7 files changed, 122 insertions, 4 deletions
diff --git a/net-firewall/Manifest.gz b/net-firewall/Manifest.gz
index b16c66433057..b3ec849cbd38 100644
--- a/net-firewall/Manifest.gz
+++ b/net-firewall/Manifest.gz
diff --git a/net-firewall/ipset/Manifest b/net-firewall/ipset/Manifest
index 66c5d232d8ff..47329c949a56 100644
--- a/net-firewall/ipset/Manifest
+++ b/net-firewall/ipset/Manifest
@@ -6,5 +6,7 @@ AUX ipset.confd-r1 666 BLAKE2B 852963fd27d11f58305f33cc9be84d5eabde73f5af4924d97
 AUX ipset.initd-r7 4175 BLAKE2B 8a9936ffc57ffcf25ed45769d6cb76cecc0de66919597a90e440156d7cf938ed5ffc6b71aed634cbc473c866ad542d9eb388e3d91ebd697949ceaa763ce24e80 SHA512 d208ee673119182ee515c25263704e0e5bbae1aefbf5ec469ca71f3e70e14900c5a2d8f0171b3a5754afbcc464d30a760d0e413b1b66ccb0d3805327fdd66b65
 AUX ipset.systemd-r1 492 BLAKE2B 78fd7b122e0fe08b36d36e736d18b7a5f0bf1aa78802f1bdc7abf69ad2ef9c0bcfb22ae84f8f6489aee6c147ee3c0be7ebfa600712bf6169940802466daf68ba SHA512 6574e48ce6b3c4f45122a8b387746793ceda62f68ec8b0f3f6f949f5650ab557f3f7eb75699e36d5bf04efbf39dc17e030cc44ea9d97891578d4c909669e6eb7
 DIST ipset-7.22.tar.bz2 694069 BLAKE2B 9daaff54adb6f9daf69cd7dabbd9134d8fcf8cd7f8ef0c52296961579ad3c8202087158a01664228eff70356ba97f77ec61abbab7c7ce323112fbdc32abd661b SHA512 e375a9110eb7974480147c57eb2cff4bdd03c7704cdae006a3d254cc80fada587aa8aee25a86f7cab29db83f5e283c5f9a47a314297317660ebba5097f623d79
+DIST ipset-7.23.tar.bz2 695655 BLAKE2B a596630d12a8bcc1383475627e5e62b7be4c17570ae9d3650b9dbcac0ec46324e1ac7c0e7e11f674fb5354871538f6f15e57476ac752b1ac1415023d837904e6 SHA512 5a43c790abf157a55db5a9a22cb5f28a225f5c7969beda81566a2259aa82c9d852979eb805b11b4347f47c6a0c2cc4de6f14e4733bee5b562844422a45fb9dab
 EBUILD ipset-7.22-r2.ebuild 3567 BLAKE2B e3775ef8927c1bd96d30064e04c9302d4e3025cbd6b9c73af9b2f65956a198b2164b9c9903eb9f0bc49122c98df0c89de12e970610f3de88118da93fccc9cabf SHA512 11d975b834bf0b376396a88265b8f65c3fbbb442c02826292926a6e31e045eb7ff2bec4447e11deae76e55b75cf3424b227999bf6505465f89977f673ebda897
+EBUILD ipset-7.23.ebuild 3439 BLAKE2B 16b29300ee71dbd9971cd4b471f5dea73e8c8a9bec5213a9b98f728cfc0f134875b59d8da5512f27459c524ea3d84bd774220288c1a4e39070ffd3b5095c7ad1 SHA512 cc41fee6e8f08ba3160b19374eb166958b9e7ac785ac5761198397c7af97be7aedd82472b07752d2d711ba6fd485c56abf38d96f83b7822cd06144c23808142e
 MISC metadata.xml 475 BLAKE2B e1e06003a410249ed76d39b74ccbcd64b8572ff05f1c818729d787cecfb19cfa9c7e3463473688abc7a398efb908b0c7145bad88bbb7259e69f1b7d985584bcc SHA512 d0a3dca6593e8a62cbf5c325eb59b620137af8d8f5a463702c4d6ec102fd03b8adbbdcd9358777d0461f57a98d892d359d80b8f722d3f322f3d4766d762f6585
diff --git a/net-firewall/ipset/ipset-7.23.ebuild b/net-firewall/ipset/ipset-7.23.ebuild
new file mode 100644
index 000000000000..00688b5a1675
--- /dev/null
+++ b/net-firewall/ipset/ipset-7.23.ebuild
@@ -0,0 +1,116 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MODULES_OPTIONAL_IUSE=modules
+inherit autotools bash-completion-r1 linux-mod-r1 systemd
+
+DESCRIPTION="IPset tool for iptables, successor to ippool"
+HOMEPAGE="https://ipset.netfilter.org/ https://git.netfilter.org/ipset/"
+SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+RDEPEND="
+	net-firewall/iptables
+	net-libs/libmnl:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( ChangeLog INSTALL README UPGRADE )
+
+# configurable from outside, e.g. /etc/portage/make.conf
+IP_NF_SET_MAX=${IP_NF_SET_MAX:-256}
+
+PATCHES=( "${FILESDIR}/${PN}-bash-completion.patch")
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+pkg_setup() {
+	get_version
+	CONFIG_CHECK="NETFILTER"
+	ERROR_NETFILTER="ipset requires NETFILTER support in your kernel."
+	CONFIG_CHECK+=" NETFILTER_NETLINK"
+	ERROR_NETFILTER_NETLINK="ipset requires NETFILTER_NETLINK support in your kernel."
+	# It does still build without NET_NS, but it may be needed in future.
+	#CONFIG_CHECK="${CONFIG_CHECK} NET_NS"
+	#ERROR_NET_NS="ipset requires NET_NS (network namespace) support in your kernel."
+	CONFIG_CHECK+=" !PAX_CONSTIFY_PLUGIN"
+	ERROR_PAX_CONSTIFY_PLUGIN="ipset contains constified variables (#614896)"
+
+	build_modules=0
+	if use modules; then
+		if linux_config_src_exists && linux_chkconfig_builtin "MODULES" ; then
+			if linux_chkconfig_present "IP_NF_SET" || \
+				linux_chkconfig_present "IP_SET"; then #274577
+				eerror "There is IP{,_NF}_SET or NETFILTER_XT_SET support in your kernel."
+				eerror "Please either build ipset with modules USE flag disabled"
+				eerror "or rebuild kernel without IP_SET support and make sure"
+				eerror "there is NO kernel ip_set* modules in /lib/modules/<your_kernel>/... ."
+				die "USE=modules and in-kernel ipset support detected."
+			else
+				einfo "Modular kernel detected. Gonna build kernel modules..."
+				build_modules=1
+			fi
+		else
+			eerror "Nonmodular kernel detected, but USE=modules. Either build"
+			eerror "modular kernel (without IP_SET) or disable USE=modules"
+			die "Nonmodular kernel detected, will not build kernel modules"
+		fi
+	fi
+
+	[[ ${build_modules} -eq 1 ]] && linux-mod-r1_pkg_setup
+}
+
+src_configure() {
+	export bashcompdir="$(get_bashcompdir)"
+
+	econf \
+		--enable-bashcompl \
+		$(use_with modules kmod) \
+		--with-maxsets=${IP_NF_SET_MAX} \
+		--with-ksource="${KV_DIR}" \
+		--with-kbuild="${KV_OUT_DIR}"
+}
+
+src_compile() {
+	einfo "Building userspace"
+
+	local modlist=( xt_set=kernel/net/netfilter/ipset/:"${S}":kernel/net/netfilter/:
+					em_ipset=kernel/net/sched:"${S}":kernel/net/sched/:modules )
+
+	for i in ip_set{,_bitmap_{ip{,mac},port},_hash_{ip{,mac,mark,port{,ip,net}},mac,net{,port{,net},iface,net}},_list_set}; do
+		modlist+=( ${i}=kernel/net/netfilter/ipset/:"${S}":kernel/net/netfilter/ipset )
+	done
+
+	emake
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Building kernel modules"
+		linux-mod-r1_src_compile
+	fi
+}
+
+src_install() {
+	einfo "Installing userspace"
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+
+	newinitd "${FILESDIR}"/ipset.initd-r7 ${PN}
+	newconfd "${FILESDIR}"/ipset.confd-r1 ${PN}
+	systemd_newunit "${FILESDIR}"/ipset.systemd-r1 ${PN}.service
+	keepdir /var/lib/ipset
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Installing kernel modules"
+		linux-mod-r1_src_install
+	fi
+}
diff --git a/net-firewall/iptables/Manifest b/net-firewall/iptables/Manifest
index 377b82450c56..e20b2e233991 100644
--- a/net-firewall/iptables/Manifest
+++ b/net-firewall/iptables/Manifest
@@ -15,7 +15,7 @@ DIST iptables-1.8.9.tar.xz 637848 BLAKE2B 37ba80be0ee7049c4d3ee5689b273b4d2cc6e6
 EBUILD iptables-1.8.10-r1.ebuild 4561 BLAKE2B 14417d62fcd1e9102f543c664c81a834fae8392799e0a3cec107baa77f234228a0853fd48f6b06b5b79f5183eb4002c6e9445b7aa809cbb17ed618f5a9eb4f75 SHA512 437e1c541f0e959a80dd9e8938c82f2ccf23872cfefc84451a70ef75d74b7603a33a23be1a5c7ff31c0336bd613504c7249743d0d15e53022b2709e72cd1e545
 EBUILD iptables-1.8.10.ebuild 4658 BLAKE2B 878e6bc44f8bf6b2352217e225e1809f20e99ac62a872088b3ff6270610833ef24d6e7bb2a5d342899a33104071744b3895855c02b3fe0a7a24f0f041631c42f SHA512 bfc698898996b1154179d8f972c652b535e4454542923eb25a2c4503f4fc10bdfb2cc5bf702d5662c28881070474a8b61be0e899f3eef3d312cc1a2a7fca2970
 EBUILD iptables-1.8.11-r1.ebuild 4498 BLAKE2B edf49a7b82f243757d55caa174804f8fd52fe97681384403cf80bc51f0757b74abf38fe35eba8cf1b3fa4bfc5895f3c1f884229c9a0a06f13758de5448b88e04 SHA512 514cec581345cc67f96eabddf3a0b03bd2518ea93fb96586325455dd83cf6f3482a1976d85e4c0c17280f7fa1b5e026241cf36a2c32bd7449f12ec5322431b6a
-EBUILD iptables-1.8.11.ebuild 4492 BLAKE2B 8a206c4e3333d0818022178d0e4952f1554348fb9dcc277f7fd3892720cd60dd8ca845caf35cf51d0aa29ef1c66e34c96d6469cdbfaf13a4b4f9135a34562bce SHA512 37ecadaf8d6fe2be0c67933c4ec1b66ae7f33f56bcdae644e0c30144ce5b347a0edaf12b5839c5215cde6bfea3d839f5d744021a717784da852e6b8c0c860bf2
+EBUILD iptables-1.8.11.ebuild 4491 BLAKE2B 37b1cffbdc69302d95000d8642c52090432e284ca9735c973d574731b0b5cd3326f626803e293b46969599d1e272bc1751e81a472726228f8acd5243bb3ac8dd SHA512 9f6bf061845753febd80126716bda1604f78b4d8c8a73af4d05c68fc4b02da5a5a7896ba5767090bd73dc8f7b1153c81e6d69b90fc2308fa4a8ef8705140a77c
 EBUILD iptables-1.8.9-r2.ebuild 4675 BLAKE2B eabc6ee05e768d69c1957d00e83b57032332f6444b1be70e54b3ccfaa7a0c3aaac2ebdd4413ee1012838bee256994e29b9ca5ea384b736bd9501f4ccb6fc6542 SHA512 1da93698bd9d7bc057a763686e32c85cf3525bdbf23d1bb94f5aa0846501d571fa2e5571a3db0bd3667e1167930a088ba5d474be4ff8c85b10a937ecc07a6768
 EBUILD iptables-1.8.9.ebuild 4550 BLAKE2B cf8ab3600795d1c327ac593a6152111bc17a6914eb29ea76ae27fa03b8555c90f1c15e5acdfab56290e636ff7b6080430a2054d1c4a5e6e25669c234c7a54149 SHA512 1a15dd7c07704ed2c5b3b3a30633e8c97ff1618f1f6a3e2b962d7b41c2d2930cc9477075ea4254a6dc12208fb87f8663f3dae994176a858882df6635a201dbea
 MISC metadata.xml 1466 BLAKE2B 7378fedb44c6e6d19e508a764ec997911f966beccd40b1f93096ad3343b7cd72f9ca129e67a666c54ca4382348a448597bd607197ffe6b94669d84306c81d127 SHA512 f89038980e81bfceaf872ff1938c47e8ad12060bbe9ff48e0e9ca9dd5acc0196b2261d2b22a156cbfd7be89d1d67448969d39ff9b28efb0896702760afa14842
diff --git a/net-firewall/iptables/iptables-1.8.11.ebuild b/net-firewall/iptables/iptables-1.8.11.ebuild
index e5b61d8245f8..6bfee9b5102c 100644
--- a/net-firewall/iptables/iptables-1.8.11.ebuild
+++ b/net-firewall/iptables/iptables-1.8.11.ebuild
@@ -13,7 +13,7 @@ LICENSE="GPL-2"
 # Subslot reflects PV when libxtables and/or libip*tc was changed
 # the last time.
 SLOT="0/1.8.3"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="conntrack netlink nftables pcap static-libs test"
 RESTRICT="!test? ( test )"
 # TODO: skip tests needing nftables if no xtables-nft-multi (bug #890628)
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index bc7eb1841260..fb9ce68ddaef 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -15,6 +15,6 @@ DIST nftables-1.1.1.tar.xz 989700 BLAKE2B f273c78369ba755049c6afa63eba195cf29f92
 DIST nftables-1.1.1.tar.xz.sig 566 BLAKE2B b7debda3373972f69af9b4b23e1b66a8fd156440187aafba605bb7342c267207e5aa628256e96432ebd4583a6a9436e1969a33636111d2bd8d57185a01e2d502 SHA512 fc23034c512f686167203e827ff2a8f7cb64530211ce92a28793bd49577ce3bf519ffbe910b0071cb21925898497cb5cbf70121c68bfcdbfa4460c63a14203ac
 EBUILD nftables-1.0.9.ebuild 6472 BLAKE2B 28da5e49bdf6f55f3e5811d0563c8906e46c74dc8075bd9d88cb5558c6d2b41a9b3f6fe2cf310b8adbd2943ca2ee26e9fb96b516e14fdaf08a4c028ebb3546fc SHA512 46de8e2d2b0750185fdeefe4640d4df9233b7a9369a23f580bb4ab7681a830a7d7d13e2a7ebc9b10d1dfe11ba04b0d63a77e5902113543f45571205cc57b6254
 EBUILD nftables-1.1.0-r1.ebuild 6556 BLAKE2B 4289acbf5aa22a66a0591af82ac10d2e6173f678a77d52e28a9911d64b51554bb5096585b5adaf34f5faee9fd94f909fe60e29082ebdbc1bf25801d3543037f1 SHA512 3c0cf66264351f2bfa4efbcafebcfc1f229f8124539516af16d9b3a1f3c583e9ecc6ecf0bffb155a6cf76ab7ac3d28515c88baad3b37491e7d815738e8db5a71
-EBUILD nftables-1.1.1.ebuild 6476 BLAKE2B 173d869b61b140ba0ade63f200e950fff583e287246120a832249f044bd260e0a3148edd14dff921e0a08826ef58d019384338c11641ac57cf67f1f442aa7092 SHA512 a33cb3bea0972f6965f034da5ed817d1978690c5ddec0180cd182990379c34db135d06fa9adf98edf5898507dc02eb098948eea33abd8475d219d68b2e85edfd
+EBUILD nftables-1.1.1.ebuild 6475 BLAKE2B 512b0895a5e2c76137b3a70ff03f36e0360be25bdf4529b93f9006848e0035b23c7126e30fdab1e5080301317738e2158ab23150852c194c974eae08c84e4fea SHA512 ad1119727c4f90f9bbed9c82edfb4bbedd68e32430e4e82e814b8ed4e63bc80b62d0ac7f83b1380d5c73e114b4e4f5c18cba9dccc3349e036a5ad9ce4cd127ff
 EBUILD nftables-9999.ebuild 6482 BLAKE2B f803c2b3ea243bdd7365fccdb7f36dffe6246381b7743d656dcebfa6c5afbaca110c2dd110cea0437f7d5fcc9790da57df00f6b6021861a048672abab8f26c8a SHA512 265d6d5512b005e45f555a812557ac7ca48a2a9efb0095cd9aa37e90877bc6943a2e751efd9f82f1583b623bb4c05cbb04e93253c8f9804f8a14887d1eadffba
 MISC metadata.xml 684 BLAKE2B 96044107a07596178b59f3d4bed0433e06eb74693fafcc1a8c20468e02626814ba1544bba54c64367e43a126463b0f3b33e340476aff15db934467e8b9d46bf7 SHA512 fa4c9cadddccda4217837a892fbec3e1b984fb18a4d11d5536f22724d2455724eb59c5cc06da5830fb28bb48cb2d01374fdc56e216296c695c678af28390392a
diff --git a/net-firewall/nftables/nftables-1.1.1.ebuild b/net-firewall/nftables/nftables-1.1.1.ebuild
index bc24e4b07772..d6be7fe6a1e3 100644
--- a/net-firewall/nftables/nftables-1.1.1.ebuild
+++ b/net-firewall/nftables/nftables-1.1.1.ebuild
@@ -21,7 +21,7 @@ else
 		https://netfilter.org/projects/nftables/files/${P}.tar.xz
 		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
 	"
-	KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ~ppc64 ~riscv sparc x86"
+	KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv sparc x86"
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
 fi