From bc9cc199e43200282c4cecdfa70df146a4a48652 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 14 Apr 2026 11:58:10 +0800 Subject: [PATCH 1/4] firewalld: 2.4.0 -> 2.4.2 --- pkgs/by-name/fi/firewalld/package.nix | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix index e2f637639772..853ea60a0220 100644 --- a/pkgs/by-name/fi/firewalld/package.nix +++ b/pkgs/by-name/fi/firewalld/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitHub, - fetchpatch2, autoconf, automake, docbook_xml_dtd_42, @@ -46,13 +45,16 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "firewalld"; - version = "2.4.0"; + version = "2.4.2"; + + __structuredAttrs = true; + strictDeps = true; src = fetchFromGitHub { owner = "firewalld"; repo = "firewalld"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-P48qdgvcF3BQZ5h+HaylHb70ECa2bmEvYiAi9CeH0qs="; + tag = "v${finalAttrs.version}"; + hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM="; }; patches = [ @@ -61,20 +63,13 @@ stdenv.mkDerivation (finalAttrs: { ./specify-localedir.patch ./gettext-0.25.patch - - # CVE-2026-4948: https://github.com/NixOS/nixpkgs/issues/505280 - (fetchpatch2 { - url = "https://github.com/Prince213/firewalld/commit/e621b4b54be7cd8d77ce549ec17c6f814f9bd337.patch?full_index=1"; - hash = "sha256-8auXNPVYnNk1UI0jM82IEQrMBhG189/I+DbaXt0VEhc="; - }) ]; postPatch = '' substituteInPlace config/xmlschema/check.sh \ --replace-fail /usr/bin/ "" - for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in} \ - config/firewall-{applet,config}.desktop.in; do + for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in}; do substituteInPlace $file \ --replace-fail /usr "$out" done @@ -162,8 +157,7 @@ stdenv.mkDerivation (finalAttrs: { ''; passthru.tests = { - firewalld = nixosTests.firewalld; - firewall-firewalld = nixosTests.firewall-firewalld; + inherit (nixosTests) firewalld firewall-firewalld; }; meta = { From 737356d7d9fe7b046a61189358ee41a936b35aae Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 14 Apr 2026 11:58:10 +0800 Subject: [PATCH 2/4] firewalld: don't depend on nm-connection-editor --- .../fi/firewalld/nm-connection-editor.patch | 19 +++++++++++++++++++ pkgs/by-name/fi/firewalld/package.nix | 10 ++-------- 2 files changed, 21 insertions(+), 8 deletions(-) create mode 100644 pkgs/by-name/fi/firewalld/nm-connection-editor.patch diff --git a/pkgs/by-name/fi/firewalld/nm-connection-editor.patch b/pkgs/by-name/fi/firewalld/nm-connection-editor.patch new file mode 100644 index 000000000000..b12ef91354f7 --- /dev/null +++ b/pkgs/by-name/fi/firewalld/nm-connection-editor.patch @@ -0,0 +1,19 @@ +--- a/src/firewall-applet.in ++++ b/src/firewall-applet.in +@@ -59,14 +59,8 @@ + + NM_CONNECTION_EDITOR = "" + for binary in [ +- "/usr/bin/systemsettings", +- "/bin/systemsettings", +- "/usr/bin/nm-connection-editor", +- "/bin/nm-connection-editor", +- "/usr/bin/kde5-nm-connection-editor", +- "/bin/kde5-nm-connection-editor", +- "/usr/bin/kde-nm-connection-editor", +- "/bin/kde-nm-connection-editor", ++ "/run/current-system/sw/bin/systemsettings", ++ "/run/current-system/sw/bin/nm-connection-editor", + ]: + if os.path.exists(binary): + NM_CONNECTION_EDITOR = binary diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix index 853ea60a0220..0d7e5ea21f23 100644 --- a/pkgs/by-name/fi/firewalld/package.nix +++ b/pkgs/by-name/fi/firewalld/package.nix @@ -12,14 +12,12 @@ intltool, ipset, iptables, - kdePackages, kmod, libnotify, librsvg, libxml2, libxslt, networkmanager, - networkmanagerapplet, pkg-config, python3, qt6, @@ -63,7 +61,8 @@ stdenv.mkDerivation (finalAttrs: { ./specify-localedir.patch ./gettext-0.25.patch - ]; + ] + ++ lib.optional withGui ./nm-connection-editor.patch; postPatch = '' substituteInPlace config/xmlschema/check.sh \ @@ -73,11 +72,6 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace $file \ --replace-fail /usr "$out" done - '' - + lib.optionalString withGui '' - substituteInPlace src/firewall-applet.in \ - --replace-fail "/usr/bin/systemsettings" "${kdePackages.systemsettings}/bin/systemsettings" \ - --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor" ''; nativeBuildInputs = [ From df041989dcefc12a8a60ba50df25548623a589e8 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Fri, 12 Jun 2026 15:23:42 +0800 Subject: [PATCH 3/4] nixosTests.firewalld: wait until state is running --- nixos/tests/firewalld.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/tests/firewalld.nix b/nixos/tests/firewalld.nix index a191fe806354..5c1c34e35ece 100644 --- a/nixos/tests/firewalld.nix +++ b/nixos/tests/firewalld.nix @@ -29,6 +29,8 @@ walled.wait_for_unit("firewalld") walled.wait_for_unit("httpd") + # https://github.com/firewalld/firewalld/issues/1571 + walled.wait_until_succeeds("firewall-cmd --state") open.wait_for_unit("network.target") From 04b8fdb00ae629dd25e7326bf6095f7915f8a3a1 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Fri, 12 Jun 2026 15:23:42 +0800 Subject: [PATCH 4/4] nixosTests.firewall-firewalld: wait until state is running --- nixos/tests/firewall.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix index 31db36ef8dc1..5c2e94fccac4 100644 --- a/nixos/tests/firewall.nix +++ b/nixos/tests/firewall.nix @@ -89,12 +89,17 @@ else "nixos-firewall-tool open tcp 80"; reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset"; + # https://github.com/firewalld/firewalld/issues/1571 + waitForFirewalld = lib.optionalString (backend == "firewalld") '' + walled.wait_until_succeeds("firewall-cmd --state") + ''; in '' start_all() walled.wait_for_unit("${unit}") walled.wait_for_unit("httpd") + ${waitForFirewalld} attacker.wait_for_unit("network.target") # Local connections should still work.