anchor.diff:          '';
       };
   
  +    networking.firewall.logReversePathDrops = mkOption {
  +      default = false;
  +      type = types.bool;
  +      description =
  +        ''
  +          Logs dropped packets failing the reverse path filter test if
  +          the option networking.firewall.checkReversePath is enabled.
  +        '';
  +    };
  +
       networking.firewall.connectionTrackingModules = mkOption {
         default = [ "ftp" ];
         example = [ "ftp" "irc" "sane" "sip" "tftp" "amanda" "h323" "netbios_sn" "pptp" "snmp" ];
  
positive.code:     # Perform a reverse-path test to refuse spoofers
      # For now, we just drop, as the raw table doesn't have a log-refuse yet
      ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
        if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
          echo "<2>failed to initialise rpfilter support" >&2
        fi
      ''}
  
      # Accept all traffic on the trusted interfaces.
  
negative.code:     ip46tables -D INPUT -j nixos-fw 2>/dev/null || true
  
      ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
        ip46tables -t raw -D PREROUTING -j nixos-fw-rpfilter 2>/dev/null || true
      ''}
  
      ${cfg.extraStopCommands}
  