anchor.diff:      ./ext_auth-path.patch
       ./firewall_defaults.patch
       ./updown-path.patch
  -    (substituteAll {
  +    (optional stdenv.isLinux (substituteAll {
         src = ./modprobe-path.patch;
         inherit kmod;
  -    })
  +    }))
     ];
   
     postPatch = ''
  -    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
  -
       # swanctl can be configured by files in SWANCTLDIR which defaults to
       # $out/etc/swanctl. Since that directory is in the nix store users can't
       # modify it. Ideally swanctl accepts a command line option for specifying
       # the configuration files. In the absence of that we patch swanctl to look
       # for configuration files in /etc/swanctl.
       substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
  +    '' + optionalString stdenv.isLinux ''
       # glibc-2.26 reorganized internal includes
       sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
  +
  +    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
       '';
   
     preConfigure = ''
  
positive.code:     echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
    '';
  
    NIX_LDFLAGS = "-lgcc_s" ;
  
    meta = {
      description = "OpenSource IPsec-based VPN Solution";
  
negative.code: 
    nativeBuildInputs = [ pkgconfig autoreconfHook ];
    buildInputs =
      [ curl gmp python ldns unbound openssl pcsclite ]
      ++ optionals enableTNC [ trousers sqlite libxml2 ]
      ++ optionals stdenv.isLinux [ systemd.dev pam iptables ]
      ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
      ++ optionals enableNetworkManager [ networkmanager ]
      # ad-hoc fix for https://github.com/NixOS/nixpkgs/pull/51787
      # Remove when the above PR lands in master
  