gentoo resync : 21.06.2020

3 files changed, 486 insertions, 0 deletions

diff --git a/net-vpn/ipsec-tools/Manifest b/net-vpn/ipsec-tools/Manifest
index 61c593be7917..3a5a2ee55883 100644
--- a/net-vpn/ipsec-tools/Manifest
+++ b/net-vpn/ipsec-tools/Manifest
@@ -1,5 +1,6 @@
 AUX ipsec-tools-0.8.0-sysctl.patch 485 BLAKE2B 95d0ef609a8a744bf8b3451a9b6b8ee4e79d79c99bd7919d45c6fc99d61904e16b3213afbfcde4743dc1be8de0b4455f1da2b3faf210c21833cbd482ab7d0c52 SHA512 a2a96cea5c2b451665d54572e471a6c2b4fb72382dcd90bda536aaabf78cdd36d630d5c1fa56372b95066dc7dffd56480d3402fdbe2d56825a017b2cc075ac66
 AUX ipsec-tools-CVE-2015-4047.patch 517 BLAKE2B 2ef6ddd4b78d7602bc4b19d76a794a1e172049b515932f00d3fe0f63b8157f3652a86f39473dc2f85b017d141790c5bc13378e79d008239899849484c4d9d42a SHA512 1dfda43a9d5919fbf274a28addbf798083f48094c65b88426d471a56e5339b72c9438c36efc6d6a3d74b4a084103c2fd4d1f974cbe494ee1228b2dbcaa304b49
+AUX ipsec-tools-CVE-2016-10396.patch 5805 BLAKE2B dd3c80403033b5a914302bea61de9c8cf088002f27d0a76d42e26c834593faabebd5366a7b46fbf5376fa93086a63a6630b04c2ac895374b1c0b80cd996b7247 SHA512 f0ae3465a41c478db59644d270560452f4f1bbf8ca79e7169a033c5139a4c484c22fb3f5f7f82da5bda0fd436331112f47698648e79a4839c45cdd904fb65d7e
 AUX ipsec-tools-add-openssl-1.1.x-support.patch 32066 BLAKE2B b8380408c90bb93f0b95938de2efc61c80d727ae61a1417134583a8c74055fcfe1f7f75893f1f701b0f301a16d8b4d14f1b8a09d1e81d238821bcc122dfe183f SHA512 f2bd85f1c51226da6fc50d3473129e4c2e3c0e46107337f8d676029b7072b98bf164b6813a16de7dd4481f80038453b55a5ff56e7f5ec08ab07641034258e778
 AUX ipsec-tools-def-psk.patch 907 BLAKE2B 511982e1e7902f10442ca7ec7cd2a732f8a523f5fdc4a3630833d4280518296a3b4c735648c2793a40ad7d2d914019dc19699a51f0cdaddc35b13e94ea0d6b49 SHA512 683f168fac390df602ece1608db7f65370749c291e837497fa68fe4f39ddab907d10d67d4c80d583d7f12a1ea0bf02ba98d228e7c6e9267b49a1a8a7e57e99c4
 AUX ipsec-tools-include-vendoridh.patch 434 BLAKE2B ae27d4fc5630ee372314a855ec0c17b9f9efc5f87cbc6b86c1decd685212478a4a5592bd64c2a5ed19779243114eca4bff7f7e243bdc508454ef0bf4d998245f SHA512 fc39e09dd7b1a2d3b6cdfbfad9f4978ab5d070ae2435cf77fe2283b566bea1d58cd26dbf6cafb563587200724c9602a32ce737fd163b757872e8a6d2c8007d5c
@@ -13,4 +14,5 @@ AUX racoon.pam.d 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af57697
 AUX racoon.service 244 BLAKE2B f7e268518787a67e9363c936b8a9e69763c41db1926f99f3f001fdf738b0b3a92cd62770ab6cc0189cea20ca22d3abe675c832363ad77974e3f531ffbf525e7b SHA512 56d84f36b307e1ea93f3cdc9fbb7b459f4b3b65ea2bb765f61def10d06a3ff09d61b8d53b21796a55022279e791d751f3bc1ccf0d0f85799a743371390930567
 DIST ipsec-tools-0.8.2.tar.bz2 866465 BLAKE2B cf8c9175d96326fc5c74e6b1921bc66911256e289e6fe9cef77f26c197546902be3ebd5696af39c749a2abaac3f42010c9e2a281fd208122cd59222044b9dd4c SHA512 2b7d0efa908d3a699be7ef8b2b126a3809956cb7add50e8efb1cfdfc2d9b70c39ef517379cb9a4fad9e5f0c25937e98535b06c32bd3e729f5129da4ab133e30f
 EBUILD ipsec-tools-0.8.2-r5.ebuild 7907 BLAKE2B 4f0dee8d6a083952e1db6f89b5cdacf701eb476943915d3efdc08a369ab9f03eddc9798f7f2931021555429a69aea1fa00bee99fc24d2e8303212c4b9fc8656d SHA512 3390b428d29df81755b2d419b049ee776ff60b38d8156ed7852e54fb47fa0441f3608ee23a8a254781fb4078d8cd12bfa624035924355464e891c7a344c2bb9a
+EBUILD ipsec-tools-0.8.2-r6.ebuild 7960 BLAKE2B 5557846cd1912402055f2591ff722fcbd79edf5ff437c0ea02e5f682da5e4cc1ef518163905af6f0d3070153184f0891743f086d028aed443682b5ab824416ba SHA512 a42c3655726e8667cb1ea588db799b36fc95969ac41a3b61de61a0efcf9f59739eaa325d8d78431e77d31c5a168192cf34abccafb892aae887158603247606e2
 MISC metadata.xml 632 BLAKE2B 705ccbcd150c7180f882207dd5e7a8b0765b58f8296be9bb299e982207d88031b770186b665ee936ca834b2b8601a78f7d2ade63b88d6aa09808b2fe3a89be87 SHA512 7636e9dd2ed9069933b2215829660c3d7c1b43d9c4ad3303cf8889618bd659f68a27994ae520ec7e327060337a196e8b720140e5b32fc6830158be0f0fff1eb8
diff --git a/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch
new file mode 100644
index 000000000000..e123007bb593
--- /dev/null
+++ b/net-vpn/ipsec-tools/files/ipsec-tools-CVE-2016-10396.patch
@@ -0,0 +1,201 @@
+Description: Fix remotely exploitable DoS. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10396
+Source: vendor; https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682
+Bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867986
+
+Index: pkg-ipsec-tools/src/racoon/isakmp_frag.c
+===================================================================
+--- pkg-ipsec-tools.orig/src/racoon/isakmp_frag.c
++++ pkg-ipsec-tools/src/racoon/isakmp_frag.c
+@@ -1,4 +1,4 @@
+-/*	$NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $	*/
++/*	$NetBSD: isakmp_frag.c,v 1.5.36.1 2017/04/21 16:50:42 bouyer Exp $	*/
+ 
+ /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
+ 
+@@ -173,6 +173,43 @@ vendorid_frag_cap(gen)
+ 	return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
+ }
+ 
++static int 
++isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item)
++{
++	struct isakmp_frag_item *pitem = NULL;
++	struct isakmp_frag_item *citem = iph1->frag_chain;
++
++	/* no frag yet, just insert at beginning of list */
++	if (iph1->frag_chain == NULL) {
++		iph1->frag_chain = item;
++		return 0;
++	}
++
++	do {
++		/* duplicate fragment number, abort (CVE-2016-10396) */
++		if (citem->frag_num == item->frag_num)
++			return -1;
++
++		/* need to insert before current item */
++		if (citem->frag_num > item->frag_num) {
++			if (pitem != NULL)
++				pitem->frag_next = item;
++			else
++				/* insert at the beginning of the list  */
++				iph1->frag_chain = item;
++			item->frag_next = citem;
++			return 0;
++		}
++
++		pitem = citem;
++		citem = citem->frag_next;
++	} while (citem != NULL);
++
++	/* we reached the end of the list, insert */
++	pitem->frag_next = item;
++	return 0;
++}
++
+ int 
+ isakmp_frag_extract(iph1, msg)
+ 	struct ph1handle *iph1;
+@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg)
+ 	item->frag_next = NULL;
+ 	item->frag_packet = buf;
+ 
+-	/* Look for the last frag while inserting the new item in the chain */
+-	if (item->frag_last)
+-		last_frag = item->frag_num;
++	/* Check for the last frag before inserting the new item in the chain */
++	if (item->frag_last) {
++		/* if we have the last fragment, indices must match */
++		if (iph1->frag_last_index != 0 &&
++		    item->frag_last != iph1->frag_last_index) {
++			plog(LLV_ERROR, LOCATION, NULL,
++			     "Repeated last fragment index mismatch\n");
++			racoon_free(item);
++			vfree(buf);
++			return -1;
++		}
+ 
+-	if (iph1->frag_chain == NULL) {
+-		iph1->frag_chain = item;
+-	} else {
+-		struct isakmp_frag_item *current;
++		last_frag = iph1->frag_last_index = item->frag_num;
++	}
+ 
+-		current = iph1->frag_chain;
+-		while (current->frag_next) {
+-			if (current->frag_last)
+-				last_frag = item->frag_num;
+-			current = current->frag_next;
+-		}
+-		current->frag_next = item;
++	/* insert fragment into chain */
++	if (isakmp_frag_insert(iph1, item) == -1) {
++		plog(LLV_ERROR, LOCATION, NULL,
++		    "Repeated fragment index mismatch\n");
++		racoon_free(item);
++		vfree(buf);
++		return -1;
+ 	}
+ 
+-	/* If we saw the last frag, check if the chain is complete */
++	/* If we saw the last frag, check if the chain is complete
++	 * we have a sorted list now, so just walk through */
+ 	if (last_frag != 0) {
++		item = iph1->frag_chain;
+ 		for (i = 1; i <= last_frag; i++) {
+-			item = iph1->frag_chain;
+-			do {
+-				if (item->frag_num == i)
+-					break;
+-				item = item->frag_next;
+-			} while (item != NULL);
+-
++			if (item->frag_num != i)
++				break;
++			item = item->frag_next;
+ 			if (item == NULL) /* Not found */
+ 				break;
+ 		}
+ 
+-		if (item != NULL) /* It is complete */
++		if (i > last_frag) /* It is complete */
+ 			return 1;
+ 	}
+ 		
+@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1)
+ 	}
+ 	data = buf->v;
+ 
++	item = iph1->frag_chain;
+ 	for (i = 1; i <= frag_count; i++) {
+-		item = iph1->frag_chain;
+-		do {
+-			if (item->frag_num == i)
+-				break;
+-			item = item->frag_next;
+-		} while (item != NULL);
+-
+-		if (item == NULL) {
++		if (item->frag_num != i) {
+ 			plog(LLV_ERROR, LOCATION, NULL, 
+ 			    "Missing fragment #%d\n", i);
+ 			vfree(buf);
+@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1)
+ 		}
+ 		memcpy(data, item->frag_packet->v, item->frag_packet->l);
+ 		data += item->frag_packet->l;
++		item = item->frag_next;
+ 	}
+ 
+ out:
+Index: pkg-ipsec-tools/src/racoon/isakmp_inf.c
+===================================================================
+--- pkg-ipsec-tools.orig/src/racoon/isakmp_inf.c
++++ pkg-ipsec-tools/src/racoon/isakmp_inf.c
+@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca
+ #endif
+ #ifdef ENABLE_FRAG
+ 	iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 
+Index: pkg-ipsec-tools/src/racoon/isakmp.c
+===================================================================
+--- pkg-ipsec-tools.orig/src/racoon/isakmp.c
++++ pkg-ipsec-tools/src/racoon/isakmp.c
+@@ -1072,6 +1072,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
+ 		iph1->frag = 1;
+ 	else
+ 		iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 	iph1->approval = NULL;
+@@ -1176,6 +1177,7 @@ isakmp_ph1begin_r(msg, remote, local, et
+ #endif
+ #ifdef ENABLE_FRAG
+ 	iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 	iph1->approval = NULL;
+Index: pkg-ipsec-tools/src/racoon/handler.h
+===================================================================
+--- pkg-ipsec-tools.orig/src/racoon/handler.h
++++ pkg-ipsec-tools/src/racoon/handler.h
+@@ -1,4 +1,4 @@
+-/*	$NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $	*/
++/*	$NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $	*/
+ 
+ /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
+ 
+@@ -141,6 +141,7 @@ struct ph1handle {
+ #endif
+ #ifdef ENABLE_FRAG
+ 	int frag;			/* IKE phase 1 fragmentation */
++	int frag_last_index;
+ 	struct isakmp_frag_item *frag_chain;	/* Received fragments */
+ #endif
+ 
diff --git a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild
new file mode 100644
index 000000000000..b570d3dc4b91
--- /dev/null
+++ b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild
@@ -0,0 +1,283 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit flag-o-matic autotools linux-info pam systemd
+
+DESCRIPTION="A port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation"
+HOMEPAGE="http://ipsec-tools.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~ia64 ~mips ~ppc ~ppc64 x86"
+IUSE="hybrid idea ipv6 kerberos ldap libressl nat pam rc5 readline selinux stats"
+
+CDEPEND="
+	!libressl? ( dev-libs/openssl:0 )
+	libressl? ( dev-libs/libressl )
+	kerberos? ( virtual/krb5 )
+	ldap? ( net-nds/openldap )
+	pam? ( sys-libs/pam )
+	readline? ( sys-libs/readline:0= )
+	selinux? ( sys-libs/libselinux )"
+
+DEPEND="${CDEPEND}
+	>=sys-kernel/linux-headers-2.6.30"
+
+RDEPEND="${CDEPEND}
+	selinux? ( sec-policy/selinux-ipsec )
+"
+
+pkg_preinst() {
+	if has_version "<${CATEGORY}/${PN}-0.8.0-r5" ; then
+		ewarn
+		ewarn "\033[1;33m**************************************************\033[00m"
+		ewarn
+		if ! has_version "net-vpn/strongswan" &&
+			! has_version "net-misc/openswan" &&
+			! has_version "net-vpn/libreswan"; then
+			ewarn "We found an earlier version of ${PN} installed."
+			ewarn "As of ${PN}-0.8.0-r5, the old configuration file,"
+			ewarn "ipsec.conf, has been changed to ipsec-tools.conf to avoid"
+			ewarn "a conflict with net-vpn/strongswan; bug #436144.  We will"
+			ewarn "rename this file for you with this upgrade.  However, if"
+			ewarn "you later downgrade, you'll have to rename the file to"
+			ewarn "its orignal manually or change /etc/conf.d/racoon to point"
+			ewarn "to the new file."
+
+			if [[ -f /etc/ipsec.conf && ! -f /etc/ipsec-tools.conf ]] ; then
+				mv /etc/ipsec.conf /etc/ipsec-tools.conf
+			else
+				ewarn
+				ewarn "Oops!  I can't move ipsec.conf to ipsec-tools.conf!"
+				ewarn "Either the former doesn't exist or the later does and"
+				ewarn "I won't clobber it.  Please fix this situation manually."
+			fi
+		else
+			ewarn "You had both an earlier version of ${PN} and"
+			ewarn "net-vpn/strongswan installed.  I can't tell whether"
+			ewarn "the configuration file, ipsec.conf, belongs to one"
+			ewarn "package or the other due to a file conflict; bug #436144."
+			ewarn "The current version of ${PN} uses ipsec-tools.conf"
+			ewarn "as its configuration file, as will future versions."
+			ewarn "Please fix this situation manually."
+		fi
+		ewarn
+		ewarn "\033[1;33m**************************************************\033[00m"
+		ewarn
+	fi
+}
+
+pkg_setup() {
+	linux-info_pkg_setup
+
+	get_version
+
+	if linux_config_exists && kernel_is -ge 2 6 19; then
+		ewarn
+		ewarn "\033[1;33m**************************************************\033[00m"
+		ewarn
+		ewarn "Checking kernel configuration in /usr/src/linux or"
+		ewarn "or /proc/config.gz for compatibility with ${PN}."
+		ewarn "Here are the potential problems:"
+		ewarn
+
+		local nothing="1"
+
+		# Check options for all flavors of IPSec
+		local msg=""
+		for i in XFRM_USER NET_KEY; do
+			if ! linux_chkconfig_present ${i}; then
+				msg="${msg} ${i}"
+			fi
+		done
+		if [[ ! -z "$msg" ]]; then
+			nothing="0"
+			ewarn
+			ewarn "ALL IPSec may fail. CHECK:"
+			ewarn "${msg}"
+		fi
+
+		# Check unencrypted IPSec
+		if ! linux_chkconfig_present CRYPTO_NULL; then
+			nothing="0"
+			ewarn
+			ewarn "Unencrypted IPSec may fail. CHECK:"
+			ewarn " CRYPTO_NULL"
+		fi
+
+		# Check IPv4 IPSec
+		msg=""
+		for i in \
+			INET_IPCOMP INET_AH INET_ESP \
+			INET_XFRM_MODE_TRANSPORT \
+			INET_XFRM_MODE_TUNNEL \
+			INET_XFRM_MODE_BEET
+		do
+			if ! linux_chkconfig_present ${i}; then
+				msg="${msg} ${i}"
+			fi
+		done
+		if [[ ! -z "$msg" ]]; then
+			nothing="0"
+			ewarn
+			ewarn "IPv4 IPSec may fail. CHECK:"
+			ewarn "${msg}"
+		fi
+
+		# Check IPv6 IPSec
+		if use ipv6; then
+			msg=""
+			for i in INET6_IPCOMP INET6_AH INET6_ESP \
+				INET6_XFRM_MODE_TRANSPORT \
+				INET6_XFRM_MODE_TUNNEL \
+				INET6_XFRM_MODE_BEET
+			do
+				if ! linux_chkconfig_present ${i}; then
+					msg="${msg} ${i}"
+				fi
+			done
+			if [[ ! -z "$msg" ]]; then
+			nothing="0"
+				ewarn
+				ewarn "IPv6 IPSec may fail. CHECK:"
+				ewarn "${msg}"
+			fi
+		fi
+
+		# Check IPSec behind NAT
+		if use nat; then
+			if ! linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then
+				nothing="0"
+				ewarn
+				ewarn "IPSec behind NAT may fail.  CHECK:"
+				ewarn " NETFILTER_XT_MATCH_POLICY"
+			fi
+		fi
+
+		if [[ $nothing == "1" ]]; then
+			ewarn "NO PROBLEMS FOUND"
+		fi
+
+		ewarn
+		ewarn "WARNING: If your *configured* and *running* kernel"
+		ewarn "differ either now or in the future, then these checks"
+		ewarn "may lead to misleading results."
+		ewarn
+		ewarn "\033[1;33m**************************************************\033[00m"
+		ewarn
+	else
+		eerror
+		eerror "\033[1;31m**************************************************\033[00m"
+		eerror "Make sure that your *running* kernel is/will be >=2.6.19."
+		eerror "Building ${PN} now, assuming that you know what you're doing."
+		eerror "\033[1;31m**************************************************\033[00m"
+		eerror
+	fi
+}
+
+src_prepare() {
+	# fix for bug #124813
+	sed -i 's:-Werror::g' "${S}"/configure.ac || die
+	# fix for building with gcc-4.6
+	sed -i 's: -R: -Wl,-R:' "${S}"/configure.ac || die
+
+	eapply "${FILESDIR}/${PN}-def-psk.patch"
+	eapply "${FILESDIR}/${PN}-include-vendoridh.patch"
+	eapply "${FILESDIR}"/${PN}-0.8.0-sysctl.patch #425770
+	eapply "${FILESDIR}"/${PN}-CVE-2015-4047.patch
+	eapply "${FILESDIR}"/${PN}-add-openssl-1.1.x-support.patch
+	eapply "${FILESDIR}"/${PN}-CVE-2016-10396.patch
+	AT_M4DIR="${S}" eautoreconf
+
+	eapply_user
+}
+
+src_configure() {
+	#--with-{libiconv,libradius} lead to "Broken getaddrinfo()"
+	#--enable-samode-unspec is not supported in linux
+	local myconf
+	myconf="--with-kernel-headers=/usr/include \
+			--enable-adminport \
+			--enable-dependency-tracking \
+			--enable-dpd \
+			--enable-frag \
+			--without-libiconv \
+			--without-libradius \
+			--disable-samode-unspec \
+			$(use_enable idea) \
+			$(use_enable ipv6) \
+			$(use_enable kerberos gssapi) \
+			$(use_with ldap libldap) \
+			$(use_enable nat natt) \
+			$(use_with pam libpam) \
+			$(use_enable rc5) \
+			$(use_with readline) \
+			$(use_enable selinux security-context) \
+			$(use_enable stats)"
+
+	use nat && myconf="${myconf} --enable-natt-versions=yes"
+
+	# enable mode-cfg and xauth support
+	if use pam; then
+		myconf="${myconf} --enable-hybrid"
+	else
+		myconf="${myconf} $(use_enable hybrid)"
+	fi
+
+	econf ${myconf}
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	keepdir /var/lib/racoon
+	newconfd "${FILESDIR}"/racoon.conf.d-r2 racoon
+	newinitd "${FILESDIR}"/racoon.init.d-r3 racoon
+	systemd_dounit "${FILESDIR}/ipsec-tools.service"
+	systemd_dounit "${FILESDIR}/racoon.service"
+	use pam && newpamd "${FILESDIR}"/racoon.pam.d racoon
+
+	insinto /etc
+	doins "${FILESDIR}"/ipsec-tools.conf
+	insinto /etc/racoon
+	doins "${FILESDIR}"/racoon.conf
+	doins "${FILESDIR}"/psk.txt
+	chmod 400 "${D}"/etc/racoon/psk.txt
+
+	dodoc ChangeLog README NEWS
+	dodoc -r src/racoon/samples
+	dodoc -r src/racoon/doc
+	docinto samples
+	newdoc src/setkey/sample.cf ipsec-tools.conf
+}
+
+pkg_postinst() {
+	if use nat; then
+		elog
+		elog "You have enabled the nat traversal functionnality."
+		elog "Nat versions wich are enabled by default are 00,02,rfc"
+		elog "you can find those drafts in the CVS repository:"
+		elog "cvs -d anoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools"
+		elog
+		elog "If you feel brave enough and you know what you are"
+		elog "doing, you can consider emerging this ebuild with"
+		elog "EXTRA_ECONF=\"--enable-natt-versions=08,07,06\""
+		elog
+	fi
+
+	if use ldap; then
+		elog
+		elog "You have enabled ldap support with {$PN}."
+		elog "The man page does NOT contain any information on it yet."
+		elog "Consider using a more recent version or CVS."
+		elog
+	fi
+
+	elog
+	elog "Please have a look in /usr/share/doc/${P} and visit"
+	elog "http://www.netbsd.org/Documentation/network/ipsec/"
+	elog "to find more information on how to configure this tool."
+	elog
+}