(CommandList
  children: [
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:tid)
          op: Equal
          rhs: {(DQ ('sshd control of local and remote forwarding'))}
          spids: [7]
        )
      ]
      spids: [7]
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:LFWD_PORT) op:Equal rhs:{(3320)} spids:[13])]
      spids: [13]
    )
    (Assignment
      keyword: Assign_None
      pairs: [(assign_pair lhs:(LhsName name:RFWD_PORT) op:Equal rhs:{(3321)} spids:[16])]
      spids: [16]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:CTL)
          op: Equal
          rhs: {($ VSub_Name '$OBJ') (/ctl-sock)}
          spids: [19]
        )
      ]
      spids: [19]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:READY)
          op: Equal
          rhs: {($ VSub_Name '$OBJ') (/ready)}
          spids: [23]
        )
      ]
      spids: [23]
    )
    (FuncDef
      name: wait_for_file_to_appear
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_path)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [35]
                )
              ]
              spids: [35]
            )
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:_n) op:Equal rhs:{(0)} spids:[39])]
              spids: [39]
            )
            (While
              cond: [
                (Sentence
                  child: (C {(test)} {(KW_Bang '!')} {(-f)} {($ VSub_Name '$_path')})
                  terminator: <Op_Semi ';'>
                )
              ]
              body: 
                (DoGroup
                  children: [
                    (AndOr
                      children: [
                        (C {(test)} {($ VSub_Name '$_n')} {(-eq)} {(1)})
                        (C {(trace)} {(DQ ('waiting for ') ($ VSub_Name '$_path') (' to appear'))})
                      ]
                      op_id: Op_DAmp
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:_n)
                          op: Equal
                          rhs: 
                            {
                              (CommandSubPart
                                command_list: 
                                  (CommandList
                                    children: [
                                      (C {(expr)} {($ VSub_Name '$_n')} {(Lit_Other '+')} {(1)})
                                    ]
                                  )
                                left_token: <Left_Backtick '`'>
                                spids: [78 86]
                              )
                            }
                          spids: [77]
                        )
                      ]
                      spids: [77]
                    )
                    (AndOr
                      children: [
                        (C {(test)} {($ VSub_Name '$_n')} {(-ge)} {(20)})
                        (ControlFlow
                          token: <ControlFlow_Return return>
                          arg_word: {(1)}
                        )
                      ]
                      op_id: Op_DAmp
                    )
                    (C {(sleep)} {(1)})
                  ]
                  spids: [55 109]
                )
            )
            (ControlFlow token:<ControlFlow_Return return> arg_word:{(0)})
          ]
          spids: [32]
        )
      spids: [28 31]
    )
    (FuncDef
      name: wait_for_process_to_exit
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_pid)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [126]
                )
              ]
              spids: [126]
            )
            (Assignment
              keyword: Assign_None
              pairs: [(assign_pair lhs:(LhsName name:_n) op:Equal rhs:{(0)} spids:[130])]
              spids: [130]
            )
            (While
              cond: [
                (Sentence
                  child: 
                    (SimpleCommand
                      words: [{(kill)} {(-0)} {($ VSub_Name '$_pid')}]
                      redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[142])]
                    )
                  terminator: <Op_Semi ';'>
                )
              ]
              body: 
                (DoGroup
                  children: [
                    (AndOr
                      children: [
                        (C {(test)} {($ VSub_Name '$_n')} {(-eq)} {(1)})
                        (C {(trace)} {(DQ ('waiting for ') ($ VSub_Name '$_pid') (' to exit'))})
                      ]
                      op_id: Op_DAmp
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:_n)
                          op: Equal
                          rhs: 
                            {
                              (CommandSubPart
                                command_list: 
                                  (CommandList
                                    children: [
                                      (C {(expr)} {($ VSub_Name '$_n')} {(Lit_Other '+')} {(1)})
                                    ]
                                  )
                                left_token: <Left_Backtick '`'>
                                spids: [170 178]
                              )
                            }
                          spids: [169]
                        )
                      ]
                      spids: [169]
                    )
                    (AndOr
                      children: [
                        (C {(test)} {($ VSub_Name '$_n')} {(-ge)} {(20)})
                        (ControlFlow
                          token: <ControlFlow_Return return>
                          arg_word: {(1)}
                        )
                      ]
                      op_id: Op_DAmp
                    )
                    (C {(sleep)} {(1)})
                  ]
                  spids: [147 201]
                )
            )
            (ControlFlow token:<ControlFlow_Return return> arg_word:{(0)})
          ]
          spids: [123]
        )
      spids: [119 122]
    )
    (FuncDef
      name: check_lfwd
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_proto)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [221]
                )
              ]
              spids: [221]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_expected)
                  op: Equal
                  rhs: {($ VSub_Number '$2')}
                  spids: [225]
                )
              ]
              spids: [225]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_message)
                  op: Equal
                  rhs: {($ VSub_Number '$3')}
                  spids: [229]
                )
              ]
              spids: [229]
            )
            (C {(rm)} {(-f)} {($ VSub_Name '$READY')})
            (Sentence
              child: 
                (SimpleCommand
                  words: [
                    {(${ VSub_Name SSH)}
                    {(-oProtocol) (Lit_Other '=') ($ VSub_Name '$_proto')}
                    {(-F)}
                    {($ VSub_Name '$OBJ') (/ssh_proxy)}
                    {(-L) ($ VSub_Name '$LFWD_PORT') (Lit_Other ':') (127.0.0.1) (Lit_Other ':') 
                      ($ VSub_Name '$PORT')
                    }
                    {(-o)}
                    {(Lit_VarLike 'ExitOnForwardFailure=') (yes)}
                    {(-n)}
                    {(host)}
                    {(exec)}
                    {(sh)}
                    {(-c)}
                    {(EscapedLiteralPart token:<Lit_EscapedChar "\\'">) 
                      (DQ ('sleep 60 & echo ') (EscapedLiteralPart token:<Lit_EscapedChar '\\$'>) 
                        ('! > ') ($ VSub_Name '$READY') (' ; wait ')
                      ) (EscapedLiteralPart token:<Lit_EscapedChar "\\'">)
                    }
                  ]
                  redirects: [
                    (Redir
                      op_id: Redir_Great
                      fd: -1
                      arg_word: {(/dev/null)}
                      spids: [293]
                    )
                    (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[296])
                  ]
                )
              terminator: <Op_Amp '&'>
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_sshpid)
                  op: Equal
                  rhs: {($ VSub_Bang '$!')}
                  spids: [302]
                )
              ]
              spids: [302]
            )
            (AndOr
              children: [
                (C {(wait_for_file_to_appear)} {($ VSub_Name '$READY')})
                (C {(fatal)} {(DQ ('check_lfwd ssh fail: ') ($ VSub_Name '$_message'))})
              ]
              op_id: Op_DPipe
            )
            (SimpleCommand
              words: [
                {(${ VSub_Name SSH)}
                {(-F)}
                {($ VSub_Name '$OBJ') (/ssh_config)}
                {(-p)}
                {($ VSub_Name '$LFWD_PORT')}
                {(-oConnectionAttempts) (Lit_Other '=') (4)}
                {(host)}
                {(true)}
              ]
              redirects: [
                (Redir op_id:Redir_Great fd:-1 arg_word:{(/dev/null)} spids:[345])
                (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[348])
              ]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_result)
                  op: Equal
                  rhs: {($ VSub_QMark '$?')}
                  spids: [352]
                )
              ]
              spids: [352]
            )
            (SimpleCommand
              words: [
                {(kill)}
                {($ VSub_Name '$_sshpid')}
                {
                  (CommandSubPart
                    command_list: (CommandList children:[(C {(cat)} {($ VSub_Name '$READY')})])
                    left_token: <Left_Backtick '`'>
                    spids: [360 364]
                  )
                }
              ]
              redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[366])]
            )
            (C {(wait_for_process_to_exit)} {($ VSub_Name '$_sshpid')})
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} {(Lit_Other '=')} {(DQ (xY))} 
                          {(-a)} {($ VSub_Name '$_result')} {(-ne)} {(0)}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fail)} 
                      {(DQ ('check_lfwd failed (expecting success): ') ($ VSub_Name '$_message'))}
                    )
                  ]
                  spids: [-1 400]
                )
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} {(Lit_Other '=')} {(DQ (xN))} 
                          {(-a)} {($ VSub_Name '$_result')} {(-eq)} {(0)}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fail)} 
                      {(DQ ('check_lfwd succeeded (expecting failure): ') ($ VSub_Name '$_message'))}
                    )
                  ]
                  spids: [411 436]
                )
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} 
                          {(KW_Bang '!') (Lit_Other '=')} {(DQ (xY))} {(-a)} {(DQ (x) ($ VSub_Name '$_expected'))} {(KW_Bang '!') (Lit_Other '=')} {(DQ (xN))}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fatal)} 
                      {
                        (DQ ('check_lfwd invalid argument ') 
                          (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$_expected') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [447 479]
                )
              ]
              else_action: [
                (C {(verbose)} 
                  {
                    (DQ ('check_lfwd done (expecting ') ($ VSub_Name '$_expected') ('): ') 
                      ($ VSub_Name '$_message')
                    )
                  }
                )
              ]
              spids: [492 505]
            )
          ]
          spids: [218]
        )
      spids: [214 217]
    )
    (FuncDef
      name: check_rfwd
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_proto)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [520]
                )
              ]
              spids: [520]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_expected)
                  op: Equal
                  rhs: {($ VSub_Number '$2')}
                  spids: [524]
                )
              ]
              spids: [524]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_message)
                  op: Equal
                  rhs: {($ VSub_Number '$3')}
                  spids: [528]
                )
              ]
              spids: [528]
            )
            (C {(rm)} {(-f)} {($ VSub_Name '$READY')})
            (Sentence
              child: 
                (SimpleCommand
                  words: [
                    {(${ VSub_Name SSH)}
                    {(-oProtocol) (Lit_Other '=') ($ VSub_Name '$_proto')}
                    {(-F)}
                    {($ VSub_Name '$OBJ') (/ssh_proxy)}
                    {(-R) ($ VSub_Name '$RFWD_PORT') (Lit_Other ':') (127.0.0.1) (Lit_Other ':') 
                      ($ VSub_Name '$PORT')
                    }
                    {(-o)}
                    {(Lit_VarLike 'ExitOnForwardFailure=') (yes)}
                    {(-n)}
                    {(host)}
                    {(exec)}
                    {(sh)}
                    {(-c)}
                    {(EscapedLiteralPart token:<Lit_EscapedChar "\\'">) 
                      (DQ ('sleep 60 & echo ') (EscapedLiteralPart token:<Lit_EscapedChar '\\$'>) 
                        ('! > ') ($ VSub_Name '$READY') (' ; wait ')
                      ) (EscapedLiteralPart token:<Lit_EscapedChar "\\'">)
                    }
                  ]
                  redirects: [
                    (Redir
                      op_id: Redir_Great
                      fd: -1
                      arg_word: {(/dev/null)}
                      spids: [592]
                    )
                    (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[595])
                  ]
                )
              terminator: <Op_Amp '&'>
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_sshpid)
                  op: Equal
                  rhs: {($ VSub_Bang '$!')}
                  spids: [601]
                )
              ]
              spids: [601]
            )
            (C {(wait_for_file_to_appear)} {($ VSub_Name '$READY')})
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_result)
                  op: Equal
                  rhs: {($ VSub_QMark '$?')}
                  spids: [610]
                )
              ]
              spids: [610]
            )
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: (C {(test)} {($ VSub_Name '$_result')} {(-eq)} {(0)})
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (SimpleCommand
                      words: [
                        {(${ VSub_Name SSH)}
                        {(-F)}
                        {($ VSub_Name '$OBJ') (/ssh_config)}
                        {(-p)}
                        {($ VSub_Name '$RFWD_PORT')}
                        {(-oConnectionAttempts) (Lit_Other '=') (4)}
                        {(host)}
                        {(true)}
                      ]
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(/dev/null)}
                          spids: [652]
                        )
                        (Redir
                          op_id: Redir_GreatAnd
                          fd: 2
                          arg_word: {(1)}
                          spids: [655]
                        )
                      ]
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:_result)
                          op: Equal
                          rhs: {($ VSub_QMark '$?')}
                          spids: [659]
                        )
                      ]
                      spids: [659]
                    )
                    (SimpleCommand
                      words: [
                        {(kill)}
                        {($ VSub_Name '$_sshpid')}
                        {
                          (CommandSubPart
                            command_list: 
                              (CommandList
                                children: [(C {(cat)} {($ VSub_Name '$READY')})]
                              )
                            left_token: <Left_Backtick '`'>
                            spids: [667 671]
                          )
                        }
                      ]
                      redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[673])]
                    )
                    (C {(wait_for_process_to_exit)} {($ VSub_Name '$_sshpid')})
                  ]
                  spids: [-1 626]
                )
              ]
              spids: [-1 682]
            )
            (If
              arms: [
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} {(Lit_Other '=')} {(DQ (xY))} 
                          {(-a)} {($ VSub_Name '$_result')} {(-ne)} {(0)}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fail)} 
                      {(DQ ('check_rfwd failed (expecting success): ') ($ VSub_Name '$_message'))}
                    )
                  ]
                  spids: [-1 710]
                )
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} {(Lit_Other '=')} {(DQ (xN))} 
                          {(-a)} {($ VSub_Name '$_result')} {(-eq)} {(0)}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fail)} 
                      {(DQ ('check_rfwd succeeded (expecting failure): ') ($ VSub_Name '$_message'))}
                    )
                  ]
                  spids: [721 746]
                )
                (if_arm
                  cond: [
                    (Sentence
                      child: 
                        (C {(test)} {(DQ (x) ($ VSub_Name '$_expected'))} 
                          {(KW_Bang '!') (Lit_Other '=')} {(DQ (xY))} {(-a)} {(DQ (x) ($ VSub_Name '$_expected'))} {(KW_Bang '!') (Lit_Other '=')} {(DQ (xN))}
                        )
                      terminator: <Op_Semi ';'>
                    )
                  ]
                  action: [
                    (C {(fatal)} 
                      {
                        (DQ ('check_rfwd invalid argument ') 
                          (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$_expected') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [757 789]
                )
              ]
              else_action: [
                (C {(verbose)} 
                  {
                    (DQ ('check_rfwd done (expecting ') ($ VSub_Name '$_expected') ('): ') 
                      ($ VSub_Name '$_message')
                    )
                  }
                )
              ]
              spids: [802 815]
            )
          ]
          spids: [517]
        )
      spids: [513 516]
    )
    (C {(start_sshd)})
    (C {(cp)} {(${ VSub_Name OBJ) (/sshd_proxy)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
    (C {(cp)} {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER)} 
      {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER) (.bak)}
    )
    (ForEach
      iter_name: p
      iter_words: [{(${ VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: False
      body: 
        (DoGroup
          children: [
            (C {(check_lfwd)} {($ VSub_Name '$p')} {(Y)} 
              {(DQ ('proto ') ($ VSub_Name '$p') (', default configuration'))}
            )
            (C {(check_rfwd)} {($ VSub_Name '$p')} {(Y)} 
              {(DQ ('proto ') ($ VSub_Name '$p') (', default configuration'))}
            )
          ]
          spids: [869 897]
        )
      spids: [862 867]
    )
    (FuncDef
      name: all_tests
      body: 
        (BraceGroup
          children: [
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_tcpfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$1')}
                  spids: [910]
                )
              ]
              spids: [910]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_plain_lfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$2')}
                  spids: [914]
                )
              ]
              spids: [914]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_plain_rfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$3')}
                  spids: [918]
                )
              ]
              spids: [918]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_nopermit_lfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$4')}
                  spids: [922]
                )
              ]
              spids: [922]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_nopermit_rfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$5')}
                  spids: [926]
                )
              ]
              spids: [926]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_permit_lfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$6')}
                  spids: [930]
                )
              ]
              spids: [930]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_permit_rfwd)
                  op: Equal
                  rhs: {($ VSub_Number '$7')}
                  spids: [934]
                )
              ]
              spids: [934]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_badfwd)
                  op: Equal
                  rhs: {(127.0.0.1) (Lit_Other ':') (22)}
                  spids: [938]
                )
              ]
              spids: [938]
            )
            (Assignment
              keyword: Assign_None
              pairs: [
                (assign_pair
                  lhs: (LhsName name:_goodfwd)
                  op: Equal
                  rhs: {(127.0.0.1) (Lit_Other ':') (${ VSub_Name PORT)}
                  spids: [944]
                )
              ]
              spids: [944]
            )
            (ForEach
              iter_name: _proto
              iter_words: [{(${ VSub_Name SSH_PROTOCOLS)}]
              do_arg_iter: False
              body: 
                (DoGroup
                  children: [
                    (C {(cp)} {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER) (.bak)} 
                      {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER)}
                    )
                    (Assignment
                      keyword: Assign_None
                      pairs: [
                        (assign_pair
                          lhs: (LhsName name:_prefix)
                          op: Equal
                          rhs: 
                            {
                              (DQ ('proto ') ($ VSub_Name '$_proto') (', AllowTcpForwarding=') 
                                ($ VSub_Name '$_tcpfwd')
                              )
                            }
                          spids: [989]
                        )
                      ]
                      spids: [989]
                    )
                    (Subshell
                      child: 
                        (CommandList
                          children: [
                            (Sentence
                              child: (C {(cat)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
                              terminator: <Op_Semi ';'>
                            )
                            (C {(echo)} {(DQ ('AllowTcpForwarding ') ($ VSub_Name '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(${ VSub_Name OBJ) (/sshd_proxy)}
                          spids: [1025]
                        )
                      ]
                      spids: [1002 1021]
                    )
                    (C {(check_lfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_plain_lfwd')} 
                      {(DQ ($ VSub_Name '$_prefix'))}
                    )
                    (C {(check_rfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_plain_rfwd')} 
                      {(DQ ($ VSub_Name '$_prefix'))}
                    )
                    (Subshell
                      child: 
                        (CommandList
                          children: [
                            (Sentence
                              child: (C {(cat)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
                              terminator: <Op_Semi ';'>
                            )
                            (Sentence
                              child: 
                                (C {(echo)} {(DQ ('AllowTcpForwarding ') ($ VSub_Name '$_tcpfwd'))})
                              terminator: <Op_Semi ';'>
                            )
                            (C {(echo)} {(DQ ('PermitOpen ') ($ VSub_Name '$_badfwd'))})
                          ]
                        )
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(${ VSub_Name OBJ) (/sshd_proxy)}
                          spids: [1092]
                        )
                      ]
                      spids: [1059 1088]
                    )
                    (C {(check_lfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_nopermit_lfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', !PermitOpen'))}
                    )
                    (C {(check_rfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_nopermit_rfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', !PermitOpen'))}
                    )
                    (Subshell
                      child: 
                        (CommandList
                          children: [
                            (Sentence
                              child: (C {(cat)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
                              terminator: <Op_Semi ';'>
                            )
                            (Sentence
                              child: 
                                (C {(echo)} {(DQ ('AllowTcpForwarding ') ($ VSub_Name '$_tcpfwd'))})
                              terminator: <Op_Semi ';'>
                            )
                            (C {(echo)} 
                              {
                                (DQ ('PermitOpen ') ($ VSub_Name '$_badfwd') (' ') 
                                  ($ VSub_Name '$_goodfwd')
                                )
                              }
                            )
                          ]
                        )
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(${ VSub_Name OBJ) (/sshd_proxy)}
                          spids: [1163]
                        )
                      ]
                      spids: [1128 1159]
                    )
                    (AndOr
                      children: [
                        (SimpleCommand
                          words: [
                            {(sed)}
                            {
                              (DQ ('s/^/permitopen=') 
                                (EscapedLiteralPart
                                  token: <Lit_EscapedChar '\\"'>
                                ) ($ VSub_Name '$_badfwd') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) (' /')
                              )
                            }
                          ]
                          redirects: [
                            (Redir
                              op_id: Redir_Less
                              fd: -1
                              arg_word: 
                                {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER) (.bak)}
                              spids: [1195]
                            )
                            (Redir
                              op_id: Redir_Great
                              fd: -1
                              arg_word: {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER)}
                              spids: [1208]
                            )
                          ]
                        )
                        (C {(fatal)} {(DQ ('sed 1 fail'))})
                      ]
                      op_id: Op_DPipe
                    )
                    (Subshell
                      child: 
                        (CommandList
                          children: [
                            (Sentence
                              child: (C {(cat)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
                              terminator: <Op_Semi ';'>
                            )
                            (C {(echo)} {(DQ ('AllowTcpForwarding ') ($ VSub_Name '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(${ VSub_Name OBJ) (/sshd_proxy)}
                          spids: [1250]
                        )
                      ]
                      spids: [1227 1246]
                    )
                    (C {(check_lfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_nopermit_lfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', !permitopen'))}
                    )
                    (C {(check_rfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_nopermit_rfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', !permitopen'))}
                    )
                    (AndOr
                      children: [
                        (SimpleCommand
                          words: [
                            {(sed)}
                            {
                              (DQ ('s/^/permitopen=') 
                                (EscapedLiteralPart
                                  token: <Lit_EscapedChar '\\"'>
                                ) ($ VSub_Name '$_badfwd') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) (',permitopen=') 
                                (EscapedLiteralPart
                                  token: <Lit_EscapedChar '\\"'>
                                ) ($ VSub_Name '$_goodfwd') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) (' /')
                              )
                            }
                          ]
                          redirects: [
                            (Redir
                              op_id: Redir_Less
                              fd: -1
                              arg_word: 
                                {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER) (.bak)}
                              spids: [1302]
                            )
                            (Redir
                              op_id: Redir_Great
                              fd: -1
                              arg_word: {(${ VSub_Name OBJ) (/authorized_keys_) (${ VSub_Name USER)}
                              spids: [1315]
                            )
                          ]
                        )
                        (C {(fatal)} {(DQ ('sed 2 fail'))})
                      ]
                      op_id: Op_DPipe
                    )
                    (Subshell
                      child: 
                        (CommandList
                          children: [
                            (Sentence
                              child: (C {(cat)} {(${ VSub_Name OBJ) (/sshd_proxy.bak)})
                              terminator: <Op_Semi ';'>
                            )
                            (C {(echo)} {(DQ ('AllowTcpForwarding ') ($ VSub_Name '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (Redir
                          op_id: Redir_Great
                          fd: -1
                          arg_word: {(${ VSub_Name OBJ) (/sshd_proxy)}
                          spids: [1357]
                        )
                      ]
                      spids: [1334 1353]
                    )
                    (C {(check_lfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_permit_lfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', permitopen'))}
                    )
                    (C {(check_rfwd)} {($ VSub_Name '$_proto')} {($ VSub_Name '$_permit_rfwd')} 
                      {(DQ ($ VSub_Name '$_prefix') (', permitopen'))}
                    )
                  ]
                  spids: [964 1389]
                )
              spids: [957 962]
            )
          ]
          spids: [907]
        )
      spids: [903 906]
    )
    (C {(all_tests)} {(yes)} {(Y)} {(Y)} {(N)} {(Y)} {(Y)} {(Y)})
    (C {(all_tests)} {(Assign_Local local)} {(Y)} {(N)} {(N)} {(N)} {(Y)} {(N)})
    (C {(all_tests)} {(remote)} {(N)} {(Y)} {(N)} {(Y)} {(N)} {(Y)})
    (C {(all_tests)} {(no)} {(N)} {(N)} {(N)} {(N)} {(N)} {(N)})
  ]
)