anchor.diff:      "--enable-libipq"
       "--enable-nfsynproxy"
       "--enable-shared"
  -  ] ++ optional (!nftablesCompat) "--disable-nftables";
  +  ] ++ lib.optional (!nftablesCompat) "--disable-nftables";
   
  -  outputs = [ "out" "dev" ];
  -
  -  postInstall = optionalString nftablesCompat ''
  +  postInstall = lib.optionalString nftablesCompat ''
       rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
       ln -sv xtables-nft-multi $out/bin/iptables
       ln -sv xtables-nft-multi $out/bin/iptables-restore
  
positive.code:     ln -sv xtables-nft-multi $out/bin/ip6tables-save
    '';
  
    meta = {
      description = "A program to configure the Linux IP packet filtering ruleset";
      homepage = "https://www.netfilter.org/projects/iptables/index.html";
      platforms = platforms.linux;
  
negative.code: { lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
  , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
  , nftablesCompat ? true
  , fetchpatch
  }:
  
  stdenv.mkDerivation rec {
    version = "1.8.8";
    pname = "iptables";
  
    src = fetchurl {
      url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
      sha256 = "sha256-ccdYidxxBnZjFVPrFRHaAXe7qvG1USZbkS0jbD9RhZ8=";
    };
  
    patches = [
      # xshared: Fix build for -Werror=format-security
      (fetchpatch {
        url = "https://git.netfilter.org/iptables/patch/?id=b72eb12ea5a61df0655ad99d5048994e916be83a";
        sha256 = "sha256-pnamqOagwNWoiwlxPnKCqSc2N7MP/eZlT7JiE09c8OE=";
      })
      # treewide: use uint* instead of u_int*
      (fetchpatch {
        url = "https://git.netfilter.org/iptables/patch/?id=f319389525b066b7dc6d389c88f16a0df3b8f189";
        sha256 = "sha256-rOxCEWZoI8Ac5fQDp286YHAwvreUAoDVAbomboKrGyM=";
      })
    ];
  
    outputs = [ "out" "dev" "man" ];
  
    nativeBuildInputs = [ pkg-config pruneLibtoolFiles flex bison ];
  
  