diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.10.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.10.0
new file mode 100644
index 0000000000..fc2fc8ae73
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.10.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.10.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=349433ed5e85d0477cab0aaef56cda29
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.11.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.11.0
new file mode 100644
index 0000000000..c7c6e0c937
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.11.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.11.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=159c0715919aeba5454e59cdf3735df6
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.12.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.12.0
new file mode 100644
index 0000000000..9e7bebef6f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.12.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.12.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=b3074a1f75ba2310b432f93290fe38e4
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.13.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.13.0
new file mode 100644
index 0000000000..1deb8e529c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.13.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=6
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.13.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=79d1ac6176812dbcd41768b06523e114
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.4.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.4.0
new file mode 100644
index 0000000000..f3e4e1757b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.4.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.4.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=f2502eba08854a7d09bdcf1e8d6d5013
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.5.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.5.0
new file mode 100644
index 0000000000..06b00a5b22
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.5.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.5.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=d87f37032509f0528473b9e8f7f7164c
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.6.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.6.0
new file mode 100644
index 0000000000..d56f8bedd7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.6.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.6.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=436387079fca9ecbfcbdb213d3737b84
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.7.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.7.0
new file mode 100644
index 0000000000..e7d92317a9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.7.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.7.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=6c86d665a729ac29ee9e41d6e332f204
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.8.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.8.0
new file mode 100644
index 0000000000..8104b6f6bc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.8.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.8.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=6c86d665a729ac29ee9e41d6e332f204
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.9.0 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.9.0
new file mode 100644
index 0000000000..2d2fdddb2f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-4.9.0
@@ -0,0 +1,13 @@
+DEFINED_PHASES=configure install prepare
+DEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.16 elibc_glibc? ( >=sys-libs/glibc-2.7 )
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=5
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+KEYWORDS=~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd !minimal? ( net-libs/libmnl ) iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+SRC_URI=mirror://kernel/linux/utils/net/iproute2/iproute2-4.9.0.tar.xz
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=72c96739f5411b69a7437288e2f86079
diff --git a/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-9999 b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-9999
new file mode 100644
index 0000000000..1102badf52
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/metadata/md5-cache/sys-apps/iproute2-9999
@@ -0,0 +1,11 @@
+DEFINED_PHASES=configure install prepare unpack
+DEPEND=!net-misc/arpd iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux ) app-arch/xz-utils iptables? ( virtual/pkgconfig ) sys-devel/bison sys-devel/flex >=sys-kernel/linux-headers-3.7 elibc_glibc? ( >=sys-libs/glibc-2.7 ) >=dev-vcs/git-1.8.2.1
+DESCRIPTION=kernel routing and traffic control utilities
+EAPI=6
+HOMEPAGE=https://wiki.linuxfoundation.org/networking/iproute2
+IUSE=atm berkdb +iptables ipv6 minimal selinux
+LICENSE=GPL-2
+RDEPEND=!net-misc/arpd iptables? ( >=net-firewall/iptables-1.4.20:= ) berkdb? ( sys-libs/db:= ) atm? ( net-dialup/linux-atm ) selinux? ( sys-libs/libselinux )
+SLOT=0
+_eclasses_=epatch	8233751dc5105a6ae8fcd86ce2bb0247	estack	43ddf5aaffa7a8d0482df54d25a66a1f	eutils	9c113d6a64826c40154cad7be15d95ea	flag-o-matic	61cad4fb5d800b29d484b27cb033f59b	git-r3	cbafa3261c37c7e3af44bb16a34ea390	ltprune	2770eed66a9b8ef944714cd0e968182e	multilib	97f470f374f2e94ccab04a2fb21d811e	toolchain-funcs	8fec6b1eb195836560e70b66d98fb163
+_md5_=80dc051c83ec7d6a5d4142bf0496c340
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
new file mode 100644
index 0000000000..e451a90689
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -0,0 +1,10 @@
+DIST iproute2-4.10.0.tar.xz 626944 SHA256 22b1e1c1fc704ad35837e5a66103739727b8b48ac90b48c13f79b7367ff0a9a8 SHA512 e54477e167455e7ef5da4adc168d63eaa96091b63dc987fffe918cbb005eceed18a62283ca99ee2512dc0e960f47ae21b39ffbe399c1612fd9cea147c34c581b WHIRLPOOL 7034f87835b13d275d2e065ee00d869060ae20c7dd325d8974da414db20328195e5968ede2f0b6925ddf67de3712b5945f54276c6ce5c8367ba28520c2adb859
+DIST iproute2-4.11.0.tar.xz 657100 SHA256 72671028bda696d0cb8f48ec8e702581c3a501caeed33eec3a81d7041cbc8026 SHA512 e6cc3dbe2779670a752ab346c1a432b496033448d1645aa0161b3f7b683b3f9939ab09db12199b794cc64dff257faaf0d151046feea9031a6139176e08b4f4fa WHIRLPOOL 9bf25b018d3f392a2e2f4faf4c3877f52ec4b0aebb082d9c2e2c3e80c0c8f3885c122c5d211c4c6ef014506d786213b36938728f63b581079274a3116fc85581
+DIST iproute2-4.12.0.tar.xz 662424 SHA256 2e0a4c4262d9f6c169885a6e16c4c5c5f1ef6fd57b6a0e7b41f42be5bb6ebd7d SHA512 275147f71e7c4698654f0d6d0981ab42f6f108066508c15cfcd5d9e0d3aaf8d33291968d9f06cb03f5494d801cfabf8d53308aaf56fc4fa92c52b137e970a3b0 WHIRLPOOL 590cc191e96ff0b777373603186e4416f064931d529878ec783759f31fd99e1119bb0604e8a89dc98d350f80eca2bfef05a13bca7ce24302408072002c0b17b2
+DIST iproute2-4.13.0.tar.xz 670340 SHA256 9cfb81edf8c8509e03daa77cf62aead01c4a827132f6c506578f94cc19415c50 SHA512 f96d2839aec1f439bfac504c8e3881c063dacbf4c67b15f0e3da9882d2fa013cba33c23602de3eab624e0eecbb911a13967d60bddcdf097f47a580a5a77b5e3a WHIRLPOOL 757247f1356eef49b299019f6d1809e5d781471665daedce885201b7034a6138def73c84ba2f0453f2f0f5d55cc2edf778992b3d79d06e01364c511373ea4644
+DIST iproute2-4.4.0.tar.xz 528552 SHA256 bc91c367288a19f78ef800cd6840363be1f22da8436fbae88e1a7250490d6514 SHA512 48236fc6103a55d977efa4f93ad7fdfc0944df975ce771d57fd3dcfb13b761b0c05dbe749978ac86c7a471d023bee62a2f1648a6ca75f50da9252acfde174b69 WHIRLPOOL 7e90c98805e12b28de284bb998e5a27cf524a78d0bd7632c0d49a7ddff8f11f5229ac6867076e9fea6f21b6b31360bddb21138673d94de766bdf7324a09bc013
+DIST iproute2-4.5.0.tar.xz 554500 SHA256 3f15292f53e465cb5bd6652961343ca64eb6936309ae75be5d5a541435bc494a SHA512 d12be24cf7a1102be8e449d1e95fa67b784d505e98fcf2f18caedf0136fb378dc439f74a75bc0d6ef5b2893e5ca1968e122054404c1f4d1a212aeb0fba1c5860 WHIRLPOOL dc660bde36fed126b27fb69a59c02405b5299b92a6b519ebdce74d817f88be82114bb10217ca34bbc26a89e664ff243e606a84bcb00db41088bce824542def40
+DIST iproute2-4.6.0.tar.xz 570960 SHA256 74fc6a8ad085be095a159f8158bbaf385b42af9e101619f233f1ae466829d406 SHA512 1e3868ced65012da6724744eb15e6bb8e2c5bf8d7a46cf2b655526de1a9e1224c7b7e9bd4a88e40516b5648955987eb9001600ca5afbd507bc664f92b51ede9f WHIRLPOOL 1b0ff7988d6d5567137aca9d41e2cc3183f3620f8b874113ff9e6ca9508349550e388e423c54b165e73ed54ccb7a366ef8d032a930f27722eccbd5ff6879032e
+DIST iproute2-4.7.0.tar.xz 589928 SHA256 8f60dbcfb33a79daae0638f53bdcaa4310c0aa59ae39af8a234020dc69bb7b92 SHA512 dd884b192ede7f165d565dce6819fb7280eda880d4d53e06a604ab20e7ce343ba37847750172fd52061892e9db3d18bd8ae13d37bd4410e50a8f704cb3fe4ece WHIRLPOOL 191335f76f816ec1c86b2b9cac398129a475993e5a6366d0d0a35287eb07ae61d873e1a8a25a0083b28953011d8dfd492e7a718bacfd7f872130cdb2e3a5729d
+DIST iproute2-4.8.0.tar.xz 594636 SHA256 a30959c8421bc8ef42719bed41d14e1d7cfdbad80d7d70c5c42ad31f2c2cb389 SHA512 9b9db053e5d6ae2e7dd17870a3081ef61788a7eeb07473430e1a26c3c948123d33840bd6bb81b4a553ac6913ea89f02ac2a1b7d52ced65523a43991f03e84f49 WHIRLPOOL 83015c0bcfc6739ce688307a6824047910d453265883d4fbb9bec67c8720a5f478d2d72e5095ffc75191e64f3525a25f019032f20fc428b622e4a5c1b8fcbe3d
+DIST iproute2-4.9.0.tar.xz 613032 SHA256 c0f30f043f7767cc1b2cd2197b08d4e9b2392c95823fabe30bbce308c30116c4 SHA512 0d974d7c001eac75def0d90b628e432d9847024843d02a6cd27266ff30e3f7a9c874fa91115da74db5f321c2e815b486a847059ca6df3aa8ea49432ffa39a889 WHIRLPOOL 83c8d42ef43f42a58835ff3b1df7460c67db4de1ae9d5df775d8aa15bfe2c488a626dd40c4327c2772436ed88bea1a1f57a953cd6bf650955465e76aec9476a2
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-3.1.0-mtu.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-3.1.0-mtu.patch
new file mode 100644
index 0000000000..fa12dad2d7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-3.1.0-mtu.patch
@@ -0,0 +1,48 @@
+http://bugs.gentoo.org/291907
+
+This patch was merged from two patches extracted from this thread:
+http://markmail.org/thread/qkd76gpdgefpjlfn
+
+tc_stab.c: small fixes to commandline help
+
+
+tc_core.c:
+As kernel part of things relies on cell align which is always set to -1,
+I also added it to userspace computation stage. This way if someone
+specified e.g. 2048 and 512 for mtu and tsize respectively, one wouldn't
+end with tsize supporting mtu 4096 suddenly, New default mtu is also set
+to 2048 (disregarding weirdness of setting mtu to such values).
+
+
+Unless I missed something, this is harmless and feels cleaner, but if it's
+not allowed, documentation will have to be changed back to 2047 + extra
+explanation as well.
+
+--- iproute2/tc/tc_core.c
++++ iproute2/tc/tc_core.c
+@@ -155,12 +155,12 @@
+ 	}
+ 
+ 	if (s->mtu == 0)
+-		s->mtu = 2047;
++		s->mtu = 2048;
+ 	if (s->tsize == 0)
+ 		s->tsize = 512;
+ 
+ 	s->cell_log = 0;
+-	while ((s->mtu >> s->cell_log) > s->tsize - 1)
++	while ((s->mtu - 1 >> s->cell_log) > s->tsize - 1)
+ 		s->cell_log++;
+ 
+ 	*stab = malloc(s->tsize * sizeof(__u16));
+--- iproute2/tc/tc_stab.c
++++ iproute2/tc/tc_stab.c
+@@ -32,7 +32,7 @@
+ 	fprintf(stderr,
+ 		"Usage: ... stab [ mtu BYTES ] [ tsize SLOTS ] [ mpu BYTES ] \n"
+ 		"                [ overhead BYTES ] [ linklayer TYPE ] ...\n"
+-		"   mtu       : max packet size we create rate map for {2047}\n"
++		"   mtu       : max packet size we create size table for {2048}\n"
+ 		"   tsize     : how many slots should size table have {512}\n"
+ 		"   mpu       : minimum packet size used in rate computations\n"
+ 		"   overhead  : per-packet size overhead used in rate computations\n"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.11.0-no-ipv6.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.11.0-no-ipv6.patch
new file mode 100644
index 0000000000..fc855dcf22
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.11.0-no-ipv6.patch
@@ -0,0 +1,37 @@
+--- iproute2-4.11.0/ip/ipmonitor.c
++++ iproute2-4.11.0/ip/ipmonitor.c
+@@ -114,7 +114,6 @@
+ 	}
+ 	if (n->nlmsg_type == RTM_NEWPREFIX) {
+ 		print_headers(fp, "[PREFIX]", ctrl);
+-		print_prefix(who, n, arg);
+ 		return 0;
+ 	}
+ 	if (n->nlmsg_type == RTM_NEWRULE || n->nlmsg_type == RTM_DELRULE) {
+--- iproute2-4.11.0/ip/iptunnel.c
++++ iproute2-4.11.0/ip/iptunnel.c
+@@ -589,13 +589,6 @@
+ 		break;
+ 	case AF_INET:
+ 		break;
+-	/*
+-	 * This is silly enough but we have no easy way to make it
+-	 * protocol-independent because of unarranged structure between
+-	 * IPv4 and IPv6.
+-	 */
+-	case AF_INET6:
+-		return do_ip6tunnel(argc, argv);
+ 	default:
+ 		fprintf(stderr, "Unsupported protocol family: %d\n", preferred_family);
+ 		exit(-1);
+--- iproute2-4.11.0/ip/Makefile
++++ iproute2-4.11.0/ip/Makefile
+@@ -1,6 +1,6 @@
+ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
+-    rtm_map.o iptunnel.o ip6tunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
+-    ipmaddr.o ipmonitor.o ipmroute.o ipprefix.o iptuntap.o iptoken.o \
++    rtm_map.o iptunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
++    ipmaddr.o ipmonitor.o ipmroute.o iptuntap.o iptoken.o \
+     ipxfrm.o xfrm_state.o xfrm_policy.o xfrm_monitor.o iplink_dummy.o \
+     iplink_ifb.o iplink_nlmon.o iplink_team.o iplink_vcan.o \
+     iplink_vlan.o link_veth.o link_gre.o iplink_can.o iplink_xdp.o \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.12.0-uclibc-ng-add-ipproto_mh.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.12.0-uclibc-ng-add-ipproto_mh.patch
new file mode 100644
index 0000000000..48cae70143
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.12.0-uclibc-ng-add-ipproto_mh.patch
@@ -0,0 +1,38 @@
+From 2ac2f416072d9968a9ea2dd9f48168223a1147b0 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Tue, 18 Jul 2017 14:09:06 +0300
+Subject: [PATCH] Fix build with uClibc-ng
+
+Add a local definition for IPPROTO_MH to fix build with uClibc-ng. As of
+version 1.0.25, the uClibc-ng netinet/in.h header does not provide this
+definition. The kernel provided definition is masked by libc-compat.h. Add
+this local fix until uClibc-ng syncs netinet/in.h with glibc.
+
+This partially reverts upstream commit a9ae195a2169 (xfrm: get #define's from
+linux includes)
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+---
+Upstream status: non upstreamable; local uClibc-ng compatibility fix
+---
+ ip/xfrm.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/ip/xfrm.h b/ip/xfrm.h
+index 54d80ce5e949..50b85550fb45 100644
+--- a/ip/xfrm.h
++++ b/ip/xfrm.h
+@@ -30,6 +30,10 @@
+ #include <linux/xfrm.h>
+ #include <linux/ipsec.h>
+ 
++#ifndef IPPROTO_MH
++# define IPPROTO_MH     135
++#endif
++
+ #define XFRMS_RTA(x)  ((struct rtattr*)(((char*)(x)) + NLMSG_ALIGN(sizeof(struct xfrm_usersa_info))))
+ #define XFRMS_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct xfrm_usersa_info))
+ 
+-- 
+2.13.2
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.2.0-no-ipv6.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.2.0-no-ipv6.patch
new file mode 100644
index 0000000000..b29e1aa3e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.2.0-no-ipv6.patch
@@ -0,0 +1,37 @@
+--- iproute2-4.2.0/ip/ipmonitor.c
++++ iproute2-4.2.0/ip/ipmonitor.c
+@@ -115,7 +115,6 @@
+ 	}
+ 	if (n->nlmsg_type == RTM_NEWPREFIX) {
+ 		print_headers(fp, "[PREFIX]", ctrl);
+-		print_prefix(who, n, arg);
+ 		return 0;
+ 	}
+ 	if (n->nlmsg_type == RTM_NEWRULE || n->nlmsg_type == RTM_DELRULE) {
+--- iproute2-4.2.0/ip/iptunnel.c
++++ iproute2-4.2.0/ip/iptunnel.c
+@@ -637,13 +637,6 @@
+ 		break;
+ 	case AF_INET:
+ 		break;
+-	/*
+-	 * This is silly enough but we have no easy way to make it
+-	 * protocol-independent because of unarranged structure between
+-	 * IPv4 and IPv6.
+-	 */
+-	case AF_INET6:
+-		return do_ip6tunnel(argc, argv);
+ 	default:
+ 		fprintf(stderr, "Unsupported protocol family: %d\n", preferred_family);
+ 		exit(-1);
+--- iproute2-4.2.0/ip/Makefile
++++ iproute2-4.2.0/ip/Makefile
+@@ -1,6 +1,6 @@
+ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
+-    rtm_map.o iptunnel.o ip6tunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
+-    ipmaddr.o ipmonitor.o ipmroute.o ipprefix.o iptuntap.o iptoken.o \
++    rtm_map.o iptunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
++    ipmaddr.o ipmonitor.o ipmroute.o iptuntap.o iptoken.o \
+     ipxfrm.o xfrm_state.o xfrm_policy.o xfrm_monitor.o \
+     iplink_vlan.o link_veth.o link_gre.o iplink_can.o \
+     iplink_macvlan.o iplink_macvtap.o ipl2tp.o link_vti.o link_vti6.o \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.5.0-no-iptables.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.5.0-no-iptables.patch
new file mode 100644
index 0000000000..7ed9dfbad2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.5.0-no-iptables.patch
@@ -0,0 +1,42 @@
+--- iproute2-4.5.0/configure~	2016-03-14 23:02:31.000000000 +0000
++++ iproute2-4.5.0/configure	2016-03-17 13:24:17.634743197 +0000
+@@ -169,10 +169,25 @@
+ 
+ check_ipt()
+ {
+-	if ! grep TC_CONFIG_XT Config > /dev/null
++	if grep -q TC_CONFIG_XT Config
+ 	then
++		return
++	fi
++
++	cat >$TMPDIR/ipttest.c <<EOF
++#include <iptables.h>
++int main() { return 0; }
++EOF
++
++	if $CC -std=c90 -I$INCLUDE $IPTC -o $TMPDIR/ipttest $TMPDIR/ipttest.c $IPTL \
++		$(${PKG_CONFIG} libiptc --cflags --libs 2>/dev/null) -ldl >/dev/null 2>&1
++	then
++		echo "TC_CONFIG_IPT:=y" >>Config
+ 		echo "using iptables"
++	else
++		echo "no"
+ 	fi
++	rm -f $TMPDIR/ipttest.c $TMPDIR/ipttest
+ }
+ 
+ check_ipt_lib_dir()
+--- iproute2-4.5.0/tc/Makefile~	2016-03-14 23:02:31.000000000 +0000
++++ iproute2-4.5.0/tc/Makefile	2016-03-17 13:18:18.686689985 +0000
+@@ -88,7 +88,9 @@
+ 	CFLAGS += -DTC_CONFIG_XT_H
+ 	TCSO += m_xt_old.so
+     else
+-      TCMODULES += m_ipt.o
++      ifeq ($(TC_CONFIG_IPT),y)
++        TCMODULES += m_ipt.o
++      endif
+     endif
+   endif
+ endif
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.10.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.10.0.ebuild
new file mode 100644
index 0000000000..2408101d55
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.10.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.11.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.11.0.ebuild
new file mode 100644
index 0000000000..74f13e1418
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.11.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.11.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.12.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.12.0.ebuild
new file mode 100644
index 0000000000..3443e720d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.12.0.ebuild
@@ -0,0 +1,150 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="
+	${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.11.0-no-ipv6.patch #326849
+		)
+	fi
+
+	# Local uclibc-ng compat fix until uclibc-ng upstream can sync
+	# netinet/in.h with glibc.  Resolves #626546.
+	if use elibc_uclibc ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.12.0-uclibc-ng-add-ipproto_mh.patch
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.13.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.13.0.ebuild
new file mode 100644
index 0000000000..fa700784bd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.13.0.ebuild
@@ -0,0 +1,150 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="
+	${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.11.0-no-ipv6.patch #326849
+		)
+	fi
+
+	# Local uclibc-ng compat fix until uclibc-ng upstream can sync
+	# netinet/in.h with glibc.  Resolves #626546.
+	if use elibc_uclibc ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.12.0-uclibc-ng-add-ipproto_mh.patch
+		)
+	fi
+
+	default
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX%/}"/$(get_libdir) \
+		SBINDIR="${EPREFIX%/}"/sbin \
+		CONFDIR="${EPREFIX%/}"/etc/iproute2 \
+		DOCDIR="${EPREFIX%/}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX%/}"/usr/share/man \
+		ARPDDIR="${EPREFIX%/}"/var/lib/arpd \
+		install
+
+	rm "${ED%/}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED%/}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED%/}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED%/}"/sbin/arpd "${ED%/}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.4.0.ebuild
new file mode 100644
index 0000000000..39aca2ca93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.4.0.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	use ipv6 || epatch "${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+
+	sed -i \
+		-e '/^CC =/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.5.0.ebuild
new file mode 100644
index 0000000000..2d253c6727
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.5.0.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	use ipv6 || epatch "${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+
+	sed -i \
+		-e '/^CC =/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.6.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.6.0.ebuild
new file mode 100644
index 0000000000..2b8c4aa156
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.6.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	"${FILESDIR}"/${PN}-4.5.0-no-iptables.patch #577464
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC =/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.7.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.7.0.ebuild
new file mode 100644
index 0000000000..ae4dae7138
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.7.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	"${FILESDIR}"/${PN}-4.5.0-no-iptables.patch #577464
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.8.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.8.0.ebuild
new file mode 100644
index 0000000000..ae4dae7138
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.8.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	"${FILESDIR}"/${PN}-4.5.0-no-iptables.patch #577464
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.9.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.9.0.ebuild
new file mode 100644
index 0000000000..c0bb3e0c3f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-4.9.0.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-2
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="!net-misc/arpd
+	!minimal? ( net-libs/libmnl )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948 and some defines #553876
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.16
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.2.0-no-ipv6.patch #326849
+		)
+	fi
+
+	epatch "${PATCHES[@]}"
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	rm "${ED}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
new file mode 100644
index 0000000000..ba7c88b2ac
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -0,0 +1,135 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs flag-o-matic multilib
+
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb +iptables ipv6 minimal selinux"
+
+RDEPEND="!net-misc/arpd
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	berkdb? ( sys-libs/db:= )
+	atm? ( net-dialup/linux-atm )
+	selinux? ( sys-libs/libselinux )"
+# We require newer linux-headers for ipset support #549948
+DEPEND="${RDEPEND}
+	app-arch/xz-utils
+	iptables? ( virtual/pkgconfig )
+	sys-devel/bison
+	sys-devel/flex
+	>=sys-kernel/linux-headers-3.7
+	elibc_glibc? ( >=sys-libs/glibc-2.7 )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+)
+
+src_prepare() {
+	if ! use ipv6 ; then
+		PATCHES+=(
+			"${FILESDIR}"/${PN}-4.11.0-no-ipv6.patch #326849
+		)
+	fi
+
+	default
+
+	sed -i \
+		-e '/^CC :=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s:-O2:${CFLAGS} ${CPPFLAGS}:" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^WFLAGS/s:-Werror::" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Use /run instead of /var/run.
+	sed -i \
+		-e 's:/var/run:/run:g' \
+		include/namespace.h \
+		man/man8/ip-netns.8 || die
+
+	# build against system headers
+	rm -r include/netinet #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	# don't build arpd if USE=-berkdb #81660
+	use berkdb || sed -i '/^TARGETS=/s: arpd : :' misc/Makefile
+
+	use minimal && sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
+	echo 'int main(){return 0;}' > test.c
+	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
+	popd >/dev/null
+
+	cat <<-EOF > Config
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	# We've locked in recent enough kernel headers #549948
+	TC_CONFIG_IPSET := y
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, #144265 #293709
+	IPT_LIB_DIR := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		LIBDIR="${EPREFIX%/}"/$(get_libdir) \
+		SBINDIR="${EPREFIX%/}"/sbin \
+		CONFDIR="${EPREFIX%/}"/etc/iproute2 \
+		DOCDIR="${EPREFIX%/}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX%/}"/usr/share/man \
+		ARPDDIR="${EPREFIX%/}"/var/lib/arpd \
+		install
+
+	rm "${ED%/}"/usr/share/doc/${PF}/*.{sgml,tex} || die #455988
+
+	dodir /bin
+	mv "${ED%/}"/{s,}bin/ip || die #330115
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+	# This local header pulls in a lot of linux headers it
+	# doesn't directly need.  Delete this header that requires
+	# linux-headers-3.8 until that goes stable.  #467716
+	sed -i '/linux\/netconf.h/d' "${ED%/}"/usr/include/libnetlink.h || die
+
+	if use berkdb ; then
+		dodir /var/lib/arpd
+		# bug 47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED%/}"/sbin/arpd "${ED%/}"/usr/bin/ || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/metadata.xml
new file mode 100644
index 0000000000..0fa0b4cd78
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>base-system@gentoo.org</email>
+	<name>Gentoo Base System</name>
+</maintainer>
+<use>
+	<flag name="berkdb">build programs that use berkdb (just arpd)</flag>
+	<flag name="iptables">include support for iptables filtering</flag>
+	<flag name="minimal">only install ip and tc programs</flag>
+</use>
+</pkgmetadata>