From 345e07c85e725ac3de6e81c075bcee89d22720d5 Mon Sep 17 00:00:00 2001 From: Michael Mol Date: Fri, 9 Jun 2017 15:51:13 -0400 Subject: [PATCH] Support Match prioritization OpenSSH's Match declarations are applied first-match-wins. However, we can't safely define two Matches that might overlap unless we first sort the keys, as Python (and Jinja) dicts don't guarantee the order of dict keys, We also won't scramble the match sequence every time the user adds, removes or renames a match, and so we give the user clearer, more concise diffs as when they apply changes. Finally, we leave a comment on the Match line identifying where the Match rule came from, to assist in troubleshooting. --- openssh/files/sshd_config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openssh/files/sshd_config b/openssh/files/sshd_config index 9a75fe3..816fd78 100644 --- a/openssh/files/sshd_config +++ b/openssh/files/sshd_config @@ -215,8 +215,8 @@ {# Handle matches last as they need to go at the bottom #} {%- if 'matches' in sshd_config %} - {%- for match in sshd_config['matches'].values() %} -Match {{ match['type'].keys()[0] }} {{ match['type'].values()[0] }} + {%- for name, match in sshd_config['matches']|dictsort(true) %} +Match {{ match['type'].keys()[0] }} {{ match['type'].values()[0] }} # {{ name }} {%- for keyword in match['options'].keys() %} {{ render_option(keyword, '', config_dict=match['options']) }} {%- endfor %}