(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'sshd control of local and remote forwarding'>)}
          spids: [7]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:LFWD_PORT)
          op: assign_op.Equal
          rhs: {<3320>}
          spids: [13]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:RFWD_PORT)
          op: assign_op.Equal
          rhs: {<3321>}
          spids: [16]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:CTL)
          op: assign_op.Equal
          rhs: {($ Id.VSub_DollarName '$OBJ') <'/ctl-sock'>}
          spids: [19]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:READY)
          op: assign_op.Equal
          rhs: {($ Id.VSub_DollarName '$OBJ') <'/ready'>}
          spids: [23]
        )
      ]
    )
    (command.ShFunction
      name: wait_for_file_to_appear
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_path)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [35]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_n)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [39]
                )
              ]
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: (C {<test>} {<Id.KW_Bang '!'>} {<-f>} {($ Id.VSub_DollarName '$_path')})
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              body: 
                (command.DoGroup
                  children: [
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-eq>} {<1>})
                        (C {<trace>} 
                          {(DQ <'waiting for '> ($ Id.VSub_DollarName '$_path') <' to appear'>)}
                        )
                      ]
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_n)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                child: 
                                  (C {<expr>} {($ Id.VSub_DollarName '$_n')} {<Id.Lit_Other '+'>} {<1>})
                              )
                            }
                          spids: [77]
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-ge>} {<20>})
                        (command.ControlFlow
                          token: <Id.ControlFlow_Return return>
                          arg_word: {<1>}
                        )
                      ]
                    )
                    (C {<sleep>} {<1>})
                  ]
                )
            )
            (command.ControlFlow token:<Id.ControlFlow_Return return> arg_word:{<0>})
          ]
        )
    )
    (command.ShFunction
      name: wait_for_process_to_exit
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_pid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [128]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_n)
                  op: assign_op.Equal
                  rhs: {<0>}
                  spids: [132]
                )
              ]
            )
            (command.WhileUntil
              keyword: <Id.KW_While while>
              cond: 
                (condition.Shell
                  commands: [
                    (command.Sentence
                      child: 
                        (command.Simple
                          words: [{<kill>} {<-0>} {($ Id.VSub_DollarName '$_pid')}]
                          redirects: [
                            (redir
                              op: <Id.Redir_Great '2>'>
                              loc: (redir_loc.Fd fd:2)
                              arg: {<'/dev/null'>}
                            )
                          ]
                          do_fork: T
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                )
              body: 
                (command.DoGroup
                  children: [
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-eq>} {<1>})
                        (C {<trace>} {(DQ <'waiting for '> ($ Id.VSub_DollarName '$_pid') <' to exit'>)})
                      ]
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_n)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (command_sub
                                left_token: <Id.Left_Backtick '`'>
                                child: 
                                  (C {<expr>} {($ Id.VSub_DollarName '$_n')} {<Id.Lit_Other '+'>} {<1>})
                              )
                            }
                          spids: [171]
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DAmp]
                      children: [
                        (C {<test>} {($ Id.VSub_DollarName '$_n')} {<-ge>} {<20>})
                        (command.ControlFlow
                          token: <Id.ControlFlow_Return return>
                          arg_word: {<1>}
                        )
                      ]
                    )
                    (C {<sleep>} {<1>})
                  ]
                )
            )
            (command.ControlFlow token:<Id.ControlFlow_Return return> arg_word:{<0>})
          ]
        )
    )
    (command.ShFunction
      name: check_lfwd
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_proto)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [225]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_expected)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [229]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_message)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [233]
                )
              ]
            )
            (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$READY')})
            (command.Sentence
              child: 
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSH)}
                    {<-oProtocol> <Id.Lit_Equals '='> ($ Id.VSub_DollarName '$_proto')}
                    {<-F>}
                    {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>}
                    {<-L> ($ Id.VSub_DollarName '$LFWD_PORT') <Id.Lit_Colon ':'> <127.0.0.1> 
                      <Id.Lit_Colon ':'> ($ Id.VSub_DollarName '$PORT')
                    }
                    {<-o>}
                    {<Id.Lit_VarLike 'ExitOnForwardFailure='> <yes>}
                    {<-n>}
                    {<host>}
                    {<exec>}
                    {<sh>}
                    {<-c>}
                    {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>) 
                      (DQ <'sleep 60 & echo '> 
                        (word_part.EscapedLiteral
                          token: <Id.Lit_EscapedChar '\\$'>
                        ) <'! > '> ($ Id.VSub_DollarName '$READY') <' ; wait '>
                      ) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>)
                    }
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
              terminator: <Id.Op_Amp _>
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_sshpid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Bang '$!')}
                  spids: [306]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {<wait_for_file_to_appear>} {($ Id.VSub_DollarName '$READY')})
                (C {<fatal>} {(DQ <'check_lfwd ssh fail: '> ($ Id.VSub_DollarName '$_message'))})
              ]
            )
            (command.Simple
              words: [
                {(${ Id.VSub_Name SSH)}
                {<-F>}
                {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>}
                {<-p>}
                {($ Id.VSub_DollarName '$LFWD_PORT')}
                {<-oConnectionAttempts> <Id.Lit_Equals '='> <4>}
                {<host>}
                {<true>}
              ]
              redirects: [
                (redir
                  op: <Id.Redir_Great '>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {<'/dev/null'>}
                )
                (redir op:<Id.Redir_GreatAnd '2>&'> loc:(redir_loc.Fd fd:2) arg:{<1>})
              ]
              do_fork: T
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [356]
                )
              ]
            )
            (command.Simple
              words: [
                {<kill>}
                {($ Id.VSub_DollarName '$_sshpid')}
                {
                  (command_sub
                    left_token: <Id.Left_Backtick '`'>
                    child: (C {<cat>} {($ Id.VSub_DollarName '$READY')})
                  )
                }
              ]
              redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
              do_fork: T
            )
            (C {<wait_for_process_to_exit>} {($ Id.VSub_DollarName '$_sshpid')})
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-ne>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_lfwd failed (expecting success): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [381 406]
                )
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xN>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_lfwd succeeded (expecting failure): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [417 442]
                )
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} 
                              {(DQ <xN>)}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'check_lfwd invalid argument '> 
                          (word_part.EscapedLiteral
                            token: <Id.Lit_EscapedChar '\\"'>
                          ) ($ Id.VSub_DollarName '$_expected') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [453 485]
                )
              ]
              else_action: [
                (C {<verbose>} 
                  {
                    (DQ <'check_lfwd done (expecting '> ($ Id.VSub_DollarName '$_expected') <'): '> 
                      ($ Id.VSub_DollarName '$_message')
                    )
                  }
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: check_rfwd
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_proto)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [526]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_expected)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [530]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_message)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [534]
                )
              ]
            )
            (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$READY')})
            (command.Sentence
              child: 
                (command.Simple
                  words: [
                    {(${ Id.VSub_Name SSH)}
                    {<-oProtocol> <Id.Lit_Equals '='> ($ Id.VSub_DollarName '$_proto')}
                    {<-F>}
                    {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>}
                    {<-R> ($ Id.VSub_DollarName '$RFWD_PORT') <Id.Lit_Colon ':'> <127.0.0.1> 
                      <Id.Lit_Colon ':'> ($ Id.VSub_DollarName '$PORT')
                    }
                    {<-o>}
                    {<Id.Lit_VarLike 'ExitOnForwardFailure='> <yes>}
                    {<-n>}
                    {<host>}
                    {<exec>}
                    {<sh>}
                    {<-c>}
                    {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>) 
                      (DQ <'sleep 60 & echo '> 
                        (word_part.EscapedLiteral
                          token: <Id.Lit_EscapedChar '\\$'>
                        ) <'! > '> ($ Id.VSub_DollarName '$READY') <' ; wait '>
                      ) (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\\''>)
                    }
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
              terminator: <Id.Op_Amp _>
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_sshpid)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Bang '$!')}
                  spids: [607]
                )
              ]
            )
            (C {<wait_for_file_to_appear>} {($ Id.VSub_DollarName '$READY')})
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [616]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: (C {<test>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>})
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (command.Simple
                      words: [
                        {(${ Id.VSub_Name SSH)}
                        {<-F>}
                        {($ Id.VSub_DollarName '$OBJ') <'/ssh_config'>}
                        {<-p>}
                        {($ Id.VSub_DollarName '$RFWD_PORT')}
                        {<-oConnectionAttempts> <Id.Lit_Equals '='> <4>}
                        {<host>}
                        {<true>}
                      ]
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {<'/dev/null'>}
                        )
                        (redir
                          op: <Id.Redir_GreatAnd '2>&'>
                          loc: (redir_loc.Fd fd:2)
                          arg: {<1>}
                        )
                      ]
                      do_fork: T
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_result)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_QMark '$?')}
                          spids: [665]
                        )
                      ]
                    )
                    (command.Simple
                      words: [
                        {<kill>}
                        {($ Id.VSub_DollarName '$_sshpid')}
                        {
                          (command_sub
                            left_token: <Id.Left_Backtick '`'>
                            child: (C {<cat>} {($ Id.VSub_DollarName '$READY')})
                          )
                        }
                      ]
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '2>'>
                          loc: (redir_loc.Fd fd:2)
                          arg: {<'/dev/null'>}
                        )
                      ]
                      do_fork: T
                    )
                    (C {<wait_for_process_to_exit>} {($ Id.VSub_DollarName '$_sshpid')})
                  ]
                  spids: [620 632]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-ne>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_rfwd failed (expecting success): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [693 718]
                )
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xN>)} {<-a>} {($ Id.VSub_DollarName '$_result')} {<-eq>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fail>} 
                      {
                        (DQ <'check_rfwd succeeded (expecting failure): '> 
                          ($ Id.VSub_DollarName '$_message')
                        )
                      }
                    )
                  ]
                  spids: [729 754]
                )
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} 
                              {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xY>)} {<-a>} {(DQ <x> ($ Id.VSub_DollarName '$_expected'))} {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} 
                              {(DQ <xN>)}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'check_rfwd invalid argument '> 
                          (word_part.EscapedLiteral
                            token: <Id.Lit_EscapedChar '\\"'>
                          ) ($ Id.VSub_DollarName '$_expected') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>)
                        )
                      }
                    )
                  ]
                  spids: [765 797]
                )
              ]
              else_action: [
                (C {<verbose>} 
                  {
                    (DQ <'check_rfwd done (expecting '> ($ Id.VSub_DollarName '$_expected') <'): '> 
                      ($ Id.VSub_DollarName '$_message')
                    )
                  }
                )
              ]
            )
          ]
        )
    )
    (C {<start_sshd>})
    (C {<cp>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
    (C {<cp>} {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER)} 
      {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER) <.bak>}
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<check_lfwd>} {($ Id.VSub_DollarName '$p')} {<Y>} 
              {(DQ <'proto '> ($ Id.VSub_DollarName '$p') <', default configuration'>)}
            )
            (C {<check_rfwd>} {($ Id.VSub_DollarName '$p')} {<Y>} 
              {(DQ <'proto '> ($ Id.VSub_DollarName '$p') <', default configuration'>)}
            )
          ]
        )
    )
    (command.ShFunction
      name: all_tests
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_tcpfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [918]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_plain_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [922]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_plain_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [926]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_nopermit_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [930]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_nopermit_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$5')}
                  spids: [934]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_permit_lfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$6')}
                  spids: [938]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_permit_rfwd)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$7')}
                  spids: [942]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_badfwd)
                  op: assign_op.Equal
                  rhs: {<127.0.0.1> <Id.Lit_Colon ':'> <22>}
                  spids: [946]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_goodfwd)
                  op: assign_op.Equal
                  rhs: {<127.0.0.1> <Id.Lit_Colon ':'> (${ Id.VSub_Name PORT)}
                  spids: [952]
                )
              ]
            )
            (command.ForEach
              iter_name: _proto
              iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<cp>} 
                      {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER) <.bak>} {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER)}
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:_prefix)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (DQ <'proto '> ($ Id.VSub_DollarName '$_proto') <', AllowTcpForwarding='> 
                                ($ Id.VSub_DollarName '$_tcpfwd')
                              )
                            }
                          spids: [997]
                        )
                      ]
                    )
                    (command.Subshell
                      child: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_plain_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix'))}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_plain_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix'))}
                    )
                    (command.Subshell
                      child: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
                              terminator: <Id.Op_Semi _>
                            )
                            (command.Sentence
                              child: 
                                (C {<echo>} 
                                  {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))}
                                )
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'PermitOpen '> ($ Id.VSub_DollarName '$_badfwd'))})
                          ]
                        )
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !PermitOpen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !PermitOpen'>)}
                    )
                    (command.Subshell
                      child: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
                              terminator: <Id.Op_Semi _>
                            )
                            (command.Sentence
                              child: 
                                (C {<echo>} 
                                  {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))}
                                )
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} 
                              {
                                (DQ <'PermitOpen '> ($ Id.VSub_DollarName '$_badfwd') <' '> 
                                  ($ Id.VSub_DollarName '$_goodfwd')
                                )
                              }
                            )
                          ]
                        )
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>}
                        )
                      ]
                    )
                    (command.AndOr
                      ops: [Id.Op_DPipe]
                      children: [
                        (command.Simple
                          words: [
                            {<sed>}
                            {
                              (DQ <'s/^/permitopen='> 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) ($ Id.VSub_DollarName '$_badfwd') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) <' /'>
                              )
                            }
                          ]
                          redirects: [
                            (redir
                              op: <Id.Redir_Less '<'>
                              loc: (redir_loc.Fd fd:0)
                              arg: 
                                {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER) 
                                  <.bak>
                                }
                            )
                            (redir
                              op: <Id.Redir_Great '>'>
                              loc: (redir_loc.Fd fd:1)
                              arg: 
                                {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER)}
                            )
                          ]
                          do_fork: T
                        )
                        (C {<fatal>} {(DQ <'sed 1 fail'>)})
                      ]
                    )
                    (command.Subshell
                      child: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !permitopen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_nopermit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', !permitopen'>)}
                    )
                    (command.AndOr
                      ops: [Id.Op_DPipe]
                      children: [
                        (command.Simple
                          words: [
                            {<sed>}
                            {
                              (DQ <'s/^/permitopen='> 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) ($ Id.VSub_DollarName '$_badfwd') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) 
                                <',permitopen='> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ($ Id.VSub_DollarName '$_goodfwd') 
                                (word_part.EscapedLiteral
                                  token: <Id.Lit_EscapedChar '\\"'>
                                ) <' /'>
                              )
                            }
                          ]
                          redirects: [
                            (redir
                              op: <Id.Redir_Less '<'>
                              loc: (redir_loc.Fd fd:0)
                              arg: 
                                {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER) 
                                  <.bak>
                                }
                            )
                            (redir
                              op: <Id.Redir_Great '>'>
                              loc: (redir_loc.Fd fd:1)
                              arg: 
                                {(${ Id.VSub_Name OBJ) <'/authorized_keys_'> (${ Id.VSub_Name USER)}
                            )
                          ]
                          do_fork: T
                        )
                        (C {<fatal>} {(DQ <'sed 2 fail'>)})
                      ]
                    )
                    (command.Subshell
                      child: 
                        (command.CommandList
                          children: [
                            (command.Sentence
                              child: (C {<cat>} {(${ Id.VSub_Name OBJ) <'/sshd_proxy.bak'>})
                              terminator: <Id.Op_Semi _>
                            )
                            (C {<echo>} {(DQ <'AllowTcpForwarding '> ($ Id.VSub_DollarName '$_tcpfwd'))})
                          ]
                        )
                      redirects: [
                        (redir
                          op: <Id.Redir_Great '>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {(${ Id.VSub_Name OBJ) <'/sshd_proxy'>}
                        )
                      ]
                    )
                    (C {<check_lfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_permit_lfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', permitopen'>)}
                    )
                    (C {<check_rfwd>} {($ Id.VSub_DollarName '$_proto')} 
                      {($ Id.VSub_DollarName '$_permit_rfwd')} {(DQ ($ Id.VSub_DollarName '$_prefix') <', permitopen'>)}
                    )
                  ]
                )
            )
          ]
        )
    )
    (C {<all_tests>} {<yes>} {<Y>} {<Y>} {<N>} {<Y>} {<Y>} {<Y>})
    (C {<all_tests>} {<local>} {<Y>} {<N>} {<N>} {<N>} {<Y>} {<N>})
    (C {<all_tests>} {<remote>} {<N>} {<Y>} {<N>} {<Y>} {<N>} {<Y>})
    (C {<all_tests>} {<no>} {<N>} {<N>} {<N>} {<N>} {<N>} {<N>})
  ]
)