# bash completion for dfw
# shellcheck shell=bash
_dfw() {
	local cur=${COMP_WORDS[COMP_CWORD]}
	if ((COMP_CWORD == 1)); then
		mapfile -t COMPREPLY < <(compgen -W "status allow deny reload help" -- "$cur")
		return
	fi
	case ${COMP_WORDS[1]} in
	deny)
		# The ports opened with dfw
		local ports
		ports=$(sed -n 's/^add element inet das \(tcp\|udp\)_ports { \(.*\) }$/\2 \1/p' /etc/nftables.d/dfw.nft 2>/dev/null |
			awk '{ for (i = 1; i < NF; i++) { p = $i; sub(/,$/, "", p); print p "/" $NF } }')
		mapfile -t COMPREPLY < <(compgen -W "$ports" -- "$cur")
		;;
	allow)
		mapfile -t COMPREPLY < <(compgen -W "http https 80/tcp 443/tcp 53/udp" -- "$cur")
		;;
	esac
}
complete -F _dfw dfw