Merge branch 'current' into 2fa

15 files changed, 320 insertions, 331 deletions

diff --git a/src/op_mode/containers_op.py b/src/op_mode/containers_op.py
index 1e3fc3a8f..bc317029c 100755
--- a/src/op_mode/containers_op.py
+++ b/src/op_mode/containers_op.py
@@ -15,10 +15,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import argparse
-from vyos.configquery import query_context, ConfigQueryError
-from vyos.util import cmd
 
-config, op = query_context()
+from getpass import getuser
+from vyos.configquery import ConfigTreeQuery
+from vyos.util import cmd
 
 parser = argparse.ArgumentParser()
 parser.add_argument("-a", "--all", action="store_true", help="Show all containers")
@@ -26,34 +26,53 @@ parser.add_argument("-i", "--image", action="store_true", help="Show container i
 parser.add_argument("-n", "--networks", action="store_true", help="Show container images")
 parser.add_argument("-p", "--pull", action="store", help="Pull image for container")
 parser.add_argument("-d", "--remove", action="store", help="Delete container image")
+parser.add_argument("-u", "--update", action="store", help="Update given container image")
 
-if not config.exists(['container']):
+config = ConfigTreeQuery()
+base = ['container']
+if not config.exists(base):
     print('Containers not configured')
     exit(0)
 
+if getuser() != 'root':
+    raise OSError('This functions needs to be run as root to return correct results!')
+
 if __name__ == '__main__':
     args = parser.parse_args()
 
     if args.all:
         print(cmd('podman ps --all'))
-        exit(0)
-    if args.image:
+
+    elif args.image:
         print(cmd('podman image ls'))
-        exit(0)
-    if args.networks:
+
+    elif args.networks:
         print(cmd('podman network ls'))
-        exit(0)
-    if args.pull:
+
+    elif args.pull:
         image = args.pull
         try:
-            print(cmd(f'sudo podman image pull {image}'))
+            print(cmd(f'podman image pull {image}'))
         except:
             print(f'Can\'t find or download image "{image}"')
-        exit(0)
-    if args.remove:
+
+    elif args.remove:
         image = args.remove
         try:
-            print(cmd(f'sudo podman image rm {image}'))
+            print(cmd(f'podman image rm {image}'))
         except:
             print(f'Can\'t delete image "{image}"')
-        exit(0)
+
+    elif args.update:
+        tmp = config.get_config_dict(base + ['name', args.update],
+                                     key_mangling=('-', '_'), get_first_key=True)
+        try:
+            image = tmp['image']
+            print(cmd(f'podman image pull {image}'))
+        except:
+            print(f'Can\'t find or download image "{image}"')
+    else:
+        parser.print_help()
+        exit(1)
+
+    exit(0)
diff --git a/src/op_mode/dns_forwarding_statistics.py b/src/op_mode/dns_forwarding_statistics.py
index 1fb61d263..d79b6c024 100755
--- a/src/op_mode/dns_forwarding_statistics.py
+++ b/src/op_mode/dns_forwarding_statistics.py
@@ -11,7 +11,7 @@ PDNS_CMD='/usr/bin/rec_control --socket-dir=/run/powerdns'
 OUT_TMPL_SRC = """
 DNS forwarding statistics:
 
-Cache entries: {{ cache_entries -}}
+Cache entries: {{ cache_entries }}
 Cache size: {{ cache_size }} kbytes
 
 """
diff --git a/src/op_mode/ikev2_profile_generator.py b/src/op_mode/ikev2_profile_generator.py
index d45525431..990b06c12 100755
--- a/src/op_mode/ikev2_profile_generator.py
+++ b/src/op_mode/ikev2_profile_generator.py
@@ -21,7 +21,7 @@ from sys import exit
 from socket import getfqdn
 from cryptography.x509.oid import NameOID
 
-from vyos.config import Config
+from vyos.configquery import ConfigTreeQuery
 from vyos.pki import load_certificate
 from vyos.template import render_to_string
 from vyos.util import ask_input
@@ -117,7 +117,7 @@ args = parser.parse_args()
 ipsec_base = ['vpn', 'ipsec']
 config_base = ipsec_base +  ['remote-access', 'connection']
 pki_base = ['pki']
-conf = Config()
+conf = ConfigTreeQuery()
 if not conf.exists(config_base):
     exit('IPSec remote-access is not configured!')
 
@@ -153,7 +153,7 @@ cert = load_certificate(pki['certificate'][cert_name]['certificate'])
 
 data['ca_cn'] = ca_cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
 data['cert_cn'] = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
-data['ca_cert'] = conf.return_value(pki_base + ['ca', ca_name, 'certificate'])
+data['ca_cert'] = conf.value(pki_base + ['ca', ca_name, 'certificate'])
 
 esp_proposals = conf.get_config_dict(ipsec_base + ['esp-group', data['esp_group'], 'proposal'],
                                      key_mangling=('-', '_'), get_first_key=True)
diff --git a/src/op_mode/ping.py b/src/op_mode/ping.py
index 2144ab53c..60bbc0c78 100755
--- a/src/op_mode/ping.py
+++ b/src/op_mode/ping.py
@@ -62,8 +62,8 @@ options = {
     },
     'interface': {
         'ping': '{command} -I {value}',
-        'type': '<interface> <X.X.X.X> <h:h:h:h:h:h:h:h>',
-        'help': 'Interface to use as source for ping'
+        'type': '<interface>',
+        'help': 'Source interface'
     },
     'interval': {
         'ping': '{command} -i {value}',
@@ -115,6 +115,10 @@ options = {
         'type': '<bytes>',
         'help': 'Number of bytes to send'
     },
+    'source-address': {
+        'ping': '{command} -I {value}',
+        'type': '<x.x.x.x> <h:h:h:h:h:h:h:h>',
+    },
     'ttl': {
         'ping': '{command} -t {value}',
         'type': '<ttl>',
@@ -234,4 +238,4 @@ if __name__ == '__main__':
 
     # print(f'{command} {host}')
     os.system(f'{command} {host}')
-    
\ No newline at end of file
+
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 297270cf1..2283cd820 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -17,7 +17,6 @@
 import argparse
 import ipaddress
 import os
-import re
 import sys
 import tabulate
 
@@ -25,6 +24,7 @@ from cryptography import x509
 from cryptography.x509.oid import ExtendedKeyUsageOID
 
 from vyos.config import Config
+from vyos.configquery import ConfigTreeQuery
 from vyos.configdict import dict_merge
 from vyos.pki import encode_certificate, encode_public_key, encode_private_key, encode_dh_parameters
 from vyos.pki import create_certificate, create_certificate_request, create_certificate_revocation_list
@@ -37,25 +37,24 @@ from vyos.util import ask_input, ask_yes_no
 from vyos.util import cmd
 
 CERT_REQ_END = '-----END CERTIFICATE REQUEST-----'
-
 auth_dir = '/config/auth'
 
 # Helper Functions
-
+conf = ConfigTreeQuery()
 def get_default_values():
     # Fetch default x509 values
-    conf = Config()
     base = ['pki', 'x509', 'default']
     x509_defaults = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                     get_first_key=True, no_tag_node_value_mangle=True)
+                                     get_first_key=True,
+                                     no_tag_node_value_mangle=True)
     default_values = defaults(base)
-    return dict_merge(default_values, x509_defaults)
+    x509_defaults = dict_merge(default_values, x509_defaults)
+
+    return x509_defaults
 
 def get_config_ca_certificate(name=None):
     # Fetch ca certificates from config
-    conf = Config()
     base = ['pki', 'ca']
-
     if not conf.exists(base):
         return False
 
@@ -65,13 +64,12 @@ def get_config_ca_certificate(name=None):
             return False
 
     return conf.get_config_dict(base, key_mangling=('-', '_'),
-        get_first_key=True, no_tag_node_value_mangle=True)
+                                get_first_key=True,
+                                no_tag_node_value_mangle=True)
 
 def get_config_certificate(name=None):
     # Get certificates from config
-    conf = Config()
     base = ['pki', 'certificate']
-
     if not conf.exists(base):
         return False
 
@@ -81,7 +79,8 @@ def get_config_certificate(name=None):
             return False
 
     return conf.get_config_dict(base, key_mangling=('-', '_'),
-        get_first_key=True, no_tag_node_value_mangle=True)
+                                get_first_key=True,
+                                no_tag_node_value_mangle=True)
 
 def get_certificate_ca(cert, ca_certs):
     # Find CA certificate for given certificate
@@ -100,7 +99,6 @@ def get_certificate_ca(cert, ca_certs):
 
 def get_config_revoked_certificates():
     # Fetch revoked certificates from config
-    conf = Config()
     ca_base = ['pki', 'ca']
     cert_base = ['pki', 'certificate']
 
@@ -108,12 +106,14 @@ def get_config_revoked_certificates():
 
     if conf.exists(ca_base):
         ca_certificates = conf.get_config_dict(ca_base, key_mangling=('-', '_'),
-            get_first_key=True, no_tag_node_value_mangle=True)
+                                               get_first_key=True,
+                                               no_tag_node_value_mangle=True)
         certs.extend(ca_certificates.values())
 
     if conf.exists(cert_base):
         certificates = conf.get_config_dict(cert_base, key_mangling=('-', '_'),
-            get_first_key=True, no_tag_node_value_mangle=True)
+                                            get_first_key=True,
+                                            no_tag_node_value_mangle=True)
         certs.extend(certificates.values())
 
     return [cert_dict for cert_dict in certs if 'revoke' in cert_dict]
@@ -144,39 +144,41 @@ def get_revoked_by_serial_numbers(serial_numbers=[]):
 def install_certificate(name, cert='', private_key=None, key_type=None, key_passphrase=None, is_ca=False):
     # Show conf commands for installing certificate
     prefix = 'ca' if is_ca else 'certificate'
-    print("Configure mode commands to install:")
+    print('Configure mode commands to install:')
 
+    base = f"set pki {prefix} {name}"
     if cert:
         cert_pem = "".join(encode_certificate(cert).strip().split("\n")[1:-1])
-        print("set pki %s %s certificate '%s'" % (prefix, name, cert_pem))
+        print(f"{base} certificate '{cert_pem}'")
 
     if private_key:
         key_pem = "".join(encode_private_key(private_key, passphrase=key_passphrase).strip().split("\n")[1:-1])
-        print("set pki %s %s private key '%s'" % (prefix, name, key_pem))
+        print(f"{base} private key '{key_pem}'")
         if key_passphrase:
-            print("set pki %s %s private password-protected" % (prefix, name))
+            print(f"{base} private password-protected")
 
 def install_crl(ca_name, crl):
     # Show conf commands for installing crl
     print("Configure mode commands to install CRL:")
     crl_pem = "".join(encode_certificate(crl).strip().split("\n")[1:-1])
-    print("set pki ca %s crl '%s'" % (ca_name, crl_pem))
+    print(f"set pki ca {ca_name} crl '{crl_pem}'")
 
 def install_dh_parameters(name, params):
     # Show conf commands for installing dh params
     print("Configure mode commands to install DH parameters:")
     dh_pem = "".join(encode_dh_parameters(params).strip().split("\n")[1:-1])
-    print("set pki dh %s parameters '%s'" % (name, dh_pem))
+    print(f"set pki dh {name} parameters '{dh_pem}'")
 
 def install_ssh_key(name, public_key, private_key, passphrase=None):
     # Show conf commands for installing ssh key
     key_openssh = encode_public_key(public_key, encoding='OpenSSH', key_format='OpenSSH')
     username = os.getlogin()
     type_key_split = key_openssh.split(" ")
+
+    base = f"set system login user {username} authentication public-keys {name}"
     print("Configure mode commands to install SSH key:")
-    print("set system login user %s authentication public-keys %s key '%s'" % (username, name, type_key_split[1]))
-    print("set system login user %s authentication public-keys %s type '%s'" % (username, name, type_key_split[0]))
-    print("")
+    print(f"{base} key '{type_key_split[1]}'")
+    print(f"{base} type '{type_key_split[0]}'", end="\n\n")
     print(encode_private_key(private_key, encoding='PEM', key_format='OpenSSH', passphrase=passphrase))
 
 def install_keypair(name, key_type, private_key=None, public_key=None, passphrase=None):
@@ -189,7 +191,7 @@ def install_keypair(name, key_type, private_key=None, public_key=None, passphras
 
         if install_public_key:
             install_public_pem = "".join(public_key_pem.strip().split("\n")[1:-1])
-            print("set pki key-pair %s public key '%s'" % (name, install_public_pem))
+            print(f"set pki key-pair {name} public key '{install_public_pem}'")
         else:
             print("Public key:")
             print(public_key_pem)
@@ -200,30 +202,53 @@ def install_keypair(name, key_type, private_key=None, public_key=None, passphras
 
         if install_private_key:
             install_private_pem = "".join(private_key_pem.strip().split("\n")[1:-1])
-            print("set pki key-pair %s private key '%s'" % (name, install_private_pem))
+            print(f"set pki key-pair {name} private key '{install_private_pem}'")
             if passphrase:
-                print("set pki key-pair %s private password-protected" % (name,))
+                print(f"set pki key-pair {name} private password-protected")
         else:
             print("Private key:")
             print(private_key_pem)
 
-def install_wireguard_key(name, private_key, public_key):
+def install_wireguard_key(interface, private_key, public_key):
     # Show conf commands for installing wireguard key pairs
-    is_interface = re.match(r'^wg[\d]+$', name)
+    from vyos.ifconfig import Section
+    if Section.section(interface) != 'wireguard':
+        print(f'"{interface}" is not a WireGuard interface name!')
+        exit(1)
+
+    # Check if we are running in a config session - if yes, we can directly write to the CLI
+    cli_string = f"interfaces wireguard {interface} private-key '{private_key}'"
+    if Config().in_session():
+        cmd(f"/opt/vyatta/sbin/my_set {cli_string}")
+
+        print('"generate" CLI command executed from config session.\nGenerated private-key was imported to CLI!',end='\n\n')
+        print(f'Use the following command to verify: show interfaces wireguard {interface}')
+    else:
+        print('"generate" CLI command executed from operational level.\n'
+              'Generated private-key is not stored to CLI, use configure mode commands to install key:', end='\n\n')
+        print(f"set {cli_string}", end="\n\n")
 
-    print("Configure mode commands to install key:")
-    if is_interface:
-        print("set interfaces wireguard %s private-key '%s'" % (name, private_key))
-        print("")
-        print("Public key for use on peer configuration: " + public_key)
+    print(f"Corresponding public-key to use on peer system is: '{public_key}'")
+
+
+def install_wireguard_psk(interface, peer, psk):
+    from vyos.ifconfig import Section
+    if Section.section(interface) != 'wireguard':
+        print(f'"{interface}" is not a WireGuard interface name!')
+        exit(1)
+
+    # Check if we are running in a config session - if yes, we can directly write to the CLI
+    cli_string = f"interfaces wireguard {interface} peer {peer} preshared-key '{psk}'"
+    if Config().in_session():
+        cmd(f"/opt/vyatta/sbin/my_set {cli_string}")
+
+        print('"generate" CLI command executed from config session.\nGenerated preshared-key was imported to CLI!',end='\n\n')
+        print(f'Use the following command to verify: show interfaces wireguard {interface}')
     else:
-        print("set interfaces wireguard [INTERFACE] peer %s public-key '%s'" % (name, public_key))
-        print("")
-        print("Private key for use on peer configuration: " + private_key)
+        print('"generate" CLI command executed from operational level.\n'
+              'Generated preshared-key is not stored to CLI, use configure mode commands to install key:', end='\n\n')
+        print(f"set {cli_string}", end="\n\n")
 
-def install_wireguard_psk(name, psk):
-    # Show conf commands for installing wireguard psk
-    print("set interfaces wireguard [INTERFACE] peer %s preshared-key '%s'" % (name, psk))
 
 def ask_passphrase():
     passphrase = None
@@ -464,7 +489,7 @@ def generate_certificate_sign(name, ca_name, install=False, file=False):
     if not cert_req:
         print("Invalid certificate request")
         return None
-        
+
     cert = generate_certificate(cert_req, ca_cert, ca_private_key, is_ca=False)
     passphrase = ask_passphrase()
 
@@ -630,49 +655,37 @@ def generate_openvpn_key(name, install=False, file=False):
         key_data = "".join(key_lines[1:-1]) # Remove wrapper tags and line endings
         key_version = '1'
 
+        import re
         version_search = re.search(r'BEGIN OpenVPN Static key V(\d+)', result) # Future-proofing (hopefully)
         if version_search:
             key_version = version_search[1]
 
+        base = f"set pki openvpn shared-secret {name}"
         print("Configure mode commands to install OpenVPN key:")
-        print("set pki openvpn shared-secret %s key '%s'" % (name, key_data))
-        print("set pki openvpn shared-secret %s version '%s'" % (name, key_version))
+        print(f"{base} key '{key_data}'")
+        print(f"{base} version '{key_version}'")
 
     if file:
         write_file(f'{name}.key', result)
 
-def generate_wireguard_key(name, install=False, file=False):
+def generate_wireguard_key(interface=None, install=False):
     private_key = cmd('wg genkey')
     public_key = cmd('wg pubkey', input=private_key)
 
-    if not install:
-        print("Private key: " + private_key)
-        print("Public key: " + public_key)
-        return None
-
-    if install:
-        install_wireguard_key(name, private_key, public_key)
-
-    if file:
-        write_file(f'{name}_public.key', public_key)
-        write_file(f'{name}_private.key', private_key)
+    if interface and install:
+        install_wireguard_key(interface, private_key, public_key)
+    else:
+        print(f'Private key: {private_key}')
+        print(f'Public key: {public_key}', end='\n\n')
 
-def generate_wireguard_psk(name, install=False, file=False):
+def generate_wireguard_psk(interface=None, peer=None, install=False):
     psk = cmd('wg genpsk')
-
-    if not install and not file:
-        print("Pre-shared key:")
-        print(psk)
-        return None
-
-    if install:
-        install_wireguard_psk(name, psk)
-
-    if file:
-        write_file(f'{name}.key', psk)
+    if interface and peer and install:
+        install_wireguard_psk(interface, peer, psk)
+    else:
+        print(f'Pre-shared key: {psk}')
 
 # Show functions
-
 def show_certificate_authority(name=None):
     headers = ['Name', 'Subject', 'Issuer CN', 'Issued', 'Expiry', 'Private Key', 'Parent']
     data = []
@@ -789,10 +802,13 @@ if __name__ == '__main__':
     # OpenVPN
     parser.add_argument('--openvpn', help='OpenVPN TLS key', required=False)
 
-    # Wireguard
+    # WireGuard
     parser.add_argument('--wireguard', help='Wireguard', action='store_true')
-    parser.add_argument('--key', help='Wireguard key pair', required=False)
-    parser.add_argument('--psk', help='Wireguard pre shared key', required=False)
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument('--key', help='Wireguard key pair', action='store_true', required=False)
+    group.add_argument('--psk', help='Wireguard pre shared key', action='store_true', required=False)
+    parser.add_argument('--interface', help='Install generated keys into running-config for named interface', action='store')
+    parser.add_argument('--peer', help='Install generated keys into running-config for peer', action='store')
 
     # Global
     parser.add_argument('--file', help='Write generated keys into specified filename', action='store_true')
@@ -813,26 +829,47 @@ if __name__ == '__main__':
                 elif args.self_sign:
                     generate_certificate_selfsign(args.certificate, install=args.install, file=args.file)
                 else:
-                    generate_certificate_request(name=args.certificate, install=args.install)
+                    generate_certificate_request(name=args.certificate, install=args.install, file=args.file)
+
             elif args.crl:
                 generate_certificate_revocation_list(args.crl, install=args.install, file=args.file)
+
             elif args.ssh:
                 generate_ssh_keypair(args.ssh, install=args.install, file=args.file)
+
             elif args.dh:
                 generate_dh_parameters(args.dh, install=args.install, file=args.file)
+
             elif args.keypair:
                 generate_keypair(args.keypair, install=args.install, file=args.file)
+
             elif args.openvpn:
                 generate_openvpn_key(args.openvpn, install=args.install, file=args.file)
+
             elif args.wireguard:
+                # WireGuard supports writing key directly into the CLI, but this
+                # requires the vyos_libexec_dir environment variable to be set
+                os.environ["vyos_libexec_dir"] = "/usr/libexec/vyos"
+
                 if args.key:
-                    generate_wireguard_key(args.key, install=args.install, file=args.file)
-                elif args.psk:
-                    generate_wireguard_psk(args.psk, install=args.install, file=args.file)
+                    generate_wireguard_key(args.interface, install=args.install)
+                if args.psk:
+                    generate_wireguard_psk(args.interface, peer=args.peer, install=args.install)
+
         elif args.action == 'show':
             if args.ca:
-                show_certificate_authority(None if args.ca == 'all' else args.ca)
+                ca_name = None if args.ca == 'all' else args.ca
+                if ca_name:
+                    if not conf.exists(['pki', 'ca', ca_name]):
+                        print(f'CA "{ca_name}" does not exist!')
+                        exit(1)
+                show_certificate_authority(ca_name)
             elif args.certificate:
+                cert_name = None if args.certificate == 'all' else args.certificate
+                if cert_name:
+                    if not conf.exists(['pki', 'certificate', cert_name]):
+                        print(f'Certificate "{cert_name}" does not exist!')
+                        exit(1)
                 show_certificate(None if args.certificate == 'all' else args.certificate)
             elif args.crl:
                 show_crl(None if args.crl == 'all' else args.crl)
diff --git a/src/op_mode/powerctrl.py b/src/op_mode/powerctrl.py
index f8b5a3dda..679b03c0b 100755
--- a/src/op_mode/powerctrl.py
+++ b/src/op_mode/powerctrl.py
@@ -92,37 +92,40 @@ def cancel_shutdown():
         try:
             run('/sbin/shutdown -c --no-wall')
         except OSError as e:
-            exit("Could not cancel a reboot or poweroff: %s" % e)
+            exit(f'Could not cancel a reboot or poweroff: {e}')
 
-        message = 'Scheduled {} has been cancelled {}'.format(output['MODE'], timenow)
+        mode = output['MODE']
+        message = f'Scheduled {mode} has been cancelled {timenow}'
         run(f'wall {message} > /dev/null 2>&1')
     else:
         print("Reboot or poweroff is not scheduled")
 
 
 def execute_shutdown(time, reboot=True, ask=True):
+    action = "reboot" if reboot else "poweroff"
     if not ask:
-        action = "reboot" if reboot else "poweroff"
-        if not ask_yes_no("Are you sure you want to %s this system?" % action):
+        if not ask_yes_no(f"Are you sure you want to {action} this system?"):
             exit(0)
-
-    action = "-r" if reboot else "-P"
+    action_cmd = "-r" if reboot else "-P"
 
     if len(time) == 0:
         # T870 legacy reboot job support
         chk_vyatta_based_reboots()
         ###
 
-        out = cmd(f'/sbin/shutdown {action} now', stderr=STDOUT)
+        out = cmd(f'/sbin/shutdown {action_cmd} now', stderr=STDOUT)
         print(out.split(",", 1)[0])
         return
     elif len(time) == 1:
         # Assume the argument is just time
         ts = parse_time(time[0])
         if ts:
-            cmd(f'/sbin/shutdown {action} {time[0]}', stderr=STDOUT)
+            cmd(f'/sbin/shutdown {action_cmd} {time[0]}', stderr=STDOUT)
+            # Inform all other logged in users about the reboot/shutdown
+            wall_msg = f'System {action} is scheduled {time[0]}'
+            cmd(f'/usr/bin/wall "{wall_msg}"')
         else:
-            exit("Invalid time \"{0}\". The valid format is HH:MM".format(time[0]))
+            exit(f'Invalid time "{time[0]}". The valid format is HH:MM')
     elif len(time) == 2:
         # Assume it's date and time
         ts = parse_time(time[0])
@@ -131,14 +134,18 @@ def execute_shutdown(time, reboot=True, ask=True):
             t = datetime.combine(ds, ts)
             td = t - datetime.now()
             t2 = 1 + int(td.total_seconds())//60  # Get total minutes
-            cmd('/sbin/shutdown {action} {t2}', stderr=STDOUT)
+
+            cmd(f'/sbin/shutdown {action_cmd} {t2}', stderr=STDOUT)
+            # Inform all other logged in users about the reboot/shutdown
+            wall_msg = f'System {action} is scheduled {time[1]} {time[0]}'
+            cmd(f'/usr/bin/wall "{wall_msg}"')
         else:
             if not ts:
-                exit("Invalid time \"{0}\". The valid format is HH:MM".format(time[0]))
+                exit(f'Invalid time "{time[0]}". The valid format is HH:MM')
             else:
-                exit("Invalid time \"{0}\". A valid format is YYYY-MM-DD [HH:MM]".format(time[1]))
+                exit(f'Invalid date "{time[1]}". A valid format is YYYY-MM-DD [HH:MM]')
     else:
-        exit("Could not decode date and time. Valids formats are HH:MM or YYYY-MM-DD HH:MM")
+        exit('Could not decode date and time. Valids formats are HH:MM or YYYY-MM-DD HH:MM')
     check_shutdown()
 
 
diff --git a/src/op_mode/restart_frr.py b/src/op_mode/restart_frr.py
index d1b66b33f..109c8dd7b 100755
--- a/src/op_mode/restart_frr.py
+++ b/src/op_mode/restart_frr.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019 VyOS maintainers and contributors
+# Copyright (C) 2019-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -13,16 +13,19 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
 
-import sys
+import os
 import argparse
 import logging
-from logging.handlers import SysLogHandler
-from pathlib import Path
 import psutil
 
+from logging.handlers import SysLogHandler
+from shutil import rmtree
+
 from vyos.util import call
+from vyos.util import ask_yes_no
+from vyos.util import process_named_running
+from vyos.util import makedir
 
 # some default values
 watchfrr = '/usr/lib/frr/watchfrr.sh'
@@ -40,40 +43,45 @@ logger.setLevel(logging.INFO)
 def _check_safety():
     try:
         # print warning
-        answer = input("WARNING: This is a potentially unsafe function! You may lose the connection to the router or active configuration after running this command. Use it at your own risk! Continue? [y/N]: ")
-        if not answer.lower() == "y":
-            logger.error("User aborted command")
+        if not ask_yes_no('WARNING: This is a potentially unsafe function!\n' \
+                          'You may lose the connection to the router or active configuration after\n' \
+                          'running this command. Use it at your own risk!\n\n'
+                          'Continue?'):
             return False
 
         # check if another restart process already running
         if len([process for process in psutil.process_iter(attrs=['pid', 'name', 'cmdline']) if 'python' in process.info['name'] and 'restart_frr.py' in process.info['cmdline'][1]]) > 1:
-            logger.error("Another restart_frr.py already running")
-            answer = input("Another restart_frr.py process is already running. It is unsafe to continue. Do you want to process anyway? [y/N]: ")
-            if not answer.lower() == "y":
+            message = 'Another restart_frr.py process is already running!'
+            logger.error(message)
+            if not ask_yes_no(f'\n{message} It is unsafe to continue.\n\n' \
+                              'Do you want to process anyway?'):
                 return False
 
         # check if watchfrr.sh is running
-        for process in psutil.process_iter(attrs=['pid', 'name', 'cmdline']):
-            if 'bash' in process.info['name'] and watchfrr in process.info['cmdline']:
-                logger.error("Another {} already running".format(watchfrr))
-                answer = input("Another {} process is already running. It is unsafe to continue. Do you want to process anyway? [y/N]: ".format(watchfrr))
-                if not answer.lower() == "y":
-                    return False
+        tmp = os.path.basename(watchfrr)
+        if process_named_running(tmp):
+            message = f'Another {tmp} process is already running.'
+            logger.error(message)
+            if not ask_yes_no(f'{message} It is unsafe to continue.\n\n' \
+                              'Do you want to process anyway?'):
+                return False
 
         # check if vtysh is running
-        for process in psutil.process_iter(attrs=['pid', 'name', 'cmdline']):
-            if 'vtysh' in process.info['name']:
-                logger.error("The vtysh is running by another task")
-                answer = input("The vtysh is running by another task. It is unsafe to continue. Do you want to process anyway? [y/N]: ")
-                if not answer.lower() == "y":
-                    return False
+        if process_named_running('vtysh'):
+            message = 'vtysh process is executed by another task.'
+            logger.error(message)
+            if not ask_yes_no(f'{message} It is unsafe to continue.\n\n' \
+                              'Do you want to process anyway?'):
+                return False
 
         # check if temporary directory exists
-        if Path(frrconfig_tmp).exists():
-            logger.error("The temporary directory \"{}\" already exists".format(frrconfig_tmp))
-            answer = input("The temporary directory \"{}\" already exists. It is unsafe to continue. Do you want to process anyway? [y/N]: ".format(frrconfig_tmp))
-            if not answer.lower() == "y":
+        if os.path.exists(frrconfig_tmp):
+            message = f'Temporary directory "{frrconfig_tmp}" already exists!'
+            logger.error(message)
+            if not ask_yes_no(f'{message} It is unsafe to continue.\n\n' \
+                              'Do you want to process anyway?'):
                 return False
+
     except:
         logger.error("Something goes wrong in _check_safety()")
         return False
@@ -84,94 +92,68 @@ def _check_safety():
 # write active config to file
 def _write_config():
     # create temporary directory
-    Path(frrconfig_tmp).mkdir(parents=False, exist_ok=True)
+    makedir(frrconfig_tmp)
     # save frr.conf to it
-    command = "{} -n -w --config_dir {} 2> /dev/null".format(vtysh, frrconfig_tmp)
+    command = f'{vtysh} -n -w --config_dir {frrconfig_tmp} 2> /dev/null'
     return_code = call(command)
-    if not return_code == 0:
-        logger.error("Failed to save active config: \"{}\" returned exit code: {}".format(command, return_code))
+    if return_code != 0:
+        logger.error(f'Failed to save active config: "{command}" returned exit code: {return_code}')
         return False
-    logger.info("Active config saved to {}".format(frrconfig_tmp))
+    logger.info(f'Active config saved to {frrconfig_tmp}')
     return True
 
 # clear and remove temporary directory
 def _cleanup():
-    tmpdir = Path(frrconfig_tmp)
-    try:
-        if tmpdir.exists():
-            for file in tmpdir.iterdir():
-                file.unlink()
-            tmpdir.rmdir()
-    except:
-        logger.error("Failed to remove temporary directory {}".format(frrconfig_tmp))
-        print("Failed to remove temporary directory {}".format(frrconfig_tmp))
-
-# check if daemon is running
-def _daemon_check(daemon):
-    command = "{} print_status {}".format(watchfrr, daemon)
-    return_code = call(command)
-    if not return_code == 0:
-        logger.error("Daemon \"{}\" is not running".format(daemon))
-        return False
-
-    # return True if all checks were passed
-    return True
+    if os.path.isdir(frrconfig_tmp):
+        rmtree(frrconfig_tmp)
 
 # restart daemon
 def _daemon_restart(daemon):
-    command = "{} restart {}".format(watchfrr, daemon)
+    command = f'{watchfrr} restart {daemon}'
     return_code = call(command)
     if not return_code == 0:
-        logger.error("Failed to restart daemon \"{}\"".format(daemon))
+        logger.error(f'Failed to restart daemon "{daemon}"!')
         return False
 
     # return True if restarted successfully
-    logger.info("Daemon \"{}\" restarted".format(daemon))
+    logger.info(f'Daemon "{daemon}" restarted!')
     return True
 
 # reload old config
 def _reload_config(daemon):
     if daemon != '':
-        command = "{} -n -b --config_dir {} -d {} 2> /dev/null".format(vtysh, frrconfig_tmp, daemon)
+        command = f'{vtysh} -n -b --config_dir {frrconfig_tmp} -d {daemon} 2> /dev/null'
     else:
-        command = "{} -n -b --config_dir {} 2> /dev/null".format(vtysh, frrconfig_tmp)
+        command = f'{vtysh} -n -b --config_dir {frrconfig_tmp} 2> /dev/null'
 
     return_code = call(command)
     if not return_code == 0:
-        logger.error("Failed to reinstall configuration")
+        logger.error('Failed to re-install configuration!')
         return False
 
     # return True if restarted successfully
-    logger.info("Configuration reinstalled successfully")
-    return True
-
-# check all daemons if they are running
-def _check_args_daemon(daemons):
-    for daemon in daemons:
-        if not _daemon_check(daemon):
-            return False
+    logger.info('Configuration re-installed successfully!')
     return True
 
 # define program arguments
 cmd_args_parser = argparse.ArgumentParser(description='restart frr daemons')
 cmd_args_parser.add_argument('--action', choices=['restart'], required=True, help='action to frr daemons')
-cmd_args_parser.add_argument('--daemon', choices=['bfdd', 'bgpd', 'ospfd', 'ospf6d', 'ripd', 'ripngd', 'staticd', 'zebra'], required=False,  nargs='*', help='select single or multiple daemons')
+cmd_args_parser.add_argument('--daemon', choices=['bfdd', 'bgpd', 'ospfd', 'ospf6d', 'isisd', 'ripd', 'ripngd', 'staticd', 'zebra'], required=False,  nargs='*', help='select single or multiple daemons')
 # parse arguments
 cmd_args = cmd_args_parser.parse_args()
 
-
 # main logic
 # restart daemon
 if cmd_args.action == 'restart':
     # check if it is safe to restart FRR
     if not _check_safety():
         print("\nOne of the safety checks was failed or user aborted command. Exiting.")
-        sys.exit(1)
+        exit(1)
 
     if not _write_config():
         print("Failed to save active config")
         _cleanup()
-        sys.exit(1)
+        exit(1)
 
     # a little trick to make further commands more clear
     if not cmd_args.daemon:
@@ -179,19 +161,20 @@ if cmd_args.action == 'restart':
 
     # check all daemons if they are running
     if cmd_args.daemon != ['']:
-        if not _check_args_daemon(cmd_args.daemon):
-            print("Warning: some of listed daemons are not running")
+        for daemon in cmd_args.daemon:
+            if not process_named_running(daemon):
+                print('WARNING: some of listed daemons are not running!')
 
     # run command to restart daemon
     for daemon in cmd_args.daemon:
         if not _daemon_restart(daemon):
-            print("Failed to restart daemon: {}".format(daemon))
+            print('Failed to restart daemon: {daemon}')
             _cleanup()
-            sys.exit(1)
+            exit(1)
         # reinstall old configuration
         _reload_config(daemon)
 
     # cleanup after all actions
     _cleanup()
 
-sys.exit(0)
+exit(0)
diff --git a/src/op_mode/show_dhcp.py b/src/op_mode/show_dhcp.py
index 4df275e04..cd6e8ed43 100755
--- a/src/op_mode/show_dhcp.py
+++ b/src/op_mode/show_dhcp.py
@@ -177,7 +177,7 @@ if __name__ == '__main__':
     group = parser.add_mutually_exclusive_group()
     group.add_argument("-l", "--leases", action="store_true", help="Show DHCP leases")
     group.add_argument("-s", "--statistics", action="store_true", help="Show DHCP statistics")
-    group.add_argument("--allowed", type=str, choices=["pool", "sort", "state"], help="Show allowed values for argument")
+    group.add_argument("--allowed", type=str, choices=["sort", "state"], help="Show allowed values for argument")
 
     parser.add_argument("-p", "--pool", type=str, help="Show lease for specific pool")
     parser.add_argument("-S", "--sort", type=str, default='ip', help="Sort by")
@@ -188,11 +188,7 @@ if __name__ == '__main__':
 
     conf = Config()
 
-    if args.allowed == 'pool':
-        if conf.exists_effective('service dhcp-server'):
-            print(' '.join(conf.list_effective_nodes("service dhcp-server shared-network-name")))
-        exit(0)
-    elif args.allowed == 'sort':
+    if args.allowed == 'sort':
         print(' '.join(lease_display_fields.keys()))
         exit(0)
     elif args.allowed == 'state':
diff --git a/src/op_mode/show_interfaces.py b/src/op_mode/show_interfaces.py
index 20d5d9e17..3d50eb938 100755
--- a/src/op_mode/show_interfaces.py
+++ b/src/op_mode/show_interfaces.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2017, 2019 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2017-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -19,9 +19,7 @@ import os
 import re
 import sys
 import glob
-import datetime
 import argparse
-import netifaces
 
 from vyos.ifconfig import Section
 from vyos.ifconfig import Interface
@@ -63,27 +61,27 @@ def filtered_interfaces(ifnames, iftypes, vif, vrrp):
     ifnames: a list of interfaces names to consider, empty do not filter
     return an instance of the interface class
     """
-    allnames = Section.interfaces()
+    if isinstance(iftypes, list):
+        for iftype in iftypes:
+            yield from filtered_interfaces(ifnames, iftype, vif, vrrp)
 
-    vrrp_interfaces = VRRP.active_interfaces() if vrrp else []
-
-    for ifname in allnames:
+    for ifname in Section.interfaces(iftypes):
+        # Bail out early if interface name not part of our search list
         if ifnames and ifname not in ifnames:
             continue
 
-        # return the class which can handle this interface name
-        klass = Section.klass(ifname)
-        # connect to the interface
-        interface = klass(ifname, create=False, debug=False)
-
-        if iftypes and interface.definition['section'] not in iftypes:
-            continue
+        # As we are only "reading" from the interface - we must use the
+        # generic base class which exposes all the data via a common API
+        interface = Interface(ifname, create=False, debug=False)
 
+        # VLAN interfaces have a '.' in their name by convention
         if vif and not '.' in ifname:
             continue
 
-        if vrrp and ifname not in vrrp_interfaces:
-            continue
+        if vrrp:
+            vrrp_interfaces = VRRP.active_interfaces()
+            if ifname not in vrrp_interfaces:
+                continue
 
         yield interface
 
@@ -120,10 +118,6 @@ def split_text(text, used=0):
     yield line[1:]
 
 
-def get_vrrp_intf():
-    return [intf for intf in Section.interfaces() if intf.is_vrrp()]
-
-
 def get_counter_val(clear, now):
     """
     attempt to correct a counter if it wrapped, copied from perl
diff --git a/src/op_mode/show_ipsec_sa.py b/src/op_mode/show_ipsec_sa.py
index e491267fd..c964caaeb 100755
--- a/src/op_mode/show_ipsec_sa.py
+++ b/src/op_mode/show_ipsec_sa.py
@@ -23,6 +23,12 @@ import hurry.filesize
 
 import vyos.util
 
+def convert(text):
+    return int(text) if text.isdigit() else text.lower()
+
+def alphanum_key(key):
+    return [convert(c) for c in re.split('([0-9]+)', str(key))]
+
 def format_output(conns, sas):
     sa_data = []
 
@@ -111,7 +117,7 @@ if __name__ == '__main__':
 
         headers = ["Connection", "State", "Uptime", "Bytes In/Out", "Packets In/Out", "Remote address", "Remote ID", "Proposal"]
         sa_data = format_output(conns, sas)
-        sa_data = sorted(sa_data, key=lambda peer: peer[0])
+        sa_data = sorted(sa_data, key=alphanum_key)
         output = tabulate.tabulate(sa_data, headers)
         print(output)
     except PermissionError:
diff --git a/src/op_mode/show_nat_rules.py b/src/op_mode/show_nat_rules.py
index 0f40ecabe..d68def26a 100755
--- a/src/op_mode/show_nat_rules.py
+++ b/src/op_mode/show_nat_rules.py
@@ -67,46 +67,54 @@ if args.source or args.destination:
             continue
         interface = dict_search('match.right', data['expr'][0])
         srcdest = ''
-        for i in [1, 2]:
-            srcdest_json = dict_search('match.right', data['expr'][i])
-            if not srcdest_json:
-                continue
-
-            if isinstance(srcdest_json,str):
-                srcdest += srcdest_json + ' '
-            elif 'prefix' in srcdest_json:
-                addr_tmp = dict_search('match.right.prefix.addr', data['expr'][i])
-                len_tmp = dict_search('match.right.prefix.len', data['expr'][i])
-                if addr_tmp and len_tmp:
-                    srcdest = addr_tmp + '/' + str(len_tmp) + ' '
-            elif 'set' in srcdest_json:
-                if isinstance(srcdest_json['set'][0],str):
-                    srcdest += 'port ' + str(srcdest_json['set'][0]) + ' '
-                else:
-                    port_range = srcdest_json['set'][0]['range']
-                    srcdest += 'port ' + str(port_range[0]) + '-' + str(port_range[1]) + ' '
-
+        srcdests = []
         tran_addr = ''
-        tran_addr_json = dict_search('snat.addr' if args.source else 'dnat.addr', data['expr'][3])
-        if tran_addr_json:
-            if isinstance(tran_addr_json,str):
-                tran_addr = tran_addr_json
-            elif 'prefix' in tran_addr_json:
-                addr_tmp = dict_search('snat.addr.prefix.addr' if args.source else 'dnat.addr.prefix.addr', data['expr'][3])
-                len_tmp = dict_search('snat.addr.prefix.len' if args.source else 'dnat.addr.prefix.len', data['expr'][3])
-                if addr_tmp and len_tmp:
-                    tran_addr = addr_tmp + '/' + str(len_tmp)
-        else:
-            if 'masquerade' in data['expr'][3]:
-                tran_addr = 'masquerade'
-            elif 'log' in data['expr'][3]:
-                continue
-
-        tran_port = dict_search('snat.port' if args.source else 'dnat.port', data['expr'][3])
-        if tran_port:
-            tran_addr += ' port ' + str(tran_port)
+        for i in range(1,len(data['expr']) ):
+            srcdest_json = dict_search('match.right', data['expr'][i])
+            if srcdest_json:
+                if isinstance(srcdest_json,str):
+                    if srcdest != '':
+                        srcdests.append(srcdest)
+                        srcdest = ''
+                    srcdest = srcdest_json + ' '
+                elif 'prefix' in srcdest_json:
+                    addr_tmp = dict_search('match.right.prefix.addr', data['expr'][i])
+                    len_tmp = dict_search('match.right.prefix.len', data['expr'][i])
+                    if addr_tmp and len_tmp:
+                        srcdest = addr_tmp + '/' + str(len_tmp) + ' '
+                elif 'set' in srcdest_json:
+                    if isinstance(srcdest_json['set'][0],int):
+                        srcdest += 'port ' + str(srcdest_json['set'][0]) + ' '
+                    else:
+                        port_range = srcdest_json['set'][0]['range']
+                        srcdest += 'port ' + str(port_range[0]) + '-' + str(port_range[1]) + ' '
+            
+            tran_addr_json = dict_search('snat' if args.source else 'dnat', data['expr'][i])
+            if tran_addr_json:
+                if isinstance(tran_addr_json['addr'],str):
+                    tran_addr += tran_addr_json['addr'] + ' '
+                elif 'prefix' in tran_addr_json['addr']:
+                    addr_tmp = dict_search('snat.addr.prefix.addr' if args.source else 'dnat.addr.prefix.addr', data['expr'][3])
+                    len_tmp = dict_search('snat.addr.prefix.len' if args.source else 'dnat.addr.prefix.len', data['expr'][3])
+                    if addr_tmp and len_tmp:
+                        tran_addr += addr_tmp + '/' + str(len_tmp) + ' '
+            
+                if isinstance(tran_addr_json['port'],int):
+                    tran_addr += 'port ' + tran_addr_json['port']
+            
+            else:
+                if 'masquerade' in data['expr'][i]:
+                    tran_addr = 'masquerade'
+                elif 'log' in data['expr'][i]:
+                    continue
 
-        print(format_nat_rule.format(rule, srcdest, tran_addr, interface))
+        if srcdest != '':
+            srcdests.append(srcdest)
+            srcdest = ''
+        print(format_nat_rule.format(rule, srcdests[0], tran_addr, interface))
+        
+        for i in range(1, len(srcdests)):
+            print(format_nat_rule.format(' ', srcdests[i], ' ', ' '))
     
     exit(0)
 else:
diff --git a/src/op_mode/show_system_integrity.py b/src/op_mode/show_system_integrity.py
deleted file mode 100755
index c34d41e80..000000000
--- a/src/op_mode/show_system_integrity.py
+++ /dev/null
@@ -1,70 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2020 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-#
-
-import sys
-import os
-import re
-import json
-from datetime import datetime, timedelta
-
-version_file = r'/usr/share/vyos/version.json'
-
-
-def _get_sys_build_version():
-    if not os.path.exists(version_file):
-        return None
-    buf = open(version_file, 'r').read()
-    j = json.loads(buf)
-    if not 'built_on' in j:
-        return None
-    return datetime.strptime(j['built_on'], '%a %d %b %Y %H:%M %Z')
-
-
-def _check_pkgs(build_stamp):
-    pkg_diffs = {
-        'buildtime': str(build_stamp),
-        'pkg': {}
-    }
-
-    pkg_info = os.listdir('/var/lib/dpkg/info/')
-    for file in pkg_info:
-        if re.search('\.list$', file):
-            fts = os.stat('/var/lib/dpkg/info/' + file).st_mtime
-            dt_str = (datetime.utcfromtimestamp(
-                fts).strftime('%Y-%m-%d %H:%M:%S'))
-            fdt = datetime.strptime(dt_str, '%Y-%m-%d %H:%M:%S')
-            if fdt > build_stamp:
-                pkg_diffs['pkg'].update(
-                    {str(re.sub('\.list', '', file)): str(fdt)})
-
-    if len(pkg_diffs['pkg']) != 0:
-        return pkg_diffs
-    else:
-        return None
-
-
-if __name__ == '__main__':
-    built_date = _get_sys_build_version()
-    if not built_date:
-        sys.exit(1)
-    pkgs = _check_pkgs(built_date)
-    if pkgs:
-        print (
-            "The following packages don\'t fit the image creation time\nbuild time:\t" + pkgs['buildtime'])
-        for k, v in pkgs['pkg'].items():
-            print ("installed: " + v + '\t' + k)
diff --git a/src/op_mode/show_version.py b/src/op_mode/show_version.py
index 5bbc2e1f1..7962e1e7b 100755
--- a/src/op_mode/show_version.py
+++ b/src/op_mode/show_version.py
@@ -32,12 +32,12 @@ parser.add_argument("-j", "--json", action="store_true", help="Produce JSON outp
 
 version_output_tmpl = """
 Version:          VyOS {{version}}
-Release Train:    {{release_train}}
+Release train:    {{release_train}}
 
 Built by:         {{built_by}}
 Built on:         {{built_on}}
 Build UUID:       {{build_uuid}}
-Build Commit ID:  {{build_git}}
+Build commit ID:  {{build_git}}
 
 Architecture:     {{system_arch}}
 Boot via:         {{boot_via}}
diff --git a/src/op_mode/show_wwan.py b/src/op_mode/show_wwan.py
index 249dda2a5..529b5bd0f 100755
--- a/src/op_mode/show_wwan.py
+++ b/src/op_mode/show_wwan.py
@@ -34,13 +34,17 @@ required = parser.add_argument_group('Required arguments')
 required.add_argument("--interface", help="WWAN interface name, e.g. wwan0", required=True)
 
 def qmi_cmd(device, command, silent=False):
-    tmp = cmd(f'qmicli --device={device} --device-open-proxy {command}')
-    tmp = tmp.replace(f'[{cdc}] ', '')
-    if not silent:
-        # skip first line as this only holds the info headline
-        for line in tmp.splitlines()[1:]:
-            print(line.lstrip())
-    return tmp
+    try:
+        tmp = cmd(f'qmicli --device={device} --device-open-proxy {command}')
+        tmp = tmp.replace(f'[{cdc}] ', '')
+        if not silent:
+            # skip first line as this only holds the info headline
+            for line in tmp.splitlines()[1:]:
+                print(line.lstrip())
+        return tmp
+    except:
+        print('Command not supported by Modem')
+        exit(1)
 
 if __name__ == '__main__':
     args = parser.parse_args()
diff --git a/src/op_mode/wireguard_client.py b/src/op_mode/wireguard_client.py
index 7661254da..76c1ff7d1 100755
--- a/src/op_mode/wireguard_client.py
+++ b/src/op_mode/wireguard_client.py
@@ -39,10 +39,11 @@ To enable this configuration on a VyOS router you can use the following commands
 set interfaces wireguard {{ interface }} peer {{ name }} allowed-ips '{{ addr }}'
 {% endfor %}
 set interfaces wireguard {{ interface }} peer {{ name }} public-key '{{ pubkey }}'
+
+=== RoadWarrior (client) configuration ===
 """
 
 client_config = """
-=== RoadWarrior (client) configuration ===
 
 [Interface]
 PrivateKey = {{ privkey }}