anchor.diff:          supported, but the installation does not fail otherwise.
         '';
   
  +      copy_df = mkYesNoParam yes ''
  +        Whether to copy the DF bit to the outer IPv4 header in tunnel mode. This
  +        effectively disables Path MTU discovery (PMTUD). Controlling this
  +        behavior is not supported by all kernel interfaces.
  +      '';
  +
  +      copy_ecn = mkYesNoParam yes ''
  +        Whether to copy the ECN (Explicit Congestion Notification) header field
  +        to/from the outer IP header in tunnel mode. Controlling this behavior is
  +        not supported by all kernel interfaces.
  +      '';
  +
  +      copy_dscp = mkEnumParam [ "out" "in" "yes" "no" ] "out" ''
  +        Whether to copy the DSCP (Differentiated Services Field Codepoint)
  +        header field to/from the outer IP header in tunnel mode. The value
  +        <literal>out</literal> only copies the field from the inner to the outer
  +        header, the value <literal>in</literal> does the opposite and only
  +        copies the field from the outer to the inner header when decapsulating,
  +        the value <literal>yes</literal> copies the field in both directions,
  +        and the value <literal>no</literal> disables copying the field
  +        altogether. Setting this to <literal>yes</literal> or
  +        <literal>in</literal> could allow an attacker to adversely affect other
  +        traffic at the receiver, which is why the default is
  +        <literal>out</literal>. Controlling this behavior is not supported by
  +        all kernel interfaces.
  +      '';
  +
         start_action = mkEnumParam ["none" "trap" "start"] "none" ''
           Action to perform after loading the configuration.
           <itemizedlist>
  
positive.code:     } ''
        IKE preshared secret section for a specific secret. Each IKE PSK is
        defined in a unique section having the <literal>ike</literal> prefix.
      '';
  
      private = mkPrefixedAttrsOfParams {
  
negative.code:         <literal>0xffffffff</literal>.
        '';
  
        set_mark_in = mkStrParam "0/0x00000000" ''
          Netfilter mark applied to packets after the inbound IPsec SA processed
          them. This way it's not necessary to mark packets via Netfilter before
          decryption or right afterwards to match policies or process them
          differently (e.g. via policy routing).
  
          An additional mask may be appended to the mark, separated by
          <literal>/</literal>. The default mask if omitted is 0xffffffff. The
          special value <literal>%same</literal> uses the value (but not the mask)
          from <option>mark_in</option> as mark value, which can be fixed,
          <literal>%unique</literal> or <literal>%unique-dir</literal>.
  
          Setting marks in XFRM input requires Linux 4.19 or higher.
        '';
  
        set_mark_out = mkStrParam "0/0x00000000" ''
          Netfilter mark applied to packets after the outbound IPsec SA processed
          them. This allows processing ESP packets differently than the original
          traffic (e.g. via policy routing).
  
          An additional mask may be appended to the mark, separated by
          <literal>/</literal>. The default mask if omitted is 0xffffffff. The
          special value <literal>%same</literal> uses the value (but not the mask)
          from <option>mark_out</option> as mark value, which can be fixed,
          <literal>%unique_</literal> or <literal>%unique-dir</literal>.
  
          Setting marks in XFRM output is supported since Linux 4.14. Setting a
          mask requires at least Linux 4.19.
        '';
  
        tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''
          Pads ESP packets with additional data to have a consistent ESP packet
          size for improved Traffic Flow Confidentiality. The padding defines the
  