{ stdenv
, fetchurl
, perl
, coreutils
, iproute
, ipset
, iptables
, ebtables
, shorewall-core
, shorewall
, utillinux
, gnugrep
, gnused
}:
let
  PATH = stdenv.lib.concatStringsSep ":"
           [ "${coreutils}/bin"
             "${iproute}/bin"
             "${iptables}/bin"
             "${ipset}/bin"
             "${ebtables}/bin"
             "${utillinux}/bin"
             "${gnugrep}/bin"
             "${gnused}/bin"
           ];
in
stdenv.mkDerivation rec {
  baseName = "shorewall6";
  version = "5.2.0.5";
  name = "${baseName}-${version}";

  src = fetchurl {
    url = "http://www.shorewall.net/pub/shorewall/5.2/shorewall-5.2.0/${baseName}-${version}.tar.bz2";
    sha256 = "1a46jnr6wknlmfkhjpdvak85wj0mr99qn02r185qswhcyfwyaapl";
  };

  buildInputs = [
    coreutils
    iproute
    ipset
    iptables
    ebtables
    shorewall-core
    utillinux
    gnugrep
    gnused
    shorewall
  ];
  configurePhase = ''
    substituteInPlace ./configure --replace '#!/bin/bash' ${stdenv.shell}
    PATH=$PATH:${shorewall-core}/bin \
    ./configure \
      HOST=linux \
      PREFIX=$out \
      CONFDIR=\$PREFIX/etc \
      SBINDIR=\$PREFIX/sbin \
      SYSCONFDIR=\$PREFIX/etc/default \
      VARLIB=/var/lib \
      INITSOURCE= \
      INITDIR= \
      INITFILE= \
      DEFAULT_PAGER=
  '';
  installPhase = ''
    # Merge with shorewall and shorewall-core
    mkdir -p $out/share/
    cp -r -s ${shorewall}/share/shorewall $out/share/
    chmod u+w $out $out/*/ $out/*/*/ $out/*/*/*/
    mkdir $out/bin
    ln -fns bin $out/sbin
    # Install shorewallrc and shorewall6
    cp --remove-destination shorewallrc $out/share/shorewall/
    #ln -s ${shorewall}/share/shorewall/compiler.pl $out/share/shorewall/
    substituteInPlace ./install.sh --replace '#!/bin/sh' ${stdenv.shell}
    ./install.sh
    cp --remove-destination ${shorewall-core}/sbin/shorewall $out/sbin/shorewall6
    # Actual config will be expected in /etc/shorewall6
    sed -i $out/share/shorewall/shorewallrc \
        -e 's~^CONFDIR=.*~CONFDIR=/etc~'
    # Fix PATH
    sed -i $out/sbin/shorewall6 \
        -e 's~^\. ${shorewall-core}\(/share/shorewall/shorewallrc\)~. '$out'\1~' \
        -e 's~^PRODUCT=.*~&\nexport PATH=${PATH}''${PATH:+:}$PATH~'
    # Fix shorewall.conf
    sed -i $out/etc/shorewall6/shorewall6.conf \
        -e 's|^LOGFILE=.*|LOGFILE=/var/log/shorewall6.log|' \
        -e 's|^PATH=.*|PATH=${PATH}|' \
        -e 's|^PERL=.*|PERL=${perl}/bin/perl|' \
        -e 's|^SHOREWALL_SHELL=.*|SHOREWALL_SHELL=${stdenv.shell}|' \
        -e 's|^CONFIG_PATH=.*|CONFIG_PATH=:''${CONFDIR}/shorewall6:''${SHAREDIR}/shorewall6:''${SHAREDIR}/shorewall|'
    # NOTE: the CONFIG_PATH fix is because ''${SHAREDIR}/shorewall6
    #       must replace the default /usr/share/shorewall6,
    #       otherwise it can fail in subtle ways,
    #       like using shorewall's macro.Ping instead of shorewall6's,
    #       hence not using the right icmp-type (8 instead of 128 here).
  '';

  meta = {
    homepage = http://www.shorewall.net/;
    description = "An IPv6 gateway/firewall configuration tool for GNU/Linux";
    longDescription = ''
      Shorewall is a high-level tool for configuring Netfilter. You describe your
      firewall/gateway requirements using entries in a set of configuration
      files. Shorewall reads those configuration files and with the help of the
      iptables, iptables-restore, ip and tc utilities, Shorewall configures
      Netfilter and the Linux networking subsystem to match your requirements.
      Shorewall can be used on a dedicated firewall system, a multi-function
      gateway/router/server or on a standalone GNU/Linux system. Shorewall does
      not use Netfilter's ipchains compatibility mode and can thus take
      advantage of Netfilter's connection state tracking capabilities.
    '';
    license = stdenv.lib.licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.linux;
  };
}