nixos: add configuration for firewalld

[alaviss]

Description of changes

Add new module to allow for configuration of firewalld.

This PR contains a couple auxiliary fixes:

• nftables: Fixed python module default SO import path.
• firewalld: Fixed firewall-applet and networkmanager integration.

I can split this into other PRs if that's desired.

TODO (in a future PR, maybe):

• Add an option to allow for overlaying extra default configurations. NetworkManager is known to ship with a zone configuration (disabled by default on NixOS, though).
• Patch firewalld to let it load base config from the default config directory (ie. /lib/firewalld/firewalld.conf). This should allow for services.firewalld.config to be used in tandem with ordinary user configs.

Fixes #165882
Fixes #249609

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[alaviss]

@lukegb Please help me write tests for nftables python module :P

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/1813

[deviantsemicolon]

Will this get merged or is a new PR necessary?

[quentinmit]

Some of this was already merged, but it still needs more work. Here's the overlay I apply to get a working firewalld:

  firewalld = prev.firewalld.overrideAttrs (old: {
    # Patch /usr/lib, and fix typo in nm-connection-editor
    postPatch = ''
      substituteInPlace src/firewall/config/__init__.py.in \
        --replace "/usr/share" "$out/share" \
        --replace "/usr/lib/" "/run/current-system/sw/lib/"

      for file in config/firewall-{applet,config}.desktop.in; do
        substituteInPlace $file \
          --replace "/usr/bin/" "$out/bin/"
      done
      substituteInPlace src/firewall-applet.in \
        --replace "/usr/bin/nm-connection-editor" "${final.networkmanagerapplet}/bin/nm-connection-editor"
    '';
    # Make NM available for gobject-introspection
    buildInputs = old.buildInputs ++ [final.networkmanager];
    # Fix applet executable
    nativeBuildInputs = old.nativeBuildInputs ++ [final.libsForQt5.wrapQtAppsHook];
    dontWrapQtApps = true;
    preFixup = old.preFixup + ''
      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
    '';
  });

[alaviss]

I'm closing this PR to signal that I'm not planning to work on this anytime soon.

If anyone is interested, feel free to make a new PR based off the work done here.

[deviantsemicolon]

Some of this was already merged, but it still needs more work. Here's the overlay I apply to get a working firewalld:

  firewalld = prev.firewalld.overrideAttrs (old: {
    # Patch /usr/lib, and fix typo in nm-connection-editor
    postPatch = ''
      substituteInPlace src/firewall/config/__init__.py.in \
        --replace "/usr/share" "$out/share" \
        --replace "/usr/lib/" "/run/current-system/sw/lib/"

      for file in config/firewall-{applet,config}.desktop.in; do
        substituteInPlace $file \
          --replace "/usr/bin/" "$out/bin/"
      done
      substituteInPlace src/firewall-applet.in \
        --replace "/usr/bin/nm-connection-editor" "${final.networkmanagerapplet}/bin/nm-connection-editor"
    '';
    # Make NM available for gobject-introspection
    buildInputs = old.buildInputs ++ [final.networkmanager];
    # Fix applet executable
    nativeBuildInputs = old.nativeBuildInputs ++ [final.libsForQt5.wrapQtAppsHook];
    dontWrapQtApps = true;
    preFixup = old.preFixup + ''
      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
    '';
  });

the modules were merged? i don't see any in nixos options

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/firewalld-systemd-service/49129/8