anchor.diff:  
       # Perform a reverse-path test to refuse spoofers
       # For now, we just drop, as the raw table doesn't have a log-refuse yet
  -    ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
  +    ${optionalString cfg.checkReversePath ''
         if ! ip46tables -A PREROUTING -t raw -m rpfilter --invert -j DROP; then
           echo "<2>failed to initialise rpfilter support" >&2
         fi
  
positive.code:     # Clean up after added ruleset
      ip46tables -D INPUT -j nixos-fw 2>/dev/null || true
  
      ${optionalString (kernelHasRPFilter && cfg.checkReversePath) ''
        if ! ip46tables -D PREROUTING -t raw -m rpfilter --invert -j DROP; then
          echo "<2>failed to stop rpfilter support" >&2
        fi
  
negative.code:       options nf_conntrack nf_conntrack_helper=0
      '';
  
      assertions = [ { assertion = ! cfg.checkReversePath;
                       message = "This kernel does not support rpfilter"; }
                     { assertion = cfg.autoLoadConntrackHelpers || kernelCanDisableHelpers;
                       message = "This kernel does not support disabling conntrack helpers"; }
  