Description of problem:
The new /usr/bin/firewall-cmd cmdline hasn't a '--delete' option for deleting firewall rules, however, the iptablesCommandNew() only sets 'action' as "--insert" or "--delete" in src/util/viriptables.c.

Version-Release number of selected component (if applicable):
# rpm -q libvirt firewalld kernel
libvirt-1.1.1-25.el7.x86_64
firewalld-0.3.9-6.el7.noarch
kernel-3.10.0-86.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. # tail -2 /etc/libvirt/libvirtd.conf
log_outputs="1:file:/tmp/libvirtd.log"
log_filters="3:remote 4:event 1:libvirt 1:conf"

2. # service libvirtd restart

3. # grep firewall-cmd /tmp/libvirtd.log | head -1

Actual results:
# grep firewall-cmd /tmp/libvirtd.log | head -1
2014-02-27 10:57:45.070+0000: 12036: error : virCommandWait:2399 : internal error: Child process (/usr/bin/firewall-cmd --direct --passthrough ipv4 --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp '!' --destination 192.168.122.0/24 --jump MASQUERADE --to-ports 1024-65535) unexpected exit status 2: usage: see firewall-cmd man page

Expected results:
Fix it.

Additional info:

# firewall-cmd -h|grep -E '(delete|remove)'
  --delete-zone=<zone> Delete an existing zone [P only]
  --delete-icmptype=<icmptype>
  --delete-service=<service>
  --remove-service=<service>
  --remove-port=<portid>[-<portid>]/<protocol>
  --remove-icmp-block=<icmptype>
  --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
  --remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]
  --remove-rich-rule=<rule>
  --remove-interface=<interface>
  --remove-source=<source>[/<mask>]
  --remove-chain {ipv4|ipv6|eb} <table> <chain>
  --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
  --remove-rules {ipv4|ipv6|eb} <table> <chain>
  --remove-passthrough {ipv4|ipv6|eb} <arg>...
  --remove-lockdown-whitelist-command=<command>
  --remove-lockdown-whitelist-context=<context>
  --remove-lockdown-whitelist-uid=<uid>
  --remove-lockdown-whitelist-user=<user>


# pwd
/root/rpmbuild/BUILD/libvirt-1.1.1

[root@rhel7 libvirt-1.1.1]# grep -A 20 "iptablesCommandNew(const" ./src/util/viriptables.c
iptablesCommandNew(const char *table, const char *chain, int family, int action)
{
    virCommandPtr cmd = NULL;
#if HAVE_FIREWALLD
    virIpTablesInitialize();
    if (firewall_cmd_path) {
        cmd = virCommandNew(firewall_cmd_path);
        virCommandAddArgList(cmd, "--direct", "--passthrough",
                             (family == AF_INET6) ? "ipv6" : "ipv4", NULL);
    }
#endif

    if (cmd == NULL) {
        cmd = virCommandNew((family == AF_INET6)
                        ? IP6TABLES_PATH : IPTABLES_PATH);
    }

    virCommandAddArgList(cmd, "--table", table,
                         action == ADD ? "--insert" : "--delete",
                         chain, NULL);
    return cmd;
}

NOTE: if the 'action' isn't ADD(or it's REMOVE), the 'action' will be '--delete', which is not a option for latest firewall-cmd command.