(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'sshd control of local and remote forwarding'>)}
          spids: [7]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:LFWD_PORT)
          op: assign_op.Equal
          rhs: {<3320>}
          spids: [13]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:RFWD_PORT)
          op: assign_op.Equal
          rhs: {<3321>}
          spids: [16]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:CTL)
          op: assign_op.Equal
          rhs: {($ Id.VSub_DollarName '$OBJ') </ctl-sock>}
          spids: [19]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:READY)
          op: assign_op.Equal
          rhs: {($ Id.VSub_DollarName '$OBJ') </ready>}
          spids: [23]
        )
      ]
    )
    (command.ShFunction
      name: wait_for_file_to_appear
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_path)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [35]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_n)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [39]
                )
              ]
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: [
                (command.Sentence
                  child: (C {<test>} {<Id.KW_Bang '!'>} {<-f>} {($ Id.VSub_DollarName '$_path')})
                  terminator: <Id.Op_Semi _>
                )
              ]
              body: 
                (command.DoGroup
                  children: [
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-eq>} {<1>})
                        (C {<trace>} 
                          {(DQ <'waiting for '> ($ Id.VSub_DollarName '$_path') <' to appear'>)}
                        )
                      ]
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_n)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                command_list: 
                                  (command.CommandList
                                    children: [
                                      (C {<expr>} {($ Id.VSub_DollarName '$_n')} {<Id.Lit_Other '+'>} 
                                        {<1>}
                                      )
                                    ]
                                  )
                              )
                            }
                          spids: [77]
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-ge>} {<20>})
                        (command.ControlFlow
                          token: <Id.ControlFlow_Return return>
                          arg_word: {<1>}
                        )
                      ]
                    )
                    (C {<sleep>} {<1>})
                  ]
                )
            )
            (command.ControlFlow token:<Id.ControlFlow_Return return> arg_word:{<0>})
          ]
        )
    )
    (command.ShFunction
      name: wait_for_process_to_exit
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_pid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [128]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_n)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [132]
                )
              ]
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: [
                (command.Sentence
                  child: 
                    (command.Simple
                      words: [{<kill>} {<-0>} {($ Id.VSub_DollarName '$_pid')}]
                      redirects: [(redir.Redir op:<Id.Redir_Great '2>'> fd:2 arg_word:{</dev/null>})]
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
              body: 
                (command.DoGroup
                  children: [
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-eq>} {<1>})
                        (C {<trace>} {(DQ <'waiting for '> ($ Id.VSub_DollarName '$_pid') <' to exit'>)})
                      ]
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_n)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                command_list: 
                                  (command.CommandList
                                    children: [
                                      (C {<expr>} {($ Id.VSub_DollarName '$_n')} {<Id.Lit_Other '+'>} 
                                        {<1>}
                                      )
                                    ]
                                  )
                              )
                            }
                          spids: [171]
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-ge>} {<20>})
                        (command.ControlFlow
                          token: <Id.ControlFlow_Return return>
                          arg_word: {<1>}
                        )
                      ]
                    )
                    (C {<sleep>} {<1>})
                  ]
                )
            )
            (command.ControlFlow token:<Id.ControlFlow_Return return> arg_word:{<0>})
          ]
        )
    )
    (command.ShFunction
      name: check_lfwd
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_proto)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [225]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_expected)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [229]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_message)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [233]
                )
              ]
            )
            (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$READY')})
            (command.Sentence
              child: 
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSH)}
                    {<-oProtocol> <Id.Lit_Equals '='> ($ Id.VSub_DollarName '$_proto')}
                    {<-F>}
                    {($ Id.VSub_DollarName '$OBJ') </ssh_proxy>}
                    {<-L> ($ Id.VSub_DollarName '$LFWD_PORT') <Id.Lit_Other ':'> <127.0.0.1> 
                      <Id.Lit_Other ':'> ($ Id.VSub_DollarName '$PORT')
                    }
                    {<-o>}
                    {<Id.Lit_VarLike 'ExitOnForwardFailure='> <yes>}
                    {<-n>}
                    {<host>}
                    {<exec>}
                    {<sh>}
                    {<-c>}
                    {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar "\\'">) 
                      (DQ <'sleep 60 & echo '> 
                        (word_part.EscapedLiteral
                          token: <Id.Lit_EscapedChar '\\$'>
                        ) <'! > '> ($ Id.VSub_DollarName '$READY') <' ; wait '>
                      ) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar "\\'">)
                    }
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
                  ]
                )
              terminator: <Id.Op_Amp _>
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_sshpid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Bang '$!')}
                  spids: [306]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {<wait_for_file_to_appear>} {($ Id.VSub_DollarName '$READY')})
                (C {<fatal>} {(DQ <'check_lfwd ssh fail: '> ($ Id.VSub_DollarName '$_message'))})
              ]
            )
            (command.Simple
              words: [
                {(${ Id.VSub_Name SSH)}
                {<-F>}
                {($ Id.VSub_DollarName '$OBJ') </ssh_config>}
                {<-p>}
                {($ Id.VSub_DollarName '$LFWD_PORT')}
                {<-oConnectionAttempts> <Id.Lit_Equals '='> <4>}
                {<host>}
                {<true>}
              ]
              redirects: [
                (redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})
                (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [356]
                )
              ]
            )
            (command.Simple
              words: [
                {<kill>}
                {($ Id.VSub_DollarName '$_sshpid')}
                {
                  (command_sub
                    left_token: <Id.Left_Backtick '`'>
                    command_list: 
                      (command.CommandList
                        children: [(C {<cat>} {($ Id.VSub_DollarName '$READY')})]
                      )
                  )
                }
              ]
              redirects: [(redir.Redir op:<Id.Redir_Great '2>'> fd:2 arg_word:{</dev/null>})]
            )
            (C {<wait_for_process_to_exit>} {($ Id.VSub_DollarName '$_sshpid')})
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.Lit_Equals '='>} 
                          {(DQ <xY>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-ne>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_lfwd failed (expecting success): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [381 406]
                )
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.Lit_Equals '='>} 
                          {(DQ <xN>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_lfwd succeeded (expecting failure): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [417 442]
                )
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                          {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} 
                          {(DQ <xN>)}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'check_lfwd invalid argument '> 
                          (word_part.EscapedLiteral
                            token: <Id.Lit_EscapedChar '\\"'>
                          ) ($ Id.VSub_DollarName '$_expected') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [453 485]
                )
              ]
              else_action: [
                (C {<verbose>} 
                  {
                    (DQ <'check_lfwd done (expecting '> ($ Id.VSub_DollarName '$_expected') <'): '> 
                      ($ Id.VSub_DollarName '$_message')
                    )
                  }
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: check_rfwd
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_proto)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [526]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_expected)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [530]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_message)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [534]
                )
              ]
            )
            (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$READY')})
            (command.Sentence
              child: 
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSH)}
                    {<-oProtocol> <Id.Lit_Equals '='> ($ Id.VSub_DollarName '$_proto')}
                    {<-F>}
                    {($ Id.VSub_DollarName '$OBJ') </ssh_proxy>}
                    {<-R> ($ Id.VSub_DollarName '$RFWD_PORT') <Id.Lit_Other ':'> <127.0.0.1> 
                      <Id.Lit_Other ':'> ($ Id.VSub_DollarName '$PORT')
                    }
                    {<-o>}
                    {<Id.Lit_VarLike 'ExitOnForwardFailure='> <yes>}
                    {<-n>}
                    {<host>}
                    {<exec>}
                    {<sh>}
                    {<-c>}
                    {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar "\\'">) 
                      (DQ <'sleep 60 & echo '> 
                        (word_part.EscapedLiteral
                          token: <Id.Lit_EscapedChar '\\$'>
                        ) <'! > '> ($ Id.VSub_DollarName '$READY') <' ; wait '>
                      ) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar "\\'">)
                    }
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
                  ]
                )
              terminator: <Id.Op_Amp _>
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_sshpid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Bang '$!')}
                  spids: [607]
                )
              ]
            )
            (C {<wait_for_file_to_appear>} {($ Id.VSub_DollarName '$READY')})
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [616]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: (C {<test>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>})
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (command.Simple
                      words: [
                        {(${ Id.VSub_Name SSH)}
                        {<-F>}
                        {($ Id.VSub_DollarName '$OBJ') </ssh_config>}
                        {<-p>}
                        {($ Id.VSub_DollarName '$RFWD_PORT')}
                        {<-oConnectionAttempts> <Id.Lit_Equals '='> <4>}
                        {<host>}
                        {<true>}
                      ]
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {</dev/null>}
                        )
                        (redir.Redir
                          op: <Id.Redir_GreatAnd '2>&'>
                          fd: 2
                          arg_word: {<1>}
                        )
                      ]
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_result)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_QMark '$?')}
                          spids: [665]
                        )
                      ]
                    )
                    (command.Simple
                      words: [
                        {<kill>}
                        {($ Id.VSub_DollarName '$_sshpid')}
                        {
                          (command_sub
                            left_token: <Id.Left_Backtick '`'>
                            command_list: 
                              (command.CommandList
                                children: [(C {<cat>} {($ Id.VSub_DollarName '$READY')})]
                              )
                          )
                        }
                      ]
                      redirects: [(redir.Redir op:<Id.Redir_Great '2>'> fd:2 arg_word:{</dev/null>})]
                    )
                    (C {<wait_for_process_to_exit>} {($ Id.VSub_DollarName '$_sshpid')})
                  ]
                  spids: [620 632]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.Lit_Equals '='>} 
                          {(DQ <xY>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-ne>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_rfwd failed (expecting success): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [693 718]
                )
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.Lit_Equals '='>} 
                          {(DQ <xN>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_rfwd succeeded (expecting failure): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [729 754]
                )
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                          {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} 
                          {(DQ <xN>)}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'check_rfwd invalid argument '> 
                          (word_part.EscapedLiteral
                            token: <Id.Lit_EscapedChar '\\"'>
                          ) ($ Id.VSub_DollarName '$_expected') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [765 797]
                )
              ]
              else_action: [
                (C {<verbose>} 
                  {
                    (DQ <'check_rfwd done (expecting '> ($ Id.VSub_DollarName '$_expected') <'): '> 
                      ($ Id.VSub_DollarName '$_message')
                    )
                  }
                )
              ]
            )
          ]
        )
    )
    (C {<start_sshd>})
    (C {<cp>} {(${ Id.VSub_Name OBJ) </sshd_proxy>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
    (C {<cp>} {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER)} 
      {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER) <.bak>}
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<check_lfwd>} {($ Id.VSub_DollarName '$p')} {<Y>} 
              {(DQ <'proto '> ($ Id.VSub_DollarName '$p') <', default configuration'>)}
            )
            (C {<check_rfwd>} {($ Id.VSub_DollarName '$p')} {<Y>} 
              {(DQ <'proto '> ($ Id.VSub_DollarName '$p') <', default configuration'>)}
            )
          ]
        )
    )
    (command.ShFunction
      name: all_tests
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_tcpfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [918]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_plain_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [922]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_plain_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [926]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_nopermit_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [930]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_nopermit_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$5')}
                  spids: [934]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_permit_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$6')}
                  spids: [938]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_permit_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$7')}
                  spids: [942]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_badfwd)
                  op: assign_op.Equal
                  rhs: {<127.0.0.1> <Id.Lit_Other ':'> <22>}
                  spids: [946]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_goodfwd)
                  op: assign_op.Equal
                  rhs: {<127.0.0.1> <Id.Lit_Other ':'> (${ Id.VSub_Name PORT)}
                  spids: [952]
                )
              ]
            )
            (command.ForEach
              iter_name: _proto
              iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<cp>} {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER) <.bak>} 
                      {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER)}
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_prefix)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (DQ <'proto '> ($ Id.VSub_DollarName '$_proto') <', AllowTcpForwarding='> 
                                ($ Id.VSub_DollarName '$_tcpfwd')
                              )
                            }
                          spids: [997]
                        )
                      ]
                    )
                    (command.Subshell
                      command_list: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {(${ Id.VSub_Name OBJ) </sshd_proxy>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_plain_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix'))}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_plain_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix'))}
                    )
                    (command.Subshell
                      command_list: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
                              terminator: <Id.Op_Semi _>
                            )
                            (command.Sentence
                              child: 
                                (C {<echo>} 
                                  {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))}
                                )
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'PermitOpen '> ($ Id.VSub_DollarName '$_badfwd'))})
                          ]
                        )
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {(${ Id.VSub_Name OBJ) </sshd_proxy>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !PermitOpen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !PermitOpen'>)}
                    )
                    (command.Subshell
                      command_list: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
                              terminator: <Id.Op_Semi _>
                            )
                            (command.Sentence
                              child: 
                                (C {<echo>} 
                                  {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))}
                                )
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} 
                              {
                                (DQ <'PermitOpen '> ($ Id.VSub_DollarName '$_badfwd') <' '> 
                                  ($ Id.VSub_DollarName '$_goodfwd')
                                )
                              }
                            )
                          ]
                        )
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {(${ Id.VSub_Name OBJ) </sshd_proxy>}
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DPipe]
                      children: [
                        (command.Simple
                          words: [
                            {<sed>}
                            {
                              (DQ <'s/^/permitopen='> 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) ($ Id.VSub_DollarName '$_badfwd') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) <' /'>
                              )
                            }
                          ]
                          redirects: [
                            (redir.Redir
                              op: <Id.Redir_Less '<'>
                              fd: -1
                              arg_word: 
                                {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER) 
                                  <.bak>
                                }
                            )
                            (redir.Redir
                              op: <Id.Redir_Great '>'>
                              fd: -1
                              arg_word: 
                                {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER)}
                            )
                          ]
                        )
                        (C {<fatal>} {(DQ <'sed 1 fail'>)})
                      ]
                    )
                    (command.Subshell
                      command_list: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {(${ Id.VSub_Name OBJ) </sshd_proxy>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !permitopen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !permitopen'>)}
                    )
                    (command.AndOr
                      ops: [Id.Op_DPipe]
                      children: [
                        (command.Simple
                          words: [
                            {<sed>}
                            {
                              (DQ <'s/^/permitopen='> 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) ($ Id.VSub_DollarName '$_badfwd') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) 
                                <',permitopen='> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ($ Id.VSub_DollarName '$_goodfwd') 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) <' /'>
                              )
                            }
                          ]
                          redirects: [
                            (redir.Redir
                              op: <Id.Redir_Less '<'>
                              fd: -1
                              arg_word: 
                                {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER) 
                                  <.bak>
                                }
                            )
                            (redir.Redir
                              op: <Id.Redir_Great '>'>
                              fd: -1
                              arg_word: 
                                {(${ Id.VSub_Name OBJ) </authorized_keys_> (${ Id.VSub_Name USER)}
                            )
                          ]
                        )
                        (C {<fatal>} {(DQ <'sed 2 fail'>)})
                      ]
                    )
                    (command.Subshell
                      command_list: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) </sshd_proxy.bak>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir.Redir
                          op: <Id.Redir_Great '>'>
                          fd: -1
                          arg_word: {(${ Id.VSub_Name OBJ) </sshd_proxy>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_permit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', permitopen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_permit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', permitopen'>)}
                    )
                  ]
                )
            )
          ]
        )
    )
    (C {<all_tests>} {<yes>} {<Y>} {<Y>} {<N>} {<Y>} {<Y>} {<Y>})
    (C {<all_tests>} {<local>} {<Y>} {<N>} {<N>} {<N>} {<Y>} {<N>})
    (C {<all_tests>} {<remote>} {<N>} {<Y>} {<N>} {<Y>} {<N>} {<Y>})
    (C {<all_tests>} {<no>} {<N>} {<N>} {<N>} {<N>} {<N>} {<N>})
  ]
)