(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'sshd_config match'>)}
          spids: [7]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:pidfile)
          op: assign_op.Equal
          rhs: {($ Id.VSub_DollarName '$OBJ') <'/remote_pid'>}
          spids: [13]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:fwdport)
          op: assign_op.Equal
          rhs: {<3301>}
          spids: [17]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:fwd)
          op: assign_op.Equal
          rhs: 
            {
              (DQ <'-L '> ($ Id.VSub_DollarName '$fwdport') <':127.0.0.1:'> 
                ($ Id.VSub_DollarName '$PORT')
              )
            }
          spids: [20]
        )
      ]
    )
    (command.Simple
      words: [{<echo>} {(DQ <'ExitOnForwardFailure=yes'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'ExitOnForwardFailure=yes'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ShFunction
      name: start_client
      body: 
        (BraceGroup
          children: [
            (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$pidfile')})
            (command.Sentence
              child: 
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSH)}
                    {<-q>}
                    {<-> ($ Id.VSub_DollarName '$p')}
                    {($ Id.VSub_DollarName '$fwd')}
                    {(DQ ($ Id.VSub_At '$@'))}
                    {<somehost>}
                    {<exec>}
                    {<sh>}
                    {<-c>}
                    {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>) 
                      (DQ <'echo '> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\$'>) 
                        (word_part.EscapedLiteral
                          token: <Id.Lit_EscapedChar '\\$'>
                        ) <' > '> ($ Id.VSub_DollarName '$pidfile') <'; exec sleep 100'>
                      ) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>)
                    }
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_DGreat '>>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {($ Id.VSub_DollarName '$TEST_REGRESS_LOGFILE')}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
              terminator: <Id.Op_Amp _>
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:client_pid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Bang '$!')}
                  spids: [113]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:n)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [121]
                )
              ]
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: (C {<test>} {<Id.KW_Bang '!'>} {<-f>} {($ Id.VSub_DollarName '$pidfile')})
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              body: 
                (command.DoGroup
                  children: [
                    (C {<sleep>} {<1>})
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:n)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                child: 
                                  (C {<expr>} {($ Id.VSub_DollarName '$n')} {<Id.Lit_Other '+'>} {<1>})
                              )
                            }
                          spids: [145]
                        )
                      ]
                    )
                    (command.If
                      arms: [
                        (if_arm
                          cond: 
                            (condition.Shell
                              commands: [
                                (command.Sentence
                                  child: (C {<test>} {($ Id.VSub_DollarName '$n')} {<-gt>} {<60>})
                                  terminator: <Id.Op_Semi _>
                                )
                              ]
                            )
                          action: [
                            (C {<kill>} {($ Id.VSub_DollarName '$client_pid')})
                            (C {<fatal>} {(DQ <'timeout waiting for background ssh'>)})
                          ]
                          spids: [159 170]
                        )
                      ]
                    )
                  ]
                )
            )
          ]
        )
    )
    (command.ShFunction
      name: stop_client
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:pid)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        child: (C {<cat>} {($ Id.VSub_DollarName '$pidfile')})
                      )
                    }
                  spids: [201]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<Id.Lit_LBracket '['>} {<Id.KW_Bang '!'>} {<-z>} 
                              {(DQ ($ Id.VSub_DollarName '$pid'))} {<Id.Lit_RBracket ']'>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [(C {<kill>} {($ Id.VSub_DollarName '$pid')})]
                  spids: [211 226]
                )
              ]
            )
            (C {<wait>})
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>}
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:1'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_config'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match Address 127.0.0.1'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_config'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:'> ($ Id.VSub_DollarName '$PORT'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_config'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<grep>} {<-v>} {<AuthorizedKeysFile>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>}]
      redirects: [
        (redir
          op: <Id.Redir_Great '>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'AuthorizedKeysFile /dev/null'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:1'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match user '> ($ Id.VSub_DollarName '$USER'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [
        {<echo>}
        {(DQ <'AuthorizedKeysFile /dev/null '> ($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_%u'>)}
      ]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match Address 127.0.0.1'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:'> ($ Id.VSub_DollarName '$PORT'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (C {<start_sshd>})
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'match permitopen localhost proto '> ($ Id.VSub_DollarName '$p'))})
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>})
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} {(DQ <'match permitopen permit proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'match permitopen proxy proto '> ($ Id.VSub_DollarName '$p'))})
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>})
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} {(DQ <'match permitopen deny proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
    (C {<cp>} {<'/dev/null'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> ($ Id.VSub_DollarName '$USER')}
    )
    (command.ForEach
      iter_name: t
      iter_words: [{(${ Id.VSub_Name SSH_KEYTYPES)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.Simple
              words: [
                {<printf>}
                {(SQ <'permitopen="127.0.0.1:'>) ($ Id.VSub_DollarName '$PORT') (SQ <'" '>)}
              ]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
            (command.Simple
              words: [{<cat>} {($ Id.VSub_DollarName '$OBJ') <'/'> ($ Id.VSub_DollarName '$t') <.pub>}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
          ]
        )
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'match permitopen proxy w/key opts proto '> ($ Id.VSub_DollarName '$p'))})
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>})
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} 
                  {(DQ <'match permitopen deny w/key opt proto '> ($ Id.VSub_DollarName '$p'))}
                )
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'match permitopen localhost proto '> ($ Id.VSub_DollarName '$p'))})
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>})
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} {(DQ <'match permitopen permit proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
    )
    (command.Simple
      words: [
        {<echo>}
        {(DQ <'PermitOpen 127.0.0.1:1 127.0.0.1:'> ($ Id.VSub_DollarName '$PORT') <' 127.0.0.2:2'>)}
      ]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match User '> ($ Id.VSub_DollarName '$USER'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:1 127.0.0.1:2'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'match permitopen proxy w/key opts proto '> ($ Id.VSub_DollarName '$p'))})
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>})
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} {(DQ <'match override permitopen proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
    )
    (command.Simple
      words: [
        {<echo>}
        {(DQ <'PermitOpen 127.0.0.1:1 127.0.0.1:'> ($ Id.VSub_DollarName '$PORT') <' 127.0.0.2:2'>)}
      ]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match User NoSuchUser'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'PermitOpen 127.0.0.1:1 127.0.0.1:2'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} 
              {(DQ <'nomatch permitopen proxy w/key opts proto '> ($ Id.VSub_DollarName '$p'))}
            )
            (C {<start_client>} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>})
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-q>} {<-> ($ Id.VSub_DollarName '$p')} {<-p>} 
                  {($ Id.VSub_DollarName '$fwdport')} {<-F>} {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>} {<somehost>} {<true>}
                )
                (C {<fail>} {(DQ <'nomatch override permitopen proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
            (C {<stop_client>})
          ]
        )
    )
  ]
)