6 files changed, 240 insertions, 229 deletions
diff --git a/net-firewall/Manifest.gz b/net-firewall/Manifest.gz
index 2b9a91fd305c..6259eadbd5c2 100644
--- a/net-firewall/Manifest.gz
+++ b/net-firewall/Manifest.gz
diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest
index 3bc14b137bcf..84cc3ce568c1 100644
--- a/net-firewall/firewalld/Manifest
+++ b/net-firewall/firewalld/Manifest
@@ -1,5 +1,8 @@
+AUX firewalld-2.2.1-systemd-service.patch 752 BLAKE2B 2e728ebda2372f755d3c2bddb6ffd9716c22b5a162f7f26b5a4ff2486ca40b56d1c1928c3f98d0d0d703c877a6060584eb431948006af80d98de0178de93f5ea SHA512 2a3c44af1922aad414ef58752c1b49ad02f3ad833716002e66a7d54af5f1ad74883e0c71ae7d7c44a8eab980b7afa423f8daeccb105f2b2ba859b12f4e0bbe09
 AUX firewalld-systemd-service.patch 769 BLAKE2B fbd8392b6f542413ae2896f8830faa0d0ccab11af3e41d427e3497b862ee7245b45a04c217aa84ea976b21661f2ce5311c7f1602d90c72bf9365fd815596bd9b SHA512 de85e40625581d55a476f9502d0172cfd45e01cd78e4b9afebc14a603e0a73deace625899a333f6fe37e55b1b0a606f515daf75b5460ebad63318042bba8541e
 AUX firewalld.init 250 BLAKE2B 1c0f690e24313037b801902aa772a9d1cb6889a05f142bc3d84602002ef053cd059b5193983f9fe6d89065a070a566a6a9ba8212a092435953ebed80ea7c7b40 SHA512 457cda01449f38563e98e1db937fe1c50745eab91797f52687e3ab9f5d94dd42d129740ae6669e99666a3f096d631dd3a44e66010b638b31b9c6ba798362403e
 DIST firewalld-2.1.1.tar.bz2 1315222 BLAKE2B 064abfae1f2f1c5a63bbbbbec3357aa6e63936818fa2020ca882d1b834736b3735a32b0ab318e6de78b6f785cb4da0ee4e299956c922d9dbf6e7bd442e9bb2d6 SHA512 383e5ea3d451a28241e5a76f8d0efeeb8319663bdc5f680b68c5156ddb5145fac766a9ee9521c4af27b1df82861ca6f68ee81c0588b1dd6c4f6d4e4f5ca8fee1
+DIST firewalld-2.2.1.tar.bz2 1295501 BLAKE2B fc7bb401895bc39c34ec585468bdcc1b3c3f8eeb35c786c0cf7d886f456c99840107db73e8f611a7d7ab1db1408c6dc349a3d5eee2fbd1e624fe06dd8a558d91 SHA512 08117be01a25a8e263cf419d7b01a98c80b53108af68f6cfc1d900692e6124c37b9dd6feaf4bc3c6e3f27958a9ee45b9795c7f5a9250eb644b6e903f97672c8a
 EBUILD firewalld-2.1.1-r5.ebuild 5356 BLAKE2B 3d2ca4ce68b4c40b081c30780af9c32df51c9f857315c2b11bfdef56d67e5708d9569e0405d689499248dee395a83583e4a758879e42f5207b955ba08956738c SHA512 80266f187abd46119dbe2edcbc7b6c7f85e92cb5547652610a23bca833121d73859bf98a0b4f1dbaec5d313eff9680f3efce6e52b139050d05d05b7f303c17b7
+EBUILD firewalld-2.2.1-r1.ebuild 4854 BLAKE2B 6259dffa729262aa8902b4654fa3ba6a557db1834da74dbba67b9ea126c7457755c4bcf5231e640c8cc5d44cd67db18b13d3c206cab3d384b5936353b74238eb SHA512 a5202f1ea58452318cb106d305608a921a851346060e9ab40f3f5201a243a553449b9d862e6769d4d7a9329d56507d18ab9aad3fc99d79617b0363b5f384ef20
 MISC metadata.xml 671 BLAKE2B 69c4bda7cc74a243aa1738bed90d16a3bc2c2085f6c0718becc7797a68da63035ef4d4f5e59c0583987d54032c163df6052d012fb7ca49026ca7259088793d33 SHA512 dd2d482251a4e33cb12ba324e1a21b4758f82de83c0cf83d5fa6259444c272360b47c5666e596103eba4703183fc9864a6bbb07a254aba67146b89d9870e9bbe
diff --git a/net-firewall/firewalld/files/firewalld-2.2.1-systemd-service.patch b/net-firewall/firewalld/files/firewalld-2.2.1-systemd-service.patch
new file mode 100644
index 000000000000..461dec825c94
--- /dev/null
+++ b/net-firewall/firewalld/files/firewalld-2.2.1-systemd-service.patch
@@ -0,0 +1,19 @@
+Drops the/an obsolete 'conflicts' line with old iptables services bug #833506
+Removes EnvironmentFile and FIREWALLD_ARGS variable
+===================================================================
+--- a/config/firewalld.service.in
++++ b/config/firewalld.service.in
+@@ -4,12 +4,10 @@
+ Wants=network-pre.target
+ After=dbus.service
+ After=polkit.service
+-Conflicts=iptables.service ip6tables.service ebtables.service ipset.service
+ Documentation=man:firewalld(1)
+
+ [Service]
+-EnvironmentFile=-/etc/sysconfig/firewalld
+-ExecStart=@sbindir@/firewalld --nofork --nopid $FIREWALLD_ARGS
++ExecStart=@sbindir@/firewalld --nofork --nopid
+ ExecReload=/bin/kill -HUP $MAINPID
+ # supress to log debug and error output also to /var/log/messages
+ StandardOutput=null
diff --git a/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild b/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild
new file mode 100644
index 000000000000..f017a3287621
--- /dev/null
+++ b/net-firewall/firewalld/firewalld-2.2.1-r1.ebuild
@@ -0,0 +1,218 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit bash-completion-r1 gnome2-utils linux-info optfeature
+inherit plocale python-single-r1 systemd xdg-utils
+
+DESCRIPTION="Firewall daemon with D-Bus interface providing a dynamic firewall"
+HOMEPAGE="https://firewalld.org/"
+SRC_URI="https://github.com/firewalld/firewalld/releases/download/v${PV}/${P}.tar.bz2"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv"
+IUSE="gui selinux test"
+# Tests are too unreliable in sandbox environment
+RESTRICT="!test? ( test ) test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	|| ( >=sys-apps/openrc-0.11.5 sys-apps/openrc-navi sys-apps/systemd )
+	$(python_gen_cond_dep '
+		dev-python/dbus-python[${PYTHON_USEDEP}]
+		dev-python/pygobject:3[${PYTHON_USEDEP}]
+		>=net-firewall/nftables-0.9.4[python,json,${PYTHON_USEDEP}]
+		gui? (
+			x11-libs/gtk+:3
+			dev-python/PyQt6[gui,widgets,${PYTHON_USEDEP}]
+		)
+	')
+	net-firewall/nftables[xtables(+)]
+	selinux? ( sec-policy/selinux-firewalld )
+"
+DEPEND="
+	${RDEPEND}
+	dev-libs/glib:2
+"
+BDEPEND="
+	app-text/docbook-xml-dtd
+	>=dev-util/intltool-0.35
+	sys-devel/gettext
+"
+
+# Testsuite's Makefile.am calls missing(!)
+# ... but this seems to be consistent with the autoconf docs?
+# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html
+QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
+
+PLOCALES="ar as ast bg bn_IN ca cs da de el en_GB en_US es et eu fa fi fr gl gu hi hr hu ia id it ja ka kn ko lt ml mr nl or pa pl pt pt_BR ro ru si sk sl sq sr sr@latin sv ta te tr uk zh_CN zh_TW"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.2.1-systemd-service.patch
+)
+
+pkg_setup() {
+	# See bug #830132 for the huge list
+	# We can probably narrow it down a bit but it's rather fragile
+	local CONFIG_CHECK="
+		~NF_CONNTRACK ~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER
+		~NETFILTER_ADVANCED
+		~NETFILTER_INGRESS
+		~NF_NAT_MASQUERADE
+		~NF_NAT_REDIRECT
+		~NF_TABLES_INET
+		~NF_TABLES_IPV4
+		~NF_TABLES_IPV6
+		~NF_CONNTRACK
+		~NF_CONNTRACK_BROADCAST
+		~NF_CONNTRACK_NETBIOS_NS
+		~NF_CONNTRACK_TFTP
+		~NF_CT_NETLINK
+		~NF_CT_NETLINK_HELPER
+		~NF_DEFRAG_IPV4
+		~NF_DEFRAG_IPV6
+		~NF_NAT
+		~NF_NAT_TFTP
+		~NF_REJECT_IPV4
+		~NF_REJECT_IPV6
+		~NF_SOCKET_IPV4
+		~NF_SOCKET_IPV6
+		~NF_TABLES
+		~NF_TPROXY_IPV4
+		~NF_TPROXY_IPV6
+		~IP_NF_FILTER
+		~IP_NF_IPTABLES
+		~IP_NF_MANGLE
+		~IP_NF_NAT
+		~IP_NF_RAW
+		~IP_NF_SECURITY
+		~IP_NF_TARGET_MASQUERADE
+		~IP_NF_TARGET_REJECT
+		~IP6_NF_FILTER
+		~IP6_NF_IPTABLES
+		~IP6_NF_MANGLE
+		~IP6_NF_NAT
+		~IP6_NF_RAW
+		~IP6_NF_SECURITY
+		~IP6_NF_TARGET_MASQUERADE
+		~IP6_NF_TARGET_REJECT
+		~IP_SET
+		~NETFILTER_CONNCOUNT
+		~NETFILTER_NETLINK
+		~NETFILTER_NETLINK_OSF
+		~NETFILTER_NETLINK_QUEUE
+		~NETFILTER_SYNPROXY
+		~NETFILTER_XTABLES
+		~NETFILTER_XT_CONNMARK
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_MULTIPORT
+		~NETFILTER_XT_MATCH_STATE
+		~NETFILTER_XT_NAT
+		~NETFILTER_XT_TARGET_MASQUERADE
+		~NFT_COMPAT
+		~NFT_CT
+		~NFT_FIB
+		~NFT_FIB_INET
+		~NFT_FIB_IPV4
+		~NFT_FIB_IPV6
+		~NFT_HASH
+		~NFT_LIMIT
+		~NFT_LOG
+		~NFT_MASQ
+		~NFT_NAT
+		~NFT_QUEUE
+		~NFT_QUOTA
+		~NFT_REDIR
+		~NFT_REJECT
+		~NFT_REJECT_INET
+		~NFT_REJECT_IPV4
+		~NFT_REJECT_IPV6
+		~NFT_SOCKET
+		~NFT_SYNPROXY
+		~NFT_TPROXY
+		~NFT_TUNNEL
+		~NFT_XFRM
+	"
+
+	# kernel >= 4.19 has a unified NF_CONNTRACK module, bug #692944
+	if kernel_is -lt 4 19; then
+		CONFIG_CHECK+=" ~NF_CONNTRACK_IPV4 ~NF_CONNTRACK_IPV6"
+	fi
+
+	# bug #831259
+	if kernel_is -le 5 4 ; then
+		CONFIG_CHECK+=" ~NF_TABLES_SET"
+	fi
+
+	# bug #853055
+	if kernel_is -lt 5 18 ; then
+		CONFIG_CHECK+=" ~NFT_COUNTER"
+	fi
+
+	# bug #926685
+	if kernel_is -le 6 1 ; then
+		CONFIG_CHECK+=" ~NFT_OBJREF"
+	fi
+
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	plocale_find_changes "po" "" ".po" || die
+	plocale_get_locales | sed -e 's/ /\n/g' > po/LINGUAS
+}
+
+src_configure() {
+	python_setup
+
+	local myeconfargs=(
+		--enable-systemd
+		--with-systemd-unitdir="$(systemd_get_systemunitdir)"
+		--with-bashcompletiondir="$(get_bashcompdir)"
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+	python_optimize
+
+	# Get rid of junk
+	rm -rf "${ED}"/etc/sysconfig/ || die
+
+	# For non-gui installs we need to remove GUI bits
+	if ! use gui; then
+		rm -rf "${ED}"/etc/xdg/autostart || die
+		rm -f "${ED}"/usr/bin/firewall-applet || die
+		rm -f "${ED}"/usr/bin/firewall-config || die
+		rm -rf "${ED}"/usr/share/applications || die
+		rm -rf "${ED}"/usr/share/icons || die
+	fi
+
+	newinitd "${FILESDIR}"/firewalld.init firewalld
+}
+
+pkg_preinst() {
+	gnome2_schemas_savelist
+}
+
+pkg_postinst() {
+	xdg_icon_cache_update
+	gnome2_schemas_update
+
+	# bug #833569
+	optfeature "changing zones with NetworkManager" gnome-extra/nm-applet
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	gnome2_schemas_update
+}
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index 21e79f6d64ea..c669a7a94571 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -13,6 +13,5 @@ DIST nftables-1.1.0.tar.xz 1057672 BLAKE2B cc876d9ba344480a2f5a12811206356d9edbd
 DIST nftables-1.1.0.tar.xz.sig 566 BLAKE2B 556287b40ad6f82d229ae18910ec2008c3168c7088e7149f8b5e80ca9983b90ec202cf01838c80e973845dd565f4f13a454d6dc99030a3f9cede6c33929da07d SHA512 1b3a42a76b378373c8a21b77aaf9c1fc57402360d49d56b22f02c50bef969b1f6867a4d40bda24b2dd1a0dfcf7148893938a7eea84ff8cc67d9edcd6b9b62bb4
 EBUILD nftables-1.0.9.ebuild 6478 BLAKE2B 67415f3877ba9d24eb995bb97f4bd93520d9fc70d7fde48b743779879886aad83d4cb3b5bcebbb3b63d27038d2e556c99b01979e539db1054058759b3830a663 SHA512 cd4ee3af488cc918cead56406f54a5b74dc54e3aabab3e63e7b704922add8cb652d509ea87b6c3227455bf0805b12fb328a94992062cc09c3ed9710be4bc7b85
 EBUILD nftables-1.1.0-r1.ebuild 6570 BLAKE2B a4fb963a29cfedf3a596377479ad8419b3609ada67362d499ab0a0ff7150a2effa9c23f662c199d808c878256b89b3d5526b8f3fe7ccf1950ba39383ebbb6435 SHA512 5ecd1232140316d7b9b9fe07c2ab44e702c099f11b62f7a5c21f12a253bdbddacd52d8a1d4573d5917eb4bde470c35c4841bd5f1032a0eb9d47c009a01f1efd6
-EBUILD nftables-1.1.0.ebuild 6488 BLAKE2B eb5ca8ea1b6bd0ef187bc45aed113b0e24e691d958cd08c32b5f67bdbd2b22b25fbc438f77f5c54cd1e87cdda5b89e48a2d86dc58d04520920bcca09bb0ad0f6 SHA512 47848d0eb477c62ecc3250aa0bc2cfc20b4ec5226e377e3f533ee2e4c79189e2beb41ef77d424a8258bab8b1401cadff837fc327fa20eaa9faad00b2c9d34e05
 EBUILD nftables-9999.ebuild 6488 BLAKE2B eb5ca8ea1b6bd0ef187bc45aed113b0e24e691d958cd08c32b5f67bdbd2b22b25fbc438f77f5c54cd1e87cdda5b89e48a2d86dc58d04520920bcca09bb0ad0f6 SHA512 47848d0eb477c62ecc3250aa0bc2cfc20b4ec5226e377e3f533ee2e4c79189e2beb41ef77d424a8258bab8b1401cadff837fc327fa20eaa9faad00b2c9d34e05
 MISC metadata.xml 684 BLAKE2B 96044107a07596178b59f3d4bed0433e06eb74693fafcc1a8c20468e02626814ba1544bba54c64367e43a126463b0f3b33e340476aff15db934467e8b9d46bf7 SHA512 fa4c9cadddccda4217837a892fbec3e1b984fb18a4d11d5536f22724d2455724eb59c5cc06da5830fb28bb48cb2d01374fdc56e216296c695c678af28390392a
diff --git a/net-firewall/nftables/nftables-1.1.0.ebuild b/net-firewall/nftables/nftables-1.1.0.ebuild
deleted file mode 100644
index 60c4f92e0ca9..000000000000
--- a/net-firewall/nftables/nftables-1.1.0.ebuild
+++ /dev/null
@@ -1,228 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_OPTIONAL=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/netfilter.org.asc
-inherit edo linux-info distutils-r1 systemd verify-sig
-
-DESCRIPTION="Linux kernel firewall, NAT and packet mangling tools"
-HOMEPAGE="https://netfilter.org/projects/nftables/"
-
-if [[ ${PV} =~ ^[9]{4,}$ ]]; then
-	inherit autotools git-r3
-	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
-	BDEPEND="app-alternatives/yacc"
-else
-	SRC_URI="
-		https://netfilter.org/projects/nftables/files/${P}.tar.xz
-		verify-sig? ( https://netfilter.org/projects/nftables/files/${P}.tar.xz.sig )
-	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
-	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
-fi
-
-# See COPYING: new code is GPL-2+, existing code is GPL-2
-LICENSE="GPL-2 GPL-2+"
-SLOT="0/1"
-IUSE="debug doc +gmp json libedit python +readline static-libs test xtables"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=net-libs/libmnl-1.0.4:=
-	>=net-libs/libnftnl-1.2.7:=
-	gmp? ( dev-libs/gmp:= )
-	json? ( dev-libs/jansson:= )
-	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )
-	xtables? ( >=net-firewall/iptables-1.6.1:= )
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	app-alternatives/lex
-	virtual/pkgconfig
-	doc? (
-		app-text/asciidoc
-		>=app-text/docbook2X-0.8.8-r4
-	)
-	python? ( ${DISTUTILS_DEPS} )
-"
-
-REQUIRED_USE="
-	python? ( ${PYTHON_REQUIRED_USE} )
-	libedit? ( !readline )
-"
-
-src_prepare() {
-	default
-
-	if [[ ${PV} =~ ^[9]{4,}$ ]] ; then
-		eautoreconf
-	fi
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_prepare
-		popd >/dev/null || die
-	fi
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sbindir="${EPREFIX}"/sbin
-		$(use_enable debug)
-		$(use_enable doc man-doc)
-		$(use_with !gmp mini_gmp)
-		$(use_with json)
-		$(use_with libedit cli editline)
-		$(use_with readline cli readline)
-		$(use_enable static-libs static)
-		$(use_with xtables)
-	)
-
-	econf "${myeconfargs[@]}"
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_configure
-		popd >/dev/null || die
-	fi
-}
-
-src_compile() {
-	default
-
-	if use python; then
-		pushd py >/dev/null || die
-		distutils-r1_src_compile
-		popd >/dev/null || die
-	fi
-}
-
-src_test() {
-	emake check
-
-	if [[ ${EUID} == 0 ]]; then
-		edo tests/shell/run-tests.sh -v
-	else
-		ewarn "Skipping shell tests (requires root)"
-	fi
-
-	if use python; then
-		pushd tests/py >/dev/null || die
-		distutils-r1_src_test
-		popd >/dev/null || die
-	fi
-}
-
-python_test() {
-	if [[ ${EUID} == 0 ]]; then
-		edo "${EPYTHON}" nft-test.py
-	else
-		ewarn "Skipping Python tests (requires root)"
-	fi
-}
-
-src_install() {
-	default
-
-	if ! use doc && [[ ! ${PV} =~ ^[9]{4,}$ ]]; then
-		pushd doc >/dev/null || die
-		doman *.?
-		popd >/dev/null || die
-	fi
-
-	# Do it here instead of in src_prepare to avoid eautoreconf
-	# rmdir lets us catch if more files end up installed in /etc/nftables
-	dodir /usr/share/doc/${PF}/skels/
-	mv "${ED}"/etc/nftables/osf "${ED}"/usr/share/doc/${PF}/skels/osf || die
-	rmdir "${ED}"/etc/nftables || die
-
-	exeinto /usr/libexec/${PN}
-	newexe "${FILESDIR}"/libexec/${PN}-mk.sh ${PN}.sh
-	newconfd "${FILESDIR}"/${PN}-mk.confd ${PN}
-	newinitd "${FILESDIR}"/${PN}-mk.init-r1 ${PN}
-	keepdir /var/lib/nftables
-
-	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
-
-	if use python ; then
-		pushd py >/dev/null || die
-		distutils-r1_src_install
-		popd >/dev/null || die
-	fi
-
-	find "${ED}" -type f -name "*.la" -delete || die
-}
-
-pkg_preinst() {
-	local stderr
-
-	# There's a history of regressions with nftables upgrades. Perform a
-	# safety check to help us spot them earlier. For the check to pass, the
-	# currently loaded ruleset, if any, must be successfully evaluated by
-	# the newly built instance of nft(8).
-	if [[ -n ${ROOT} ]] || [[ ! -d /sys/module/nftables ]] || [[ ! -x /sbin/nft ]]; then
-		# Either nftables isn't yet in use or nft(8) cannot be executed.
-		return
-	elif ! stderr=$(umask 177; /sbin/nft -t list ruleset 2>&1 >"${T}"/ruleset.nft); then
-		# Report errors induced by trying to list the ruleset but don't
-		# treat them as being fatal.
-		printf '%s\n' "${stderr}" >&2
-	elif [[ ${stderr} == *"is managed by iptables-nft"* ]]; then
-		# Rulesets generated by iptables-nft are special in nature and
-		# will not always be printed in a way that constitutes a valid
-		# syntax for ntf(8). Ignore them.
-		return
-	elif set -- "${ED}"/usr/lib*/libnftables.so;
-		! LD_LIBRARY_PATH=${1%/*} "${ED}"/sbin/nft -c -f -- "${T}"/ruleset.nft
-	then
-		eerror "Your currently loaded ruleset cannot be parsed by the newly built instance of"
-		eerror "nft. This probably means that there is a regression introduced by v${PV}."
-		eerror "(To make the ebuild fail instead of warning, set NFTABLES_ABORT_ON_RELOAD_FAILURE=1.)"
-		if [[ -n ${NFTABLES_ABORT_ON_RELOAD_FAILURE} ]] ; then
-			die "Aborting because of failed nft reload!"
-		fi
-	fi
-}
-
-pkg_postinst() {
-	local save_file
-	save_file="${EROOT}"/var/lib/nftables/rules-save
-
-	# In order for the nftables-restore systemd service to start
-	# the save_file must exist.
-	if [[ ! -f "${save_file}" ]]; then
-		( umask 177; touch "${save_file}" )
-	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
-		ewarn "Your system has dangerous permissions for ${save_file}"
-		ewarn "It is probably affected by bug #691326."
-		ewarn "You may need to fix the permissions of the file. To do so,"
-		ewarn "you can run the command in the line below as root."
-		ewarn "    'chmod 600 \"${save_file}\"'"
-	fi
-
-	if has_version 'sys-apps/systemd'; then
-		elog "If you wish to enable the firewall rules on boot (on systemd) you"
-		elog "will need to enable the nftables-restore service."
-		elog "    'systemctl enable ${PN}-restore.service'"
-		elog
-		elog "If you are creating firewall rules before the next system restart"
-		elog "the nftables-restore service must be manually started in order to"
-		elog "save those rules on shutdown."
-	fi
-
-	if has_version 'sys-apps/openrc'; then
-		elog "If you wish to enable the firewall rules on boot (on openrc) you"
-		elog "will need to enable the nftables service."
-		elog "    'rc-update add ${PN} default'"
-		elog
-		elog "If you are creating or updating the firewall rules and wish to save"
-		elog "them to be loaded on the next restart, use the \"save\" functionality"
-		elog "in the init script."
-		elog "    'rc-service ${PN} save'"
-	fi
-}