This is an archive of the discontinued Mercurial Phabricator instance.

Differential D9309

errors: set detailed exit code to 100 for some remote errors
ClosedPublic

Authored by martinvonz on Nov 12 2020, 11:37 AM.

Details

Reviewers
mharbison72
Group Reviewers
hg-reviewers
Commits
rHGebee234d952a: errors: set detailed exit code to 100 for some remote errors
Summary

This is per https://www.mercurial-scm.org/wiki/ErrorCategoriesPlan.

Diff Detail

Repository
rHG Mercurial
Branch
default
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

martinvonz created this revision.Nov 12 2020, 11:37 AM
mharbison72 added a subscriber: mharbison72.Nov 12 2020, 10:31 PM
mharbison72 added inline comments.
tests/test-clone.t
621

I'm surprised this is a considered a remote error. Maybe it's related to the sniffing for HttpError or URLError in the exception handler? (I'm fine with this if you are- maybe there's no way to distinguish from a remote error).

tests/test-extdata.t
116

Probably the same issue as above with thinking OSError is a remote error?

martinvonz added inline comments.Nov 13 2020, 2:59 AM
tests/test-clone.t
621

I agree. I spent a bit of time trying to convert the errors at a lower level (in keepalive.py) but it seems hard to tell them apart even there. So I'd say it's probably not worth it.

I insert D9318 before this patch to clean up a little.

mharbison72 added inline comments.Nov 16 2020, 1:06 AM
tests/test-extdata.t
116

With the cleanup in D9318, I'm baffled why this change didn't go away. Any idea why it's doing this, or how widespread the misdiagnosis is? (I'm assuming it's got something specific to do with this revset, because I didn't notice anything else that looked wrong in the tests)

martinvonz added inline comments.Nov 16 2020, 1:18 PM
tests/test-extdata.t
116

We still get a URLError here because the path is not found. In that other case in test-clone.t where the user gave us a bad URL, I agree that it would have been better to consider that an InputError (exit code 10). It's less clear-cut where because the user gave us a valid URL but it didn't "respond". Of course, in this case it was a file system path, so it's easier to tell the difference between a URL that doesn't exist and some network error...

mharbison72 accepted this revision.Nov 17 2020, 12:55 AM
This revision is now accepted and ready to land.Nov 17 2020, 12:55 AM

Revision Contents
Changeset List

Diff 23489

mercurial/scmutil.py

ui.error( ui.error(
_(b"abort: could not lock %s: %s\n") _(b"abort: could not lock %s: %s\n")
% ( % (
inst.desc or stringutil.forcebytestr(inst.filename), inst.desc or stringutil.forcebytestr(inst.filename),
encoding.strtolocal(inst.strerror), encoding.strtolocal(inst.strerror),
) )
) )
except error.OutOfBandError as inst: except error.OutOfBandError as inst:
detailed_exit_code = 100
if inst.args: if inst.args:
msg = _(b"abort: remote error:\n") msg = _(b"abort: remote error:\n")
else: else:
msg = _(b"abort: remote error\n") msg = _(b"abort: remote error\n")
ui.error(msg) ui.error(msg)
if inst.args: if inst.args:
ui.error(b''.join(inst.args)) ui.error(b''.join(inst.args))
if inst.hint: if inst.hint:
except ImportError as inst: except ImportError as inst:
ui.error(_(b"abort: %s!\n") % stringutil.forcebytestr(inst)) ui.error(_(b"abort: %s!\n") % stringutil.forcebytestr(inst))
m = stringutil.forcebytestr(inst).split()[-1] m = stringutil.forcebytestr(inst).split()[-1]
if m in b"mpatch bdiff".split(): if m in b"mpatch bdiff".split():
ui.error(_(b"(did you forget to compile extensions?)\n")) ui.error(_(b"(did you forget to compile extensions?)\n"))
elif m in b"zlib".split(): elif m in b"zlib".split():
ui.error(_(b"(is your Python install correct?)\n")) ui.error(_(b"(is your Python install correct?)\n"))
except util.urlerr.httperror as inst: except util.urlerr.httperror as inst:
detailed_exit_code = 100
ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst)) ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst))
except util.urlerr.urlerror as inst: except util.urlerr.urlerror as inst:
detailed_exit_code = 100
try: # usually it is in the form (errno, strerror) try: # usually it is in the form (errno, strerror)
reason = inst.reason.args[1] reason = inst.reason.args[1]
except (AttributeError, IndexError): except (AttributeError, IndexError):
# it might be anything, for example a string # it might be anything, for example a string
reason = inst.reason reason = inst.reason
if isinstance(reason, pycompat.unicode): if isinstance(reason, pycompat.unicode):
# SSLError of Python 2.7.9 contains a unicode # SSLError of Python 2.7.9 contains a unicode
reason = encoding.unitolocal(reason) reason = encoding.unitolocal(reason)

tests/test-bad-pull.t

#require serve #require serve
$ hg clone http://localhost:$HGPORT/ copy $ hg clone http://localhost:$HGPORT/ copy
abort: * (glob) abort: * (glob)
[255] [100]
$ test -d copy $ test -d copy
[1] [1]
$ "$PYTHON" "$TESTDIR/dumbhttp.py" -p $HGPORT --pid dumb.pid $ "$PYTHON" "$TESTDIR/dumbhttp.py" -p $HGPORT --pid dumb.pid
$ cat dumb.pid >> $DAEMON_PIDS $ cat dumb.pid >> $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/foo copy2 $ hg clone http://localhost:$HGPORT/foo copy2
abort: HTTP Error 404: * (glob) abort: HTTP Error 404: * (glob)
[255] [100]
$ killdaemons.py $ killdaemons.py

tests/test-bundle2-exchange.t

$ hg serve -p $HGPORT -d --pid-file=hg.pid $ hg serve -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid >> $DAEMON_PIDS $ cat hg.pid >> $DAEMON_PIDS
$ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2 $ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2
requesting all changes requesting all changes
abort: remote error: abort: remote error:
incompatible Mercurial client; bundle2 required incompatible Mercurial client; bundle2 required
(see https://www.mercurial-scm.org/wiki/IncompatibleClient) (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
[255] [100]
$ killdaemons.py $ killdaemons.py
$ cd .. $ cd ..
bundle1 can still pull non-generaldelta repos when generaldelta bundle1 disabled bundle1 can still pull non-generaldelta repos when generaldelta bundle1 disabled
$ hg --config format.usegeneraldelta=false init notgdserver $ hg --config format.usegeneraldelta=false init notgdserver
$ cd notgdserver $ cd notgdserver
$ cat > .hg/hgrc << EOF $ cat > .hg/hgrc << EOF
$ hg serve -p $HGPORT -d --pid-file=hg.pid $ hg serve -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid >> $DAEMON_PIDS $ cat hg.pid >> $DAEMON_PIDS
$ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2 $ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2
requesting all changes requesting all changes
abort: remote error: abort: remote error:
incompatible Mercurial client; bundle2 required incompatible Mercurial client; bundle2 required
(see https://www.mercurial-scm.org/wiki/IncompatibleClient) (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
[255] [100]
$ killdaemons.py $ killdaemons.py
Verify the global server.bundle1 option works Verify the global server.bundle1 option works
$ cd .. $ cd ..
$ cat > bundle2onlyserver/.hg/hgrc << EOF $ cat > bundle2onlyserver/.hg/hgrc << EOF
> [server] > [server]
> bundle1 = false > bundle1 = false
> EOF > EOF
$ hg serve -R bundle2onlyserver -p $HGPORT -d --pid-file=hg.pid $ hg serve -R bundle2onlyserver -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid >> $DAEMON_PIDS $ cat hg.pid >> $DAEMON_PIDS
$ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT not-bundle2 $ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT not-bundle2
requesting all changes requesting all changes
abort: remote error: abort: remote error:
incompatible Mercurial client; bundle2 required incompatible Mercurial client; bundle2 required
(see https://www.mercurial-scm.org/wiki/IncompatibleClient) (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
[255] [100]
$ killdaemons.py $ killdaemons.py
$ hg --config devel.legacy.exchange=bundle1 clone ssh://user@dummy/bundle2onlyserver not-bundle2-ssh $ hg --config devel.legacy.exchange=bundle1 clone ssh://user@dummy/bundle2onlyserver not-bundle2-ssh
requesting all changes requesting all changes
adding changesets adding changesets
remote: abort: incompatible Mercurial client; bundle2 required remote: abort: incompatible Mercurial client; bundle2 required
remote: (see https://www.mercurial-scm.org/wiki/IncompatibleClient) remote: (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
transaction abort! transaction abort!
rollback completed rollback completed
abort: stream ended unexpectedly (got 0 bytes, expected 4) abort: stream ended unexpectedly (got 0 bytes, expected 4)
[255] [255]
$ cat > bundle2onlyserver/.hg/hgrc << EOF $ cat > bundle2onlyserver/.hg/hgrc << EOF
> [server] > [server]
> bundle1gd = false > bundle1gd = false
> EOF > EOF
$ hg serve -R bundle2onlyserver -p $HGPORT -d --pid-file=hg.pid $ hg serve -R bundle2onlyserver -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid >> $DAEMON_PIDS $ cat hg.pid >> $DAEMON_PIDS
$ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2 $ hg --config devel.legacy.exchange=bundle1 clone http://localhost:$HGPORT/ not-bundle2
requesting all changes requesting all changes
abort: remote error: abort: remote error:
incompatible Mercurial client; bundle2 required incompatible Mercurial client; bundle2 required
(see https://www.mercurial-scm.org/wiki/IncompatibleClient) (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
[255] [100]
$ killdaemons.py $ killdaemons.py
$ cd notgdserver $ cd notgdserver
$ cat > .hg/hgrc << EOF $ cat > .hg/hgrc << EOF
> [server] > [server]
> bundle1gd = false > bundle1gd = false
> EOF > EOF
$ echo commit > foo $ echo commit > foo
$ hg commit -m commit $ hg commit -m commit
$ hg --config devel.legacy.exchange=bundle1 push $ hg --config devel.legacy.exchange=bundle1 push
pushing to http://localhost:$HGPORT/ pushing to http://localhost:$HGPORT/
searching for changes searching for changes
abort: remote error: abort: remote error:
incompatible Mercurial client; bundle2 required incompatible Mercurial client; bundle2 required
(see https://www.mercurial-scm.org/wiki/IncompatibleClient) (see https://www.mercurial-scm.org/wiki/IncompatibleClient)
[255] [100]
(also check with ssh) (also check with ssh)
$ hg --config devel.legacy.exchange=bundle1 push ssh://user@dummy/bundle2onlyserver $ hg --config devel.legacy.exchange=bundle1 push ssh://user@dummy/bundle2onlyserver
pushing to ssh://user@dummy/bundle2onlyserver pushing to ssh://user@dummy/bundle2onlyserver
searching for changes searching for changes
remote: abort: incompatible Mercurial client; bundle2 required remote: abort: incompatible Mercurial client; bundle2 required
remote: (see https://www.mercurial-scm.org/wiki/IncompatibleClient) remote: (see https://www.mercurial-scm.org/wiki/IncompatibleClient)

tests/test-clone.t

$ hg clone a b $ hg clone a b
abort: repository a not found! abort: repository a not found!
[255] [255]
Invalid URL Invalid URL
$ hg clone http://invalid:url/a b $ hg clone http://invalid:url/a b
abort: error: nonnumeric port: 'url' abort: error: nonnumeric port: 'url'
[255] [100]
mharbison72Unsubmitted
Not Done

I'm surprised this is a considered a remote error. Maybe it's related to the sniffing for HttpError or URLError in the exception handler? (I'm fine with this if you are- maybe there's no way to distinguish from a remote error).

mharbison72: I'm surprised this is a considered a remote error. Maybe it's related to the sniffing for…
martinvonzAuthorUnsubmitted
Done

I agree. I spent a bit of time trying to convert the errors at a lower level (in keepalive.py) but it seems hard to tell them apart even there. So I'd say it's probably not worth it.

I insert D9318 before this patch to clean up a little.

martinvonz: I agree. I spent a bit of time trying to convert the errors at a lower level (in `keepalive.
No remote source No remote source
#if windows #if windows
$ hg clone http://$LOCALIP:3121/a b $ hg clone http://$LOCALIP:3121/a b
abort: error: * (glob) abort: error: * (glob)
[255] [255]
#else #else
$ hg clone http://$LOCALIP:3121/a b $ hg clone http://$LOCALIP:3121/a b
abort: error: *refused* (glob) abort: error: *refused* (glob)
[255] [100]
#endif #endif
$ rm -rf b # work around bug with http clone $ rm -rf b # work around bug with http clone
#if unix-permissions no-root #if unix-permissions no-root
Inaccessible source Inaccessible source

tests/test-extdata.t

[255] [255]
we don't fix up relative file URLs, but we do run shell commands in repo root we don't fix up relative file URLs, but we do run shell commands in repo root
$ mkdir sub $ mkdir sub
$ cd sub $ cd sub
$ hg log -qr "extdata(filedata)" $ hg log -qr "extdata(filedata)"
abort: error: $ENOENT$ abort: error: $ENOENT$
[255] [100]
mharbison72Unsubmitted
Not Done

Probably the same issue as above with thinking OSError is a remote error?

mharbison72: Probably the same issue as above with thinking OSError is a remote error?
mharbison72Unsubmitted
Not Done

With the cleanup in D9318, I'm baffled why this change didn't go away. Any idea why it's doing this, or how widespread the misdiagnosis is? (I'm assuming it's got something specific to do with this revset, because I didn't notice anything else that looked wrong in the tests)

mharbison72: With the cleanup in D9318, I'm baffled why this change didn't go away. Any idea why it's doing…
martinvonzAuthorUnsubmitted
Done

We still get a URLError here because the path is not found. In that other case in test-clone.t where the user gave us a bad URL, I agree that it would have been better to consider that an InputError (exit code 10). It's less clear-cut where because the user gave us a valid URL but it didn't "respond". Of course, in this case it was a file system path, so it's easier to tell the difference between a URL that doesn't exist and some network error...

martinvonz: We still get a `URLError` here because the path is not found. In that other case in `test-clone.
$ hg log -qr "extdata(shelldata)" $ hg log -qr "extdata(shelldata)"
2:f6ed99a58333 2:f6ed99a58333
$ cd .. $ cd ..

tests/test-http-bad-server.t

Failure to accept() socket should result in connection related error message Failure to accept() socket should result in connection related error message
$ hg serve --config badserver.closebeforeaccept=true -p $HGPORT -d --pid-file=hg.pid $ hg serve --config badserver.closebeforeaccept=true -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: (\$ECONNRESET\$|\$EADDRNOTAVAIL\$) (re) abort: error: (\$ECONNRESET\$|\$EADDRNOTAVAIL\$) (re)
[255] [100]
(The server exits on its own, but there is a race between that and starting a new server. (The server exits on its own, but there is a race between that and starting a new server.
So ensure the process is dead.) So ensure the process is dead.)
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
Failure immediately after accept() should yield connection related error message Failure immediately after accept() should yield connection related error message
$ hg serve --config badserver.closeafteraccept=true -p $HGPORT -d --pid-file=hg.pid $ hg serve --config badserver.closeafteraccept=true -p $HGPORT -d --pid-file=hg.pid
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
TODO: this usually outputs good results, but sometimes emits abort: TODO: this usually outputs good results, but sometimes emits abort:
error: '' on FreeBSD and OS X. error: '' on FreeBSD and OS X.
What we ideally want are: What we ideally want are:
abort: error: $ECONNRESET$ abort: error: $ECONNRESET$
The flakiness in this output was observable easily with The flakiness in this output was observable easily with
--runs-per-test=20 on macOS 10.12 during the freeze for 4.2. --runs-per-test=20 on macOS 10.12 during the freeze for 4.2.
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: * (glob) abort: error: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
Failure to read all bytes in initial HTTP request should yield connection related error message Failure to read all bytes in initial HTTP request should yield connection related error message
$ hg serve --config badserver.closeafterrecvbytes=1 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config badserver.closeafterrecvbytes=1 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: bad HTTP status line: * (glob) abort: error: bad HTTP status line: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log $ cat error.log
readline(1 from 65537) -> (1) G readline(1 from 65537) -> (1) G
read limit reached; closing socket read limit reached; closing socket
$ rm -f error.log $ rm -f error.log
Same failure, but server reads full HTTP request line Same failure, but server reads full HTTP request line
$ hg serve --config badserver.closeafterrecvbytes=40 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config badserver.closeafterrecvbytes=40 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: bad HTTP status line: * (glob) abort: error: bad HTTP status line: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log $ cat error.log
readline(40 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n readline(40 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n
readline(7 from *) -> (7) Accept- (glob) readline(7 from *) -> (7) Accept- (glob)
read limit reached; closing socket read limit reached; closing socket
$ rm -f error.log $ rm -f error.log
Failure on subsequent HTTP request on the same socket (cmd?batch) Failure on subsequent HTTP request on the same socket (cmd?batch)
$ hg serve --config badserver.closeafterrecvbytes=210,223 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config badserver.closeafterrecvbytes=210,223 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: bad HTTP status line: * (glob) abort: error: bad HTTP status line: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log $ cat error.log
readline(210 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n readline(210 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n
readline(177 from *) -> (27) Accept-Encoding: identity\r\n (glob) readline(177 from *) -> (27) Accept-Encoding: identity\r\n (glob)
readline(150 from *) -> (35) accept: application/mercurial-0.1\r\n (glob) readline(150 from *) -> (35) accept: application/mercurial-0.1\r\n (glob)
readline(115 from *) -> (*) host: localhost:$HGPORT\r\n (glob) readline(115 from *) -> (*) host: localhost:$HGPORT\r\n (glob)
Failure to read getbundle HTTP request Failure to read getbundle HTTP request
$ hg serve --config badserver.closeafterrecvbytes=308,317,304 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config badserver.closeafterrecvbytes=308,317,304 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
requesting all changes requesting all changes
abort: error: bad HTTP status line: * (glob) abort: error: bad HTTP status line: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log $ cat error.log
readline(1 from -1) -> (1) x (?) readline(1 from -1) -> (1) x (?)
readline(1 from -1) -> (1) x (?) readline(1 from -1) -> (1) x (?)
readline(308 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n readline(308 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n
readline(275 from *) -> (27) Accept-Encoding: identity\r\n (glob) readline(275 from *) -> (27) Accept-Encoding: identity\r\n (glob)
Now do a variation using POST to send arguments Now do a variation using POST to send arguments
$ hg serve --config experimental.httppostargs=true --config badserver.closeafterrecvbytes=329,344 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config experimental.httppostargs=true --config badserver.closeafterrecvbytes=329,344 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: bad HTTP status line: * (glob) abort: error: bad HTTP status line: * (glob)
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log | "$PYTHON" $TESTDIR/filtertraceback.py $ cat error.log | "$PYTHON" $TESTDIR/filtertraceback.py
readline(329 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n readline(329 from 65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n
readline(296 from *) -> (27) Accept-Encoding: identity\r\n (glob) readline(296 from *) -> (27) Accept-Encoding: identity\r\n (glob)
readline(269 from *) -> (35) accept: application/mercurial-0.1\r\n (glob) readline(269 from *) -> (35) accept: application/mercurial-0.1\r\n (glob)
readline(234 from *) -> (2?) host: localhost:$HGPORT\r\n (glob) readline(234 from *) -> (2?) host: localhost:$HGPORT\r\n (glob)
Server sends a single character from the HTTP response line Server sends a single character from the HTTP response line
$ hg serve --config badserver.closeaftersendbytes=1 -p $HGPORT -d --pid-file=hg.pid -E error.log $ hg serve --config badserver.closeaftersendbytes=1 -p $HGPORT -d --pid-file=hg.pid -E error.log
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ clone $ hg clone http://localhost:$HGPORT/ clone
abort: error: bad HTTP status line: H abort: error: bad HTTP status line: H
[255] [100]
$ killdaemons.py $DAEMON_PIDS $ killdaemons.py $DAEMON_PIDS
$ cat error.log | "$PYTHON" $TESTDIR/filtertraceback.py $ cat error.log | "$PYTHON" $TESTDIR/filtertraceback.py
readline(65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n readline(65537) -> (33) GET /?cmd=capabilities HTTP/1.1\r\n
readline(*) -> (27) Accept-Encoding: identity\r\n (glob) readline(*) -> (27) Accept-Encoding: identity\r\n (glob)
readline(*) -> (35) accept: application/mercurial-0.1\r\n (glob) readline(*) -> (35) accept: application/mercurial-0.1\r\n (glob)
readline(*) -> (2?) host: localhost:$HGPORT\r\n (glob) readline(*) -> (2?) host: localhost:$HGPORT\r\n (glob)

tests/test-http-bundle1.t

(run 'hg update' to get a working copy) (run 'hg update' to get a working copy)
$ cd .. $ cd ..
clone from invalid URL clone from invalid URL
$ hg clone http://localhost:$HGPORT/bad $ hg clone http://localhost:$HGPORT/bad
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
test http authentication test http authentication
+ use the same server to test server side streaming preference + use the same server to test server side streaming preference
$ cd test $ cd test
$ hg serve --config extensions.x=$TESTDIR/httpserverauth.py -p $HGPORT2 -d \ $ hg serve --config extensions.x=$TESTDIR/httpserverauth.py -p $HGPORT2 -d \
> --pid-file=pid --config server.preferuncompressed=True \ > --pid-file=pid --config server.preferuncompressed=True \
updating to branch default updating to branch default
5 files updated, 0 files merged, 0 files removed, 0 files unresolved 5 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg id http://user2@localhost:$HGPORT2/ $ hg id http://user2@localhost:$HGPORT2/
abort: http authorization required for http://localhost:$HGPORT2/ abort: http authorization required for http://localhost:$HGPORT2/
[255] [255]
$ hg id http://user:pass2@localhost:$HGPORT2/ $ hg id http://user:pass2@localhost:$HGPORT2/
abort: HTTP Error 403: no abort: HTTP Error 403: no
[255] [100]
$ hg -R dest-pull tag -r tip top $ hg -R dest-pull tag -r tip top
$ hg -R dest-pull push http://user:pass@localhost:$HGPORT2/ $ hg -R dest-pull push http://user:pass@localhost:$HGPORT2/
pushing to http://user:***@localhost:$HGPORT2/ pushing to http://user:***@localhost:$HGPORT2/
searching for changes searching for changes
remote: adding changesets remote: adding changesets
remote: adding manifests remote: adding manifests
remote: adding file changes remote: adding file changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 3 changesets with 7 changes to 7 files added 3 changesets with 7 changes to 7 files
new changesets 8b6053c928fe:56f9bc90cce6 new changesets 8b6053c928fe:56f9bc90cce6
updating to branch default updating to branch default
cloning subrepo sub from http://localhost:$HGPORT/sub cloning subrepo sub from http://localhost:$HGPORT/sub
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
$ hg clone http://localhost:$HGPORT/ slash-clone $ hg clone http://localhost:$HGPORT/ slash-clone
requesting all changes requesting all changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 3 changesets with 7 changes to 7 files added 3 changesets with 7 changes to 7 files
new changesets 8b6053c928fe:56f9bc90cce6 new changesets 8b6053c928fe:56f9bc90cce6
updating to branch default updating to branch default
cloning subrepo sub from http://localhost:$HGPORT/sub cloning subrepo sub from http://localhost:$HGPORT/sub
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
check error log check error log
$ cat error.log $ cat error.log
Check error reporting while pulling/cloning Check error reporting while pulling/cloning
$ $RUNTESTDIR/killdaemons.py $ $RUNTESTDIR/killdaemons.py
$ hg serve -R test -p $HGPORT -d --pid-file=hg3.pid -E error.log --config extensions.crash=${TESTDIR}/crashgetbundler.py $ hg serve -R test -p $HGPORT -d --pid-file=hg3.pid -E error.log --config extensions.crash=${TESTDIR}/crashgetbundler.py
$ cat hg3.pid >> $DAEMON_PIDS $ cat hg3.pid >> $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT/ abort-clone $ hg clone http://localhost:$HGPORT/ abort-clone
requesting all changes requesting all changes
abort: remote error: abort: remote error:
this is an exercise this is an exercise
[255] [100]
$ cat error.log $ cat error.log
disable pull-based clones disable pull-based clones
$ hg serve -R test -p $HGPORT1 -d --pid-file=hg4.pid -E error.log --config server.disablefullbundle=True $ hg serve -R test -p $HGPORT1 -d --pid-file=hg4.pid -E error.log --config server.disablefullbundle=True
$ cat hg4.pid >> $DAEMON_PIDS $ cat hg4.pid >> $DAEMON_PIDS
$ hg clone http://localhost:$HGPORT1/ disable-pull-clone $ hg clone http://localhost:$HGPORT1/ disable-pull-clone
requesting all changes requesting all changes
abort: remote error: abort: remote error:
server has pull-based clones disabled server has pull-based clones disabled
[255] [100]
#if no-reposimplestore #if no-reposimplestore
... but keep stream clones working ... but keep stream clones working
$ hg clone --stream --noupdate http://localhost:$HGPORT1/ test-stream-clone $ hg clone --stream --noupdate http://localhost:$HGPORT1/ test-stream-clone
streaming all changes streaming all changes
* files to transfer, * of data (glob) * files to transfer, * of data (glob)
transferred * in * seconds (* KB/sec) (glob) transferred * in * seconds (* KB/sec) (glob)

tests/test-http-permissions.t

$ hg serve -p $HGPORT -d --pid-file hg.pid $ hg serve -p $HGPORT -d --pid-file hg.pid
$ cat hg.pid > $DAEMON_PIDS $ cat hg.pid > $DAEMON_PIDS
$ hg --cwd ../test2 push -B bm http://localhost:$HGPORT/ $ hg --cwd ../test2 push -B bm http://localhost:$HGPORT/
pushing to http://localhost:$HGPORT/ pushing to http://localhost:$HGPORT/
searching for changes searching for changes
no changes found no changes found
abort: HTTP Error 403: ssl required abort: HTTP Error 403: ssl required
[255] [100]
$ hg --cwd ../test2 push http://localhost:$HGPORT/ $ hg --cwd ../test2 push http://localhost:$HGPORT/
pushing to http://localhost:$HGPORT/ pushing to http://localhost:$HGPORT/
searching for changes searching for changes
abort: HTTP Error 403: ssl required abort: HTTP Error 403: ssl required
[255] [100]
$ killdaemons.py $ killdaemons.py
web.deny_push=* denies pushing to unauthenticated users web.deny_push=* denies pushing to unauthenticated users
$ cat > .hg/hgrc <<EOF $ cat > .hg/hgrc <<EOF
> [web] > [web]
> push_ssl = false > push_ssl = false

tests/test-http-proxy.t

updating to branch default updating to branch default
1 files updated, 0 files merged, 0 files removed, 0 files unresolved 1 files updated, 0 files merged, 0 files removed, 0 files unresolved
bad host:port for proxy ("Protocol not supported" can happen on bad host:port for proxy ("Protocol not supported" can happen on
misconfigured hosts) misconfigured hosts)
$ http_proxy=localhost:$HGPORT2 hg clone --config http_proxy.always=True http://localhost:$HGPORT/ f $ http_proxy=localhost:$HGPORT2 hg clone --config http_proxy.always=True http://localhost:$HGPORT/ f
abort: error: (Connection refused|Protocol not supported|.* actively refused it|\$EADDRNOTAVAIL\$|No route to host) (re) abort: error: (Connection refused|Protocol not supported|.* actively refused it|\$EADDRNOTAVAIL\$|No route to host) (re)
[255] [100]
do not use the proxy if it is in the no list do not use the proxy if it is in the no list
$ http_proxy=localhost:$HGPORT1 hg clone --config http_proxy.no=localhost http://localhost:$HGPORT/ g $ http_proxy=localhost:$HGPORT1 hg clone --config http_proxy.no=localhost http://localhost:$HGPORT/ g
requesting all changes requesting all changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes

tests/test-http.t

(run 'hg update' to get a working copy) (run 'hg update' to get a working copy)
$ cd .. $ cd ..
clone from invalid URL clone from invalid URL
$ hg clone http://localhost:$HGPORT/bad $ hg clone http://localhost:$HGPORT/bad
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
test http authentication test http authentication
+ use the same server to test server side streaming preference + use the same server to test server side streaming preference
$ cd test $ cd test
$ hg serve --config extensions.x=$TESTDIR/httpserverauth.py -p $HGPORT2 -d \ $ hg serve --config extensions.x=$TESTDIR/httpserverauth.py -p $HGPORT2 -d \
> --pid-file=pid --config server.preferuncompressed=True -E ../errors2.log \ > --pid-file=pid --config server.preferuncompressed=True -E ../errors2.log \
updating to branch default updating to branch default
5 files updated, 0 files merged, 0 files removed, 0 files unresolved 5 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg id http://user2@localhost:$HGPORT2/ $ hg id http://user2@localhost:$HGPORT2/
abort: http authorization required for http://localhost:$HGPORT2/ abort: http authorization required for http://localhost:$HGPORT2/
[255] [255]
$ hg id http://user:pass2@localhost:$HGPORT2/ $ hg id http://user:pass2@localhost:$HGPORT2/
abort: HTTP Error 403: no abort: HTTP Error 403: no
[255] [100]
$ hg -R dest-pull tag -r tip top $ hg -R dest-pull tag -r tip top
$ hg -R dest-pull push http://user:pass@localhost:$HGPORT2/ $ hg -R dest-pull push http://user:pass@localhost:$HGPORT2/
pushing to http://user:***@localhost:$HGPORT2/ pushing to http://user:***@localhost:$HGPORT2/
searching for changes searching for changes
remote: adding changesets remote: adding changesets
remote: adding manifests remote: adding manifests
remote: adding file changes remote: adding file changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 3 changesets with 7 changes to 7 files added 3 changesets with 7 changes to 7 files
new changesets 8b6053c928fe:56f9bc90cce6 new changesets 8b6053c928fe:56f9bc90cce6
updating to branch default updating to branch default
cloning subrepo sub from http://localhost:$HGPORT/sub cloning subrepo sub from http://localhost:$HGPORT/sub
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
$ hg clone http://localhost:$HGPORT/ slash-clone $ hg clone http://localhost:$HGPORT/ slash-clone
requesting all changes requesting all changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 3 changesets with 7 changes to 7 files added 3 changesets with 7 changes to 7 files
new changesets 8b6053c928fe:56f9bc90cce6 new changesets 8b6053c928fe:56f9bc90cce6
updating to branch default updating to branch default
cloning subrepo sub from http://localhost:$HGPORT/sub cloning subrepo sub from http://localhost:$HGPORT/sub
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
check error log check error log
$ cat error.log $ cat error.log
$ cat errors2.log $ cat errors2.log
check abort error reporting while pulling/cloning check abort error reporting while pulling/cloning
$ hg serve --config extensions.cookieauth=cookieauth.py -R test -p $HGPORT -d --pid-file=pid $ hg serve --config extensions.cookieauth=cookieauth.py -R test -p $HGPORT -d --pid-file=pid
$ cat pid > $DAEMON_PIDS $ cat pid > $DAEMON_PIDS
Request without cookie sent should fail due to lack of cookie Request without cookie sent should fail due to lack of cookie
$ hg id http://localhost:$HGPORT $ hg id http://localhost:$HGPORT
abort: HTTP Error 500: no-cookie abort: HTTP Error 500: no-cookie
[255] [100]
Populate a cookies file Populate a cookies file
$ cat > cookies.txt << EOF $ cat > cookies.txt << EOF
> # HTTP Cookie File > # HTTP Cookie File
> # Expiration is 2030-01-01 at midnight > # Expiration is 2030-01-01 at midnight
> .example.com TRUE / FALSE 1893456000 hgkey examplevalue > .example.com TRUE / FALSE 1893456000 hgkey examplevalue
> EOF > EOF
Should not send a cookie for another domain Should not send a cookie for another domain
$ hg --config auth.cookiefile=cookies.txt id http://localhost:$HGPORT/ $ hg --config auth.cookiefile=cookies.txt id http://localhost:$HGPORT/
abort: HTTP Error 500: no-cookie abort: HTTP Error 500: no-cookie
[255] [100]
Add a cookie entry for our test server and verify it is sent Add a cookie entry for our test server and verify it is sent
$ cat >> cookies.txt << EOF $ cat >> cookies.txt << EOF
> localhost.local FALSE / FALSE 1893456000 hgkey localhostvalue > localhost.local FALSE / FALSE 1893456000 hgkey localhostvalue
> EOF > EOF
$ hg --config auth.cookiefile=cookies.txt id http://localhost:$HGPORT/ $ hg --config auth.cookiefile=cookies.txt id http://localhost:$HGPORT/
abort: HTTP Error 500: Cookie: hgkey=localhostvalue abort: HTTP Error 500: Cookie: hgkey=localhostvalue
[255] [100]

tests/test-https.t

abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [255]
#endif #endif
#if defaultcacertsloaded #if defaultcacertsloaded
$ hg clone https://localhost:$HGPORT/ copy-pull $ hg clone https://localhost:$HGPORT/ copy-pull
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
#endif #endif
Specifying a per-host certificate file that doesn't exist will abort. The full Specifying a per-host certificate file that doesn't exist will abort. The full
C:/path/to/msysroot will print on Windows. C:/path/to/msysroot will print on Windows.
$ hg --config hostsecurity.localhost:verifycertsfile=/does/not/exist clone https://localhost:$HGPORT/ $ hg --config hostsecurity.localhost:verifycertsfile=/does/not/exist clone https://localhost:$HGPORT/
abort: path specified by hostsecurity.localhost:verifycertsfile does not exist: */does/not/exist (glob) abort: path specified by hostsecurity.localhost:verifycertsfile does not exist: */does/not/exist (glob)
[255] [255]
A malformed per-host certificate file will raise an error A malformed per-host certificate file will raise an error
$ echo baddata > badca.pem $ echo baddata > badca.pem
$ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ $ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/
abort: error loading CA file badca.pem: * (glob) abort: error loading CA file badca.pem: * (glob)
(file is empty or malformed?) (file is empty or malformed?)
[255] [255]
A per-host certificate mismatching the server will fail verification A per-host certificate mismatching the server will fail verification
(modern ssl is able to discern whether the loaded cert is a CA cert) (modern ssl is able to discern whether the loaded cert is a CA cert)
$ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/
(an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error) (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error)
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
A per-host certificate matching the server's cert will be accepted A per-host certificate matching the server's cert will be accepted
$ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" clone -U https://localhost:$HGPORT/ perhostgood1 $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" clone -U https://localhost:$HGPORT/ perhostgood1
requesting all changes requesting all changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
pulling from https://*:$HGPORT/ (glob) pulling from https://*:$HGPORT/ (glob)
warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob) warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob)
searching for changes searching for changes
no changes found no changes found
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem"
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" \ $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" \
> --insecure > --insecure
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
searching for changes searching for changes
no changes found no changes found
Test server cert which isn't valid yet Test server cert which isn't valid yet
$ hg serve -R test -p $HGPORT1 -d --pid-file=hg1.pid --certificate=server-not-yet.pem $ hg serve -R test -p $HGPORT1 -d --pid-file=hg1.pid --certificate=server-not-yet.pem
$ cat hg1.pid >> $DAEMON_PIDS $ cat hg1.pid >> $DAEMON_PIDS
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-not-yet.pem" \ $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-not-yet.pem" \
> https://localhost:$HGPORT1/ > https://localhost:$HGPORT1/
pulling from https://localhost:$HGPORT1/ pulling from https://localhost:$HGPORT1/
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
Test server cert which no longer is valid Test server cert which no longer is valid
$ hg serve -R test -p $HGPORT2 -d --pid-file=hg2.pid --certificate=server-expired.pem $ hg serve -R test -p $HGPORT2 -d --pid-file=hg2.pid --certificate=server-expired.pem
$ cat hg2.pid >> $DAEMON_PIDS $ cat hg2.pid >> $DAEMON_PIDS
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-expired.pem" \ $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-expired.pem" \
> https://localhost:$HGPORT2/ > https://localhost:$HGPORT2/
pulling from https://localhost:$HGPORT2/ pulling from https://localhost:$HGPORT2/
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
Setting ciphers to an invalid value aborts Setting ciphers to an invalid value aborts
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/
abort: could not set ciphers: No cipher can be selected. abort: could not set ciphers: No cipher can be selected.
(change cipher string (invalid) in config) (change cipher string (invalid) in config)
[255] [255]
$ P="$CERTSDIR" hg --config hostsecurity.localhost:ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.localhost:ciphers=invalid -R copy-pull id https://localhost:$HGPORT/
Clients requiring newer TLS version than what server supports fail Clients requiring newer TLS version than what server supports fail
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT1/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT1/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
--insecure will allow TLS 1.0 connections and override configs --insecure will allow TLS 1.0 connections and override configs
$ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/ $ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
5fed3813f7f5 5fed3813f7f5
The per-host config option overrides the default The per-host config option overrides the default
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config hostsecurity.minimumprotocol=tls1.2 \ > --config hostsecurity.minimumprotocol=tls1.2 \
> --config hostsecurity.localhost:minimumprotocol=tls1.0 > --config hostsecurity.localhost:minimumprotocol=tls1.0
5fed3813f7f5 5fed3813f7f5
The per-host config option by itself works The per-host config option by itself works
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config hostsecurity.localhost:minimumprotocol=tls1.2 > --config hostsecurity.localhost:minimumprotocol=tls1.2
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
.hg/hgrc file [hostsecurity] settings are applied to remote ui instances (issue5305) .hg/hgrc file [hostsecurity] settings are applied to remote ui instances (issue5305)
$ cat >> copy-pull/.hg/hgrc << EOF $ cat >> copy-pull/.hg/hgrc << EOF
> [hostsecurity] > [hostsecurity]
> localhost:minimumprotocol=tls1.2 > localhost:minimumprotocol=tls1.2
> EOF > EOF
$ P="$CERTSDIR" hg -R copy-pull id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg -R copy-pull id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: .*(unsupported protocol|wrong ssl version).* (re) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [100]
$ killdaemons.py hg0.pid $ killdaemons.py hg0.pid
$ killdaemons.py hg1.pid $ killdaemons.py hg1.pid
$ killdaemons.py hg2.pid $ killdaemons.py hg2.pid
#endif #endif
Prepare for connecting through proxy Prepare for connecting through proxy
Test https with cert problems through proxy Test https with cert problems through proxy
$ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \ $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \
> --config web.cacerts="$CERTSDIR/pub-other.pem" > --config web.cacerts="$CERTSDIR/pub-other.pem"
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
$ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \ $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \
> --config web.cacerts="$CERTSDIR/pub-expired.pem" https://localhost:$HGPORT2/ > --config web.cacerts="$CERTSDIR/pub-expired.pem" https://localhost:$HGPORT2/
pulling from https://localhost:$HGPORT2/ pulling from https://localhost:$HGPORT2/
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
abort: error: *certificate verify failed* (glob) abort: error: *certificate verify failed* (glob)
[255] [100]
$ killdaemons.py hg0.pid $ killdaemons.py hg0.pid
$ cd test $ cd test
Missing certificate file(s) are detected Missing certificate file(s) are detected
> --config devel.servercafile=$PRIV --config devel.serverrequirecert=true > --config devel.servercafile=$PRIV --config devel.serverrequirecert=true
$ cat ../hg0.pid >> $DAEMON_PIDS $ cat ../hg0.pid >> $DAEMON_PIDS
$ cd .. $ cd ..
without client certificate: without client certificate:
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/
abort: error: .*(\$ECONNRESET\$|certificate required|handshake failure).* (re) abort: error: .*(\$ECONNRESET\$|certificate required|handshake failure).* (re)
[255] [100]
with client certificate: with client certificate:
$ cat << EOT >> $HGRCPATH $ cat << EOT >> $HGRCPATH
> [auth] > [auth]
> l.prefix = localhost > l.prefix = localhost
> l.cert = $CERTSDIR/client-cert.pem > l.cert = $CERTSDIR/client-cert.pem
> l.key = $CERTSDIR/client-key.pem > l.key = $CERTSDIR/client-key.pem
> EOT > EOT
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config auth.l.key="$CERTSDIR/client-key-decrypted.pem" > --config auth.l.key="$CERTSDIR/client-key-decrypted.pem"
5fed3813f7f5 5fed3813f7f5
$ printf '1234\n' | env P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ printf '1234\n' | env P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config ui.interactive=True --config ui.nontty=True > --config ui.interactive=True --config ui.nontty=True
passphrase for */client-key.pem: 5fed3813f7f5 (glob) passphrase for */client-key.pem: 5fed3813f7f5 (glob)
$ env P="$CERTSDIR" hg id https://localhost:$HGPORT/ $ env P="$CERTSDIR" hg id https://localhost:$HGPORT/
abort: error: * (glob) abort: error: * (glob)
[255] [100]
Missing certficate and key files result in error Missing certficate and key files result in error
$ hg id https://localhost:$HGPORT/ --config auth.l.cert=/missing/cert $ hg id https://localhost:$HGPORT/ --config auth.l.cert=/missing/cert
abort: certificate file (*/missing/cert) does not exist; cannot connect to localhost (glob) abort: certificate file (*/missing/cert) does not exist; cannot connect to localhost (glob)
(restore missing file or fix references in Mercurial config) (restore missing file or fix references in Mercurial config)
[255] [255]
$ hg id https://localhost:$HGPORT/ --config auth.l.key=/missing/key $ hg id https://localhost:$HGPORT/ --config auth.l.key=/missing/key
abort: certificate file (*/missing/key) does not exist; cannot connect to localhost (glob) abort: certificate file (*/missing/key) does not exist; cannot connect to localhost (glob)
(restore missing file or fix references in Mercurial config) (restore missing file or fix references in Mercurial config)
[255] [255]

tests/test-largefiles-wireproto.t

$ hg serve -R r4 -d -p $HGPORT2 --pid-file hg.pid $ hg serve -R r4 -d -p $HGPORT2 --pid-file hg.pid
$ cat hg.pid >> $DAEMON_PIDS $ cat hg.pid >> $DAEMON_PIDS
$ hg --config extensions.largefiles=! clone http://localhost:$HGPORT2 r5 $ hg --config extensions.largefiles=! clone http://localhost:$HGPORT2 r5
abort: remote error: abort: remote error:
This repository uses the largefiles extension. This repository uses the largefiles extension.
Please enable it in your Mercurial config file. Please enable it in your Mercurial config file.
[255] [100]
used all HGPORTs, kill all daemons used all HGPORTs, kill all daemons
$ killdaemons.py $ killdaemons.py
#endif #endif
vanilla clients locked out from largefiles ssh repos vanilla clients locked out from largefiles ssh repos
$ hg --config extensions.largefiles=! clone -e "\"$PYTHON\" \"$TESTDIR/dummyssh\"" ssh://user@dummy/r4 r5 $ hg --config extensions.largefiles=! clone -e "\"$PYTHON\" \"$TESTDIR/dummyssh\"" ssh://user@dummy/r4 r5
remote: remote:
remote: This repository uses the largefiles extension. remote: This repository uses the largefiles extension.
remote: remote:
remote: Please enable it in your Mercurial config file. remote: Please enable it in your Mercurial config file.
remote: remote:
remote: - remote: -
abort: remote error abort: remote error
(check previous remote output) (check previous remote output)
[255] [100]
#if serve #if serve
largefiles clients refuse to push largefiles repos to vanilla servers largefiles clients refuse to push largefiles repos to vanilla servers
$ mkdir r6 $ mkdir r6
$ cd r6 $ cd r6
$ hg init $ hg init
$ echo c1 > f1 $ echo c1 > f1

tests/test-patchbomb-tls.t

#if defaultcacertsloaded #if defaultcacertsloaded
$ try $ try
this patch series consists of 1 patches. this patch series consists of 1 patches.
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
(?i)abort: .*?certificate.verify.failed.* (re) (?i)abort: .*?certificate.verify.failed.* (re)
[255] [100]
#endif #endif
$ DISABLECACERTS="--config devel.disableloaddefaultcerts=true" $ DISABLECACERTS="--config devel.disableloaddefaultcerts=true"
Without certificates: Without certificates:
$ try --debug $ try --debug
With invalid certificates: With invalid certificates:
$ try --config web.cacerts="$CERTSDIR/pub-other.pem" $ try --config web.cacerts="$CERTSDIR/pub-other.pem"
this patch series consists of 1 patches. this patch series consists of 1 patches.
(the full certificate chain may not be available locally; see "hg help debugssl") (windows !) (the full certificate chain may not be available locally; see "hg help debugssl") (windows !)
(?i)abort: .*?certificate.verify.failed.* (re) (?i)abort: .*?certificate.verify.failed.* (re)
[255] [100]
$ cd .. $ cd ..

tests/test-push-http.t

expect ssl error expect ssl error
$ req $ req
pushing to http://localhost:$HGPORT/ pushing to http://localhost:$HGPORT/
searching for changes searching for changes
abort: HTTP Error 403: ssl required abort: HTTP Error 403: ssl required
% serve errors % serve errors
[255] [100]
expect authorization error expect authorization error
$ echo '[web]' > .hg/hgrc $ echo '[web]' > .hg/hgrc
$ echo 'push_ssl = false' >> .hg/hgrc $ echo 'push_ssl = false' >> .hg/hgrc
$ req $ req
pushing to http://localhost:$HGPORT/ pushing to http://localhost:$HGPORT/
searching for changes searching for changes

tests/test-serve.t

$ rm access.log $ rm access.log
$ hg serve -a localhost -p $HGPORT -d --prefix some/dir \ $ hg serve -a localhost -p $HGPORT -d --prefix some/dir \
> --pid-file=hg.pid -E errors.log > --pid-file=hg.pid -E errors.log
$ cat hg.pid >> "$DAEMON_PIDS" $ cat hg.pid >> "$DAEMON_PIDS"
$ hg id http://localhost:$HGPORT/some/dir7 $ hg id http://localhost:$HGPORT/some/dir7
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
$ hg id http://localhost:$HGPORT/some $ hg id http://localhost:$HGPORT/some
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
$ cat access.log errors.log $ cat access.log errors.log
$LOCALIP - - [$LOGDATE$] "GET /some/dir7?cmd=capabilities HTTP/1.1" 404 - (glob) $LOCALIP - - [$LOGDATE$] "GET /some/dir7?cmd=capabilities HTTP/1.1" 404 - (glob)
$LOCALIP - - [$LOGDATE$] "GET /some?cmd=capabilities HTTP/1.1" 404 - (glob) $LOCALIP - - [$LOGDATE$] "GET /some?cmd=capabilities HTTP/1.1" 404 - (glob)
$ "$PYTHON" $RUNTESTDIR/killdaemons.py $DAEMON_PIDS $ "$PYTHON" $RUNTESTDIR/killdaemons.py $DAEMON_PIDS
issue6362: Previously, this crashed on Python 3 issue6362: Previously, this crashed on Python 3
$ hg serve -a 0.0.0.0 -d --pid-file=hg.pid $ hg serve -a 0.0.0.0 -d --pid-file=hg.pid
listening at http://*:$HGPORT1/ (bound to *:$HGPORT1) (glob) (?) listening at http://*:$HGPORT1/ (bound to *:$HGPORT1) (glob) (?)
$ cat hg.pid > "$DAEMON_PIDS" $ cat hg.pid > "$DAEMON_PIDS"
$ "$PYTHON" $RUNTESTDIR/killdaemons.py $DAEMON_PIDS $ "$PYTHON" $RUNTESTDIR/killdaemons.py $DAEMON_PIDS
$ cd .. $ cd ..

tests/test-static-http.t

#require no-reposimplestore #require no-reposimplestore
$ hg clone http://localhost:$HGPORT/ copy $ hg clone http://localhost:$HGPORT/ copy
abort: * (glob) abort: * (glob)
[255] [100]
$ test -d copy $ test -d copy
[1] [1]
This server doesn't do range requests so it's basically only good for This server doesn't do range requests so it's basically only good for
one pull one pull
$ "$PYTHON" "$TESTDIR/dumbhttp.py" -p $HGPORT --pid dumb.pid \ $ "$PYTHON" "$TESTDIR/dumbhttp.py" -p $HGPORT --pid dumb.pid \
> --logfile server.log > --logfile server.log

tests/test-subrepo-deep-nested-change.t

adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 1 changesets with 3 changes to 3 files added 1 changesets with 3 changes to 3 files
new changesets 7f491f53a367 new changesets 7f491f53a367
updating to branch default updating to branch default
cloning subrepo sub1 from http://localhost:$HGPORT/../sub1 cloning subrepo sub1 from http://localhost:$HGPORT/../sub1
abort: HTTP Error 404: Not Found abort: HTTP Error 404: Not Found
[255] [100]
$ cat access.log $ cat access.log
* "GET /?cmd=capabilities HTTP/1.1" 200 - (glob) * "GET /?cmd=capabilities HTTP/1.1" 200 - (glob)
* "GET /?cmd=batch HTTP/1.1" 200 - * (glob) * "GET /?cmd=batch HTTP/1.1" 200 - * (glob)
* "GET /?cmd=getbundle HTTP/1.1" 200 - * (glob) * "GET /?cmd=getbundle HTTP/1.1" 200 - * (glob)
* "GET /../sub1?cmd=capabilities HTTP/1.1" 404 - (glob) * "GET /../sub1?cmd=capabilities HTTP/1.1" 404 - (glob)
$ cat error.log $ cat error.log

tests/test-subrepo-relative-path.t

$ hg -R cloned push --config paths.default=bogus://invalid $ hg -R cloned push --config paths.default=bogus://invalid
pushing to http://user:***@localhost:$HGPORT/main pushing to http://user:***@localhost:$HGPORT/main
pushing subrepo sub to http://user:***@localhost:$HGPORT/sub pushing subrepo sub to http://user:***@localhost:$HGPORT/sub
searching for changes searching for changes
no changes found no changes found
searching for changes searching for changes
no changes found no changes found
abort: HTTP Error 403: ssl required abort: HTTP Error 403: ssl required
[255] [100]
Checking cloned repo ids Checking cloned repo ids
$ hg id -R cloned $ hg id -R cloned
fdfeeb3e979e tip fdfeeb3e979e tip
$ hg id -R cloned/sub $ hg id -R cloned/sub
863c1745b441 tip 863c1745b441 tip