From 04b8fdb00ae629dd25e7326bf6095f7915f8a3a1 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Fri, 12 Jun 2026 15:23:42 +0800
Subject: [PATCH] nixosTests.firewall-firewalld: wait until state is running

---
 nixos/tests/firewall.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix
index 31db36ef8dc1..5c2e94fccac4 100644
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -89,12 +89,17 @@
         else
           "nixos-firewall-tool open tcp 80";
       reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
     in
     ''
       start_all()
 
       walled.wait_for_unit("${unit}")
       walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
       attacker.wait_for_unit("network.target")
 
       # Local connections should still work.