cad63952030f23a0bc806590ba0e63770cf03a18f0112d59209bc7e5b8540c0a235617bb3ed07dcf0a42deeef045b44730a84ddc6186f8953fc7f9f SHA512 d77be08b66a152187f760351cfe668f9cdcc5a957949a9a3c4d78aa39eb6d4f530e6af2f10d940c811dcf68d002b45651e99c899880a77bacb63b257b3682a86
+DIST conntrack-tools-1.4.6.tar.bz2 499806 BLAKE2B 7c1ee1c5fc2b6f9d33c6cf850eca80978b8763317b1a76892cefb776130564f15fbd4e4554fdb08dbba93d9f16b7e4624a1b4dd5a631f747f5fcc0a5b01b8d5e SHA512 a48260308a12b11b584fcf4658ec2c4c1adb2801c9cf9a73fc259e5c30d2fbe401aca21e931972413f03e415f98fbf9bd678d2126faa6c6d5748e8a652e58f1a
 EBUILD conntrack-tools-1.4.5.ebuild 2189 BLAKE2B 3bbe8c531ceb6e20573b7a9a7ff0aca9713c38a1ad22dec26a189e2624517ddec93b72c7cf90e756d6dcd323a9916fd66210a91f9ce1d4485e4ead5d8d3bb4dc SHA512 942175e372ec7029c882d9c7ed808414ee24b64ad49b534847b03724263f43a50039dba64183df0ad08e157034cf3524289e6504202c9bcd48e40b7f0e4865cf
+EBUILD conntrack-tools-1.4.6.ebuild 2105 BLAKE2B 223f58db36bc8c537db0d3973891268847922858430e08c0aaa0705090ba1366bf2615d16d393c6ec502ea494ccd5b58273c331973d50ba935b7334cc8926f04 SHA512 d89dd57ca1648a064b507dc98f7762c49643756347c1d748321e0931326a1b1ea79c15ab30da6e251d6c0c321481ef71278c0d541dd8c43a874cfd9a6546545f
 MISC metadata.xml 1048 BLAKE2B beb5773ccddbbf517dd5a1e81672a502e3f728085d3c1128207bcd91c544dd8abc3fc3dead68c4bc44b86c3bda2c2f101620ecc86a03fae5c7231716c882f5bb SHA512 4fd1da860481f73d5a47422c93fb5051995884dd488b64d8cd80bc720f81fd37e15a9bb9b86192c37bdfdb024201f600900cd6bcf38b20979c40019b0b290338
diff --git a/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild b/net-firewall/conntrack-tools/conntrack-tools-1.4.6.ebuild
index 6d420e097be3..7b4774526311 100644
--- a/net-firewall/conntrack-tools/conntrack-tools-1.4.4-r1.ebuild
+++ b/net-firewall/conntrack-tools/conntrack-tools-1.4.6.ebuild
@@ -1,8 +1,8 @@
 # Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
-inherit autotools eutils linux-info
+EAPI=7
+inherit linux-info
 
 DESCRIPTION="Connection tracking userspace tools"
 HOMEPAGE="http://conntrack-tools.netfilter.org"
@@ -10,18 +10,24 @@ SRC_URI="http://www.netfilter.org/projects/conntrack-tools/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm64 hppa x86"
-IUSE="doc +libtirpc"
+KEYWORDS="~alpha ~amd64 ~arm64 ~hppa ~x86"
+IUSE="doc +cthelper +cttimeout systemd"
 
 RDEPEND="
 	>=net-libs/libmnl-1.0.3
-	>=net-libs/libnetfilter_conntrack-1.0.6
-	>=net-libs/libnetfilter_cthelper-1.0.0
-	>=net-libs/libnetfilter_cttimeout-1.0.0
+	>=net-libs/libnetfilter_conntrack-1.0.8
 	>=net-libs/libnetfilter_queue-1.0.2
 	>=net-libs/libnfnetlink-1.0.1
-	!libtirpc? ( sys-libs/glibc[rpc(-)] )
-	libtirpc? ( net-libs/libtirpc )
+	net-libs/libtirpc
+	cthelper? (
+		>=net-libs/libnetfilter_cthelper-1.0.0
+	)
+	cttimeout? (
+		>=net-libs/libnetfilter_cttimeout-1.0.0
+	)
+	systemd? (
+		>=sys-apps/systemd-227
+	)
 "
 DEPEND="
 	${RDEPEND}
@@ -60,19 +66,17 @@ pkg_setup() {
 }
 
 src_prepare() {
-	default
-
 	# bug #474858
 	sed -i -e 's:/var/lock:/run/lock:' doc/stats/conntrackd.conf || die
 
-	# bug #631902
-	epatch "${FILESDIR}/${P}-rpc.patch"
-
-	eautoreconf
+	default
 }
 
 src_configure() {
-	econf $(use_with libtirpc)
+	econf \
+		$(use_enable cthelper) \
+		$(use_enable cttimeout) \
+		$(use_enable systemd)
 }
 
 src_compile() {
diff --git a/net-firewall/conntrack-tools/files/conntrack-tools-1.4.4-rpc.patch b/net-firewall/conntrack-tools/files/conntrack-tools-1.4.4-rpc.patch
deleted file mode 100644
index 01ef537a7352..000000000000
--- a/net-firewall/conntrack-tools/files/conntrack-tools-1.4.4-rpc.patch
+++ /dev/null
@@ -1,41 +0,0 @@
---- a/configure.ac
-+++ b/configure.ac
-@@ -50,6 +50,25 @@
-         AS_HELP_STRING([--enable-systemd], [Build systemd support]),
-         [enable_systemd="$enableval"], [enable_systemd="no"])
- 
-+AC_ARG_WITH([libtirpc],
-+           AS_HELP_STRING([--with-libtirpc], [Use libtirpc as RPC implementation (instead of sunrpc)]),
-+           [], [ with_libtirpc=no ])
-+
-+AS_IF([test "x$with_libtirpc" != xno],
-+      [PKG_CHECK_MODULES([TIRPC],
-+                         [libtirpc],
-+                         [RPC_CFLAGS=$TIRPC_CFLAGS; RPC_LIBS=$TIRPC_LIBS;],
-+                        [AC_MSG_ERROR([libtirpc requested, but library not found.])]
-+                       )],
-+      [AC_CHECK_HEADER(rpc/rpc.h,
-+                      [RPC_CFLAGS=""; RPC_LIBS="";],
-+                      [AC_MSG_ERROR([sunrpc requested, but headers are not present.])]
-+                     )]
-+)
-+
-+AC_SUBST(RPC_CFLAGS)
-+AC_SUBST(RPC_LIBS)
-+
- PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
- PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
- PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 1.0.6])
---- a/src/helpers/Makefile.am
-+++ b/src/helpers/Makefile.am
-@@ -22,8 +22,8 @@
- ct_helper_ftp_la_CFLAGS = $(AM_CFLAGS) $(LIBNETFILTER_CONNTRACK_CFLAGS)
- 
- ct_helper_rpc_la_SOURCES = rpc.c
--ct_helper_rpc_la_LDFLAGS = -avoid-version -module $(LIBNETFILTER_CONNTRACK_LIBS)
--ct_helper_rpc_la_CFLAGS = $(AM_CFLAGS) $(LIBNETFILTER_CONNTRACK_CFLAGS)
-+ct_helper_rpc_la_LDFLAGS = -avoid-version -module $(LIBNETFILTER_CONNTRACK_LIBS) $(RPC_LIBS)
-+ct_helper_rpc_la_CFLAGS = $(AM_CFLAGS) $(LIBNETFILTER_CONNTRACK_CFLAGS) $(RPC_CFLAGS)
- 
- ct_helper_tftp_la_SOURCES = tftp.c
- ct_helper_tftp_la_LDFLAGS = -avoid-version -module $(LIBNETFILTER_CONNTRACK_LIBS)
diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest
index 1430feeceaf6..b54e5525a6ad 100644
--- a/net-firewall/firewalld/Manifest
+++ b/net-firewall/firewalld/Manifest
@@ -1,6 +1,6 @@
 AUX firewalld.init 250 BLAKE2B 1c0f690e24313037b801902aa772a9d1cb6889a05f142bc3d84602002ef053cd059b5193983f9fe6d89065a070a566a6a9ba8212a092435953ebed80ea7c7b40 SHA512 457cda01449f38563e98e1db937fe1c50745eab91797f52687e3ab9f5d94dd42d129740ae6669e99666a3f096d631dd3a44e66010b638b31b9c6ba798362403e
-DIST firewalld-0.6.3.tar.gz 2294470 BLAKE2B 09bb971d8142e5d28b6a085527e7f5275090f15e5dc4ccf2b16b6ed837049ed75443b09a54db76e37c6f0c5db6524ba85cf34c5117c1139bba0e3b223f289d57 SHA512 ea9e8bad34d3608257ef2a38851855974eff97b21dbab93ca3d8cfad90339734a8124447ed531a978b41546ab4040135bb61c8fdc9677ba0df9188d7ee4422ee
 DIST firewalld-0.7.1.tar.gz 2326020 BLAKE2B 1ab435bfd97608ce246657a24daebe6ca83f72560a627c702e940de64bf4fb34f26ebe9abf62468972fd8cd9394c5e885acd6882ec3cad112dfe62bca3905c7a SHA512 6be842d4c2849f56fc0e6c13219aed7d767635a3b190ef41f1516cecf51de71ad9af77ccc96b699d11bed56407abf9837cdbd0cfbf93ab716b5de5e4c2f94c68
-EBUILD firewalld-0.6.3-r1.ebuild 2616 BLAKE2B 598544370854bed198fbc79d45c2b8160cfc382174bb2554e4f451f2fee8208461b7163be17ec0b5badb65de9644e68bb7e8d07735fa718d5bbecee2d1a96ab1 SHA512 6ee2e5f1433bd6fe021528188eabf5fccc1db7ea14c076c8951f22be85aaad67ba22530386517632297cef2f799bbe7d47c225223cf7d20198c9259c644097f0
-EBUILD firewalld-0.7.1-r1.ebuild 2607 BLAKE2B d1d08d05aca74180e838722fd7470316d13f6d34fddc02c612a1f26efac66851609d5ffb5d10817a262beea99f3e67798e17696bcaab1c7dbd29d1b0d2712af3 SHA512 0daf8e834f117c67f2f900a42c48b037febb53eaa4e17e485843f0340343bd5983c0167b4968a39197e6f8a0321a1365dcce56d6f851311be4ab7bace33ce810
-MISC metadata.xml 271 BLAKE2B 0ac34325897226d2062f0b77cc069fcacd6026432b276adcdc2e7c9ef532cc1900855dd821d0b6314ac77488fd0695f916e821fc11148f3b9f2753bc97afbe2f SHA512 0cd444be2e9b4a1530671dc4fc88a2177541dceb453dca10a1778938d8f114caaa55a01551b662c29e0e775aa9e9df9389b4a5d5ab4fba643da447ac2e7aca32
+DIST firewalld-0.7.3.tar.gz 1247590 BLAKE2B 80b34749ab47fa3f2733c6c2fe6dec9483b38baa3485c91875888ecce4bacc16a05e69d5734aaed017408ec2ba8b33155aa0c08e93b1f8eac5c6708682edf238 SHA512 49ab1403b29b215ef69d54baf9060826917ab2a6d632f0a53b458170576639e74580e4399e5c78a74bf12a4999479db86aadacbc17c749ab25e9de8ed686146f
+EBUILD firewalld-0.7.1-r3.ebuild 3257 BLAKE2B 87d864ba1e9889806a42c0be2b4a91eb65c502100bf681adfbed5cef5f451a0e5bdd3223d6ee391fb177a041e46102767e03035e7b1dbd6c3e6d0a94a511e186 SHA512 b84a171f56147aa649c515c4986ca439d3e9203afd03280261b813f1c2708d814a0cc4fcd9e89ff397406ad7b83c93efcf9cb94c64fdff92c9c2abe08c8f10f5
+EBUILD firewalld-0.7.3-r1.ebuild 3259 BLAKE2B 400accbe443a5d1360261ff2d35062f8d316fef898283ed9253ecc9708892c3fbf95ebbd9c9e2101cd4f2b6a84aae0b99384eabc78f0b9f11449402cd5555f00 SHA512 70b573f0d912a4d964eaf11d8d6f7f6b5c1ec3fe12119b4d60445da819cd3abea58b356e6d310ff7a1abd1452eb91d953951dcef3050fefe6d72c0029b1809ee
+MISC metadata.xml 486 BLAKE2B 0d1b9c530a7b7ac43414cda002e07cbc9b897164be53d9183dc50ba78bc8d29a40bfc364444f4253f903ac1698a459e6f7ca68431a22905a6f5aed02ca41bb61 SHA512 d4b20ffb819399bfc60760ec90bfaf60ffbe666a1c0b2117a8eae42db2f85c1f5274c8dee28fbfa7b66bea1d9720ad1dd8acb425c43eb71cf0c9b2557a1471a0
diff --git a/net-firewall/firewalld/firewalld-0.6.3-r1.ebuild b/net-firewall/firewalld/firewalld-0.7.1-r3.ebuild
index 3035cef8c28a..28feae85d15a 100644
--- a/net-firewall/firewalld/firewalld-0.6.3-r1.ebuild
+++ b/net-firewall/firewalld/firewalld-0.7.1-r3.ebuild
@@ -1,10 +1,10 @@
 # Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 PYTHON_COMPAT=( python{2_7,3_6,3_7} )
 
-inherit autotools gnome2-utils linux-info python-single-r1 systemd bash-completion-r1
+inherit autotools bash-completion-r1 gnome2-utils l10n linux-info python-single-r1 systemd xdg-utils
 
 DESCRIPTION="A firewall daemon with D-BUS interface providing a dynamic firewall"
 HOMEPAGE="http://www.firewalld.org/"
@@ -12,16 +12,19 @@ SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="amd64 ~arm64 x86"
-IUSE="gui"
+KEYWORDS="amd64 ~arm64 ~ppc64 x86"
+IUSE="gui +nftables +iptables"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
 RDEPEND="${PYTHON_DEPS}
 	!!net-firewall/gshield
-	|| ( net-firewall/ebtables net-firewall/iptables[nftables] )
-	net-firewall/iptables[ipv6]
-	net-firewall/ipset
-	net-firewall/nftables
+	nftables? ( net-firewall/nftables )
+	iptables? (
+		net-firewall/iptables[ipv6]
+		net-firewall/ebtables
+		net-firewall/ipset
+		nftables? ( net-firewall/nftables[xtables(+)] )
+	)
 	|| ( >=sys-apps/openrc-0.11.5 sys-apps/systemd )
 	$(python_gen_cond_dep '
 		dev-python/dbus-python[${PYTHON_MULTI_USEDEP}]
@@ -40,30 +43,44 @@ DEPEND="${RDEPEND}
 
 RESTRICT="test" # bug 650760
 
+PLOCALES="ar as bg bn_IN ca cs da de el en_GB en_US es et eu fi fr gl gu hi hu ia id it ja ka kn ko lt ml mr nl or pa pl pt pt_BR ru sk sq sr sr@latin sv ta te tr uk zh_CN zh_TW"
+
 pkg_setup() {
-	local CONFIG_CHECK="~NF_CONNTRACK ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6 ~NETFILTER_XT_MATCH_CONNTRACK"
+	local CONFIG_CHECK="~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK"
+
+	# kernel >= 4.19 has unified a NF_CONNTRACK module, bug 692944
+	if kernel_is -lt 4 19; then
+		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6"
+	fi
+
 	linux-info_pkg_setup
 }
 
 src_prepare() {
 	default
 	eautoreconf
+
+	l10n_find_plocales_changes "po" "" ".po"
+	l10n_get_locales | sed -e 's/ /\n/g' > po/LINGUAS
 }
 
 src_configure() {
 	python_setup
 
-	econf \
-		--enable-systemd \
-		--with-iptables="${EPREFIX}/sbin/iptables" \
-		--with-ip6tables="${EPREFIX}/sbin/ip6tables" \
-		--with-iptables_restore="${EPREFIX}/sbin/iptables-restore" \
-		--with-ip6tables_restore="${EPREFIX}/sbin/ip6tables-restore" \
-		--with-ebtables="${EPREFIX}/sbin/ebtables" \
-		--with-ebtables_restore="${EPREFIX}/sbin/ebtables-restore" \
-		--with-nft="${EPREFIX}/sbin/nft" \
-		--with-systemd-unitdir="$(systemd_get_systemunitdir)" \
+	local econf_args=(
+		--enable-systemd
+		$(use_with nftables nft "${EPREFIX}/sbin/nft")
+		$(use_with iptables iptables "${EPREFIX}/sbin/iptables")
+		$(use_with iptables iptables_restore "${EPREFIX}/sbin/iptables-restore")
+		$(use_with iptables ip6tables "${EPREFIX}/sbin/ip6tables")
+		$(use_with iptables ip6tables_restore "${EPREFIX}/sbin/ip6tables-restore")
+		$(use_with iptables ebtables "${EPREFIX}/sbin/ebtables")
+		$(use_with iptables ebtables_restore "${EPREFIX}/sbin/ebtables-restore")
+		$(use_with iptables ipset "${EPREFIX}/usr/sbin/ipset")
+		--with-systemd-unitdir="$(systemd_get_systemunitdir)"
 		--with-bashcompletiondir="$(get_bashcompdir)"
+	)
+	econf "${econf_args[@]}"
 }
 
 src_install() {
@@ -87,16 +104,15 @@ src_install() {
 }
 
 pkg_preinst() {
-	gnome2_icon_savelist
 	gnome2_schemas_savelist
 }
 
 pkg_postinst() {
-	gnome2_icon_cache_update
+	xdg_icon_cache_update
 	gnome2_schemas_update
 }
 
 pkg_postrm() {
-	gnome2_icon_cache_update
+	xdg_icon_cache_update
 	gnome2_schemas_update
 }
diff --git a/net-firewall/firewalld/firewalld-0.7.1-r1.ebuild b/net-firewall/firewalld/firewalld-0.7.3-r1.ebuild
index af7ce3dfdc23..8f68175271de 100644
--- a/net-firewall/firewalld/firewalld-0.7.1-r1.ebuild
+++ b/net-firewall/firewalld/firewalld-0.7.3-r1.ebuild
@@ -4,7 +4,7 @@
 EAPI=7
 PYTHON_COMPAT=( python{2_7,3_6,3_7} )
 
-inherit autotools bash-completion-r1 gnome2-utils linux-info python-single-r1 systemd xdg-utils
+inherit autotools bash-completion-r1 gnome2-utils l10n linux-info python-single-r1 systemd xdg-utils
 
 DESCRIPTION="A firewall daemon with D-BUS interface providing a dynamic firewall"
 HOMEPAGE="http://www.firewalld.org/"
@@ -13,15 +13,18 @@ SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 LICENSE="GPL-2+"
 SLOT="0"
 KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
-IUSE="gui"
+IUSE="gui +nftables +iptables"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
 RDEPEND="${PYTHON_DEPS}
 	!!net-firewall/gshield
-	net-firewall/iptables[ipv6]
-	|| ( net-firewall/iptables[nftables] net-firewall/ebtables )
-	net-firewall/ipset
-	net-firewall/nftables
+	nftables? ( net-firewall/nftables )
+	iptables? (
+		net-firewall/iptables[ipv6]
+		net-firewall/ebtables
+		net-firewall/ipset
+		nftables? ( net-firewall/nftables[xtables(+)] )
+	)
 	|| ( >=sys-apps/openrc-0.11.5 sys-apps/systemd )
 	$(python_gen_cond_dep '
 		dev-python/dbus-python[${PYTHON_MULTI_USEDEP}]
@@ -40,30 +43,44 @@ DEPEND="${RDEPEND}
 
 RESTRICT="test" # bug 650760
 
+PLOCALES="ar as bg bn_IN ca cs da de el en_GB en_US es et eu fi fr gl gu hi hu ia id it ja ka kn ko lt ml mr nl or pa pl pt pt_BR ru sk sq sr sr@latin sv ta te tr uk zh_CN zh_TW"
+
 pkg_setup() {
-	local CONFIG_CHECK="~NF_CONNTRACK ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6 ~NETFILTER_XT_MATCH_CONNTRACK"
+	local CONFIG_CHECK="~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK"
+
+	# kernel >= 4.19 has unified a NF_CONNTRACK module, bug 692944
+	if kernel_is -lt 4 19; then
+		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6"
+	fi
+
 	linux-info_pkg_setup
 }
 
 src_prepare() {
 	default
 	eautoreconf
+
+	l10n_find_plocales_changes "po" "" ".po"
+	l10n_get_locales | sed -e 's/ /\n/g' > po/LINGUAS
 }
 
 src_configure() {
 	python_setup
 
-	econf \
-		--enable-systemd \
-		--with-iptables="${EPREFIX}/sbin/iptables" \
-		--with-ip6tables="${EPREFIX}/sbin/ip6tables" \
-		--with-iptables_restore="${EPREFIX}/sbin/iptables-restore" \
-		--with-ip6tables_restore="${EPREFIX}/sbin/ip6tables-restore" \
-		--with-ebtables="${EPREFIX}/sbin/ebtables" \
-		--with-ebtables_restore="${EPREFIX}/sbin/ebtables-restore" \
-		--with-nft="${EPREFIX}/sbin/nft" \
-		--with-systemd-unitdir="$(systemd_get_systemunitdir)" \
+	local econf_args=(
+		--enable-systemd
+		$(use_with nftables nft "${EPREFIX}/sbin/nft")
+		$(use_with iptables iptables "${EPREFIX}/sbin/iptables")
+		$(use_with iptables iptables_restore "${EPREFIX}/sbin/iptables-restore")
+		$(use_with iptables ip6tables "${EPREFIX}/sbin/ip6tables")
+		$(use_with iptables ip6tables_restore "${EPREFIX}/sbin/ip6tables-restore")
+		$(use_with iptables ebtables "${EPREFIX}/sbin/ebtables")
+		$(use_with iptables ebtables_restore "${EPREFIX}/sbin/ebtables-restore")
+		$(use_with iptables ipset "${EPREFIX}/usr/sbin/ipset")
+		--with-systemd-unitdir="$(systemd_get_systemunitdir)"
 		--with-bashcompletiondir="$(get_bashcompdir)"
+	)
+	econf "${econf_args[@]}"
 }
 
 src_install() {
diff --git a/net-firewall/firewalld/metadata.xml b/net-firewall/firewalld/metadata.xml
index 121cd46cb5e1..96b274a47c90 100644
--- a/net-firewall/firewalld/metadata.xml
+++ b/net-firewall/firewalld/metadata.xml
@@ -5,4 +5,8 @@
 		<email>virtualization@gentoo.org</email>
 		<name>Gentoo Virtualization Project</name>
 	</maintainer>
+	<use>
+		<flag name="nftables">Add support for <pkg>net-firewall/nftables</pkg> as firewall backend</flag>
+		<flag name="iptables">Add support for <pkg>net-firewall/nftables</pkg> as firewall backend</flag>
+	</use>
 </pkgmetadata>
diff --git a/net-firewall/fwknop/Manifest b/net-firewall/fwknop/Manifest
index ab41de1fa612..2d34e4a919f5 100644
--- a/net-firewall/fwknop/Manifest
+++ b/net-firewall/fwknop/Manifest
@@ -1,9 +1,10 @@
+AUX fwknop-2.6.10_fno-common_fix.patch 767 BLAKE2B 3ae85e3a7ff23060ab54e8720a247a9fff074c391dd7a9ebe702a7a2be55927ee631a6f05523c5508f7dce21b1abd3f7239e6cdd0f4d80dfca83aa9e180b6aa6 SHA512 9ac0d885b8b93afaf413d3208a09e3c0d976046468472bdf774b1ead37fc64aff27b44fa55645387f6c4e48c48010afb4b5d5928bc39c616c43b8b4ff7ac29a9
 AUX fwknopd.confd 475 BLAKE2B 46c87fd251ab4bf57a35a6604e01a5a0ac80bdaca0c00f0fc84e04e4bff73b3a45fba6d914c9215f8e00bba14ee2c5df7a20655fbe22b11183cbf78fa6d9e896 SHA512 a23e42ca59f2d86b0ff1456773419d9b075bdae83fcd307d506dd9e282b58d24c6f6c50ea3418d5cce07a447f32f0089f747516e8f108b7e3c03944ea59a6412
 AUX fwknopd.init 2706 BLAKE2B 561cc62b1e557d425648947c25751dfb2fe323b04cb96ea1d05e395cbe1cd61466e11689f93d02569545057e43fedfa405558106bf687c2b16cd9c7bde9928a1 SHA512 6e58cb40bd2c69b624fa5bb320f79e6befd91bc39e4aa66ec0b2a2a014b9342377ea919b364cf52cfda76b924d5d497a79b0d66f2e0c7339894b75bfa9e165fa
 AUX fwknopd.service 235 BLAKE2B c46c01121a745ee46a5415654c0ba422531008ed52915833712f748026eda3afd8019d6ec6bb86434b40ad273a4cc46115d3a64a73b621731ec68f3bad92dc41 SHA512 890bbba586183275cbd3b420a9c0d609ff3eca0fd239b4af97e2730e2790f317fc114f51d60107ba4fbddd2cabb60c70d8b615e2a75bb80cf27d352c894a1c6d
 AUX fwknopd.tmpfiles.conf 31 BLAKE2B 81d88d9bb1fd826c242b2815e1a6c0e5a300f22e19dd65ad67e114d692731cb532162ac877f0239879ebfcf0432d61053adcddd2c234d85ed60bf33720b22dcc SHA512 73b56a42c7728c9dabd82cd81bd6ffa1b948fe80fa67feee348ad65f957f1f2ea53c6b5d74fa2784ea75c45c2c27b5d989da4a618f3a4cf67914c927e04b74ae
 DIST fwknop-2.6.10.tar.gz 1988197 BLAKE2B d4c2010c64ab160f0edc02e2b1530749ee47ff6ed16d6b556d366daef7ce5e22ef38fbbbf6e8cfaa14e0d9706ba2b65937b03c70b54b3429ff1732ae33c1852c SHA512 3b3e35eda574abd1759431c88677eea7078c54cb3252c0ee0e1019b5b8224ed8844d30760da70a952e1cd92b04715a547f6effabda54678f791fff9afa32cd80
 DIST fwknop-2.6.9.tar.gz 3043542 BLAKE2B 11440fa0fe5e990a269587fa9ee1da0242f3dc939d6dc185d6adff9e9c995a8ffe902a6351a057c619cb6ff056519caea38f7b865978fe5ac810a39281bb3fc3 SHA512 4706560d44c911c8604059d88dded9c1b8c333399d90ec7dc366c0fba96c79680bdbf1b8b5e76cc34aaf3a1e58fff80db8f5f20c96d57481bdb476a9b99f4d1b
-EBUILD fwknop-2.6.10-r1.ebuild 3645 BLAKE2B e189a429bbd503641c4ea4ffe7c8f8069935952b1412e751106f73454df3ac5e8749066446634524160353820af1ee03989acc67a3f990b39b92a3694204084b SHA512 8811954807de2f3b050f19c184aceb5c56d339b1e2ea40d73a9edc65492c4b473db02b901b1d42c8d58b9203ab76e74545c260c1240bc916feabbaf0490b1a46
+EBUILD fwknop-2.6.10-r1.ebuild 3706 BLAKE2B 25805b725cca9f3c5345d49edafd7c4e6ca40f44ab3206b829c61be43447b19864f645b9a93e1d794c8680d275ad2d88549733c62a3bd8f91085e3f9a3f0b9e3 SHA512 a9267412dc4d1ab74be5479a857475f1571599a7f08e13699de90cfd13bc97ec5c8299e818dd34bb1c99e3dbb30777ff72502467b9acb81f00ef35e00944748f
 EBUILD fwknop-2.6.9-r1.ebuild 3794 BLAKE2B 34962c2026d3ad921bca886f69483fccbb5b107c497fffda054fcd2088548afe905cf19b16b4d3f9017fb9383fc8580ed98e54f7b9f7f0cdb9c4b7fe3e6861a3 SHA512 a07321223267ed412af9a72fd4527b358bf49f2de34fd03be80e40a33a345acf835fe1a2314f5e23d56724d80be68a021918c35e02ca78617743bed338b2ec87
 MISC metadata.xml 1217 BLAKE2B 2b44d1d81f7d4bc625c3130cf29328fce6d85fbeedfb5376146dad93b020f03440f620e68187fa1ffd496fdff0cedaa6f02d015578ec0620070ea97029b9eec8 SHA512 b215b1ad55f6ba7e9f4ac316916241ec2084bcd2e3e5ca6a7d81c935df6affdbc36066914b1bb4d984333e005a57f54c6c8f07013a4e14e465f9dd6dbc6c93d2
diff --git a/net-firewall/fwknop/files/fwknop-2.6.10_fno-common_fix.patch b/net-firewall/fwknop/files/fwknop-2.6.10_fno-common_fix.patch
new file mode 100644
index 000000000000..9c144cc1eddd
--- /dev/null
+++ b/net-firewall/fwknop/files/fwknop-2.6.10_fno-common_fix.patch
@@ -0,0 +1,23 @@
+From a87325b0816a79329cf0b4d4f9ebf247ead117db Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Mon, 10 Feb 2020 15:21:56 +0100
+Subject: [PATCH] Unbreak build with gcc10 (-fno-common)
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ client/log_msg.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/client/log_msg.h b/client/log_msg.h
+index cc17716b..3dda1614 100644
+--- a/client/log_msg.h
++++ b/client/log_msg.h
+@@ -38,7 +38,7 @@ enum
+     LOG_VERBOSITY_INFO,         /*!< Constant to define a INFO message */
+     LOG_VERBOSITY_DEBUG,        /*!< Constant to define a DEBUG message */
+     LOG_LAST_VERBOSITY
+-} log_level_t;
++};
+ 
+ #define LOG_DEFAULT_VERBOSITY   LOG_VERBOSITY_NORMAL    /*!< Default verbosity to use */
+ 
diff --git a/net-firewall/fwknop/fwknop-2.6.10-r1.ebuild b/net-firewall/fwknop/fwknop-2.6.10-r1.ebuild
index 52c57d2312c0..786366d6895e 100644
--- a/net-firewall/fwknop/fwknop-2.6.10-r1.ebuild
+++ b/net-firewall/fwknop/fwknop-2.6.10-r1.ebuild
@@ -43,6 +43,8 @@ REQUIRED_USE="
 	udp-server? ( server )
 "
 
+PATCHES=( "${FILESDIR}/${PN}-2.6.10_fno-common_fix.patch" )
+
 DOCS=( AUTHORS ChangeLog README )
 
 DISABLE_AUTOFORMATTING=1
diff --git a/net-firewall/iptables/Manifest b/net-firewall/iptables/Manifest
index 37903af2214a..92a5bf5ad7ae 100644
--- a/net-firewall/iptables/Manifest
+++ b/net-firewall/iptables/Manifest
@@ -2,6 +2,7 @@ AUX ip6tables-1.4.13.confd 690 BLAKE2B 457beb9caaef166b8d98bddfd3e9f2799439bdfef
 AUX ip6tables-r1.confd 899 BLAKE2B d8c72df359a35798d7a92958ba9a620ab580427a06765850928181d7b4cc25455c586daaad88bd20e61a9c9218dbc0895de38b006526bb04f4f2e998d8062fbe SHA512 553ddf83558edaccf891a366175e47aad950853be0de556581cfa08f614afa1f4139c94b8d8d2884ed69018513edeb966331d4d6a615829ada65fac2066840e5
 AUX iptables-1.4.13.confd 687 BLAKE2B 78b2242454b5f3228661f1e41b790aaa458c1225162a222da5a309a15eca56a531c756a5ceb49e506095461998305189efe136fde0bfe5916cc2d00661de1789 SHA512 bd67d53e997ea65755148ba071fe6e3856d6e604b9167c666900721bc3dc24f63d395bc33a1a34ae50f95e72760da630db1a8d35afc81ec5973e60ba5343dc70
 AUX iptables-1.8.2-link.patch 785 BLAKE2B 2ef5ac495260eef324f341d5d807e8c59afee8ac4853b46ef8c88765ed786396888d0bcd15822765da5584c25c6cdbbbc6b8b85eb0b8dbdd9b300662b1d59479 SHA512 10f6fdc4e4a37a0becb87f99c49888df366248f02b17037faf83068ef00824ecb61022a40b5551f9c8d2db22262ad738d554296bd6b78765dd5f8baf524b2388
+AUX iptables-1.8.4-no-symlinks.patch 800 BLAKE2B 721d2dcc881f781031d2be48659dcd54568b3e8c25ad19d0505699f0cf8276990b41f2ddf9d5eda5c2a77f66ae9a16ae542c42c6fc2d91b085cc5922121f9b00 SHA512 79601d8a8a352f82f0f3eaf85a7b1f830c9ddc400ae0fadaf08eb1848bb9a2801a886b2b0803bf498e353db1828c0976aa8d30c9ece5fdcf61a203070ed4d7cd
 AUX iptables-r1.confd 890 BLAKE2B 0aaca870e3c03f19a71cf1b210377dfda320faf118359e298bef419eaf280fd11c9726d200ae89602e863c9b48de0bb51ac05424b50c064afe948a980e300153 SHA512 10002da01ded6be0e9bca6041798ad0859fa2212fde077a048443e4f3012c95d86e4580ae426e87af5891368062af9af6f9fd35ed617d24cdd3c51702b816b13
 AUX iptables-r2.init 4384 BLAKE2B d11be1725e25d234e01af86c82d3745fd630b15b3ae2228845c5555db5c2ffdcd920fd565480f76ab91ef2d5b26f9ae96432efc288a1b9aa2abfb5b9bb01d7bf SHA512 8897ab985424c895e261e0fe521921f0da8e09e38394655b0f91c65c0e8f603731faf70489f7a6610c83d6c2fde75f92f309405d72277643165a847e62238df7
 AUX iptables.init 2787 BLAKE2B 79c17ba2970d63791dd4d137536b3ccf0f9b6a637d0445049a6fac338ca4e2d1fad927038dfa7ad42a1eb321feac1dc834af09ce0baec554fc9767f199e10b6b SHA512 317c71bee98f5b1bbfd17ea961e5e268532c2320fc865b7876f7cc4e02a66b6a012fc336f8880045a83e101f161197c0a1d106220af6240407cebafbf38022db
@@ -13,12 +14,11 @@ AUX systemd/iptables-store.service 240 BLAKE2B 7ddb4425e63cd41f421767fab25a7b055
 AUX systemd/iptables.service 130 BLAKE2B 1b4881253eae9fd24c831931e5836efc3d3bb6f7ebb1762ca5aabb31813e3298e02d66d557efa73e6f252bf3f67898a2b646c863879dd993a613796b4c057019 SHA512 87114ccc7eb079d1ed43d77be35cf4c91702ca960883a4bbca5dfcf74aa6f086e44f4a4251441ac3a277c93eb10e7482157caf2d62bbf2a7f5327947ede25bef
 DIST iptables-1.6.1.tar.bz2 620890 BLAKE2B b45ac26e1fb7e8b17a6df0afab3b6c0e2f0a5df9191367548136b3ce9aadc1bcb875b8bc0403e6f12fcf487054e96418f4ef34da827af8989fd4dcf83cd3cd8d SHA512 12280db6e6ef8e68da2537e9da59fc601790fd02b1ba38a37c90dbb56272018329dccb8be995f96ecd5d94fafa6043204f3e8f8ee96531685d9e3c55359d2ee8
 DIST iptables-1.6.2.tar.bz2 639785 BLAKE2B 3d129756fd33c8c73d56d57e3c5595896db86ded14834a45db21b964d82840b62216ce3cea4ae4960e8c5f0671df3cc6bfb222f68d29cf3a8c99e0eee14bf017 SHA512 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
-DIST iptables-1.8.2.tar.bz2 679858 BLAKE2B 2004d85c89ecbc37ef0d571ac8ece680fd2e11a51b074f6387d6e9c4892da524c785d6bf3f30e26af4e7c2cb1f401d51bf8bcb21a91e380e24945374553139cb SHA512 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76
 DIST iptables-1.8.3.tar.bz2 716257 BLAKE2B 58c606a5753ae2cb8ada9039e4653d2abe03c7c9b6aeef1e458baa3e10e818893f35e8f2aed5221e692415115e618aa673c8fcd33d172f85e9d1b609ed79c7b8 SHA512 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d
 DIST iptables-1.8.4.tar.bz2 704312 BLAKE2B f677bb9ed2c86e6a39953c0565766991e9647224effdc7db2b563f3f491f6ace2f9073ecc8e865d489101a9f80cf964d9775ab81536412dbd4ca85937432de94 SHA512 a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb
-EBUILD iptables-1.6.1-r3.ebuild 3270 BLAKE2B 414a816e479bbadc14d612427d4dbf896f38c643d889739de706d27221bd4f7b29e32fd662a15a21a296f14adcff9b616e200e3dcae0fd8e44dc2649ca0ac153 SHA512 3eb77414a97768c13865cb5b2cf75ecb13c0229c07a81ca91599bdb27200c461312c15ea53edffd54bda28327675b784b65c1a24d74662ecea3c5ab3c44f6f51
-EBUILD iptables-1.6.2-r2.ebuild 3340 BLAKE2B aad99bac62ba2ec4754e93a211ef82672ad2639011009ade87ead6062221900ec32dcc5bd732fecf3017fd53e22e45d51343e8e6b656768d5d97403ee11daa59 SHA512 744bff7edd5b33d18d8cc28b7f8fba70f692975f2f8f36143524abcd7edec827bf5d7b21b2127ffcb155f542b9520787776968e158af71b1611b1cfad11d463a
-EBUILD iptables-1.8.2-r2.ebuild 3446 BLAKE2B 9cbf96d3253ddf4bdbbdcdd7bd93b384503528c9ca021523236ebda045a0046c1287236ea473967782cc6eff43653ac573b8ca1425b70f85275697282d330fa9 SHA512 068bec8142df4c2cbe1c0019afb8011be2d22bb72820659e0c8a6079b6bdfb67c1671cb2a9a323cad67a6acff677988838fa387c80ac9e1d54b6891add893674
-EBUILD iptables-1.8.3-r1.ebuild 3402 BLAKE2B ff4b46d0c95ec9ae02b269b32234834553e48ca7884c9dd0b8bf719d84a176b79898d7f3aef6fefc8764774f95b2d3f380cb3a1d4dbde78de612181e685de0ec SHA512 a639d8de9b7884ed51e77fadb40885e2dd83011c609d78dc8c55b362ee1f81b066a854b495ca0adba09fbe5cedf572901e23256340a777b8384e6a0333390330
-EBUILD iptables-1.8.4.ebuild 3302 BLAKE2B 81aa119eca2308416f59b6a1ef8250ea623be4b55f95ccc35f23ec7f52769b57c35b34d2142f1259e644ea6a294a036c97aa2a1a1d50b896b44f707973fd35ff SHA512 e74682d90e770cafcdfc475d4951a26f0f6ebe03d950d3729dd86d00d8c9a4fe599741079023670c4db564f984a4c47d393116c3407680b5ef82706576b91077
+EBUILD iptables-1.6.1-r3.ebuild 3268 BLAKE2B 665891ca8247eedb0525dabfa38834794d51375a431f91cd1f031df6a7f3f7c7a9a2646e64a2f2ec6841ca71073fe304a97d96fb301ca1fc8d959d4cd675a890 SHA512 722f1574bcd5d66178f28d6c97c03050f0be851adffb95daf96d1c756bbf7453827cf70cde04e164929700b011e980ec8f6bd1947be022011e8d39f819460f5a
+EBUILD iptables-1.6.2-r2.ebuild 3333 BLAKE2B 21d4bd596b61da1409a797c9883d612f5688ec15e144621028ba11872a184493440d636d998795b74be7f8856b39a184a24f25ac6ff56ff756fe66e3eaefc041 SHA512 6153c18419f192db0b9fccd7827ad41da201d3c25a298f0e2b823a97dd0b3d9bd6fa4dc9987ff62a0b8a0c1265b10ee71170385c2b5c5272c6183c0e21ae41bd
+EBUILD iptables-1.8.3-r1.ebuild 3398 BLAKE2B 0c61459abb1fa45910ac746f1af4527647494305ea8486f9db2935bf281c28928d9af767b781bc6f3d4a4e2c306cc7fafb71d286bb248e3f655a90b98be87d41 SHA512 533f02df18534fbe5ef8751656445cb3114a03697b6d0c06fab1b99ff590ea0ed76adef117e03681c3814633b9fbdb4c84027cf57535a5b285bc2b8c878f820b
+EBUILD iptables-1.8.4-r1.ebuild 3865 BLAKE2B 2c24556afd8268cabdb197dedab571c0111e0865e8e3fa8e736885fa9e99929bb5570d10d25d418d5afaa6107efe3e519a3c2b4a8b97029bcaa26477d1ff4b92 SHA512 7ffc7cef8b2be865b9ceb4b9695b25d4c1edadf446880858620fc0d7d35a2bd372a839695c9a8d5c9439a132b0bf1614740c41eca2862e03b27abe4e996cb677
+EBUILD iptables-1.8.4.ebuild 3298 BLAKE2B 923a2c7b841f3bb1dde876db19837f1eda830f6f0495e9aaf18743af298435f543b9865deb0e1e7942130f2cdaa000717663ae05ec97f721e467cead207480bb SHA512 97ab0f7fd1aa2380246eef249b7a01cbd7aecbd271aebe1b40bd0eee25053a4a813309774412e3308b3ba9d6dc102289c89b3bfc35506a8ad985c31d80a3c078
 MISC metadata.xml 1465 BLAKE2B c60f98672fb6153499b700a436b26b63c0f271c8f8519a3391e486b761ba673c362a7dc5e23b86e3af887270596a1682ea993e643a08215f670f7e3804f095bd SHA512 26bf7e3008dfd705995b15eccaaaa8c79fd488be191570a874b76571a2f9d4648a7c19eb576399ca7bbe849336d7d193f5b6b58a3ff83f87f3c157c53333e987
diff --git a/net-firewall/iptables/files/iptables-1.8.4-no-symlinks.patch b/net-firewall/iptables/files/iptables-1.8.4-no-symlinks.patch
new file mode 100644
index 000000000000..349a01abd5fd
--- /dev/null
+++ b/net-firewall/iptables/files/iptables-1.8.4-no-symlinks.patch
@@ -0,0 +1,19 @@
+diff --git a/iptables/Makefile.am b/iptables/Makefile.am
+index 71b1b1d4..30c77f9a 100644
+--- a/iptables/Makefile.am
++++ b/iptables/Makefile.am
+@@ -71,12 +71,10 @@ CLEANFILES       = iptables.8 xtables-monitor.8 \
+ 
+ vx_bin_links   = iptables-xml
+ if ENABLE_IPV4
+-v4_sbin_links  = iptables-legacy iptables-legacy-restore iptables-legacy-save \
+-		 iptables iptables-restore iptables-save
++v4_sbin_links  = iptables-legacy iptables-legacy-restore iptables-legacy-save
+ endif
+ if ENABLE_IPV6
+-v6_sbin_links  = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save \
+-		 ip6tables ip6tables-restore ip6tables-save
++v6_sbin_links  = ip6tables-legacy ip6tables-legacy-restore ip6tables-legacy-save
+ endif
+ if ENABLE_NFTABLES
+ x_sbin_links  = iptables-nft iptables-nft-restore iptables-nft-save \
diff --git a/net-firewall/iptables/iptables-1.6.1-r3.ebuild b/net-firewall/iptables/iptables-1.6.1-r3.ebuild
index d8603b1de212..63eb987090b6 100644
--- a/net-firewall/iptables/iptables-1.6.1-r3.ebuild
+++ b/net-firewall/iptables/iptables-1.6.1-r3.ebuild
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 # Subslot tracks libxtables as that's the one other packages generally link
 # against and iptables changes.  Will have to revisit if other sonames change.
 SLOT="0/12"
-KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 m68k ~mips ppc ppc64 s390 sparc x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
diff --git a/net-firewall/iptables/iptables-1.6.2-r2.ebuild b/net-firewall/iptables/iptables-1.6.2-r2.ebuild
index 40d1b1f8de5f..abd85bcb2ebf 100644
--- a/net-firewall/iptables/iptables-1.6.2-r2.ebuild
+++ b/net-firewall/iptables/iptables-1.6.2-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=6
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 # Subslot tracks libxtables as that's the one other packages generally link
 # against and iptables changes.  Will have to revisit if other sonames change.
 SLOT="0/12"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
diff --git a/net-firewall/iptables/iptables-1.8.3-r1.ebuild b/net-firewall/iptables/iptables-1.8.3-r1.ebuild
index 52246a8ac413..a1da5ac8f6a2 100644
--- a/net-firewall/iptables/iptables-1.8.3-r1.ebuild
+++ b/net-firewall/iptables/iptables-1.8.3-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 # Subslot reflects PV when libxtables and/or libip*tc was changed
 # the last time.
 SLOT="0/1.8.3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
diff --git a/net-firewall/iptables/iptables-1.8.2-r2.ebuild b/net-firewall/iptables/iptables-1.8.4-r1.ebuild
index 6fdac74e6d4b..80ef3dd2877b 100644
--- a/net-firewall/iptables/iptables-1.8.2-r2.ebuild
+++ b/net-firewall/iptables/iptables-1.8.4-r1.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 # Force users doing their own patches to install their own tools
 AUTOTOOLS_AUTO_DEPEND=no
@@ -13,24 +13,27 @@ HOMEPAGE="https://www.netfilter.org/projects/iptables/"
 SRC_URI="https://www.netfilter.org/projects/iptables/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
-# Subslot tracks libxtables as that's the one other packages generally link
-# against and iptables changes.  Will have to revisit if other sonames change.
-SLOT="0/12"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86"
+# Subslot reflects PV when libxtables and/or libip*tc was changed
+# the last time.
+SLOT="0/1.8.3"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
+	app-eselect/eselect-iptables
 	conntrack? ( >=net-libs/libnetfilter_conntrack-1.0.6 )
 	netlink? ( net-libs/libnfnetlink )
 	nftables? (
 		>=net-libs/libmnl-1.0:0=
-		>=net-libs/libnftnl-1.1.1:0=
+		>=net-libs/libnftnl-1.1.5:0=
 	)
 	pcap? ( net-libs/libpcap )
 "
 DEPEND="${COMMON_DEPEND}
 	virtual/os-headers
 	>=sys-kernel/linux-headers-4.4:0
+"
+BDEPEND="
 	virtual/pkgconfig
 	nftables? (
 		sys-devel/flex
@@ -41,12 +44,16 @@ RDEPEND="${COMMON_DEPEND}
 	nftables? ( net-misc/ethertypes )
 "
 
+PATCHES=(
+	"${FILESDIR}/iptables-1.8.4-no-symlinks.patch"
+	"${FILESDIR}/iptables-1.8.2-link.patch"
+)
+
 src_prepare() {
 	# use the saner headers from the kernel
-	rm -f include/linux/{kernel,types}.h
+	rm include/linux/{kernel,types}.h || die
 
-	eapply "${FILESDIR}"/${P}-link.patch
-	eapply_user
+	default
 	eautoreconf
 }
 
@@ -77,8 +84,6 @@ src_configure() {
 }
 
 src_compile() {
-	# Deal with parallel build errors.
-	use nftables && emake -C iptables xtables-config-parser.h
 	emake V=1
 }
 
@@ -109,13 +114,13 @@ src_install() {
 
 	if use nftables; then
 		# Bug 647458
-		rm "${ED%/}"/etc/ethertypes || die
+		rm "${ED}"/etc/ethertypes || die
 
 		# Bug 660886
-		rm "${ED%/}"/sbin/{arptables,ebtables} || die
+		rm "${ED}"/sbin/{arptables,ebtables} || die
 
 		# Bug 669894
-		rm "${ED%/}"/sbin/ebtables-{save,restore} || die
+		rm "${ED}"/sbin/ebtables-{save,restore} || die
 	fi
 
 	systemd_dounit "${FILESDIR}"/systemd/iptables-{re,}store.service
@@ -124,7 +129,25 @@ src_install() {
 	fi
 
 	# Move important libs to /lib #332175
-	gen_usr_ldscript -a ip{4,6}tc iptc xtables
+	gen_usr_ldscript -a ip{4,6}tc xtables
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	local default_iptables="xtables-legacy-multi"
+	if ! eselect iptables show &>/dev/null; then
+		elog "Current iptables implementation is unset, setting to ${default_iptables}"
+		eselect iptables set "${default_iptables}"
+		use ipv6 && eselect iptables set --ipv6 "${default_iptables}"
+	fi
+	eselect iptables show
+}
+
+pkg_prerm() {
+	elog "Unsetting iptables symlinks before removal"
+	eselect iptables unset
 
-	find "${ED}" -name "*.la" -delete || die
+	# the eselect module failing should not be fatal
+	return 0
 }
diff --git a/net-firewall/iptables/iptables-1.8.4.ebuild b/net-firewall/iptables/iptables-1.8.4.ebuild
index 8cb78dfb30be..ba0c606aedff 100644
--- a/net-firewall/iptables/iptables-1.8.4.ebuild
+++ b/net-firewall/iptables/iptables-1.8.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 # Subslot reflects PV when libxtables and/or libip*tc was changed
 # the last time.
 SLOT="0/1.8.3"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="conntrack ipv6 netlink nftables pcap static-libs"
 
 COMMON_DEPEND="
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index 0725650ba22b..c318da90eaa6 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -1,19 +1,16 @@
 AUX libexec/nftables-mk.sh 1070 BLAKE2B 30d8109d74e7d8c4f51c753f676f91a1902ad42f6d68662f1191ff73d2a43a1bf49fb795f3763705f8aeb0a4f22cab0006a943e01adb188f1ef9eb05125dfdbd SHA512 a14e48f014f75c7e611bf2a653d9760804754febd1ae4543f78abbfbe60c79f5aa07c5fd53fe26bb74b48fcb8cb8aa78274771212e41c42db031e8c8ba7e81d2
 AUX libexec/nftables.sh 3665 BLAKE2B 74362a4425e974e74e7b895980002f0ded2ecbb4731bbf956edb56ffb9f1ad394802c4eeab3af3735eba4d8e71572a5663e564ce4e7fad76c9715043b90c1b43 SHA512 6cb1ac0928ae2da5c69764d45c52a661a6d72698bb9edd6a603580d2f9bd82b59f2a2661e7569ade3a3b729459d115004f251ad6a5eac8cdf1d38c65bfa9349e
-AUX nftables-0.9.1-avoid_dive_into_py_subdir.patch 1097 BLAKE2B dfb2b75226f54ec6af270de97edc10d065e5a9842654e8c6e5c13f3dbc7550e9a4bce90626418bf618d5111c4fbea4a361797e794150923286454c8fe4386b4f SHA512 cbcbd8897f3659771edf53df26f2741e0803d1e8d48180889d687122f986d39f412a88afd1c6d4cf0b7709d024d0c648065dd30714d1401718068291320b84e0
-AUX nftables-0.9.1-python_build.patch 1490 BLAKE2B 9cd50eaa93c315752f545827acc03629a349e46542ac884783b4494a8ec8d37d2270de9c13d67c49b91ba1ba510f32cd0fdde520a01957527633c1b860f3c3d3 SHA512 d3cd35b42203112b4423cb89eff51bccb63e18f2a325cf9b486cc8db367892d1afea941198a66c6a671df9324bd7cab39ed4cba7d0447f6bff10861a5cdcfda5
+AUX man-pages/gen-manpages.bash 1797 BLAKE2B c93cc311570abd674a12eb88711cf01664f437b8dc0fb4de36194f36671d92c35e04fcff6c56adcb0e642f089169f63ef063736398584e5e7ce799bf55acf2ff SHA512 ea3291412ce13d9dd463403fcc11c665c9de63edaabdecaf55e051b52b0ff845c9c7d63a6c4c08e4d2d94428815fe11daf9b7390081b4e9de4774e188b9ea677
+AUX nftables-0.9.4-Allow-building-from-tarballs-without-yacc-lex.patch 1132 BLAKE2B 49d938450bd0e7b09266c2e49ac09aa2bde5f4ab945478a1c973cc05368a9338a5aee222c9638bd44a27f6e81233f3843e672ef3177e25f8e851a2c10edfda36 SHA512 31dce9d6508f36d8411ea834cbb35989067a93b0af2366f278d12aaf30b6fd9b70995e6ad21836e4b44ba009a77900057139d292053533330826ec496009de24
 AUX nftables-mk.confd 899 BLAKE2B f4c3d82fbae87fb0d755af786a98db591b6a667cf33660ba9275ada2e6417fad1899a7f29762f23c112fc5c9e178bc7590c3b2ba26617853c3577917bd7d3edf SHA512 505ed05674a04367f1a3d5cf6447596ad1c3b2e9c920697f12f58a20d94c2a39b0041bb4911678511c4548566a69d964661d4afc3e7e27997943b875f204c602
 AUX nftables-mk.init 2090 BLAKE2B 62f56586ca4ba0acbd3ac41f4904041d625388771bbafc32833055a5f3c00f251e1d9a04bb41dd672f33d13a0825f7e4470a30d7e874df1abd41508148ef42b0 SHA512 819b2d60b42207cb70d95b700557e873fe18c5f6e8437683240beb317f773cf8e18755086e24652a9bcff49c6f96af8cd9e3f3b62c9f433779eff4e3f3935197
 AUX nftables.confd 655 BLAKE2B 5512be1edd43e270941de3d9b66fda69e4afd7c7e6e970b232a044c2fd64f8e50b9b55a4fe670174c3eabf3d176ee0158c1043baec4b76b0802e7e97bc862fcf SHA512 8370abcdc89fcd9da5dc7d1620be6afb4633b8bcd0a8a120b464cc1a7e1fab6f34956c293da3f6d3cbe1f7a2e03038fd0c94a614137ae5657d29ffdb5f3fa144
 AUX nftables.init 3069 BLAKE2B 68c6b2b81995bd909c00cc3527f891f04d0dd30532cd821c89b59fc7e3ea0dff0e98d767cee2c00a5462023fdf6f59e813dec7063768a34187f2404377e498f7 SHA512 ca761be0440945b21d5b002468baffb3299d0a3ac244aa895734dfdfaf442e7a73b757bcda99d958582064411d1b80b2cbcb4eb532bb219b4df407c9ed892661
 AUX systemd/nftables-restore.service 394 BLAKE2B 1c1f358eb2eff789e68c051098c971f11a8df6621c3c919e30a1ec1213f6db822c390609c01827fe9fc75c540effa3e3a7b6f93bd24e16ea19841bbfaab796ed SHA512 18da6a770bb3e94fd6b2c9e6f033450aaff9fe886c8846f780d08a21e2fc884ac078652743b50b3d4ea8c9500f92d272bdd27e2881e438c2b223d40816c100a0
-DIST nftables-0.9.0.tar.gz 417981 BLAKE2B 4dfba4d71928f1694ffeb4871353fc373d88e23c5ba716e726e1e6aba0efb2703233528f7a408bfefe47bfe54aa3612cccab9742c2a2208ec8c7a4bcda0e1823 SHA512 78e383bad5440c9414202cf0e4b6749fc5c01071d2fa547208e61cea6e7e179933990e7e538a60696eb0a7cf510d2c4b273a91d50287bb51507d244cd2875aed
-DIST nftables-0.9.1.tar.bz2 764066 BLAKE2B 26b194d6b3b970c05348c32a3ab21e8c25fcdb0d09d3d6b467198ba23a5bb44e7b6450d3efb86c39a488df4a837885c4a1ab96c197d5449f7de49b7b18ff5f90 SHA512 e14b75197ba3fea2a46c090450bf8b45b39fdc20db67bab1d6919c90128dee8ea8bbe9508e070f86b22ec70bcad8ab584fb89630a2240f09683137471c77d242
-DIST nftables-0.9.2.tar.bz2 779850 BLAKE2B 40bf9ed956a126048f27b343afc7aa4f6e34f35dc91127402cb127903f8150d212c80491fef2b54c18a63ca065608521062b3f6a2dd78969bdbf4d7d8a5a751d SHA512 2d83b104af0d70f99a16c2e40afdb9bf89bd984323810e2895976c5e2e346bf09dd88850a391f295e335279adfdd39d34c13610cf8e6b801499dc0df2a5cecf6
 DIST nftables-0.9.3.tar.bz2 786759 BLAKE2B 578276d861fdb2b843223aca1276bbc1dda9627d0058259a966e324e30ee64d8c102d1e2cceb82d29143caa9dcd1a4492df168f1c87b136fc7b3a1a7dc8568a8 SHA512 d264f6fc75c95510e29fe7d5b82ae418d502f40437b098ba6117ffb1374d9989d70a7296e2e58c5fb25142145a987bb9c160902637899f892589809f9541db43
-EBUILD nftables-0.9.0-r5.ebuild 2886 BLAKE2B bea596aa70ac2317ad61e3ee2bd27e904c3004124e7a79fa91cd4177e0fc09fc82e9181e97766079c6005de2f0f5c04ccabdddd376865884b05f1660a049360f SHA512 44aa02207ec3db7ca91b9969847b82ed7d417b4ae7cdcd5a0fb54bb99d492be7ed3f56321d6d12757289912030016e0a1a2c6be8b4b93f40983d012c02f0e4f3
-EBUILD nftables-0.9.0-r6.ebuild 2869 BLAKE2B af739ee33b4666216d4bc049b3c5f274a90a3f906ef72a60ce433848cc4cf2801c5ccc9fe19945fd36f3da821ddbcfbccb7af510dbc4df2b0b35c38c39529ba7 SHA512 50bb9e432f6b4de5aaac7010799a915841b870ab49fe6b1636fe1e0ce8dc0bf60a1fb1bc412c24af9b66f886bc41d9a7f77ffa092db2b8d84d83213d79c896fd
-EBUILD nftables-0.9.1-r2.ebuild 3838 BLAKE2B c2e56f1b280a899848a052ef5860fb50de0130c2896fc34271514ab2e9d6365a9df2f2adbcc8813eb84a69c802e6cd51240d21784dd7325e5493f0e56d90e334 SHA512 440efe48987ce9eec72b4ec47b7258b36adf3f666c4bee60f687eae9f0ae6b4977f8905648aa7b8b30375163bb0b69005f035b663762f58ec9ced3db642d3eb1
-EBUILD nftables-0.9.2-r2.ebuild 3741 BLAKE2B 1aefcc28925d397aa277214069c8f03f9974028f44d8a65742fc9fb4d85c553b8d2cca9f468d05fdcb21455bdbca62be5398dcd5aa868a8f3d72dfe2cd87d278 SHA512 3d3229de926b53f4ec6104ba791b00f8cd30e815a1463c75d282d4321952ced419fc227e8326a1d1e91e76fbfa5db23d09061ba7cd184665682e22de12928627
-EBUILD nftables-0.9.3-r1.ebuild 3755 BLAKE2B fc44ae9636c1754eb5a9e9a7446f123d692bf44f3f2a079598caf4fa17bd1cbfe5fd8b97216a557130c78b0e76343fee9e25c38c2fa766381c090652ef5535be SHA512 095c8901aedc4ee1bb0da83a1f4186c1eba9f47fe749cd8edba9e46a43ba32bab53373a339df85656d3034c44a8a820dd907ec02841b3125df9aa2ca456eefae
+DIST nftables-0.9.4-manpages.tar.xz 38580 BLAKE2B bb561c7824d032ecfff5c98af10c95af6f5188377f43de8398be7e503adff0441d49fa3e2cefcb646927cc1a4222957f0cc75d5ad4c770ef3a3f8cb8a677c5ce SHA512 1b94ff06ceccf75bbefbf64496d5fa0b492907d7ec5fe41f7808c6e239b2a0a42e88d61e35e22485abee7e4bd382178e962a7c5b113433247ca329cbfa408bca
+DIST nftables-0.9.4.tar.bz2 792788 BLAKE2B 3f2d8ff3bcfe3ab815ee369c4937adef5e5730edee8ea59b32031732802e608bcb47ddd3e55303ad6c295158aff51b2f2c069d98600db83d732ff78836c7abb5 SHA512 cef5b5f26f3a2893a3eb1323f1f0ecfd6e2865e0eb040e9b7da5824e5be2274b888e661abe96e828add9e951f47303e30cb7c9238d267a031c0f99b5f3b6e2c0
+EBUILD nftables-0.9.3-r1.ebuild 3756 BLAKE2B 79cbed1a1065288d7736bb3687e7142a9bc55e788bdf88cdbb7fb48f6adfd93af2e0deb6964d3522f09fbeeed4f6c4700988f7db27a6e52ccf10bd0a9c469026 SHA512 5f508726b8e1543590379b60c589f97f722bb458ac12530833992d76094e5c70df830af223363a3c95fb142309843df6b30320b666062b48f2659e4c014973b6
+EBUILD nftables-0.9.4-r1.ebuild 3781 BLAKE2B c25fd6174c133d80178976e4b1e624061de4876459640384c555476e267b98ebeb601d2e2c475179e7732e5b4f5f9c25aab21ed4ef6d4dc024b42f8c5b8f9ffb SHA512 dac803385ecc52e77c4531c13a9b8b3cd8e694cf0a6adc4559fd095833b6b9a9284a7a7bed41848a44b1efd0943a6fb8c639d6daef9b73f562878c6b946b23b0
+EBUILD nftables-0.9.4-r2.ebuild 4130 BLAKE2B 88a9ebe9a5228d11a9e9cb9c1e9b7493e8d7b0cb9a4300c7cbed6cbe0b7f2c2f5e20d3d7b2eb1eeab3ba3d6e71413570af63c295d5d5ba082c70b1b9e4ffdcfe SHA512 21bfce23115c386124a56563856287ec270dd39f9d69d4fe6d8e4ffd007e926ef833c4660109aea6d5965fc615409173d48b9d7267172308c08b8ff5668cc3af
 MISC metadata.xml 918 BLAKE2B 8c2c39f04e2c5591ea06788788d244bddc1cdc25780810b2a19e131d43d0bdf964d2129c01605fc536451cb9a3354420a1c2f656dad45c56dec4f360a95fe473 SHA512 08de9d11f48dcb132eb5423de56b458dd4c4122329b84b56c252436c882b7670233f2217cc01755649f27e14ff9346cf99e3a742224567e712f5cb3678165dcf
diff --git a/net-firewall/nftables/files/man-pages/gen-manpages.bash b/net-firewall/nftables/files/man-pages/gen-manpages.bash
new file mode 100644
index 000000000000..a2223d3dd5be
--- /dev/null
+++ b/net-firewall/nftables/files/man-pages/gen-manpages.bash
@@ -0,0 +1,72 @@
+#!/bin/bash
+#
+# create manpages for nftables
+
+declare -A MAN_PAGES
+
+MAN_PAGES=(
+	[nft.8]="nft.txt"
+	[libnftables-json.5]="libnftables-json.adoc"
+	[libnftables.3]="libnftables.adoc"
+)
+
+build_manpages() {
+	tar axf "${distfile}" -C "${srcdir}" || return
+
+	pushd "${srcdir}/${version}/doc" > /dev/null || return
+	local manpage
+	for manpage in "${!MAN_PAGES[@]}"; do
+		a2x -L --doctype manpage --format manpage -D . "${MAN_PAGES[${manpage}]}" || return
+	done
+	popd > /dev/null || return
+
+	local -a tarfiles
+	readarray -t tarfiles < <(printf -- "${version}/doc/%s\\n" "${!MAN_PAGES[@]}")
+
+	tar -Jc --owner='root:0' --group='root:0' \
+		--transform="s:^${version}/doc:${version}-manpages:" \
+		-f "${version}-manpages.tar.xz" \
+		-C "${srcdir}" \
+		"${tarfiles[@]}" || return
+
+	rm -rf "${srcdir:?}/${version}" || return
+}
+
+main() {
+	shopt -s failglob
+	local version="${1}" srcdir="${0%/*}"
+
+	if [[ -z ${version} ]]; then
+		# shellcheck disable=SC2016
+		version=$(
+			find . -maxdepth 1 -type d -a -name 'nftables-*' -printf '%P\0' 2>/dev/null \
+			| LC_COLLATE=C sort -z \
+			| sed -z -n '${p;Q}' \
+			| tr -d '\000'
+		)
+		if [[ -z ${version} ]]; then
+			# shellcheck disable=SC2016
+			version=$(
+				find . -maxdepth 3 -mindepth 3 -type f -a -name 'nftables-*.ebuild' -printf '%P\0' 2>/dev/null \
+				| LC_COLLATE=C sort -z \
+				| sed -r -z -n '${s:.*/::;s:-r[0-9]+::;s:[.]ebuild::;p;Q}' \
+				| tr -d '\000'
+			)
+			if [[ -z ${version} ]]; then
+				printf 'Usage %s <version>\n' "${0}" >&2
+				return 1
+			fi
+		fi
+	elif [[ ${version} =~ [0-9.]+ ]]; then
+		version="nftables-${version}"
+	fi
+
+	local distdir distfile
+	local -a distfiles
+	distdir="$(portageq distdir)" || return
+	distfiles=( "${distdir}/${version}.tar."* ) || return
+	distfile="${distfiles[-1]}"
+	build_manpages || return
+}
+
+main "${@}"
diff --git a/net-firewall/nftables/files/nftables-0.9.1-avoid_dive_into_py_subdir.patch b/net-firewall/nftables/files/nftables-0.9.1-avoid_dive_into_py_subdir.patch
deleted file mode 100644
index 8ff4b85d88a8..000000000000
--- a/net-firewall/nftables/files/nftables-0.9.1-avoid_dive_into_py_subdir.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From c5ca85848c2fe28366d286a5b000f99d927516d3 Mon Sep 17 00:00:00 2001
-From: Jan Engelhardt <jengelh@inai.de>
-Date: Tue, 25 Jun 2019 08:58:34 +0200
-Subject: build: avoid recursion into py/ if not selected
-
-Signed-off-by: Jan Engelhardt <jengelh@inai.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- Makefile.am    | 6 ++++--
- py/Makefile.am | 3 ---
- 2 files changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index e567d32d..4a17424d 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -3,8 +3,10 @@ ACLOCAL_AMFLAGS	= -I m4
- SUBDIRS = 	src	\
- 		include	\
- 		files	\
--		doc		\
--		py
-+		doc
-+if HAVE_PYTHON
-+SUBDIRS += py
-+endif
- 
- EXTRA_DIST =	tests	\
- 		files
-diff --git a/py/Makefile.am b/py/Makefile.am
-index 9fce7c9e..5f4e1f6f 100644
---- a/py/Makefile.am
-+++ b/py/Makefile.am
-@@ -1,7 +1,5 @@
- EXTRA_DIST = setup.py __init__.py nftables.py schema.json
- 
--if HAVE_PYTHON
--
- all-local:
- 	cd $(srcdir) && \
- 		$(PYTHON_BIN) setup.py build --build-base $(abs_builddir)
-@@ -28,4 +26,3 @@ clean-local:
- 
- distclean-local:
- 	rm -f version
--endif
--- 
-cgit v1.2.1
-
diff --git a/net-firewall/nftables/files/nftables-0.9.1-python_build.patch b/net-firewall/nftables/files/nftables-0.9.1-python_build.patch
deleted file mode 100644
index 81f65524ce7d..000000000000
--- a/net-firewall/nftables/files/nftables-0.9.1-python_build.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 1f7e4deb527db32c55646e6e5baedb2ff2aa205e Mon Sep 17 00:00:00 2001
-From: Jan Engelhardt <jengelh@inai.de>
-Date: Tue, 25 Jun 2019 08:58:33 +0200
-Subject: build: unbreak non-functionality of --disable-python
-
-Signed-off-by: Jan Engelhardt <jengelh@inai.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- configure.ac | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 75cf9199..b71268e8 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -103,11 +103,14 @@ AC_ARG_WITH([python_bin],
- 	   )
- 
- AS_IF([test "x$PYTHON_BIN" = "x"], [
--	AS_IF([test "x$enable_python" = "xyes"], [AC_MSG_ERROR([Python asked but not found])])
--	AS_IF([test "x$enable_python" = "xcheck"], [AC_MSG_WARN([Python not found, continuing anyway])])
-+	AS_IF([test "x$enable_python" = "xyes"], [AC_MSG_ERROR([Python asked but not found])],
-+	[test "x$enable_python" = "xcheck"], [
-+		AC_MSG_WARN([Python not found, continuing anyway])
-+		enable_python=no
- 	])
-+])
- 
--AM_CONDITIONAL([HAVE_PYTHON], [test "x$PYTHON_BIN" != "x"])
-+AM_CONDITIONAL([HAVE_PYTHON], [test "$enable_python" != "no"])
- 
- AC_CONFIG_FILES([					\
- 		Makefile				\
-@@ -138,7 +141,7 @@ nft configuration:
-   libxtables support:		${with_xtables}
-   json output support:          ${with_json}"
- 
--AS_IF([test "x$PYTHON_BIN" != "x"], [
-+AS_IF([test "$enable_python" != "no"], [
- 	echo "  enable Python:		yes (with $PYTHON_BIN)"
- 	], [
- 	echo "  enable Python:		no"
--- 
-cgit v1.2.1
-
diff --git a/net-firewall/nftables/files/nftables-0.9.4-Allow-building-from-tarballs-without-yacc-lex.patch b/net-firewall/nftables/files/nftables-0.9.4-Allow-building-from-tarballs-without-yacc-lex.patch
new file mode 100644
index 000000000000..6eb708596255
--- /dev/null
+++ b/net-firewall/nftables/files/nftables-0.9.4-Allow-building-from-tarballs-without-yacc-lex.patch
@@ -0,0 +1,37 @@
+From 3c83e2bca90b697e7c98f849319f1ad015dcdb86 Mon Sep 17 00:00:00 2001
+From: Matt Turner <mattst88@gmail.com>
+Date: Tue, 7 Apr 2020 13:16:59 -0700
+Subject: [PATCH nftables 2/2] build: Allow building from tarballs without
+ yacc/lex
+
+The generated files are included in the tarballs already, but
+configure.ac was coded to fail if yacc/lex were not found regardless.
+
+Signed-off-by: Matt Turner <mattst88@gmail.com>
+---
+ configure.ac | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index a04d94bc..3496e410 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -29,13 +29,13 @@ AC_PROG_SED
+ AM_PROG_LEX
+ AC_PROG_YACC
+ 
+-if test -z "$ac_cv_prog_YACC"
++if test -z "$ac_cv_prog_YACC" -a ! -f "${srcdir}/src/parser_bison.c"
+ then
+         echo "*** Error: No suitable bison/yacc found. ***"
+         echo "    Please install the 'bison' package."
+         exit 1
+ fi
+-if test -z "$ac_cv_prog_LEX"
++if test -z "$ac_cv_prog_LEX" -a ! -f "${srcdir}/src/scanner.c"
+ then
+         echo "*** Error: No suitable flex/lex found. ***"
+         echo "    Please install the 'flex' package."
+-- 
+2.24.1
+
diff --git a/net-firewall/nftables/nftables-0.9.0-r5.ebuild b/net-firewall/nftables/nftables-0.9.0-r5.ebuild
deleted file mode 100644
index dc29d33b649e..000000000000
--- a/net-firewall/nftables/nftables-0.9.0-r5.ebuild
+++ /dev/null
@@ -1,103 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools linux-info systemd
-
-DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-SRC_URI="https://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ia64 x86"
-IUSE="debug doc +gmp json +modern-kernel +readline"
-
-RDEPEND=">=net-libs/libmnl-1.0.3:0=
-	gmp? ( dev-libs/gmp:0= )
-	json? ( dev-libs/jansson )
-	readline? ( sys-libs/readline:0= )
-	>=net-libs/libnftnl-1.1.1:0="
-
-DEPEND="${RDEPEND}
-	>=app-text/docbook2X-0.8.8-r4
-	doc? ( >=app-text/dblatex-0.3.7 )
-	sys-devel/bison
-	sys-devel/flex
-	virtual/pkgconfig"
-
-S="${WORKDIR}/v${PV}"
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		if use modern-kernel && kernel_is lt 3 18; then
-			eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
-		fi
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sbindir="${EPREFIX}"/sbin
-		$(use_enable debug)
-		$(use_enable doc pdf-doc)
-		$(use_with !gmp mini_gmp)
-		$(use_with json)
-		$(use_with readline cli)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	local mksuffix=""
-	use modern-kernel && mksuffix="-mk"
-
-	exeinto /usr/libexec/${PN}
-	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
-	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}${mksuffix}.init ${PN}
-	keepdir /var/lib/nftables
-
-	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
-
-	docinto /usr/share/doc/${PF}/skels
-	dodoc "${D}"/etc/nftables/*
-	rm -R "${D}"/etc/nftables
-}
-
-pkg_postinst() {
-	local save_file
-	save_file="${EROOT%/}/var/lib/nftables/rules-save"
-
-	# In order for the nftables-restore systemd service to start
-	# the save_file must exist.
-	if [[ ! -f "${save_file}" ]]; then
-		( umask 177; touch "${save_file}" )
-	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
-		ewarn "Your system has dangerous permissions for ${save_file}"
-		ewarn "It is probably affected by bug #691326."
-		ewarn "You may need to fix the permissions of the file. To do so,"
-		ewarn "you can run the command in the line below as root."
-		ewarn "    'chmod 600 \"${save_file}\"'"
-	fi
-
-	elog "If you wish to enable the firewall rules on boot (on systemd) you"
-	elog "will need to enable the nftables-restore service."
-	elog "    'systemd_enable_service basic.target ${PN}-restore.service'"
-	elog
-	elog "If you are creating firewall rules before the next system restart "
-	elog "the nftables-restore service must be manually started in order to "
-	elog "save those rules on shutdown."
-}
diff --git a/net-firewall/nftables/nftables-0.9.0-r6.ebuild b/net-firewall/nftables/nftables-0.9.0-r6.ebuild
deleted file mode 100644
index 90884e99c1c3..000000000000
--- a/net-firewall/nftables/nftables-0.9.0-r6.ebuild
+++ /dev/null
@@ -1,103 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools linux-info systemd
-
-DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-SRC_URI="https://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~x86"
-IUSE="debug doc +gmp json +modern-kernel +readline"
-
-RDEPEND=">=net-libs/libmnl-1.0.3:0=
-	gmp? ( dev-libs/gmp:0= )
-	json? ( dev-libs/jansson )
-	readline? ( sys-libs/readline:0= )
-	>=net-libs/libnftnl-1.1.1:0="
-
-DEPEND="${RDEPEND}
-	>=app-text/docbook2X-0.8.8-r4
-	doc? ( >=app-text/dblatex-0.3.7 )
-	sys-devel/bison
-	sys-devel/flex
-	virtual/pkgconfig"
-
-S="${WORKDIR}/v${PV}"
-
-pkg_setup() {
-	if kernel_is ge 3 13; then
-		if use modern-kernel && kernel_is lt 3 18; then
-			eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
-		fi
-		CONFIG_CHECK="~NF_TABLES"
-		linux-info_pkg_setup
-	else
-		eerror "This package requires kernel version 3.13 or newer to work properly."
-	fi
-}
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sbindir="${EPREFIX}"/sbin
-		$(use_enable debug)
-		$(use_enable doc pdf-doc)
-		$(use_with !gmp mini_gmp)
-		$(use_with json)
-		$(use_with readline cli)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	local mksuffix=""
-	use modern-kernel && mksuffix="-mk"
-
-	exeinto /usr/libexec/${PN}
-	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
-	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}${mksuffix}.init ${PN}
-	keepdir /var/lib/nftables
-
-	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
-
-	docinto skels
-	dodoc "${D}"/etc/nftables/*
-	rm -R "${D}"/etc/nftables
-}
-
-pkg_postinst() {
-	local save_file
-	save_file="${EROOT%/}/var/lib/nftables/rules-save"
-
-	# In order for the nftables-restore systemd service to start
-	# the save_file must exist.
-	if [[ ! -f "${save_file}" ]]; then
-		( umask 177; touch "${save_file}" )
-	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
-		ewarn "Your system has dangerous permissions for ${save_file}"
-		ewarn "It is probably affected by bug #691326."
-		ewarn "You may need to fix the permissions of the file. To do so,"
-		ewarn "you can run the command in the line below as root."
-		ewarn "    'chmod 600 \"${save_file}\"'"
-	fi
-
-	elog "If you wish to enable the firewall rules on boot (on systemd) you"
-	elog "will need to enable the nftables-restore service."
-	elog "    'systemd_enable_service basic.target ${PN}-restore.service'"
-	elog
-	elog "If you are creating firewall rules before the next system restart "
-	elog "the nftables-restore service must be manually started in order to "
-	elog "save those rules on shutdown."
-}
diff --git a/net-firewall/nftables/nftables-0.9.3-r1.ebuild b/net-firewall/nftables/nftables-0.9.3-r1.ebuild
index eb102f26b556..5b91d72210c5 100644
--- a/net-firewall/nftables/nftables-0.9.3-r1.ebuild
+++ b/net-firewall/nftables/nftables-0.9.3-r1.ebuild
@@ -14,7 +14,7 @@ SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 arm ~arm64 ia64 ~ppc64 ~sparc x86"
+KEYWORDS="amd64 arm ~arm64 ~ia64 ~ppc64 ~sparc x86"
 IUSE="debug +doc +gmp json +modern-kernel python +readline static-libs xtables"
 
 RDEPEND="
diff --git a/net-firewall/nftables/nftables-0.9.2-r2.ebuild b/net-firewall/nftables/nftables-0.9.4-r1.ebuild
index 99f33eaaa6c3..c6c7496044cf 100644
--- a/net-firewall/nftables/nftables-0.9.2-r2.ebuild
+++ b/net-firewall/nftables/nftables-0.9.4-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{6,7} )
+PYTHON_COMPAT=( python3_{6,7,8} )
 
 inherit autotools linux-info python-r1 systemd
 
@@ -14,7 +14,7 @@ SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~sparc ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~ppc64 ~sparc ~x86"
 IUSE="debug +doc +gmp json +modern-kernel python +readline static-libs xtables"
 
 RDEPEND="
@@ -23,15 +23,17 @@ RDEPEND="
 	json? ( dev-libs/jansson )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:0= )
-	>=net-libs/libnftnl-1.1.4:0=
+	>=net-libs/libnftnl-1.1.6:0=
 	xtables? ( >=net-firewall/iptables-1.6.1 )
 "
 
 DEPEND="${RDEPEND}"
 
 BDEPEND="
-	doc? ( app-text/asciidoc )
-	>=app-text/docbook2X-0.8.8-r4
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
 	sys-devel/bison
 	sys-devel/flex
 	virtual/pkgconfig
@@ -83,7 +85,7 @@ src_configure() {
 		$(use_enable doc man-doc)
 		$(use_with !gmp mini_gmp)
 		$(use_with json)
-		$(use_with readline cli)
+		$(use_with readline cli readline)
 		$(use_enable static-libs static)
 		$(use_with xtables)
 	)
@@ -115,6 +117,7 @@ src_install() {
 		python_foreach_impl python_make install
 	fi
 
+	python_foreach_impl python_optimize
 	find "${ED}" -type f -name "*.la" -delete || die
 }
 
@@ -136,7 +139,7 @@ pkg_postinst() {
 
 	elog "If you wish to enable the firewall rules on boot (on systemd) you"
 	elog "will need to enable the nftables-restore service."
-	elog "    'systemd_enable_service basic.target ${PN}-restore.service'"
+	elog "    'systemctl enable ${PN}-restore.service'"
 	elog
 	elog "If you are creating firewall rules before the next system restart "
 	elog "the nftables-restore service must be manually started in order to "
diff --git a/net-firewall/nftables/nftables-0.9.1-r2.ebuild b/net-firewall/nftables/nftables-0.9.4-r2.ebuild
index adebe58c63c3..f9a434586f77 100644
--- a/net-firewall/nftables/nftables-0.9.1-r2.ebuild
+++ b/net-firewall/nftables/nftables-0.9.4-r2.ebuild
@@ -3,19 +3,20 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{6,7} )
+PYTHON_COMPAT=( python3_{6,7,8} )
 
 inherit autotools linux-info python-r1 systemd
 
 DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
 HOMEPAGE="https://netfilter.org/projects/nftables/"
 #SRC_URI="https://git.netfilter.org/nftables/snapshot/v${PV}.tar.gz -> ${P}.tar.gz"
-SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
+SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2
+	!doc? ( https://dev.gentoo.org/~chutzpah/dist/nftables/${P}-manpages.tar.xz )"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~x86"
-IUSE="debug +doc +gmp json +modern-kernel python +readline static-libs xtables"
+KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~ppc64 ~sparc ~x86"
+IUSE="debug doc +gmp json +modern-kernel python +readline static-libs xtables"
 
 RDEPEND="
 	>=net-libs/libmnl-1.0.3:0=
@@ -23,17 +24,17 @@ RDEPEND="
 	json? ( dev-libs/jansson )
 	python? ( ${PYTHON_DEPS} )
 	readline? ( sys-libs/readline:0= )
-	>=net-libs/libnftnl-1.1.3:0=
+	>=net-libs/libnftnl-1.1.6:0=
 	xtables? ( >=net-firewall/iptables-1.6.1 )
 "
 
 DEPEND="${RDEPEND}"
 
 BDEPEND="
-	doc? ( app-text/asciidoc )
-	>=app-text/docbook2X-0.8.8-r4
-	sys-devel/bison
-	sys-devel/flex
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
 	virtual/pkgconfig
 "
 
@@ -42,8 +43,9 @@ REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 #S="${WORKDIR}/v${PV}"
 
 PATCHES=(
-	"${FILESDIR}"/${P}-python_build.patch
-	"${FILESDIR}"/${P}-avoid_dive_into_py_subdir.patch
+	# this has been sent upstream, see
+	# https://marc.info/?l=netfilter-devel&m=158629102300853
+	"${FILESDIR}/nftables-0.9.4-Allow-building-from-tarballs-without-yacc-lex.patch"
 )
 
 python_make() {
@@ -88,7 +90,7 @@ src_configure() {
 		$(use_enable doc man-doc)
 		$(use_with !gmp mini_gmp)
 		$(use_with json)
-		$(use_with readline cli)
+		$(use_with readline cli readline)
 		$(use_enable static-libs static)
 		$(use_with xtables)
 	)
@@ -106,6 +108,12 @@ src_compile() {
 src_install() {
 	default
 
+	if ! use doc; then
+		pushd "${WORKDIR}/${P}-manpages" >/dev/null || die
+		doman *.?
+		popd >/dev/null || die
+	fi
+
 	local mksuffix="$(usex modern-kernel '-mk' '')"
 
 	exeinto /usr/libexec/${PN}
@@ -120,6 +128,7 @@ src_install() {
 		python_foreach_impl python_make install
 	fi
 
+	python_foreach_impl python_optimize
 	find "${ED}" -type f -name "*.la" -delete || die
 }
 
@@ -141,7 +150,7 @@ pkg_postinst() {
 
 	elog "If you wish to enable the firewall rules on boot (on systemd) you"
 	elog "will need to enable the nftables-restore service."
-	elog "    'systemd_enable_service basic.target ${PN}-restore.service'"
+	elog "    'systemctl enable ${PN}-restore.service'"
 	elog
 	elog "If you are creating firewall rules before the next system restart "
 	elog "the nftables-restore service must be manually started in order to "
diff --git a/net-firewall/shorewall/Manifest b/net-firewall/shorewall/Manifest
index 6de82ca07dc8..4355130f27b0 100644
--- a/net-firewall/shorewall/Manifest
+++ b/net-firewall/shorewall/Manifest
@@ -15,20 +15,20 @@ AUX shorewall.systemd 568 BLAKE2B 385edad8857f029f691481483cc3e5e5981836254b7b39
 AUX shorewall6-lite.systemd 612 BLAKE2B e658af2b6d399fe527a58201b80997651954df67a18be2465a1099b81f7ed89cc3c63d4ef550521d3b9e3cc995915439e21e1142f46f8df1e44e22b5c29009d5 SHA512 0bd832d4f8857bf9b1c9c776a53739d8666f002d1caab29c976a248916cf1eb5806d6b59dbf7ee8a120a3158b10e6fa6e179e34fe9fa6077a794ffa7d1e06cec
 AUX shorewall6.systemd 577 BLAKE2B 5c755c0105954a34e39e077af0e012d9d6e647715a4b12fbae4fc47f4ae19afd6a63266b3684ddead689b2d4f7450b7a12906258fc86ef33fc36a4dac3771274 SHA512 96b69df246a18e8b7dbfdbe78959da1baa8f2a97eb290853d4040a895f2ae91b97addd2ab4e4e19345960ffe8f1b099442f40ce319b27f0d4d8d7d4780d2e78d
 AUX shorewallrc-r3 2035 BLAKE2B 6f4e4c93cee1f25405cc3ac76958064f1241a325c8b530c30f6dbd94423577d592e88613f463c4b41c1af1db22c7e53512fd8509931bb6527a8da669f2dbe773 SHA512 eaa32bf6baca0d3555db918d6221c7678f5ba67e78bf9dcdc1bf96deded8f64838d3a332226fa6605f0c1ae82e51e0f2c1540fa6188fd9bced22460a631f48a8
-DIST shorewall-5.2.3.5.tar.bz2 554891 BLAKE2B 470b2a6d67e18f05262197877dc2bd853a756fcf3ac4e547c4e53a398fc1ddcb7bc2beccecc3146baafce72cae49cb20b41f482ceb036ccbe1c4b21bc2a3c2af SHA512 a93166d77ae29d32719a47912d64c9f0a7fdace61473a2d95c60cd611bab3a9b5faf0cebe6d80c47a34a5164538d61695e951e5d458a6f7ae172ff62dd9b81ea
-DIST shorewall-5.2.3.6.tar.bz2 543859 BLAKE2B 29a7e8068a5920e73bcb832241c2366a31fc54e6671d401ad35dd01a38f719622a5e3d09cb50084887ac52b96ff5f827e433ef06223eaf2d7f279b1299d726c4 SHA512 e6cd5bcf9f3fe57a5220e717985525ef4dac37b36e7e81b583948fc47c73d443e9649395db365829e0b29d213e5ca8e706578ad323983c6851c3cc5f3dccb03f
-DIST shorewall-core-5.2.3.5.tar.bz2 70007 BLAKE2B 0f7485775fe566e5bc9d67da314f27f1aba3b9faef82a8d51dc5bc00413dba32a24c53cae07531c59c528b0c2b7c87fda81252669c771c749abf5d83f9c02696 SHA512 f8346767d42ae6624b1831b637be3b4f625c4213a75759fc9330ffac7fc31aef0926e89af952f6353faf2a56334fe49fc65635c33a9c77c21b4ae79d93a0e9a6
-DIST shorewall-core-5.2.3.6.tar.bz2 70407 BLAKE2B 084e79d02702dfa3738f593ba029d97b230ccff5fd1741ca2566db7bfabb5ffe7afba5104ec7cca7d54da6e261c85090ecdbc2a0ab3c85b4fc9eb5a22add8ee8 SHA512 8bbd571e4279ea097634632903e3297bad6579152fe0d590db1f04cc1852cef86abdf5720b704bc166185118fa2d90c0463745a930ffe379f87a5d77c8a69141
-DIST shorewall-docs-html-5.2.3.5.tar.bz2 4291459 BLAKE2B 150345621b93a100ff08b3e38df789a706ef73543022ab963b951d1c19088407c7b4698729935c2717d65199cffceb2652b222247f4610554d21c7d74ef14c07 SHA512 5b638a4eb15a8ab28787cf684003ba02c43f04b691b90f70637a3c981d774ccc52150fa1419e54b5294f59f92118a74b56cb6ca9b5598e7176f92f0cab76c3b8
-DIST shorewall-docs-html-5.2.3.6.tar.bz2 4306757 BLAKE2B b2ef0ec2956b6dccfa0e2c597d3a924ad068f7e627bf86cf508d7db5547def979910a9bfdbf49650b1907716ca45973be23d0470eb1e90825c3cef9ea8c63268 SHA512 fb89f54e6da64fcb59ac76441588d0473e229279aad8cbc394cacf9bdb93d74723c6c7334934dee373527adcfc582d9843ce12aa454ea3a4d3f42597c93a3661
-DIST shorewall-init-5.2.3.5.tar.bz2 35147 BLAKE2B 34fff5474fc60a7526991e5718f2f561ee7e67f339f5d95bef204bbbd4efafef5c1298d9533eae481a6adeb4fe516f45cd1060af33b66c900c054f7b7f9e519e SHA512 ad06ad0c0ddeef278e18babe7aa42935aa3af79052d10b54cd6729fe7b67ed9f210ea3f511b0da23cb2b1f67b82bdcba339f919f1ccbafbde51f77b9f0004606
-DIST shorewall-init-5.2.3.6.tar.bz2 35309 BLAKE2B 963b73e86592fcefa5881273149d8c0c2fcf423d6268ba4ccc60941f2eccebc9d8e5ee2d2e80209fe3109ae43ce43521117f50824c2796b51ea945c9a7d06e01 SHA512 4e3ef2d4a47f8e0b7751dbeab26cbf749a0304c5e64f42642b3e6cdf8df1bfa057666260dc76c628ec193cac880d8574f2aaf91b4a54f2fd4f4ac76ee102093b
-DIST shorewall-lite-5.2.3.5.tar.bz2 39954 BLAKE2B 601e793adaa9d4ac77a1a4c17b7d1726af6a0b19c8dda2621ebbd36be63e3a33deb9ff36cb25d195d0875c5f159fa758a16cd7af2200e748d542f862bc474425 SHA512 3472bc4e96cd1624b5a6dde0bac893d87f57baa0381a230682889c15f841324e67034411e3ceb5229d48256a84e7f63ba04c478a86df9dd0e76ce820bb7c27dc
-DIST shorewall-lite-5.2.3.6.tar.bz2 40125 BLAKE2B 432fe34770b0da68c3fa9955ddebab6ce3fd75fec83d81d2e71ff4c7b74e8923886396acf8d5641cd5f1bd4bbf7a298283dad5db52ff1df04c6df452a947f791 SHA512 5d2802057cd5b3b8cbd15aadd8a4bdad13b2ae88d9839982ff95a98552bf672a2602bb3afa548068fc58f095f31267e07037f6ffc58a8213367a3edc904e5966
-DIST shorewall6-5.2.3.5.tar.bz2 191963 BLAKE2B b1aa5e5576749313a351eac29b2c247d58c4e38b9d948374f2c64a97a51bd6f7407afd52601ad0856c2899765ff4fe3ac0c96b4507e777a3112ec962a7dc71c9 SHA512 10081615887a5507b885ba6177016575829ca9cec81fe0fb8d5a6c12871d87ae1c63bb7319ea1e831d0c259084e243294125cad3650a0ffc66d0c09e457283d1
-DIST shorewall6-5.2.3.6.tar.bz2 191857 BLAKE2B 53784b26b8a8a94c525ec50e94d370ac022f4ab214d20580450bd2f083dcd05192442750aeeca17dba7b9e910c148feaa988bf3affcc07010bc0b87751fef47a SHA512 56b72e4821217a57b64a5295cd7fd9556899b946a8ad6d04e343e35109c67401ed5dc7bb3cf96f3b969f90d5d45cf0c0bbab1a3114658d0f6e21d69d4c0e0bb4
-DIST shorewall6-lite-5.2.3.5.tar.bz2 39907 BLAKE2B d396c4365d0fedac5afd997c2283c9cfaa05077d786dc95f40f3bcebf778f2cf8a95b386aeed8e8c80f556b000399da8c7c2e3fae9f1cbf2e9ebe4935acd27f4 SHA512 533be2c2bcc6b406eda45916d49bf38d776445fa6a7b43946ab5f11623f45f922d9a49ed47abc141a843c0afbec5ed08f6050d431ff73aba922fd8b5197f6bf0
-DIST shorewall6-lite-5.2.3.6.tar.bz2 40089 BLAKE2B 03552fc8cbcfeeedd5099781a38050896ca36d178faf396a11766c055959d2241e9c9f30e5030001a059b45090914c2c6ee24700b9ee7c1cf96de66665c83e4a SHA512 3bab2d04111ed68e228b5a22db6bc2471eeb4b9fe80da1c826af179a5bb9f8a7377e95850d8e97bf167c6254553304509eee01828da13957f6472c4eb507c1ec
-EBUILD shorewall-5.2.3.5.ebuild 16949 BLAKE2B 9100e4ddbf9669865d7a30c25bbe3308ee817585b520edea55144bcddad6c49f86d3b857b7b5d1af65deee8982b39d1eb67afdc3e9b47d9862f74e39ac7506ab SHA512 b687c39c598af8d21c5b967a9e2dad11632393e800361bd4c293b4ef82e1695ace66afa722d4f2d811965832f3da0014e6cd1e2cc8638838b3ecb8fd62088432
-EBUILD shorewall-5.2.3.6.ebuild 16955 BLAKE2B 17fe7a10d6c7fd11ece4169246604d8e33864a2a5a9c508a9f150da4034bb4531f5b21d9e6ad9787add150fc371361ed114edd4cd7574baba79c81cc4cc8c002 SHA512 40611e703f784b36a6435e8e2209a8d41268fba1ab6b29ad7ea66a1ad9dae5586a744dd506774baa71fc00296d225d975d7a387567b70ba59dcbf77aa8745956
+DIST shorewall-5.2.3.7.tar.bz2 579234 BLAKE2B 968d9f23f9d66d1326dfd9c0b989959a1a8449f6dd3230d9191cb3f3be805065fe4d1ab5e7bd679b5da7ebbf625654dc0a878a4ebc6346e51a9d2588102e52b5 SHA512 c0f90d5cbbc6a9cad443b3ecfedda79bee71f79685049c421d8bba3826e5c874c7c31f09f243d3728514684983a27c8d4ac6854b55766fbcf34f6937f8ab28bd
+DIST shorewall-5.2.4.tar.bz2 579480 BLAKE2B 5bbca22cfa11dc482859c2703d54f35f55f1c8db46286c3480879eb47d562358a73412f0ba3ba4af9d3763c838608269a70668daf30accb07314245308f46022 SHA512 2eee8b8e86aef29f646f324dcbd156eae7a687db179361e03172ef4792f2665fd3623830028a748ea3506ffbb2f59afa9f7deba7862643aff7628857aa2ac63c
+DIST shorewall-core-5.2.3.7.tar.bz2 71454 BLAKE2B 3df2b99dfbde169a817f4a5f45876c07dbdcda432763c1227fd86d9f2e2556c639595db9c57f195a404535c72f33ae1211aee080e5df37c342f6ebd4be2a5994 SHA512 e708ee48bc087cef24959b22430c8d8814d5c2f9315988c410e6fa59b4dca9c8b48501fea9515115e760d902d9e9719f33c1310d91a83550030a8768efd18751
+DIST shorewall-core-5.2.4.tar.bz2 71532 BLAKE2B edd3762b39db162775e05d30e3ddeac244ca4375ee74bc1581af85879ddcfda22e6cae7b1357ddf5b0df615a4f5072457b1e34918bde5cb43273b21dd60f76ba SHA512 40add35f175abd62ede0b0b8f84151d7a81d56bcc3d622ed9ac676e382bd33cfee648da205f23ead462b5e6e577784c79ffdcdde5f45c731c6d93c11788d982d
+DIST shorewall-docs-html-5.2.3.7.tar.bz2 4293387 BLAKE2B 6a0ffe8eac171c13961fcf448932b7287cdca3e1da895020d5551d135fe542ca8dba3e0cba7f505ec9a204649dd5fd9849613bbb30d2970a45f321b46aa74ba5 SHA512 19c5bb80f40c9df8262e6ee00908f64d3e2d489c734bdecf6faec5f8d23bf3b6201ed21673900a2906053bc7d59872b7974262caf9883207126a082bbb2cb281
+DIST shorewall-docs-html-5.2.4.tar.bz2 4293639 BLAKE2B c024da5a3fab5f98c0913f294dafd85eced4c259762f5f06d9e98a74ea2e1ac5c0565e027609da472bd911e08027a6524e7cf97e2ec06c70965e5088fa3c331e SHA512 cb3ce47a892e92a032d4f49d693b23ad47ad3a0effb44cb24c0ff86f9b9b75eaa231210369a0ae10789bddedbbfd4c2a8a11bef9695591ef22351570c5abe481
+DIST shorewall-init-5.2.3.7.tar.bz2 35860 BLAKE2B b6046004c246113105206f2a034e0d8930a8283c3431675a2cb5c29b1509619b5d79a03bdf8c1daea085a330344ffe519a0b9d7ec860fdcd3603efd739613d2e SHA512 f3f231923a5d352cb8288d051568d4dbf24ef38122a1d8ae0c158b317c09146d938389597a5f57e9099c7c1b283780357b74f8605ea1e14393a0e3b1fa6b1118
+DIST shorewall-init-5.2.4.tar.bz2 36672 BLAKE2B 9b1d8e4670f2fadca9c3ffb4aade2734ab2714ae86d9b66728595b9e6c222b151be064634ea374767adea4424d578b7f7369acab855a5716e6f8def2f35d7b6f SHA512 7a68eb0c8e40e778123c0ecc60c2210888c1e6c68fd282e0d4f2fb2fdac3f1f00dde521c157520a1edd31ef77fe40e5d15834c5ce7d3d5500ae5fb8d66a6a324
+DIST shorewall-lite-5.2.3.7.tar.bz2 40674 BLAKE2B cf7ed3c81ab3a49556e61f48bdabf828dbb79a4c0a6c431f9ce77a4f15ec33ccbfc6bc5b1e6a942d695795679670bdb3ff22c37c54bcc4cd3552f6117bb4834b SHA512 c83f349f2626fe98a2f968a76fb48de2e7412f95ed0e72c48724cd93fe6e3b480d6cc185b5445434432bbf40ffaef7dbb875c4b5494f7875ce1f96f345314ea6
+DIST shorewall-lite-5.2.4.tar.bz2 41491 BLAKE2B 1cdef18c368d44bf7aae756c2519b3cf8aaa648be0044b6aab22aa6dda989a8a7e51ab77d963f450ab0338ea490ca2629680e1c251e4dbf43594a952a17ded9a SHA512 a222d06e60f889167160cea5107fb534e8c5bec00b42e7027615447875e3ee2513ba1eefd1e14e17ea7c91d08f2e9cfebb1b3fe2bd384f6288961c1258cbb359
+DIST shorewall6-5.2.3.7.tar.bz2 197912 BLAKE2B 20193edb20a6e165cc83391ff36e5601104dbc95f8300d1880253edc451fb086b0b619496cec84f3a6e1ea52c33ebea9de436babeb6517b41688e95eaaa10641 SHA512 45ac97f27569006715156579ca86e9dc580d30f64dabb1557ef25dbb171e76a67251a64e4ff77c8e88017dc2a9e364503c1f565f376312335ca2ac0d961a6043
+DIST shorewall6-5.2.4.tar.bz2 198630 BLAKE2B 4aa511ba5b998835b9aadad3a733b7ea7e4c0940135ae8959895ea499fd5f83e8cad3831560215c41c855f0d02f845ee97b8318af409fa088a98bbd5f3ec7a87 SHA512 b4dce7043b44fc1b84c5f8b07c524b0c9b5a83e06f694646115c448ad1e0407a77613ace99b5866cfa8b7078a98c1aba79a94c094e40453745d6cccc453d8934
+DIST shorewall6-lite-5.2.3.7.tar.bz2 40641 BLAKE2B d1c3720e7fefe6a20a29ab90e65fe9c0a113894c008377734e274177f6759245c056fb2a7e7abf42c7bddd35bd159f8c2ed2e4135edd1dda9d63ad1b596cec8c SHA512 0727a0e709bb206e4905ae8b5b4b39b2d2eb950b8aa03d8593de71a12464422681b5528a8e06a05e91e9bd1bae6a78962da1810ecbc8707e670073c28daccaaa
+DIST shorewall6-lite-5.2.4.tar.bz2 41474 BLAKE2B 123b73281cc4e84f74eef56111af24243eca9706ad03a38cb8bf3763b8645fffdb1847098d33c109b8b481eb66baa9d71a907285cc20ae6094eac9304cf7fd52 SHA512 a2a5f8054e59815e3dc2f3a51f59f29b3880226d5074b78e189e68e6c6f66de44a86791417f088bb4f1d0eead78d2841269cd222450d33b7b5cef1c00b08cfc8
+EBUILD shorewall-5.2.3.7.ebuild 16949 BLAKE2B 9100e4ddbf9669865d7a30c25bbe3308ee817585b520edea55144bcddad6c49f86d3b857b7b5d1af65deee8982b39d1eb67afdc3e9b47d9862f74e39ac7506ab SHA512 b687c39c598af8d21c5b967a9e2dad11632393e800361bd4c293b4ef82e1695ace66afa722d4f2d811965832f3da0014e6cd1e2cc8638838b3ecb8fd62088432
+EBUILD shorewall-5.2.4.ebuild 16955 BLAKE2B 17fe7a10d6c7fd11ece4169246604d8e33864a2a5a9c508a9f150da4034bb4531f5b21d9e6ad9787add150fc371361ed114edd4cd7574baba79c81cc4cc8c002 SHA512 40611e703f784b36a6435e8e2209a8d41268fba1ab6b29ad7ea66a1ad9dae5586a744dd506774baa71fc00296d225d975d7a387567b70ba59dcbf77aa8745956
 MISC metadata.xml 2254 BLAKE2B e9d48407a0f055415070f5b0266ed9f534768f6d17d52b7070de30a037b89dbd08daac40b0ec313b8dfc65ba40ff38dae96c9758b78ec66d100ac8fa6b870d5f SHA512 0a201cf40dd1282b52897f751903baf28a2eb284b94316a45d8af6879f995dde1cdd4a7d474293835a0bde801ce41497bde558a51035a5e3650f0ec098688f33
diff --git a/net-firewall/shorewall/shorewall-5.2.3.5.ebuild b/net-firewall/shorewall/shorewall-5.2.3.7.ebuild
index ab98fa113074..ab98fa113074 100644
--- a/net-firewall/shorewall/shorewall-5.2.3.5.ebuild
+++ b/net-firewall/shorewall/shorewall-5.2.3.7.ebuild
diff --git a/net-firewall/shorewall/shorewall-5.2.3.6.ebuild b/net-firewall/shorewall/shorewall-5.2.4.ebuild
index 9f77b3406b11..9f77b3406b11 100644
--- a/net-firewall/shorewall/shorewall-5.2.3.6.ebuild
+++ b/net-firewall/shorewall/shorewall-5.2.4.ebuild
diff --git a/net-firewall/ufw/Manifest b/net-firewall/ufw/Manifest
index e87575442bd4..41bc7679a435 100644
--- a/net-firewall/ufw/Manifest
+++ b/net-firewall/ufw/Manifest
@@ -14,6 +14,6 @@ AUX ufw.confd 219 BLAKE2B 8ed5dec5dd9acc84715918240e31398268ff36f73bb2cfc10e64e0
 AUX ufw.service 329 BLAKE2B e817fc85b3bdb21b47a3089c6f2204292a019eaeae510832530f0e09f8784a312dd636fa3cf90610bb3159d52b4bdaadf803699ac4bff31576b566a3e977b2d2 SHA512 a365e704ca958c83c86f8a6b1623ce3f9ad72dcfb0cfc7758bfc787e0877f897ccf8b200db83df17130ca5dcc54f938178b8cabfe3ee0c0896c814ee7d2439c7
 DIST ufw-0.35.tar.gz 375310 BLAKE2B 3babf22e860ead6970c1386b0ab9fc3de364ba3f5c8bc0237be4a9446358fe058d216e7928d16eed8a148fbee5b82fc1d9e3b358f357c2fac236ae6f6b942a01 SHA512 b36c82559910634505648f717d19eb5a0cb1ce739a804359087e74c966869d0375c4ed5811954b32d2b5b51866f6ae1bec62a4a464f226b2eecc56b096f303fc
 DIST ufw-0.36.tar.gz 580338 BLAKE2B a7e07ac11539061a69bb83d45c0affc54793503b31c9e9f9f8b34fa890a3fe97682f9133102e74e5f6e1eb372a929cfc8619baa2cc9efc1dc289d9f4a1766efd SHA512 b32d7f79f43c203149c48b090ee0d063df78fcf654344ee11066a7363e799a62b046758ffe02b8bd15121545ac2a6b61df21fe56f8b810319fe4dd562cbdadb3
-EBUILD ufw-0.35-r1.ebuild 5629 BLAKE2B 94b1a98c73f0983e1661f58522c42d73c39c72e12523214ea10578945359f9dfe36a66726b359d64c442236efd274217c3a2b5a6e6ad620dde08e3059fdd1f16 SHA512 88336d6dc300202d8d25dcc1ef853b2b59353e97bf91947168543ef1b4709ec79f1d01d72c601b7549b2ca08ce45122d5d994d46a79450fde6d90f9d83cee625
-EBUILD ufw-0.36.ebuild 5715 BLAKE2B 75e8fe678dd451321d9007d2e5e3db754efd3f18748f5057263d83e510391e9a655372889a3a0540c4b333ce15c6ad49991224cb9d60ef12f64e544b4d6aaeb3 SHA512 87ee083edd1e07bedce5e8ec35aac7bff80ca4189bc88ed22b15646e9401c0291a4d41c6c1e85ba9f43eca4d33383c18e36722941e408f77cc7cdd122bd95cca
+EBUILD ufw-0.35-r1.ebuild 5630 BLAKE2B 5fae04dd991fa046db5768c93cadc54ba44d853e96eae1b0268c1c6d718d537a65cd1a3525dd8a0d33322708e28cdd6a339b348affbd2b31b481069f7c8cd068 SHA512 5aac0a79bb395b5dfbd8b192626ddd164494ac6ae35e8a5c2a2e671039d67e591bab4b0759ed4809064319e38fc3e22b9a5dceaf4258fbf859aca26665960e4d
+EBUILD ufw-0.36.ebuild 5716 BLAKE2B fc67446fab27bcedb0dcf9b120ac554cf8fce0663a6bcfef321612d09bdfedad17c17a6b44877d197afa0d38a681932ffb1673713abaffb32c649ebc46fb5ee9 SHA512 71a7d5b97d0d2468610455599d58ccd709e498761cbed609aa70f7ccb46742d0ca739d9cfbc608111c3358fc9eada298bf66220db6141a8ac95fffdcde4f1b83
 MISC metadata.xml 867 BLAKE2B 803f1809161a81c013989270661d5e17bc74c9f02dd7c2cf9e7847b86072ea56fc5ad980a6f2d285ee1d806902621ff1100ac20bbc27465e828aec4537e846c6 SHA512 e11ddde14aa8fb8aa187537f3cfeb01b26b4421489d69223fc77ab4400b002105d2b8161ebf489748eb42b615899f87c1abc65d10d7ef40b2f107f0d85c17c77
diff --git a/net-firewall/ufw/ufw-0.35-r1.ebuild b/net-firewall/ufw/ufw-0.35-r1.ebuild
index abde803eb42f..ff137b6b8320 100644
--- a/net-firewall/ufw/ufw-0.35-r1.ebuild
+++ b/net-firewall/ufw/ufw-0.35-r1.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://launchpad.net/ufw/${PV}/${PV}/+download/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="amd64 ia64 ppc ppc64 sparc x86"
+KEYWORDS="amd64 ~ia64 ppc ppc64 sparc x86"
 IUSE="examples ipv6"
 
 DEPEND="sys-devel/gettext"
diff --git a/net-firewall/ufw/ufw-0.36.ebuild b/net-firewall/ufw/ufw-0.36.ebuild
index 01f7c4afdbd6..54c3c4bf91ee 100644
--- a/net-firewall/ufw/ufw-0.36.ebuild
+++ b/net-firewall/ufw/ufw-0.36.ebuild
@@ -14,7 +14,7 @@ SRC_URI="https://launchpad.net/ufw/${PV}/${PV}/+download/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="amd64 ia64 ppc ppc64 sparc x86"
+KEYWORDS="amd64 ~ia64 ppc ppc64 sparc x86"
 IUSE="examples ipv6"
 
 DEPEND=""
diff --git a/net-firewall/xtables-addons/Manifest b/net-firewall/xtables-addons/Manifest
index 809fdc2084b1..ab1e0098f160 100644
--- a/net-firewall/xtables-addons/Manifest
+++ b/net-firewall/xtables-addons/Manifest
@@ -1,5 +1,9 @@
 DIST xtables-addons-2.13.tar.xz 322116 BLAKE2B 31d12adcfdf2043b44b5789f3ba3215197ff48d378b20fd6406f6afd22739e04069f08f32214a2230ec797469b236788dbebef079855539994db69be358ec421 SHA512 51cfa963d6f2f931b0361746e0b48f5ecf43a14e9e8d5297ef55faf0e9f8d1deb4641e88e3fea2afdbb3e39dd06d414de6057fb4a21e5184d4ea3d21b8028497
 DIST xtables-addons-3.7.tar.xz 325124 BLAKE2B e7f0bff03f0b77b55cd578c5a77ab4a306fa5a5cfd3b7e5b801b60d4ccc2c5a476fee2b04f4cb8db4b3ab34c7dab353ec13cba1fe98a714cfbb2e89e3110841d SHA512 336f19596251507a88d7c399f9a3e6f517e4b72787ff7e7108e20e42e68932bca0eed79c54ddfa92112daae73a94a7349a874bcf993bd4abea1d875d7f2b8565
+DIST xtables-addons-3.8.tar.xz 324468 BLAKE2B e460e0dc7fcd7037610b44132628b3c39c81477c2e1ef345d939f1c4d5981517789f240d1d2233c6a8e962e326ff9a25c5e66dcf829fb23db66dc8cd78b076d6 SHA512 2e0594ee0e654a19e6bae4f7acb7efd142957418ed44ce92ecd7474bb2f0bfd8dad684be937e8f6ed28395f9d7a6dbea61e7c3259d7b89c05ab10bcad3c04264
+DIST xtables-addons-3.9.tar.xz 324380 BLAKE2B d78afec65647c9b83b16e591b3cf6827748d70c02b381c30ee1751aadca6397fcbbe4e7f8e1e9199ae93b07e37ae333358e677b89d2b2c62adeb01e345ce2a33 SHA512 ec7d2ec97c433eb94b893aedfd346393986ef140d7ff95cd8be070cfa397efd87df7d73d36359b81c80618eb8575282a1ea8624c3bf182ddd60d8975f58579b5
 EBUILD xtables-addons-2.13.ebuild 5515 BLAKE2B 1ae1dd1a2f6608a42a1f832adc7d66ae0912122d688d96e11bfb9c3e9c09b3844dfcace85d59576415290355a99bb07cc25011110a33daa2b581a4b04a49cd07 SHA512 21409ed9b16bc18140841b30924b56b2e38752f43d93c9ef07aab80069b9899000d98d794d2bde9aae666e99cd8c8f85d9c604640c603eaa17911ef86cf726ad
 EBUILD xtables-addons-3.7.ebuild 5487 BLAKE2B 09a0cb0654233f8899c64b02bd395d9fb964aa82becc4e56e52b092f1ccfa6eaa847e67391c32d353a24c0296ad4b2227bacb86be08957181cf3a042f2baf435 SHA512 e758d352f4a984004d21bb745e19a6ffe39efb9b0e085538eeeb8456dbd88f7ee0bcb8319a81d02b4ae5247c1078004a175a9a93df8c0bbeafa5eb7c28ae3a21
+EBUILD xtables-addons-3.8.ebuild 5487 BLAKE2B 09a0cb0654233f8899c64b02bd395d9fb964aa82becc4e56e52b092f1ccfa6eaa847e67391c32d353a24c0296ad4b2227bacb86be08957181cf3a042f2baf435 SHA512 e758d352f4a984004d21bb745e19a6ffe39efb9b0e085538eeeb8456dbd88f7ee0bcb8319a81d02b4ae5247c1078004a175a9a93df8c0bbeafa5eb7c28ae3a21
+EBUILD xtables-addons-3.9.ebuild 5487 BLAKE2B 09a0cb0654233f8899c64b02bd395d9fb964aa82becc4e56e52b092f1ccfa6eaa847e67391c32d353a24c0296ad4b2227bacb86be08957181cf3a042f2baf435 SHA512 e758d352f4a984004d21bb745e19a6ffe39efb9b0e085538eeeb8456dbd88f7ee0bcb8319a81d02b4ae5247c1078004a175a9a93df8c0bbeafa5eb7c28ae3a21
 MISC metadata.xml 775 BLAKE2B 3462baf963682f15042f1fe9a985fdce50d46abb5fbe1080f6ce5285314a3e24581d780d84112a5bed0a4a132ce17f29678983711a38745d0fd7969091e76182 SHA512 85474ba552703d77bc7cc18ccef424f5eeb68e23eb41e14a8c360afcdcb2632a99420fda2dca57ea15dbda3f850d939c16b18cbdc96dbfcf31a6af3f40743f0c
diff --git a/net-firewall/xtables-addons/xtables-addons-3.8.ebuild b/net-firewall/xtables-addons/xtables-addons-3.8.ebuild
new file mode 100644
index 000000000000..ef77b6f7711e
--- /dev/null
+++ b/net-firewall/xtables-addons/xtables-addons-3.8.ebuild
@@ -0,0 +1,189 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODULES_OPTIONAL_USE=modules
+MODULES_OPTIONAL_USE_IUSE_DEFAULT=1
+inherit eutils linux-info linux-mod multilib toolchain-funcs
+
+DESCRIPTION="iptables extensions not yet accepted in the main kernel"
+HOMEPAGE="http://xtables-addons.sourceforge.net/"
+SRC_URI="mirror://sourceforge/xtables-addons/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+MODULES="quota2 psd pknock lscan length2 ipv4options ipp2p iface gradm geoip fuzzy condition tarpit sysrq logmark ipmark echo dnetmap dhcpmac delude chaos account"
+
+for mod in ${MODULES}; do
+	IUSE="${IUSE} xtables_addons_${mod}"
+done
+
+DEPEND=">=net-firewall/iptables-1.6.0"
+
+RDEPEND="${DEPEND}
+	xtables_addons_geoip? (
+		app-arch/unzip
+		dev-perl/Net-CIDR-Lite
+		dev-perl/Text-CSV_XS
+		virtual/perl-Getopt-Long
+	)
+"
+
+DEPEND="${DEPEND}
+	virtual/linux-sources"
+
+SKIP_MODULES=""
+
+XA_check4internal_module() {
+	local mod=${1}
+	local version=${3}
+	local kconfigname=${3}
+
+	if use xtables_addons_${mod} && kernel_is -gt ${version}; then
+		ewarn "${kconfigname} should be provided by the kernel. Skipping its build..."
+		if ! linux_chkconfig_present ${kconfigname}; then
+			ewarn "Please enable ${kconfigname} target in your kernel
+			configuration or disable checksum module in ${PN}."
+		fi
+		# SKIP_MODULES in case we need to disable building of everything
+		# like having this USE disabled
+		SKIP_MODULES+=" ${mod}"
+	fi
+}
+
+pkg_setup() {
+	if use modules; then
+		get_version
+		check_modules_supported
+		CONFIG_CHECK="NF_CONNTRACK NF_CONNTRACK_MARK ~CONNECTOR"
+		ERROR_CONNECTOR="Please, enable CONFIG_CONNECTOR if you wish to receive userspace notifications from pknock through netlink/connector"
+		linux-mod_pkg_setup
+
+		if ! linux_chkconfig_present IPV6; then
+			SKIP_IPV6_MODULES="ip6table_rawpost"
+			ewarn "No IPV6 support in kernel. Disabling: ${SKIP_IPV6_MODULES}"
+		fi
+		kernel_is -lt 4 18 && die "${P} requires kernel version >= 4.18"
+	fi
+}
+
+# Helper for maintainer: cheks if all possible MODULES are listed.
+XA_qa_check() {
+	local all_modules
+	all_modules=$(sed -n '/^build_/{s/build_\(.*\)=.*/\L\1/;G;s/\n/ /;s/ $//;h}; ${x;p}' "${S}/mconfig")
+	if [[ ${all_modules} != ${MODULES} ]]; then
+		ewarn "QA: Modules in mconfig differ from \$MODULES in ebuild."
+		ewarn "Please, update MODULES in ebuild."
+		ewarn "'${all_modules}'"
+	fi
+}
+
+# Is there any use flag set?
+XA_has_something_to_build() {
+	local mod
+	for mod in ${MODULES}; do
+		use xtables_addons_${mod} && return
+	done
+
+	eerror "All modules are disabled. What do you want me to build?"
+	eerror "Please, set XTABLES_ADDONS to any combination of"
+	eerror "${MODULES}"
+	die "All modules are disabled."
+}
+
+# Parse Kbuid files and generates list of sources
+XA_get_module_name() {
+	[[ $# != 1 ]] && die "XA_get_sources_for_mod: needs exactly one argument."
+	local mod objdir build_mod sources_list
+	mod=${1}
+	objdir=${S}/extensions
+	# Take modules name from mconfig
+	build_mod=$(sed -n "s/\(build_${mod}\)=.*/\1/Ip" "${S}/mconfig")
+	# strip .o, = and everything before = and print
+	sources_list=$(sed -n "/^obj-[$][{]${build_mod}[}]/\
+		{s:obj-[^+]\+ [+]=[[:space:]]*::;s:[.]o::g;p}" \
+				"${objdir}/Kbuild")
+
+	if [[ -d ${S}/extensions/${sources_list} ]]; then
+		objdir=${S}/extensions/${sources_list}
+		sources_list=$(sed -n "/^obj-m/\
+			{s:obj-[^+]\+ [+]=[[:space:]]*::;s:[.]o::g;p}" \
+				"${objdir}/Kbuild")
+	fi
+	for mod_src in ${sources_list}; do
+		has ${mod_src} ${SKIP_IPV6_MODULES} || \
+			echo " ${mod_src}(xtables_addons:${S}/extensions:${objdir})"
+	done
+}
+
+# Die on modules known to fail on certain kernel version.
+XA_known_failure() {
+	local module_name=$1
+	local KV_max=$2
+
+	if use xtables_addons_${module_name} && kernel_is ge ${KV_max//./ }; then
+		eerror
+		eerror "XTABLES_ADDONS=${module_name} fails to build on linux ${KV_max} or above."
+		eerror "Either remove XTABLES_ADDONS=${module_name} or use an earlier version of the kernel."
+		eerror
+		die
+	fi
+}
+
+src_prepare() {
+	XA_qa_check
+	XA_has_something_to_build
+
+	# Bug #553630#c2.  echo fails on linux-4 and above.
+	# This appears to be fixed, at least as of linux-4.2
+	# XA_known_failure "echo" 4
+
+	local mod module_name
+	if use modules; then
+		MODULE_NAMES="compat_xtables(xtables_addons:${S}/extensions:)"
+	fi
+	for mod in ${MODULES}; do
+		if ! has ${mod} ${SKIP_MODULES} && use xtables_addons_${mod}; then
+			sed "s/\(build_${mod}=\).*/\1m/I" -i mconfig || die
+			if use modules; then
+				for module_name in $(XA_get_module_name ${mod}); do
+					MODULE_NAMES+=" ${module_name}"
+				done
+			fi
+		else
+			sed "s/\(build_${mod}=\).*/\1n/I" -i mconfig || die
+		fi
+	done
+	einfo "${MODULE_NAMES}" # for debugging
+
+	sed -e 's/depmod -a/true/' -i Makefile.in || die
+	sed -e '/^all-local:/{s: modules::}' \
+		-e '/^install-exec-local:/{s: modules_install::}' \
+			-i extensions/Makefile.in || die
+
+	use xtables_addons_geoip || sed  -e '/^SUBDIRS/{s/geoip//}' -i Makefile.in
+
+	eapply_user
+}
+
+src_configure() {
+	set_arch_to_kernel # .. or it'll look for /arch/amd64/Makefile
+	econf --prefix="${EPREFIX}/" \
+		--libexecdir="${EPREFIX}/$(get_libdir)/" \
+		--with-kbuild="${KV_OUT_DIR}"
+}
+
+src_compile() {
+	emake CFLAGS="${CFLAGS}" CC="$(tc-getCC)" V=1
+	use modules && BUILD_PARAMS="V=1" BUILD_TARGETS="modules" linux-mod_src_compile
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	use modules && linux-mod_src_install
+	dodoc -r README doc/*
+	find "${ED}" -type f -name '*.la' -exec rm -rf '{}' '+'
+}
diff --git a/net-firewall/xtables-addons/xtables-addons-3.9.ebuild b/net-firewall/xtables-addons/xtables-addons-3.9.ebuild
new file mode 100644
index 000000000000..ef77b6f7711e
--- /dev/null
+++ b/net-firewall/xtables-addons/xtables-addons-3.9.ebuild
@@ -0,0 +1,189 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODULES_OPTIONAL_USE=modules
+MODULES_OPTIONAL_USE_IUSE_DEFAULT=1
+inherit eutils linux-info linux-mod multilib toolchain-funcs
+
+DESCRIPTION="iptables extensions not yet accepted in the main kernel"
+HOMEPAGE="http://xtables-addons.sourceforge.net/"
+SRC_URI="mirror://sourceforge/xtables-addons/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+MODULES="quota2 psd pknock lscan length2 ipv4options ipp2p iface gradm geoip fuzzy condition tarpit sysrq logmark ipmark echo dnetmap dhcpmac delude chaos account"
+
+for mod in ${MODULES}; do
+	IUSE="${IUSE} xtables_addons_${mod}"
+done
+
+DEPEND=">=net-firewall/iptables-1.6.0"
+
+RDEPEND="${DEPEND}
+	xtables_addons_geoip? (
+		app-arch/unzip
+		dev-perl/Net-CIDR-Lite
+		dev-perl/Text-CSV_XS
+		virtual/perl-Getopt-Long
+	)
+"
+
+DEPEND="${DEPEND}
+	virtual/linux-sources"
+
+SKIP_MODULES=""
+
+XA_check4internal_module() {
+	local mod=${1}
+	local version=${3}
+	local kconfigname=${3}
+
+	if use xtables_addons_${mod} && kernel_is -gt ${version}; then
+		ewarn "${kconfigname} should be provided by the kernel. Skipping its build..."
+		if ! linux_chkconfig_present ${kconfigname}; then
+			ewarn "Please enable ${kconfigname} target in your kernel
+			configuration or disable checksum module in ${PN}."
+		fi
+		# SKIP_MODULES in case we need to disable building of everything
+		# like having this USE disabled
+		SKIP_MODULES+=" ${mod}"
+	fi
+}
+
+pkg_setup() {
+	if use modules; then
+		get_version
+		check_modules_supported
+		CONFIG_CHECK="NF_CONNTRACK NF_CONNTRACK_MARK ~CONNECTOR"
+		ERROR_CONNECTOR="Please, enable CONFIG_CONNECTOR if you wish to receive userspace notifications from pknock through netlink/connector"
+		linux-mod_pkg_setup
+
+		if ! linux_chkconfig_present IPV6; then
+			SKIP_IPV6_MODULES="ip6table_rawpost"
+			ewarn "No IPV6 support in kernel. Disabling: ${SKIP_IPV6_MODULES}"
+		fi
+		kernel_is -lt 4 18 && die "${P} requires kernel version >= 4.18"
+	fi
+}
+
+# Helper for maintainer: cheks if all possible MODULES are listed.
+XA_qa_check() {
+	local all_modules
+	all_modules=$(sed -n '/^build_/{s/build_\(.*\)=.*/\L\1/;G;s/\n/ /;s/ $//;h}; ${x;p}' "${S}/mconfig")
+	if [[ ${all_modules} != ${MODULES} ]]; then
+		ewarn "QA: Modules in mconfig differ from \$MODULES in ebuild."
+		ewarn "Please, update MODULES in ebuild."
+		ewarn "'${all_modules}'"
+	fi
+}
+
+# Is there any use flag set?
+XA_has_something_to_build() {
+	local mod
+	for mod in ${MODULES}; do
+		use xtables_addons_${mod} && return
+	done
+
+	eerror "All modules are disabled. What do you want me to build?"
+	eerror "Please, set XTABLES_ADDONS to any combination of"
+	eerror "${MODULES}"
+	die "All modules are disabled."
+}
+
+# Parse Kbuid files and generates list of sources
+XA_get_module_name() {
+	[[ $# != 1 ]] && die "XA_get_sources_for_mod: needs exactly one argument."
+	local mod objdir build_mod sources_list
+	mod=${1}
+	objdir=${S}/extensions
+	# Take modules name from mconfig
+	build_mod=$(sed -n "s/\(build_${mod}\)=.*/\1/Ip" "${S}/mconfig")
+	# strip .o, = and everything before = and print
+	sources_list=$(sed -n "/^obj-[$][{]${build_mod}[}]/\
+		{s:obj-[^+]\+ [+]=[[:space:]]*::;s:[.]o::g;p}" \
+				"${objdir}/Kbuild")
+
+	if [[ -d ${S}/extensions/${sources_list} ]]; then
+		objdir=${S}/extensions/${sources_list}
+		sources_list=$(sed -n "/^obj-m/\
+			{s:obj-[^+]\+ [+]=[[:space:]]*::;s:[.]o::g;p}" \
+				"${objdir}/Kbuild")
+	fi
+	for mod_src in ${sources_list}; do
+		has ${mod_src} ${SKIP_IPV6_MODULES} || \
+			echo " ${mod_src}(xtables_addons:${S}/extensions:${objdir})"
+	done
+}
+
+# Die on modules known to fail on certain kernel version.
+XA_known_failure() {
+	local module_name=$1
+	local KV_max=$2
+
+	if use xtables_addons_${module_name} && kernel_is ge ${KV_max//./ }; then
+		eerror
+		eerror "XTABLES_ADDONS=${module_name} fails to build on linux ${KV_max} or above."
+		eerror "Either remove XTABLES_ADDONS=${module_name} or use an earlier version of the kernel."
+		eerror
+		die
+	fi
+}
+
+src_prepare() {
+	XA_qa_check
+	XA_has_something_to_build
+
+	# Bug #553630#c2.  echo fails on linux-4 and above.
+	# This appears to be fixed, at least as of linux-4.2
+	# XA_known_failure "echo" 4
+
+	local mod module_name
+	if use modules; then
+		MODULE_NAMES="compat_xtables(xtables_addons:${S}/extensions:)"
+	fi
+	for mod in ${MODULES}; do
+		if ! has ${mod} ${SKIP_MODULES} && use xtables_addons_${mod}; then
+			sed "s/\(build_${mod}=\).*/\1m/I" -i mconfig || die
+			if use modules; then
+				for module_name in $(XA_get_module_name ${mod}); do
+					MODULE_NAMES+=" ${module_name}"
+				done
+			fi
+		else
+			sed "s/\(build_${mod}=\).*/\1n/I" -i mconfig || die
+		fi
+	done
+	einfo "${MODULE_NAMES}" # for debugging
+
+	sed -e 's/depmod -a/true/' -i Makefile.in || die
+	sed -e '/^all-local:/{s: modules::}' \
+		-e '/^install-exec-local:/{s: modules_install::}' \
+			-i extensions/Makefile.in || die
+
+	use xtables_addons_geoip || sed  -e '/^SUBDIRS/{s/geoip//}' -i Makefile.in
+
+	eapply_user
+}
+
+src_configure() {
+	set_arch_to_kernel # .. or it'll look for /arch/amd64/Makefile
+	econf --prefix="${EPREFIX}/" \
+		--libexecdir="${EPREFIX}/$(get_libdir)/" \
+		--with-kbuild="${KV_OUT_DIR}"
+}
+
+src_compile() {
+	emake CFLAGS="${CFLAGS}" CC="$(tc-getCC)" V=1
+	use modules && BUILD_PARAMS="V=1" BUILD_TARGETS="modules" linux-mod_src_compile
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	use modules && linux-mod_src_install
+	dodoc -r README doc/*
+	find "${ED}" -type f -name '*.la' -exec rm -rf '{}' '+'
+}