firewalld: 2.4.0 -> 2.4.2 & clean up (#509812)

nixos/tests/firewall.nix

@@ -89,12 +89,17 @@
         else
           "nixos-firewall-tool open tcp 80";
       reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
     in
     ''
       start_all()
 
       walled.wait_for_unit("${unit}")
       walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
       attacker.wait_for_unit("network.target")
 
       # Local connections should still work.

nixos/tests/firewalld.nix

@@ -29,6 +29,8 @@
 
     walled.wait_for_unit("firewalld")
     walled.wait_for_unit("httpd")
+    # https://github.com/firewalld/firewalld/issues/1571
+    walled.wait_until_succeeds("firewall-cmd --state")
 
     open.wait_for_unit("network.target")
 

pkgs/by-name/fi/firewalld/nm-connection-editor.patch

@@ -0,0 +1,19 @@
+--- a/src/firewall-applet.in
++++ b/src/firewall-applet.in
+@@ -59,14 +59,8 @@
+ 
+ NM_CONNECTION_EDITOR = ""
+ for binary in [
+-    "/usr/bin/systemsettings",
+-    "/bin/systemsettings",
+-    "/usr/bin/nm-connection-editor",
+-    "/bin/nm-connection-editor",
+-    "/usr/bin/kde5-nm-connection-editor",
+-    "/bin/kde5-nm-connection-editor",
+-    "/usr/bin/kde-nm-connection-editor",
+-    "/bin/kde-nm-connection-editor",
++    "/run/current-system/sw/bin/systemsettings",
++    "/run/current-system/sw/bin/nm-connection-editor",
+ ]:
+     if os.path.exists(binary):
+         NM_CONNECTION_EDITOR = binary

pkgs/by-name/fi/firewalld/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   autoconf,
   automake,
   docbook_xml_dtd_42,
@@ -13,14 +12,12 @@
   intltool,
   ipset,
   iptables,
-  kdePackages,
   kmod,
   libnotify,
   librsvg,
   libxml2,
   libxslt,
   networkmanager,
-  networkmanagerapplet,
   pkg-config,
   python3,
   qt6,
@@ -46,13 +43,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "firewalld";
-  version = "2.4.0";
+  version = "2.4.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "firewalld";
     repo = "firewalld";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-P48qdgvcF3BQZ5h+HaylHb70ECa2bmEvYiAi9CeH0qs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM=";
   };
 
   patches = [
@@ -61,28 +61,17 @@ stdenv.mkDerivation (finalAttrs: {
     ./specify-localedir.patch
 
     ./gettext-0.25.patch
-
-    # CVE-2026-4948: https://github.com/NixOS/nixpkgs/issues/505280
-    (fetchpatch2 {
-      url = "https://github.com/Prince213/firewalld/commit/e621b4b54be7cd8d77ce549ec17c6f814f9bd337.patch?full_index=1";
-      hash = "sha256-8auXNPVYnNk1UI0jM82IEQrMBhG189/I+DbaXt0VEhc=";
-    })
-  ];
+  ]
+  ++ lib.optional withGui ./nm-connection-editor.patch;
 
   postPatch = ''
     substituteInPlace config/xmlschema/check.sh \
       --replace-fail /usr/bin/ ""
 
-    for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in} \
-      config/firewall-{applet,config}.desktop.in; do
+    for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in}; do
         substituteInPlace $file \
           --replace-fail /usr "$out"
     done
-  ''
-  + lib.optionalString withGui ''
-    substituteInPlace src/firewall-applet.in \
-      --replace-fail "/usr/bin/systemsettings" "${kdePackages.systemsettings}/bin/systemsettings" \
-      --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
   '';
 
   nativeBuildInputs = [
@@ -162,8 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.tests = {
-    firewalld = nixosTests.firewalld;
-    firewall-firewalld = nixosTests.firewall-firewalld;
+    inherit (nixosTests) firewalld firewall-firewalld;
   };
 
   meta = {