[patch] New shorewall-4.6.3.4 ebuild

shorewall-4.6.3.4.patch (text/plain), 41.63 KB, created by Thomas Deutschmann (RETIRED) on 2014-09-24 15:59:49 UTC

diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6.confd new/net-firewall/shorewall/files/4.6/shorewall6.confd
--- old/net-firewall/shorewall/files/4.6/shorewall6.confd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6.confd	2013-11-14 19:31:48.000000000 +0100
@@ -0,0 +1,15 @@
+# Global start/restart/stop options
+# 
+OPTIONS=""
+
+# Start options
+# 
+STARTOPTIONS=""
+
+# Stop options
+# 
+STOPOPTIONS=""
+
+# Restart options
+# 
+RESTARTOPTIONS=""
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6.initd new/net-firewall/shorewall/files/4.6/shorewall6.initd
--- old/net-firewall/shorewall/files/4.6/shorewall6.initd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6.initd	2014-08-23 00:53:44.000000000 +0200
@@ -0,0 +1,107 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+description='The Shoreline Firewall 6, more commonly known as "Shorewall6", is'
+description="${description} a high-level tool for configuring Netfilter."
+
+extra_commands="check clear"
+extra_started_commands="refresh reset"
+
+description_check="Checks if the configuration will compile or not."
+
+description_clear="Clear will remove all rules and chains installed by"
+description_clear="${description_clear} Shorewall6. The firewall is then"
+description_clear="${description_clear} wide open and unprotected."
+
+description_refresh="The mangle table will be refreshed along with the"
+description_refresh="${description_refresh} blacklist chain (if any)."
+
+description_reset="All the packet and byte counters in the firewall are reset."
+
+depend() {
+	need net
+	provide firewall
+	after ulogd
+}
+
+status() {
+	local _retval
+	/sbin/shorewall6 status 1>/dev/null
+	_retval=$?
+	if [ ${_retval} = '0' ]; then
+		einfo 'status: started'
+		mark_service_started "${SVCNAME}"
+		return 0
+	else
+		einfo 'status: stopped'	
+		mark_service_stopped "${SVCNAME}"
+		return 3
+	fi
+}
+
+start() {
+	ebegin "Starting shorewall6"
+	/sbin/shorewall6 ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null
+	eend $? 
+}
+
+stop() {
+	ebegin "Stopping shorewall6"
+	/sbin/shorewall6 ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null
+	eend $?
+}
+
+restart() {
+	# shorewall comes with its own control script that includes a
+	# restart function, so refrain from calling svc_stop/svc_start
+	# here.  Note that this comment is required to fix bug 55576;
+	# runscript.sh greps this script...  (09 Jul 2004 agriffis)
+
+	ebegin "Restarting shorewall6"
+	/sbin/shorewall6 status 1>/dev/null
+	if [ $? != 0 ] ; then
+		svc_start
+	else
+		/sbin/shorewall6 ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null
+	fi
+	eend $?
+}
+
+clear() {
+	# clear will remove all the rules and bring the system to an unfirewalled
+	# state. (21 Nov 2004 eldad)
+
+	ebegin "Clearing all shorewall rules and setting policy to ACCEPT"
+	/sbin/shorewall6 ${OPTIONS} clear 1>/dev/null
+	eend $?
+}
+
+reset() {
+	# reset the packet and byte counters in the firewall
+
+	ebegin "Resetting the packet and byte counters in shorewall6"
+	/sbin/shorewall6 ${OPTIONS} reset 1>/dev/null
+	eend $?
+}
+
+refresh() {
+	# refresh the rules involving the broadcast addresses of firewall 
+	# interfaces, the black list, traffic control rules and 
+	# ECN control rules
+
+	ebegin "Refreshing shorewall6 rules"
+	/sbin/shorewall6 ${OPTIONS} refresh 1>/dev/null
+	eend $?
+}
+
+check() {
+	# perform cursory validation of the zones, interfaces, hosts, rules
+	# and policy files. CAUTION: does not parse and validate the generated 
+	# iptables commands.
+
+	ebegin "Checking shorewall6 configuration"
+	/sbin/shorewall6 ${OPTIONS} check 1>/dev/null
+	eend $?
+}
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6-lite.confd new/net-firewall/shorewall/files/4.6/shorewall6-lite.confd
--- old/net-firewall/shorewall/files/4.6/shorewall6-lite.confd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6-lite.confd	2014-08-23 00:36:17.000000000 +0200
@@ -0,0 +1,15 @@
+# Global start/restart/stop options
+#
+OPTIONS=""
+
+# Start options
+#
+STARTOPTIONS=""
+
+# Stop options
+#
+STOPOPTIONS=""
+
+# Restart options
+#
+RESTARTOPTIONS=""
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6-lite.initd new/net-firewall/shorewall/files/4.6/shorewall6-lite.initd
--- old/net-firewall/shorewall/files/4.6/shorewall6-lite.initd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6-lite.initd	2014-08-23 00:52:53.000000000 +0200
@@ -0,0 +1,82 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+description='The Shoreline Firewall 6 Lite, more commonly known as "Shorewall6 Lite", is'
+description="${description} a high-level tool for configuring Netfilter."
+
+extra_commands="clear"
+extra_started_commands="reset"
+
+description_clear="Clear will remove all rules and chains installed by"
+description_clear="${description_clear} Shorewall6 Lite. The firewall is"
+description_clear="${description_clear} then wide open and unprotected."
+
+description_reset="All the packet and byte counters in the firewall are reset."
+
+depend() {
+	need net
+	provide firewall
+	after ulogd
+}
+
+status() {
+	local _retval
+	/sbin/shorewall6-lite status 1>/dev/null
+	_retval=$?
+	if [ ${_retval} = '0' ]; then
+		einfo 'status: started'
+		mark_service_started "${SVCNAME}"
+		return 0
+	else
+		einfo 'status: stopped'	
+		mark_service_stopped "${SVCNAME}"
+		return 3
+	fi
+}
+
+start() {
+	ebegin "Starting shorewall6-lite"
+	/sbin/shorewall6-lite ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null
+	eend $? 
+}
+
+stop() {
+	ebegin "Stopping shorewall6-lite"
+	/sbin/shorewall6-lite ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null
+	eend $?
+}
+
+restart() {
+	# shorewall comes with its own control script that includes a
+	# restart function, so refrain from calling svc_stop/svc_start
+	# here.  Note that this comment is required to fix bug 55576;
+	# runscript.sh greps this script...  (09 Jul 2004 agriffis)
+
+	ebegin "Restarting shorewall6-lite"
+	/sbin/shorewall6-lite status 1>/dev/null
+	if [ $? != 0 ] ; then
+		svc_start
+	else
+		/sbin/shorewall6-lite ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null
+	fi
+	eend $?
+}
+
+clear() {
+	# clear will remove all the rules and bring the system to an unfirewalled
+	# state. (21 Nov 2004 eldad)
+
+	ebegin "Clearing all shorewall6-lite rules and setting policy to ACCEPT"
+	/sbin/shorewall6-lite ${OPTIONS} clear 1>/dev/null
+	eend $?
+}
+
+reset() {
+	# reset the packet and byte counters in the firewall
+
+	ebegin "Resetting the packet and byte counters in shorewall6-lite"
+	/sbin/shorewall6-lite ${OPTIONS} reset 1>/dev/null
+	eend $?
+}
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6-lite.systemd new/net-firewall/shorewall/files/4.6/shorewall6-lite.systemd
--- old/net-firewall/shorewall/files/4.6/shorewall6-lite.systemd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6-lite.systemd	2014-09-24 17:30:32.000000000 +0200
@@ -0,0 +1,19 @@
+#
+#	The Shoreline Firewall 6 Lite (Shorewall6-Lite) Packet Filtering Firewall - V4.6
+#
+[Unit]
+Description=Shorewall IPv6 firewall lite
+Documentation=man:shorewall6-lite(8) http://www.shorewall.net/Documentation_Index.html
+After=network.target
+Conflicts=ip6tables.service firewalld.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/conf.d/shorewall6-lite
+StandardOutput=syslog
+ExecStart=/sbin/shorewall6-lite $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall6-lite $OPTIONS stop $STOPOPTIONS
+
+[Install]
+WantedBy=basic.target
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall6.systemd new/net-firewall/shorewall/files/4.6/shorewall6.systemd
--- old/net-firewall/shorewall/files/4.6/shorewall6.systemd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall6.systemd	2014-09-24 17:27:43.000000000 +0200
@@ -0,0 +1,19 @@
+#
+#	The Shoreline Firewall 6 (Shorewall6) Packet Filtering Firewall - V4.6
+#
+[Unit]
+Description=Shorewall IPv6 firewall
+Documentation=man:shorewall6(8) http://www.shorewall.net/Documentation_Index.html
+After=network.target
+Conflicts=ip6tables.service firewalld.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/conf.d/shorewall6
+StandardOutput=syslog
+ExecStart=/sbin/shorewall6 $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall6 $OPTIONS stop $STOPOPTIONS
+
+[Install]
+WantedBy=basic.target
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall.confd new/net-firewall/shorewall/files/4.6/shorewall.confd
--- old/net-firewall/shorewall/files/4.6/shorewall.confd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall.confd	2014-08-23 00:34:46.000000000 +0200
@@ -0,0 +1,15 @@
+# Global start/restart/stop options
+#
+OPTIONS=""
+
+# Start options
+#
+STARTOPTIONS=""
+
+# Stop options
+#
+STOPOPTIONS=""
+
+# Restart options
+#
+RESTARTOPTIONS=""
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-init-01_remove-ipset-functionality.patch new/net-firewall/shorewall/files/4.6/shorewall-init-01_remove-ipset-functionality.patch
--- old/net-firewall/shorewall/files/4.6/shorewall-init-01_remove-ipset-functionality.patch	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-init-01_remove-ipset-functionality.patch	2014-07-17 01:20:14.000000000 +0200
@@ -0,0 +1,27 @@
+--- shorewall-init.old	2013-09-08 23:25:36.364924304 +0200
++++ shorewall-init	2013-09-08 23:29:27.418736392 +0200
+@@ -79,10 +79,6 @@
+       fi
+   done
+ 
+-  if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
+-      ipset -R < "$SAVE_IPSETS"
+-  fi
+-
+   return 0
+ }
+ 
+@@ -100,13 +96,6 @@
+       fi
+   done
+ 
+-  if [ -n "$SAVE_IPSETS" ]; then
+-      mkdir -p $(dirname "$SAVE_IPSETS")
+-      if ipset -S > "${SAVE_IPSETS}.tmp"; then
+-	  grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
+-      fi
+-  fi
+-
+   return 0
+ }
+ 
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-init.confd new/net-firewall/shorewall/files/4.6/shorewall-init.confd
--- old/net-firewall/shorewall/files/4.6/shorewall-init.confd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-init.confd	2014-08-26 11:07:57.000000000 +0200
@@ -0,0 +1,6 @@
+# List the Shorewall products that Shorewall-init is to
+# initialize (space-separated list).
+#
+# Sample: PRODUCTS="shorewall shorewall6-lite"
+#
+PRODUCTS=""
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall.initd new/net-firewall/shorewall/files/4.6/shorewall.initd
--- old/net-firewall/shorewall/files/4.6/shorewall.initd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall.initd	2014-08-23 00:53:30.000000000 +0200
@@ -0,0 +1,97 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+description='The Shoreline Firewall, more commonly known as "Shorewall", is'
+description="${description} a high-level tool for configuring Netfilter."
+
+extra_commands="check clear"
+extra_started_commands="refresh reset"
+
+description_check="Checks if the configuration will compile or not."
+
+description_clear="Clear will remove all rules and chains installed by"
+description_clear="${description_clear} Shorewall. The firewall is then"
+description_clear="${description_clear} wide open and unprotected."
+
+description_refresh="The mangle table will be refreshed along with the"
+description_refresh="${description_refresh} blacklist chain (if any)."
+
+description_reset="All the packet and byte counters in the firewall are reset."
+
+depend() {
+	need net
+	provide firewall
+	after ulogd
+}
+
+status() {
+	local _retval
+	/sbin/shorewall status 1>/dev/null
+	_retval=$?
+	if [ ${_retval} = '0' ]; then
+		einfo 'status: started'
+		mark_service_started "${SVCNAME}"
+		return 0
+	else
+		einfo 'status: stopped'	
+		mark_service_stopped "${SVCNAME}"
+		return 3
+	fi
+}
+
+start() {
+	ebegin "Starting shorewall"
+	/sbin/shorewall ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null
+	eend $? 
+}
+
+stop() {
+	ebegin "Stopping shorewall"
+	/sbin/shorewall ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null
+	eend $?
+}
+
+restart() {
+	ebegin "Restarting shorewall"
+	/sbin/shorewall status 1>/dev/null
+	if [ $? != 0 ] ; then
+		svc_start
+	else
+		/sbin/shorewall ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null
+	fi
+	eend $?
+}
+
+clear() {
+	ebegin "Clearing all shorewall rules and setting policy to ACCEPT"
+	/sbin/shorewall ${OPTIONS} clear 1>/dev/null
+	eend $?
+}
+
+reset() {
+	ebegin "Resetting the packet and byte counters in shorewall"
+	/sbin/shorewall ${OPTIONS} reset 1>/dev/null
+	eend $?
+}
+
+refresh() {
+	# refresh the rules involving the broadcast addresses of firewall 
+	# interfaces, the black list, traffic control rules and 
+	# ECN control rules
+
+	ebegin "Refreshing shorewall rules"
+	/sbin/shorewall ${OPTIONS} refresh 1>/dev/null
+	eend $?
+}
+
+check() {
+	# perform cursory validation of the zones, interfaces, hosts, rules
+	# and policy files. CAUTION: does not parse and validate the generated 
+	# iptables commands.
+
+	ebegin "Checking shorewall configuration"
+	/sbin/shorewall ${OPTIONS} check 1>/dev/null
+	eend $?
+}
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-init.initd new/net-firewall/shorewall/files/4.6/shorewall-init.initd
--- old/net-firewall/shorewall/files/4.6/shorewall-init.initd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-init.initd	2014-08-23 00:53:02.000000000 +0200
@@ -0,0 +1,189 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+SHOREWALLRC_FILE="@GENTOO_PORTAGE_EPREFIX@/usr/share/shorewall/shorewallrc"
+CONFIG_FILE="@GENTOO_PORTAGE_EPREFIX@/etc/conf.d/${SVCNAME}"
+
+description="Puts Shorewall in a safe state at boot time"
+description="${description} prior to bringing up the network."
+
+required_files="$SHOREWALLRC_FILE"
+
+depend() {
+	need localmount
+	before net
+	after bootmisc ipset tmpfiles.setup ulogd
+}
+
+
+. $SHOREWALLRC_FILE
+
+checkconfig() {
+	local PRODUCT=
+
+	if [ -z "${VARLIB}" ]; then
+		eerror "\"VARLIB\" isn't defined or empty! Please check" \
+			"\"${SHOREWALLRC_FILE}\"."
+
+		return 1
+	fi
+
+	if [ -z "${PRODUCTS}" ]; then
+		eerror "${SVCNAME} isn't configured! Please check" \
+			"\"${CONFIG_FILE}\"."
+
+		return 1
+	fi
+
+	for PRODUCT in ${PRODUCTS}; do
+		if [ ! -x ${SBINDIR}/${PRODUCT} ]; then
+			eerror "Invalid product \"${PRODUCT}\" specified" \
+				"in \"${CONFIG_FILE}\"!"
+			eerror "Maybe \"${PRODUCT}\" isn't installed?"
+
+			return 1
+		fi
+	done
+
+	return 0
+}
+
+check_firewall_script() {
+	if [ ! -x ${STATEDIR}/firewall ]; then
+		if [ ${PRODUCT} = shorewall -o ${PRODUCT} = shorewall6 ]; then
+			ebegin "Creating \"${STATEDIR}/firewall\""
+			${SBINDIR}/${PRODUCT} compile 1>/dev/null
+			eend $?
+		else
+			eerror "\"${PRODUCT}\" isn't configured!"
+			eerror "Please go to your 'administrative system'" \
+				"and deploy the compiled firewall" \
+				"configuration for this system."
+
+			return 1
+		fi
+	fi
+
+	return 0
+}
+
+is_allowed_to_be_executed() {
+	# This is not a real service. shorewall-init is an intermediate
+	# script to put your Shorewall-based firewall into a safe state
+	# at boot time prior to bringing up the network.
+	# Please read /usr/share/doc/shorewall-init-*/README.gentoo.gz
+	# for more information.
+	# When your system is up, there is no need to call shorewall-init.
+	# Please call shorewall{,6,-lite,6-lite} directly. That's the
+	# reason why we are preventing start, stop or restart here.
+
+	local PRODUCT=
+
+	if [ "${RC_RUNLEVEL}" != "boot" -a "${RC_CMD}" = "start" ]; then
+		# Starting shorewall-init is only allowed at boot time
+		eerror "This is a boot service, which can only be started" \
+			"at boot."
+		eerror "If you want to get your shorewall-based firewall" \
+			"into the same safe boot state again, run"
+		eerror ""
+		eindent
+		for PRODUCT in ${PRODUCTS}; do
+			eerror "/etc/init.d/${PRODUCT} stop"
+		done
+		eoutdent
+		eerror ""
+		eerror "Yes, \"stop\" and not start."
+		eerror ""
+		return 1
+	fi
+
+	if [ "${RC_RUNLEVEL}" != "shutdown" -a "${RC_CMD}" = "stop" ]; then
+		# Stopping shorewall-init is only allowed at shutdown
+		eerror "This is a boot service, which cannot be stopped."
+		eerror "If you really want to stop your Shorewall-based" \
+			"firewall the same way this service would stop" \
+			"Shorewall at shutdown, please run"
+		eerror ""
+		eindent
+		for PRODUCT in ${PRODUCTS}; do
+			eerror "/etc/init.d/${PRODUCT} clear"
+		done
+		eoutdent
+		eerror ""
+		eerror "Keep in mind that this will clear (=bring down)" \
+			"your firewall!"
+		eerror ""
+		return 1
+	fi
+
+	if [ "${RC_CMD}" = "restart" ]; then
+		eerror "This is a boot service, which cannot be restarted."
+		eerror "If you want to restart any of your Shorewall-based" \
+			"firewalls, run"
+		eerror ""
+		eindent
+		for PRODUCT in ${PRODUCTS}; do
+			eerror "/etc/init.d/${PRODUCT} restart"
+		done
+		eoutdent
+		eerror ""
+		return 1
+	fi
+
+	return 0
+}
+
+set_statedir() {
+	STATEDIR=
+	local VARDIR=
+
+	if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then
+		STATEDIR=$( . ${CONFDIR}/${PRODUCT}/vardir && echo ${VARDIR} )
+	fi
+
+	[ ! -n "${STATEDIR}" ] && STATEDIR=${VARLIB}/${PRODUCT}
+}
+
+start_pre() {
+	checkconfig || return 1
+
+	is_allowed_to_be_executed || return 1
+}
+
+start() {
+	local PRODUCT=
+	local STATEDIR=
+
+	for PRODUCT in ${PRODUCTS}; do
+		set_statedir
+
+		check_firewall_script || return 1
+
+		ebegin "Initializing \"${PRODUCT}\""
+		${STATEDIR}/firewall stop 1>/dev/null
+		eend $?
+	done
+}
+
+stop_pre() {
+	checkconfig || return 1
+
+	is_allowed_to_be_executed || return 1
+}
+
+stop() {
+	local PRODUCT=
+	local STATEDIR=
+
+	for PRODUCT in ${PRODUCTS}; do
+		set_statedir
+
+		check_firewall_script || return 1
+
+		ebegin "Clearing \"${PRODUCT}\""
+		${STATEDIR}/firewall clear 1>/dev/null
+		eend $?
+	done
+}
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-init.readme new/net-firewall/shorewall/files/4.6/shorewall-init.readme
--- old/net-firewall/shorewall/files/4.6/shorewall-init.readme	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-init.readme	2013-11-14 19:31:48.000000000 +0100
@@ -0,0 +1,30 @@
+shorewall-init from upstream offers two features (taken from [1]):
+
+	1. It can 'close' the firewall before the network interfaces are
+	   brought up during boot.
+	
+	2. It can change the firewall state as the result of interfaces
+	   being brought up or taken down.
+
+On Gentoo we only support the first feature -- the firewall lockdown during
+boot.
+
+We do not support the second feature, because Gentoo doesn't support a
+if-{up,down}.d folder like other distributions do. If you would want to use
+such a feature, you would have to add a custom action to /etc/conf.d/net
+(please refer to the Gentoo Linux Handbook [2] for more information).
+If you are able to add your custom {pre,post}{up,down} action, your are
+also able to specify what shorewall{6,-lite,6-lite} should do, so there is
+no need for upstream's scripts in Gentoo.
+
+If you disagree with us, feel free to open a bug [3] and contribute your
+solution for Gentoo.
+
+Upstream's original init script also supports saving and restoring of
+ipsets. Please use the init script from net-firewall/ipset if you need
+such a feature.
+
+
+[1] http://www.shorewall.net/Shorewall-init.html
+[2] http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=4&chap=5
+[3] https://bugs.gentoo.org
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-init.systemd new/net-firewall/shorewall/files/4.6/shorewall-init.systemd
--- old/net-firewall/shorewall/files/4.6/shorewall-init.systemd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-init.systemd	2014-09-24 17:31:16.000000000 +0200
@@ -0,0 +1,18 @@
+#
+#	The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.6
+#
+[Unit]
+Description=shorewall-init
+Documentation=http://www.shorewall.net/Shorewall-init.html
+Before=network.target
+Conflicts=firewalld.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+StandardOutput=syslog
+ExecStart=/sbin/shorewall-init start
+ExecStop=/sbin/shorewall-init stop
+
+[Install]
+WantedBy=basic.target
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-lite.confd new/net-firewall/shorewall/files/4.6/shorewall-lite.confd
--- old/net-firewall/shorewall/files/4.6/shorewall-lite.confd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-lite.confd	2014-08-23 00:31:04.000000000 +0200
@@ -0,0 +1,15 @@
+# Global start/restart/stop options
+#
+OPTIONS=""
+
+# Start options
+#
+STARTOPTIONS=""
+
+# Stop options
+#
+STOPOPTIONS=""
+
+# Restart options
+#
+RESTARTOPTIONS=""
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-lite.initd new/net-firewall/shorewall/files/4.6/shorewall-lite.initd
--- old/net-firewall/shorewall/files/4.6/shorewall-lite.initd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-lite.initd	2014-08-23 00:53:20.000000000 +0200
@@ -0,0 +1,72 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+description='The Shoreline Firewall Lite, more commonly known as "Shorewall Lite", is'
+description="${description} a high-level tool for configuring Netfilter."
+
+extra_commands="clear"
+extra_started_commands="reset"
+
+description_clear="Clear will remove all rules and chains installed by"
+description_clear="${description_clear} Shorewall Lite. The firewall is"
+description_clear="${description_clear} then wide open and unprotected."
+
+description_reset="All the packet and byte counters in the firewall are reset."
+
+depend() {
+	need net
+	provide firewall
+	after ulogd
+}
+
+status() {
+	local _retval
+	/sbin/shorewall-lite status 1>/dev/null
+	_retval=$?
+	if [ ${_retval} = '0' ]; then
+		einfo 'status: started'
+		mark_service_started "${SVCNAME}"
+		return 0
+	else
+		einfo 'status: stopped'	
+		mark_service_stopped "${SVCNAME}"
+		return 3
+	fi
+}
+
+start() {
+	ebegin "Starting shorewall-lite"
+	/sbin/shorewall-lite ${OPTIONS} start ${STARTOPTIONS} 1>/dev/null
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping shorewall-lite"
+	/sbin/shorewall-lite ${OPTIONS} stop ${STOPOPTIONS} 1>/dev/null
+	eend $?
+}
+
+restart() {
+	ebegin "Restarting shorewall-lite"
+	/sbin/shorewall-lite status 1>/dev/null
+	if [ $? != 0 ] ; then
+		svc_start
+	else
+		/sbin/shorewall-lite ${OPTIONS} restart ${RESTARTOPTIONS} 1>/dev/null
+	fi
+	eend $?
+}
+
+clear() {
+	ebegin "Clearing all shorewall-lite rules and setting policy to ACCEPT"
+	/sbin/shorewall-lite ${OPTIONS} clear 1>/dev/null
+	eend $?
+}
+
+reset() {
+	ebegin "Resetting the packet and byte counters in shorewall-lite"
+	/sbin/shorewall-lite ${OPTIONS} reset 1>/dev/null
+	eend $?
+}
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall-lite.systemd new/net-firewall/shorewall/files/4.6/shorewall-lite.systemd
--- old/net-firewall/shorewall/files/4.6/shorewall-lite.systemd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall-lite.systemd	2014-09-24 17:29:58.000000000 +0200
@@ -0,0 +1,19 @@
+#
+#	The Shoreline Firewall Lite (Shorewall-Lite) Packet Filtering Firewall - V4.6
+#
+[Unit]
+Description=Shorewall IPv4 firewall lite
+Documentation=man:shorewall-lite(8) http://www.shorewall.net/Documentation_Index.html
+After=network.target
+Conflicts=iptables.service firewalld.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/conf.d/shorewall-lite
+StandardOutput=syslog
+ExecStart=/sbin/shorewall-lite $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall-lite $OPTIONS stop $STOPOPTIONS
+
+[Install]
+WantedBy=basic.target
diff -rupN old/net-firewall/shorewall/files/4.6/shorewallrc new/net-firewall/shorewall/files/4.6/shorewallrc
--- old/net-firewall/shorewall/files/4.6/shorewallrc	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewallrc	2014-08-23 00:26:04.000000000 +0200
@@ -0,0 +1,23 @@
+#
+# Gentoo Shorewall 4.6 rc file
+#
+BUILD=                                  #Default is to detect the build system
+HOST=gentoo                             #Gentoo GNU Linux
+PREFIX=@GENTOO_PORTAGE_EPREFIX@/usr                             #Top-level directory for shared files, libraries, etc.
+SHAREDIR=${PREFIX}/share                #Directory for arch-neutral files.
+LIBEXECDIR=${PREFIX}/share              #Directory for executable scripts.
+PERLLIBDIR=${PREFIX}/share/shorewall    #Directory to install Shorewall Perl module directory
+CONFDIR=@GENTOO_PORTAGE_EPREFIX@/etc                            #Directory where subsystem configurations are installed
+SBINDIR=@GENTOO_PORTAGE_EPREFIX@/sbin                           #Directory where system administration programs are installed
+MANDIR=${PREFIX}/share/man              #Directory where manpages are installed.
+INITDIR=${CONFDIR}/init.d               #Directory where SysV init scripts are installed.
+INITFILE=${PRODUCT}                     #Name of the product's installed SysV init script
+INITSOURCE=init.gentoo.sh               #Name of the distributed file to be installed as the SysV init script
+ANNOTATED=                              #If non-zero, annotated configuration files are installed
+SYSTEMD=@GENTOO_PORTAGE_EPREFIX@/usr/lib/systemd/system         #Directory where .service files are installed (systems running systemd only)
+SERVICEFILE=gentoo.service              #Name of the distributed file to be installed as systemd service file
+SYSCONFFILE=default.gentoo              #Name of the distributed file to be installed in $SYSCONFDIR
+SYSCONFDIR=${CONFDIR}/conf.d            #Directory where SysV init parameter files are installed
+SPARSE=                                 #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
+VARLIB=@GENTOO_PORTAGE_EPREFIX@/var/lib                         #Directory where product variable data is stored.
+VARDIR=${VARLIB}/${PRODUCT}             #Directory where product variable data is stored.
diff -rupN old/net-firewall/shorewall/files/4.6/shorewall.systemd new/net-firewall/shorewall/files/4.6/shorewall.systemd
--- old/net-firewall/shorewall/files/4.6/shorewall.systemd	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/files/4.6/shorewall.systemd	2014-09-24 17:28:51.000000000 +0200
@@ -0,0 +1,19 @@
+#
+#	The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.6
+#
+[Unit]
+Description=Shorewall IPv4 firewall
+Documentation=man:shorewall(8) http://www.shorewall.net/Documentation_Index.html
+After=network.target
+Conflicts=iptables.service firewalld.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/conf.d/shorewall
+StandardOutput=syslog
+ExecStart=/sbin/shorewall $OPTIONS start $STARTOPTIONS
+ExecStop=/sbin/shorewall $OPTIONS stop $STOPOPTIONS
+
+[Install]
+WantedBy=basic.target
diff -rupN old/net-firewall/shorewall/metadata.xml new/net-firewall/shorewall/metadata.xml
--- old/net-firewall/shorewall/metadata.xml	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/metadata.xml	2014-08-26 10:20:48.000000000 +0200
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<herd>netmon</herd>
+	<herd>proxy-maintainers</herd>
+	<maintainer>
+		<email>[e-mail]</email>
+		<name>Thomas D. (Whissi)</name>
+	</maintainer>
+	<use>
+		<flag name="init">Adds the capability to place the firewall in a safe state prior to bringing up the network interfaces</flag>
+		<flag name="ipv4">Installs everything needed to create a full IPv4 firewall</flag>
+		<flag name="ipv6">Adds the capability to create a full IPv6 firewall (requires <pkg>net-firewall/shorewall[ipv4]</pkg>)</flag>
+		<flag name="lite4">Installs everything needed to just *run* an IPv4 compiled firewall script created with <pkg>net-firewall/shorewall[ipv4]</pkg></flag>
+		<flag name="lite6">Installs everything needed to just *run* an IPv6 compiled firewall script created with <pkg>net-firewall/shorewall[ipv6]</pkg></flag>
+	</use>
+</pkgmetadata>
diff -rupN old/net-firewall/shorewall/shorewall-4.6.3.4.ebuild new/net-firewall/shorewall/shorewall-4.6.3.4.ebuild
--- old/net-firewall/shorewall/shorewall-4.6.3.4.ebuild	1970-01-01 01:00:00.000000000 +0100
+++ new/net-firewall/shorewall/shorewall-4.6.3.4.ebuild	2014-09-19 14:22:15.000000000 +0200
@@ -0,0 +1,381 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+EAPI="5"
+
+inherit eutils linux-info prefix systemd versionator
+
+DESCRIPTION='The Shoreline Firewall, commonly known as Shorewall, is'
+DESCRIPTION+=' a high-level tool for configuring Netfilter'
+HOMEPAGE="http://www.shorewall.net/"
+
+MY_URL_PREFIX=
+case ${P} in
+	*_beta* | \
+	*_rc*)
+		MY_URL_PREFIX='development/'
+		;;
+esac
+
+MY_PV=${PV/_rc/-RC}
+MY_PV=${MY_PV/_beta/-Beta}
+MY_P=${PN}-${MY_PV}
+MY_P_IPV4=shorewall-${MY_PV}
+MY_P_IPV6=shorewall6-${MY_PV}
+MY_P_LITE4=shorewall-lite-${MY_PV}
+MY_P_LITE6=shorewall6-lite-${MY_PV}
+MY_P_INIT=shorewall-init-${MY_PV}
+MY_P_CORE=shorewall-core-${MY_PV}
+MY_P_DOCS=shorewall-docs-html-${MY_PV}
+
+MY_MAJOR_RELEASE_NUMBER=$(get_version_component_range 1-2)
+MY_MAJORMINOR_RELEASE_NUMBER=$(get_version_component_range 1-3)
+
+SRC_URI="
+	http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall-core-${MY_PV}.tar.bz2
+	ipv4? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall-${MY_PV}.tar.bz2 )
+	ipv6? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall6-${MY_PV}.tar.bz2 )
+	lite4? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall-lite-${MY_PV}.tar.bz2 )
+	lite6? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall6-lite-${MY_PV}.tar.bz2 )
+	init? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/shorewall-init-${MY_PV}.tar.bz2 )
+	doc? ( http://www.shorewall.net/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}/${MY_P_DOCS}.tar.bz2 )
+"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
+IUSE="doc init +ipv4 ipv6 lite4 lite6"
+
+# - Shorewall6 requires Shorewall
+# - Installing Shorewall-init or just the documentation doesn't any sense,
+#   that's why we force the user to select at least one "real" Shorewall product
+#
+# See http://shorewall.net/download.htm#Which
+REQUIRED_USE="
+	ipv6? ( ipv4 )
+	|| ( ipv4 lite4 lite6 )
+"
+
+# No build dependencies! Just plain shell scripts...
+DEPEND=""
+
+RDEPEND="
+	>=net-firewall/iptables-1.4.20
+	>=sys-apps/iproute2-3.8.0[-minimal]
+	>=sys-devel/bc-1.06.95
+	ipv4? (
+		>=dev-lang/perl-5.16
+		virtual/perl-Digest-SHA
+	)
+	ipv6? (
+		>=dev-perl/Socket6-0.230.0
+		>=net-firewall/iptables-1.4.20[ipv6]
+		>=sys-apps/iproute2-3.8.0[ipv6]
+	)
+	lite6? (
+		>=net-firewall/iptables-1.4.20[ipv6]
+		>=sys-apps/iproute2-3.8.0[ipv6]
+	)
+	init? ( >=sys-apps/coreutils-8.20 )
+	!net-firewall/shorewall-core
+	!net-firewall/shorewall6
+	!net-firewall/shorewall-lite
+	!net-firewall/shorewall6-lite
+	!net-firewall/shorewall-init
+	!<sys-apps/openrc-0.13
+"
+
+S=${WORKDIR}
+
+pkg_pretend() {
+	local CONFIG_CHECK="~NF_CONNTRACK"
+
+	local WARNING_CONNTRACK="Without NF_CONNTRACK support, you will be unable"
+	local WARNING_CONNTRACK+=" to run any shorewall-based firewall on the local system."
+
+	if use ipv4 || use lite4; then
+		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4"
+
+		local WARNING_CONNTRACK_IPV4="Without NF_CONNTRACK_IPV4 support, you will"
+		local WARNING_CONNTRACK_IPV4+=" be unable to run any shorewall-based IPv4 firewall on the local system."
+	fi
+
+	if use ipv6 || use lite6; then
+		CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV6"
+
+		local WARNING_CONNTRACK_IPV6="Without NF_CONNTRACK_IPV6 support, you will"
+		local WARNING_CONNTRACK_IPV6+=" be unable to run any shorewall-based IPv6 firewall on the local system."
+	fi
+
+	check_extra_config
+}
+
+src_prepare() {
+	einfo "Preparing shorewallrc ..."
+	cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewallrc "${S}"/shorewallrc.gentoo || die "Copying shorewallrc failed"
+	eprefixify "${S}"/shorewallrc.gentoo
+
+	# shorewall-core
+	ebegin "Applying Gentoo-specific changes to ${MY_P_CORE}"
+	ln -s ../shorewallrc.gentoo ${MY_P_CORE}/shorewallrc.gentoo
+	eend 0
+
+	# shorewall
+	if use ipv4; then
+		ebegin "Applying Gentoo-specific changes to ${MY_P_IPV4}"
+		ln -s ../shorewallrc.gentoo ${MY_P_IPV4}/shorewallrc.gentoo
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall.confd "${S}"/${MY_P_IPV4}/default.gentoo || die "Copying shorewall.confd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall.initd "${S}"/${MY_P_IPV4}/init.gentoo.sh || die "Copying shorewall.initd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall.systemd "${S}"/${MY_P_IPV4}/gentoo.service || die "Copying shorewall.systemd failed"
+		eend 0
+	fi
+
+	# shorewall6
+	if use ipv6; then
+		ebegin "Applying Gentoo-specific changes to ${MY_P_IPV6}"
+		ln -s ../shorewallrc.gentoo ${MY_P_IPV6}/shorewallrc.gentoo
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6.confd "${S}"/${MY_P_IPV6}/default.gentoo || die "Copying shorewall6.confd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6.initd "${S}"/${MY_P_IPV6}/init.gentoo.sh || die "Copying shorewall6.initd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6.systemd "${S}"/${MY_P_IPV6}/gentoo.service || die "Copying shorewall6.systemd failed"
+		eend 0
+	fi
+
+	# shorewall-lite
+	if use lite4; then
+		ebegin "Applying Gentoo-specific changes to ${MY_P_LITE4}"
+		ln -s ../shorewallrc.gentoo ${MY_P_LITE4}/shorewallrc.gentoo
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-lite.confd "${S}"/${MY_P_LITE4}/default.gentoo || die "Copying shorewall-lite.confd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-lite.initd "${S}"/${MY_P_LITE4}/init.gentoo.sh || die "Copying shorewall-lite.initd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-lite.systemd "${S}"/${MY_P_LITE4}/gentoo.service || die "Copying shorewall-lite.systemd failed"
+		eend 0
+	fi
+
+	# shorewall6-lite
+	if use lite6; then
+		ebegin "Applying Gentoo-specific changes to ${MY_P_LITE6}"
+		ln -s ../shorewallrc.gentoo ${MY_P_LITE6}/shorewallrc.gentoo
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6-lite.confd "${S}"/${MY_P_LITE6}/default.gentoo || die "Copying shorewall6-lite.confd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6-lite.initd "${S}"/${MY_P_LITE6}/init.gentoo.sh || die "Copying shorewall6-lite.initd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall6-lite.systemd "${S}"/${MY_P_LITE6}/gentoo.service || die "Copying shorewall6-lite.systemd failed"
+		eend 0
+	fi
+
+	# shorewall-init
+	if use init; then
+		ebegin "Applying Gentoo-specific changes to ${MY_P_INIT}"
+		ln -s ../shorewallrc.gentoo ${MY_P_INIT}/shorewallrc.gentoo
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-init.confd "${S}"/${MY_P_INIT}/default.gentoo || die "Copying shorewall-init.confd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-init.initd "${S}"/${MY_P_INIT}/init.gentoo.sh || die "Copying shorewall-init.initd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-init.systemd "${S}"/${MY_P_INIT}/gentoo.service || die "Copying shorewall-init.systemd failed"
+		cp "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-init.readme "${S}"/${MY_P_INIT}/shorewall-init.README.Gentoo.txt || die "Copying shorewall-init.systemd failed"
+		eend 0
+
+		eprefixify "${S}"/${MY_P_INIT}/init.gentoo.sh
+
+		cd "${S}"/${MY_P_INIT}
+		epatch "${FILESDIR}"/${MY_MAJOR_RELEASE_NUMBER}/shorewall-init-01_remove-ipset-functionality.patch
+		cd "${S}"
+	fi
+
+	epatch_user
+}
+
+src_configure() {
+	:;
+}
+
+src_compile() {
+	:;
+}
+
+src_install() {
+	# shorewall-core
+	einfo "Installing ${MY_P_CORE} ..."
+	DESTDIR="${D%/}" ${MY_P_CORE}/install.sh shorewallrc.gentoo || die "${MY_P_CORE}/install.sh failed"
+	dodoc "${S}"/${MY_P_CORE}/changelog.txt "${S}"/${MY_P_CORE}/releasenotes.txt
+
+	# shorewall
+	if use ipv4; then
+		einfo "Installing ${MY_P_IPV4} ..."
+		keepdir /var/lib/shorewall
+		DESTDIR="${D%/}" ${MY_P_IPV4}/install.sh shorewallrc.gentoo || die "${MY_P_IPV4}/install.sh failed"
+
+		if use doc; then
+			dodoc -r "${S}"/${MY_P_IPV4}/Samples
+		fi
+	fi
+
+	# shorewall6
+	if use ipv6; then
+		einfo "Installing ${MY_P_IPV6} ..."
+		keepdir /var/lib/shorewall6
+		DESTDIR="${D%/}" ${MY_P_IPV6}/install.sh shorewallrc.gentoo || die "${MY_P_IPV6}/install.sh failed"
+
+		if use doc; then
+			dodoc -r "${S}"/${MY_P_IPV6}/Samples6
+		fi
+	fi
+
+	# shorewall-lite
+	if use lite4; then
+		einfo "Installing ${MY_P_LITE4} ..."
+		keepdir /var/lib/shorewall-lite
+		DESTDIR="${D%/}" ${MY_P_LITE4}/install.sh shorewallrc.gentoo || die "${MY_P_LITE4}/install.sh failed"
+	fi
+
+	# shorewall6-lite
+	if use lite6; then
+		einfo "Installing ${MY_P_LITE6} ..."
+		keepdir /var/lib/shorewall6-lite
+		DESTDIR="${D%/}" ${MY_P_LITE6}/install.sh shorewallrc.gentoo || die "${MY_P_LITE6}/install.sh failed"
+	fi
+
+	# shorewall-init
+	if use init; then
+		einfo "Installing ${MY_P_INIT} ..."
+		DESTDIR="${D%/}" ${MY_P_INIT}/install.sh shorewallrc.gentoo || die "${MY_P_INIT}/install.sh failed"
+		dodoc "${S}"/${MY_P_INIT}/shorewall-init.README.Gentoo.txt
+
+		if [ -f "${D}etc/logrotate.d/shorewall-init" ]; then
+			# On Gentoo, shorewall-init will not create shorewall-ifupdown.log,
+			# so we don't need a logrotate folder at all
+			einfo "Removing unused \"${D}etc/logrotate.d/shorewall-init\" ..."
+			rm -rf "${D}"etc/logrotate.d/shorewall-init || die "Removing \"${D}etc/logrotate.d/shorewall-init\" failed"
+		fi
+
+		if [ -d "${D}etc/NetworkManager" ]; then
+			# On Gentoo, we don't support NetworkManager
+			# so we don't need this folder at all
+			einfo "Removing unused \"${D}etc/NetworkManager\" ..."
+			rm -rf "${D}"etc/NetworkManager || die "Removing \"${D}etc/NetworkManager\" failed"
+		fi
+
+		if [ -f "${D}usr/share/shorewall-init/ifupdown" ]; then
+			# This script isn't supported on Gentoo
+			rm -rf "${D}"usr/share/shorewall-init/ifupdown || die "Removing \"${D}usr/share/shorewall-init/ifupdown\" failed"
+		fi
+	fi
+
+	if use doc; then
+		einfo "Installing ${MY_P_DOCS} ..."
+		dohtml -r "${S}"/${MY_P_DOCS}
+	fi
+}
+
+pkg_postinst() {
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		# This is a new installation
+
+		# Show first steps for shorewall/shorewall6
+		local _PRODUCTS=""
+		if use ipv4; then
+			_PRODUCTS="shorewall"
+
+			if use ipv6; then
+				_PRODUCTS="${_PRODUCTS}/shorewall6"
+			fi
+		fi
+
+		if [[ -n "${_PRODUCTS}" ]]; then
+			elog "Before you can use ${_PRODUCTS}, you need to edit its configuration in:"
+			elog ""
+			elog "  /etc/shorewall/shorewall.conf"
+
+			if use ipv6; then
+				elog "  /etc/shorewall6/shorewall6.conf"
+			fi
+
+			elog ""
+			elog "To activate your shorewall-based firewall on system start, please add ${_PRODUCTS} to your default runlevel:"
+			elog ""
+			elog "  # rc-update add shorewall default"
+
+			if use ipv6; then
+				elog "  # rc-update add shorewall6 default"
+			fi
+		fi
+
+		# Show first steps for shorewall-lite/shorewall6-lite
+		_PRODUCTS=""
+		if use lite4; then
+			_PRODUCTS="shorewall-lite"
+		fi
+
+		if use lite6; then
+			if [[ -z "${_PRODUCTS}" ]]; then
+				_PRODUCTS="shorewall6-lite"
+			else
+				_PRODUCTS="${_PRODUCTS}/shorewall6-lite"
+			fi
+		fi
+
+		if [[ -n "${_PRODUCTS}" ]]; then
+			if use ipv4; then
+				elog ""
+			fi
+
+			elog "Before you can use ${_PRODUCTS}, you need to provide a configuration, which you can"
+			elog "create using ${CATEGORY}/shorewall (with \"ipv4\" and or \"ipv6\" USE flag)."
+			elog ""
+			elog "To read more about ${_PRODUCTS}, please visit"
+			elog "  http://shorewall.net/CompiledPrograms.html"
+			elog ""
+			elog "To activate your shorewall-lite-based firewall on system start, please add ${PRODUCTS} to your default runlevel:"
+			elog ""
+
+			if use lite4; then
+				elog "  # rc-update add shorewall-lite default"
+			fi
+
+			if use lite6; then
+				elog "  # rc-update add shorewall6-lite default"
+			fi
+		fi
+
+		if use init; then
+			elog ""
+			elog "To secure your system on boot, please add shorewall-init to your boot runlevel:"
+			elog ""
+			elog "  # rc-update add shorewall-init boot"
+			elog ""
+			elog "and define \$PRODUCTS in"
+			elog ""
+			elog "  /etc/conf.d/shorewall-init"
+		fi
+
+	fi
+
+	if [[ -n "${REPLACING_VERSIONS}" && ${REPLACING_VERSIONS} < 4.6 ]]; then
+		# This is an upgrade
+
+		elog "You are upgrading from a previous major version. It is highly recommended that you read"
+		elog ""
+		elog "  - /usr/share/doc/shorewall*/releasenotes.tx*"
+		elog "  - http://shorewall.net/upgrade_issues.htm#idp8704902640"
+
+		if use ipv4; then
+			elog ""
+			elog "You can auto-migrate your configuration using"
+			elog ""
+			elog "  # shorewall update -A"
+
+			if use ipv6; then
+				elog "  # shorewall6 update -A"
+			fi
+
+			elog ""
+			elog "But if you are not familiar with the \"shorewall[6] update\" command,"
+			elog "please read the shorewall[6] man page first."
+		fi
+	fi
+
+	if ! use init; then
+		elog ""
+		elog "Consider emerging ${CATEGORY}/${PN} with USE flag \"init\" to secure your system on boot"
+		elog "before your shorewall-based firewall is ready to start."
+		elog ""
+		elog "To read more about shorewall-init, please visit"
+		elog "  http://www.shorewall.net/Shorewall-init.html"
+	fi
+}