anchor.diff:  { lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
   , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
   , nftablesCompat ? true
  +, fetchpatch
   }:
   
  -with lib;
  -
   stdenv.mkDerivation rec {
  -  version = "1.8.7";
  +  version = "1.8.8";
     pname = "iptables";
   
     src = fetchurl {
       url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
  -    sha256 = "1w6qx3sxzkv80shk21f63rq41c84irpx68k62m2cv629n1mwj2f1";
  +    sha256 = "sha256-ccdYidxxBnZjFVPrFRHaAXe7qvG1USZbkS0jbD9RhZ8=";
     };
  +
  +  patches = [
  +    # xshared: Fix build for -Werror=format-security
  +    (fetchpatch {
  +      url = "https://git.netfilter.org/iptables/patch/?id=b72eb12ea5a61df0655ad99d5048994e916be83a";
  +      sha256 = "sha256-pnamqOagwNWoiwlxPnKCqSc2N7MP/eZlT7JiE09c8OE=";
  +    })
  +    # treewide: use uint* instead of u_int*
  +    (fetchpatch {
  +      url = "https://git.netfilter.org/iptables/patch/?id=f319389525b066b7dc6d389c88f16a0df3b8f189";
  +      sha256 = "sha256-rOxCEWZoI8Ac5fQDp286YHAwvreUAoDVAbomboKrGyM=";
  +    })
  +  ];
  +
  +  outputs = [ "out" "dev" "man" ];
   
     nativeBuildInputs = [ pkg-config pruneLibtoolFiles flex bison ];
   
  
positive.code:     ln -sv xtables-nft-multi $out/bin/ip6tables-save
    '';
  
    meta = {
      description = "A program to configure the Linux IP packet filtering ruleset";
      homepage = "https://www.netfilter.org/projects/iptables/index.html";
      platforms = platforms.linux;
  
negative.code:     "--enable-libipq"
      "--enable-nfsynproxy"
      "--enable-shared"
    ] ++ lib.optional (!nftablesCompat) "--disable-nftables";
  
    postInstall = lib.optionalString nftablesCompat ''
      rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
      ln -sv xtables-nft-multi $out/bin/iptables
      ln -sv xtables-nft-multi $out/bin/iptables-restore
  