From 6229a6d122670dce9f841ddf6c3f9c8f61f5a928 Mon Sep 17 00:00:00 2001 From: Michael Mol Date: Mon, 12 Jun 2017 12:05:46 -0400 Subject: [PATCH] Stabily sort matches OpenSSH's Match declarations are applied first-match-wins. However, we can't safely define two Matches that might overlap unless we first sort the keys, as Python (and Jinja) dicts don't guarantee the order of dict keys, We also won't scramble the match sequence every time the user adds, removes or renames a match, and so we give the user clearer, more concise diffs as when they apply changes. Finally, we leave a comment on the Match line identifying where the Match rule came from, to assist in troubleshooting. --- openssh/files/sshd_config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openssh/files/sshd_config b/openssh/files/sshd_config index d9d44a1..763e261 100644 --- a/openssh/files/sshd_config +++ b/openssh/files/sshd_config @@ -227,12 +227,12 @@ {# Handle matches last as they need to go at the bottom #} {%- if 'matches' in sshd_config %} - {%- for match in sshd_config['matches'].values() %} + {%- for name, match in sshd_config['matches']|dictsort %} Match {#- Set up the match criteria -#} {%- for criteria in match['type'].keys()|sort() -%} {{- ' ' }}{{criteria }} {{ join_to_string(match['type'], criteria) -}} - {%- endfor -%} + {%- endfor %} #{{ name }} {#- Set up the applied options -#} {%- for keyword in match['options'].keys() %} {{ render_option(keyword, '', config_dict=match['options']) }}