[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[Aaron Bauman]

commit:     04a1f8c7b11f2ffbd7ed25367bc46b5e588f3d00
Author:     Michael Mair-Keimberger <m.mairkeimberger <AT> gmail <DOT> com>
AuthorDate: Sat Jan 19 09:22:49 2019 +0000
Commit:     Aaron Bauman <bman <AT> gentoo <DOT> org>
CommitDate: Wed Feb 27 05:35:29 2019 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04a1f8c7

net-vpn/libreswan: remove unused patches

Signed-off-by: Michael Mair-Keimberger <m.mairkeimberger <AT> gmail.com>
Signed-off-by: Aaron Bauman <bman <AT> gentoo.org>

 .../files/libreswan-3.23-modern-kernels.patch      | 15 ------------
 .../libreswan/files/libreswan-3.26-nss-link.patch  | 22 ------------------
 net-vpn/libreswan/files/libreswan-3.26-nss.patch   | 27 ----------------------
 3 files changed, 64 deletions(-)

diff --git a/net-vpn/libreswan/files/libreswan-3.23-modern-kernels.patch b/net-vpn/libreswan/files/libreswan-3.23-modern-kernels.patch
deleted file mode 100644
index 5dedfeb34c7..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.23-modern-kernels.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/programs/pluto/kernel_netlink.c
-b/programs/pluto/kernel_netlink.c
-index 8cec3a2..a2500f4 100644
---- a/programs/pluto/kernel_netlink.c
-+++ b/programs/pluto/kernel_netlink.c
-@@ -51,8 +51,8 @@
- #include <linux/if_addr.h>
- #include <linux/if_link.h>
-
--#include "libreswan.h" /* before xfrm.h otherwise break on F22 */
- #include "linux/xfrm.h" /* local (if configured) or system copy */
-+#include "libreswan.h" /* before xfrm.h otherwise break on F22 */
-
- #include "libreswan/pfkeyv2.h"
- #include "libreswan/pfkey.h"

diff --git a/net-vpn/libreswan/files/libreswan-3.26-nss-link.patch b/net-vpn/libreswan/files/libreswan-3.26-nss-link.patch
deleted file mode 100644
index 267aa2120db..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.26-nss-link.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From b3199806cc66de4888917ddc85b511b433e43d63 Mon Sep 17 00:00:00 2001
-From: Paul Wouters <pwouters@redhat.com>
-Date: Mon, 17 Sep 2018 11:23:11 -0400
-Subject: [PATCH] building: -lfreebl is no longer needed
-
----
- mk/config.mk | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mk/config.mk b/mk/config.mk
-index 3bd2527497..d8497c2104 100644
---- a/mk/config.mk
-+++ b/mk/config.mk
-@@ -234,7 +234,7 @@ BISONOSFLAGS?=
- NSSFLAGS?=$(shell pkg-config --cflags nss)
- # We don't want to link against every library pkg-config --libs nss
- # returns
--NSS_LDFLAGS ?= -lnss3 -lfreebl -lnssutil3
-+NSS_LDFLAGS ?= -lnss3 -lnssutil3
- NSS_SMIME_LDFLAGS ?= -lsmime3
- NSS_UTIL_LDFLAGS ?= -lnssutil3
- NSPR_LDFLAGS ?= -lnspr4

diff --git a/net-vpn/libreswan/files/libreswan-3.26-nss.patch b/net-vpn/libreswan/files/libreswan-3.26-nss.patch
deleted file mode 100644
index 89a6436a2a2..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.26-nss.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 910f69119b491c6d7abcc85cf8911d2fa012a135 Mon Sep 17 00:00:00 2001
-From: Andrew Cagney <cagney@gnu.org>
-Date: Mon, 17 Sep 2018 11:56:56 -0400
-Subject: [PATCH] ecdsa: don't include NSS's "blapi.h", no longer needed and
- not on debian
-
-(not to be confused with "lbapit.h", which also looks suspect)
-
-Follow-up b3199806cc66de4888917ddc85b511b433e43d63 and
-2d093c9fb83c8104604e4b40defa4e41129577ea.  The latter
-relaced the call to ECDSA_VerifyDigest() with PK11_Verify().
----
- programs/pluto/keys.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/programs/pluto/keys.c b/programs/pluto/keys.c
-index b3df5802cf..bd9d8d8c6c 100644
---- a/programs/pluto/keys.c
-+++ b/programs/pluto/keys.c
-@@ -72,7 +72,6 @@
- #include <secerr.h>
- #include <secport.h>
- #include <time.h>
--#include <blapi.h>
- #include "lswconf.h"
- #include "lswnss.h"
- #include "secrets.h"

[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[Aaron Bauman]

commit:     852b13c026a0af6046179504e550a9a648708afd
Author:     Michael Mair-Keimberger <m.mairkeimberger <AT> gmail <DOT> com>
AuthorDate: Sun Mar  3 16:07:05 2019 +0000
Commit:     Aaron Bauman <bman <AT> gentoo <DOT> org>
CommitDate: Mon Mar  4 03:09:57 2019 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=852b13c0

net-vpn/libreswan: remove unused patch(es)

Signed-off-by: Michael Mair-Keimberger <m.mairkeimberger <AT> gmail.com>
Closes: https://github.com/gentoo/gentoo/pull/11241
Signed-off-by: Aaron Bauman <bman <AT> gentoo.org>

 .../libreswan/files/libreswan-3.25-no-curl.patch   | 25 ----------------------
 1 file changed, 25 deletions(-)

diff --git a/net-vpn/libreswan/files/libreswan-3.25-no-curl.patch b/net-vpn/libreswan/files/libreswan-3.25-no-curl.patch
deleted file mode 100644
index f23e2f7f227..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.25-no-curl.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 903f953b271c35f33790bb7ba98b17acfdecede6 Mon Sep 17 00:00:00 2001
-From: Paul Wouters <pwouters@redhat.com>
-Date: Sun, 22 Jul 2018 11:37:04 -0700
-Subject: [PATCH] building: only call check_crls() if LIBCURL support is
- compiled in
-
-Noted by Daniel M. Weeks
----
- programs/pluto/timer.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/programs/pluto/timer.c b/programs/pluto/timer.c
-index b8a465a91b..4e82e634ea 100644
---- a/programs/pluto/timer.c
-+++ b/programs/pluto/timer.c
-@@ -432,7 +432,9 @@ static void timer_event_cb(evutil_socket_t fd UNUSED, const short event UNUSED,
- 		break;
- 
- 	case EVENT_CHECK_CRLS:
-+#ifdef LIBCURL
- 		check_crls();
-+#endif
- 		break;
- 
- 	case EVENT_v2_RELEASE_WHACK:

[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[Aaron Bauman]

commit:     b93b46f86152e37afd6cdee0c7d2ca568dbb17c4
Author:     Michael Mair-Keimberger <m.mairkeimberger <AT> gmail <DOT> com>
AuthorDate: Fri Dec  6 11:04:56 2019 +0000
Commit:     Aaron Bauman <bman <AT> gentoo <DOT> org>
CommitDate: Fri Dec  6 15:38:35 2019 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b93b46f8

net-vpn/libreswan: remove unused patch(es)

Signed-off-by: Michael Mair-Keimberger <m.mairkeimberger <AT> gmail.com>
Closes: https://github.com/gentoo/gentoo/pull/13891
Signed-off-by: Aaron Bauman <bman <AT> gentoo.org>

 .../files/libreswan-3.28-barf-syntax.patch         |  23 ---
 .../files/libreswan-3.28-xfrm-detection.patch      | 200 ---------------------
 2 files changed, 223 deletions(-)

diff --git a/net-vpn/libreswan/files/libreswan-3.28-barf-syntax.patch b/net-vpn/libreswan/files/libreswan-3.28-barf-syntax.patch
deleted file mode 100644
index 69786bba99f..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.28-barf-syntax.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 8c3ba6a5f73ae64aa5171252f54c15d65c9930db Mon Sep 17 00:00:00 2001
-From: Tuomo Soini <tis@foobar.fi>
-Date: Fri, 24 May 2019 19:19:12 +0300
-Subject: [PATCH] barf: fix syntax error caused by removing pfkey checks
-
-Fixes problem introduced in beccfe9f7a40816a9ec663e4076ff051bf4c91cb
----
- programs/barf/barf.in | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/programs/barf/barf.in b/programs/barf/barf.in
-index fce05994cf..9cb92ffc58 100755
---- a/programs/barf/barf.in
-+++ b/programs/barf/barf.in
-@@ -170,6 +170,8 @@ if test -r /proc/net/ipsec_tncfg
- then
- 	cat /proc/net/ipsec_tncfg
- fi
-+if test -r /proc/net/xfrm_stat
-+then
- _________________________ ip-xfrm-state
- 	ip xfrm state
- _________________________ ip-xfrm-policy

diff --git a/net-vpn/libreswan/files/libreswan-3.28-xfrm-detection.patch b/net-vpn/libreswan/files/libreswan-3.28-xfrm-detection.patch
deleted file mode 100644
index 7cda675af77..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.28-xfrm-detection.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-From 716f4b712724c6698469563e531dea3667507ceb Mon Sep 17 00:00:00 2001
-From: Paul Wouters <pwouters@redhat.com>
-Date: Tue, 28 May 2019 00:24:30 -0400
-Subject: [PATCH] programs: Change to use /proc/sys/net/core/xfrm_acq_expires
- to detect XFRM
-
-Apparently, not all kernels with XFRM support also enable support for
-CONFIG_XFRM_STATISTICS, causing XFRM auto-detection to fail.
-
-This affected openwrt and also some other distribution/custom kernels.
----
- programs/_realsetup.bsd/_realsetup.in   | 2 +-
- programs/_stackmanager/_stackmanager.in | 2 +-
- programs/barf/barf.in                   | 6 +++---
- programs/eroute/eroute.c                | 2 +-
- programs/ipsec/ipsec.in                 | 2 +-
- programs/look/look.in                   | 2 +-
- programs/pluto/kernel.c                 | 2 +-
- programs/setup/setup.in                 | 2 +-
- programs/spi/spi.c                      | 2 +-
- programs/spigrp/spigrp.c                | 2 +-
- programs/tncfg/tncfg.c                  | 2 +-
- programs/verify/verify.in               | 2 +-
- 12 files changed, 14 insertions(+), 14 deletions(-)
-
-diff --git a/programs/_realsetup.bsd/_realsetup.in b/programs/_realsetup.bsd/_realsetup.in
-index 91cca98ac8..4a783772f6 100755
---- a/programs/_realsetup.bsd/_realsetup.in
-+++ b/programs/_realsetup.bsd/_realsetup.in
-@@ -28,7 +28,7 @@ plutoctl=/var/run/pluto/pluto.ctl
- subsyslock=/var/lock/subsys/ipsec
- lock=/var/run/pluto/ipsec_setup.pid
- 
--xfrm_stat=/proc/net/xfrm_stat
-+xfrm_stat=/proc/sys/net/core/xfrm_acq_expires
- 
- # defaults for "config setup" items
- IPSECuniqueids=${IPSECuniqueids:-yes}
-diff --git a/programs/_stackmanager/_stackmanager.in b/programs/_stackmanager/_stackmanager.in
-index 4d41c5ad51..21616a31c9 100644
---- a/programs/_stackmanager/_stackmanager.in
-+++ b/programs/_stackmanager/_stackmanager.in
-@@ -29,7 +29,7 @@ eval $(ASAN_OPTIONS=detect_leaks=0 ipsec addconn  --configsetup | grep -v "#" |
- test ${IPSEC_INIT_SCRIPT_DEBUG} && set -v -x
- MODPROBE="@MODPROBEBIN@ @MODPROBEARGS@"
- 
--xfrm_stat=/proc/net/xfrm_stat
-+xfrm_stat=/proc/sys/net/core/xfrm_acq_expires
- klipsstack=/proc/net/ipsec/version
- action="${1}"
- 
-diff --git a/programs/barf/barf.in b/programs/barf/barf.in
-index 17f830d4a3..15eb252f11 100755
---- a/programs/barf/barf.in
-+++ b/programs/barf/barf.in
-@@ -174,14 +174,13 @@ _________________________ /proc/net/ipsec_tncfg
- if test -r /proc/net/ipsec_tncfg
- then
-     cat /proc/net/ipsec_tncfg
- fi
--if test -r /proc/net/xfrm_stat
--then
-+if [ -r /proc/sys/net/core/xfrm_acq_expires ]; then
- _________________________ ip-xfrm-state
-     ip xfrm state
- _________________________ ip-xfrm-policy
-     ip xfrm policy
--_________________________ ip-xfrm-stats
-+_________________________ cat-proc-net-xfrm_stat
-     cat /proc/net/xfrm_stat
- fi
- _________________________ ip-l2tp-tunnel
-@@ -283,9 +283,8 @@ _________________________ /proc/net/ipsec_version
- if test -r /proc/net/ipsec_version
- then
-     cat /proc/net/ipsec_version
- else
--    if test -r /proc/net/xfrm_stat
--    then
-+    if [ -r /proc/sys/net/core/xfrm_acq_expires ]; then
- 	echo "NETKEY (`uname -r`) support detected "
-     else
- 	echo "no KLIPS or NETKEY support detected"
-diff --git a/programs/eroute/eroute.c b/programs/eroute/eroute.c
-index c33234c194..6f058d9232 100644
---- a/programs/eroute/eroute.c
-+++ b/programs/eroute/eroute.c
-@@ -495,7 +495,7 @@ int main(int argc, char **argv)
- 	if (argcount == 1) {
- 		struct stat sts;
- 
--		if (stat("/proc/net/xfrm_stat", &sts) == 0) {
-+		if (stat("/proc/sys/net/core/xfrm_acq_expires", &sts) == 0) {
- 			fprintf(stderr,
- 				"%s: NETKEY does not support eroute table.\n",
- 				progname);
-diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
-index 401a596628..06bec21632 100755
---- a/programs/ipsec/ipsec.in
-+++ b/programs/ipsec/ipsec.in
-@@ -61,7 +61,7 @@ fixversion() {
- 	stack=" (klips)"
- 	kv="$(awk '{print $NF}' /proc/net/ipsec_version)"
-     else
--	if [ -f /proc/net/xfrm_stat ]; then
-+	if [ -f /proc/sys/net/core/xfrm_acq_expires ]; then
- 	    stack=" (netkey)"
- 	    kv="${version}"
- 	else
-diff --git a/programs/look/look.in b/programs/look/look.in
-index bb55e8eda2..192856c630 100755
---- a/programs/look/look.in
-+++ b/programs/look/look.in
-@@ -72,7 +72,7 @@ if [ -f /proc/net/ipsec_spi ]; then
- fi
- 
- # xfrm
--if [ -f /proc/net/xfrm_stat ]; then
-+if [ -f /proc/sys/net/core/xfrm_acq_expires ]; then
-     echo "XFRM state:"
-     ip xfrm state
-     echo "XFRM policy:"
-diff --git a/programs/pluto/kernel.c b/programs/pluto/kernel.c
-index 39b1e32389..5c71c04af3 100644
---- a/programs/pluto/kernel.c
-+++ b/programs/pluto/kernel.c
-@@ -2666,7 +2666,7 @@ void init_kernel(void)
- 	switch (kern_interface) {
- #if defined(NETKEY_SUPPORT)
- 	case USE_NETKEY:
--		if (stat("/proc/net/xfrm_stat", &buf) != 0) {
-+		if (stat("/proc/sys/net/core/xfrm_acq_expires", &buf) != 0) {
- 			libreswan_log("No XFRM kernel interface detected");
- 			exit_pluto(PLUTO_EXIT_KERNEL_FAIL);
- 		}
-diff --git a/programs/setup/setup.in b/programs/setup/setup.in
-index 8c28b0e157..1933089459 100755
---- a/programs/setup/setup.in
-+++ b/programs/setup/setup.in
-@@ -110,7 +110,7 @@ case "$1" in
- 
- 	# If stack is non-modular, we want to force clean too
- 	[ -f /proc/net/pf_key ] && ipsec eroute --clear
--	[ -f /proc/net/xfrm_stat ] && ip xfrm state flush && ip xfrm policy flush
-+	[ -f /proc/sys/net/core/xfrm_acq_expires ] && ip xfrm state flush && ip xfrm policy flush
- 
- 	# Cleaning up backup resolv.conf
- 	if [ -e ${LIBRESWAN_RESOLV_CONF} ]; then
-diff --git a/programs/spi/spi.c b/programs/spi/spi.c
-index c45fe6a517..742898a86f 100644
---- a/programs/spi/spi.c
-+++ b/programs/spi/spi.c
-@@ -1135,7 +1135,7 @@ int main(int argc, char *argv[])
- 			progname);
- 	}
- 
--	if (stat("/proc/net/xfrm_stat", &sts) == 0) {
-+	if (stat("/proc/sys/net/core/xfrm_acq_expires", &sts) == 0) {
- 		fprintf(stderr,
- 			"%s: XFRM does not use the ipsec spi command. Use 'ip xfrm' instead.\n",
- 			progname);
-diff --git a/programs/spigrp/spigrp.c b/programs/spigrp/spigrp.c
-index 79d6c50e5e..fe0942325d 100644
---- a/programs/spigrp/spigrp.c
-+++ b/programs/spigrp/spigrp.c
-@@ -151,7 +151,7 @@ int main(int argc, char **argv)
- 	if (debug)
- 		fprintf(stdout, "...After check for --label option.\n");
- 
--	if (stat("/proc/net/xfrm_stat", &sts) == 0) {
-+	if (stat("/proc/sys/net/core/xfrm_acq_expires", &sts) == 0) {
- 		fprintf(stderr,
- 			"%s: XFRM does not use the ipsec spigrp command. Use 'ip xfrm' instead.\n",
- 			progname);
-diff --git a/programs/tncfg/tncfg.c b/programs/tncfg/tncfg.c
-index 55de83b1ef..5a9f2e9aee 100644
---- a/programs/tncfg/tncfg.c
-+++ b/programs/tncfg/tncfg.c
-@@ -259,7 +259,7 @@ int main(int argc, char *argv[])
- 		}
- 	}
- 
--	if (stat("/proc/net/xfrm_stat", &sts) == 0) {
-+	if (stat("/proc/sys/net/core/xfrm_acq_expires", &sts) == 0) {
- 		fprintf(stderr,
- 			"%s: XFRM does not support virtual interfaces.\n",
- 			progname);
-diff --git a/programs/verify/verify.in b/programs/verify/verify.in
-index 9321631931..81ae1d32fe 100755
---- a/programs/verify/verify.in
-+++ b/programs/verify/verify.in
-@@ -223,7 +223,7 @@ def installstartcheck():
- 		print_result("FAIL","FAILED")
- 
- 	printfun("Checking for IPsec support in kernel")
--	if not os.path.isfile("/proc/net/ipsec_eroute") and not os.path.isfile("/proc/net/xfrm_stat"):
-+	if not os.path.isfile("/proc/net/ipsec_eroute") and not os.path.isfile("/proc/sys/net/core/xfrm_acq_expires"):
- 		print_result("FAIL","FAILED")
- 		if "no kernel code presently loaded" in output:
- 			print("\n The ipsec service should be started before running 'ipsec verify'\n")

[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[Conrad Kostecki]

commit:     dbddf84e82f627f7273f52e1f8a75fa85b85fd13
Author:     Michael Mair-Keimberger <mmk <AT> levelnine <DOT> at>
AuthorDate: Sat Aug 28 19:28:55 2021 +0000
Commit:     Conrad Kostecki <conikost <AT> gentoo <DOT> org>
CommitDate: Sun Aug 29 22:41:06 2021 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dbddf84e

net-vpn/libreswan: remove unused patch

Closes: https://github.com/gentoo/gentoo/pull/22147
Package-Manager: Portage-3.0.22, Repoman-3.0.3
Signed-off-by: Michael Mair-Keimberger <mmk <AT> levelnine.at>
Signed-off-by: Conrad Kostecki <conikost <AT> gentoo.org>

 .../files/libreswan-3.32-nss-compat.patch          | 23 ----------------------
 1 file changed, 23 deletions(-)

diff --git a/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch b/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch
deleted file mode 100644
index 09f71a9f907..00000000000
--- a/net-vpn/libreswan/files/libreswan-3.32-nss-compat.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Add compatibility setting for NSS
-
-https://github.com/libreswan/libreswan/commit/65a497959a0e1ca615341109eaad5e75723839d6
-
-We patch a different file because a later commit moved the setting to this file.
-
-diff --git a/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c b/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
-index 93a027089a..571913cc1e 100644
---- a/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
-+++ b/lib/libswan/ike_alg_encrypt_nss_gcm_ops.c
-@@ -16,6 +16,12 @@
- #include <stdio.h>
- #include <stdlib.h>
- 
-+/*
-+ * Special advise from Bob Relyea - needs to go before any nss include
-+ *
-+ */
-+#define NSS_PKCS11_2_0_COMPAT 1
-+
- #include "lswlog.h"
- #include "lswnss.h"
- #include "prmem.h"

[gentoo-commits] repo/gentoo:master commit in: net-vpn/libreswan/files/

[Conrad Kostecki]

commit:     1c1ef22b1f75f875063e408b54439633f682f804
Author:     Michael Mair-Keimberger <mmk <AT> levelnine <DOT> at>
AuthorDate: Sun Mar 13 10:06:41 2022 +0000
Commit:     Conrad Kostecki <conikost <AT> gentoo <DOT> org>
CommitDate: Sun Mar 27 22:07:10 2022 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1c1ef22b

net-vpn/libreswan: remove unused patch

Closes: https://github.com/gentoo/gentoo/pull/24527
Package-Manager: Portage-3.0.30, Repoman-3.0.3
Signed-off-by: Michael Mair-Keimberger <mmk <AT> levelnine.at>
Signed-off-by: Conrad Kostecki <conikost <AT> gentoo.org>

 net-vpn/libreswan/files/libreswan-3.30-ip-path.patch | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/net-vpn/libreswan/files/libreswan-3.30-ip-path.patch b/net-vpn/libreswan/files/libreswan-3.30-ip-path.patch
deleted file mode 100644
index ac45270beaf7..000000000000
--- a/net-vpn/libreswan/files/libreswan-3.30-ip-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/initsystems/systemd/ipsec.service.in.orig	2020-02-14 08:11:29.883638349 +0100
-+++ b/initsystems/systemd/ipsec.service.in	2020-02-14 08:11:40.555430565 +0100
-@@ -29,8 +29,8 @@
- # Enable for portexcludes support
- # ExecStartPost=@FINALLIBEXECDIR@/portexcludes
- ExecStop=@FINALLIBEXECDIR@/whack --shutdown
--ExecStopPost=/sbin/ip xfrm policy flush
--ExecStopPost=/sbin/ip xfrm state flush
-+ExecStopPost=/bin/ip xfrm policy flush
-+ExecStopPost=/bin/ip xfrm state flush
- ExecStopPost=@FINALSBINDIR@/ipsec --stopnflog
- ExecReload=@FINALLIBEXECDIR@/whack --listen
-