From 15119b82443c3e4f4ad310fc0b351481a4e6247b Mon Sep 17 00:00:00 2001
From: aktaboot <akhtaboot@protonmail.com>
Date: Sun, 15 Sep 2024 09:39:07 +0200
Subject: [PATCH] nixos/mullvad-vpn: remove unneeded hacks

iproute2 rt_tables are no longer used upstream

and loose Reverse-Path seems to no longer be needed, according to my local test
---
 .../modules/services/networking/mullvad-vpn.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix
index 0a339cefd3f0..4c0abb9b8942 100644
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -10,7 +10,6 @@ with lib;
       default = false;
       description = ''
         This option enables Mullvad VPN daemon.
-        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
       '';
     };
 
@@ -36,12 +35,6 @@ with lib;
 
     environment.systemPackages = [ cfg.package ];
 
-    # mullvad-daemon writes to /etc/iproute2/rt_tables
-    networking.iproute2.enable = true;
-
-    # See https://github.com/NixOS/nixpkgs/issues/113589
-    networking.firewall.checkReversePath = "loose";
-
     # See https://github.com/NixOS/nixpkgs/issues/176603
     security.wrappers.mullvad-exclude = mkIf cfg.enableExcludeWrapper {
       setuid = true;
@@ -59,13 +52,9 @@ with lib;
         "NetworkManager.service"
         "systemd-resolved.service"
       ];
-      path = [
-        pkgs.iproute2
-        # Needed for ping
-        "/run/wrappers"
-        # See https://github.com/NixOS/nixpkgs/issues/262681
-      ] ++ (lib.optional config.networking.resolvconf.enable
-        config.networking.resolvconf.package);
+      # See https://github.com/NixOS/nixpkgs/issues/262681
+      path = lib.optional config.networking.resolvconf.enable
+        config.networking.resolvconf.package;
       startLimitBurst = 5;
       startLimitIntervalSec = 20;
       serviceConfig = {