gentoo resync : 29.06.2020

16 files changed, 155 insertions, 296 deletions

diff --git a/net-vpn/Manifest.gz b/net-vpn/Manifest.gz
index 752cdc42c214..877fbc6cdaeb 100644
--- a/net-vpn/Manifest.gz
+++ b/net-vpn/Manifest.gz
diff --git a/net-vpn/ipsec-tools/Manifest b/net-vpn/ipsec-tools/Manifest
index 3a5a2ee55883..0398c8de0cde 100644
--- a/net-vpn/ipsec-tools/Manifest
+++ b/net-vpn/ipsec-tools/Manifest
@@ -13,6 +13,5 @@ AUX racoon.init.d-r3 1295 BLAKE2B 730b7c7069ea94f0e27fe3c0ed344d6f9631e0445d2368
 AUX racoon.pam.d 156 BLAKE2B 91ebefbb1264fe3fe98df0a72ac22a4cd8a787b3b391af5769798e0b0185f0a588bc089d229c76138fd2db39fbe6bd33924f0d53e0513074d9c2d7abf88dcb78 SHA512 d3f7e6ca8c9f2b5060ebccb259316bb59c9a7e158e8ef9466765a20db263a4043a590811f1a3ab072b718dbd70898bc69b77e0b19603d7f394b5ac1bd0a4a56c
 AUX racoon.service 244 BLAKE2B f7e268518787a67e9363c936b8a9e69763c41db1926f99f3f001fdf738b0b3a92cd62770ab6cc0189cea20ca22d3abe675c832363ad77974e3f531ffbf525e7b SHA512 56d84f36b307e1ea93f3cdc9fbb7b459f4b3b65ea2bb765f61def10d06a3ff09d61b8d53b21796a55022279e791d751f3bc1ccf0d0f85799a743371390930567
 DIST ipsec-tools-0.8.2.tar.bz2 866465 BLAKE2B cf8c9175d96326fc5c74e6b1921bc66911256e289e6fe9cef77f26c197546902be3ebd5696af39c749a2abaac3f42010c9e2a281fd208122cd59222044b9dd4c SHA512 2b7d0efa908d3a699be7ef8b2b126a3809956cb7add50e8efb1cfdfc2d9b70c39ef517379cb9a4fad9e5f0c25937e98535b06c32bd3e729f5129da4ab133e30f
-EBUILD ipsec-tools-0.8.2-r5.ebuild 7907 BLAKE2B 4f0dee8d6a083952e1db6f89b5cdacf701eb476943915d3efdc08a369ab9f03eddc9798f7f2931021555429a69aea1fa00bee99fc24d2e8303212c4b9fc8656d SHA512 3390b428d29df81755b2d419b049ee776ff60b38d8156ed7852e54fb47fa0441f3608ee23a8a254781fb4078d8cd12bfa624035924355464e891c7a344c2bb9a
-EBUILD ipsec-tools-0.8.2-r6.ebuild 7960 BLAKE2B 5557846cd1912402055f2591ff722fcbd79edf5ff437c0ea02e5f682da5e4cc1ef518163905af6f0d3070153184f0891743f086d028aed443682b5ab824416ba SHA512 a42c3655726e8667cb1ea588db799b36fc95969ac41a3b61de61a0efcf9f59739eaa325d8d78431e77d31c5a168192cf34abccafb892aae887158603247606e2
+EBUILD ipsec-tools-0.8.2-r6.ebuild 7956 BLAKE2B 270b0b564f4f37b2a334ade4947eb26b14f202ba546b31f13a7f9f65743c363f995db4c730b23a37a511c39aca7d929be1e03a46efd1066305a299fc4215082c SHA512 11b47ba7dd381be70dbdee1a5a30c6151c078310e7ff2d7bfb07434a5deac3e3cc91c1690bc569fa4a21c11f4511c6812d2de9b26111107ce5e69684ed68a848
 MISC metadata.xml 632 BLAKE2B 705ccbcd150c7180f882207dd5e7a8b0765b58f8296be9bb299e982207d88031b770186b665ee936ca834b2b8601a78f7d2ade63b88d6aa09808b2fe3a89be87 SHA512 7636e9dd2ed9069933b2215829660c3d7c1b43d9c4ad3303cf8889618bd659f68a27994ae520ec7e327060337a196e8b720140e5b32fc6830158be0f0fff1eb8
diff --git a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r5.ebuild b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r5.ebuild
deleted file mode 100644
index 1355050b3636..000000000000
--- a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r5.ebuild
+++ /dev/null
@@ -1,282 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="6"
-
-inherit flag-o-matic autotools linux-info pam systemd
-
-DESCRIPTION="A port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation"
-HOMEPAGE="http://ipsec-tools.sourceforge.net/"
-SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="amd64 arm ~ia64 ~mips ppc ppc64 x86"
-IUSE="hybrid idea ipv6 kerberos ldap libressl nat pam rc5 readline selinux stats"
-
-CDEPEND="
-	!libressl? ( dev-libs/openssl:0 )
-	libressl? ( dev-libs/libressl )
-	kerberos? ( virtual/krb5 )
-	ldap? ( net-nds/openldap )
-	pam? ( sys-libs/pam )
-	readline? ( sys-libs/readline:0= )
-	selinux? ( sys-libs/libselinux )"
-
-DEPEND="${CDEPEND}
-	>=sys-kernel/linux-headers-2.6.30"
-
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-ipsec )
-"
-
-pkg_preinst() {
-	if has_version "<${CATEGORY}/${PN}-0.8.0-r5" ; then
-		ewarn
-		ewarn "\033[1;33m**************************************************\033[00m"
-		ewarn
-		if ! has_version "net-vpn/strongswan" &&
-			! has_version "net-misc/openswan" &&
-			! has_version "net-vpn/libreswan"; then
-			ewarn "We found an earlier version of ${PN} installed."
-			ewarn "As of ${PN}-0.8.0-r5, the old configuration file,"
-			ewarn "ipsec.conf, has been changed to ipsec-tools.conf to avoid"
-			ewarn "a conflict with net-vpn/strongswan; bug #436144.  We will"
-			ewarn "rename this file for you with this upgrade.  However, if"
-			ewarn "you later downgrade, you'll have to rename the file to"
-			ewarn "its orignal manually or change /etc/conf.d/racoon to point"
-			ewarn "to the new file."
-
-			if [[ -f /etc/ipsec.conf && ! -f /etc/ipsec-tools.conf ]] ; then
-				mv /etc/ipsec.conf /etc/ipsec-tools.conf
-			else
-				ewarn
-				ewarn "Oops!  I can't move ipsec.conf to ipsec-tools.conf!"
-				ewarn "Either the former doesn't exist or the later does and"
-				ewarn "I won't clobber it.  Please fix this situation manually."
-			fi
-		else
-			ewarn "You had both an earlier version of ${PN} and"
-			ewarn "net-vpn/strongswan installed.  I can't tell whether"
-			ewarn "the configuration file, ipsec.conf, belongs to one"
-			ewarn "package or the other due to a file conflict; bug #436144."
-			ewarn "The current version of ${PN} uses ipsec-tools.conf"
-			ewarn "as its configuration file, as will future versions."
-			ewarn "Please fix this situation manually."
-		fi
-		ewarn
-		ewarn "\033[1;33m**************************************************\033[00m"
-		ewarn
-	fi
-}
-
-pkg_setup() {
-	linux-info_pkg_setup
-
-	get_version
-
-	if linux_config_exists && kernel_is -ge 2 6 19; then
-		ewarn
-		ewarn "\033[1;33m**************************************************\033[00m"
-		ewarn
-		ewarn "Checking kernel configuration in /usr/src/linux or"
-		ewarn "or /proc/config.gz for compatibility with ${PN}."
-		ewarn "Here are the potential problems:"
-		ewarn
-
-		local nothing="1"
-
-		# Check options for all flavors of IPSec
-		local msg=""
-		for i in XFRM_USER NET_KEY; do
-			if ! linux_chkconfig_present ${i}; then
-				msg="${msg} ${i}"
-			fi
-		done
-		if [[ ! -z "$msg" ]]; then
-			nothing="0"
-			ewarn
-			ewarn "ALL IPSec may fail. CHECK:"
-			ewarn "${msg}"
-		fi
-
-		# Check unencrypted IPSec
-		if ! linux_chkconfig_present CRYPTO_NULL; then
-			nothing="0"
-			ewarn
-			ewarn "Unencrypted IPSec may fail. CHECK:"
-			ewarn " CRYPTO_NULL"
-		fi
-
-		# Check IPv4 IPSec
-		msg=""
-		for i in \
-			INET_IPCOMP INET_AH INET_ESP \
-			INET_XFRM_MODE_TRANSPORT \
-			INET_XFRM_MODE_TUNNEL \
-			INET_XFRM_MODE_BEET
-		do
-			if ! linux_chkconfig_present ${i}; then
-				msg="${msg} ${i}"
-			fi
-		done
-		if [[ ! -z "$msg" ]]; then
-			nothing="0"
-			ewarn
-			ewarn "IPv4 IPSec may fail. CHECK:"
-			ewarn "${msg}"
-		fi
-
-		# Check IPv6 IPSec
-		if use ipv6; then
-			msg=""
-			for i in INET6_IPCOMP INET6_AH INET6_ESP \
-				INET6_XFRM_MODE_TRANSPORT \
-				INET6_XFRM_MODE_TUNNEL \
-				INET6_XFRM_MODE_BEET
-			do
-				if ! linux_chkconfig_present ${i}; then
-					msg="${msg} ${i}"
-				fi
-			done
-			if [[ ! -z "$msg" ]]; then
-			nothing="0"
-				ewarn
-				ewarn "IPv6 IPSec may fail. CHECK:"
-				ewarn "${msg}"
-			fi
-		fi
-
-		# Check IPSec behind NAT
-		if use nat; then
-			if ! linux_chkconfig_present NETFILTER_XT_MATCH_POLICY; then
-				nothing="0"
-				ewarn
-				ewarn "IPSec behind NAT may fail.  CHECK:"
-				ewarn " NETFILTER_XT_MATCH_POLICY"
-			fi
-		fi
-
-		if [[ $nothing == "1" ]]; then
-			ewarn "NO PROBLEMS FOUND"
-		fi
-
-		ewarn
-		ewarn "WARNING: If your *configured* and *running* kernel"
-		ewarn "differ either now or in the future, then these checks"
-		ewarn "may lead to misleading results."
-		ewarn
-		ewarn "\033[1;33m**************************************************\033[00m"
-		ewarn
-	else
-		eerror
-		eerror "\033[1;31m**************************************************\033[00m"
-		eerror "Make sure that your *running* kernel is/will be >=2.6.19."
-		eerror "Building ${PN} now, assuming that you know what you're doing."
-		eerror "\033[1;31m**************************************************\033[00m"
-		eerror
-	fi
-}
-
-src_prepare() {
-	# fix for bug #124813
-	sed -i 's:-Werror::g' "${S}"/configure.ac || die
-	# fix for building with gcc-4.6
-	sed -i 's: -R: -Wl,-R:' "${S}"/configure.ac || die
-
-	eapply "${FILESDIR}/${PN}-def-psk.patch"
-	eapply "${FILESDIR}/${PN}-include-vendoridh.patch"
-	eapply "${FILESDIR}"/${PN}-0.8.0-sysctl.patch #425770
-	eapply "${FILESDIR}"/${PN}-CVE-2015-4047.patch
-	eapply "${FILESDIR}"/${PN}-add-openssl-1.1.x-support.patch
-	AT_M4DIR="${S}" eautoreconf
-
-	eapply_user
-}
-
-src_configure() {
-	#--with-{libiconv,libradius} lead to "Broken getaddrinfo()"
-	#--enable-samode-unspec is not supported in linux
-	local myconf
-	myconf="--with-kernel-headers=/usr/include \
-			--enable-adminport \
-			--enable-dependency-tracking \
-			--enable-dpd \
-			--enable-frag \
-			--without-libiconv \
-			--without-libradius \
-			--disable-samode-unspec \
-			$(use_enable idea) \
-			$(use_enable ipv6) \
-			$(use_enable kerberos gssapi) \
-			$(use_with ldap libldap) \
-			$(use_enable nat natt) \
-			$(use_with pam libpam) \
-			$(use_enable rc5) \
-			$(use_with readline) \
-			$(use_enable selinux security-context) \
-			$(use_enable stats)"
-
-	use nat && myconf="${myconf} --enable-natt-versions=yes"
-
-	# enable mode-cfg and xauth support
-	if use pam; then
-		myconf="${myconf} --enable-hybrid"
-	else
-		myconf="${myconf} $(use_enable hybrid)"
-	fi
-
-	econf ${myconf}
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-	keepdir /var/lib/racoon
-	newconfd "${FILESDIR}"/racoon.conf.d-r2 racoon
-	newinitd "${FILESDIR}"/racoon.init.d-r3 racoon
-	systemd_dounit "${FILESDIR}/ipsec-tools.service"
-	systemd_dounit "${FILESDIR}/racoon.service"
-	use pam && newpamd "${FILESDIR}"/racoon.pam.d racoon
-
-	insinto /etc
-	doins "${FILESDIR}"/ipsec-tools.conf
-	insinto /etc/racoon
-	doins "${FILESDIR}"/racoon.conf
-	doins "${FILESDIR}"/psk.txt
-	chmod 400 "${D}"/etc/racoon/psk.txt
-
-	dodoc ChangeLog README NEWS
-	dodoc -r src/racoon/samples
-	dodoc -r src/racoon/doc
-	docinto samples
-	newdoc src/setkey/sample.cf ipsec-tools.conf
-}
-
-pkg_postinst() {
-	if use nat; then
-		elog
-		elog "You have enabled the nat traversal functionnality."
-		elog "Nat versions wich are enabled by default are 00,02,rfc"
-		elog "you can find those drafts in the CVS repository:"
-		elog "cvs -d anoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools"
-		elog
-		elog "If you feel brave enough and you know what you are"
-		elog "doing, you can consider emerging this ebuild with"
-		elog "EXTRA_ECONF=\"--enable-natt-versions=08,07,06\""
-		elog
-	fi
-
-	if use ldap; then
-		elog
-		elog "You have enabled ldap support with {$PN}."
-		elog "The man page does NOT contain any information on it yet."
-		elog "Consider using a more recent version or CVS."
-		elog
-	fi
-
-	elog
-	elog "Please have a look in /usr/share/doc/${P} and visit"
-	elog "http://www.netbsd.org/Documentation/network/ipsec/"
-	elog "to find more information on how to configure this tool."
-	elog
-}
diff --git a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild
index b570d3dc4b91..92c5ce61b3ac 100644
--- a/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild
+++ b/net-vpn/ipsec-tools/ipsec-tools-0.8.2-r6.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~ia64 ~mips ~ppc ~ppc64 x86"
+KEYWORDS="amd64 arm ~ia64 ~mips ppc ppc64 x86"
 IUSE="hybrid idea ipv6 kerberos ldap libressl nat pam rc5 readline selinux stats"
 
 CDEPEND="
diff --git a/net-vpn/libreswan/Manifest b/net-vpn/libreswan/Manifest
index 0612614ea800..e2cc28179521 100644
--- a/net-vpn/libreswan/Manifest
+++ b/net-vpn/libreswan/Manifest
@@ -1,4 +1,6 @@
 AUX libreswan-3.30-ip-path.patch 563 BLAKE2B 838ae401b4e7c04378e8cbb2561a6d348896883942683682c8ac3b31de56d360460bc2ea2c26f579a6f36078101270167b775579fd2502c72dd680620c12a585 SHA512 a8a391386014cff3b867fb8c0ba8c83ecb93c11d35aea205877b66e3104712311e19f13eb9659ee158833512c199d0104b5a796ebef37a1bc210e254abc6f573
+AUX libreswan-3.32-nss-compat.patch 680 BLAKE2B 5eb1f43e95d2f0801e0725ae1186e96ccf529200b0f1e4c8aa8d6d09248114f45a61468ad88a247a85c2f97b019ab0a022c6ce8a6ed263097c8d42c0008cfa43 SHA512 231b3985f333cc4a6f588b6854a217847136dd67305152dd14be96db8c0d7e043b885c47382276387e44939e26d046753d16853f3f0f17b43f966e3c3213c8e1
 DIST libreswan-3.32.tar.gz 4141631 BLAKE2B 37a4cb5c1f52d69b17ba60abd2b7a181d9f5567914a453ab875185110aeda4d33ecdaacfc83e361f153860a1db66faec70e0ad06af65e310af28ae72ce68fc6a SHA512 bb65512351059e2fac6f1c3ed1e291eabd6835faacf6d9c58649dd71dab1bb4fe6d6074178dea6dea01f24d39f3fbefd84c6060e4d8436b5d057fa55ae4467f3
+EBUILD libreswan-3.32-r1.ebuild 3165 BLAKE2B c0144e07373f076366d0baeb9c9c2472edc6c07f7fbb6ee37c7865ea37cdf4476e3f3119c51efeb1ac4ba54caad84a14727811387cf6eacd3be9724a5ede7b1d SHA512 1bd84beadae36e45f948b0c902e5ee4058c79a26a7d72b985bda62bfe3267e468f0c6ea970fe73f70e34332a286fe3c8da9f6e8b34b5f3c9d8eb742508b40344
 EBUILD libreswan-3.32.ebuild 3127 BLAKE2B dfd79e648967070d3a2ae7018873647a03d162bf904f4f70fa7d2baf9969d7912407a56869986f0c83675e65e5f27e5622ffccf4c6b1b3bcecb3200472976372 SHA512 5937f4ee0eba31fa8cbfcb477e19e5d2f74b1fafba9be035cdb64e88e80d5bc0acfd6dd995de54e449be6a8ff01a893ad64d578d4eb7b5e72f42f748fc829333
 MISC metadata.xml 319 BLAKE2B 6bae0756e29efeb1cf77d60f7e38fe62ffa5f24c3745e07900e6ef5f65194c50f6a479d97fdcc24804ccdcfefd9707b12f08dffe613fcf798afc421826de36e4 SHA512 924161f15c0f7a9666a6d7a422b45da679190e1a0f2859b997ddd753cbf49df9da337e5420040210736f76fa712dca3ec8862480f62bd321de71e74bee7c0865
diff --git a/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch b/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch
new file mode 100644
index 000000000000..09f71a9f907c
--- /dev/null
+++ b/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch
@@ -0,0 +1,23 @@
+Add compatibility setting for NSS
+
+https://github.com/libreswan/libreswan/commit/65a497959a0e1ca615341109eaad5e75723839d6
+
+We patch a different file because a later commit moved the setting to this file.
+
+diff --git a/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c b/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
+index 93a027089a..571913cc1e 100644
+--- a/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
++++ b/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
+@@ -16,6 +16,12 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ 
++/*
++ * Special advise from Bob Relyea - needs to go before any nss include
++ *
++ */
++#define NSS_PKCS11_2_0_COMPAT 1
++
+ #include "lswlog.h"
+ #include "lswnss.h"
+ #include "prmem.h"
diff --git a/net-vpn/libreswan/libreswan-3.32-r1.ebuild b/net-vpn/libreswan/libreswan-3.32-r1.ebuild
new file mode 100644
index 000000000000..594a265b4671
--- /dev/null
+++ b/net-vpn/libreswan/libreswan-3.32-r1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit systemd toolchain-funcs
+
+SRC_URI="https://download.libreswan.org/${P}.tar.gz"
+KEYWORDS="~amd64 ~arm ~ppc ~x86"
+
+DESCRIPTION="IPsec implementation for Linux, fork of Openswan"
+HOMEPAGE="https://libreswan.org/"
+
+LICENSE="GPL-2 BSD-4 RSA DES"
+SLOT="0"
+IUSE="caps curl dnssec ldap pam seccomp selinux systemd test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-libs/gmp:0=
+	dev-libs/libevent:0=
+	dev-libs/nspr
+	>=dev-libs/nss-3.42
+	>=sys-kernel/linux-headers-4.19
+	caps? ( sys-libs/libcap-ng )
+	curl? ( net-misc/curl )
+	dnssec? ( >=net-dns/unbound-1.9.1-r1:= net-libs/ldns )
+	ldap? ( net-nds/openldap )
+	pam? ( sys-libs/pam )
+	seccomp? ( sys-libs/libseccomp )
+	selinux? ( sys-libs/libselinux )
+	systemd? ( sys-apps/systemd:0= )
+"
+BDEPEND="
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/xmlto
+	dev-libs/nss
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+	test? ( dev-python/setproctitle )
+"
+RDEPEND="${DEPEND}
+	dev-libs/nss[utils(+)]
+	sys-apps/iproute2
+	!net-vpn/strongswan
+	selinux? ( sec-policy/selinux-ipsec )
+"
+
+usetf() {
+	usex "$1" true false
+}
+
+PATCHES=( "${FILESDIR}/${PN}-3.30-ip-path.patch" "${FILESDIR}/${P}-nss-compat.patch" )
+
+src_prepare() {
+	sed -i -e 's:/sbin/runscript:/sbin/openrc-run:' initsystems/openrc/ipsec.init.in || die
+	sed -i -e '/^install/ s/postcheck//' -e '/^doinstall/ s/oldinitdcheck//' initsystems/systemd/Makefile || die
+	default
+}
+
+src_configure() {
+	tc-export AR CC
+	export INC_USRLOCAL=/usr
+	export INC_MANDIR=share/man
+	export FINALEXAMPLECONFDIR=/usr/share/doc/${PF}
+	export FINALDOCDIR=/usr/share/doc/${PF}/html
+	export INITSYSTEM=openrc
+	export INC_RCDIRS=
+	export INC_RCDEFAULT=/etc/init.d
+	export USERCOMPILE=
+	export USERLINK=
+	export USE_DNSSEC=$(usetf dnssec)
+	export USE_LABELED_IPSEC=$(usetf selinux)
+	export USE_LIBCAP_NG=$(usetf caps)
+	export USE_LIBCURL=$(usetf curl)
+	export USE_LINUX_AUDIT=$(usetf selinux)
+	export USE_LDAP=$(usetf ldap)
+	export USE_SECCOMP=$(usetf seccomp)
+	export USE_SYSTEMD_WATCHDOG=$(usetf systemd)
+	export SD_WATCHDOGSEC=$(usex systemd 200 0)
+	export USE_XAUTHPAM=$(usetf pam)
+	export DEBUG_CFLAGS=
+	export OPTIMIZE_CFLAGS=
+	export WERROR_CFLAGS=
+}
+
+src_compile() {
+	emake all
+	emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" all
+}
+
+src_test() {
+	: # integration tests only that require set of kvms to be set up
+}
+
+src_install() {
+	default
+	emake -C initsystems INITSYSTEM=systemd SYSTEMUNITDIR="$(systemd_get_systemunitdir)" SYSTEMTMPFILESDIR="/usr/lib/tmpfiles.d" DESTDIR="${D}" install
+
+	echo "include /etc/ipsec.d/*.secrets" > "${D}"/etc/ipsec.secrets
+	fperms 0600 /etc/ipsec.secrets
+
+	dodoc -r docs
+
+	find "${D}" -type d -empty -delete || die
+}
+
+pkg_postinst() {
+	local IPSEC_CONFDIR=${ROOT}/etc/ipsec.d
+	if [[ ! -f ${IPSEC_CONFDIR}/cert8.db && ! -f ${IPSEC_CONFDIR}/cert9.db ]] ; then
+		ebegin "Setting up NSS database in ${IPSEC_CONFDIR} with empty password"
+		certutil -N -d "${IPSEC_CONFDIR}" --empty-password
+		eend $?
+		einfo "To set a password: certutil -W -d sql:${IPSEC_CONFDIR}"
+	fi
+}
diff --git a/net-vpn/networkmanager-openvpn/Manifest b/net-vpn/networkmanager-openvpn/Manifest
index 3f9eefc3142f..9f570f077499 100644
--- a/net-vpn/networkmanager-openvpn/Manifest
+++ b/net-vpn/networkmanager-openvpn/Manifest
@@ -1,5 +1,5 @@
 DIST NetworkManager-openvpn-1.8.10.tar.xz 564540 BLAKE2B e117395b91efbd0ee10bdefe0aaff8a39fdd1fe232dc1543224be7dfd9bb18729ad873091301e6348f8955f28579e106f5565c7138309571e06598aa35dc5bba SHA512 f710848fccf21ac4554a2b46e80cf890c011edc6d64d9a49d6d8669f3ff71f7990e11e6f4681bb85d30238ec05f2fc79c4619983f6860c6ab0d714f941a3dfcc
 DIST NetworkManager-openvpn-1.8.12.tar.xz 597216 BLAKE2B 55ccb3139b1be9d1894d3651d60ce0f2167a24efbb24a9870eb4bb683a91603ae5f5149ed9aca8307cf608140c075a7b19bdfef68b1dbfe0729c117f084bb904 SHA512 1b8adf926426f866f7509a07c24203d6b584627aba4f8e2b1b00fa897bf0d7155009d566c3440565d1ee0e938694dd8d6746f37f62d493864d16eae007590b22
 EBUILD networkmanager-openvpn-1.8.10-r2.ebuild 1302 BLAKE2B 451a9e8e1e8a1de6a943927529fe439b36fd7048115db948b7fe90698c4730470dc6a73735106c0b7c4b90e892b2ee07a1b993c0397ac1b620062c585a2f7558 SHA512 6f8f1aea4ff54490b07a2d72777d6a5eec0e36de17014703ed0000a4d516966a7f8b4ad8635c988aa9a4b18ae6c8c844b79a85a9fa76d19e9ce89c04c75ed284
-EBUILD networkmanager-openvpn-1.8.12.ebuild 1304 BLAKE2B 6d11cfdcf647867da8682da56382151f51bc808bf2cf2de5a90a87c3601a18becd9382c8b1a675d34ee483f14849844be74512e7e4cf5b906fde2eacb46f56ab SHA512 0fbc2316d8ed07067c61ff0da0055fa567e846f360388a422356e7816ed000de09059b5fae2511a2b45411654e30eafb9dd662006dc309a88e7fe52742fab3cd
+EBUILD networkmanager-openvpn-1.8.12.ebuild 1303 BLAKE2B a1048fead3a30800d45aeefee9819780944c262ceafcf6ef12ea44c672efad4086dd3bd93ea28141ee966c8f7167390261d9fd46d7b70e649bf90e23b1d0819e SHA512 6f9ca67327f9965237a58d6ced3c7a1f7914953f4280ec1d950bf67eef313abc79ef61a0ec6e4cd173e7fe65e29a92ee73a37e84fd7a7398e152e50dbc2c0857
 MISC metadata.xml 253 BLAKE2B a1efbd3751efaa83ee173f557ec1c8a4497a90b60896cf5a7a07da40b4f94a7a299ca0385477e82b2f5e5dbdf9afa482ccbe21f35ef44214e9c451d764b65529 SHA512 8d59f413993268ca783f7407b676900bb2d964754bf705d4175e2bafbe058a52af74f3928e4bd84d292518f8cf13fab7051486ab7cdc61d02fae6e0188d44442
diff --git a/net-vpn/networkmanager-openvpn/networkmanager-openvpn-1.8.12.ebuild b/net-vpn/networkmanager-openvpn/networkmanager-openvpn-1.8.12.ebuild
index 513bba285b9a..936a26c2ca5c 100644
--- a/net-vpn/networkmanager-openvpn/networkmanager-openvpn-1.8.12.ebuild
+++ b/net-vpn/networkmanager-openvpn/networkmanager-openvpn-1.8.12.ebuild
@@ -11,7 +11,7 @@ HOMEPAGE="https://wiki.gnome.org/Projects/NetworkManager"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~x86"
+KEYWORDS="~amd64 ~arm x86"
 IUSE="gtk test"
 RESTRICT="!test? ( test )"
 
diff --git a/net-vpn/networkmanager-wireguard/Manifest b/net-vpn/networkmanager-wireguard/Manifest
index 7f3d1bd0818c..a49ae776fe52 100644
--- a/net-vpn/networkmanager-wireguard/Manifest
+++ b/net-vpn/networkmanager-wireguard/Manifest
@@ -1,5 +1,5 @@
 AUX networkmanager-wireguard-0_pre20191128-change-appdata-path.patch 945 BLAKE2B 2d235958175d6f62cb9032e88b0a7d8c1e3a0c859d6e233c687fa5aff65cd54b7d225008d150a4b1e6ab3115055d33b6cd07473aeb41e14aef6f1050a66d8fdf SHA512 8efa817767eb80752c862be1b4d1a1aa923d293f868dad880fd02a7af50cebbf1a6b3673a2f6598cb92cb0f38e50434414787b6b33644e3c90a6da13581e9d23
 DIST networkmanager-wireguard-0_pre20191128.tar.gz 238536 BLAKE2B e926c08c68df3e452a7ba25c66e7678969594002cb45a03ca26af32c86b021260c7836157fe9244c07223bf2e1c821ee64c3535c392f3636217c6ae67d8b800a SHA512 4ed9566a18be01b1be7d92da4663a292e17804a706045d58f08640e2fe81f9672880f20d1657b70eafc769b2688f72928c6fa601c0011bde91347902a222e670
-EBUILD networkmanager-wireguard-0_pre20191128-r5.ebuild 1173 BLAKE2B 66d8354573d0a40db3ddd77a0af637c633ab869f8443b273cfc9edef825c2af6ddfff5c8f7657ef43acfa443c4d4cc5d89f45f8f552f53d7eb84b5c68a6d1550 SHA512 3f60affe37bd1563b848e0365364ccfc356a3825a37c55b745647cb6e9355af743334124f2e93670f9797cdaada398047e9d19266cd8a34222eefde3c694344d
+EBUILD networkmanager-wireguard-0_pre20191128-r5.ebuild 1171 BLAKE2B fb7d3c9f5471f133a96b8d5fbbf9ce5ac6e3d52bec24a9da0531bfabe3134785f2015a8759ca369ac333cf52ad21460b655a1b6a3a1c0e915cc18306fa5764f0 SHA512 e4579c17da4360c384349e00c0e35cb25e4161b5909253ebb7f3c60eb56f47ae68a6bdc34821f78c70d925c6b9a08bc8acd2335efe8fe539a46f79a4acdf7224
 EBUILD networkmanager-wireguard-9999.ebuild 1019 BLAKE2B 46b228e851771f0673c01212f40b784840d5faf74982fae7c3983fdf9b3d2306aff39c149e363ca48fae6196de08c63bdd75a4517764a55dfd039cb46436a639 SHA512 89123d77464e1064d49bb0c142483c3cb8bd9067a54eb67469906fa238ee176b6880dc6ef938b6ca35df370b3bb95ba998f07bb92258c730ebc96ac34c74a9c8
 MISC metadata.xml 479 BLAKE2B 2d974d5fe2bfd35934e2638959ea93f54e0bb0c574dc0da398a9521573de047ab091728cbc6583530cdc737bd1c00af16eb282b78aae39ae8d21c37a0ad3aabe SHA512 6f8889fee4242fb2ee7e11b9ff5b1c1e012b434d19ae909c719a12dd63ff30830adc71632fb31517ea24872f3450f54381e787b399391744f8a89dfd4de0e3c6
diff --git a/net-vpn/networkmanager-wireguard/networkmanager-wireguard-0_pre20191128-r5.ebuild b/net-vpn/networkmanager-wireguard/networkmanager-wireguard-0_pre20191128-r5.ebuild
index 9b37b3a8b4cf..4d9e66dee6b3 100644
--- a/net-vpn/networkmanager-wireguard/networkmanager-wireguard-0_pre20191128-r5.ebuild
+++ b/net-vpn/networkmanager-wireguard/networkmanager-wireguard-0_pre20191128-r5.ebuild
@@ -14,7 +14,7 @@ SRC_URI="https://github.com/max-moser/${MY_PN}/archive/${EGIT_COMMIT}.tar.gz ->
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="amd64 x86"
 IUSE="+gtk +nls"
 
 RDEPEND="
diff --git a/net-vpn/wireguard-modules/Manifest b/net-vpn/wireguard-modules/Manifest
index f963113e231d..fc6fcfab7c52 100644
--- a/net-vpn/wireguard-modules/Manifest
+++ b/net-vpn/wireguard-modules/Manifest
@@ -1,4 +1,4 @@
-DIST wireguard-linux-compat-1.0.20200611.tar.xz 262892 BLAKE2B bf8441b3428a6d330fb7976695a4c70c3784550854b81cfb6e784dcd9fa1d32351652cab46d0b4dab51a5dbf9ec989cfb41a58b8632ae06571b6d57dcdb0e667 SHA512 b650115d64a4bd665fdc27918d3b8ee72578a2b9542eabbc9a9d99df87c6f4d26aa395b5ec6569becadcdf291662934061fec962a7949bb99679fe7b37e9fadc
-EBUILD wireguard-modules-1.0.20200611.ebuild 3442 BLAKE2B 81c97ff68c71ce60d343266035852d2128246a3aa1c4ca95d0847904c021c5e4a7bb652d8c531e50be1dcc430fa34e54682462595101fded003af71e97e037e6 SHA512 1979d83d24156acf594edfc23c76e8e30e9a21ef9cd3fd45a06462ba20a30a9c90618852a611793af53424a52e0486a93d9198e18f89b7c57f9e8e06b434c9d5
+DIST wireguard-linux-compat-1.0.20200623.tar.xz 263156 BLAKE2B 2a45dea6d3a02f91f45ab4fcbbf5da4b24532afc3f775b2731e0360e949d8c689b4fd9e7351c337158bfcd33b09f6e94715b07532a3ebe9eaf40a3e4fff7142f SHA512 447a88d849cf81d83412adbe5aabf5ad44f878b7f64de56672d39b656a9c8053059ea71e5a965c55bacd33651bef2d9d677caf0586b0c7ee7807c69098e1942d
+EBUILD wireguard-modules-1.0.20200623.ebuild 3442 BLAKE2B 81c97ff68c71ce60d343266035852d2128246a3aa1c4ca95d0847904c021c5e4a7bb652d8c531e50be1dcc430fa34e54682462595101fded003af71e97e037e6 SHA512 1979d83d24156acf594edfc23c76e8e30e9a21ef9cd3fd45a06462ba20a30a9c90618852a611793af53424a52e0486a93d9198e18f89b7c57f9e8e06b434c9d5
 EBUILD wireguard-modules-9999.ebuild 3442 BLAKE2B 81c97ff68c71ce60d343266035852d2128246a3aa1c4ca95d0847904c021c5e4a7bb652d8c531e50be1dcc430fa34e54682462595101fded003af71e97e037e6 SHA512 1979d83d24156acf594edfc23c76e8e30e9a21ef9cd3fd45a06462ba20a30a9c90618852a611793af53424a52e0486a93d9198e18f89b7c57f9e8e06b434c9d5
 MISC metadata.xml 661 BLAKE2B bb9a48b3a4f3162f8ccec522734cbc8ffdc7a92868cc7dc32adc1f7ef89f7b2eab1df573bed421d4b76204f9f38ad4fee45f9db4b41c7dc3b86d9d9bb3120a8f SHA512 e9daa3bb8fa72cc60373a3187610231cf396bc5014f33412b65d069ffd02caa659c426819aa76d46a0dd15e8cb579325b46df5296a3b2136d020ec378e5f98a5
diff --git a/net-vpn/wireguard-modules/wireguard-modules-1.0.20200611.ebuild b/net-vpn/wireguard-modules/wireguard-modules-1.0.20200623.ebuild
index 16df945c1ab1..16df945c1ab1 100644
--- a/net-vpn/wireguard-modules/wireguard-modules-1.0.20200611.ebuild
+++ b/net-vpn/wireguard-modules/wireguard-modules-1.0.20200623.ebuild
diff --git a/net-vpn/wireguard-tools/Manifest b/net-vpn/wireguard-tools/Manifest
index 43508c67d957..e7ae98cc4150 100644
--- a/net-vpn/wireguard-tools/Manifest
+++ b/net-vpn/wireguard-tools/Manifest
@@ -1,5 +1,5 @@
 DIST wireguard-tools-1.0.20200319.tar.xz 92324 BLAKE2B 9f514748708ef6a5b7f5b043c9054c954d17bb77de7a354b5a9a4e63cfb5f441237e98b16b288426441a7e709e1874d396cf67b04b38bb0ebbe7822bb32ada57 SHA512 d5bcd153f9b10f184b9a1bf9a81f33a9713ab4863ab5aa190eac60e92919756c8fecbb0d3cfb83bae20ac78fc43fdd7168f37294cdd7c5ee21f2a1b2db5fdf41
 DIST wireguard-tools-1.0.20200513.tar.xz 94500 BLAKE2B 34a39533018416df382d180da76d6494feec1d40208c9df427c1979817dbe138c217fe4c4f4cf5cecd3c4053e6f73f1863d1e0a9ed2cad41899dda5387c15844 SHA512 4d27b262350b6b47843a323c2e7ab8d2bdd48065c265778abdec85b3f6fc92aa9af77d76e368df9cc8e435eae1c0ce50fed52e1d78db54358c1884d34be08d2c
-EBUILD wireguard-tools-1.0.20200319.ebuild 3231 BLAKE2B 09c77ccd2a56b735d48595f5363d086de834c0eb0d25437c24df9a7615c6ebebe593d44686d0397ac6b77fbe34685130a40dd0e31a07495bb3c2ac13b792d1ad SHA512 11ea317a713b3018cc3c7b54d37fa680a205dc98949505834e268e57637e054ad609f1cd300ad69c1969843e88e42fd157d4fbacf923c80e98cd51c4bada1dbd
-EBUILD wireguard-tools-1.0.20200513.ebuild 3234 BLAKE2B 0dcfc0ad5c8f7e893fc8fa7989da618b31025f2e7c28defd22278bf3f0228eb87014e8b32d6787ac257b94bb6ffdb2b2c34dadd06b0375d948a28685bb7698cd SHA512 f2a43c9a53144ef7a8fa7fb62a7fff5126f9422df3b946c54ec36c3637e846533df92e62dd2062ef2e405c44ee6440af5825f929d99779913bb55face199c383
+EBUILD wireguard-tools-1.0.20200319.ebuild 3272 BLAKE2B 800f2ec75e42ac5adb2ef8ffd0403ebd448e19f27609e6d9883d252743e838bd3a017ef86561d4aa8c82e0e67ec7f3b5d3c543ca100f495935bdb6d45faebe25 SHA512 714e11822d0854acb7eb86db716266cd53ff0ae8eb713c962b2aacaaa35b72dcca5ed03562c1a858e6cb204ae85ab25a9097f0db1516fb2ba62d33f1186f35a5
+EBUILD wireguard-tools-1.0.20200513.ebuild 3272 BLAKE2B 800f2ec75e42ac5adb2ef8ffd0403ebd448e19f27609e6d9883d252743e838bd3a017ef86561d4aa8c82e0e67ec7f3b5d3c543ca100f495935bdb6d45faebe25 SHA512 714e11822d0854acb7eb86db716266cd53ff0ae8eb713c962b2aacaaa35b72dcca5ed03562c1a858e6cb204ae85ab25a9097f0db1516fb2ba62d33f1186f35a5
 MISC metadata.xml 362 BLAKE2B b6c8384cc5434b65a80b2326df412ca38a96bfd137feb34cea5124eebe13d383851b3ceea17cfc0b937555a0760608e0f3d0a7834da15271e65f669bfbfb8d2a SHA512 bf494cd4c95dbbbf783fc847cdf03f9a83b2673bf3a0a78fa12480abd1e2657f255019cf4f68db5143b11c5c63d6c16e9e18480800115751be9bc3cae910c8ea
diff --git a/net-vpn/wireguard-tools/wireguard-tools-1.0.20200319.ebuild b/net-vpn/wireguard-tools/wireguard-tools-1.0.20200319.ebuild
index e42a4178572d..07fee8d91012 100644
--- a/net-vpn/wireguard-tools/wireguard-tools-1.0.20200319.ebuild
+++ b/net-vpn/wireguard-tools/wireguard-tools-1.0.20200319.ebuild
@@ -11,7 +11,6 @@ HOMEPAGE="https://www.wireguard.com/"
 if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://git.zx2c4.com/wireguard-tools"
-	KEYWORDS="sparc"
 else
 	SRC_URI="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${PV}.tar.xz"
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 sparc x86"
@@ -55,6 +54,7 @@ pkg_setup() {
 		wg_quick_optional_config_nob NETFILTER_XT_MARK
 		wg_quick_optional_config_nob NETFILTER_XT_CONNMARK
 		wg_quick_optional_config_nob NETFILTER_XT_MATCH_COMMENT
+		wg_quick_optional_config_nob NETFILTER_XT_MATCH_ADDRTYPE
 		wg_quick_optional_config_nob IP6_NF_RAW
 		wg_quick_optional_config_nob IP_NF_RAW
 		wg_quick_optional_config_nob IP6_NF_FILTER
diff --git a/net-vpn/wireguard-tools/wireguard-tools-1.0.20200513.ebuild b/net-vpn/wireguard-tools/wireguard-tools-1.0.20200513.ebuild
index ab890be7d847..07fee8d91012 100644
--- a/net-vpn/wireguard-tools/wireguard-tools-1.0.20200513.ebuild
+++ b/net-vpn/wireguard-tools/wireguard-tools-1.0.20200513.ebuild
@@ -11,10 +11,9 @@ HOMEPAGE="https://www.wireguard.com/"
 if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://git.zx2c4.com/wireguard-tools"
-	KEYWORDS=""
 else
 	SRC_URI="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${PV}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 sparc x86"
 fi
 
 LICENSE="GPL-2"
@@ -55,6 +54,7 @@ pkg_setup() {
 		wg_quick_optional_config_nob NETFILTER_XT_MARK
 		wg_quick_optional_config_nob NETFILTER_XT_CONNMARK
 		wg_quick_optional_config_nob NETFILTER_XT_MATCH_COMMENT
+		wg_quick_optional_config_nob NETFILTER_XT_MATCH_ADDRTYPE
 		wg_quick_optional_config_nob IP6_NF_RAW
 		wg_quick_optional_config_nob IP_NF_RAW
 		wg_quick_optional_config_nob IP6_NF_FILTER