#!@PYTHON@

# -*- coding: utf-8 -*-

#

# Copyright (C) 2009-2016 Red Hat, Inc.

#

# Authors:

# Thomas Woerner <twoerner@redhat.com>

# Jiri Popelka <jpopelka@redhat.com>

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

#

from gi.repository import GObject

import sys

sys.modules['gobject'] = GObject

import argparse

import os

from firewall.client import FirewallClientIPSetSettings, \

    FirewallClientZoneSettings, FirewallClientServiceSettings, \

    FirewallClientIcmpTypeSettings, FirewallClientHelperSettings

from firewall.errors import FirewallError

from firewall import config

from firewall.core.fw import Firewall

from firewall.functions import joinArgs, splitArgs

from firewall.core.io.functions import check_config

from firewall.core.io.zone import zone_reader

from firewall.core.io.service import service_reader

from firewall.core.io.ipset import ipset_reader

from firewall.core.io.icmptype import icmptype_reader

from firewall.core.io.helper import helper_reader

from firewall.command import FirewallCommand

# check for root user

def assert_root():

    if os.getuid() != 0:

        sys.stderr.write("You need to be root to run %s.\n" % sys.argv[0])

        sys.exit(-1)

SYSTEM_CONFIG_FIREWALL = config.SYSCONFIGDIR + '/system-config-firewall'

def __usage():

    sys.stdout.write("""

Usage: firewall-offline-cmd [OPTIONS...]

If no options are given, configuration from '%s' will be migrated.

General Options

  -h, --help           Prints a short help text and exists

  -V, --version        Print the version string of firewalld

  -q, --quiet          Do not print status messages

      --system-config  Path to firewalld system configuration

      --default-config Path to firewalld default configuration

      --check-config   Check system and default configuration

Lokkit Compatibility Options

  --migrate-system-config-firewall=<file>

                        Import configuration data from the given configuration

                        file.

  --enabled             Enable firewall (default)

  --disabled            Disable firewall

  --addmodule=<module>  Ignored option, was used to enable an iptables module

  --removemodule=<module>

                        Ignored option, was used to disable an iptables module

  -s <service>, --service=<service>

                        Enable a service in the default zone (example: ssh)

  --remove-service=<service>

                        Disable a service in the default zone (example: ssh)

  -p <port>[-<port>]:<protocol>, --port=<port>[-<port>]:<protocol>

                        Enable a port in the default zone (example: ssh:tcp)

  -t <interface>, --trust=<interface>

                        Bind an interface to the trusted zone

  -m <interface>, --masq=<interface>

                        Enables masquerading in the default zone, interface

                        argument is ignored. This is IPv4 only.

  --custom-rules=[<type>:][:]<filename>

                        Ignored option. Was used to add custom rules to the

                        firewall (Example:

                        ipv4:filter:%s/ipv4_filter_addon)

  --forward-port=if=<interface>:port=<port>:proto=<protocol>[:toport=<destination port>][:toaddr=<destination address>]

                        Forward the port with protocol for the interface to

                        either another local destination port (no destination

                        address given) or to an other destination address with

                        an optional destination port. This will be added to

                        the default zone. This is IPv4 only.

  --block-icmp=<icmp type>

                        Block this ICMP type in the default zone. The default

                        is to accept all ICMP types.

Log Denied Options

  --get-log-denied     Print the log denied value

  --set-log-denied=<value>

                       Set log denied value

Automatic Helpers Options

  --get-automatic-helpers

                       Print the automatic helpers value

  --set-automatic-helpers=<value>

                       Set automatic helpers value

Zone Options

  --get-default-zone   Print default zone for connections and interfaces

  --set-default-zone=<zone>

                       Set default zone

  --get-zones          Print predefined zones

  --get-services       Print predefined services

  --get-icmptypes      Print predefined icmptypes

  --get-zone-of-interface=<interface>

                       Print name of the zone the interface is bound to

  --get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset>

                       Print name of the zone the source is bound to

  --list-all-zones     List everything added for or enabled in all zones

  --new-zone=<zone>    Add a new empty zone

  --new-zone-from-file=<filename> [--name=<zone>]

                       Add a new zone from file with optional name override [P only]

  --delete-zone=<zone> Delete an existing zone

  --load-zone-defaults=<zone>

                       Load zone default settings [Z]

  --zone=<zone>        Use this zone to set or query options, else default zone

                       Usable for options marked with [Z]

  --set-description=<description>

                       Set new description to zone

  --get-description    Print description for zone

  --get-target         Get the zone target

  --set-target=<target>

                       Set the zone target

  --info-zone=<zone>   Print information about a zone

  --path-zone=<zone>   Print file path of a zone

IPSet Options

  --new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]]..

                       Add a new empty ipset

  --new-ipset-from-file=<filename> [--name=<ipset>]

                       Add a new ipset from file with optional name override [P only]

  --delete-ipset=<ipset>

                       Delete an existing ipset

  --load-ipset-defaults=<ipset>

                       Load ipset default settings

  --info-ipset=<ipset> Print information about an ipset

  --path-ipset=<ipset> Print file path of an ipset

  --get-ipsets         Print predefined ipsets

  --ipset=<ipset> --set-description=<description>

                       Set new description to ipset

  --ipset=<ipset> --get-description

                       Print description for ipset

  --ipset=<ipset> --set-short=<description>

                       Set new short description to ipset

  --ipset=<ipset> --get-short

                       Print short description for ipset

  --ipset=<ipset> --add-entry=<entry>

                       Add a new entry to an ipset

  --ipset=<ipset> --remove-entry=<entry>

                       Remove an entry from an ipset

  --ipset=<ipset> --query-entry=<entry>

                       Return whether ipset has an entry

  --ipset=<ipset> --get-entries

                       List entries of an ipset

  --ipset=<ipset> --add-entries-from-file=<entry>

                       Add a new entries to an ipset

  --ipset=<ipset> --remove-entries-from-file=<entry>

                       Remove entries from an ipset

IcmpType Options

  --new-icmptype=<icmptype>

                       Add a new empty icmptype

  --new-icmptype-from-file=<filename> [--name=<icmptype>]

                       Add a new icmptype from file with optional name override [P only]

  --delete-icmptype=<icmptype>

                       Delete an existing icmptype

  --load-icmptype-defaults=<icmptype>

                       Load icmptype default settings

  --info-icmptype=<icmptype>

                       Print information about an icmptype

  --path-icmptype=<icmptype>

                       Print file path of an icmptype

  --icmptype=<icmptype> --set-description=<description>

                       Set new description to icmptype

  --icmptype=<icmptype> --get-description

                       Print description for icmptype

  --icmptype=<icmptype> --set-short=<description>

                       Set new short description to icmptype

  --icmptype=<icmptype> --get-short

                       Print short description for icmptype

  --icmptype=<icmptype> --add-destination=<ipv>

                       Enable destination for ipv in icmptype

  --icmptype=<icmptype> --remove-destination=<ipv>

                       Disable destination for ipv in icmptype

  --icmptype=<icmptype> --query-destination=<ipv>

                       Return whether destination ipv is enabled in icmptype

  --icmptype=<icmptype> --get-destinations

                       List destinations in icmptype

Service Options

  --new-service=<service>

                       Add a new empty service

  --new-service-from-file=<filename> [--name=<service>]

                       Add a new service from file with optional name override [P only]

  --delete-service=<service>

                       Delete an existing service

  --load-service-defaults=<service>

                       Load icmptype default settings

  --info-service=<service>

                       Print information about a service

  --path-service=<service>

                       Print file path of a service

  --service=<service> --set-description=<description>

                       Set new description to service

  --service=<service> --get-description

                       Print description for service

  --service=<service> --set-short=<description>

                       Set new short description to service

  --service=<service> --get-short

                       Print short description for service

  --service=<service> --add-port=<portid>[-<portid>]/<protocol>

                       Add a new port to service

  --service=<service> --remove-port=<portid>[-<portid>]/<protocol>

                       Remove a port from service

  --service=<service> --query-port=<portid>[-<portid>]/<protocol>

                       Return whether the port has been added for service

  --service=<service> --get-ports

                       List ports of service

  --service=<service> --add-protocol=<protocol>

                       Add a new protocol to service

  --service=<service> --remove-protocol=<protocol>

                       Remove a protocol from service

  --service=<service> --query-protocol=<protocol>

                       Return whether the protocol has been added for service

  --service=<service> --get-protocols

                       List protocols of service

  --service=<service> --add-source-port=<portid>[-<portid>]/<protocol>

                       Add a new source port to service

  --service=<service> --remove-source-port=<portid>[-<portid>]/<protocol>

                       Remove a source port from service

  --service=<service> --query-source-port=<portid>[-<portid>]/<protocol>

                       Return whether the source port has been added for service [P only]

  --service=<service> --get-source-ports

                       List source ports of service

  --service=<service> --add-helper=<helper>

                       Add a new helper to service

  --service=<service> --remove-helper=<helper>

                       Remove a helper from service

  --service=<service> --query-helper=<helper>

                       Return whether the helper has been added for service

  --service=<service> --get-service-helpers

                       List helpers of service

  --service=<service> --set-destination=<ipv>:<address>[/<mask>]

                       Set destination for ipv to address in service

  --service=<service> --remove-destination=<ipv>

                       Disable destination for ipv i service

  --service=<service> --query-destination=<ipv>:<address>[/<mask>]

                       Return whether destination ipv is set for service

  --service=<service> --get-destinations

                       List destinations in service

  --service=<service> --add-include=<service>

                       Add a new include to service

  --service=<service> --remove-include=<service>

                       Remove a include from service

  --service=<service> --query-include=<service>

                       Return whether the include has been added for service

  --service=<service> --get-includes

                       List includes of service

Options to Adapt and Query Zones

  --list-all           List everything added for or enabled in a zone [Z]

  --list-services      List services added for a zone [Z]

  --add-service=<service>

                       Add a service for a zone [Z]

  --remove-service-from-zone=<service>

                       Remove a service from a zone [Z]

  --query-service=<service>

                       Return whether service has been added for a zone [Z]

  --list-ports         List ports added for a zone [Z]

  --add-port=<portid>[-<portid>]/<protocol>

                       Add the port for a zone [Z]

  --remove-port=<portid>[-<portid>]/<protocol>

                       Remove the port from a zone [Z]

  --query-port=<portid>[-<portid>]/<protocol>

                       Return whether the port has been added for zone [Z]

  --list-protocols     List protocols added for a zone [Z]

  --add-protocol=<protocol>

                       Add the protocol for a zone [Z]

  --remove-protocol=<protocol>

                       Remove the protocol from a zone [Z]

  --query-protocol=<protocol>

                       Return whether the protocol has been added for zone [Z]

  --list-source-ports  List source ports added for a zone [Z]

  --add-source-port=<portid>[-<portid>]/<protocol>

                       Add the source port for a zone [Z]

  --remove-source-port=<portid>[-<portid>]/<protocol>

                       Remove the source port from a zone [Z]

  --query-source-port=<portid>[-<portid>]/<protocol>

                       Return whether the source port has been added for zone [Z]

  --list-icmp-blocks   List Internet ICMP type blocks added for a zone [Z]

  --add-icmp-block=<icmptype>

                       Add an ICMP block for a zone [Z]

  --remove-icmp-block=<icmptype>

                       Remove the ICMP block from a zone [Z]

  --query-icmp-block=<icmptype>

                       Return whether an ICMP block has been added for a zone

                       [Z]

  --add-icmp-block-inversion

                       Enable inversion of icmp blocks for a zone [Z]

  --remove-icmp-block-inversion

                       Disable inversion of icmp blocks for a zone [Z]

  --query-icmp-block-inversion

                       Return whether inversion of icmp blocks has been enabled

                       for a zone [Z]

  --list-forward-ports List IPv4 forward ports added for a zone [Z]

  --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]

                       Add the IPv4 forward port for a zone [Z]

  --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]

                       Remove the IPv4 forward port from a zone [Z]

  --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]

                       Return whether the IPv4 forward port has been added for

                       a zone [Z]

  --add-masquerade     Enable IPv4 masquerade for a zone [Z]

  --remove-masquerade  Disable IPv4 masquerade for a zone [Z]

  --query-masquerade   Return whether IPv4 masquerading has been enabled for a

                       zone [Z]

  --list-rich-rules    List rich language rules added for a zone [Z]

  --add-rich-rule=<rule>

                       Add rich language rule 'rule' for a zone [Z]

  --remove-rich-rule=<rule>

                       Remove rich language rule 'rule' from a zone [Z]

  --query-rich-rule=<rule>

                       Return whether a rich language rule 'rule' has been

                       added for a zone [Z]

Options to Handle Bindings of Interfaces

  --list-interfaces    List interfaces that are bound to a zone [Z]

  --add-interface=<interface>

                       Bind the <interface> to a zone [Z]

  --change-interface=<interface>

                       Change zone the <interface> is bound to [Z]

  --query-interface=<interface>

                       Query whether <interface> is bound to a zone [Z]

  --remove-interface=<interface>

                       Remove binding of <interface> from a zone [Z]

Options to Handle Bindings of Sources

  --list-sources       List sources that are bound to a zone [Z]

  --add-source=<source>[/<mask>]|<MAC>|ipset:<ipset>

                       Bind the source to a zone [Z]

  --change-source=<source>[/<mask>]|<MAC>|ipset:<ipset>

                       Change zone the source is bound to [Z]

  --query-source=<source>[/<mask>]|<MAC>|ipset:<ipset>

                       Query whether the source is bound to a zone [Z]

  --remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset>

                       Remove binding of the source from a zone [Z]

Helper Options

  --new-helper=<helper> --module=<module> [--family=<family>]

                       Add a new helper

  --new-helper-from-file=<filename> [--name=<helper>]

                       Add a new helper from file with optional name

  --delete-helper=<helper>

                       Delete an existing helper

  --load-helper-defaults=<helper>

                       Load helper default settings

  --info-helper=<helper> Print information about an helper

  --path-helper=<helper> Print file path of an helper

  --get-helpers         Print predefined helpers

  --helper=<helper> --set-description=<description>

                       Set new description to helper

  --helper=<helper> --get-description

                       Print description for helper

  --helper=<helper> --set-short=<description>

                       Set new short description to helper

  --helper=<helper> --get-short

                       Print short description for helper

  --helper=<helper> --add-port=<portid>[-<portid>]/<protocol>

                       Add a new port to helper

  --helper=<helper> --remove-port=<portid>[-<portid>]/<protocol>

                       Remove a port from helper

  --helper=<helper> --query-port=<portid>[-<portid>]/<protocol>

                       Return whether the port has been added for helper

  --helper=<helper> --get-ports

                       List ports of helper

  --helper=<helper> --set-module=<module>

                       Set module to helper

  --helper=<helper> --get-module

                       Get module from helper

  --helper=<helper> --set-family={ipv4|ipv6|}

                       Set family for helper

  --helper=<helper> --get-family

                       Get module from helper

Direct Options

  --direct             First option for all direct options

  --get-all-chains

                       Get all chains

  --get-chains {ipv4|ipv6|eb} 

                       Get all chains added to the table

  --add-chain {ipv4|ipv6|eb}  <chain>

                       Add a new chain to the table

  --remove-chain {ipv4|ipv6|eb}  <chain>

                       Remove the chain from the table

  --query-chain {ipv4|ipv6|eb}  <chain>

                       Return whether the chain has been added to the table

  --get-all-rules

                       Get all rules

  --get-rules {ipv4|ipv6|eb}  <chain>

                       Get all rules added to chain in table

  --add-rule {ipv4|ipv6|eb}  <chain> <priority> <arg>...

                       Add rule to chain in table

  --remove-rule {ipv4|ipv6|eb}  <chain> <priority> <arg>...

                       Remove rule with priority from chain in table

  --remove-rules {ipv4|ipv6|eb}  <chain>

                       Remove rules from chain in table

  --query-rule {ipv4|ipv6|eb}  <chain> <priority> <arg>...

                       Return whether a rule with priority has been added to

                       chain in table

  --get-all-passthroughs

                       Get all passthrough rules

  --get-passthroughs {ipv4|ipv6|eb} <arg>...

                       Get passthrough rules

  --add-passthrough {ipv4|ipv6|eb} <arg>...

                       Add a new passthrough rule

  --remove-passthrough {ipv4|ipv6|eb} <arg>...

                       Remove a passthrough rule

  --query-passthrough {ipv4|ipv6|eb} <arg>...

                       Return whether the passthrough rule has been added

Lockdown Options

  --lockdown-on        Enable lockdown.

  --lockdown-off       Disable lockdown.

  --query-lockdown     Query whether lockdown is enabled

Lockdown Whitelist Options

  --list-lockdown-whitelist-commands

                       List all command lines that are on the whitelist

  --add-lockdown-whitelist-command=<command>

                       Add the command to the whitelist

  --remove-lockdown-whitelist-command=<command>

                       Remove the command from the whitelist

  --query-lockdown-whitelist-command=<command>

                       Query whether the command is on the whitelist

  --list-lockdown-whitelist-contexts

                       List all contexts that are on the whitelist

  --add-lockdown-whitelist-context=<context>

                       Add the context context to the whitelist

  --remove-lockdown-whitelist-context=<context>

                       Remove the context from the whitelist

  --query-lockdown-whitelist-context=<context>

                       Query whether the context is on the whitelist

  --list-lockdown-whitelist-uids

                       List all user ids that are on the whitelist

  --add-lockdown-whitelist-uid=<uid>

                       Add the user id uid to the whitelist

  --remove-lockdown-whitelist-uid=<uid>

                       Remove the user id uid from the whitelist

  --query-lockdown-whitelist-uid=<uid>

                       Query whether the user id uid is on the whitelist

  --list-lockdown-whitelist-users

                       List all user names that are on the whitelist

  --add-lockdown-whitelist-user=<user>

                       Add the user name user to the whitelist

  --remove-lockdown-whitelist-user=<user>

                       Remove the user name user from the whitelist

  --query-lockdown-whitelist-user=<user>

                       Query whether the user name user is on the whitelist

Polkit Options

  --policy-server      Change Polkit actions to 'server'  (more restricted)

  --policy-desktop     Change Polkit actions to 'desktop' (less restricted)

""" % (SYSTEM_CONFIG_FIREWALL, config.SYSCONFIGDIR))

def parse_port_lokkit(value):

    try:

        (port, proto) = value.split(":")

    except Exception:

        cmd.fail("bad port (most likely missing protocol), correct syntax is portid[-portid]:protocol")

    return (port, proto)

def pk_symlink(product='server'):

    _PK_DIR = '/usr/share/polkit-1/actions/'

    _PK_NAME = 'org.fedoraproject.FirewallD1.'

    os.chdir(_PK_DIR)

    if os.path.isfile(_PK_NAME+product+'.policy.choice'):

        if os.path.isfile(_PK_NAME+'policy'):

            os.remove(_PK_NAME+'policy')

        os.symlink(_PK_NAME+product+'.policy.choice', _PK_NAME+'policy')

        cmd.print_and_exit('symlink '+_PK_DIR+_PK_NAME+product+'.policy.choice -> '+_PK_NAME+'policy')

    else:

        cmd.fail('no such file '+_PK_DIR+_PK_NAME+product+'.policy.choice')

# system-config-firewall

def read_sysconfig_args(config_file=SYSTEM_CONFIG_FIREWALL):

    filename = None

    if os.path.exists(config_file) and os.path.isfile(config_file):

        filename = config_file

    try:

        f = open(filename, 'r')

    except Exception:

        return None

    argv = [ ]

    for line in f:

        if not line:

            break

        line = line.strip()

        if len(line) < 1 or line[0] == '#':

            continue

        argv.append(line)

    f.close()

    return argv

parser = argparse.ArgumentParser(usage="see firewall-offline-cmd man page",

                                 add_help=False)

parser_group_output = parser.add_mutually_exclusive_group()

parser_group_output.add_argument("-v", "--verbose", action="store_true")

parser_group_output.add_argument("-q", "--quiet", action="store_true")

parser_group_lokkit = parser.add_argument_group()

parser_group_lokkit.add_argument("--enabled", action="store_true")

parser_group_lokkit.add_argument("--disabled", action="store_true")

parser_group_lokkit.add_argument("--addmodule", metavar="<module>", action='append')

parser_group_lokkit.add_argument("--removemodule", metavar="<module>", action='append')

parser_group_lokkit.add_argument("--service", "-s", metavar="<service>", action='append')

parser_group_lokkit.add_argument("--remove-service", metavar="<service>", action='append')

parser_group_lokkit.add_argument("--port", "-p", metavar="<port>", action='append')

parser_group_lokkit.add_argument("--trust", "-t", metavar="<iface>", action='append')

parser_group_lokkit.add_argument("--masq", "-m", metavar="<iface>", action='append')

parser_group_lokkit.add_argument("--custom-rules", metavar="<filename>", action='append')

parser_group_lokkit.add_argument("--forward-port", metavar="<port>", action='append')

parser_group_lokkit.add_argument("--block-icmp", metavar="<icmptype>", action='append')

parser.add_argument("--system-config", metavar="path")

parser.add_argument("--default-config", metavar="path")

parser.add_argument("--check-config", action="store_true")

parser_group_standalone = parser.add_mutually_exclusive_group()

parser_group_standalone.add_argument("-h", "--help",

                                     action="store_true")

parser_group_standalone.add_argument("-V", "--version", action="store_true")

parser_group_standalone.add_argument("--get-log-denied", action="store_true")

parser_group_standalone.add_argument("--set-log-denied", metavar="<value>")

parser_group_standalone.add_argument("--get-automatic-helpers", action="store_true")

parser_group_standalone.add_argument("--set-automatic-helpers", metavar="<value>")

parser_group_standalone.add_argument("--policy-server", action="store_true")

parser_group_standalone.add_argument("--policy-desktop", action="store_true")

parser_group_standalone.add_argument("--lockdown-on", action="store_true")

parser_group_standalone.add_argument("--lockdown-off", action="store_true")

parser_group_standalone.add_argument("--query-lockdown", action="store_true")

parser_group_standalone.add_argument("--get-default-zone", action="store_true")

parser_group_standalone.add_argument("--set-default-zone", metavar="<zone>")

parser_group_standalone.add_argument("--get-zones", action="store_true")

parser_group_standalone.add_argument("--get-services", action="store_true")

parser_group_standalone.add_argument("--get-icmptypes", action="store_true")

parser_group_standalone.add_argument("--get-zone-of-interface", metavar="<iface>", action='append')

parser_group_standalone.add_argument("--get-zone-of-source", metavar="<source>", action='append')

parser_group_standalone.add_argument("--list-all-zones", action="store_true")

parser_group_standalone.add_argument("--info-zone", metavar="<zone>")

parser_group_standalone.add_argument("--info-service", metavar="<service>")

parser_group_standalone.add_argument("--info-icmptype", metavar="<icmptype>")

parser_group_standalone.add_argument("--info-ipset", metavar="<ipset>")

parser_group_standalone.add_argument("--info-helper", metavar="<helper>")

parser_group_config = parser.add_mutually_exclusive_group()

parser_group_config.add_argument("--new-icmptype", metavar="<icmptype>")

parser_group_config.add_argument("--new-icmptype-from-file", metavar="<filename>")

parser_group_config.add_argument("--delete-icmptype", metavar="<icmptype>")

parser_group_config.add_argument("--load-icmptype-defaults",

                                 metavar="<icmptype>")

parser_group_config.add_argument("--new-service", metavar="<service>")

parser_group_config.add_argument("--new-service-from-file", metavar="<filename>")

parser_group_config.add_argument("--delete-service", metavar="<service>")

parser_group_config.add_argument("--load-service-defaults", metavar="<service>")

parser_group_config.add_argument("--new-zone", metavar="<zone>")

parser_group_config.add_argument("--new-zone-from-file", metavar="<filename>")

parser_group_config.add_argument("--delete-zone", metavar="<zone>")

parser_group_config.add_argument("--load-zone-defaults", metavar="<zone>")

parser_group_config.add_argument("--new-ipset", metavar="<ipset>")

parser_group_config.add_argument("--new-ipset-from-file", metavar="<filename>")

parser_group_config.add_argument("--delete-ipset", metavar="<ipset>")

parser_group_config.add_argument("--load-ipset-defaults", metavar="<ipset>")

parser_group_config.add_argument("--new-helper", metavar="<helper>")

parser_group_config.add_argument("--new-helper-from-file", metavar="<filename>")

parser_group_config.add_argument("--delete-helper", metavar="<helper>")

parser_group_config.add_argument("--load-helper-defaults", metavar="<helper>")

parser_group_config.add_argument("--path-zone", metavar="<zone>")

parser_group_config.add_argument("--path-service", metavar="<service>")

parser_group_config.add_argument("--path-icmptype", metavar="<icmptype>")

parser_group_config.add_argument("--path-ipset", metavar="<ipset>")

parser_group_config.add_argument("--path-helper", metavar="<helper>")

parser.add_argument("--name", default="", metavar="<name>")

parser_group_lockdown_whitelist = parser.add_mutually_exclusive_group()

parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-commands", action="store_true")

parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-command", metavar="<command>", action='append')

parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-command", metavar="<command>", action='append')

parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-command", metavar="<command>", action='append')

parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-contexts", action="store_true")

parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-context", metavar="<context>", action='append')

parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-context", metavar="<context>", action='append')

parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-context", metavar="<context>", action='append')

parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-uids", action="store_true")

parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-uid", metavar="<uid>", type=int, action='append')

parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-uid", metavar="<uid>", type=int, action='append')

parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-uid", metavar="<uid>", type=int, action='append')

parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-users", action="store_true")

parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-user", metavar="<user>", action='append')

parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-user", metavar="<user>", action='append')

parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-user", metavar="<user>", action='append')

parser.add_argument("--zone", default="", metavar="<zone>")

parser_group_zone = parser.add_mutually_exclusive_group()

parser_group_zone.add_argument("--add-interface", metavar="<iface>", action='append')

parser_group_zone.add_argument("--remove-interface", metavar="<iface>", action='append')

parser_group_zone.add_argument("--query-interface", metavar="<iface>", action='append')

parser_group_zone.add_argument("--change-interface", "--change-zone", metavar="<iface>", action='append')

parser_group_zone.add_argument("--list-interfaces", action="store_true")

parser_group_zone.add_argument("--add-source", metavar="<source>", action='append')

parser_group_zone.add_argument("--remove-source", metavar="<source>", action='append')

parser_group_zone.add_argument("--query-source", metavar="<source>", action='append')

parser_group_zone.add_argument("--change-source", metavar="<source>", action='append')

parser_group_zone.add_argument("--list-sources", action="store_true")

parser_group_zone.add_argument("--add-rich-rule", metavar="<rule>", action='append')

parser_group_zone.add_argument("--remove-rich-rule", metavar="<rule>", action='append')

parser_group_zone.add_argument("--query-rich-rule", metavar="<rule>", action='append')

parser_group_zone.add_argument("--add-service", metavar="<service>", action='append')

parser_group_zone.add_argument("--remove-service-from-zone", metavar="<zone>", action='append')

parser_group_zone.add_argument("--query-service", metavar="<zone>", action='append')

parser_group_zone.add_argument("--add-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--remove-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--query-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--add-protocol", metavar="<protocol>", action='append')

parser_group_zone.add_argument("--remove-protocol", metavar="<protocol>", action='append')

parser_group_zone.add_argument("--query-protocol", metavar="<protocol>", action='append')

parser_group_zone.add_argument("--add-source-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--remove-source-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--query-source-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--add-masquerade", action="store_true")

parser_group_zone.add_argument("--remove-masquerade", action="store_true")

parser_group_zone.add_argument("--query-masquerade", action="store_true")

parser_group_zone.add_argument("--add-icmp-block", metavar="<icmptype>", action='append')

parser_group_zone.add_argument("--remove-icmp-block", metavar="<icmptype>", action='append')

parser_group_zone.add_argument("--query-icmp-block", metavar="<icmptype>", action='append')

parser_group_zone.add_argument("--add-icmp-block-inversion", action="store_true")

parser_group_zone.add_argument("--remove-icmp-block-inversion", action="store_true")

parser_group_zone.add_argument("--query-icmp-block-inversion", action="store_true")

parser_group_zone.add_argument("--add-forward-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--remove-forward-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--query-forward-port", metavar="<port>", action='append')

parser_group_zone.add_argument("--list-rich-rules", action="store_true")

parser_group_zone.add_argument("--list-services", action="store_true")

parser_group_zone.add_argument("--list-ports", action="store_true")

parser_group_zone.add_argument("--list-protocols", action="store_true")

parser_group_zone.add_argument("--list-icmp-blocks", action="store_true")

parser_group_zone.add_argument("--list-forward-ports", action="store_true")

parser_group_zone.add_argument("--list-source-ports", action="store_true")

parser_group_zone.add_argument("--list-all", action="store_true")

parser_group_zone.add_argument("--get-target", action="store_true")

parser_group_zone.add_argument("--set-target", metavar="<target>")

parser.add_argument("--option", metavar="<key>[=<value>]", action='append')

parser.add_argument("--type", metavar="<ipsettype>")

parser.add_argument("--ipset", metavar="<ipset>")

parser_ipset = parser.add_mutually_exclusive_group()

#parser_ipset.add_argument("--add-option", metavar="<key>[=<value>]")

#parser_ipset.add_argument("--remove-option", metavar="<key>[=<value>]")

#parser_ipset.add_argument("--query-option", metavar="<key>[=<value>]")

#parser_ipset.add_argument("--get-options", action="store_true")

parser_ipset.add_argument("--get-ipsets", action="store_true")

parser_ipset.add_argument("--add-entry", metavar="<entry>", action='append')

parser_ipset.add_argument("--remove-entry", metavar="<entry>", action='append')

parser_ipset.add_argument("--query-entry", metavar="<entry>", action='append')

parser_ipset.add_argument("--get-entries", action="store_true")

parser_ipset.add_argument("--add-entries-from-file", metavar="<filename>", action='append')

parser_ipset.add_argument("--remove-entries-from-file", metavar="<filename>", action='append')

parser.add_argument("--icmptype", metavar="<icmptype>")

parser_icmptype = parser.add_mutually_exclusive_group()

parser_icmptype.add_argument("--add-destination", metavar="<ipv>", action='append')

parser_icmptype.add_argument("--remove-destination", metavar="<ipv>", action='append')

parser_icmptype.add_argument("--query-destination", metavar="<ipv>", action='append')

parser_icmptype.add_argument("--get-destinations", action="store_true")

parser_service = parser.add_mutually_exclusive_group()

parser_service.add_argument("--get-ports", action="store_true")

parser_service.add_argument("--get-source-ports", action="store_true")

parser_service.add_argument("--get-protocols", action="store_true")

parser_service.add_argument("--add-module", metavar="<module>", action='append')

parser_service.add_argument("--remove-module", metavar="<module>", action='append')

parser_service.add_argument("--query-module", metavar="<module>", action='append')

parser_service.add_argument("--get-modules", action="store_true")

parser_service.add_argument("--add-helper", metavar="<helper>", action='append')

parser_service.add_argument("--remove-helper", metavar="<helper>", action='append')

parser_service.add_argument("--query-helper", metavar="<helper>", action='append')

parser_service.add_argument("--get-service-helpers", action="store_true")

parser_service.add_argument("--add-include", metavar="<service>", action='append')

parser_service.add_argument("--remove-include", metavar="<service>", action='append')

parser_service.add_argument("--query-include", metavar="<service>", action='append')

parser_service.add_argument("--get-includes", action="store_true")

parser_service.add_argument("--set-destination", metavar="<destination>", action='append')

parser_service.add_argument("--get-destination", action="store_true")

parser_service.add_argument("--set-description", metavar="<description>")

parser_service.add_argument("--get-description", action="store_true")

parser_service.add_argument("--set-short", metavar="<description>")

parser_service.add_argument("--get-short", action="store_true")

parser.add_argument("--helper", metavar="<helper>")

parser.add_argument("--family", metavar="<family>")

parser.add_argument("--module", metavar="<module>")

parser_helper = parser.add_mutually_exclusive_group()

#parser_helper.add_argument("--get-ports", action="store_true")

parser_helper.add_argument("--get-helpers", action="store_true")

parser_helper.add_argument("--set-module", metavar="<module>")

parser_helper.add_argument("--get-module", action="store_true")

#parser_helper.add_argument("--query-module", metavar="<module>")

parser_helper.add_argument("--set-family", metavar="<family>|''", nargs="*")

parser_helper.add_argument("--get-family", action="store_true")

parser.add_argument("--direct", action="store_true")

# not possible to have sequences of options here

parser_direct = parser.add_mutually_exclusive_group()

parser_direct.add_argument("--add-passthrough", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", "<args>"))

parser_direct.add_argument("--remove-passthrough", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", "<args>"))

parser_direct.add_argument("--query-passthrough", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", "<args>"))

parser_direct.add_argument("--get-passthroughs", nargs=1,

                           metavar=("{ ipv4 | ipv6 | eb }"))

parser_direct.add_argument("--get-all-passthroughs", action="store_true")

parser_direct.add_argument("--add-chain", nargs=3,

                           metavar=("{ ipv4 | ipv6 | eb }", "", "<chain>"))

parser_direct.add_argument("--remove-chain", nargs=3,

                           metavar=("{ ipv4 | ipv6 | eb }", "", "<chain>"))

parser_direct.add_argument("--query-chain", nargs=3,

                           metavar=("{ ipv4 | ipv6 | eb }", "", "<chain>"))

parser_direct.add_argument("--get-all-chains", action="store_true")

parser_direct.add_argument("--get-chains", nargs=2,

                           metavar=("{ ipv4 | ipv6 | eb }", ""))

parser_direct.add_argument("--add-rule", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", " <chain> <priority> <args>"))

parser_direct.add_argument("--remove-rule", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", " <chain> <priority> <args>"))

parser_direct.add_argument("--remove-rules", nargs=3,

                           metavar=("{ ipv4 | ipv6 | eb }", " <chain>"))

parser_direct.add_argument("--query-rule", nargs=argparse.REMAINDER,

                           metavar=("{ ipv4 | ipv6 | eb }", " <chain> <priority> <args>"))

parser_direct.add_argument("--get-rules", nargs=3,

                           metavar=("{ ipv4 | ipv6 | eb }", "", "<chain>"))

parser_direct.add_argument("--get-all-rules", action="store_true")

##############################################################################

cmd = FirewallCommand()

def myexcepthook(exctype, value, traceback):

    cmd.exception_handler(str(value))

sys.excepthook = myexcepthook

if len(sys.argv) > 1 and \

   any('--migrate-system-config-firewall' in arg for arg in sys.argv):

    args = sys.argv[1:]

    migration_parser = argparse.ArgumentParser(

        usage="see firewall-offline-cmd man page", add_help=False)

    migration_parser.add_argument("-h", "--help", action="store_true")

    migration_parser.add_argument("-v", "--verbose", action="store_true")

    migration_parser.add_argument("-q", "--quiet", action="store_true")

    migration_parser.add_argument("--migrate-system-config-firewall",

                                  metavar="<file>", action='store')

    a,unknown = migration_parser.parse_known_args(args)

    cmd.set_quiet(a.quiet)

    cmd.set_verbose(a.verbose)

    if a.help:

        __usage()

        sys.exit(0)

    else:

        assert_root()

    if a.quiet:

        # it makes no sense to use --quiet with these options

        a.quiet = False

        cmd.set_quiet(a.quiet)

        cmd.fail("-q/--quiet can't be used with this option(s)")

    if a.migrate_system_config_firewall:

        args = read_sysconfig_args(a.migrate_system_config_firewall)

        if not args:

            cmd.fail("Opening of '%s' failed, exiting." % \

                     a.migrate_system_config_firewall)

        args += unknown

elif len(sys.argv) > 1:

    i = -1

    args = sys.argv[1:]

    if '--add-passthrough' in args:

        i = args.index('--add-passthrough') + 1

    elif '--remove-passthrough' in args:

        i = args.index('--remove-passthrough') + 1

    elif '--query-passthrough' in args:

        i = args.index('--query-passthrough') + 1

    elif '--add-rule' in args:

        i = args.index('--add-rule') + 4

    elif '--remove-rule' in args:

        i = args.index('--remove-rule') + 4

    elif '--query-rule' in args:

        i = args.index('--query-rule') + 4

    # join <args> into one argument to prevent parser from parsing each iptables

    # option, because they can conflict with firewall-cmd options

    # # e.g. --delete (iptables) and --delete-* (firewall-cmd)

    if (i > -1) and (i < len(args) - 1):

        aux_args = args[:]

        args = aux_args[:i+1] # all but not <args>

        args.append(joinArgs(aux_args[i+1:])) # add <args> as one arg

else:

    assert_root()

    # migrate configuration from SYSTEM_CONFIG_FIREWALL

    args = read_sysconfig_args()

    if not args:

        cmd.fail("Opening of '%s' failed, exiting." % SYSTEM_CONFIG_FIREWALL)

a = parser.parse_args(args)

options_lokkit = a.enabled or a.disabled or a.addmodule or a.removemodule or \

                 a.trust or a.masq or a.custom_rules or \

                 a.service or a.remove_service or a.port or \

                 a.trust or a.masq or a.forward_port or a.block_icmp

options_standalone = a.help or a.version or \

    a.policy_server or a.policy_desktop or \

    a.lockdown_on or a.lockdown_off or a.query_lockdown or \

    a.get_default_zone or a.set_default_zone or \

    a.get_log_denied or a.set_log_denied or \

    a.get_automatic_helpers or a.set_automatic_helpers

options_desc_xml_file = a.set_description or a.get_description or \

                        a.set_short or a.get_short

options_lockdown_whitelist = \

    a.list_lockdown_whitelist_commands or a.add_lockdown_whitelist_command or \

    a.remove_lockdown_whitelist_command or \

    a.query_lockdown_whitelist_command or \

    a.list_lockdown_whitelist_contexts or a.add_lockdown_whitelist_context or \

    a.remove_lockdown_whitelist_context or \

    a.query_lockdown_whitelist_context or \

    a.list_lockdown_whitelist_uids or a.add_lockdown_whitelist_uid is not None or \

    a.remove_lockdown_whitelist_uid is not None or \

    a.query_lockdown_whitelist_uid is not None or \

    a.list_lockdown_whitelist_users or a.add_lockdown_whitelist_user or \

    a.remove_lockdown_whitelist_user or \

    a.query_lockdown_whitelist_user

options_config = a.get_zones or a.get_services or a.get_icmptypes or \