anchor.diff:      ./ext_auth-path.patch
       ./firewall_defaults.patch
       ./updown-path.patch
  -    (substituteAll {
  +    (optional stdenv.isLinux (substituteAll {
         src = ./modprobe-path.patch;
         inherit kmod;
  -    })
  +    }))
     ];
   
     postPatch = ''
  -    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
  -
       # swanctl can be configured by files in SWANCTLDIR which defaults to
       # $out/etc/swanctl. Since that directory is in the nix store users can't
       # modify it. Ideally swanctl accepts a command line option for specifying
       # the configuration files. In the absence of that we patch swanctl to look
       # for configuration files in /etc/swanctl.
       substituteInPlace src/swanctl/swanctl.h --replace "SWANCTLDIR" "\"/etc/swanctl\""
  +    '' + optionalString stdenv.isLinux ''
       # glibc-2.26 reorganized internal includes
       sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
  +
  +    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
       '';
   
     preConfigure = ''
  
positive.code:   '';
  
    configureFlags =
      [ "--enable-swanctl" "--enable-cmd" "--enable-systemd"
        "--enable-farp" "--enable-dhcp"
        "--enable-openssl"
        "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
        "--enable-eap-simaka-reauth" "--enable-eap-identity" "--enable-eap-md5"
        "--enable-eap-gtc" "--enable-eap-aka" "--enable-eap-aka-3gpp2"
        "--enable-eap-mschapv2" "--enable-eap-radius" "--enable-xauth-eap" "--enable-ext-auth"
        "--enable-forecast" "--enable-connmark" "--enable-acert"
        "--enable-pkcs11" "--enable-eap-sim-pcsc" "--enable-dnscert" "--enable-unbound"
        "--enable-af-alg" "--enable-xauth-pam" "--enable-chapoly"
        "--enable-curl" ]
      ++ optionals stdenv.isx86_64 [ "--enable-aesni" "--enable-rdrand" ]
      ++ optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
      ++ optionals enableTNC [
  
negative.code: , enableTNC            ? false, trousers, sqlite, libxml2
  , enableNetworkManager ? false, networkmanager
  , libpcap
  , darwin
  }:
  
  # Note on curl support: If curl is built with gnutls as its backend, the
  