11 files changed, 305 insertions, 8 deletions
diff --git a/net-firewall/Manifest.gz b/net-firewall/Manifest.gz
index a88db7532e14..400676e8e744 100644
--- a/net-firewall/Manifest.gz
+++ b/net-firewall/Manifest.gz
diff --git a/net-firewall/ebtables/Manifest b/net-firewall/ebtables/Manifest
index 54f899de61b0..f6fa9d4c3841 100644
--- a/net-firewall/ebtables/Manifest
+++ b/net-firewall/ebtables/Manifest
@@ -4,5 +4,5 @@ AUX ebtables-2.0.11-remove-stray-atsign.patch 1120 BLAKE2B 14bac4aec87d44e5ca166
 AUX ebtables.confd-r1 685 BLAKE2B 647eeb26f9c046341c79d450fa5771480cbd9047b063b2e6c32aedeaa669f8c6f73dd317731eac86bfb85f352aec23969af505a461e7f307cf6538cb9c6b21ff SHA512 5bb7ac7aa1a723a7b71f26fbc0337f3cb5b4efd700b95695ab47ac7edc9de7ab0190591d0f56db8e461be93a79cb3ce534335c8ce13a6a6773ff5229c0959033
 AUX ebtables.initd-r1 2020 BLAKE2B f73f5904690c5c6344f0668c8327de5605b41ca5a699b3076f3b30545bbea19ff125c5c21d18a73e3bb2cc2986fbf74e7cad5757ced38887551ff59f2ca81dda SHA512 8d4c56102a2a4771e7a0d3a62ddbc4c82eba640ea6d5cba2e55ae2c2d7d0fe2621bcb81a4fa6aebdd1674ac55bb88beb964a89b521d8e684fc02f4b9da555823
 DIST ebtables-2.0.11.tar.gz 428411 BLAKE2B 62af4c38ad21498e43f41ef96c8abb5704e8d8a48f1327c587b664f36fdfa9849a9a37e59958db56d38019465d8bf1775914f7387fde99a441615913702cf504 SHA512 43a04c6174c8028c501591ef260526297e0f018016f226e2a3bcf80766fddf53d4605c347554d6da7c4ab5e2131584a18da20916ffddcbf2d26ac93b00c5777f
-EBUILD ebtables-2.0.11-r3.ebuild 2489 BLAKE2B 4bd44c75c25656490bc712ab87b1d50a3fba6a2ec0848186420a72ab230f13e30a20b46e4bfb163795b5bce961b30df0bc750f5670356d78ea0774ab7924163d SHA512 79b4b348affc14cc186a8d650b7c3db72a88d214a8d39db690b26200f1db04037901f22ae72d3b48803b499e70cf02d074c19625725fb349f8bb3005d86e0686
+EBUILD ebtables-2.0.11-r3.ebuild 2496 BLAKE2B cc0506e84dc9a6e6168b59f01f204537649736465b9792a7bbff814e3726b3d7c274e1e1bbfe20f2976b62f1132c362a7425b4a61fd8a1d98e436ce7983d951c SHA512 eff2e063c1489c0ecff02712724853a626eb40035aa9ba86397a22a09e987e7e6a3366541580b5852e01f264d090e6ba4e29f6a574b59d55171d27f428799560
 MISC metadata.xml 488 BLAKE2B 683d7552083e64daf3e41f9c1e7c53033ac4059a1f3ae248e666001424725f21efb1ec0d35c28492ac80c19998692c00e795818501b0c9f0df1037175b8bda93 SHA512 88d08269d25c3f4a22d89b5774e21c4af048c2e39beba41514780d3dac72494cb39e993becd49b0a73cb9c2d0b2e7e46c7bbe1b3a40fe6d7094431a9fb384f35
diff --git a/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild b/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild
index c8736d46935f..3701ea171e82 100644
--- a/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild
+++ b/net-firewall/ebtables/ebtables-2.0.11-r3.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 ~riscv x86"
 IUSE="+perl static"
 
 BDEPEND=">=app-eselect/eselect-iptables-20200508"
diff --git a/net-firewall/firewalld/Manifest b/net-firewall/firewalld/Manifest
index 6b3a541f433e..fa344d2dfe53 100644
--- a/net-firewall/firewalld/Manifest
+++ b/net-firewall/firewalld/Manifest
@@ -6,5 +6,5 @@ DIST firewalld-0.9.3.tar.gz 1309371 BLAKE2B 78a86f9c14ed8cc2497f3b79e4be627a28dc
 EBUILD firewalld-0.7.1-r3.ebuild 3220 BLAKE2B 3bc079c30540420da1f62aac363837eff13187c4b727dd47ee7f8512bb31ccfd2198a28226ef89abfdb6aa4aacecd75d618edeaa38836f6146034d77f007dc7b SHA512 77a9cf6d7ffade8bd151bdfa85d51c6962174faf63a5dbd5bc7bf1f610273a4044996ff93814845dbac9998d004973fcaa91fa9bbb38b21dcd5092aaa456cc2c
 EBUILD firewalld-0.7.3-r1.ebuild 3223 BLAKE2B 2409755e06f8b5def3fadc59f90bea9e9b9af57de0abd4ccbe5c65729b38c5f864f5d79e113b9289d553cd6f4f79fde47423c5acf1ab86542a4f51a9dcd52826 SHA512 99ac981b9d029ee17482d8299bd67005eab980ab41193d1cecf39c3fe17f9a73024ede67390ba86fbea631be82a7802772329e16d16a0c58394b2ace0fedb99b
 EBUILD firewalld-0.9.1-r1.ebuild 3165 BLAKE2B ee5f4f02f1dd911bd55b7f001ae416657cdb873205e916f7c5e16941699831f91918360ced1712d41153e7342f57a4f3f0362ed99e4ee4a5d07907b3da3b6cb1 SHA512 676409b0d329f4c9d5549819059141cad6fb99861bca58351e27ff5e44ac9d69b85d1ddba953658be319db7f5fdc43e8fbda7f2b093cfc21645ada32f095e10a
-EBUILD firewalld-0.9.3-r1.ebuild 3168 BLAKE2B fe0bdce016a97fb2cbde02072a5ff1ea8e956b2cac1822aeed355d3879704ef41e22463c62e0a27b9b08860b7cfcd3887d6e582cab1637ecf6a7504dcb62e329 SHA512 22b3f035114456c27be23534b785673d83e0b6d76577e9c29a3f24e8d240d0609ddd47de0e59cb8d83bb1c0cefb9d8e63ecf5142f1f09d25d715888ca366ee52
+EBUILD firewalld-0.9.3-r1.ebuild 3175 BLAKE2B 1dd8c9aeb2d1085fdc823a5f5e44c6353f27e8a3584609290fff6a65a1f68961e1ceebeebf03f1e4bc70849f9f0245708f59f62379191201346b034338a2a84d SHA512 db6145418127778121313844a05c5ec772b8963fe3153e6efa5eecc3b8f67a91f2fabd0bbc88e66df2d89dd2ba53e46e1ae78e6ff2885c0cb7b78e4826b73936
 MISC metadata.xml 486 BLAKE2B 0d1b9c530a7b7ac43414cda002e07cbc9b897164be53d9183dc50ba78bc8d29a40bfc364444f4253f903ac1698a459e6f7ca68431a22905a6f5aed02ca41bb61 SHA512 d4b20ffb819399bfc60760ec90bfaf60ffbe666a1c0b2117a8eae42db2f85c1f5274c8dee28fbfa7b66bea1d9720ad1dd8acb425c43eb71cf0c9b2557a1471a0
diff --git a/net-firewall/firewalld/firewalld-0.9.3-r1.ebuild b/net-firewall/firewalld/firewalld-0.9.3-r1.ebuild
index 527e4ba823e5..59c6dff62994 100644
--- a/net-firewall/firewalld/firewalld-0.9.3-r1.ebuild
+++ b/net-firewall/firewalld/firewalld-0.9.3-r1.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
 IUSE="gui +nftables +iptables"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
diff --git a/net-firewall/ipset/Manifest b/net-firewall/ipset/Manifest
index 4ec038865088..a942d83cfd10 100644
--- a/net-firewall/ipset/Manifest
+++ b/net-firewall/ipset/Manifest
@@ -3,5 +3,7 @@ AUX ipset.confd 588 BLAKE2B fb1b728c12953cb6d5009469eaeeb9e58e01dd76b6849ad554d5
 AUX ipset.initd-r4 2997 BLAKE2B 9c376e1a5083829a1fc40bfcca192cad19644c8ba585c29018a55837c0788127963071de2a94a251288ee19a7308ba4d7d80f48f3bc1aba497489872f9810479 SHA512 0e674308ae51b5d65e8aba913ffece7e9233ff69b15086d5f35cd8b4e23e6ee08d6c233ed21b647a033039a9e268ee2cb01718ac9ebb548734c5996a8acb3961
 AUX ipset.systemd 476 BLAKE2B 6d536142066ab60fdec24bcb138976709f186c575a7958ad9e8f0762c5b473de6882dcbdb7fbe16c79840096806fb8472308647aaa5b26dec192f91f4a541174 SHA512 c537c8c1bacbf9f3eeedfa123b666ac4f3d71cca9e44e89c9dc0f95328e1ec6be9480927272bd69d06a59f1d22bf4dc117c092d187d950c3f72e31608ab27a08
 DIST ipset-7.11.tar.bz2 674100 BLAKE2B 97f2e3372e963654ece511960e8c22d0dd9e29376d087a3767d89544dfbd85f9f9e75e0cc6c4eb9e1d813d1a472a410033a76feef3319b1d87fd51b0c3fd97cd SHA512 20890de32c17c04d9d3ae42fff64acfe21a252974bee5843ae39bdda707fcef55fde11cffccab9f987bf7e18f5445443c46c50eb854fb6f93f172f7bad07f922
-EBUILD ipset-7.11-r1.ebuild 3443 BLAKE2B b8021b1761afe2a25954902d26a47a42590c95375b937164b7493a9af3a0f8eace7df7c1dd5aa1921e72f6ba780373b73f87363066811a29e0d1763d67491db5 SHA512 4ce2cb5d34cff34618740ba8c2c9d89068cf9c04511d90265fa73833b05bc7d1f07f737d6679b72f770b1165147fbb930748a160d4247053af6501c9da27ef53
+DIST ipset-7.15.tar.bz2 680383 BLAKE2B 10acff9741370ad80a2845605be1be4f691e987b271f4dcf1fab3abfe158c63c7d39e6b3453ba7cd361dee3df92f85419cfb70806a71b6806555f6571c70b1ed SHA512 0fc936d971c30a0925c585d506c8840e782fdaeec09bc8fd249e874fe838fa55a4dbb697f6e1423a6769abf07a1ce2195abc37cb641e8e4ad70f1b4c7130916a
+EBUILD ipset-7.11-r1.ebuild 3450 BLAKE2B 214cade04c6b499a7e0043df1eec4cd475b9247b21fa1bc218503082a5265d54d93f6a388281ac7360c48de65581dd3517e49aea7022557535ff42590695795f SHA512 a8ec2d9ca9b17ba666641c6e9539714bb836e043363a5a8e0a913314b476aca59eb4fb9efd6febcc8c13bbe35962ea14bdddc510a2055d980a347e43271c6439
+EBUILD ipset-7.15.ebuild 3454 BLAKE2B a14d731bb83f6b6b8a4353e67bfab3c71221727b2b435af4a29c872a148c80ba03f3e1aac3eda3ccf5ef5f66c7e308f23fd2c0df825eb3936cceaf47f8a80d71 SHA512 dc8192083e5a59f2b12d46b1d66675db151a62d41a7255aa6414ecc1cfa50eeb0b7e6eecf42301e775263f6781d8177e829145882c1f901f95a7548d7b69fa1d
 MISC metadata.xml 368 BLAKE2B fd3ff78ab724fc8cb35326703b2605e894cdfacc3d306659ba128765aa7c88fc5fe397492caf3b7e11c6aadbc750c7bd7d578c4a47e4bcce05da708887863e52 SHA512 5ab08e27c87cd00f4ed9c9f7268692b20947554bf778579f138de82356eb9ee531a1e4da3ac65c25cdadc8ad9ccc2cb24397ce4842e7a559f1d5f77947481f63
diff --git a/net-firewall/ipset/ipset-7.11-r1.ebuild b/net-firewall/ipset/ipset-7.11-r1.ebuild
index c7dfc5a9b0cc..cbee799db563 100644
--- a/net-firewall/ipset/ipset-7.11-r1.ebuild
+++ b/net-firewall/ipset/ipset-7.11-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 x86"
+KEYWORDS="amd64 ~arm arm64 ppc ~ppc64 ~riscv x86"
 
 BDEPEND="virtual/pkgconfig"
 
diff --git a/net-firewall/ipset/ipset-7.15.ebuild b/net-firewall/ipset/ipset-7.15.ebuild
new file mode 100644
index 000000000000..b37a716c1821
--- /dev/null
+++ b/net-firewall/ipset/ipset-7.15.ebuild
@@ -0,0 +1,114 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+MODULES_OPTIONAL_USE=modules
+inherit autotools linux-info linux-mod systemd
+
+DESCRIPTION="IPset tool for iptables, successor to ippool"
+HOMEPAGE="https://ipset.netfilter.org/"
+SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+
+BDEPEND="virtual/pkgconfig"
+
+RDEPEND=">=net-firewall/iptables-1.4.7
+	net-libs/libmnl:="
+DEPEND="${RDEPEND}"
+
+DOCS=( ChangeLog INSTALL README UPGRADE )
+
+PATCHES=( "${FILESDIR}"/${PN}-7.4-fix-pkgconfig-dir.patch )
+
+# configurable from outside, e.g. /etc/portage/make.conf
+IP_NF_SET_MAX=${IP_NF_SET_MAX:-256}
+
+BUILD_TARGETS="modules"
+MODULE_NAMES_ARG="kernel/net/netfilter/ipset/:${S}/kernel/net/netfilter/ipset"
+MODULE_NAMES="xt_set(kernel/net/netfilter/ipset/:${S}/kernel/net/netfilter/)"
+MODULE_NAMES+=" em_ipset(kernel/net/sched/:${S}/kernel/net/sched/)"
+for i in ip_set{,_bitmap_{ip{,mac},port},_hash_{ip{,mac,mark,port{,ip,net}},mac,net{,port{,net},iface,net}},_list_set}; do
+	MODULE_NAMES+=" ${i}(${MODULE_NAMES_ARG})"
+done
+
+pkg_setup() {
+	get_version
+	CONFIG_CHECK="NETFILTER"
+	ERROR_NETFILTER="ipset requires NETFILTER support in your kernel."
+	CONFIG_CHECK+=" NETFILTER_NETLINK"
+	ERROR_NETFILTER_NETLINK="ipset requires NETFILTER_NETLINK support in your kernel."
+	# It does still build without NET_NS, but it may be needed in future.
+	#CONFIG_CHECK="${CONFIG_CHECK} NET_NS"
+	#ERROR_NET_NS="ipset requires NET_NS (network namespace) support in your kernel."
+	CONFIG_CHECK+=" !PAX_CONSTIFY_PLUGIN"
+	ERROR_PAX_CONSTIFY_PLUGIN="ipset contains constified variables (#614896)"
+
+	build_modules=0
+	if use modules; then
+		if linux_config_src_exists && linux_chkconfig_builtin "MODULES" ; then
+			if linux_chkconfig_present "IP_NF_SET" || \
+				linux_chkconfig_present "IP_SET"; then #274577
+				eerror "There is IP{,_NF}_SET or NETFILTER_XT_SET support in your kernel."
+				eerror "Please either build ipset with modules USE flag disabled"
+				eerror "or rebuild kernel without IP_SET support and make sure"
+				eerror "there is NO kernel ip_set* modules in /lib/modules/<your_kernel>/... ."
+				die "USE=modules and in-kernel ipset support detected."
+			else
+				einfo "Modular kernel detected. Gonna build kernel modules..."
+				build_modules=1
+			fi
+		else
+			eerror "Nonmodular kernel detected, but USE=modules. Either build"
+			eerror "modular kernel (without IP_SET) or disable USE=modules"
+			die "Nonmodular kernel detected, will not build kernel modules"
+		fi
+	fi
+	[[ ${build_modules} -eq 1 ]] && linux-mod_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_with modules kmod) \
+		--disable-static \
+		--with-maxsets=${IP_NF_SET_MAX} \
+		--libdir="${EPREFIX}/$(get_libdir)" \
+		--with-ksource="${KV_DIR}" \
+		--with-kbuild="${KV_OUT_DIR}"
+}
+
+src_compile() {
+	einfo "Building userspace"
+	emake
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Building kernel modules"
+		set_arch_to_kernel
+		emake modules
+	fi
+}
+
+src_install() {
+	einfo "Installing userspace"
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+
+	newinitd "${FILESDIR}"/ipset.initd-r4 ${PN}
+	newconfd "${FILESDIR}"/ipset.confd ${PN}
+	systemd_newunit "${FILESDIR}"/ipset.systemd ${PN}.service
+	keepdir /var/lib/ipset
+
+	if [[ ${build_modules} -eq 1 ]]; then
+		einfo "Installing kernel modules"
+		linux-mod_src_install
+	fi
+}
diff --git a/net-firewall/nftables/Manifest b/net-firewall/nftables/Manifest
index 8d9385032b14..19e70063a905 100644
--- a/net-firewall/nftables/Manifest
+++ b/net-firewall/nftables/Manifest
@@ -9,7 +9,9 @@ AUX nftables.init-r1 2279 BLAKE2B 1c4c28ea5b6a22905b3ec7de8e54726933b579352ecd79
 AUX systemd/nftables-restore.service 394 BLAKE2B 1c1f358eb2eff789e68c051098c971f11a8df6621c3c919e30a1ec1213f6db822c390609c01827fe9fc75c540effa3e3a7b6f93bd24e16ea19841bbfaab796ed SHA512 18da6a770bb3e94fd6b2c9e6f033450aaff9fe886c8846f780d08a21e2fc884ac078652743b50b3d4ea8c9500f92d272bdd27e2881e438c2b223d40816c100a0
 DIST nftables-0.9.8.tar.bz2 879516 BLAKE2B 5063090d648668f4d5ae6d4be48ebecc65dfd4b525768e94a0d90ceebbee73874c916727be8de633550db71c612d698d88cf93575931362b48d954e6ac275143 SHA512 1c5709825c8b2c13cbed0310658959ecee164c930bc9e2447618a0894598138b9a549d20509c32a5c23ce99e40438df38f9e170cf656ce993d819f365490a180
 DIST nftables-0.9.9.tar.bz2 922624 BLAKE2B 8de2709576a26ca84a8d694f7cb06cad2bb2fb4671ba21ffc32c0d5997e8124ae7cd794dafddf4db48d8a49c280b48b07d2a31b6c18f6647fdb67cfe7f065b61 SHA512 dfdd3ffc0ffc1742ca0494a3f8fac1c7b2fe942849e60d33fc3cb8a51e27bd39e1ccfeda2195191377a32bb5363ea244f4c3e71b4a6d930f33bf87e17a534fab
+DIST nftables-1.0.0.tar.bz2 921053 BLAKE2B ee86a323170433c3ba62f80118947864aac0fe0aaeb48afeb5a116a48782185c83313ef1b5735c7749eb5eccb88f252b444d1ee908be25bdaa4d9c0b833c1dc2 SHA512 33460bef4ee76b7caa44fa5515357127ae84be468448cc838dd31919b6e045ba6195b761118d4c8a4219a9f008c4416542ce784f4daad94f3b44c0626bcdd014
 EBUILD nftables-0.9.8.ebuild 4283 BLAKE2B d8fe0db1b588ac9fe53b7d06d10fbd3b4ea5ab28bc7cf97bec1357422e5c9d29cb5709cac592071ab583b56018e591f120108e70f573226bc4c8bf95de2a7651 SHA512 ad668b9c2633fc2408d3d23850f3df02d26825a03a8675f84b962feec82f435fa64f022a9e5977895426ae7ff1655ac17e3b1dd3b3b53a4e4c5d342ac6c90a61
 EBUILD nftables-0.9.9.ebuild 4553 BLAKE2B 54b3de2a5413532de597c7b496dcc83405136e442f1d9dca2e3c3cabe23f0ed8d2e84311d9091b62ec14e284cf768652f924cfd51df537a576d391026d82df2d SHA512 6d17349a2749437becd3d8a75c192e58d6019b49c3e99594d7f0f6989cb84b5a24820b843aed08cf6a43cdf359f63c250b7a00fdf2cb994c93faa31f3ad458b3
-EBUILD nftables-9999.ebuild 4559 BLAKE2B 69d40760391a11a3b8f8bcacb6281d2e2e590da4ad0f998f95aaff64f834e85fc2b733858a3aa0205a2563ee3cc957830516a14386f8290c75ff9d0681e140ab SHA512 b7026efea6bc02a77eb9c9a1f0e10c867ffa6e5ad154f19697c55ec3ea2c8310faa7cabef94e1a1b73cd61e1393883eea864836abbcd5bb866f755cebfa2256c
+EBUILD nftables-1.0.0.ebuild 4559 BLAKE2B 2abaebf2633942855cee7b67aa2d1a93575a038be04c81b0811b81fb20e51f409393f865475678defcd0eabb7728bb10e75284831aa333cbcefef1776f6399f9 SHA512 4dd6d0ad1ebb25d6e394b8f0fd09ca348b2944f0f77a9963d704c7e69f7ca8664756d2a1e4b175b37aa3e19a64d84e236da5f8da60167aedb01b9ed0fc1c535f
+EBUILD nftables-9999.ebuild 4559 BLAKE2B 2abaebf2633942855cee7b67aa2d1a93575a038be04c81b0811b81fb20e51f409393f865475678defcd0eabb7728bb10e75284831aa333cbcefef1776f6399f9 SHA512 4dd6d0ad1ebb25d6e394b8f0fd09ca348b2944f0f77a9963d704c7e69f7ca8664756d2a1e4b175b37aa3e19a64d84e236da5f8da60167aedb01b9ed0fc1c535f
 MISC metadata.xml 932 BLAKE2B 1d75a3e5a7d7416bc86d9f85bb2ca62d33a78017d773d2984b7f9666a0f615ac41cdbdab58f63f612a2b95e498fe8a785a1dce0e4be188446c197a3d96bbecd5 SHA512 8845820c9c3be773a1b8dbbf24eeb1db7327722f4710c473112b4450265bdedbd8b0284cb6ba87e915596cdc1d608e573920f19116f06fe6a1fa167e8d0e23d5
diff --git a/net-firewall/nftables/nftables-1.0.0.ebuild b/net-firewall/nftables/nftables-1.0.0.ebuild
new file mode 100644
index 000000000000..376318f5382c
--- /dev/null
+++ b/net-firewall/nftables/nftables-1.0.0.ebuild
@@ -0,0 +1,179 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{7..10} )
+
+inherit autotools linux-info python-r1 systemd
+
+DESCRIPTION="Linux kernel (3.13+) firewall, NAT and packet mangling tools"
+HOMEPAGE="https://netfilter.org/projects/nftables/"
+
+if [[ ${PV} =~ ^[9]{4,}$ ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.netfilter.org/${PN}"
+
+	BDEPEND="
+		sys-devel/bison
+		sys-devel/flex
+	"
+else
+	SRC_URI="https://netfilter.org/projects/nftables/files/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~riscv ~sparc ~x86"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/1"
+IUSE="debug doc +gmp json libedit +modern-kernel python +readline static-libs xtables"
+
+RDEPEND="
+	>=net-libs/libmnl-1.0.4:0=
+	>=net-libs/libnftnl-1.2.0:0=
+	gmp? ( dev-libs/gmp:0= )
+	json? ( dev-libs/jansson:= )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	xtables? ( >=net-firewall/iptables-1.6.1 )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND+="
+	doc? (
+		app-text/asciidoc
+		>=app-text/docbook2X-0.8.8-r4
+	)
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+	libedit? ( !readline )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.9.8-slibtool.patch"
+)
+
+python_make() {
+	emake \
+		-C py \
+		abs_builddir="${S}" \
+		DESTDIR="${D}" \
+		PYTHON_BIN="${PYTHON}" \
+		"${@}"
+}
+
+pkg_setup() {
+	if kernel_is ge 3 13; then
+		if use modern-kernel && kernel_is lt 3 18; then
+			eerror "The modern-kernel USE flag requires kernel version 3.18 or newer to work properly."
+		fi
+		CONFIG_CHECK="~NF_TABLES"
+		linux-info_pkg_setup
+	else
+		eerror "This package requires kernel version 3.13 or newer to work properly."
+	fi
+}
+
+src_prepare() {
+	default
+
+	# fix installation path for doc stuff
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels@' \
+		-i files/nftables/Makefile.am || die
+	sed '/^pkgsysconfdir/s@${sysconfdir}.*$@${docdir}/skels/osf@' \
+		-i files/osf/Makefile.am || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		# We handle python separately
+		--disable-python
+		--sbindir="${EPREFIX}"/sbin
+		$(use_enable debug)
+		$(use_enable doc man-doc)
+		$(use_with !gmp mini_gmp)
+		$(use_with json)
+		$(use_with libedit cli editline)
+		$(use_with readline cli readline)
+		$(use_enable static-libs static)
+		$(use_with xtables)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		python_foreach_impl python_make
+	fi
+}
+
+src_install() {
+	default
+
+	if ! use doc && [[ ! ${PV} =~ ^[9]{4,}$ ]]; then
+		pushd doc >/dev/null || die
+		doman *.?
+		popd >/dev/null || die
+	fi
+
+	local mksuffix="$(usex modern-kernel '-mk' '')"
+
+	exeinto /usr/libexec/${PN}
+	newexe "${FILESDIR}"/libexec/${PN}${mksuffix}.sh ${PN}.sh
+	newconfd "${FILESDIR}"/${PN}${mksuffix}.confd ${PN}
+	newinitd "${FILESDIR}"/${PN}${mksuffix}.init-r1 ${PN}
+	keepdir /var/lib/nftables
+
+	systemd_dounit "${FILESDIR}"/systemd/${PN}-restore.service
+
+	if use python ; then
+		python_foreach_impl python_make install
+		python_foreach_impl python_optimize
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
+
+pkg_postinst() {
+	local save_file
+	save_file="${EROOT}/var/lib/nftables/rules-save"
+
+	# In order for the nftables-restore systemd service to start
+	# the save_file must exist.
+	if [[ ! -f "${save_file}" ]]; then
+		( umask 177; touch "${save_file}" )
+	elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
+		ewarn "Your system has dangerous permissions for ${save_file}"
+		ewarn "It is probably affected by bug #691326."
+		ewarn "You may need to fix the permissions of the file. To do so,"
+		ewarn "you can run the command in the line below as root."
+		ewarn "    'chmod 600 \"${save_file}\"'"
+	fi
+
+	if has_version 'sys-apps/systemd'; then
+		elog "If you wish to enable the firewall rules on boot (on systemd) you"
+		elog "will need to enable the nftables-restore service."
+		elog "    'systemctl enable ${PN}-restore.service'"
+		elog
+		elog "If you are creating firewall rules before the next system restart"
+		elog "the nftables-restore service must be manually started in order to"
+		elog "save those rules on shutdown."
+	fi
+	if has_version 'sys-apps/openrc'; then
+		elog "If you wish to enable the firewall rules on boot (on openrc) you"
+		elog "will need to enable the nftables service."
+		elog "    'rc-update add ${PN} default'"
+		elog
+		elog "If you are creating or updating the firewall rules and wish to save"
+		elog "them to be loaded on the next restart, use the \"save\" functionality"
+		elog "in the init script."
+		elog "    'rc-service ${PN} save'"
+	fi
+}
diff --git a/net-firewall/nftables/nftables-9999.ebuild b/net-firewall/nftables/nftables-9999.ebuild
index 5322eb53985b..376318f5382c 100644
--- a/net-firewall/nftables/nftables-9999.ebuild
+++ b/net-firewall/nftables/nftables-9999.ebuild
@@ -29,7 +29,7 @@ IUSE="debug doc +gmp json libedit +modern-kernel python +readline static-libs xt
 
 RDEPEND="
 	>=net-libs/libmnl-1.0.4:0=
-	>=net-libs/libnftnl-1.1.9:0=
+	>=net-libs/libnftnl-1.2.0:0=
 	gmp? ( dev-libs/gmp:0= )
 	json? ( dev-libs/jansson:= )
 	python? ( ${PYTHON_DEPS} )