{ stdenv, fetchurl, perl }:

stdenv.mkDerivation rec {
  baseName = "shorewall-core";
  version = "5.2.0.5";
  name = "${baseName}-${version}";

  src = fetchurl {
    url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2";
    sha256 = "1156n42dz8g44d7f336dn7q97xcq6bl18b2gv2diydv02lc8fqbd";
  };

  buildInputs = [
    perl
  ];
  configurePhase = ''
    substituteInPlace ./configure --replace '#!/bin/bash' ${stdenv.shell}
    ./configure \
      HOST=linux \
      PREFIX=$out \
      CONFDIR=\$PREFIX/etc \
      SBINDIR=\$PREFIX/sbin \
      SYSCONFDIR=\$PREFIX/etc/default \
      VARLIB=/var/lib \
      INITSOURCE= \
      INITDIR= \
      INITFILE= \
      DEFAULT_PAGER=
  '';
  installPhase = ''
    substituteInPlace ./install.sh --replace '#!/bin/sh' ${stdenv.shell}
    ./install.sh
    # Remove hardcoded PATH
    sed -i $out/share/shorewall/lib.cli \
        -e '/^ *PATH=.*/d'
  '';

  meta = {
    homepage = http://www.shorewall.net/;
    description = "A gateway/firewall configuration tool for GNU/Linux";
    longDescription = ''
      Shorewall is a high-level tool for configuring Netfilter. You describe your
      firewall/gateway requirements using entries in a set of configuration
      files. Shorewall reads those configuration files and with the help of the
      iptables, iptables-restore, ip and tc utilities, Shorewall configures
      Netfilter and the Linux networking subsystem to match your requirements.
      Shorewall can be used on a dedicated firewall system, a multi-function
      gateway/router/server or on a standalone GNU/Linux system. Shorewall does
      not use Netfilter's ipchains compatibility mode and can thus take
      advantage of Netfilter's connection state tracking capabilities.
    '';
    license = stdenv.lib.licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.linux;
  };
}