anchor.diff:        NF_CONNTRACK_TIMEOUT        = yes;
         NF_CONNTRACK_TIMESTAMP      = yes;
         NETFILTER_NETLINK_GLUE_CT   = yes;
  -      NF_TABLES_INET              = whenAtLeast "4.19" yes;
  -      NF_TABLES_NETDEV            = whenAtLeast "4.19" yes;
  +      NF_TABLES_INET              = mkMerge [ (whenOlder "4.17" module)
  +                                              (whenAtLeast "4.17" yes) ];
  +      NF_TABLES_NETDEV            = mkMerge [ (whenOlder "4.17" module)
  +                                              (whenAtLeast "4.17" yes) ];
         # IP: Netfilter Configuration
  -      NF_TABLES_IPV4              = yes;
  -      NF_TABLES_ARP               = whenAtLeast "4.19" yes;
  +      NF_TABLES_IPV4              = mkMerge [ (whenOlder "4.17" module)
  +                                              (whenAtLeast "4.17" yes) ];
  +      NF_TABLES_ARP               = mkMerge [ (whenOlder "4.17" module)
  +                                              (whenAtLeast "4.17" yes) ];
         # IPv6: Netfilter Configuration
  -      NF_TABLES_IPV6              = yes;
  +      NF_TABLES_IPV6              = mkMerge [ (whenOlder "4.17" module)
  +                                              (whenAtLeast "4.17" yes) ];
         # Bridge Netfilter Configuration
         NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
                                                 (whenAtLeast "5.3" module) ];
  
positive.code:       SUN8I_DE2_CCU = whenAtLeast "4.13" yes;
  
        # See comments on https://github.com/NixOS/nixpkgs/commit/9b67ea9106102d882f53d62890468071900b9647
        CRYPTO_AEGIS128_SIMD = no;
      };
    };
  in
  
negative.code:       NET_DROP_MONITOR = yes;
  
        # needed for ss
        INET_DIAG         = module;
        INET_TCP_DIAG     = module;
        INET_UDP_DIAG     = module;
        INET_RAW_DIAG     = whenAtLeast "4.14" module;
        INET_DIAG_DESTROY = whenAtLeast "4.9" yes;
  