net-firewall/shorewall/shorewall-5.2.4.4.ebuild

   1 # Copyright 1999-2020 Gentoo Authors
   2 # Distributed under the terms of the GNU General Public License v2
   3
   4 EAPI="7"
   5
   6 inherit linux-info prefix systemd
   7
   8 DESCRIPTION='A high-level tool for configuring Netfilter'
   9 HOMEPAGE="https://shorewall.org/"
  10 LICENSE="GPL-2"
  11 SLOT="0"
  12 IUSE="doc +init +ipv4 ipv6 lite4 lite6 selinux"
  13
  14 MY_PV=${PV/_rc/-RC}
  15 MY_PV=${MY_PV/_beta/-Beta}
  16 MY_P=${PN}-${MY_PV}
  17
  18 MY_MAJOR_RELEASE_NUMBER=$(ver_cut 1-2)
  19 MY_MAJORMINOR_RELEASE_NUMBER=$(ver_cut 1-3)
  20
  21 # shorewall
  22 MY_PN_IPV4=Shorewall
  23 MY_P_IPV4=${MY_PN_IPV4/#S/s}-${MY_PV}
  24
  25 # shorewall6
  26 MY_PN_IPV6=Shorewall6
  27 MY_P_IPV6=${MY_PN_IPV6/#S/s}-${MY_PV}
  28
  29 # shorewall-lite
  30 MY_PN_LITE4=Shorewall-lite
  31 MY_P_LITE4=${MY_PN_LITE4/#S/s}-${MY_PV}
  32
  33 # shorewall6-lite
  34 MY_PN_LITE6=Shorewall6-lite
  35 MY_P_LITE6=${MY_PN_LITE6/#S/s}-${MY_PV}
  36
  37 # shorewall-init
  38 MY_PN_INIT=Shorewall-init
  39 MY_P_INIT=${MY_PN_INIT/#S/s}-${MY_PV}
  40
  41 # shorewall-core
  42 MY_PN_CORE=Shorewall-core
  43 MY_P_CORE=${MY_PN_CORE/#S/s}-${MY_PV}
  44
  45 # shorewall-docs-html
  46 MY_PN_DOCS=Shorewall-docs-html
  47 MY_P_DOCS=${MY_PN_DOCS/#S/s}-${MY_PV}
  48
  49 # Upstream URL schema:
  50 # Beta:    $MIRROR/pub/shorewall/development/4.6/shorewall-4.6.4-Beta2/shorewall-4.6.4-Beta2.tar.bz2
  51 # RC:      $MIRROR/pub/shorewall/development/4.6/shorewall-4.6.4-RC1/shorewall-4.6.4-RC1.tar.bz2
  52 # Release: $MIRROR/pub/shorewall/4.6/shorewall-4.6.3/shorewall-4.6.3.3.tar.bz2
  53
  54 MY_URL_PREFIX=
  55 MY_URL_SUFFIX=
  56 if [[ ${MY_PV} = *-Beta* ]] || [[ ${MY_PV} = *-RC* ]]; then
  57         MY_URL_PREFIX='development/'
  58
  59         if [[ ${MY_PV} = *-Beta* ]] ; then
  60                 MY_URL_SUFFIX="-Beta${MY_PV##*-Beta}"
  61         elif [[ ${MY_PV} = *-RC* ]] ; then
  62                 MY_URL_SUFFIX="-RC${MY_PV##*-RC}"
  63         fi
  64
  65         # Cleaning up temporary variables
  66         unset _tmp_last_index
  67         unset _tmp_suffix
  68 else
  69         KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
  70 fi
  71
  72 SRC_URI="
  73         https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-core-${MY_PV}.tar.bz2
  74         ipv4? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-${MY_PV}.tar.bz2 )
  75         ipv6? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall6-${MY_PV}.tar.bz2 )
  76         lite4? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-lite-${MY_PV}.tar.bz2 )
  77         lite6? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall6-lite-${MY_PV}.tar.bz2 )
  78         init? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/shorewall-init-${MY_PV}.tar.bz2 )
  79         doc? ( https://shorewall.org/pub/shorewall/${MY_URL_PREFIX}${MY_MAJOR_RELEASE_NUMBER}/shorewall-${MY_MAJORMINOR_RELEASE_NUMBER}${MY_URL_SUFFIX}/${MY_P_DOCS}.tar.bz2 )
  80 "
  81
  82 # - Shorewall6 requires Shorewall
  83 # - Installing Shorewall-init or just the documentation doesn't make any sense,
  84 #   that's why we force the user to select at least one "real" Shorewall product
  85 #
  86 # See https://shorewall.org/download.htm#Which
  87 REQUIRED_USE="
  88         ipv6? ( ipv4 )
  89         || ( ipv4 lite4 lite6 )
  90 "
  91
  92 # No build dependencies! Just plain shell scripts...
  93 DEPEND=""
  94
  95 RDEPEND="
  96         >=net-firewall/iptables-1.4.20
  97         >=sys-apps/iproute2-3.8.0[-minimal]
  98         >=sys-devel/bc-1.06.95
  99         ipv4? (
 100                 >=dev-lang/perl-5.16
 101                 virtual/perl-Digest-SHA
 102         )
 103         ipv6? (
 104                 >=dev-perl/Socket6-0.230.0
 105                 >=net-firewall/iptables-1.4.20[ipv6]
 106                 >=sys-apps/iproute2-3.8.0[ipv6]
 107         )
 108         lite6? (
 109                 >=net-firewall/iptables-1.4.20[ipv6]
 110                 >=sys-apps/iproute2-3.8.0[ipv6]
 111         )
 112         init? ( >=sys-apps/coreutils-8.20 )
 113         selinux? ( >=sec-policy/selinux-shorewall-2.20161023-r3 )
 114         !net-firewall/shorewall-core
 115         !net-firewall/shorewall6
 116         !net-firewall/shorewall-lite
 117         !net-firewall/shorewall6-lite
 118         !net-firewall/shorewall-init
 119         !<sys-apps/systemd-214
 120 "
 121
 122 S=${WORKDIR}
 123
 124 pkg_pretend() {
 125         local CONFIG_CHECK="~NF_CONNTRACK"
 126
 127         local WARNING_CONNTRACK="Without NF_CONNTRACK support, you will be unable"
 128         local WARNING_CONNTRACK+=" to run any shorewall-based firewall on the local system."
 129
 130         # kernel >=4.19 has unified NF_CONNTRACK module, bug 671176
 131         if kernel_is -lt 4 19; then
 132                 if use ipv4 || use lite4; then
 133                         CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV4"
 134
 135                         local WARNING_CONNTRACK_IPV4="Without NF_CONNTRACK_IPV4 support, you will"
 136                         local WARNING_CONNTRACK_IPV4+=" be unable to run any shorewall-based IPv4 firewall on the local system."
 137                 fi
 138
 139                 if use ipv6 || use lite6; then
 140                         CONFIG_CHECK="${CONFIG_CHECK} ~NF_CONNTRACK_IPV6"
 141
 142                         local WARNING_CONNTRACK_IPV6="Without NF_CONNTRACK_IPV6 support, you will"
 143                         local WARNING_CONNTRACK_IPV6+=" be unable to run any shorewall-based IPv6 firewall on the local system."
 144                 fi
 145         fi
 146
 147         check_extra_config
 148 }
 149
 150 pkg_setup() {
 151         if [[ -n "${DIGEST}" ]]; then
 152                 einfo "Unsetting environment variable \"DIGEST\" to prevent conflicts with package's \"install.sh\" script ..."
 153                 unset DIGEST
 154         fi
 155 }
 156
 157 src_prepare() {
 158         # We are moving each unpacked source from MY_P_* to MY_PN_*.
 159         # This allows us to use patches from upstream and keeps epatch_user working
 160
 161         einfo "Preparing shorewallrc ..."
 162         cp "${FILESDIR}"/shorewallrc-r3 "${S}"/shorewallrc.gentoo || die "Copying shorewallrc failed"
 163         eprefixify "${S}"/shorewallrc.gentoo
 164         sed -i \
 165                 -e "s|SERVICEDIR=tbs|SERVICEDIR=$(systemd_get_systemunitdir)|" \
 166                 "${S}"/shorewallrc.gentoo || die "Failed to update shorewallrc"
 167
 168         # shorewall-core
 169         mv "${S}"/${MY_P_CORE} "${S}"/${MY_PN_CORE} || die "Failed to move '${S}/${MY_P_CORE}' to '${S}/${MY_PN_CORE}'"
 170         ebegin "Applying Gentoo-specific changes to ${MY_P_CORE} ..."
 171         ln -s ../shorewallrc.gentoo ${MY_PN_CORE}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 172         eend 0
 173
 174         pushd "${S}"/${MY_PN_CORE} &>/dev/null || die
 175         eapply "${FILESDIR}"/shorewall-core-5.2.1-no-gzipped-manpages.patch
 176         popd &>/dev/null || die
 177
 178         # shorewall
 179         if use ipv4; then
 180                 mv "${S}"/${MY_P_IPV4} "${S}"/${MY_PN_IPV4} || die "Failed to move '${S}/${MY_P_IPV4}' to '${S}/${MY_PN_IPV4}'"
 181                 ebegin "Applying Gentoo-specific changes to ${MY_P_IPV4}"
 182                 ln -s ../shorewallrc.gentoo ${MY_PN_IPV4}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 183                 cp "${FILESDIR}"/shorewall.confd-r1 "${S}"/${MY_PN_IPV4}/default.gentoo || die "Copying shorewall.confd-r1 failed"
 184                 cp "${FILESDIR}"/shorewall.initd-r3 "${S}"/${MY_PN_IPV4}/init.gentoo.sh || die "Copying shorewall.initd-r2 failed"
 185                 cp "${FILESDIR}"/shorewall.systemd "${S}"/${MY_PN_IPV4}/gentoo.service || die "Copying shorewall.systemd failed"
 186                 eend 0
 187
 188                 pushd "${S}"/${MY_PN_IPV4} &>/dev/null || die
 189                 eapply "${FILESDIR}"/shorewall-5.2.1-no-gzipped-manpages.patch
 190                 popd &>/dev/null || die
 191         fi
 192
 193         # shorewall6
 194         if use ipv6; then
 195                 mv "${S}"/${MY_P_IPV6} "${S}"/${MY_PN_IPV6} || die "Failed to move '${S}/${MY_P_IPV6}' to '${S}/${MY_PN_IPV6}'"
 196                 ebegin "Applying Gentoo-specific changes to ${MY_P_IPV6}"
 197                 ln -s ../shorewallrc.gentoo ${MY_PN_IPV6}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 198                 cp "${FILESDIR}"/shorewall.confd-r1 "${S}"/${MY_PN_IPV6}/default.gentoo || die "Copying shorewall.confd-r1 failed"
 199                 cp "${FILESDIR}"/shorewall.initd-r3 "${S}"/${MY_PN_IPV6}/init.gentoo.sh || die "Copying shorewall.initd-r2 failed"
 200                 cp "${FILESDIR}"/shorewall6.systemd "${S}"/${MY_PN_IPV6}/gentoo.service || die "Copying shorewall6.systemd failed"
 201                 eend 0
 202
 203                 pushd "${S}"/${MY_PN_IPV6} &>/dev/null || die
 204                 eapply "${FILESDIR}"/shorewall-5.2.1-no-gzipped-manpages.patch
 205                 popd &>/dev/null || die
 206         fi
 207
 208         # shorewall-lite
 209         if use lite4; then
 210                 mv "${S}"/${MY_P_LITE4} "${S}"/${MY_PN_LITE4} || die "Failed to move '${S}/${MY_P_LITE4}' to '${S}/${MY_PN_LITE4}'"
 211                 ebegin "Applying Gentoo-specific changes to ${MY_P_LITE4}"
 212                 ln -s ../shorewallrc.gentoo ${MY_PN_LITE4}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 213                 cp "${FILESDIR}"/shorewall-lite.confd-r1 "${S}"/${MY_PN_LITE4}/default.gentoo || die "Copying shorewall-lite.confd-r1 failed"
 214                 cp "${FILESDIR}"/shorewall-lite.initd-r3 "${S}"/${MY_PN_LITE4}/init.gentoo.sh || die "Copying shorewall-lite.initd-r2 failed"
 215                 cp "${FILESDIR}"/shorewall-lite.systemd "${S}"/${MY_PN_LITE4}/gentoo.service || die "Copying shorewall-lite.systemd failed"
 216                 eend 0
 217
 218                 pushd "${S}"/${MY_PN_LITE4} &>/dev/null || die
 219                 eapply "${FILESDIR}"/shorewall-lite-5.2.1-no-gzipped-manpages.patch
 220                 popd &>/dev/null || die
 221         fi
 222
 223         # shorewall6-lite
 224         if use lite6; then
 225                 mv "${S}"/${MY_P_LITE6} "${S}"/${MY_PN_LITE6} || die "Failed to move '${S}/${MY_P_LITE6}' to '${S}/${MY_PN_LITE6}'"
 226                 ebegin "Applying Gentoo-specific changes to ${MY_P_LITE6}"
 227                 ln -s ../shorewallrc.gentoo ${MY_PN_LITE6}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 228                 cp "${FILESDIR}"/shorewall-lite.confd-r1 "${S}"/${MY_PN_LITE6}/default.gentoo || die "Copying shorewall-lite.confd-r1 failed"
 229                 cp "${FILESDIR}"/shorewall-lite.initd-r3 "${S}"/${MY_PN_LITE6}/init.gentoo.sh || die "Copying shorewall-lite.initd-r2 failed"
 230                 cp "${FILESDIR}"/shorewall6-lite.systemd "${S}"/${MY_PN_LITE6}/gentoo.service || die "Copying shorewall6-lite.systemd failed"
 231                 eend 0
 232
 233                 pushd "${S}"/${MY_PN_LITE6} &>/dev/null || die
 234                 eapply "${FILESDIR}"/shorewall-lite-5.2.1-no-gzipped-manpages.patch
 235                 popd &>/dev/null || die
 236         fi
 237
 238         # shorewall-init
 239         if use init; then
 240                 mv "${S}"/${MY_P_INIT} "${S}"/${MY_PN_INIT} || die "Failed to move '${S}/${MY_P_INIT}' to '${S}/${MY_PN_INIT}'"
 241                 ebegin "Applying Gentoo-specific changes to ${MY_P_INIT}"
 242                 ln -s ../shorewallrc.gentoo ${MY_PN_INIT}/shorewallrc.gentoo || die "Failed to symlink shorewallrc.gentoo"
 243                 cp "${FILESDIR}"/shorewall-init.confd "${S}"/${MY_PN_INIT}/default.gentoo || die "Copying shorewall-init.confd failed"
 244                 cp "${FILESDIR}"/shorewall-init.initd "${S}"/${MY_PN_INIT}/init.gentoo.sh || die "Copying shorewall-init.initd failed"
 245                 cp "${FILESDIR}"/shorewall-init.systemd "${S}"/${MY_PN_INIT}/gentoo.service || die "Copying shorewall-init.systemd failed"
 246                 cp "${FILESDIR}"/shorewall-init.readme "${S}"/${MY_PN_INIT}/shorewall-init.README.Gentoo.txt || die "Copying shorewall-init.systemd failed"
 247                 eend 0
 248
 249                 eprefixify "${S}"/${MY_PN_INIT}/init.gentoo.sh
 250
 251                 pushd "${S}"/${MY_PN_INIT} &>/dev/null || die
 252                 eapply -p2 "${FILESDIR}"/shorewall-init-01_remove-ipset-functionality-r2.patch
 253                 popd &>/dev/null || die
 254         fi
 255
 256         # shorewall-docs-html
 257         if use doc; then
 258                 mv "${S}"/${MY_P_DOCS} "${S}"/${MY_PN_DOCS} || die "Failed to move '${S}/${MY_P_DOCS}' to '${S}/${MY_PN_DOCS}'"
 259         fi
 260
 261         eapply_user
 262 }
 263
 264 src_configure() {
 265         :;
 266 }
 267
 268 src_compile() {
 269         :;
 270 }
 271
 272 src_install() {
 273         # shorewall-core
 274         einfo "Installing ${MY_P_CORE} ..."
 275         DESTDIR="${ED}" ${MY_PN_CORE}/install.sh shorewallrc.gentoo || die "${MY_PN_CORE}/install.sh failed"
 276         dodoc "${S}"/${MY_PN_CORE}/changelog.txt "${S}"/${MY_PN_CORE}/releasenotes.txt
 277
 278         # shorewall
 279         if use ipv4; then
 280                 einfo "Installing ${MY_P_IPV4} ..."
 281                 DESTDIR="${ED}" ${MY_PN_IPV4}/install.sh shorewallrc.gentoo || die "${MY_PN_IPV4}/install.sh failed"
 282                 keepdir /var/lib/shorewall
 283
 284                 if use doc; then
 285                         dodoc -r "${S}"/${MY_PN_IPV4}/Samples
 286                 fi
 287         fi
 288
 289         # shorewall6
 290         if use ipv6; then
 291                 einfo "Installing ${MY_P_IPV6} ..."
 292                 DESTDIR="${ED}" ${MY_PN_IPV6}/install.sh shorewallrc.gentoo || die "${MY_PN_IPV6}/install.sh failed"
 293                 keepdir /var/lib/shorewall6
 294
 295                 if use doc; then
 296                         dodoc -r "${S}"/${MY_PN_IPV6}/Samples6
 297                 fi
 298         fi
 299
 300         # shorewall-lite
 301         if use lite4; then
 302                 einfo "Installing ${MY_P_LITE4} ..."
 303                 DESTDIR="${ED}" ${MY_PN_LITE4}/install.sh shorewallrc.gentoo || die "${MY_PN_LITE4}/install.sh failed"
 304                 keepdir /var/lib/shorewall-lite
 305         fi
 306
 307         # shorewall6-lite
 308         if use lite6; then
 309                 einfo "Installing ${MY_P_LITE6} ..."
 310                 DESTDIR="${ED}" ${MY_PN_LITE6}/install.sh shorewallrc.gentoo || die "${MY_PN_LITE6}/install.sh failed"
 311                 keepdir /var/lib/shorewall6-lite
 312         fi
 313
 314         # shorewall-init
 315         if use init; then
 316                 einfo "Installing ${MY_P_INIT} ..."
 317                 DESTDIR="${ED}" ${MY_PN_INIT}/install.sh shorewallrc.gentoo || die "${MY_PN_INIT}/install.sh failed"
 318                 dodoc "${S}"/${MY_PN_INIT}/shorewall-init.README.Gentoo.txt
 319
 320                 if [[ -f "${ED}/etc/logrotate.d/shorewall-init" ]]; then
 321                         # On Gentoo, shorewall-init will not create shorewall-ifupdown.log,
 322                         # so we don't need a logrotate configuration file for shorewall-init
 323                         einfo "Removing unused \"${ED}/etc/logrotate.d/shorewall-init\" ..."
 324                         rm -rf "${ED}"/etc/logrotate.d/shorewall-init || die "Removing \"${ED}/etc/logrotate.d/shorewall-init\" failed"
 325                 fi
 326
 327                 if [[ -d "${ED}/etc/NetworkManager" ]]; then
 328                         # On Gentoo, we don't support NetworkManager
 329                         # so we don't need this folder at all
 330                         einfo "Removing unused \"${ED}/etc/NetworkManager\" ..."
 331                         rm -rf "${ED}"/etc/NetworkManager || die "Removing \"${ED}/etc/NetworkManager\" failed"
 332                 fi
 333
 334                 if [[ -f "${ED}/usr/share/shorewall-init/ifupdown" ]]; then
 335                         # This script isn't supported on Gentoo
 336                         rm -rf "${ED}"/usr/share/shorewall-init/ifupdown || die "Removing \"${ED}/usr/share/shorewall-init/ifupdown\" failed"
 337                 fi
 338         fi
 339
 340         if use doc; then
 341                 einfo "Installing ${MY_P_DOCS} ..."
 342                 docinto html && dodoc -r "${S}"/${MY_PN_DOCS}/*
 343         fi
 344 }
 345
 346 pkg_postinst() {
 347         if [[ -z "${REPLACING_VERSIONS}" ]]; then
 348                 # This is a new installation
 349
 350                 # Show first steps for shorewall/shorewall6
 351                 local _PRODUCTS=""
 352                 if use ipv4; then
 353                         _PRODUCTS="shorewall"
 354
 355                         if use ipv6; then
 356                                 _PRODUCTS="${_PRODUCTS}/shorewall6"
 357                         fi
 358                 fi
 359
 360                 if [[ -n "${_PRODUCTS}" ]]; then
 361                         elog "Before you can use ${_PRODUCTS}, you need to edit its configuration in:"
 362                         elog ""
 363                         elog "  /etc/shorewall/shorewall.conf"
 364
 365                         if use ipv6; then
 366                                 elog "  /etc/shorewall6/shorewall6.conf"
 367                         fi
 368
 369                         elog ""
 370                         elog "To activate your shorewall-based firewall on system start, please add ${_PRODUCTS} to your default runlevel:"
 371                         elog ""
 372                         elog "  # rc-update add shorewall default"
 373
 374                         if use ipv6; then
 375                                 elog "  # rc-update add shorewall6 default"
 376                         fi
 377                 fi
 378
 379                 # Show first steps for shorewall-lite/shorewall6-lite
 380                 _PRODUCTS=""
 381                 if use lite4; then
 382                         _PRODUCTS="shorewall-lite"
 383                 fi
 384
 385                 if use lite6; then
 386                         if [[ -z "${_PRODUCTS}" ]]; then
 387                                 _PRODUCTS="shorewall6-lite"
 388                         else
 389                                 _PRODUCTS="${_PRODUCTS}/shorewall6-lite"
 390                         fi
 391                 fi
 392
 393                 if [[ -n "${_PRODUCTS}" ]]; then
 394                         if use ipv4; then
 395                                 elog ""
 396                         fi
 397
 398                         elog "Before you can use ${_PRODUCTS}, you need to provide a configuration, which you can"
 399                         elog "create using ${CATEGORY}/shorewall (with \"ipv4\" and or \"ipv6\" USE flag)."
 400                         elog ""
 401                         elog "To read more about ${_PRODUCTS}, please visit"
 402                         elog "  https://shorewall.org/CompiledPrograms.html"
 403                         elog ""
 404                         elog "To activate your shorewall-lite-based firewall on system start, please add ${PRODUCTS} to your default runlevel:"
 405                         elog ""
 406
 407                         if use lite4; then
 408                                 elog "  # rc-update add shorewall-lite default"
 409                         fi
 410
 411                         if use lite6; then
 412                                 elog "  # rc-update add shorewall6-lite default"
 413                         fi
 414                 fi
 415
 416                 if use init; then
 417                         elog ""
 418                         elog "To secure your system on boot, please add shorewall-init to your boot runlevel:"
 419                         elog ""
 420                         elog "  # rc-update add shorewall-init boot"
 421                         elog ""
 422                         elog "and review \$PRODUCTS in"
 423                         elog ""
 424                         elog "  /etc/conf.d/shorewall-init"
 425                 fi
 426
 427         fi
 428
 429         local v
 430         for v in ${REPLACING_VERSIONS}; do
 431                 if ! version_is_at_least ${MY_MAJOR_RELEASE_NUMBER} ${v}; then
 432                         # This is an upgrade
 433
 434                         elog "You are upgrading from a previous major version. It is highly recommended that you read"
 435                         elog ""
 436                         elog "  - /usr/share/doc/shorewall*/releasenotes.tx*"
 437                         elog "  - https://shorewall.org/Shorewall-5.html#idm214"
 438
 439                         if use ipv4; then
 440                                 elog ""
 441                                 elog "You can auto-migrate your configuration using"
 442                                 elog ""
 443                                 elog "  # shorewall update -A"
 444
 445                                 if use ipv6; then
 446                                         elog "  # shorewall6 update -A"
 447                                 fi
 448
 449                                 elog ""
 450                                 elog "*after* you have merged the changed files using one of the configuration"
 451                                 elog "files update tools of your choice (dispatch-conf, etc-update...)."
 452
 453                                 elog ""
 454                                 elog "But if you are not familiar with the \"shorewall[6] update\" command,"
 455                                 elog "please read the shorewall[6] man page first."
 456                         fi
 457
 458                         # Show this elog only once
 459                         break
 460                 fi
 461         done
 462
 463         if ! use init; then
 464                 elog ""
 465                 elog "Consider emerging ${CATEGORY}/${PN} with USE flag \"init\" to secure your system on boot"
 466                 elog "before your shorewall-based firewall is ready to start."
 467                 elog ""
 468                 elog "To read more about shorewall-init, please visit"
 469                 elog "  https://shorewall.org/Shorewall-init.html"
 470         fi
 471
 472         if ! has_version "net-firewall/conntrack-tools"; then
 473                 elog ""
 474                 elog "Your Shorewall firewall can utilize \"conntrack\" from the \"net-firewall/conntrack-tools\""
 475                 elog "package. if you want to use this feature, you need to install \"net-firewall/conntrack-tools\"!"
 476         fi
 477
 478         if ! has_version "dev-perl/Devel-NYTProf"; then
 479                 elog ""
 480                 elog "If you want to profile your Shorewall firewall you need to install \"dev-perl/Devel-NYTProf\"!"
 481         fi
 482 }