<h2>Edit File: firewall-cmd</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/bin/python3 -s
# -*- coding: utf-8 -*-
#
# Copyright (C) 2009-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner &lt;twoerner@redhat.com&gt;
# Jiri Popelka &lt;jpopelka@redhat.com&gt;
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#

from gi.repository import GObject
import sys
sys.modules[&#039;gobject&#039;] = GObject

import argparse
import os

from firewall.client import FirewallClient, FirewallClientIPSetSettings, \
    FirewallClientZoneSettings, FirewallClientServiceSettings, \
    FirewallClientIcmpTypeSettings, FirewallClientHelperSettings, \
    FirewallClientPolicySettings
from firewall.errors import FirewallError
from firewall import errors
from firewall.functions import joinArgs, splitArgs, getPortRange
from firewall.core.fw_nm import nm_is_imported, \
    nm_get_connection_of_interface, nm_get_zone_of_connection, \
    nm_set_zone_of_connection, nm_get_interfaces_in_zone
from firewall.core.io.zone import zone_reader
from firewall.core.io.policy import policy_reader
from firewall.core.io.service import service_reader
from firewall.core.io.ipset import ipset_reader
from firewall.core.io.icmptype import icmptype_reader
from firewall.core.io.helper import helper_reader
from firewall.command import FirewallCommand

def __usage():
    sys.stdout.write(&quot;&quot;&quot;
Usage: firewall-cmd [OPTIONS...]

General Options
  -h, --help           Prints a short help text and exits
  -V, --version        Print the version string of firewalld
  -q, --quiet          Do not print status messages

Status Options
  --state              Return and print firewalld state
  --reload             Reload firewall and keep state information
  --complete-reload    Reload firewall and lose state information
  --runtime-to-permanent
                       Create permanent from runtime configuration
  --reset-to-defaults
                       Reset configuration to firewalld&#039;s default configuration
  --check-config       Check permanent configuration for errors

Log Denied Options
  --get-log-denied     Print the log denied value
  --set-log-denied=&lt;value&gt;
                       Set log denied value

Permanent Options
  --permanent          Set an option permanently
                       Usable for options marked with [P]

Zone Options
  --get-default-zone   Print default zone for connections and interfaces
  --set-default-zone=&lt;zone&gt;
                       Set default zone
  --get-active-zones   Print currently active zones
  --get-zones          Print predefined zones [P]
  --get-services       Print predefined services [P]
  --get-icmptypes      Print predefined icmptypes [P]
  --get-zone-of-interface=&lt;interface&gt;
                       Print name of the zone the interface is bound to [P]
  --get-zone-of-source=&lt;source&gt;[/&lt;mask&gt;]|&lt;MAC&gt;|ipset:&lt;ipset&gt;
                       Print name of the zone the source is bound to [P]
  --list-all-zones     List everything added for or enabled in all zones [P]
  --new-zone=&lt;zone&gt;    Add a new zone [P only]
  --new-zone-from-file=&lt;filename&gt; [--name=&lt;zone&gt;]
                       Add a new zone from file with optional name [P only]
  --delete-zone=&lt;zone&gt; Delete an existing zone [P only]
  --load-zone-defaults=&lt;zone&gt;
                       Load zone default settings [P only]
  --zone=&lt;zone&gt;        Use this zone to set or query options, else default zone
                       Usable for options marked with [Z]
  --info-zone=&lt;zone&gt;   Print information about a zone
  --path-zone=&lt;zone&gt;   Print file path of a zone [P only]

Policy Options
  --get-policies       Print predefined policies
  --get-active-policies
                       Print currently active policies
  --list-all-policies  List everything added for or enabled in all policies
  --new-policy=&lt;policy&gt;
                       Add a new empty policy
  --new-policy-from-file=&lt;filename&gt; [--name=&lt;policy&gt;]
                       Add a new policy from file with optional name override [P only]
  --delete-policy=&lt;policy&gt;
                       Delete an existing policy
  --load-policy-defaults=&lt;policy&gt;
                       Load policy default settings
  --policy=&lt;policy&gt;    Use this policy to set or query options
                       Usable for options marked with [O]
  --info-policy=&lt;policy&gt;
                       Print information about a policy
  --path-policy=&lt;policy&gt;
                       Print file path of a policy

IPSet Options
  --get-ipset-types    Print the supported ipset types
  --new-ipset=&lt;ipset&gt; --type=&lt;ipset type&gt; [--option=&lt;key&gt;[=&lt;value&gt;]]..
                       Add a new ipset [P only]
  --new-ipset-from-file=&lt;filename&gt; [--name=&lt;ipset&gt;]
                       Add a new ipset from file with optional name [P only]
  --delete-ipset=&lt;ipset&gt;
                       Delete an existing ipset [P only]
  --load-ipset-defaults=&lt;ipset&gt;
                       Load ipset default settings [P only]
  --info-ipset=&lt;ipset&gt; Print information about an ipset
  --path-ipset=&lt;ipset&gt; Print file path of an ipset [P only]
  --get-ipsets         Print predefined ipsets
  --ipset=&lt;ipset&gt; --set-description=&lt;description&gt;
                       Set new description to ipset [P only]
  --ipset=&lt;ipset&gt; --get-description
                       Print description for ipset [P only]
  --ipset=&lt;ipset&gt; --set-short=&lt;description&gt;
                       Set new short description to ipset [P only]
  --ipset=&lt;ipset&gt; --get-short
                       Print short description for ipset [P only]
  --ipset=&lt;ipset&gt; --add-entry=&lt;entry&gt;
                       Add a new entry to an ipset [P]
  --ipset=&lt;ipset&gt; --remove-entry=&lt;entry&gt;
                       Remove an entry from an ipset [P]
  --ipset=&lt;ipset&gt; --query-entry=&lt;entry&gt;
                       Return whether ipset has an entry [P]
  --ipset=&lt;ipset&gt; --get-entries
                       List entries of an ipset [P]
  --ipset=&lt;ipset&gt; --add-entries-from-file=&lt;entry&gt;
                       Add a new entries to an ipset [P]
  --ipset=&lt;ipset&gt; --remove-entries-from-file=&lt;entry&gt;
                       Remove entries from an ipset [P]

IcmpType Options
  --new-icmptype=&lt;icmptype&gt;
                       Add a new icmptype [P only]
  --new-icmptype-from-file=&lt;filename&gt; [--name=&lt;icmptype&gt;]
                       Add a new icmptype from file with optional name [P only]
  --delete-icmptype=&lt;icmptype&gt;
                       Delete an existing icmptype [P only]
  --load-icmptype-defaults=&lt;icmptype&gt;
                       Load icmptype default settings [P only]
  --info-icmptype=&lt;icmptype&gt;
                       Print information about an icmptype
  --path-icmptype=&lt;icmptype&gt;
                       Print file path of an icmptype [P only]
  --icmptype=&lt;icmptype&gt; --set-description=&lt;description&gt;
                       Set new description to icmptype [P only]
  --icmptype=&lt;icmptype&gt; --get-description
                       Print description for icmptype [P only]
  --icmptype=&lt;icmptype&gt; --set-short=&lt;description&gt;
                       Set new short description to icmptype [P only]
  --icmptype=&lt;icmptype&gt; --get-short
                       Print short description for icmptype [P only]
  --icmptype=&lt;icmptype&gt; --add-destination=&lt;ipv&gt;
                       Enable destination for ipv in icmptype [P only]
  --icmptype=&lt;icmptype&gt; --remove-destination=&lt;ipv&gt;
                       Disable destination for ipv in icmptype [P only]
  --icmptype=&lt;icmptype&gt; --query-destination=&lt;ipv&gt;
                       Return whether destination ipv is enabled in icmptype [P only]
  --icmptype=&lt;icmptype&gt; --get-destinations
                       List destinations in icmptype [P only]

Service Options
  --new-service=&lt;service&gt;
                       Add a new service [P only]
  --new-service-from-file=&lt;filename&gt; [--name=&lt;service&gt;]
                       Add a new service from file with optional name [P only]
  --delete-service=&lt;service&gt;
                       Delete an existing service [P only]
  --load-service-defaults=&lt;service&gt;
                       Load icmptype default settings [P only]
  --info-service=&lt;service&gt;
                       Print information about a service
  --path-service=&lt;service&gt;
                       Print file path of a service [P only]
  --service=&lt;service&gt; --set-description=&lt;description&gt;
                       Set new description to service [P only]
  --service=&lt;service&gt; --get-description
                       Print description for service [P only]
  --service=&lt;service&gt; --set-short=&lt;description&gt;
                       Set new short description to service [P only]
  --service=&lt;service&gt; --get-short
                       Print short description for service [P only]
  --service=&lt;service&gt; --add-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Add a new port to service [P only]
  --service=&lt;service&gt; --remove-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Remove a port from service [P only]
  --service=&lt;service&gt; --query-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Return whether the port has been added for service [P only]
  --service=&lt;service&gt; --get-ports
                       List ports of service [P only]
  --service=&lt;service&gt; --add-protocol=&lt;protocol&gt;
                       Add a new protocol to service [P only]
  --service=&lt;service&gt; --remove-protocol=&lt;protocol&gt;
                       Remove a protocol from service [P only]
  --service=&lt;service&gt; --query-protocol=&lt;protocol&gt;
                       Return whether the protocol has been added for service [P only]
  --service=&lt;service&gt; --get-protocols
                       List protocols of service [P only]
  --service=&lt;service&gt; --add-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Add a new source port to service [P only]
  --service=&lt;service&gt; --remove-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Remove a source port from service [P only]
  --service=&lt;service&gt; --query-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Return whether the source port has been added for service [P only]
  --service=&lt;service&gt; --get-source-ports
                       List source ports of service [P only]
  --service=&lt;service&gt; --add-helper=&lt;helper&gt;
                       Add a new helper to service [P only]
  --service=&lt;service&gt; --remove-helper=&lt;helper&gt;
                       Remove a helper from service [P only]
  --service=&lt;service&gt; --query-helper=&lt;helper&gt;
                       Return whether the helper has been added for service [P only]
  --service=&lt;service&gt; --get-service-helpers
                       List helpers of service [P only]
  --service=&lt;service&gt; --set-destination=&lt;ipv&gt;:&lt;address&gt;[/&lt;mask&gt;]
                       Set destination for ipv to address in service [P only]
  --service=&lt;service&gt; --remove-destination=&lt;ipv&gt;
                       Disable destination for ipv i service [P only]
  --service=&lt;service&gt; --query-destination=&lt;ipv&gt;:&lt;address&gt;[/&lt;mask&gt;]
                       Return whether destination ipv is set for service [P only]
  --service=&lt;service&gt; --get-destinations
                       List destinations in service [P only]
  --service=&lt;service&gt; --add-include=&lt;service&gt;
                       Add a new include to service [P only]
  --service=&lt;service&gt; --remove-include=&lt;service&gt;
                       Remove a include from service [P only]
  --service=&lt;service&gt; --query-include=&lt;service&gt;
                       Return whether the include has been added for service [P only]
  --service=&lt;service&gt; --get-includes
                       List includes of service [P only]

Options to Adapt and Query Zones and Policies
  --list-all           List everything added for or enabled [P] [Z] [O]
  --timeout=&lt;timeval&gt;  Enable an option for timeval time, where timeval is
                       a number followed by one of letters &#039;s&#039; or &#039;m&#039; or &#039;h&#039;
                       Usable for options marked with [T]
  --set-description=&lt;description&gt;
                       Set new description [P only] [Z] [O]
  --get-description    Print description [P only] [Z] [O]
  --get-target         Get the target [P only] [Z] [O]
  --set-target=&lt;target&gt;
                       Set the target [P only] [Z] [O]
  --set-short=&lt;description&gt;
                       Set new short description [Z] [O]
  --get-short          Print short description [P only] [Z] [O]
  --list-services      List services added [P] [Z]
  --add-service=&lt;service&gt;
                       Add a service [P] [Z] [O] [T]
  --remove-service=&lt;service&gt;
                       Remove a service [P] [Z] [O]
  --query-service=&lt;service&gt;
                       Return whether service has been added [P] [Z] [O]
  --list-ports         List ports added [P] [Z] [O]
  --add-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Add the port [P] [Z] [O] [T]
  --remove-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Remove the port [P] [Z] [O]
  --query-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Return whether the port has been added [P] [Z] [O]
  --list-protocols     List protocols added [P] [Z] [O]
  --add-protocol=&lt;protocol&gt;
                       Add the protocol [P] [Z] [O] [T]
  --remove-protocol=&lt;protocol&gt;
                       Remove the protocol [P] [Z] [O]
  --query-protocol=&lt;protocol&gt;
                       Return whether the protocol has been added [P] [Z] [O]
  --list-source-ports  List source ports added [P] [Z] [O]
  --add-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Add the source port [P] [Z] [O] [T]
  --remove-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Remove the source port [P] [Z] [O]
  --query-source-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Return whether the source port has been added [P] [Z] [O]
  --list-icmp-blocks   List Internet ICMP type blocks added [P] [Z] [O]
  --add-icmp-block=&lt;icmptype&gt;
                       Add an ICMP block [P] [Z] [O] [T]
  --remove-icmp-block=&lt;icmptype&gt;
                       Remove the ICMP block [P] [Z] [O]
  --query-icmp-block=&lt;icmptype&gt;
                       Return whether an ICMP block has been added [P] [Z] [O]
  --list-forward-ports List IPv4 forward ports added [P] [Z] [O]
  --add-forward-port=port=&lt;portid&gt;[-&lt;portid&gt;]:proto=&lt;protocol&gt;[:toport=&lt;portid&gt;[-&lt;portid&gt;]][:toaddr=&lt;address&gt;[/&lt;mask&gt;]]
                       Add the IPv4 forward port [P] [Z] [O] [T]
  --remove-forward-port=port=&lt;portid&gt;[-&lt;portid&gt;]:proto=&lt;protocol&gt;[:toport=&lt;portid&gt;[-&lt;portid&gt;]][:toaddr=&lt;address&gt;[/&lt;mask&gt;]]
                       Remove the IPv4 forward port [P] [Z] [O]
  --query-forward-port=port=&lt;portid&gt;[-&lt;portid&gt;]:proto=&lt;protocol&gt;[:toport=&lt;portid&gt;[-&lt;portid&gt;]][:toaddr=&lt;address&gt;[/&lt;mask&gt;]]
                       Return whether the IPv4 forward port has been added [P] [Z] [O]
  --add-masquerade     Enable IPv4 masquerade [P] [Z] [O] [T]
  --remove-masquerade  Disable IPv4 masquerade [P] [Z] [O]
  --query-masquerade   Return whether IPv4 masquerading has been enabled [P] [Z] [O]
  --list-rich-rules    List rich language rules added [P] [Z] [O]
  --add-rich-rule=&lt;rule&gt;
                       Add rich language rule &#039;rule&#039; [P] [Z] [O] [T]
  --remove-rich-rule=&lt;rule&gt;
                       Remove rich language rule &#039;rule&#039; [P] [Z] [O]
  --query-rich-rule=&lt;rule&gt;
                       Return whether a rich language rule &#039;rule&#039; has been
                       added [P] [Z] [O]

Options to Adapt and Query Zones
  --add-icmp-block-inversion
                       Enable inversion of icmp blocks for a zone [P] [Z]
  --remove-icmp-block-inversion
                       Disable inversion of icmp blocks for a zone [P] [Z]
  --query-icmp-block-inversion
                       Return whether inversion of icmp blocks has been enabled
                       for a zone [P] [Z]
  --add-forward        Enable forwarding of packets between interfaces and
                       sources in a zone [P] [Z] [T]
  --remove-forward     Disable forwarding of packets between interfaces and
                       sources in a zone [P] [Z]
  --query-forward      Return whether forwarding of packets between interfaces
                       and sources has been enabled for a zone [P] [Z]

Options to Adapt and Query Policies
  --get-priority       Get the priority [P only] [O]
  --set-priority=&lt;priority&gt;
                       Set the priority [P only] [O]
  --list-ingress-zones
                       List ingress zones that are bound to a policy [P] [O]
  --add-ingress-zone=&lt;zone&gt;
                       Add the ingress zone to a policy [P] [O]
  --remove-ingress-zone=&lt;zone&gt;
                       Remove the ingress zone from a policy [P] [O]
  --query-ingress-zone=&lt;zone&gt;
                       Query whether the ingress zone has been adedd to a
                       policy [P] [O]
  --list-egress-zones
                       List egress zones that are bound to a policy [P] [O]
  --add-egress-zone=&lt;zone&gt;
                       Add the egress zone to a policy [P] [O]
  --remove-egress-zone=&lt;zone&gt;
                       Remove the egress zone from a policy [P] [O]
  --query-egress-zone=&lt;zone&gt;
                       Query whether the egress zone has been adedd to a
                       policy [P] [O]

Options to Handle Bindings of Interfaces
  --list-interfaces    List interfaces that are bound to a zone [P] [Z]
  --add-interface=&lt;interface&gt;
                       Bind the &lt;interface&gt; to a zone [P] [Z]
  --change-interface=&lt;interface&gt;
                       Change zone the &lt;interface&gt; is bound to [P] [Z]
  --query-interface=&lt;interface&gt;
                       Query whether &lt;interface&gt; is bound to a zone [P] [Z]
  --remove-interface=&lt;interface&gt;
                       Remove binding of &lt;interface&gt; from a zone [P] [Z]

Options to Handle Bindings of Sources
  --list-sources       List sources that are bound to a zone [P] [Z]
  --add-source=&lt;source&gt;[/&lt;mask&gt;]|&lt;MAC&gt;|ipset:&lt;ipset&gt;
                       Bind the source to a zone [P] [Z]
  --change-source=&lt;source&gt;[/&lt;mask&gt;]|&lt;MAC&gt;|ipset:&lt;ipset&gt;
                       Change zone the source is bound to [Z]
  --query-source=&lt;source&gt;[/&lt;mask&gt;]|&lt;MAC&gt;|ipset:&lt;ipset&gt;
                       Query whether the source is bound to a zone [P] [Z]
  --remove-source=&lt;source&gt;[/&lt;mask&gt;]|&lt;MAC&gt;|ipset:&lt;ipset&gt;
                       Remove binding of the source from a zone [P] [Z]

Helper Options
  --new-helper=&lt;helper&gt; --module=&lt;module&gt; [--family=&lt;family&gt;]
                       Add a new helper [P only]
  --new-helper-from-file=&lt;filename&gt; [--name=&lt;helper&gt;]
                       Add a new helper from file with optional name [P only]
  --delete-helper=&lt;helper&gt;
                       Delete an existing helper [P only]
  --load-helper-defaults=&lt;helper&gt;
                       Load helper default settings [P only]
  --info-helper=&lt;helper&gt; Print information about an helper
  --path-helper=&lt;helper&gt; Print file path of an helper [P only]
  --get-helpers         Print predefined helpers
  --helper=&lt;helper&gt; --set-description=&lt;description&gt;
                       Set new description to helper [P only]
  --helper=&lt;helper&gt; --get-description
                       Print description for helper [P only]
  --helper=&lt;helper&gt; --set-short=&lt;description&gt;
                       Set new short description to helper [P only]
  --helper=&lt;helper&gt; --get-short
                       Print short description for helper [P only]
  --helper=&lt;helper&gt; --add-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Add a new port to helper [P only]
  --helper=&lt;helper&gt; --remove-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Remove a port from helper [P only]
  --helper=&lt;helper&gt; --query-port=&lt;portid&gt;[-&lt;portid&gt;]/&lt;protocol&gt;
                       Return whether the port has been added for helper [P only]
  --helper=&lt;helper&gt; --get-ports
                       List ports of helper [P only]
  --helper=&lt;helper&gt; --set-module=&lt;module&gt;
                       Set module to helper [P only]
  --helper=&lt;helper&gt; --get-module
                       Get module from helper [P only]
  --helper=&lt;helper&gt; --set-family={ipv4|ipv6|}
                       Set family for helper [P only]
  --helper=&lt;helper&gt; --get-family
                       Get module from helper [P only]

Direct Options
  --direct             First option for all direct options
  --get-all-chains
                       Get all chains [P]
  --get-chains {ipv4|ipv6|eb} &lt;table&gt;
                       Get all chains added to the table [P]
  --add-chain {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt;
                       Add a new chain to the table [P]
  --remove-chain {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt;
                       Remove the chain from the table [P]
  --query-chain {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt;
                       Return whether the chain has been added to the table [P]
  --get-all-rules
                       Get all rules [P]
  --get-rules {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt;
                       Get all rules added to chain in table [P]
  --add-rule {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;arg&gt;...
                       Add rule to chain in table [P]
  --remove-rule {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;arg&gt;...
                       Remove rule with priority from chain in table [P]
  --remove-rules {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt;
                       Remove rules from chain in table [P]
  --query-rule {ipv4|ipv6|eb} &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;arg&gt;...
                       Return whether a rule with priority has been added to
                       chain in table [P]
  --passthrough {ipv4|ipv6|eb} &lt;arg&gt;...
                       Pass a command through (untracked by firewalld)
  --get-all-passthroughs
                       Get all tracked passthrough rules [P]
  --get-passthroughs {ipv4|ipv6|eb} &lt;arg&gt;...
                       Get tracked passthrough rules [P]
  --add-passthrough {ipv4|ipv6|eb} &lt;arg&gt;...
                       Add a new tracked passthrough rule [P]
  --remove-passthrough {ipv4|ipv6|eb} &lt;arg&gt;...
                       Remove a tracked passthrough rule [P]
  --query-passthrough {ipv4|ipv6|eb} &lt;arg&gt;...
                       Return whether the tracked passthrough rule has been
                       added [P]

Lockdown Options
  --lockdown-on        Enable lockdown.
  --lockdown-off       Disable lockdown.
  --query-lockdown     Query whether lockdown is enabled

Lockdown Whitelist Options
  --list-lockdown-whitelist-commands
                       List all command lines that are on the whitelist [P]
  --add-lockdown-whitelist-command=&lt;command&gt;
                       Add the command to the whitelist [P]
  --remove-lockdown-whitelist-command=&lt;command&gt;
                       Remove the command from the whitelist [P]
  --query-lockdown-whitelist-command=&lt;command&gt;
                       Query whether the command is on the whitelist [P]
  --list-lockdown-whitelist-contexts
                       List all contexts that are on the whitelist [P]
  --add-lockdown-whitelist-context=&lt;context&gt;
                       Add the context context to the whitelist [P]
  --remove-lockdown-whitelist-context=&lt;context&gt;
                       Remove the context from the whitelist [P]
  --query-lockdown-whitelist-context=&lt;context&gt;
                       Query whether the context is on the whitelist [P]
  --list-lockdown-whitelist-uids
                       List all user ids that are on the whitelist [P]
  --add-lockdown-whitelist-uid=&lt;uid&gt;
                       Add the user id uid to the whitelist [P]
  --remove-lockdown-whitelist-uid=&lt;uid&gt;
                       Remove the user id uid from the whitelist [P]
  --query-lockdown-whitelist-uid=&lt;uid&gt;
                       Query whether the user id uid is on the whitelist [P]
  --list-lockdown-whitelist-users
                       List all user names that are on the whitelist [P]
  --add-lockdown-whitelist-user=&lt;user&gt;
                       Add the user name user to the whitelist [P]
  --remove-lockdown-whitelist-user=&lt;user&gt;
                       Remove the user name user from the whitelist [P]
  --query-lockdown-whitelist-user=&lt;user&gt;
                       Query whether the user name user is on the whitelist [P]

Panic Options
  --panic-on           Enable panic mode
  --panic-off          Disable panic mode
  --query-panic        Query whether panic mode is enabled

&quot;&quot;&quot;)

def try_set_zone_of_interface(_zone, interface):
    if nm_is_imported():
        try:
            connection = nm_get_connection_of_interface(interface)
        except Exception:
            pass
        else:
            if connection is not None:
                if _zone == nm_get_zone_of_connection(connection):
                    if _zone == &quot;&quot;:
                        cmd.print_warning(&quot;The interface is under control of NetworkManager and already bound to the default zone&quot;)
                    else:
                        cmd.print_warning(&quot;The interface is under control of NetworkManager and already bound to &#039;%s&#039;&quot; % _zone)
                if _zone == &quot;&quot;:
                    cmd.print_msg(&quot;The interface is under control of NetworkManager, setting zone to default.&quot;)
                else:
                    cmd.print_msg(&quot;The interface is under control of NetworkManager, setting zone to &#039;%s&#039;.&quot; % _zone)
                nm_set_zone_of_connection(_zone, connection)
                return True
    return False

def try_get_zone_of_interface(interface):
    if nm_is_imported():
        try:
            connection = nm_get_connection_of_interface(interface)
        except Exception:
            pass
        else:
            if connection is not None:
                return nm_get_zone_of_connection(connection)
    return False

def try_nm_get_interfaces_in_zone(zone):
    if nm_is_imported():
        try:
            return nm_get_interfaces_in_zone(zone)
        except Exception:
            pass
    return []

parser = argparse.ArgumentParser(usage=&quot;&#039;firewall-cmd --help&#039; for usage information or see firewall-cmd(1) man page&quot;,
                                 add_help=False)

parser_group_output = parser.add_mutually_exclusive_group()
parser_group_output.add_argument(&quot;-v&quot;, &quot;--verbose&quot;, action=&quot;store_true&quot;)
parser_group_output.add_argument(&quot;-q&quot;, &quot;--quiet&quot;, action=&quot;store_true&quot;)

parser_group_standalone = parser.add_mutually_exclusive_group()
parser_group_standalone.add_argument(&quot;-h&quot;, &quot;--help&quot;,
                                     action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;-V&quot;, &quot;--version&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--state&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--reload&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--complete-reload&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--runtime-to-permanent&quot;,
                                     action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--reset-to-defaults&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--check-config&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-ipset-types&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-log-denied&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--set-log-denied&quot;, metavar=&quot;&lt;value&gt;&quot;)
parser_group_standalone.add_argument(&quot;--get-automatic-helpers&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--set-automatic-helpers&quot;, metavar=&quot;&lt;value&gt;&quot;)
parser_group_standalone.add_argument(&quot;--panic-on&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--panic-off&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--query-panic&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--lockdown-on&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--lockdown-off&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--query-lockdown&quot;, action=&quot;store_true&quot;)

parser_group_standalone.add_argument(&quot;--get-default-zone&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--set-default-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_standalone.add_argument(&quot;--get-zones&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-policies&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-services&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-icmptypes&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-active-zones&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-active-policies&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--get-zone-of-interface&quot;, metavar=&quot;&lt;iface&gt;&quot;, action=&#039;append&#039;)
parser_group_standalone.add_argument(&quot;--get-zone-of-source&quot;, metavar=&quot;&lt;source&gt;&quot;, action=&#039;append&#039;)
parser_group_standalone.add_argument(&quot;--list-all-zones&quot;, action=&quot;store_true&quot;)
parser_group_standalone.add_argument(&quot;--list-all-policies&quot;, action=&quot;store_true&quot;)

parser_group_standalone.add_argument(&quot;--info-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_standalone.add_argument(&quot;--info-policy&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser_group_standalone.add_argument(&quot;--info-service&quot;, metavar=&quot;&lt;service&gt;&quot;)
parser_group_standalone.add_argument(&quot;--info-icmptype&quot;, metavar=&quot;&lt;icmptype&gt;&quot;)
parser_group_standalone.add_argument(&quot;--info-ipset&quot;, metavar=&quot;&lt;ipset&gt;&quot;)
parser_group_standalone.add_argument(&quot;--info-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;)

parser_group_config = parser.add_mutually_exclusive_group()
parser_group_config.add_argument(&quot;--new-icmptype&quot;, metavar=&quot;&lt;icmptype&gt;&quot;)
parser_group_config.add_argument(&quot;--new-icmptype-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-icmptype&quot;, metavar=&quot;&lt;icmptype&gt;&quot;)
parser_group_config.add_argument(&quot;--load-icmptype-defaults&quot;,
                                 metavar=&quot;&lt;icmptype&gt;&quot;)
parser_group_config.add_argument(&quot;--new-service&quot;, metavar=&quot;&lt;service&gt;&quot;)
parser_group_config.add_argument(&quot;--new-service-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-service&quot;, metavar=&quot;&lt;service&gt;&quot;)
parser_group_config.add_argument(&quot;--load-service-defaults&quot;, metavar=&quot;&lt;service&gt;&quot;)
parser_group_config.add_argument(&quot;--new-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_config.add_argument(&quot;--new-zone-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_config.add_argument(&quot;--load-zone-defaults&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_config.add_argument(&quot;--new-policy&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser_group_config.add_argument(&quot;--new-policy-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-policy&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser_group_config.add_argument(&quot;--load-policy-defaults&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser_group_config.add_argument(&quot;--new-ipset&quot;, metavar=&quot;&lt;ipset&gt;&quot;)
parser_group_config.add_argument(&quot;--new-ipset-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-ipset&quot;, metavar=&quot;&lt;ipset&gt;&quot;)
parser_group_config.add_argument(&quot;--load-ipset-defaults&quot;, metavar=&quot;&lt;ipset&gt;&quot;)
parser_group_config.add_argument(&quot;--new-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;)
parser_group_config.add_argument(&quot;--new-helper-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;)
parser_group_config.add_argument(&quot;--delete-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;)
parser_group_config.add_argument(&quot;--load-helper-defaults&quot;, metavar=&quot;&lt;helper&gt;&quot;)

parser_group_config.add_argument(&quot;--path-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser_group_config.add_argument(&quot;--path-policy&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser_group_config.add_argument(&quot;--path-service&quot;, metavar=&quot;&lt;service&gt;&quot;)
parser_group_config.add_argument(&quot;--path-icmptype&quot;, metavar=&quot;&lt;icmptype&gt;&quot;)
parser_group_config.add_argument(&quot;--path-ipset&quot;, metavar=&quot;&lt;ipset&gt;&quot;)
parser_group_config.add_argument(&quot;--path-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;)

parser.add_argument(&quot;--name&quot;, default=&quot;&quot;, metavar=&quot;&lt;name&gt;&quot;)

parser_group_lockdown_whitelist = parser.add_mutually_exclusive_group()
parser_group_lockdown_whitelist.add_argument(&quot;--list-lockdown-whitelist-commands&quot;, action=&quot;store_true&quot;)
parser_group_lockdown_whitelist.add_argument(&quot;--add-lockdown-whitelist-command&quot;, metavar=&quot;&lt;command&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--remove-lockdown-whitelist-command&quot;, metavar=&quot;&lt;command&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--query-lockdown-whitelist-command&quot;, metavar=&quot;&lt;command&gt;&quot;, action=&#039;append&#039;)

parser_group_lockdown_whitelist.add_argument(&quot;--list-lockdown-whitelist-contexts&quot;, action=&quot;store_true&quot;)
parser_group_lockdown_whitelist.add_argument(&quot;--add-lockdown-whitelist-context&quot;, metavar=&quot;&lt;context&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--remove-lockdown-whitelist-context&quot;, metavar=&quot;&lt;context&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--query-lockdown-whitelist-context&quot;, metavar=&quot;&lt;context&gt;&quot;, action=&#039;append&#039;)

parser_group_lockdown_whitelist.add_argument(&quot;--list-lockdown-whitelist-uids&quot;, action=&quot;store_true&quot;)
parser_group_lockdown_whitelist.add_argument(&quot;--add-lockdown-whitelist-uid&quot;, metavar=&quot;&lt;uid&gt;&quot;, type=int, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--remove-lockdown-whitelist-uid&quot;, metavar=&quot;&lt;uid&gt;&quot;, type=int, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--query-lockdown-whitelist-uid&quot;, metavar=&quot;&lt;uid&gt;&quot;, type=int, action=&#039;append&#039;)

parser_group_lockdown_whitelist.add_argument(&quot;--list-lockdown-whitelist-users&quot;, action=&quot;store_true&quot;)
parser_group_lockdown_whitelist.add_argument(&quot;--add-lockdown-whitelist-user&quot;, metavar=&quot;&lt;user&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--remove-lockdown-whitelist-user&quot;, metavar=&quot;&lt;user&gt;&quot;, action=&#039;append&#039;)
parser_group_lockdown_whitelist.add_argument(&quot;--query-lockdown-whitelist-user&quot;, metavar=&quot;&lt;user&gt;&quot;, action=&#039;append&#039;)

parser.add_argument(&quot;--permanent&quot;, action=&quot;store_true&quot;)
parser.add_argument(&quot;--zone&quot;, default=&quot;&quot;, metavar=&quot;&lt;zone&gt;&quot;)
parser.add_argument(&quot;--policy&quot;, default=&quot;&quot;, metavar=&quot;&lt;policy&gt;&quot;)
parser.add_argument(&quot;--timeout&quot;, default=&quot;0&quot;, metavar=&quot;&lt;seconds&gt;&quot;)

parser_group_zone_or_policy = parser.add_mutually_exclusive_group()
parser_group_zone_or_policy.add_argument(&quot;--add-interface&quot;, metavar=&quot;&lt;iface&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-interface&quot;, metavar=&quot;&lt;iface&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-interface&quot;, metavar=&quot;&lt;iface&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--change-interface&quot;, &quot;--change-zone&quot;, metavar=&quot;&lt;iface&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--list-interfaces&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-source&quot;, metavar=&quot;&lt;source&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-source&quot;, metavar=&quot;&lt;source&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-source&quot;, metavar=&quot;&lt;source&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--change-source&quot;, metavar=&quot;&lt;source&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--list-sources&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-ingress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-ingress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-ingress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--list-ingress-zones&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-egress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-egress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-egress-zone&quot;, metavar=&quot;&lt;zone&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--list-egress-zones&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-rich-rule&quot;, metavar=&quot;&lt;rule&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-rich-rule&quot;, metavar=&quot;&lt;rule&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-rich-rule&quot;, metavar=&quot;&lt;rule&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-service&quot;, metavar=&quot;&lt;service&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-service&quot;, metavar=&quot;&lt;zone_or_policy&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-service&quot;, metavar=&quot;&lt;zone_or_policy&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-protocol&quot;, metavar=&quot;&lt;protocol&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-protocol&quot;, metavar=&quot;&lt;protocol&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-protocol&quot;, metavar=&quot;&lt;protocol&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-source-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-source-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-source-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-forward&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--remove-forward&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--query-forward&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-masquerade&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--remove-masquerade&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--query-masquerade&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-icmp-block&quot;, metavar=&quot;&lt;icmptype&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-icmp-block&quot;, metavar=&quot;&lt;icmptype&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-icmp-block&quot;, metavar=&quot;&lt;icmptype&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--add-icmp-block-inversion&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--remove-icmp-block-inversion&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--query-icmp-block-inversion&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--add-forward-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--remove-forward-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--query-forward-port&quot;, metavar=&quot;&lt;port&gt;&quot;, action=&#039;append&#039;)
parser_group_zone_or_policy.add_argument(&quot;--list-rich-rules&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-services&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-ports&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-protocols&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-icmp-blocks&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-forward-ports&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-source-ports&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--list-all&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--get-target&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--set-target&quot;, metavar=&quot;&lt;target&gt;&quot;)
parser_group_zone_or_policy.add_argument(&quot;--get-priority&quot;, action=&quot;store_true&quot;)
parser_group_zone_or_policy.add_argument(&quot;--set-priority&quot;, metavar=&quot;&lt;priority&gt;&quot;)

parser.add_argument(&quot;--option&quot;, metavar=&quot;&lt;key&gt;[=&lt;value&gt;]&quot;, action=&#039;append&#039;)
parser.add_argument(&quot;--type&quot;, metavar=&quot;&lt;ipsettype&gt;&quot;)
parser.add_argument(&quot;--ipset&quot;, metavar=&quot;&lt;ipset&gt;&quot;)

parser_ipset = parser.add_mutually_exclusive_group()
#parser_ipset.add_argument(&quot;--add-option&quot;, metavar=&quot;&lt;key&gt;[=&lt;value&gt;]&quot;)
#parser_ipset.add_argument(&quot;--remove-option&quot;, metavar=&quot;&lt;key&gt;[=&lt;value&gt;]&quot;)
#parser_ipset.add_argument(&quot;--query-option&quot;, metavar=&quot;&lt;key&gt;[=&lt;value&gt;]&quot;)
#parser_ipset.add_argument(&quot;--get-options&quot;, action=&quot;store_true&quot;)

parser_ipset.add_argument(&quot;--get-ipsets&quot;, action=&quot;store_true&quot;)
parser_ipset.add_argument(&quot;--add-entry&quot;, metavar=&quot;&lt;entry&gt;&quot;, action=&#039;append&#039;)
parser_ipset.add_argument(&quot;--remove-entry&quot;, metavar=&quot;&lt;entry&gt;&quot;, action=&#039;append&#039;)
parser_ipset.add_argument(&quot;--query-entry&quot;, metavar=&quot;&lt;entry&gt;&quot;, action=&#039;append&#039;)
parser_ipset.add_argument(&quot;--get-entries&quot;, action=&quot;store_true&quot;)
parser_ipset.add_argument(&quot;--add-entries-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;, action=&#039;append&#039;)
parser_ipset.add_argument(&quot;--remove-entries-from-file&quot;, metavar=&quot;&lt;filename&gt;&quot;, action=&#039;append&#039;)

parser.add_argument(&quot;--icmptype&quot;, metavar=&quot;&lt;icmptype&gt;&quot;)

parser_icmptype = parser.add_mutually_exclusive_group()
parser_icmptype.add_argument(&quot;--add-destination&quot;, metavar=&quot;&lt;ipv&gt;&quot;, action=&#039;append&#039;)
parser_icmptype.add_argument(&quot;--remove-destination&quot;, metavar=&quot;&lt;ipv&gt;&quot;, action=&#039;append&#039;)
parser_icmptype.add_argument(&quot;--query-destination&quot;, metavar=&quot;&lt;ipv&gt;&quot;, action=&#039;append&#039;)
parser_icmptype.add_argument(&quot;--get-destinations&quot;, action=&quot;store_true&quot;)

parser.add_argument(&quot;--service&quot;, metavar=&quot;&lt;service&gt;&quot;)

parser_service = parser.add_mutually_exclusive_group()
parser_service.add_argument(&quot;--get-ports&quot;, action=&quot;store_true&quot;)
parser_service.add_argument(&quot;--get-source-ports&quot;, action=&quot;store_true&quot;)
parser_service.add_argument(&quot;--get-protocols&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--add-module&quot;, metavar=&quot;&lt;module&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--remove-module&quot;, metavar=&quot;&lt;module&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--query-module&quot;, metavar=&quot;&lt;module&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--get-modules&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--add-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--remove-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--query-helper&quot;, metavar=&quot;&lt;helper&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--get-service-helpers&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--add-include&quot;, metavar=&quot;&lt;service&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--remove-include&quot;, metavar=&quot;&lt;service&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--query-include&quot;, metavar=&quot;&lt;service&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--get-includes&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--set-destination&quot;, metavar=&quot;&lt;destination&gt;&quot;, action=&#039;append&#039;)
parser_service.add_argument(&quot;--get-destination&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--set-description&quot;, metavar=&quot;&lt;description&gt;&quot;)
parser_service.add_argument(&quot;--get-description&quot;, action=&quot;store_true&quot;)

parser_service.add_argument(&quot;--set-short&quot;, metavar=&quot;&lt;description&gt;&quot;)
parser_service.add_argument(&quot;--get-short&quot;, action=&quot;store_true&quot;)

parser.add_argument(&quot;--helper&quot;, metavar=&quot;&lt;helper&gt;&quot;)
parser.add_argument(&quot;--family&quot;, metavar=&quot;&lt;family&gt;&quot;)
parser.add_argument(&quot;--module&quot;, metavar=&quot;&lt;module&gt;&quot;)

parser_helper = parser.add_mutually_exclusive_group()
#parser_helper.add_argument(&quot;--get-ports&quot;, action=&quot;store_true&quot;)
parser_helper.add_argument(&quot;--get-helpers&quot;, action=&quot;store_true&quot;)
parser_helper.add_argument(&quot;--set-module&quot;, metavar=&quot;&lt;module&gt;&quot;)
parser_helper.add_argument(&quot;--get-module&quot;, action=&quot;store_true&quot;)
#parser_helper.add_argument(&quot;--query-module&quot;, metavar=&quot;&lt;module&gt;&quot;)
parser_helper.add_argument(&quot;--set-family&quot;, metavar=&quot;&lt;family&gt;|&#039;&#039;&quot;, nargs=&quot;*&quot;)
parser_helper.add_argument(&quot;--get-family&quot;, action=&quot;store_true&quot;)

parser.add_argument(&quot;--direct&quot;, action=&quot;store_true&quot;)

# not possible to have sequences of options here
parser_direct = parser.add_mutually_exclusive_group()
parser_direct.add_argument(&quot;--passthrough&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--add-passthrough&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--remove-passthrough&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--query-passthrough&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--get-passthroughs&quot;, nargs=1,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;))
parser_direct.add_argument(&quot;--get-all-passthroughs&quot;, action=&quot;store_true&quot;)
parser_direct.add_argument(&quot;--add-chain&quot;, nargs=3,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt;&quot;, &quot;&lt;chain&gt;&quot;))
parser_direct.add_argument(&quot;--remove-chain&quot;, nargs=3,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt;&quot;, &quot;&lt;chain&gt;&quot;))
parser_direct.add_argument(&quot;--query-chain&quot;, nargs=3,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt;&quot;, &quot;&lt;chain&gt;&quot;))
parser_direct.add_argument(&quot;--get-all-chains&quot;, action=&quot;store_true&quot;)
parser_direct.add_argument(&quot;--get-chains&quot;, nargs=2,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt;&quot;))
parser_direct.add_argument(&quot;--add-rule&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--remove-rule&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--remove-rules&quot;, nargs=3,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt; &lt;chain&gt;&quot;))
parser_direct.add_argument(&quot;--query-rule&quot;, nargs=argparse.REMAINDER,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;))
parser_direct.add_argument(&quot;--get-rules&quot;, nargs=3,
                           metavar=(&quot;{ ipv4 | ipv6 | eb }&quot;, &quot;&lt;table&gt;&quot;, &quot;&lt;chain&gt;&quot;))
parser_direct.add_argument(&quot;--get-all-rules&quot;, action=&quot;store_true&quot;)

##############################################################################

args = sys.argv[1:]

if len(sys.argv) &gt; 1:
    i = -1
    if &#039;--passthrough&#039; in args:
        i = args.index(&#039;--passthrough&#039;) + 1
    elif &#039;--add-passthrough&#039; in args:
        i = args.index(&#039;--add-passthrough&#039;) + 1
    elif &#039;--remove-passthrough&#039; in args:
        i = args.index(&#039;--remove-passthrough&#039;) + 1
    elif &#039;--query-passthrough&#039; in args:
        i = args.index(&#039;--query-passthrough&#039;) + 1
    elif &#039;--add-rule&#039; in args:
        i = args.index(&#039;--add-rule&#039;) + 4
    elif &#039;--remove-rule&#039; in args:
        i = args.index(&#039;--remove-rule&#039;) + 4
    elif &#039;--query-rule&#039; in args:
        i = args.index(&#039;--query-rule&#039;) + 4
    # join &lt;args&gt; into one argument to prevent parser from parsing each iptables
    # option, because they can conflict with firewall-cmd options
    # # e.g. --delete (iptables) and --delete-* (firewall-cmd)
    if (i &gt; -1) and (i &lt; len(args) - 1):
        aux_args = args[:]
        args = aux_args[:i+1] # all but not &lt;args&gt;
        args.append(joinArgs(aux_args[i+1:])) # add &lt;args&gt; as one arg

a = parser.parse_args(args)

options_standalone = a.help or a.version or \
    a.state or a.reload or a.complete_reload or a.runtime_to_permanent or \
    a.reset_to_defaults or a.panic_on or a.panic_off or a.query_panic or \
    a.lockdown_on or a.lockdown_off or a.query_lockdown or \
    a.get_default_zone or a.set_default_zone or \
    a.get_active_zones or a.get_ipset_types or \
    a.get_log_denied or a.set_log_denied or \
    a.get_automatic_helpers or a.set_automatic_helpers or a.check_config or \
    a.get_active_policies

options_desc_xml_file = a.set_description or a.get_description or \
                        a.set_short or a.get_short

options_lockdown_whitelist = \
    a.list_lockdown_whitelist_commands or a.add_lockdown_whitelist_command or \
    a.remove_lockdown_whitelist_command or \
    a.query_lockdown_whitelist_command or \
    a.list_lockdown_whitelist_contexts or a.add_lockdown_whitelist_context or \
    a.remove_lockdown_whitelist_context or \
    a.query_lockdown_whitelist_context or \
    a.list_lockdown_whitelist_uids or a.add_lockdown_whitelist_uid is not None or \
    a.remove_lockdown_whitelist_uid is not None or \
    a.query_lockdown_whitelist_uid is not None or \
    a.list_lockdown_whitelist_users or a.add_lockdown_whitelist_user or \
    a.remove_lockdown_whitelist_user or \
    a.query_lockdown_whitelist_user

options_config = a.get_zones or a.get_services or a.get_icmptypes or \
                 options_lockdown_whitelist or a.list_all_zones or \
                 a.get_zone_of_interface or a.get_zone_of_source or \
                 a.info_zone or a.info_icmptype or a.info_service or \
                 a.info_ipset or a.info_policy or a.get_ipsets or a.info_helper or \
                 a.get_helpers or a.get_policies or a.list_all_policies

options_zone_and_policy_adapt_query = \
    a.add_service or a.remove_service or a.query_service or \
    a.add_port or a.remove_port or a.query_port or \
    a.add_protocol or a.remove_protocol or a.query_protocol or \
    a.add_source_port or a.remove_source_port or a.query_source_port or \
    a.add_icmp_block or a.remove_icmp_block or a.query_icmp_block or \
    a.add_forward_port or a.remove_forward_port or a.query_forward_port or \
    a.add_rich_rule or a.remove_rich_rule or a.query_rich_rule or \
    a.add_masquerade or a.remove_masquerade or a.query_masquerade or \
    a.list_services or a.list_ports or a.list_protocols or \
    a.list_source_ports or \
    a.list_icmp_blocks or a.list_forward_ports or a.list_rich_rules or \
    a.list_all or a.get_target or a.set_target

options_zone_unique = \
    a.add_icmp_block_inversion or a.remove_icmp_block_inversion or \
    a.query_icmp_block_inversion or \
    a.add_forward or a.remove_forward or a.query_forward or \
    a.list_interfaces or a.change_interface or \
    a.add_interface or a.remove_interface or a.query_interface or \
    a.list_sources or a.change_source or \
    a.add_source or a.remove_source or a.query_source

options_zone_ops = options_zone_unique or options_zone_and_policy_adapt_query

options_policy_unique = \
    a.list_ingress_zones or a.add_ingress_zone or \
    a.remove_ingress_zone or a.query_ingress_zone or \
    a.list_egress_zones or a.add_egress_zone or \
    a.remove_egress_zone or a.query_egress_zone or \
    a.set_priority or a.get_priority

options_policy_ops = options_policy_unique or options_zone_and_policy_adapt_query

options_zone = a.zone or a.timeout != &quot;0&quot; or options_zone_ops or \
               options_desc_xml_file

options_policy = a.policy or a.timeout != &quot;0&quot; or options_policy_ops or \
                 options_desc_xml_file

options_ipset = a.add_entry or a.remove_entry or a.query_entry or \
                a.get_entries or a.add_entries_from_file or \
                a.remove_entries_from_file or options_desc_xml_file

options_icmptype = a.add_destination or a.remove_destination or \
                   a.query_destination or a.get_destinations or \
                   options_desc_xml_file

options_service = a.add_port or a.remove_port or a.query_port or \
                  a.get_ports or \
                  a.add_protocol or a.remove_protocol or a.query_protocol or \
                  a.get_protocols or \
                  a.add_source_port or a.remove_source_port or \
                  a.query_source_port or a.get_source_ports or \
                  a.add_module or a.remove_module or a.query_module or \
                  a.get_modules or \
                  a.set_destination or a.remove_destination or \
                  a.query_destination or a.get_destinations or \
                  options_desc_xml_file or \
                  a.add_include or a.remove_include or a.query_include or \
                  a.get_includes or \
                  a.add_helper or a.remove_helper or a.query_helper or \
                  a.get_service_helpers

options_helper = a.add_port or a.remove_port or a.query_port or \
                 a.get_ports or a.set_module or a.get_module or \
                 a.set_family or a.get_family or \
                 options_desc_xml_file

options_permanent = a.permanent or options_config or \
                    a.zone or options_zone_ops or \
                    a.policy or options_policy_ops or \
                    a.ipset or options_ipset or \
                    a.helper or options_helper

options_permanent_only = a.new_icmptype or a.delete_icmptype or \
                         a.new_icmptype_from_file or \
                         a.load_icmptype_defaults or \
                         a.new_service or a.delete_service or \
                         a.new_service_from_file or \
                         a.load_service_defaults or \
                         a.new_zone or a.delete_zone or \
                         a.new_zone_from_file or \
                         a.load_zone_defaults or \
                         a.new_policy or a.delete_policy or \
                         a.new_policy_from_file or \
                         a.load_policy_defaults or \
                         a.new_ipset or a.delete_ipset or \
                         a.new_ipset_from_file or \
                         a.load_ipset_defaults or \
                         a.new_helper or a.delete_helper or \
                         a.new_helper_from_file or \
                         a.load_helper_defaults or \
                         (a.icmptype and options_icmptype) or \
                         (a.service and options_service) or \
                         (a.helper and options_helper) or \
                         a.path_zone or a.path_icmptype or a.path_service or \
                         a.path_ipset or a.path_helper or options_desc_xml_file or \
                         a.path_policy

options_direct = a.passthrough or \
           a.add_chain or a.remove_chain or a.query_chain or \
           a.get_chains or a.get_all_chains or \
           a.add_rule or a.remove_rule or a.remove_rules or a.query_rule or \
           a.get_rules or a.get_all_rules or \
           a.add_passthrough or a.remove_passthrough or a.query_passthrough or \
           a.get_passthroughs or a.get_all_passthroughs

options_require_permanent = options_permanent_only or \
                            a.get_target or a.set_target

# these are supposed to only write out some output
options_list_get = a.help or a.version or a.list_all or a.list_all_zones or \
    a.list_lockdown_whitelist_commands or a.list_lockdown_whitelist_contexts or \
    a.list_lockdown_whitelist_uids or a.list_lockdown_whitelist_users or \
    a.list_services or a.list_ports or a.list_protocols or a.list_icmp_blocks or \
    a.list_forward_ports or a.list_rich_rules or a.list_interfaces or \
    a.list_sources or a.get_default_zone or a.get_active_zones or \
    a.get_zone_of_interface or a.get_zone_of_source or a.get_zones or \
    a.get_services or a.get_icmptypes or a.get_target or \
    a.info_zone or a.info_icmptype or a.info_service or \
    a.info_ipset or a.get_ipsets or a.get_entries or \
    a.info_helper or a.get_helpers or \
    a.get_destinations or a.get_description or \
    a.list_all_policies or a.info_policy or a.get_policies or \
    a.get_active_policies

# Set quiet and verbose

cmd = FirewallCommand(a.quiet, a.verbose)

def myexcepthook(exctype, value, traceback):
    cmd.exception_handler(str(value))
sys.excepthook = myexcepthook

# Check various impossible combinations of options

if options_standalone and (options_zone or options_permanent or \
                           options_direct or options_permanent_only or \
                           options_ipset or options_policy):
    cmd.fail(parser.format_usage() +
             &quot;Can&#039;t use stand-alone options with other options.&quot;)

if options_ipset and not options_desc_xml_file and not a.ipset:
    cmd.fail(parser.format_usage() + &quot;No ipset specified.&quot;)

if (options_icmptype and not a.icmptype) and \
   not (options_service and a.service) and not options_desc_xml_file:
    cmd.fail(parser.format_usage() + &quot;No icmptype specified.&quot;)

if (options_helper and not a.helper) and \
   not (options_service and a.service) and \
   not options_zone and not options_desc_xml_file and not options_policy:
    cmd.fail(parser.format_usage() + &quot;No helper specified.&quot;)

if (options_direct or options_permanent_only) and \
   (options_zone and not a.zone) and (options_service and not a.service) and \
   (options_icmptype and a.icmptype) and not options_desc_xml_file:
    cmd.fail(parser.format_usage() + &quot;Can&#039;t be used with --zone.&quot;)

if (a.direct and not options_direct) or (options_direct and not a.direct):
    cmd.fail(parser.format_usage() +
             &quot;Wrong usage of &#039;direct&#039; options.&quot;)

if a.zone and a.direct:
    cmd.fail(parser.format_usage() + &quot;--zone is an invalid option with --direct&quot;)

if a.name and not (a.new_zone_from_file or a.new_service_from_file or \
                   a.new_ipset_from_file or a.new_icmptype_from_file or \
                   a.new_helper_from_file or a.new_policy_from_file):
    cmd.fail(parser.format_usage() + &quot;Wrong usage of &#039;--name&#039; option.&quot;)

if options_require_permanent and not a.permanent:
    cmd.fail(parser.format_usage() +
             &quot;Option can be used only with --permanent.&quot;)

if options_config and (options_zone or options_policy):
    cmd.fail(parser.format_usage() +
             &quot;Wrong usage of --get-zones | --get-services | --get-icmptypes | --get-policies.&quot;)

if a.timeout != &quot;0&quot;:
    value = 0
    unit = &#039;s&#039;
    if len(a.timeout) &lt; 1:
        cmd.fail(parser.format_usage() +
                 &quot;&#039;%s&#039; is wrong timeout value. Use for example &#039;2m&#039; or &#039;1h&#039;&quot; % a.timeout)
    elif len(a.timeout) == 1:
        if a.timeout.isdigit():
            value = int (a.timeout[0])
        else:
            cmd.fail(parser.format_usage() +
                     &quot;&#039;%s&#039; is wrong timeout value. Use for example &#039;2m&#039; or &#039;1h&#039;&quot; % a.timeout)
    elif len(a.timeout) &gt; 1:
        if a.timeout.isdigit():
            value = int(a.timeout)
            unit = &#039;s&#039;
        else:
            if a.timeout[:-1].isdigit():
                value = int (a.timeout[:-1])
            else:
                cmd.fail(parser.format_usage() +
                         &quot;&#039;%s&#039; is wrong timeout value. Use for example &#039;2m&#039; or &#039;1h&#039;&quot; % a.timeout)
            unit = a.timeout[-1:].lower()
    if unit == &#039;s&#039;:
        a.timeout = value
    elif unit == &#039;m&#039;:
        a.timeout = value * 60
    elif unit == &#039;h&#039;:
        a.timeout = value * 60 * 60
    else:
        cmd.fail(parser.format_usage() +
                 &quot;&#039;%s&#039; is wrong timeout value. Use for example &#039;2m&#039; or &#039;1h&#039;&quot; % a.timeout)
else:
    a.timeout = 0

if a.timeout and not (a.add_service or a.add_port or a.add_protocol or \
                      a.add_icmp_block or a.add_forward_port or \
                      a.add_source_port or a.add_forward or \
                      a.add_masquerade or a.add_rich_rule):
    cmd.fail(parser.format_usage() + &quot;Wrong --timeout usage&quot;)

if a.permanent:
    if a.timeout:
        cmd.fail(parser.format_usage() +
                 &quot;Can&#039;t specify timeout for permanent action.&quot;)
    if options_config and not a.zone:
        pass
    elif options_permanent:
        pass
    else:
        cmd.fail(parser.format_usage() + &quot;Wrong --permanent usage.&quot;)

if a.quiet and options_list_get:
    # it makes no sense to use --quiet with these options
    a.quiet = False
    cmd.set_quiet(a.quiet)
    cmd.fail(&quot;-q/--quiet can&#039;t be used with this option(s)&quot;)

if a.zone and a.policy:
    cmd.fail(parser.format_usage() + &quot;Can&#039;t use --zone with --policy.&quot;)

if a.policy and options_zone_unique:
    cmd.fail(parser.format_usage() + &quot;Can&#039;t use --policy with zone only options.&quot;)

if a.zone and options_policy_unique:
    cmd.fail(parser.format_usage() + &quot;Can&#039;t use --zone with policy only options.&quot;)

if not a.policy and options_policy_unique:
    cmd.fail(parser.format_usage() + &quot;Must use --policy with policy only options.&quot;)

if a.help:
    __usage()
    sys.exit(0)

zone = a.zone

try:
    fw = FirewallClient()
except FirewallError as msg:
    code = FirewallError.get_code(str(msg))
    cmd.print_and_exit(&quot;Error: %s&quot; % msg, code)

fw.setExceptionHandler(cmd.exception_handler)

if not (options_standalone or options_ipset or \
        options_icmptype or options_service or options_helper or \
        options_config or options_zone_ops or options_policy or \
        options_direct or options_permanent_only):
    state = fw.get_property(&quot;state&quot;)
    if state == &quot;RUNNING&quot;:
        state = &quot;State: running\n\n&quot;
    elif state == &quot;FAILED&quot;:
        state = &quot;State: failed\n\n&quot;
    else:
        state = &quot;State: not running\n\n&quot;
    cmd.fail(state + &quot;No options specified\n&quot; + parser.format_usage()[:-1])

if not fw.connected:
    if a.state:
        cmd.print_and_exit (&quot;not running&quot;, errors.NOT_RUNNING)
    else:
        cmd.print_and_exit (&quot;FirewallD is not running&quot;, errors.NOT_RUNNING)
cmd.set_fw(fw)

if options_zone_ops and not zone and not a.policy and not \
   (a.service and options_service) and not \
   (a.helper and options_helper):
    default = fw.getDefaultZone()
    cmd.print_if_verbose(&quot;No zone specified, using default zone, i.e. &#039;%s&#039;&quot; % default)
    active = list(fw.getActiveZones().keys())
    if active and default not in active:
        cmd.print_msg(&quot;&quot;&quot;You&#039;re performing an operation over default zone (&#039;%s&#039;),
but your connections/interfaces are in zone &#039;%s&#039; (see --get-active-zones)
You most likely need to use --zone=%s option.\n&quot;&quot;&quot; % (default, &quot;,&quot;.join(active), active[0]))

if a.permanent:
    if a.get_ipsets:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getIPSetNames()))

    elif a.new_ipset:
        if not a.type:
            cmd.fail(parser.format_usage() + &quot;No type specified.&quot;)

        if a.type==&#039;hash:mac&#039; and a.family:
            cmd.fail(parser.format_usage()+ &quot;--family is not compatible with the hash:mac type&quot;)

        settings = FirewallClientIPSetSettings()
        settings.setType(a.type)
        if a.option:
            for opt in a.option:
                settings.addOption(*cmd.parse_ipset_option(opt))
        if a.family:
            settings.addOption(&quot;family&quot;, a.family)
        config = fw.config()
        config.addIPSet(a.new_ipset, settings)

    elif a.new_ipset_from_file:
        filename = os.path.basename(a.new_ipset_from_file)
        dirname = os.path.dirname(a.new_ipset_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = ipset_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load ipset file &#039;%s&#039;: %s&quot; % \
                   (a.new_ipset_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load ipset file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addIPSet(obj.name, obj.export_config())

    elif a.delete_ipset:
        ipset = fw.config().getIPSetByName(a.delete_ipset)
        ipset.remove()

    elif a.load_ipset_defaults:
        ipset = fw.config().getIPSetByName(a.load_ipset_defaults)
        ipset.loadDefaults()

    elif a.info_ipset:
        ipset = fw.config().getIPSetByName(a.info_ipset)
        cmd.print_ipset_info(a.info_ipset, ipset.getSettings())
        sys.exit(0)

    elif a.path_ipset:
        ipset = fw.config().getIPSetByName(a.path_ipset)
        cmd.print_and_exit(&quot;%s/%s&quot; % (ipset.get_property(&quot;path&quot;),
                                      ipset.get_property(&quot;filename&quot;)))

    elif a.ipset:
        ipset = fw.config().getIPSetByName(a.ipset)
        settings = ipset.getSettings()

        if a.add_entry:
            cmd.add_sequence(a.add_entry, settings.addEntry,
                             settings.queryEntry, None, &quot;&#039;%s&#039;&quot;)
            ipset.update(settings)

        elif a.remove_entry:
            cmd.remove_sequence(a.remove_entry, settings.removeEntry,
                                settings.queryEntry, None, &quot;&#039;%s&#039;&quot;)
            ipset.update(settings)

        elif a.query_entry:
            cmd.query_sequence(a.query_entry, settings.queryEntry, None, &quot;&#039;%s&#039;&quot;)

        elif a.get_entries:
            l = settings.getEntries()
            cmd.print_and_exit(&quot;\n&quot;.join(l))

        elif a.add_entries_from_file:
            changed = False

            for filename in a.add_entries_from_file:
                try:
                    entries = cmd.get_ipset_entries_from_file(filename)
                except IOError as msg:
                    message = &quot;Failed to read file &#039;%s&#039;: %s&quot; % (filename, msg)
                    if len(a.add_entries_from_file) &gt; 1:
                        cmd.print_warning(message)
                    else:
                        cmd.print_and_exit(message)
                else:
                    old_entries = settings.getEntries()
                    entries_set = set()
                    for entry in old_entries:
                        entries_set.add(entry)
                    for entry in entries:
                        if entry not in entries_set:
                            old_entries.append(entry)
                            entries_set.add(entry)
                            changed = True
                        else:
                            cmd.print_if_verbose(
                                &quot;Warning: ALREADY_ENABLED: %s&quot; % entry)
                    if changed:
                        settings.setEntries(old_entries)
            if changed:
                ipset.update(settings)

        elif a.remove_entries_from_file:
            changed = False

            for filename in a.remove_entries_from_file:
                try:
                    entries = cmd.get_ipset_entries_from_file(filename)
                except IOError as msg:
                    message = &quot;Failed to read file &#039;%s&#039;: %s&quot; % (filename, msg)
                    if len(a.remove_entries_from_file) &gt; 1:
                        cmd.print_warning(message)
                    else:
                        cmd.print_and_exit(message)
                else:
                    old_entries = settings.getEntries()
                    entries_set = set()
                    for entry in old_entries:
                        entries_set.add(entry)
                    for entry in entries:
                        if entry in entries_set:
                            old_entries.remove(entry)
                            entries_set.discard(entry)
                            changed = True
                        else:
                            cmd.print_if_verbose(&quot;Warning: NOT_ENABLED: %s&quot; % entry)
                    if changed:
                        settings.setEntries(old_entries)
            if changed:
                ipset.update(settings)

        elif a.set_description:
            settings.setDescription(a.set_description)
            ipset.update(settings)

        elif a.get_description:
            cmd.print_and_exit(settings.getDescription())

        elif a.set_short:
            settings.setShort(a.set_short)
            ipset.update(settings)

        elif a.get_short:
            cmd.print_and_exit(settings.getShort())

        else:
            cmd.fail(parser.format_usage() + &quot;Unknown option&quot;)

    elif a.get_zones:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getZoneNames()))

    elif a.new_zone:
        config = fw.config()
        config.addZone(a.new_zone, FirewallClientZoneSettings())

    elif a.new_zone_from_file:
        filename = os.path.basename(a.new_zone_from_file)
        dirname = os.path.dirname(a.new_zone_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = zone_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load zone file &#039;%s&#039;: %s&quot; % \
                   (a.new_zone_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load zone file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addZone(obj.name, obj.export_config())

    elif a.delete_zone:
        zone = fw.config().getZoneByName(a.delete_zone)
        zone.remove()

    elif a.load_zone_defaults:
        zone = fw.config().getZoneByName(a.load_zone_defaults)
        zone.loadDefaults()

    elif a.info_zone:
        zone = fw.config().getZoneByName(a.info_zone)
        cmd.print_zone_info(a.info_zone, zone.getSettings(), True)
        sys.exit(0)

    elif a.path_zone:
        zone = fw.config().getZoneByName(a.path_zone)
        cmd.print_and_exit(&quot;%s/%s&quot; % (zone.get_property(&quot;path&quot;),
                                      zone.get_property(&quot;filename&quot;)))

    elif a.get_policies:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getPolicyNames()))

    elif a.new_policy:
        config = fw.config()
        config.addPolicy(a.new_policy, FirewallClientPolicySettings())

    elif a.new_policy_from_file:
        filename = os.path.basename(a.new_policy_from_file)
        dirname = os.path.dirname(a.new_policy_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = policy_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load policy file &#039;%s&#039;: %s&quot; % \
                   (a.new_policy_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load policy file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addPolicy(obj.name, obj.export_config_dict())

    elif a.delete_policy:
        policy = fw.config().getPolicyByName(a.delete_policy)
        policy.remove()

    elif a.load_policy_defaults:
        policy = fw.config().getPolicyByName(a.load_policy_defaults)
        policy.loadDefaults()

    elif a.info_policy:
        policy = fw.config().getPolicyByName(a.info_policy)
        cmd.print_policy_info(a.info_policy, policy.getSettings())
        sys.exit(0)

    elif a.path_policy:
        policy = fw.config().getPolicyByName(a.path_policy)
        cmd.print_and_exit(&quot;%s/%s&quot; % (policy.get_property(&quot;path&quot;),
                                      policy.get_property(&quot;filename&quot;)))

    elif a.get_services:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getServiceNames()))

    elif a.new_service:
        config = fw.config()
        config.addService(a.new_service, FirewallClientServiceSettings())

    elif a.new_service_from_file:
        filename = os.path.basename(a.new_service_from_file)
        dirname = os.path.dirname(a.new_service_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = service_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load service file &#039;%s&#039;: %s&quot; % \
                     (a.new_service_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load service file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addService(obj.name, obj.export_config())

    elif a.delete_service:
        service = fw.config().getServiceByName(a.delete_service)
        service.remove()

    elif a.load_service_defaults:
        service = fw.config().getServiceByName(a.load_service_defaults)
        service.loadDefaults()

    elif a.info_service:
        service = fw.config().getServiceByName(a.info_service)
        cmd.print_service_info(a.info_service, service.getSettings())
        sys.exit(0)

    elif a.path_service:
        service = fw.config().getServiceByName(a.path_service)
        cmd.print_and_exit(&quot;%s/%s&quot; % (service.get_property(&quot;path&quot;),
                                      service.get_property(&quot;filename&quot;)))

    elif a.get_helpers:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getHelperNames()))

    elif a.new_helper:
        if not a.module:
            cmd.fail(parser.format_usage() + &quot;No module specified.&quot;)
        settings = FirewallClientHelperSettings()
        settings.setModule(a.module)
        if a.family:
            settings.setFamily(a.family)
        config = fw.config()
        config.addHelper(a.new_helper, settings)

    elif a.new_helper_from_file:
        filename = os.path.basename(a.new_helper_from_file)
        dirname = os.path.dirname(a.new_helper_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = helper_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load helper file &#039;%s&#039;: %s&quot; % \
                     (a.new_helper_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load helper file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addHelper(obj.name, obj.export_config())

    elif a.delete_helper:
        helper = fw.config().getHelperByName(a.delete_helper)
        helper.remove()

    elif a.load_helper_defaults:
        helper = fw.config().getHelperByName(a.load_helper_defaults)
        helper.loadDefaults()

    elif a.info_helper:
        helper = fw.config().getHelperByName(a.info_helper)
        cmd.print_helper_info(a.info_helper, helper.getSettings())
        sys.exit(0)

    elif a.path_helper:
        helper = fw.config().getHelperByName(a.path_helper)
        cmd.print_and_exit(&quot;%s/%s&quot; % (helper.get_property(&quot;path&quot;),
                                      helper.get_property(&quot;filename&quot;)))

    elif a.helper:
        helper = fw.config().getHelperByName(a.helper)
        settings = helper.getSettings()

        if a.add_port:
            cmd.add_sequence(a.add_port, settings.addPort,
                             settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
            helper.update(settings)

        elif a.remove_port:
            cmd.remove_sequence(a.remove_port, settings.removePort,
                                settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
            helper.update(settings)

        elif a.query_port:
            cmd.query_sequence(a.query_port, settings.queryPort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        elif a.get_ports:
            l = helper.getPorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in l]))

        elif a.get_module:
            cmd.print_and_exit(settings.getModule())

        elif a.set_module:
            settings.setModule(cmd.check_module(a.set_module))
            helper.update(settings)

        elif a.get_family:
            cmd.print_and_exit(settings.getFamily())

        elif a.set_family:
            settings.setFamily(cmd.check_helper_family(a.set_family[0]))
            helper.update(settings)

        elif a.set_description:
            settings.setDescription(a.set_description)
            helper.update(settings)

        elif a.get_description:
            cmd.print_and_exit(settings.getDescription())

        elif a.set_short:
            settings.setShort(a.set_short)
            helper.update(settings)

        elif a.get_short:
            cmd.print_and_exit(settings.getShort())

        else:
            cmd.fail(parser.format_usage() + &quot;Unknown option&quot;)

    elif a.get_icmptypes:
        cmd.print_and_exit(&quot; &quot;.join(fw.config().getIcmpTypeNames()))

    elif a.new_icmptype:
        config = fw.config()
        config.addIcmpType(a.new_icmptype, FirewallClientIcmpTypeSettings())

    elif a.new_icmptype_from_file:
        filename = os.path.basename(a.new_icmptype_from_file)
        dirname = os.path.dirname(a.new_icmptype_from_file)
        if dirname == &quot;&quot;:
            dirname = &quot;./&quot;
        try:
            obj = icmptype_reader(filename, dirname)
        except FirewallError as msg:
            cmd.fail(&quot;Failed to load icmptype file &#039;%s&#039;: %s&quot; % \
                     (a.new_icmptype_from_file, msg))
        except IOError as msg:
            cmd.fail(&quot;Failed to load icmptype file: %s&quot; % msg)

        if a.name:
            obj.name = a.name

        config = fw.config()
        config.addIcmpType(obj.name, obj.export_config())

    elif a.delete_icmptype:
        icmptype = fw.config().getIcmpTypeByName(a.delete_icmptype)
        icmptype.remove()

    elif a.load_icmptype_defaults:
        icmptype = fw.config().getIcmpTypeByName(a.load_icmptype_defaults)
        icmptype.loadDefaults()

    elif a.info_icmptype:
        icmptype = fw.config().getIcmpTypeByName(a.info_icmptype)
        cmd.print_icmptype_info(a.info_icmptype, icmptype.getSettings())
        sys.exit(0)

    elif a.path_icmptype:
        icmptype = fw.config().getIcmpTypeByName(a.path_icmptype)
        cmd.print_and_exit(&quot;%s/%s&quot; % (icmptype.get_property(&quot;path&quot;),
                                      icmptype.get_property(&quot;filename&quot;)))

    elif a.icmptype:
        icmptype = fw.config().getIcmpTypeByName(a.icmptype)
        settings = icmptype.getSettings()

        if a.add_destination:
            cmd.add_sequence(a.add_destination, settings.addDestination,
                             settings.queryDestination,
                             cmd.check_destination_ipv, &quot;&#039;%s&#039;&quot;)
            icmptype.update(settings)

        elif a.remove_destination:
            cmd.remove_sequence(a.remove_destination,
                                settings.removeDestination,
                                settings.queryDestination,
                                cmd.check_destination_ipv, &quot;&#039;%s&#039;&quot;)
            icmptype.update(settings)

        elif a.query_destination:
            cmd.query_sequence(a.query_destination, settings.queryDestination,
                               cmd.check_destination_ipv , &quot;&#039;%s&#039;&quot;)

        elif a.get_destinations:
            l = settings.getDestinations()
            if len(l) == 0:
                l = [ &quot;ipv4&quot;, &quot;ipv6&quot; ]
            cmd.print_and_exit(&quot;\n&quot;.join(l))

        elif a.set_description:
            settings.setDescription(a.set_description)
            icmptype.update(settings)

        elif a.get_description:
            cmd.print_and_exit(settings.getDescription())

        elif a.set_short:
            settings.setShort(a.set_short)
            icmptype.update(settings)

        elif a.get_short:
            cmd.print_and_exit(settings.getShort())

        else:
            cmd.fail(parser.format_usage() + &quot;Unknown option&quot;)

    elif a.service:
        service = fw.config().getServiceByName(a.service)
        settings = service.getSettings()

        if a.add_port:
            cmd.add_sequence(a.add_port, settings.addPort,
                             settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
            service.update(settings)

        elif a.remove_port:
            cmd.remove_sequence(a.remove_port, settings.removePort,
                                settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
            service.update(settings)

        elif a.query_port:
            cmd.query_sequence(a.query_port, settings.queryPort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        elif a.get_ports:
            l = settings.getPorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in l]))

        elif a.add_protocol:
            cmd.add_sequence(a.add_protocol, settings.addProtocol,
                             settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.remove_protocol:
            cmd.remove_sequence(a.remove_protocol, settings.removeProtocol,
                                settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.query_protocol:
            cmd.query_sequence(a.query_protocol, settings.queryProtocol,
                               None, &quot;&#039;%s&#039;&quot;)

        elif a.get_protocols:
            l = settings.getProtocols()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % protocol for protocol in l]))

        elif a.add_source_port:
            cmd.add_sequence(a.add_source_port, settings.addSourcePort,
                             settings.querySourcePort, cmd.parse_port, &quot;%s/%s&quot;)
            service.update(settings)

        elif a.remove_source_port:
            cmd.remove_sequence(a.remove_source_port, settings.removeSourcePort,
                                settings.querySourcePort, cmd.parse_port,
                                &quot;%s/%s&quot;)
            service.update(settings)

        elif a.query_source_port:
            cmd.query_sequence(a.query_source_port, settings.querySourcePort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        elif a.get_source_ports:
            l = settings.getSourcePorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in l]))

        elif a.add_module:
            cmd.add_sequence(a.add_module, settings.addModule,
                             settings.queryModule, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.remove_module:
            cmd.remove_sequence(a.remove_module, settings.removeModule,
                                settings.queryModule, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.query_module:
            cmd.query_sequence(a.query_module, settings.queryModule,
                               None, &quot;&#039;%s&#039;&quot;)

        elif a.get_modules:
            l = settings.getModules()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % module for module in l]))

        elif a.set_destination:
            cmd.add_sequence(a.set_destination, settings.setDestination,
                             settings.queryDestination,
                             cmd.parse_service_destination, &quot;%s:%s&quot;)
            service.update(settings)

        elif a.remove_destination:
            # special case for removeDestination: Only ipv, no address
            for ipv in a.remove_destination:
                cmd.check_destination_ipv(ipv)
                if ipv not in settings.getDestinations():
                    if len(a.remove_destination) &gt; 1:
                        cmd.print_warning(&quot;Warning: NOT_ENABLED: &#039;%s&#039;&quot; % ipv)
                    else:
                        code = FirewallError.get_code(&quot;NOT_ENABLED&quot;)
                        cmd.print_and_exit(&quot;Error: NOT_ENABLED: &#039;%s&#039;&quot; % ipv,
                                           code)
                else:
                    settings.removeDestination(ipv)
            service.update(settings)

        elif a.query_destination:
            cmd.query_sequence(a.query_destination, settings.queryDestination,
                               cmd.parse_service_destination, &quot;&#039;%s&#039;&quot;)

        elif a.get_destinations:
            l = settings.getDestinations()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s:%s&quot; % (dest[0], dest[1]) for dest in l.items()]))

        elif a.add_include:
            cmd.add_sequence(a.add_include, settings.addInclude,
                             settings.queryInclude, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.remove_include:
            cmd.remove_sequence(a.remove_include, settings.removeInclude,
                                settings.queryInclude, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.query_include:
            cmd.query_sequence(a.query_include, settings.queryInclude,
                               None, &quot;&#039;%s&#039;&quot;)

        elif a.get_includes:
            l = settings.getIncludes()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % include for include in sorted(l)]))

        elif a.add_helper:
            cmd.add_sequence(a.add_helper, settings.addHelper,
                             settings.queryHelper, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.remove_helper:
            cmd.remove_sequence(a.remove_helper, settings.removeHelper,
                                settings.queryHelper, None, &quot;&#039;%s&#039;&quot;)
            service.update(settings)

        elif a.query_helper:
            cmd.query_sequence(a.query_helper, settings.queryHelper,
                               None, &quot;&#039;%s&#039;&quot;)

        elif a.get_service_helpers:
            l = settings.getHelpers()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % helper for helper in sorted(l)]))

        elif a.set_description:
            settings.setDescription(a.set_description)
            service.update(settings)

        elif a.get_description:
            cmd.print_and_exit(settings.getDescription())

        elif a.set_short:
            settings.setShort(a.set_short)
            service.update(settings)

        elif a.get_short:
            cmd.print_and_exit(settings.getShort())

        else:
            cmd.fail(parser.format_usage() + &quot;Unknown option&quot;)

    # lockdown whitelist

    elif options_lockdown_whitelist:
        policies = fw.config().policies()

        # commands
        if a.list_lockdown_whitelist_commands:
            l = policies.getLockdownWhitelistCommands()
            cmd.print_and_exit(&quot;\n&quot;.join(l))
        elif a.add_lockdown_whitelist_command:
            cmd.add_sequence(a.add_lockdown_whitelist_command,
                             policies.addLockdownWhitelistCommand,
                             policies.queryLockdownWhitelistCommand,
                             None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_lockdown_whitelist_command:
            cmd.remove_sequence(a.remove_lockdown_whitelist_command,
                                policies.removeLockdownWhitelistCommand,
                                policies.queryLockdownWhitelistCommand,
                                None, &quot;&#039;%s&#039;&quot;)
        elif a.query_lockdown_whitelist_command:
            cmd.query_sequence(a.query_lockdown_whitelist_command,
                               policies.queryLockdownWhitelistCommand,
                               None, &quot;&#039;%s&#039;&quot;)

        # contexts
        elif a.list_lockdown_whitelist_contexts:
            l = policies.getLockdownWhitelistContexts()
            cmd.print_and_exit(&quot;\n&quot;.join(l))
        elif a.add_lockdown_whitelist_context:
            cmd.add_sequence(a.add_lockdown_whitelist_context,
                             policies.addLockdownWhitelistContext,
                             policies.queryLockdownWhitelistContext,
                             None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_lockdown_whitelist_context:
            cmd.remove_sequence(a.remove_lockdown_whitelist_context,
                                policies.removeLockdownWhitelistContext,
                                policies.queryLockdownWhitelistContext,
                                None, &quot;&#039;%s&#039;&quot;)
        elif a.query_lockdown_whitelist_context:
            cmd.query_sequence(a.query_lockdown_whitelist_context,
                               policies.queryLockdownWhitelistContext,
                               None, &quot;&#039;%s&#039;&quot;)

        # uids
        elif a.list_lockdown_whitelist_uids:
            l = policies.getLockdownWhitelistUids()
            cmd.print_and_exit(&quot; &quot;.join(map(str, l)))
        elif a.add_lockdown_whitelist_uid is not None:
            cmd.add_sequence(a.add_lockdown_whitelist_uid,
                             policies.addLockdownWhitelistUid,
                             policies.queryLockdownWhitelistUid, None, &quot;%s&quot;)
        elif a.remove_lockdown_whitelist_uid is not None:
            cmd.remove_sequence(a.remove_lockdown_whitelist_uid,
                                policies.removeLockdownWhitelistUid,
                                policies.queryLockdownWhitelistUid, None, &quot;%s&quot;)
        elif a.query_lockdown_whitelist_uid is not None:
            cmd.query_sequence(a.query_lockdown_whitelist_uid,
                               policies.queryLockdownWhitelistUid, None, &quot;%s&quot;)

        # users
        elif a.list_lockdown_whitelist_users:
            l = policies.getLockdownWhitelistUsers()
            cmd.print_and_exit(&quot;\n&quot;.join(l))
        elif a.add_lockdown_whitelist_user:
            cmd.add_sequence(a.add_lockdown_whitelist_user,
                             policies.addLockdownWhitelistUser,
                             policies.queryLockdownWhitelistUser,
                             None, &quot;%s&quot;)
        elif a.remove_lockdown_whitelist_user:
            cmd.remove_sequence(a.remove_lockdown_whitelist_user,
                                policies.removeLockdownWhitelistUser,
                                policies.queryLockdownWhitelistUser,
                                None, &quot;%s&quot;)
        elif a.query_lockdown_whitelist_user:
            cmd.query_sequence(a.query_lockdown_whitelist_user,
                               policies.queryLockdownWhitelistUser,
                               None, &quot;&#039;%s&#039;&quot;)

    elif options_direct:
        direct = fw.config().direct()

        if a.passthrough:
            if len(a.passthrough) &lt; 2:
                cmd.fail(&quot;usage: --permanent --direct --passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
            cmd.print_msg(direct.addPassthrough(cmd.check_ipv(a.passthrough[0]),
                                                splitArgs(a.passthrough[1])))

        if a.add_passthrough:
            if len(a.add_passthrough) &lt; 2:
                cmd.fail(&quot;usage: --permanent --direct --add-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
            cmd.print_msg(direct.addPassthrough(cmd.check_ipv(a.add_passthrough[0]),
                                                splitArgs(a.add_passthrough[1])))

        elif a.remove_passthrough:
            if len(a.remove_passthrough) &lt; 2:
                cmd.fail(&quot;usage: --permanent --direct --remove-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
            direct.removePassthrough(cmd.check_ipv(a.remove_passthrough[0]),
                                     splitArgs(a.remove_passthrough[1]))
        elif a.query_passthrough:
            if len(a.query_passthrough) &lt; 2:
                cmd.fail(&quot;usage: --permanent --direct --query-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
            cmd.print_query_result(
                direct.queryPassthrough(cmd.check_ipv(a.query_passthrough[0]),
                                        splitArgs(a.query_passthrough[1])))
            sys.exit(0)
        elif a.get_passthroughs:
            rules = direct.getPassthroughs(cmd.check_ipv(a.get_passthroughs[0]))
            for rule in rules:
                cmd.print_msg(joinArgs(rule))
            sys.exit(0)
        elif a.get_all_passthroughs:
            for (ipv, rule) in direct.getAllPassthroughs():
                cmd.print_msg(&quot;%s %s&quot; % (ipv, joinArgs(rule)))
            sys.exit(0)

        elif a.add_chain:
            direct.addChain(cmd.check_ipv(a.add_chain[0]),
                            a.add_chain[1], a.add_chain[2])
        elif a.remove_chain:
            direct.removeChain(cmd.check_ipv(a.remove_chain[0]),
                               a.remove_chain[1], a.remove_chain[2])
        elif a.query_chain:
            cmd.print_query_result(
                direct.queryChain(cmd.check_ipv(a.query_chain[0]),
                                  a.query_chain[1], a.query_chain[2]))
            sys.exit(0)
        elif a.get_chains:
            cmd.print_and_exit(
                &quot; &quot;.join(direct.getChains(cmd.check_ipv(a.get_chains[0]),
                                          a.get_chains[1])))
            sys.exit(0)
        elif a.get_all_chains:
            chains = direct.getAllChains()
            for (ipv, table, chain) in chains:
                cmd.print_msg(&quot;%s %s %s&quot; % (ipv, table, chain))
            sys.exit(0)
        elif a.add_rule:
            if len(a.add_rule) &lt; 5:
                cmd.fail(&quot;usage: --permanent --direct --add-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            try:
                priority = int(a.add_rule[3])
            except ValueError:
                cmd.fail(&quot;usage: --permanent --direct --add-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            direct.addRule(cmd.check_ipv(a.add_rule[0]), a.add_rule[1],
                           a.add_rule[2], priority, splitArgs(a.add_rule[4]))
        elif a.remove_rule:
            if len(a.remove_rule) &lt; 5:
                cmd.fail(&quot;usage: --permanent --direct --remove-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            try:
                priority = int(a.remove_rule[3])
            except ValueError:
                cmd.fail(&quot;usage: --permanent --direct --remove-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            direct.removeRule(cmd.check_ipv(a.remove_rule[0]), a.remove_rule[1],
                              a.remove_rule[2], priority, splitArgs(a.remove_rule[4]))
        elif a.remove_rules:
            if len(a.remove_rules) &lt; 3:
                cmd.fail(&quot;usage: --permanent --direct --remove-rules { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt;&quot;)
            direct.removeRules(cmd.check_ipv(a.remove_rules[0]),
                               a.remove_rules[1], a.remove_rules[2])
        elif a.query_rule:
            if len(a.query_rule) &lt; 5:
                cmd.fail(&quot;usage: --permanent --direct --query-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            try:
                priority = int(a.query_rule[3])
            except ValueError:
                cmd.fail(&quot;usage: --permanent --direct --query-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
            cmd.print_query_result(
                direct.queryRule(cmd.check_ipv(a.query_rule[0]),
                                 a.query_rule[1], a.query_rule[2],
                                 priority, splitArgs(a.query_rule[4])))
            sys.exit(0)
        elif a.get_rules:
            rules = direct.getRules(cmd.check_ipv(a.get_rules[0]),
                                    a.get_rules[1], a.get_rules[2])
            for (priority, rule) in rules:
                cmd.print_msg(&quot;%d %s&quot; % (priority, joinArgs(rule)))
            sys.exit(0)
        elif a.get_all_rules:
            rules = direct.getAllRules()
            for (ipv, table, chain, priority, rule) in rules:
                cmd.print_msg(&quot;%s %s %s %d %s&quot; % (ipv, table, chain, priority,
                                                  joinArgs(rule)))
            sys.exit(0)

    elif a.list_all_policies:
        names = fw.config().getPolicyNames()
        for policy in sorted(names):
            settings = fw.config().getPolicyByName(policy).getSettings()
            cmd.print_policy_info(policy, settings)
            cmd.print_msg(&quot;&quot;)
        sys.exit(0)

    elif a.policy:
        fw_policy = fw.config().getPolicyByName(a.policy)
        settings = fw_policy.getSettings()

        # list all policy settings
        if a.list_all:
            cmd.print_policy_info(a.policy, settings)
            sys.exit(0)

        # ingress zones
        elif a.list_ingress_zones:
            l = settings.getIngressZones()
            cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
        elif a.add_ingress_zone:
            cmd.add_sequence(a.add_ingress_zone, settings.addIngressZone,
                             settings.queryIngressZone, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_ingress_zone:
            cmd.remove_sequence(a.remove_ingress_zone, settings.removeIngressZone,
                                settings.queryIngressZone, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_ingress_zone:
            cmd.query_sequence(a.query_ingress_zone, settings.queryIngressZone,
                               None, &quot;&#039;%s&#039;&quot;)

        # egress zones
        elif a.list_egress_zones:
            l = settings.getEgressZones()
            cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
        elif a.add_egress_zone:
            cmd.add_sequence(a.add_egress_zone, settings.addEgressZone,
                             settings.queryEgressZone, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_egress_zone:
            cmd.remove_sequence(a.remove_egress_zone, settings.removeEgressZone,
                                settings.queryEgressZone, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_egress_zone:
            cmd.query_sequence(a.query_egress_zone, settings.queryEgressZone,
                               None, &quot;&#039;%s&#039;&quot;)

        # priority
        elif a.get_priority:
            cmd.print_and_exit(str(settings.getPriority()))
        elif a.set_priority:
            settings.setPriority(a.set_priority)

        # rich rules
        elif a.list_rich_rules:
            l = settings.getRichRules()
            cmd.print_and_exit(&quot;\n&quot;.join(l))
        elif a.add_rich_rule:
            cmd.add_sequence(a.add_rich_rule, settings.addRichRule,
                             settings.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_rich_rule:
            cmd.remove_sequence(a.remove_rich_rule, settings.removeRichRule,
                                settings.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_rich_rule:
            cmd.query_sequence(a.query_rich_rule, settings.queryRichRule,
                               None, &quot;&#039;%s&#039;&quot;)

        # service
        elif a.list_services:
            l = settings.getServices()
            cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
        elif a.add_service:
            cmd.add_sequence(a.add_service, settings.addService,
                             settings.queryService, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_service:
            cmd.remove_sequence(a.remove_service, settings.removeService,
                                settings.queryService, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_service:
            cmd.query_sequence(a.query_service, settings.queryService,
                               None, &quot;&#039;%s&#039;&quot;)

        # port
        elif a.list_ports:
            l = settings.getPorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
        elif a.add_port:
            cmd.add_sequence(a.add_port, settings.addPort,
                             settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.remove_port:
            cmd.remove_sequence(a.remove_port, settings.removePort,
                                settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.query_port:
            cmd.query_sequence(a.query_port, settings.queryPort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        # protocol
        elif a.list_protocols:
            l = settings.getProtocols()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % protocol for protocol in sorted(l)]))
        elif a.add_protocol:
            cmd.add_sequence(a.add_protocol, settings.addProtocol,
                             settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_protocol:
            cmd.remove_sequence(a.remove_protocol, settings.removeProtocol,
                                settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_protocol:
            cmd.query_sequence(a.query_protocol, settings.queryProtocol,
                               None, &quot;&#039;%s&#039;&quot;)

        # source port
        elif a.list_source_ports:
            l = settings.getSourcePorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
        elif a.add_source_port:
            cmd.add_sequence(a.add_source_port, settings.addSourcePort,
                             settings.querySourcePort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.remove_source_port:
            cmd.remove_sequence(a.remove_source_port, settings.removeSourcePort,
                                settings.querySourcePort, cmd.parse_port,
                                &quot;%s/%s&quot;)
        elif a.query_source_port:
            cmd.query_sequence(a.query_source_port, settings.querySourcePort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        # masquerade
        elif a.add_masquerade:
            settings.addMasquerade()
        elif a.remove_masquerade:
            settings.removeMasquerade()
        elif a.query_masquerade:
            cmd.print_query_result(settings.queryMasquerade())

        # forward port
        elif a.list_forward_ports:
            l = settings.getForwardPorts()
            cmd.print_and_exit(&quot;\n&quot;.join([&quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot; % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
        elif a.add_forward_port:
            cmd.add_sequence(a.add_forward_port, settings.addForwardPort,
                             settings.queryForwardPort, cmd.parse_forward_port,
                             &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
        elif a.remove_forward_port:
            cmd.remove_sequence(a.remove_forward_port,
                                settings.removeForwardPort,
                                settings.queryForwardPort,
                                cmd.parse_forward_port,
                                &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
        elif a.query_forward_port:
            cmd.query_sequence(a.query_forward_port, settings.queryForwardPort,
                               cmd.parse_forward_port,
                               &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)

        # block icmp
        elif a.list_icmp_blocks:
            l = settings.getIcmpBlocks()
            cmd.print_and_exit(&quot; &quot;.join(l))
        elif a.add_icmp_block:
            cmd.add_sequence(a.add_icmp_block, settings.addIcmpBlock,
                             settings.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_icmp_block:
            cmd.remove_sequence(a.remove_icmp_block, settings.removeIcmpBlock,
                                settings.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_icmp_block:
            cmd.query_sequence(a.query_icmp_block, settings.queryIcmpBlock,
                               None, &quot;&#039;%s&#039;&quot;)

        # target
        elif a.get_target:
            target = settings.getTarget()
            cmd.print_and_exit(target)
        elif a.set_target:
            settings.setTarget(a.set_target)

        # set description
        elif a.set_description:
            settings = fw.config().getPolicyByName(a.policy).getSettings()
            settings.setDescription(a.set_description)

        # get description
        elif a.get_description:
            settings = fw.config().getPolicyByName(a.policy).getSettings()
            cmd.print_and_exit(settings.getDescription())

        # set short description
        elif a.set_short:
            settings = fw.config().getPolicyByName(a.policy).getSettings()
            settings.setShort(a.set_short)

        # get short description
        elif a.get_short:
            settings = fw.config().getPolicyByName(a.policy).getSettings()
            cmd.print_and_exit(settings.getShort())

        fw_policy.update(settings)

    else:
        if zone == &quot;&quot;:
            zone = fw.getDefaultZone()
        fw_zone = fw.config().getZoneByName(zone)

        # interface
        if a.list_interfaces:
            interfaces = sorted(set(try_nm_get_interfaces_in_zone(zone))
                                | set(fw_zone.getInterfaces()))
            cmd.print_and_exit(&quot; &quot;.join(interfaces))
        elif a.get_zone_of_interface:
            for interface in a.get_zone_of_interface:
                # ask NM before checking our config
                zone = try_get_zone_of_interface(interface)
                if not zone:
                    zone = fw.config().getZoneOfInterface(interface)
                if zone:
                    if len(a.get_zone_of_interface) &gt; 1:
                        cmd.print_warning(&quot;%s: %s&quot; % (interface, zone))
                    else:
                        cmd.print_and_exit(zone)
                else:
                    if len(a.get_zone_of_interface) &gt; 1:
                        cmd.print_warning(&quot;%s: no zone&quot; % interface)
                    else:
                        cmd.fail(&quot;no zone&quot;)
        elif a.change_interface:
            interfaces = [ ]
            for interface in a.change_interface:
                if not try_set_zone_of_interface(zone, interface):
                    interfaces.append(interface)
            for interface in interfaces:
                old_zone_name = fw.config().getZoneOfInterface(interface)
                if old_zone_name != zone:
                    if old_zone_name:
                        old_zone_obj = fw.config().getZoneByName(old_zone_name)
                        old_zone_obj.removeInterface(interface)# remove from old
                    fw_zone.addInterface(interface)            # add to new
        elif a.add_interface:
            interfaces = [ ]
            for interface in a.add_interface:
                if not try_set_zone_of_interface(a.zone, interface):
                    interfaces.append(interface)
            cmd.add_sequence(interfaces, fw_zone.addInterface,
                             fw_zone.queryInterface, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_interface:
            interfaces = [ ]
            for interface in a.remove_interface:
                if not try_set_zone_of_interface(&quot;&quot;, interface):
                    interfaces.append(interface)
            cmd.remove_sequence(interfaces, fw_zone.removeInterface,
                                fw_zone.queryInterface, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_interface:
            cmd.query_sequence(a.query_interface, fw_zone.queryInterface,
                               None, &quot;&#039;%s&#039;&quot;)

        # source
        if a.list_sources:
            sources = fw_zone.getSources()
            cmd.print_and_exit(&quot; &quot;.join(sources))
        elif a.get_zone_of_source:
            for source in a.get_zone_of_source:
                zone = fw.config().getZoneOfSource(source)
                if zone:
                    if len(a.get_zone_of_source) &gt; 1:
                        cmd.print_warning(&quot;%s: %s&quot; % (source, zone))
                    else:
                        cmd.print_and_exit(zone)
                else:
                    if len(a.get_zone_of_source) &gt; 1:
                        cmd.print_warning(&quot;%s: no zone&quot; % source)
                    else:
                        cmd.fail(&quot;no zone&quot;)
        elif a.change_source:
            for source in a.change_source:
                old_zone_name = fw.config().getZoneOfSource(source)
                if old_zone_name != zone:
                    if old_zone_name:
                        old_zone_obj = fw.config().getZoneByName(old_zone_name)
                        old_zone_obj.removeSource(source) # remove from old
                    fw_zone.addSource(source)             # add to new
        elif a.add_source:
            cmd.add_sequence(a.add_source, fw_zone.addSource,
                             fw_zone.querySource, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_source:
            cmd.remove_sequence(a.remove_source, fw_zone.removeSource,
                                fw_zone.querySource, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_source:
            cmd.query_sequence(a.query_source, fw_zone.querySource,
                               None, &quot;&#039;%s&#039;&quot;)

        # rich rules
        if a.list_rich_rules:
            l = fw_zone.getRichRules()
            cmd.print_and_exit(&quot;\n&quot;.join(l))
        elif a.add_rich_rule:
            cmd.add_sequence(a.add_rich_rule, fw_zone.addRichRule,
                             fw_zone.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_rich_rule:
            cmd.remove_sequence(a.remove_rich_rule, fw_zone.removeRichRule,
                                fw_zone.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_rich_rule:
            cmd.query_sequence(a.query_rich_rule, fw_zone.queryRichRule,
                               None, &quot;&#039;%s&#039;&quot;)

        # service
        if a.list_services:
            l = fw_zone.getServices()
            cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
        elif a.add_service:
            cmd.add_sequence(a.add_service, fw_zone.addService,
                             fw_zone.queryService, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_service:
            cmd.remove_sequence(a.remove_service, fw_zone.removeService,
                                fw_zone.queryService, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_service:
            cmd.query_sequence(a.query_service, fw_zone.queryService,
                               None, &quot;&#039;%s&#039;&quot;)

        # port
        elif a.list_ports:
            l = fw_zone.getPorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
        elif a.add_port:
            cmd.add_sequence(a.add_port, fw_zone.addPort,
                             fw_zone.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.remove_port:
            cmd.remove_sequence(a.remove_port, fw_zone.removePort,
                                fw_zone.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.query_port:
            cmd.query_sequence(a.query_port, fw_zone.queryPort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        # protocol
        elif a.list_protocols:
            l = fw_zone.getProtocols()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % protocol for protocol in sorted(l)]))
        elif a.add_protocol:
            cmd.add_sequence(a.add_protocol, fw_zone.addProtocol,
                             fw_zone.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_protocol:
            cmd.remove_sequence(a.remove_protocol, fw_zone.removeProtocol,
                                fw_zone.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_protocol:
            cmd.query_sequence(a.query_protocol, fw_zone.queryProtocol,
                               None, &quot;&#039;%s&#039;&quot;)

        # source port
        elif a.list_source_ports:
            l = fw_zone.getSourcePorts()
            cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
        elif a.add_source_port:
            cmd.add_sequence(a.add_source_port, fw_zone.addSourcePort,
                             fw_zone.querySourcePort, cmd.parse_port, &quot;%s/%s&quot;)
        elif a.remove_source_port:
            cmd.remove_sequence(a.remove_source_port, fw_zone.removeSourcePort,
                                fw_zone.querySourcePort, cmd.parse_port,
                                &quot;%s/%s&quot;)
        elif a.query_source_port:
            cmd.query_sequence(a.query_source_port, fw_zone.querySourcePort,
                               cmd.parse_port, &quot;%s/%s&quot;)

        # forward
        elif a.add_forward:
            fw_zone.addForward()
        elif a.remove_forward:
            fw_zone.removeForward()
        elif a.query_forward:
            cmd.print_query_result(fw_zone.queryForward())

        # masquerade
        elif a.add_masquerade:
            fw_zone.addMasquerade()
        elif a.remove_masquerade:
            fw_zone.removeMasquerade()
        elif a.query_masquerade:
            cmd.print_query_result(fw_zone.queryMasquerade())

        # forward port
        elif a.list_forward_ports:
            l = fw_zone.getForwardPorts()
            cmd.print_and_exit(&quot;\n&quot;.join([&quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot; % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
        elif a.add_forward_port:
            cmd.add_sequence(a.add_forward_port, fw_zone.addForwardPort,
                             fw_zone.queryForwardPort, cmd.parse_forward_port,
                             &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
        elif a.remove_forward_port:
            cmd.remove_sequence(a.remove_forward_port,
                                fw_zone.removeForwardPort,
                                fw_zone.queryForwardPort,
                                cmd.parse_forward_port,
                                &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
        elif a.query_forward_port:
            cmd.query_sequence(a.query_forward_port, fw_zone.queryForwardPort,
                               cmd.parse_forward_port,
                               &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)

        # block icmp
        elif a.list_icmp_blocks:
            l = fw_zone.getIcmpBlocks()
            cmd.print_and_exit(&quot; &quot;.join(l))
        elif a.add_icmp_block:
            cmd.add_sequence(a.add_icmp_block, fw_zone.addIcmpBlock,
                             fw_zone.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
        elif a.remove_icmp_block:
            cmd.remove_sequence(a.remove_icmp_block, fw_zone.removeIcmpBlock,
                                fw_zone.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
        elif a.query_icmp_block:
            cmd.query_sequence(a.query_icmp_block, fw_zone.queryIcmpBlock,
                               None, &quot;&#039;%s&#039;&quot;)

        # icmp block inversion
        elif a.add_icmp_block_inversion:
            fw_zone.addIcmpBlockInversion()
        elif a.remove_icmp_block_inversion:
            fw_zone.removeIcmpBlockInversion()
        elif a.query_icmp_block_inversion:
            cmd.print_query_result(fw_zone.queryIcmpBlockInversion())

        # zone target
        elif a.get_target:
            target = fw_zone.getTarget()
            cmd.print_and_exit(target if target != &quot;%%REJECT%%&quot; else &quot;REJECT&quot;)
        elif a.set_target:
            fw_zone.setTarget(a.set_target if a.set_target != &quot;REJECT&quot; else &quot;%%REJECT%%&quot;)

        # list all zone settings
        elif a.list_all:
            interfaces = try_nm_get_interfaces_in_zone(zone)
            cmd.print_zone_info(zone, fw_zone.getSettings(), extra_interfaces=interfaces)
            sys.exit(0)

        # list everything
        elif a.list_all_zones:
            names = fw.config().getZoneNames()
            for zone in sorted(names):
                interfaces = try_nm_get_interfaces_in_zone(zone)
                settings = fw.config().getZoneByName(zone).getSettings()
                cmd.print_zone_info(zone, settings, extra_interfaces=interfaces)
                cmd.print_msg(&quot;&quot;)
            sys.exit(0)

        # set zone description
        elif a.set_description:
            settings = fw.config().getZoneByName(zone).getSettings()
            settings.setDescription(a.set_description)
            fw_zone.update(settings)

        # get zone description
        elif a.get_description:
            settings = fw.config().getZoneByName(zone).getSettings()
            cmd.print_and_exit(settings.getDescription())

        # set zone short description
        elif a.set_short:
            settings = fw.config().getZoneByName(zone).getSettings()
            settings.setShort(a.set_short)
            fw_zone.update(settings)

        # get zone short description
        elif a.get_short:
            settings = fw.config().getZoneByName(zone).getSettings()
            cmd.print_and_exit(settings.getShort())

elif a.version:
    cmd.print_and_exit(fw.get_property(&quot;version&quot;))
elif a.state:
    state = fw.get_property(&quot;state&quot;)
    if state == &quot;RUNNING&quot;:
        cmd.print_and_exit (&quot;running&quot;)
    elif state == &quot;FAILED&quot;:
        cmd.print_and_exit(&quot;failed&quot;, errors.RUNNING_BUT_FAILED)
    else:
        cmd.print_and_exit (&quot;not running&quot;, errors.NOT_RUNNING)
elif a.get_log_denied:
    cmd.print_and_exit(fw.getLogDenied())
elif a.set_log_denied:
    fw.setLogDenied(a.set_log_denied)
elif a.get_automatic_helpers:
    cmd.print_and_exit(fw.getAutomaticHelpers())
elif a.set_automatic_helpers:
    fw.setAutomaticHelpers(a.set_automatic_helpers)
elif a.get_ipset_types:
    types = fw.get_property(&quot;IPSetTypes&quot;)
    cmd.print_and_exit(&quot; &quot;.join(sorted(types)))
elif a.reload:
    fw.reload()
elif a.complete_reload:
    fw.complete_reload()
elif a.runtime_to_permanent:
    fw.runtimeToPermanent()
elif a.reset_to_defaults:
    fw.resetToDefaults()
elif a.check_config:
    fw.checkPermanentConfig()
elif a.direct:
    if a.passthrough:
        if len(a.passthrough) &lt; 2:
            cmd.fail(&quot;usage: --direct --passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
        msg = fw.passthrough(cmd.check_ipv(a.passthrough[0]), splitArgs(a.passthrough[1]))
        if msg:
            sys.stdout.write(msg + &quot;\n&quot;)

    elif a.add_passthrough:
        if len(a.add_passthrough) &lt; 2:
            cmd.fail(&quot;usage: --direct --add-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
        fw.addPassthrough(cmd.check_ipv(a.add_passthrough[0]),
                          splitArgs(a.add_passthrough[1]))
    elif a.remove_passthrough:
        if len(a.remove_passthrough) &lt; 2:
            cmd.fail(&quot;usage: --direct --remove-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
        fw.removePassthrough(cmd.check_ipv(a.remove_passthrough[0]),
                             splitArgs(a.remove_passthrough[1]))
    elif a.query_passthrough:
        if len(a.query_passthrough) &lt; 2:
            cmd.fail(&quot;usage: --direct --query-passthrough { ipv4 | ipv6 | eb } &lt;args&gt;&quot;)
        cmd.print_query_result(
            fw.queryPassthrough(cmd.check_ipv(a.query_passthrough[0]),
                                splitArgs(a.query_passthrough[1])))
    elif a.get_passthroughs:
        rules = fw.getPassthroughs(cmd.check_ipv(a.get_passthroughs[0]))
        for rule in rules:
            cmd.print_msg(joinArgs(rule))
        sys.exit(0)
    elif a.get_all_passthroughs:
        for (ipv, rule) in fw.getAllPassthroughs():
            cmd.print_msg(&quot;%s %s&quot; % (ipv, joinArgs(rule)))
        sys.exit(0)
    elif a.add_chain:
        fw.addChain(cmd.check_ipv(a.add_chain[0]), a.add_chain[1], a.add_chain[2])
    elif a.remove_chain:
        fw.removeChain(cmd.check_ipv(a.remove_chain[0]),
                       a.remove_chain[1], a.remove_chain[2])
    elif a.query_chain:
        cmd.print_query_result(fw.queryChain(cmd.check_ipv(a.query_chain[0]),
                                             a.query_chain[1],
                                             a.query_chain[2]))
    elif a.get_chains:
        cmd.print_and_exit(&quot; &quot;.join(fw.getChains(cmd.check_ipv(a.get_chains[0]),
                                                 a.get_chains[1])))
    elif a.get_all_chains:
        chains = fw.getAllChains()
        for (ipv, table, chain) in chains:
            cmd.print_msg(&quot;%s %s %s&quot; % (ipv, table, chain))
        sys.exit(0)
    elif a.add_rule:
        if len(a.add_rule) &lt; 5:
            cmd.fail(&quot;usage: --direct --add-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        try:
            priority = int(a.add_rule[3])
        except ValueError:
            cmd.fail(&quot;usage: --direct --add-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        fw.addRule(cmd.check_ipv(a.add_rule[0]), a.add_rule[1], a.add_rule[2],
                   priority, splitArgs(a.add_rule[4]))
    elif a.remove_rule:
        if len(a.remove_rule) &lt; 5:
            cmd.fail(&quot;usage: --direct --remove-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        try:
            priority = int(a.remove_rule[3])
        except ValueError:
            cmd.fail(&quot;usage: --direct --remove-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        fw.removeRule(cmd.check_ipv(a.remove_rule[0]),
                      a.remove_rule[1], a.remove_rule[2], priority, splitArgs(a.remove_rule[4]))
    elif a.remove_rules:
        if len(a.remove_rules) &lt; 3:
            cmd.fail(&quot;usage: --direct --remove-rules { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt;&quot;)
        fw.removeRules(cmd.check_ipv(a.remove_rules[0]),
                       a.remove_rules[1], a.remove_rules[2])
    elif a.query_rule:
        if len(a.query_rule) &lt; 5:
            cmd.fail(&quot;usage: --direct --query-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        try:
            priority = int(a.query_rule[3])
        except ValueError:
            cmd.fail(&quot;usage: --direct --query-rule { ipv4 | ipv6 | eb } &lt;table&gt; &lt;chain&gt; &lt;priority&gt; &lt;args&gt;&quot;)
        cmd.print_query_result(
            fw.queryRule(cmd.check_ipv(a.query_rule[0]),
                         a.query_rule[1], a.query_rule[2],
                         priority, splitArgs(a.query_rule[4])))
    elif a.get_rules:
        rules = fw.getRules(cmd.check_ipv(a.get_rules[0]),
                            a.get_rules[1], a.get_rules[2])
        for (priority, rule) in rules:
            cmd.print_msg(&quot;%d %s&quot; % (priority, joinArgs(rule)))
        sys.exit(0)
    elif a.get_all_rules:
        rules = fw.getAllRules()
        for (ipv, table, chain, priority, rule) in rules:
            cmd.print_msg(&quot;%s %s %s %d %s&quot; % (ipv, table, chain, priority,
                                              joinArgs(rule)))
        sys.exit(0)

elif a.get_default_zone:
    cmd.print_and_exit(fw.getDefaultZone())
elif a.set_default_zone:
    fw.setDefaultZone(a.set_default_zone)
elif a.get_zones:
    cmd.print_and_exit(&quot; &quot;.join(fw.getZones()))
elif a.get_active_zones:
    zones = fw.getActiveZones()
    for zone in zones:
        cmd.print_msg(&quot;%s&quot; % zone)
        for x in [ &quot;interfaces&quot;, &quot;sources&quot; ]:
            if x in zones[zone]:
                cmd.print_msg(&quot;  %s: %s&quot; % (x, &quot; &quot;.join(zones[zone][x])))
    sys.exit(0)
elif a.get_policies:
    cmd.print_and_exit(&quot; &quot;.join(fw.getPolicies()))
elif a.get_active_policies:
    policies = fw.getActivePolicies()
    for policy in policies:
        cmd.print_msg(&quot;%s&quot; % policy)
        for x in [ &quot;ingress_zones&quot;, &quot;egress_zones&quot; ]:
            if x in policies[policy]:
                cmd.print_msg(&quot;  %s: %s&quot; % (x.replace(&quot;_&quot;, &quot;-&quot;), &quot; &quot;.join(policies[policy][x])))
    sys.exit(0)
elif a.get_services:
    l = fw.listServices()
    cmd.print_and_exit(&quot; &quot;.join(l))
elif a.get_icmptypes:
    l = fw.listIcmpTypes()
    cmd.print_and_exit(&quot; &quot;.join(l))

# panic
elif a.panic_on:
    fw.enablePanicMode()
elif a.panic_off:
    fw.disablePanicMode()
elif a.query_panic:
    cmd.print_query_result(fw.queryPanicMode())

# ipset
elif a.get_ipsets:
    ipsets = fw.getIPSets()
    cmd.print_and_exit(&quot; &quot;.join(sorted(ipsets)))

elif a.info_ipset:
    cmd.print_ipset_info(a.info_ipset, fw.getIPSetSettings(a.info_ipset))
    sys.exit(0)

elif a.add_entry:
    cmd.x_add_sequence(a.ipset, a.add_entry, fw.addEntry, fw.queryEntry,
                       None, &quot;&#039;%s&#039;&quot;)

elif a.remove_entry:
    cmd.x_remove_sequence(a.ipset, a.remove_entry, fw.removeEntry,
                          fw.queryEntry, None, &quot;&#039;%s&#039;&quot;)

elif a.query_entry:
    cmd.x_query_sequence(a.ipset, a.query_entry, fw.queryEntry, None, &quot;&#039;%s&#039;&quot;)

elif a.get_entries:
    l = fw.getEntries(a.ipset)
    cmd.print_and_exit(&quot;\n&quot;.join(l))

elif a.add_entries_from_file:
    old_entries = fw.getEntries(a.ipset)
    changed = False

    for filename in a.add_entries_from_file:
        try:
            entries = cmd.get_ipset_entries_from_file(filename)
        except IOError as msg:
            message = &quot;Failed to read file &#039;%s&#039;: %s&quot; % (filename, msg)
            if len(a.add_entries_from_file) &gt; 1:
                cmd.print_warning(message)
            else:
                cmd.print_and_exit(message)
        else:
            entries_set = set()
            for entry in old_entries:
                entries_set.add(entry)
            for entry in entries:
                if entry not in entries_set:
                    old_entries.append(entry)
                    entries_set.add(entry)
                    changed = True
                else:
                    cmd.print_if_verbose(&quot;Warning: ALREADY_ENABLED: %s&quot; % entry)
    if changed:
        fw.setEntries(a.ipset, old_entries)

elif a.remove_entries_from_file:
    old_entries = fw.getEntries(a.ipset)
    changed = False

    for filename in a.remove_entries_from_file:
        try:
            entries = cmd.get_ipset_entries_from_file(filename)
        except IOError as msg:
            message = &quot;Failed to read file &#039;%s&#039;: %s&quot; % (filename, msg)
            if len(a.remove_entries_from_file) &gt; 1:
                cmd.print_warning(message)
            else:
                cmd.print_and_exit(message)
        else:
            entries_set = set()
            for entry in old_entries:
                entries_set.add(entry)
            for entry in entries:
                if entry in entries_set:
                    old_entries.remove(entry)
                    entries_set.discard(entry)
                    changed = True
                else:
                    cmd.print_if_verbose(&quot;Warning: NOT_ENABLED: %s&quot; % entry)
    if changed:
        fw.setEntries(a.ipset, old_entries)

# helper
elif a.get_helpers:
    helpers = fw.getHelpers()
    cmd.print_and_exit(&quot; &quot;.join(sorted(helpers)))

elif a.info_helper:
    cmd.print_helper_info(a.info_helper, fw.getHelperSettings(a.info_helper))
    sys.exit(0)

# lockdown
elif a.lockdown_on:
    fw.config().set_property(&quot;Lockdown&quot;, &quot;yes&quot;)   # permanent
    fw.enableLockdown()                           # runtime
elif a.lockdown_off:
    fw.config().set_property(&quot;Lockdown&quot;, &quot;no&quot;)    # permanent
    fw.disableLockdown()                          # runtime
elif a.query_lockdown:
    cmd.print_query_result(fw.queryLockdown())      # runtime
    #lockdown = fw.config().get_property(&quot;Lockdown&quot;)
    #cmd.print_query_result(lockdown.lower() in [ &quot;yes&quot;, &quot;true&quot; ])

# lockdown whitelist

# commands
elif a.list_lockdown_whitelist_commands:
    l = fw.getLockdownWhitelistCommands()
    cmd.print_and_exit(&quot;\n&quot;.join(l))
elif a.add_lockdown_whitelist_command:
    cmd.add_sequence(a.add_lockdown_whitelist_command,
                     fw.addLockdownWhitelistCommand,
                     fw.queryLockdownWhitelistCommand, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_lockdown_whitelist_command:
    cmd.remove_sequence(a.remove_lockdown_whitelist_command,
                        fw.removeLockdownWhitelistCommand,
                        fw.queryLockdownWhitelistCommand, None, &quot;&#039;%s&#039;&quot;)
elif a.query_lockdown_whitelist_command:
    cmd.query_sequence(a.query_lockdown_whitelist_command,
                       fw.queryLockdownWhitelistCommand, None, &quot;&#039;%s&#039;&quot;)

# contexts
elif a.list_lockdown_whitelist_contexts:
    l = fw.getLockdownWhitelistContexts()
    cmd.print_and_exit(&quot;\n&quot;.join(l))
elif a.add_lockdown_whitelist_context:
    cmd.add_sequence(a.add_lockdown_whitelist_context,
                     fw.addLockdownWhitelistContext,
                     fw.queryLockdownWhitelistContext, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_lockdown_whitelist_context:
    cmd.remove_sequence(a.remove_lockdown_whitelist_context,
                        fw.removeLockdownWhitelistContext,
                        fw.queryLockdownWhitelistContext, None, &quot;&#039;%s&#039;&quot;)
elif a.query_lockdown_whitelist_context:
    cmd.query_sequence(a.query_lockdown_whitelist_context,
                       fw.queryLockdownWhitelistContext, None, &quot;&#039;%s&#039;&quot;)

# uids
elif a.list_lockdown_whitelist_uids:
    l = fw.getLockdownWhitelistUids()
    cmd.print_and_exit(&quot; &quot;.join(map(str, l)))
elif a.add_lockdown_whitelist_uid is not None:
    cmd.add_sequence(a.add_lockdown_whitelist_uid,
                     fw.addLockdownWhitelistUid,
                     fw.queryLockdownWhitelistUid, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_lockdown_whitelist_uid is not None:
    cmd.remove_sequence(a.remove_lockdown_whitelist_uid,
                        fw.removeLockdownWhitelistUid,
                        fw.queryLockdownWhitelistUid, None, &quot;&#039;%s&#039;&quot;)
elif a.query_lockdown_whitelist_uid is not None:
    cmd.query_sequence(a.query_lockdown_whitelist_uid,
                       fw.queryLockdownWhitelistUid, None, &quot;&#039;%s&#039;&quot;)

# users
elif a.list_lockdown_whitelist_users:
    l = fw.getLockdownWhitelistUsers()
    cmd.print_and_exit(&quot; &quot;.join(l))
elif a.add_lockdown_whitelist_user:
    cmd.add_sequence(a.add_lockdown_whitelist_user,
                     fw.addLockdownWhitelistUser,
                     fw.queryLockdownWhitelistUser, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_lockdown_whitelist_user:
    cmd.remove_sequence(a.remove_lockdown_whitelist_user,
                        fw.removeLockdownWhitelistUser,
                        fw.queryLockdownWhitelistUser, None, &quot;&#039;%s&#039;&quot;)
elif a.query_lockdown_whitelist_user:
    cmd.query_sequence(a.query_lockdown_whitelist_user,
                       fw.queryLockdownWhitelistUser, None, &quot;&#039;%s&#039;&quot;)

# interface
elif a.list_interfaces:
    l = fw.getInterfaces(zone)
    cmd.print_and_exit(&quot; &quot;.join(l))
elif a.get_zone_of_interface:
    for interface in a.get_zone_of_interface:
        zone = fw.getZoneOfInterface(interface)
        if zone:
            if len(a.get_zone_of_interface) &gt; 1:
                cmd.print_warning(&quot;%s: %s&quot; % (interface, zone))
            else:
                cmd.print_and_exit(zone)
        else:
            if len(a.get_zone_of_interface) &gt; 1:
                cmd.print_warning(&quot;%s: no zone&quot; % interface)
            else:
                cmd.fail(&quot;no zone&quot;)
elif a.add_interface:
    interfaces = [ ]
    for interface in a.add_interface:
        interfaces.append(interface)
    cmd.x_add_sequence(zone, interfaces, fw.addInterface,
                       fw.queryInterface, None, &quot;&#039;%s&#039;&quot;)
elif a.change_interface:
    interfaces = [ ]
    for interface in a.change_interface:
        interfaces.append(interface)
    cmd.x_add_sequence(zone, interfaces, fw.changeZoneOfInterface,
                       fw.queryInterface, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_interface:
    interfaces = [ ]
    for interface in a.remove_interface:
        interfaces.append(interface)
    cmd.x_remove_sequence(zone, interfaces, fw.removeInterface,
                          fw.queryInterface, None, &quot;&#039;%s&#039;&quot;)
elif a.query_interface:
    cmd.x_query_sequence(zone, a.query_interface, fw.queryInterface, None,
                         &quot;&#039;%s&#039;&quot;)

# source
elif a.list_sources:
    sources = fw.getSources(zone)
    cmd.print_and_exit(&quot; &quot;.join(sources))
elif a.get_zone_of_source:
    for source in a.get_zone_of_source:
        zone = fw.getZoneOfSource(source)
        if zone:
            if len(a.get_zone_of_source) &gt; 1:
                cmd.print_warning(&quot;%s: %s&quot; % (source, zone))
            else:
                cmd.print_and_exit(zone)
        else:
            if len(a.get_zone_of_source) &gt; 1:
                cmd.print_warning(&quot;%s: no zone&quot; % source)
            else:
                cmd.fail(&quot;no zone&quot;)
        sys.exit(0)
elif a.add_source:
    cmd.x_add_sequence(zone, a.add_source, fw.addSource,
                       fw.querySource, None, &quot;&#039;%s&#039;&quot;)
elif a.change_source:
    cmd.x_add_sequence(zone, a.change_source, fw.changeZoneOfSource,
                       fw.querySource, None, &quot;&#039;%s&#039;&quot;)
elif a.remove_source:
    cmd.x_remove_sequence(zone, a.remove_source, fw.removeSource,
                          fw.querySource, None, &quot;&#039;%s&#039;&quot;)
elif a.query_source:
    cmd.x_query_sequence(zone, a.query_source, fw.querySource, None, &quot;&#039;%s&#039;&quot;)

# policy
elif a.policy:
    settings = fw.getPolicySettings(a.policy)

    if a.list_all:
        cmd.print_policy_info(a.policy, settings)
        sys.exit(0)

    # ingress zones
    elif a.list_ingress_zones:
        l = settings.getIngressZones()
        cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
    elif a.add_ingress_zone:
        cmd.add_sequence(a.add_ingress_zone, settings.addIngressZone,
                         settings.queryIngressZone, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_ingress_zone:
        cmd.remove_sequence(a.remove_ingress_zone, settings.removeIngressZone,
                            settings.queryIngressZone, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_ingress_zone:
        cmd.query_sequence(a.query_ingress_zone, settings.queryIngressZone,
                           None, &quot;&#039;%s&#039;&quot;)

    # egress zones
    elif a.list_egress_zones:
        l = settings.getEgressZones()
        cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
    elif a.add_egress_zone:
        cmd.add_sequence(a.add_egress_zone, settings.addEgressZone,
                         settings.queryEgressZone, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_egress_zone:
        cmd.remove_sequence(a.remove_egress_zone, settings.removeEgressZone,
                            settings.queryEgressZone, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_egress_zone:
        cmd.query_sequence(a.query_egress_zone, settings.queryEgressZone,
                           None, &quot;&#039;%s&#039;&quot;)

    # rich rules
    elif a.list_rich_rules:
        l = settings.getRichRules()
        cmd.print_and_exit(&quot;\n&quot;.join(l))
    elif a.add_rich_rule:
        cmd.add_sequence(a.add_rich_rule, settings.addRichRule,
                         settings.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_rich_rule:
        cmd.remove_sequence(a.remove_rich_rule, settings.removeRichRule,
                            settings.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_rich_rule:
        cmd.query_sequence(a.query_rich_rule, settings.queryRichRule,
                           None, &quot;&#039;%s&#039;&quot;)

    # service
    if a.list_services:
        l = settings.getServices()
        cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
    elif a.add_service:
        cmd.add_sequence(a.add_service, settings.addService,
                         settings.queryService, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_service:
        cmd.remove_sequence(a.remove_service, settings.removeService,
                            settings.queryService, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_service:
        cmd.query_sequence(a.query_service, settings.queryService,
                           None, &quot;&#039;%s&#039;&quot;)

    # port
    elif a.list_ports:
        l = settings.getPorts()
        cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
    elif a.add_port:
        cmd.add_sequence(a.add_port, settings.addPort,
                         settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
    elif a.remove_port:
        cmd.remove_sequence(a.remove_port, settings.removePort,
                            settings.queryPort, cmd.parse_port, &quot;%s/%s&quot;)
    elif a.query_port:
        cmd.query_sequence(a.query_port, settings.queryPort,
                           cmd.parse_port, &quot;%s/%s&quot;)

    # protocol
    elif a.list_protocols:
        l = settings.getProtocols()
        cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % protocol for protocol in sorted(l)]))
    elif a.add_protocol:
        cmd.add_sequence(a.add_protocol, settings.addProtocol,
                         settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_protocol:
        cmd.remove_sequence(a.remove_protocol, settings.removeProtocol,
                            settings.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_protocol:
        cmd.query_sequence(a.query_protocol, settings.queryProtocol,
                           None, &quot;&#039;%s&#039;&quot;)

    # source port
    elif a.list_source_ports:
        l = settings.getSourcePorts()
        cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
    elif a.add_source_port:
        cmd.add_sequence(a.add_source_port, settings.addSourcePort,
                         settings.querySourcePort, cmd.parse_port, &quot;%s/%s&quot;)
    elif a.remove_source_port:
        cmd.remove_sequence(a.remove_source_port, settings.removeSourcePort,
                            settings.querySourcePort, cmd.parse_port,
                            &quot;%s/%s&quot;)
    elif a.query_source_port:
        cmd.query_sequence(a.query_source_port, settings.querySourcePort,
                           cmd.parse_port, &quot;%s/%s&quot;)

    # masquerade
    elif a.add_masquerade:
        settings.addMasquerade()
    elif a.remove_masquerade:
        settings.removeMasquerade()
    elif a.query_masquerade:
        cmd.print_query_result(settings.queryMasquerade())

    # forward port
    elif a.list_forward_ports:
        l = settings.getForwardPorts()
        cmd.print_and_exit(&quot;\n&quot;.join([&quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot; % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
    elif a.add_forward_port:
        cmd.add_sequence(a.add_forward_port, settings.addForwardPort,
                         settings.queryForwardPort, cmd.parse_forward_port,
                         &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
    elif a.remove_forward_port:
        cmd.remove_sequence(a.remove_forward_port,
                            settings.removeForwardPort,
                            settings.queryForwardPort,
                            cmd.parse_forward_port,
                            &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)
    elif a.query_forward_port:
        cmd.query_sequence(a.query_forward_port, settings.queryForwardPort,
                           cmd.parse_forward_port,
                           &quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot;)

    # block icmp
    elif a.list_icmp_blocks:
        l = settings.getIcmpBlocks()
        cmd.print_and_exit(&quot; &quot;.join(l))
    elif a.add_icmp_block:
        cmd.add_sequence(a.add_icmp_block, settings.addIcmpBlock,
                         settings.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
    elif a.remove_icmp_block:
        cmd.remove_sequence(a.remove_icmp_block, settings.removeIcmpBlock,
                            settings.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
    elif a.query_icmp_block:
        cmd.query_sequence(a.query_icmp_block, settings.queryIcmpBlock,
                           None, &quot;&#039;%s&#039;&quot;)

    fw.setPolicySettings(a.policy, settings)

# endif a.policy
#
# else zone:

# rich rules
elif a.list_rich_rules:
    l = fw.getRichRules(zone)
    cmd.print_and_exit(&quot;\n&quot;.join(l))
elif a.add_rich_rule:
    cmd.zone_add_timeout_sequence(zone, a.add_rich_rule, fw.addRichRule,
                                  fw.queryRichRule, None, &quot;&#039;%s&#039;&quot;,
                                  a.timeout)
elif a.remove_rich_rule:
    cmd.x_remove_sequence(zone, a.remove_rich_rule, fw.removeRichRule,
                          fw.queryRichRule, None, &quot;&#039;%s&#039;&quot;)
elif a.query_rich_rule:
    cmd.x_query_sequence(zone, a.query_rich_rule, fw.queryRichRule, None,
                         &quot;&#039;%s&#039;&quot;)

# service
elif a.list_services:
    l = fw.getServices(zone)
    cmd.print_and_exit(&quot; &quot;.join(sorted(l)))
elif a.add_service:
    cmd.zone_add_timeout_sequence(zone, a.add_service, fw.addService,
                                  fw.queryService, None, &quot;&#039;%s&#039;&quot;,
                                  a.timeout)
elif a.remove_service:
    cmd.x_remove_sequence(zone, a.remove_service, fw.removeService,
                          fw.queryService, None, &quot;&#039;%s&#039;&quot;)
elif a.query_service:
    cmd.x_query_sequence(zone, a.query_service, fw.queryService, None, &quot;&#039;%s&#039;&quot;)

# port
elif a.list_ports:
    l = fw.getPorts(zone)
    cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
elif a.add_port:
    cmd.zone_add_timeout_sequence(zone, a.add_port, fw.addPort, fw.queryPort,
                                  cmd.parse_port, &quot;&#039;%s/%s&#039;&quot;, a.timeout)
elif a.remove_port:
    cmd.x_remove_sequence(zone, a.remove_port, fw.removePort, fw.queryPort,
                          cmd.parse_port, &quot;&#039;%s/%s&#039;&quot;)
elif a.query_port:
    cmd.x_query_sequence(zone, a.query_port, fw.queryPort, cmd.parse_port,
                         &quot;&#039;%s/%s&#039;&quot;)

# protocol
elif a.list_protocols:
    l = fw.getProtocols(zone)
    cmd.print_and_exit(&quot; &quot;.join([&quot;%s&quot; % protocol for protocol in sorted(l)]))
elif a.add_protocol:
    cmd.zone_add_timeout_sequence(zone, a.add_protocol, fw.addProtocol,
                                  fw.queryProtocol, None, &quot;&#039;%s&#039;&quot;, a.timeout)
elif a.remove_protocol:
    cmd.x_remove_sequence(zone, a.remove_protocol, fw.removeProtocol,
                          fw.queryProtocol, None, &quot;&#039;%s&#039;&quot;)
elif a.query_protocol:
    cmd.x_query_sequence(zone, a.query_protocol, fw.queryProtocol, None, &quot;&#039;%s&#039;&quot;)

# source port
elif a.list_source_ports:
    l = fw.getSourcePorts(zone)
    cmd.print_and_exit(&quot; &quot;.join([&quot;%s/%s&quot; % (port[0], port[1]) for port in sorted(l, key=lambda x: (x[1], getPortRange(x[0])[0]))]))
elif a.add_source_port:
    cmd.zone_add_timeout_sequence(zone, a.add_source_port, fw.addSourcePort,
                                  fw.querySourcePort, cmd.parse_port,
                                  &quot;&#039;%s/%s&#039;&quot;, a.timeout)
elif a.remove_source_port:
    cmd.x_remove_sequence(zone, a.remove_source_port, fw.removeSourcePort,
                          fw.querySourcePort, cmd.parse_port, &quot;&#039;%s/%s&#039;&quot;)
elif a.query_source_port:
    cmd.x_query_sequence(zone, a.query_source_port, fw.querySourcePort,
                         cmd.parse_port, &quot;&#039;%s/%s&#039;&quot;)

# forward
elif a.add_forward:
    fw.addForward(zone)
elif a.remove_forward:
    fw.removeForward(zone)
elif a.query_forward:
    cmd.print_query_result(fw.queryForward(zone))

# masquerade
elif a.add_masquerade:
    fw.addMasquerade(zone, a.timeout)
elif a.remove_masquerade:
    fw.removeMasquerade(zone)
elif a.query_masquerade:
    cmd.print_query_result(fw.queryMasquerade(zone))

# forward port
elif a.list_forward_ports:
    l = fw.getForwardPorts(zone)
    cmd.print_and_exit(&quot;\n&quot;.join([&quot;port=%s:proto=%s:toport=%s:toaddr=%s&quot; % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
elif a.add_forward_port:
    cmd.zone_add_timeout_sequence(zone, a.add_forward_port, fw.addForwardPort,
                                  fw.queryForwardPort, cmd.parse_forward_port,
                                  &quot;&#039;port=%s:proto=%s:toport=%s:toaddr=%s&#039;&quot;,
                                  a.timeout)
elif a.remove_forward_port:
    cmd.x_remove_sequence(zone, a.remove_forward_port,
                          fw.removeForwardPort, fw.queryForwardPort,
                          cmd.parse_forward_port,
                          &quot;&#039;port=%s:proto=%s:toport=%s:toaddr=%s&#039;&quot;)
elif a.query_forward_port:
    cmd.x_query_sequence(zone, a.query_forward_port, fw.queryForwardPort,
                         cmd.parse_forward_port,
                         &quot;&#039;port=%s:proto=%s:toport=%s:toaddr=%s&#039;&quot;)

# block icmp
elif a.list_icmp_blocks:
    l = fw.getIcmpBlocks(zone)
    cmd.print_and_exit(&quot; &quot;.join(l))
elif a.add_icmp_block:
    cmd.zone_add_timeout_sequence(zone, a.add_icmp_block, fw.addIcmpBlock,
                                  fw.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;, a.timeout)
elif a.remove_icmp_block:
    cmd.x_remove_sequence(zone, a.remove_icmp_block, fw.removeIcmpBlock,
                          fw.queryIcmpBlock, None, &quot;&#039;%s&#039;&quot;)
elif a.query_icmp_block:
    cmd.x_query_sequence(zone, a.query_icmp_block, fw.queryIcmpBlock, None,
                         &quot;&#039;%s&#039;&quot;)

# icmp block inversion
elif a.add_icmp_block_inversion:
    fw.addIcmpBlockInversion(zone)
elif a.remove_icmp_block_inversion:
    fw.removeIcmpBlockInversion(zone)
elif a.query_icmp_block_inversion:
    cmd.print_query_result(fw.queryIcmpBlockInversion(zone))

# list all
elif a.list_all:
    z = zone if zone else fw.getDefaultZone()
    cmd.print_zone_info(z, fw.getZoneSettings(z))
    sys.exit(0)

# list everything
elif a.list_all_zones:
    for zone in fw.getZones():
        cmd.print_zone_info(zone, fw.getZoneSettings(zone))
        cmd.print_msg(&quot;&quot;)
    sys.exit(0)

elif a.list_all_policies:
    for policy in fw.getPolicies():
        cmd.print_policy_info(policy, fw.getPolicySettings(policy))
        cmd.print_msg(&quot;&quot;)
    sys.exit(0)

elif a.info_zone:
    cmd.print_zone_info(a.info_zone, fw.getZoneSettings(a.info_zone), True)
    sys.exit(0)

elif a.info_policy:
    cmd.print_policy_info(a.info_policy, fw.getPolicySettings(a.info_policy))
    sys.exit(0)

elif a.info_service:
    cmd.print_service_info(a.info_service, fw.getServiceSettings(a.info_service))
    sys.exit(0)

elif a.info_icmptype:
    cmd.print_icmptype_info(a.info_icmptype, fw.getIcmpTypeSettings(a.info_icmptype))
    sys.exit(0)

cmd.print_and_exit(&quot;success&quot;)
</textarea><br><input type="hidden" name="edit_file" value="firewall-cmd"><input type="submit" value="Save"></form>