chgserver: handle ParseError during validate

Currently the validate command in chgserver expects config can be loaded
without issues but the config can be broken and chg will print a stacktrace
instead of the parsing error, if a chg server is already running.

This patch adds a handler for ParseError in validate and a new instruction
"exit" to make the client exit without abortmsg. A test is also added to make
sure it will behave as expected.

tests/test-chg.t

@@ -0,0 +1,12
+init repo
+
+  $ hg init foo
+  $ cd foo
+
+ill-formed config
+
+  $ hg status
+  $ echo '=brokenconfig' >> $HGRCPATH
+  $ hg status
+  hg: parse error at * (glob)
+  [255]

contrib/chg/chg.c

@@ -1,560 +1,565
 /*
  * A fast client for Mercurial command server
  *
  * Copyright (c) 2011 Yuya Nishihara <[e-mail]>
  *
  * This software may be used and distributed according to the terms of the
  * GNU General Public License version 2 or any later version.
  */
 
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/file.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/un.h>
 #include <sys/wait.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "hgclient.h"
 #include "util.h"
 
 #ifndef UNIX_PATH_MAX
 #define UNIX_PATH_MAX (sizeof(((struct sockaddr_un *)NULL)->sun_path))
 #endif
 
 struct cmdserveropts {
 	char sockname[UNIX_PATH_MAX];
 	char redirectsockname[UNIX_PATH_MAX];
 	char lockfile[UNIX_PATH_MAX];
 	size_t argsize;
 	const char **args;
 	int lockfd;
 };
 
 static void initcmdserveropts(struct cmdserveropts *opts) {
 	memset(opts, 0, sizeof(struct cmdserveropts));
 	opts->lockfd = -1;
 }
 
 static void freecmdserveropts(struct cmdserveropts *opts) {
 	free(opts->args);
 	opts->args = NULL;
 	opts->argsize = 0;
 }
 
 /*
  * Test if an argument is a sensitive flag that should be passed to the server.
  * Return 0 if not, otherwise the number of arguments starting from the current
  * one that should be passed to the server.
  */
 static size_t testsensitiveflag(const char *arg)
 {
 	static const struct {
 		const char *name;
 		size_t narg;
 	} flags[] = {
 		{"--config", 1},
 		{"--cwd", 1},
 		{"--repo", 1},
 		{"--repository", 1},
 		{"--traceback", 0},
 		{"-R", 1},
 	};
 	size_t i;
 	for (i = 0; i < sizeof(flags) / sizeof(flags[0]); ++i) {
 		size_t len = strlen(flags[i].name);
 		size_t narg = flags[i].narg;
 		if (memcmp(arg, flags[i].name, len) == 0) {
 			if (arg[len] == '\0') {  /* --flag (value) */
 				return narg + 1;
 			} else if (arg[len] == '=' && narg > 0) {  /* --flag=value */
 				return 1;
 			} else if (flags[i].name[1] != '-') {  /* short flag */
 				return 1;
 			}
 		}
 	}
 	return 0;
 }
 
 /*
  * Parse argv[] and put sensitive flags to opts->args
  */
 static void setcmdserverargs(struct cmdserveropts *opts,
 			     int argc, const char *argv[])
 {
 	size_t i, step;
 	opts->argsize = 0;
 	for (i = 0, step = 1; i < (size_t)argc; i += step, step = 1) {
 		if (!argv[i])
 			continue;  /* pass clang-analyse */
 		if (strcmp(argv[i], "--") == 0)
 			break;
 		size_t n = testsensitiveflag(argv[i]);
 		if (n == 0 || i + n > (size_t)argc)
 			continue;
 		opts->args = reallocx(opts->args,
 				      (n + opts->argsize) * sizeof(char *));
 		memcpy(opts->args + opts->argsize, argv + i,
 		       sizeof(char *) * n);
 		opts->argsize += n;
 		step = n;
 	}
 }
 
 static void preparesockdir(const char *sockdir)
 {
 	int r;
 	r = mkdir(sockdir, 0700);
 	if (r < 0 && errno != EEXIST)
 		abortmsg("cannot create sockdir %s (errno = %d)",
 			 sockdir, errno);
 
 	struct stat st;
 	r = lstat(sockdir, &st);
 	if (r < 0)
 		abortmsg("cannot stat %s (errno = %d)", sockdir, errno);
 	if (!S_ISDIR(st.st_mode))
 		abortmsg("cannot create sockdir %s (file exists)", sockdir);
 	if (st.st_uid != geteuid() || st.st_mode & 0077)
 		abortmsg("insecure sockdir %s", sockdir);
 }
 
 static void setcmdserveropts(struct cmdserveropts *opts)
 {
 	int r;
 	char sockdir[UNIX_PATH_MAX];
 	const char *envsockname = getenv("CHGSOCKNAME");
 	if (!envsockname) {
 		/* by default, put socket file in secure directory
 		 * (permission of socket file may be ignored on some Unices) */
 		const char *tmpdir = getenv("TMPDIR");
 		if (!tmpdir)
 			tmpdir = "/tmp";
 		r = snprintf(sockdir, sizeof(sockdir), "%s/chg%d",
 			     tmpdir, geteuid());
 		if (r < 0 || (size_t)r >= sizeof(sockdir))
 			abortmsg("too long TMPDIR (r = %d)", r);
 		preparesockdir(sockdir);
 	}
 
 	const char *basename = (envsockname) ? envsockname : sockdir;
 	const char *sockfmt = (envsockname) ? "%s" : "%s/server";
 	const char *lockfmt = (envsockname) ? "%s.lock" : "%s/lock";
 	r = snprintf(opts->sockname, sizeof(opts->sockname), sockfmt, basename);
 	if (r < 0 || (size_t)r >= sizeof(opts->sockname))
 		abortmsg("too long TMPDIR or CHGSOCKNAME (r = %d)", r);
 	r = snprintf(opts->lockfile, sizeof(opts->lockfile), lockfmt, basename);
 	if (r < 0 || (size_t)r >= sizeof(opts->lockfile))
 		abortmsg("too long TMPDIR or CHGSOCKNAME (r = %d)", r);
 }
 
 /*
  * Acquire a file lock that indicates a client is trying to start and connect
  * to a server, before executing a command. The lock is released upon exit or
  * explicit unlock. Will block if the lock is held by another process.
  */
 static void lockcmdserver(struct cmdserveropts *opts)
 {
 	if (opts->lockfd == -1) {
 		opts->lockfd = open(opts->lockfile, O_RDWR | O_CREAT | O_NOFOLLOW, 0600);
 		if (opts->lockfd == -1)
 			abortmsg("cannot create lock file %s", opts->lockfile);
 	}
 	int r = flock(opts->lockfd, LOCK_EX);
 	if (r == -1)
 		abortmsg("cannot acquire lock");
 }
 
 /*
  * Release the file lock held by calling lockcmdserver. Will do nothing if
  * lockcmdserver is not called.
  */
 static void unlockcmdserver(struct cmdserveropts *opts)
 {
 	if (opts->lockfd == -1)
 		return;
 	flock(opts->lockfd, LOCK_UN);
 	close(opts->lockfd);
 	opts->lockfd = -1;
 }
 
 static const char *gethgcmd(void)
 {
 	static const char *hgcmd = NULL;
 	if (!hgcmd) {
 		hgcmd = getenv("CHGHG");
 		if (!hgcmd || hgcmd[0] == '\0')
 			hgcmd = getenv("HG");
 		if (!hgcmd || hgcmd[0] == '\0')
 			hgcmd = "hg";
 	}
 	return hgcmd;
 }
 
 static void execcmdserver(const struct cmdserveropts *opts)
 {
 	const char *hgcmd = gethgcmd();
 
 	const char *baseargv[] = {
 		hgcmd,
 		"serve",
 		"--cmdserver", "chgunix",
 		"--address", opts->sockname,
 		"--daemon-postexec", "chdir:/",
 		"--config", "extensions.chgserver=",
 	};
 	size_t baseargvsize = sizeof(baseargv) / sizeof(baseargv[0]);
 	size_t argsize = baseargvsize + opts->argsize + 1;
 
 	const char **argv = mallocx(sizeof(char *) * argsize);
 	memcpy(argv, baseargv, sizeof(baseargv));
 	memcpy(argv + baseargvsize, opts->args, sizeof(char *) * opts->argsize);
 	argv[argsize - 1] = NULL;
 
 	if (putenv("CHGINTERNALMARK=") != 0)
 		abortmsg("failed to putenv (errno = %d)", errno);
 	if (execvp(hgcmd, (char **)argv) < 0)
 		abortmsg("failed to exec cmdserver (errno = %d)", errno);
 	free(argv);
 }
 
 /* Retry until we can connect to the server. Give up after some time. */
 static hgclient_t *retryconnectcmdserver(struct cmdserveropts *opts, pid_t pid)
 {
 	static const struct timespec sleepreq = {0, 10 * 1000000};
 	int pst = 0;
 
 	for (unsigned int i = 0; i < 10 * 100; i++) {
 		hgclient_t *hgc = hgc_open(opts->sockname);
 		if (hgc)
 			return hgc;
 
 		if (pid > 0) {
 			/* collect zombie if child process fails to start */
 			int r = waitpid(pid, &pst, WNOHANG);
 			if (r != 0)
 				goto cleanup;
 		}
 
 		nanosleep(&sleepreq, NULL);
 	}
 
 	abortmsg("timed out waiting for cmdserver %s", opts->sockname);
 	return NULL;
 
 cleanup:
 	if (WIFEXITED(pst)) {
 		debugmsg("cmdserver exited with status %d", WEXITSTATUS(pst));
 		exit(WEXITSTATUS(pst));
 	} else if (WIFSIGNALED(pst)) {
 		abortmsg("cmdserver killed by signal %d", WTERMSIG(pst));
 	} else {
 		abortmsg("error white waiting cmdserver");
 	}
 	return NULL;
 }
 
 /* Connect to a cmdserver. Will start a new server on demand. */
 static hgclient_t *connectcmdserver(struct cmdserveropts *opts)
 {
 	const char *sockname = opts->redirectsockname[0] ?
 		opts->redirectsockname : opts->sockname;
 	hgclient_t *hgc = hgc_open(sockname);
 	if (hgc)
 		return hgc;
 
 	lockcmdserver(opts);
 	hgc = hgc_open(sockname);
 	if (hgc) {
 		unlockcmdserver(opts);
 		debugmsg("cmdserver is started by another process");
 		return hgc;
 	}
 
 	/* prevent us from being connected to an outdated server: we were
 	 * told by a server to redirect to opts->redirectsockname and that
 	 * address does not work. we do not want to connect to the server
 	 * again because it will probably tell us the same thing. */
 	if (sockname == opts->redirectsockname)
 		unlink(opts->sockname);
 
 	debugmsg("start cmdserver at %s", opts->sockname);
 
 	pid_t pid = fork();
 	if (pid < 0)
 		abortmsg("failed to fork cmdserver process");
 	if (pid == 0) {
 		/* do not leak lockfd to hg */
 		close(opts->lockfd);
 		/* bypass uisetup() of pager extension */
 		int nullfd = open("/dev/null", O_WRONLY);
 		if (nullfd >= 0) {
 			dup2(nullfd, fileno(stdout));
 			close(nullfd);
 		}
 		execcmdserver(opts);
 	} else {
 		hgc = retryconnectcmdserver(opts, pid);
 	}
 
 	unlockcmdserver(opts);
 	return hgc;
 }
 
 static void killcmdserver(const struct cmdserveropts *opts)
 {
 	/* resolve config hash */
 	char *resolvedpath = realpath(opts->sockname, NULL);
 	if (resolvedpath) {
 		unlink(resolvedpath);
 		free(resolvedpath);
 	}
 }
 
 static pid_t peerpid = 0;
 
 static void forwardsignal(int sig)
 {
 	assert(peerpid > 0);
 	if (kill(peerpid, sig) < 0)
 		abortmsg("cannot kill %d (errno = %d)", peerpid, errno);
 	debugmsg("forward signal %d", sig);
 }
 
 static void handlestopsignal(int sig)
 {
 	sigset_t unblockset, oldset;
 	struct sigaction sa, oldsa;
 	if (sigemptyset(&unblockset) < 0)
 		goto error;
 	if (sigaddset(&unblockset, sig) < 0)
 		goto error;
 	memset(&sa, 0, sizeof(sa));
 	sa.sa_handler = SIG_DFL;
 	sa.sa_flags = SA_RESTART;
 	if (sigemptyset(&sa.sa_mask) < 0)
 		goto error;
 
 	forwardsignal(sig);
 	if (raise(sig) < 0)  /* resend to self */
 		goto error;
 	if (sigaction(sig, &sa, &oldsa) < 0)
 		goto error;
 	if (sigprocmask(SIG_UNBLOCK, &unblockset, &oldset) < 0)
 		goto error;
 	/* resent signal will be handled before sigprocmask() returns */
 	if (sigprocmask(SIG_SETMASK, &oldset, NULL) < 0)
 		goto error;
 	if (sigaction(sig, &oldsa, NULL) < 0)
 		goto error;
 	return;
 
 error:
 	abortmsg("failed to handle stop signal (errno = %d)", errno);
 }
 
 static void setupsignalhandler(pid_t pid)
 {
 	if (pid <= 0)
 		return;
 	peerpid = pid;
 
 	struct sigaction sa;
 	memset(&sa, 0, sizeof(sa));
 	sa.sa_handler = forwardsignal;
 	sa.sa_flags = SA_RESTART;
 	if (sigemptyset(&sa.sa_mask) < 0)
 		goto error;
 
 	if (sigaction(SIGHUP, &sa, NULL) < 0)
 		goto error;
 	if (sigaction(SIGINT, &sa, NULL) < 0)
 		goto error;
 
 	/* terminate frontend by double SIGTERM in case of server freeze */
 	sa.sa_flags |= SA_RESETHAND;
 	if (sigaction(SIGTERM, &sa, NULL) < 0)
 		goto error;
 
 	/* propagate job control requests to worker */
 	sa.sa_handler = forwardsignal;
 	sa.sa_flags = SA_RESTART;
 	if (sigaction(SIGCONT, &sa, NULL) < 0)
 		goto error;
 	sa.sa_handler = handlestopsignal;
 	sa.sa_flags = SA_RESTART;
 	if (sigaction(SIGTSTP, &sa, NULL) < 0)
 		goto error;
 
 	return;
 
 error:
 	abortmsg("failed to set up signal handlers (errno = %d)", errno);
 }
 
 /* This implementation is based on hgext/pager.py (pre 369741ef7253) */
 static void setuppager(hgclient_t *hgc, const char *const args[],
 		       size_t argsize)
 {
 	const char *pagercmd = hgc_getpager(hgc, args, argsize);
 	if (!pagercmd)
 		return;
 
 	int pipefds[2];
 	if (pipe(pipefds) < 0)
 		return;
 	pid_t pid = fork();
 	if (pid < 0)
 		goto error;
 	if (pid == 0) {
 		close(pipefds[0]);
 		if (dup2(pipefds[1], fileno(stdout)) < 0)
 			goto error;
 		if (isatty(fileno(stderr))) {
 			if (dup2(pipefds[1], fileno(stderr)) < 0)
 				goto error;
 		}
 		close(pipefds[1]);
 		hgc_attachio(hgc);  /* reattach to pager */
 		return;
 	} else {
 		dup2(pipefds[0], fileno(stdin));
 		close(pipefds[0]);
 		close(pipefds[1]);
 
 		int r = execlp("/bin/sh", "/bin/sh", "-c", pagercmd, NULL);
 		if (r < 0) {
 			abortmsg("cannot start pager '%s' (errno = %d)",
 				 pagercmd, errno);
 		}
 		return;
 	}
 
 error:
 	close(pipefds[0]);
 	close(pipefds[1]);
 	abortmsg("failed to prepare pager (errno = %d)", errno);
 }
 
 /* Run instructions sent from the server like unlink and set redirect path */
 static void runinstructions(struct cmdserveropts *opts, const char **insts)
 {
 	assert(insts);
 	opts->redirectsockname[0] = '\0';
 	const char **pinst;
 	for (pinst = insts; *pinst; pinst++) {
 		debugmsg("instruction: %s", *pinst);
 		if (strncmp(*pinst, "unlink ", 7) == 0) {
 			unlink(*pinst + 7);
 		} else if (strncmp(*pinst, "redirect ", 9) == 0) {
 			int r = snprintf(opts->redirectsockname,
 					 sizeof(opts->redirectsockname),
 					 "%s", *pinst + 9);
 			if (r < 0 || r >= (int)sizeof(opts->redirectsockname))
 				abortmsg("redirect path is too long (%d)", r);
+		} else if (strncmp(*pinst, "exit ", 5) == 0) {
+			int n = 0;
+			if (sscanf(*pinst + 5, "%d", &n) != 1)
+				abortmsg("cannot read the exit code");
+			exit(n);
 		} else {
 			abortmsg("unknown instruction: %s", *pinst);
 		}
 	}
 }
 
 /*
  * Test whether the command is unsupported or not. This is not designed to
  * cover all cases. But it's fast, does not depend on the server and does
  * not return false positives.
  */
 static int isunsupported(int argc, const char *argv[])
 {
 	enum {
 		SERVE = 1,
 		DAEMON = 2,
 		SERVEDAEMON = SERVE | DAEMON,
 		TIME = 4,
 	};
 	unsigned int state = 0;
 	int i;
 	for (i = 0; i < argc; ++i) {
 		if (strcmp(argv[i], "--") == 0)
 			break;
 		if (i == 0 && strcmp("serve", argv[i]) == 0)
 			state |= SERVE;
 		else if (strcmp("-d", argv[i]) == 0 ||
 			 strcmp("--daemon", argv[i]) == 0)
 			state |= DAEMON;
 		else if (strcmp("--time", argv[i]) == 0)
 			state |= TIME;
 	}
 	return (state & TIME) == TIME ||
 	       (state & SERVEDAEMON) == SERVEDAEMON;
 }
 
 static void execoriginalhg(const char *argv[])
 {
 	debugmsg("execute original hg");
 	if (execvp(gethgcmd(), (char **)argv) < 0)
 		abortmsg("failed to exec original hg (errno = %d)", errno);
 }
 
 int main(int argc, const char *argv[], const char *envp[])
 {
 	if (getenv("CHGDEBUG"))
 		enabledebugmsg();
 
 	if (getenv("CHGINTERNALMARK"))
 		abortmsg("chg started by chg detected.\n"
 			 "Please make sure ${HG:-hg} is not a symlink or "
 			 "wrapper to chg. Alternatively, set $CHGHG to the "
 			 "path of real hg.");
 
 	if (isunsupported(argc - 1, argv + 1))
 		execoriginalhg(argv);
 
 	struct cmdserveropts opts;
 	initcmdserveropts(&opts);
 	setcmdserveropts(&opts);
 	setcmdserverargs(&opts, argc, argv);
 
 	if (argc == 2) {
 		if (strcmp(argv[1], "--kill-chg-daemon") == 0) {
 			killcmdserver(&opts);
 			return 0;
 		}
 	}
 
 	hgclient_t *hgc;
 	size_t retry = 0;
 	while (1) {
 		hgc = connectcmdserver(&opts);
 		if (!hgc)
 			abortmsg("cannot open hg client");
 		hgc_setenv(hgc, envp);
 		const char **insts = hgc_validate(hgc, argv + 1, argc - 1);
 		if (insts == NULL)
 			break;
 		runinstructions(&opts, insts);
 		free(insts);
 		hgc_close(hgc);
 		if (++retry > 10)
 			abortmsg("too many redirections.\n"
 				 "Please make sure %s is not a wrapper which "
 				 "changes sensitive environment variables "
 				 "before executing hg. If you have to use a "
 				 "wrapper, wrap chg instead of hg.",
 				 gethgcmd());
 	}
 
 	setupsignalhandler(hgc_peerpid(hgc));
 	setuppager(hgc, argv + 1, argc - 1);
 	int exitcode = hgc_runcommand(hgc, argv + 1, argc - 1);
 	hgc_close(hgc);
 	freecmdserveropts(&opts);
 	return exitcode;
 }

hgext/chgserver.py

@@ -1,663 +1,671
 # chgserver.py - command server extension for cHg
 #
 # Copyright 2011 Yuya Nishihara <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 """command server extension for cHg (EXPERIMENTAL)
 
 'S' channel (read/write)
     propagate ui.system() request to client
 
 'attachio' command
     attach client's stdio passed by sendmsg()
 
 'chdir' command
     change current directory
 
 'getpager' command
     checks if pager is enabled and which pager should be executed
 
 'setenv' command
     replace os.environ completely
 
 'setumask' command
     set umask
 
 'validate' command
     reload the config and check if the server is up to date
 
 Config
 ------
 
 ::
 
   [chgserver]
   idletimeout = 3600 # seconds, after which an idle server will exit
   skiphash = False   # whether to skip config or env change checks
 """
 
 from __future__ import absolute_import
 
 import SocketServer
 import errno
 import inspect
 import os
 import re
 import struct
 import sys
 import threading
 import time
 import traceback
 
 from mercurial.i18n import _
 
 from mercurial import (
     cmdutil,
     commands,
     commandserver,
     dispatch,
     error,
     extensions,
     osutil,
     util,
 )
 
 # Note for extension authors: ONLY specify testedwith = 'internal' for
 # extensions which SHIP WITH MERCURIAL. Non-mainline extensions should
 # be specifying the version(s) of Mercurial they are tested with, or
 # leave the attribute unspecified.
 testedwith = 'internal'
 
 _log = commandserver.log
 
 def _hashlist(items):
     """return sha1 hexdigest for a list"""
     return util.sha1(str(items)).hexdigest()
 
 # sensitive config sections affecting confighash
 _configsections = [
     'extdiff',  # uisetup will register new commands
     'extensions',
 ]
 
 # sensitive environment variables affecting confighash
 _envre = re.compile(r'''\A(?:
                     CHGHG
                     |HG.*
                     |LANG(?:UAGE)?
                     |LC_.*
                     |LD_.*
                     |PATH
                     |PYTHON.*
                     |TERM(?:INFO)?
                     |TZ
                     )\Z''', re.X)
 
 def _confighash(ui):
     """return a quick hash for detecting config/env changes
 
     confighash is the hash of sensitive config items and environment variables.
 
     for chgserver, it is designed that once confighash changes, the server is
     not qualified to serve its client and should redirect the client to a new
     server. different from mtimehash, confighash change will not mark the
     server outdated and exit since the user can have different configs at the
     same time.
     """
     sectionitems = []
     for section in _configsections:
         sectionitems.append(ui.configitems(section))
     sectionhash = _hashlist(sectionitems)
     envitems = [(k, v) for k, v in os.environ.iteritems() if _envre.match(k)]
     envhash = _hashlist(sorted(envitems))
     return sectionhash[:6] + envhash[:6]
 
 def _getmtimepaths(ui):
     """get a list of paths that should be checked to detect change
 
     The list will include:
     - extensions (will not cover all files for complex extensions)
     - mercurial/__version__.py
     - python binary
     """
     modules = [m for n, m in extensions.extensions(ui)]
     try:
         from mercurial import __version__
         modules.append(__version__)
     except ImportError:
         pass
     files = [sys.executable]
     for m in modules:
         try:
             files.append(inspect.getabsfile(m))
         except TypeError:
             pass
     return sorted(set(files))
 
 def _mtimehash(paths):
     """return a quick hash for detecting file changes
 
     mtimehash calls stat on given paths and calculate a hash based on size and
     mtime of each file. mtimehash does not read file content because reading is
     expensive. therefore it's not 100% reliable for detecting content changes.
     it's possible to return different hashes for same file contents.
     it's also possible to return a same hash for different file contents for
     some carefully crafted situation.
 
     for chgserver, it is designed that once mtimehash changes, the server is
     considered outdated immediately and should no longer provide service.
     """
     def trystat(path):
         try:
             st = os.stat(path)
             return (st.st_mtime, st.st_size)
         except OSError:
             # could be ENOENT, EPERM etc. not fatal in any case
             pass
     return _hashlist(map(trystat, paths))[:12]
 
 class hashstate(object):
     """a structure storing confighash, mtimehash, paths used for mtimehash"""
     def __init__(self, confighash, mtimehash, mtimepaths):
         self.confighash = confighash
         self.mtimehash = mtimehash
         self.mtimepaths = mtimepaths
 
     @staticmethod
     def fromui(ui, mtimepaths=None):
         if mtimepaths is None:
             mtimepaths = _getmtimepaths(ui)
         confighash = _confighash(ui)
         mtimehash = _mtimehash(mtimepaths)
         _log('confighash = %s mtimehash = %s\n' % (confighash, mtimehash))
         return hashstate(confighash, mtimehash, mtimepaths)
 
 # copied from hgext/pager.py:uisetup()
 def _setuppagercmd(ui, options, cmd):
     if not ui.formatted():
         return
 
     p = ui.config("pager", "pager", os.environ.get("PAGER"))
     usepager = False
     always = util.parsebool(options['pager'])
     auto = options['pager'] == 'auto'
 
     if not p:
         pass
     elif always:
         usepager = True
     elif not auto:
         usepager = False
     else:
         attended = ['annotate', 'cat', 'diff', 'export', 'glog', 'log', 'qdiff']
         attend = ui.configlist('pager', 'attend', attended)
         ignore = ui.configlist('pager', 'ignore')
         cmds, _ = cmdutil.findcmd(cmd, commands.table)
 
         for cmd in cmds:
             var = 'attend-%s' % cmd
             if ui.config('pager', var):
                 usepager = ui.configbool('pager', var)
                 break
             if (cmd in attend or
                 (cmd not in ignore and not attend)):
                 usepager = True
                 break
 
     if usepager:
         ui.setconfig('ui', 'formatted', ui.formatted(), 'pager')
         ui.setconfig('ui', 'interactive', False, 'pager')
         return p
 
 _envvarre = re.compile(r'\$[a-zA-Z_]+')
 
 def _clearenvaliases(cmdtable):
     """Remove stale command aliases referencing env vars; variable expansion
     is done at dispatch.addaliases()"""
     for name, tab in cmdtable.items():
         cmddef = tab[0]
         if (isinstance(cmddef, dispatch.cmdalias) and
             not cmddef.definition.startswith('!') and  # shell alias
             _envvarre.search(cmddef.definition)):
             del cmdtable[name]
 
 def _newchgui(srcui, csystem):
     class chgui(srcui.__class__):
         def __init__(self, src=None):
             super(chgui, self).__init__(src)
             if src:
                 self._csystem = getattr(src, '_csystem', csystem)
             else:
                 self._csystem = csystem
 
         def system(self, cmd, environ=None, cwd=None, onerr=None,
                    errprefix=None):
             # copied from mercurial/util.py:system()
             self.flush()
             def py2shell(val):
                 if val is None or val is False:
                     return '0'
                 if val is True:
                     return '1'
                 return str(val)
             env = os.environ.copy()
             if environ:
                 env.update((k, py2shell(v)) for k, v in environ.iteritems())
             env['HG'] = util.hgexecutable()
             rc = self._csystem(cmd, env, cwd)
             if rc and onerr:
                 errmsg = '%s %s' % (os.path.basename(cmd.split(None, 1)[0]),
                                     util.explainexit(rc)[0])
                 if errprefix:
                     errmsg = '%s: %s' % (errprefix, errmsg)
                 raise onerr(errmsg)
             return rc
 
     return chgui(srcui)
 
 def _renewui(srcui, args=None):
     if not args:
         args = []
 
     newui = srcui.__class__()
     for a in ['fin', 'fout', 'ferr', 'environ']:
         setattr(newui, a, getattr(srcui, a))
     if util.safehasattr(srcui, '_csystem'):
         newui._csystem = srcui._csystem
 
     # load wd and repo config, copied from dispatch.py
     cwds = dispatch._earlygetopt(['--cwd'], args)
     cwd = cwds and os.path.realpath(cwds[-1]) or None
     rpath = dispatch._earlygetopt(["-R", "--repository", "--repo"], args)
     path, newui = dispatch._getlocal(newui, rpath, wd=cwd)
 
     # internal config: extensions.chgserver
     # copy it. it can only be overrided from command line.
     newui.setconfig('extensions', 'chgserver',
                     srcui.config('extensions', 'chgserver'), '--config')
 
     # command line args
     dispatch._parseconfig(newui, dispatch._earlygetopt(['--config'], args))
 
     # stolen from tortoisehg.util.copydynamicconfig()
     for section, name, value in srcui.walkconfig():
         source = srcui.configsource(section, name)
         if ':' in source or source == '--config':
             # path:line or command line
             continue
         if source == 'none':
             # ui.configsource returns 'none' by default
             source = ''
         newui.setconfig(section, name, value, source)
     return newui
 
 class channeledsystem(object):
     """Propagate ui.system() request in the following format:
 
     payload length (unsigned int),
     cmd, '\0',
     cwd, '\0',
     envkey, '=', val, '\0',
     ...
     envkey, '=', val
 
     and waits:
 
     exitcode length (unsigned int),
     exitcode (int)
     """
     def __init__(self, in_, out, channel):
         self.in_ = in_
         self.out = out
         self.channel = channel
 
     def __call__(self, cmd, environ, cwd):
         args = [util.quotecommand(cmd), os.path.abspath(cwd or '.')]
         args.extend('%s=%s' % (k, v) for k, v in environ.iteritems())
         data = '\0'.join(args)
         self.out.write(struct.pack('>cI', self.channel, len(data)))
         self.out.write(data)
         self.out.flush()
 
         length = self.in_.read(4)
         length, = struct.unpack('>I', length)
         if length != 4:
             raise error.Abort(_('invalid response'))
         rc, = struct.unpack('>i', self.in_.read(4))
         return rc
 
 _iochannels = [
     # server.ch, ui.fp, mode
     ('cin', 'fin', 'rb'),
     ('cout', 'fout', 'wb'),
     ('cerr', 'ferr', 'wb'),
 ]
 
 class chgcmdserver(commandserver.server):
     def __init__(self, ui, repo, fin, fout, sock, hashstate, baseaddress):
         super(chgcmdserver, self).__init__(
             _newchgui(ui, channeledsystem(fin, fout, 'S')), repo, fin, fout)
         self.clientsock = sock
         self._oldios = []  # original (self.ch, ui.fp, fd) before "attachio"
         self.hashstate = hashstate
         self.baseaddress = baseaddress
         if hashstate is not None:
             self.capabilities = self.capabilities.copy()
             self.capabilities['validate'] = chgcmdserver.validate
 
     def cleanup(self):
         # dispatch._runcatch() does not flush outputs if exception is not
         # handled by dispatch._dispatch()
         self.ui.flush()
         self._restoreio()
 
     def attachio(self):
         """Attach to client's stdio passed via unix domain socket; all
         channels except cresult will no longer be used
         """
         # tell client to sendmsg() with 1-byte payload, which makes it
         # distinctive from "attachio\n" command consumed by client.read()
         self.clientsock.sendall(struct.pack('>cI', 'I', 1))
         clientfds = osutil.recvfds(self.clientsock.fileno())
         _log('received fds: %r\n' % clientfds)
 
         ui = self.ui
         ui.flush()
         first = self._saveio()
         for fd, (cn, fn, mode) in zip(clientfds, _iochannels):
             assert fd > 0
             fp = getattr(ui, fn)
             os.dup2(fd, fp.fileno())
             os.close(fd)
             if not first:
                 continue
             # reset buffering mode when client is first attached. as we want
             # to see output immediately on pager, the mode stays unchanged
             # when client re-attached. ferr is unchanged because it should
             # be unbuffered no matter if it is a tty or not.
             if fn == 'ferr':
                 newfp = fp
             else:
                 # make it line buffered explicitly because the default is
                 # decided on first write(), where fout could be a pager.
                 if fp.isatty():
                     bufsize = 1  # line buffered
                 else:
                     bufsize = -1  # system default
                 newfp = os.fdopen(fp.fileno(), mode, bufsize)
                 setattr(ui, fn, newfp)
             setattr(self, cn, newfp)
 
         self.cresult.write(struct.pack('>i', len(clientfds)))
 
     def _saveio(self):
         if self._oldios:
             return False
         ui = self.ui
         for cn, fn, _mode in _iochannels:
             ch = getattr(self, cn)
             fp = getattr(ui, fn)
             fd = os.dup(fp.fileno())
             self._oldios.append((ch, fp, fd))
         return True
 
     def _restoreio(self):
         ui = self.ui
         for (ch, fp, fd), (cn, fn, _mode) in zip(self._oldios, _iochannels):
             newfp = getattr(ui, fn)
             # close newfp while it's associated with client; otherwise it
             # would be closed when newfp is deleted
             if newfp is not fp:
                 newfp.close()
             # restore original fd: fp is open again
             os.dup2(fd, fp.fileno())
             os.close(fd)
             setattr(self, cn, ch)
             setattr(ui, fn, fp)
         del self._oldios[:]
 
     def validate(self):
         """Reload the config and check if the server is up to date
 
         Read a list of '\0' separated arguments.
         Write a non-empty list of '\0' separated instruction strings or '\0'
         if the list is empty.
         An instruction string could be either:
             - "unlink $path", the client should unlink the path to stop the
               outdated server.
             - "redirect $path", the client should try to connect to another
               server instead.
+            - "exit $n", the client should exit directly with code n.
+              This may happen if we cannot parse the config.
         """
         args = self._readlist()
-        self.ui = _renewui(self.ui, args)
+        try:
+            self.ui = _renewui(self.ui, args)
+        except error.ParseError as inst:
+            dispatch._formatparse(self.ui.warn, inst)
+            self.ui.flush()
+            self.cresult.write('exit 255')
+            return
         newhash = hashstate.fromui(self.ui, self.hashstate.mtimepaths)
         insts = []
         if newhash.mtimehash != self.hashstate.mtimehash:
             addr = _hashaddress(self.baseaddress, self.hashstate.confighash)
             insts.append('unlink %s' % addr)
         if newhash.confighash != self.hashstate.confighash:
             addr = _hashaddress(self.baseaddress, newhash.confighash)
             insts.append('redirect %s' % addr)
         _log('validate: %s\n' % insts)
         self.cresult.write('\0'.join(insts) or '\0')
 
     def chdir(self):
         """Change current directory
 
         Note that the behavior of --cwd option is bit different from this.
         It does not affect --config parameter.
         """
         path = self._readstr()
         if not path:
             return
         _log('chdir to %r\n' % path)
         os.chdir(path)
 
     def setumask(self):
         """Change umask"""
         mask = struct.unpack('>I', self._read(4))[0]
         _log('setumask %r\n' % mask)
         os.umask(mask)
 
     def getpager(self):
         """Read cmdargs and write pager command to r-channel if enabled
 
         If pager isn't enabled, this writes '\0' because channeledoutput
         does not allow to write empty data.
         """
         args = self._readlist()
         try:
             cmd, _func, args, options, _cmdoptions = dispatch._parse(self.ui,
                                                                      args)
         except (error.Abort, error.AmbiguousCommand, error.CommandError,
                 error.UnknownCommand):
             cmd = None
             options = {}
         if not cmd or 'pager' not in options:
             self.cresult.write('\0')
             return
 
         pagercmd = _setuppagercmd(self.ui, options, cmd)
         if pagercmd:
             self.cresult.write(pagercmd)
         else:
             self.cresult.write('\0')
 
     def setenv(self):
         """Clear and update os.environ
 
         Note that not all variables can make an effect on the running process.
         """
         l = self._readlist()
         try:
             newenv = dict(s.split('=', 1) for s in l)
         except ValueError:
             raise ValueError('unexpected value in setenv request')
 
         diffkeys = set(k for k in set(os.environ.keys() + newenv.keys())
                        if os.environ.get(k) != newenv.get(k))
         _log('change env: %r\n' % sorted(diffkeys))
 
         os.environ.clear()
         os.environ.update(newenv)
 
         if set(['HGPLAIN', 'HGPLAINEXCEPT']) & diffkeys:
             # reload config so that ui.plain() takes effect
             self.ui = _renewui(self.ui)
 
         _clearenvaliases(commands.table)
 
     capabilities = commandserver.server.capabilities.copy()
     capabilities.update({'attachio': attachio,
                          'chdir': chdir,
                          'getpager': getpager,
                          'setenv': setenv,
                          'setumask': setumask})
 
 # copied from mercurial/commandserver.py
 class _requesthandler(SocketServer.StreamRequestHandler):
     def handle(self):
         # use a different process group from the master process, making this
         # process pass kernel "is_current_pgrp_orphaned" check so signals like
         # SIGTSTP, SIGTTIN, SIGTTOU are not ignored.
         os.setpgid(0, 0)
         ui = self.server.ui
         repo = self.server.repo
         sv = None
         try:
             sv = chgcmdserver(ui, repo, self.rfile, self.wfile, self.connection,
                               self.server.hashstate, self.server.baseaddress)
             try:
                 sv.serve()
             # handle exceptions that may be raised by command server. most of
             # known exceptions are caught by dispatch.
             except error.Abort as inst:
                 ui.warn(_('abort: %s\n') % inst)
             except IOError as inst:
                 if inst.errno != errno.EPIPE:
                     raise
             except KeyboardInterrupt:
                 pass
             finally:
                 sv.cleanup()
         except: # re-raises
             # also write traceback to error channel. otherwise client cannot
             # see it because it is written to server's stderr by default.
             if sv:
                 cerr = sv.cerr
             else:
                 cerr = commandserver.channeledoutput(self.wfile, 'e')
             traceback.print_exc(file=cerr)
             raise
 
 def _tempaddress(address):
     return '%s.%d.tmp' % (address, os.getpid())
 
 def _hashaddress(address, hashstr):
     return '%s-%s' % (address, hashstr)
 
 class AutoExitMixIn:  # use old-style to comply with SocketServer design
     lastactive = time.time()
     idletimeout = 3600  # default 1 hour
 
     def startautoexitthread(self):
         # note: the auto-exit check here is cheap enough to not use a thread,
         # be done in serve_forever. however SocketServer is hook-unfriendly,
         # you simply cannot hook serve_forever without copying a lot of code.
         # besides, serve_forever's docstring suggests using thread.
         thread = threading.Thread(target=self._autoexitloop)
         thread.daemon = True
         thread.start()
 
     def _autoexitloop(self, interval=1):
         while True:
             time.sleep(interval)
             if not self.issocketowner():
                 _log('%s is not owned, exiting.\n' % self.server_address)
                 break
             if time.time() - self.lastactive > self.idletimeout:
                 _log('being idle too long. exiting.\n')
                 break
         self.shutdown()
 
     def process_request(self, request, address):
         self.lastactive = time.time()
         return SocketServer.ForkingMixIn.process_request(
             self, request, address)
 
     def server_bind(self):
         # use a unique temp address so we can stat the file and do ownership
         # check later
         tempaddress = _tempaddress(self.server_address)
         self.socket.bind(tempaddress)
         self._socketstat = os.stat(tempaddress)
         # rename will replace the old socket file if exists atomically. the
         # old server will detect ownership change and exit.
         util.rename(tempaddress, self.server_address)
 
     def issocketowner(self):
         try:
             stat = os.stat(self.server_address)
             return (stat.st_ino == self._socketstat.st_ino and
                     stat.st_mtime == self._socketstat.st_mtime)
         except OSError:
             return False
 
     def unlinksocketfile(self):
         if not self.issocketowner():
             return
         # it is possible to have a race condition here that we may
         # remove another server's socket file. but that's okay
         # since that server will detect and exit automatically and
         # the client will start a new server on demand.
         try:
             os.unlink(self.server_address)
         except OSError as exc:
             if exc.errno != errno.ENOENT:
                 raise
 
 class chgunixservice(commandserver.unixservice):
     def init(self):
         self._inithashstate()
         class cls(AutoExitMixIn, SocketServer.ForkingMixIn,
                   SocketServer.UnixStreamServer):
             ui = self.ui
             repo = self.repo
             hashstate = self.hashstate
             baseaddress = self.baseaddress
         self.server = cls(self.address, _requesthandler)
         self.server.idletimeout = self.ui.configint(
             'chgserver', 'idletimeout', self.server.idletimeout)
         self.server.startautoexitthread()
         self._createsymlink()
 
     def _inithashstate(self):
         self.baseaddress = self.address
         if self.ui.configbool('chgserver', 'skiphash', False):
             self.hashstate = None
             return
         self.hashstate = hashstate.fromui(self.ui)
         self.address = _hashaddress(self.address, self.hashstate.confighash)
 
     def _createsymlink(self):
         if self.baseaddress == self.address:
             return
         tempaddress = _tempaddress(self.baseaddress)
         os.symlink(os.path.basename(self.address), tempaddress)
         util.rename(tempaddress, self.baseaddress)
 
     def run(self):
         try:
             self.server.serve_forever()
         finally:
             self.server.unlinksocketfile()
 
 def uisetup(ui):
     commandserver._servicemap['chgunix'] = chgunixservice
 
     # CHGINTERNALMARK is temporarily set by chg client to detect if chg will
     # start another chg. drop it to avoid possible side effects.
     if 'CHGINTERNALMARK' in os.environ:
         del os.environ['CHGINTERNALMARK']