passenger 2.2.15 → 3.0.0.pre1

data/ext/nginx/{HelperServer.cpp → HelperAgent.cpp}

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - http://www.modrails.com/
- *  Copyright (c) 2009 Phusion
+ *  Copyright (c) 2010 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -30,8 +30,9 @@
 #include <cstring>
 #include <unistd.h>
 #include <errno.h>
-#include <signal.h>
+#include <limits.h>
 #include <pwd.h>
+#include <grp.h>
 
 #include <set>
 #include <vector>
@@ -45,85 +46,56 @@
 #include "ScgiRequestParser.h"
 #include "HttpStatusExtractor.h"
 
-#include "StandardApplicationPool.h"
-#include "ApplicationPoolStatusReporter.h"
-#include "Application.h"
+#include "AgentBase.h"
+#include "HelperAgent/BacktracesServer.h"
+#include "Constants.h"
+#include "ApplicationPool/Pool.h"
+#include "ApplicationPool/Server.h"
+#include "Session.h"
 #include "PoolOptions.h"
+#include "MessageServer.h"
+#include "FileDescriptor.h"
+#include "ResourceLocator.h"
+#include "ServerInstanceDir.h"
 #include "Exceptions.h"
 #include "Utils.h"
+#include "Utils/Timer.h"
 
 using namespace boost;
 using namespace oxt;
 using namespace Passenger;
 
-#define HELPER_SERVER_PASSWORD_SIZE     64
+#define REQUEST_SOCKET_PASSWORD_SIZE     64
 
+struct ClientDisconnectedException { };
 
-/**
- * Wrapper class around a file descriptor integer, for RAII behavior.
- *
- * A FileDescriptor object behaves just like an int, so that you can pass it to
- * system calls such as read(). It performs reference counting. When the last
- * copy of a FileDescriptor has been destroyed, the underlying file descriptor
- * will be automatically closed.
- */
-class FileDescriptor {
+class ExitHandler: public MessageServer::Handler {
 private:
-	struct SharedData {
-		int fd;
-		
-		/**
-		 * Constructor to assign this file descriptor's handle.
-		 */
-		SharedData(int fd) {
-			this->fd = fd;
-		}
-		
-		/**
-		 * Attempts to close this file descriptor. When created on the stack,
-		 * this destructor will automatically be invoked as a result of C++
-		 * semantics when exiting the scope this object was created in. This
-		 * ensures that stack created objects with destructors like these will
-		 * de-allocate their resources upon leaving their corresponding scope.
-		 * This pattern is also known Resource Acquisition Is Initialization (RAII).
-		 *
-		 * @throws SystemException File descriptor could not be closed.
-		 */
-		~SharedData() {
-			if (syscalls::close(fd) == -1) {
-				throw SystemException("Cannot close file descriptor", errno);
-			}
-		}
-	};
-	
-	/* Shared pointer for reference counting on this file descriptor */
-	shared_ptr<SharedData> data;
+	EventFd &exitEvent;
 	
 public:
-	FileDescriptor() {
-		// Do nothing.
-	}
+	ExitHandler(EventFd &_exitEvent)
+		: exitEvent(_exitEvent)
+	{ }
 	
-	/**
-	 * Creates a new FileDescriptor instance with the given fd as a handle.
-	 */
-	FileDescriptor(int fd) {
-		data = ptr(new SharedData(fd));
-	}
-	
-	/**
-	 * Overloads the integer cast operator so that it will return the file
-	 * descriptor handle as an integer.
-	 *
-	 * @return This file descriptor's handle as an integer.
-	 */
-	operator int () const {
-		return data->fd;
+	virtual bool processMessage(MessageServer::CommonClientContext &commonContext,
+	                            MessageServer::ClientContextPtr &handlerSpecificContext,
+	                            const vector<string> &args)
+	{
+		if (args[0] == "exit") {
+			TRACE_POINT();
+			commonContext.requireRights(Account::EXIT);
+			UPDATE_TRACE_POINT();
+			exitEvent.notify();
+			UPDATE_TRACE_POINT();
+			commonContext.channel.write("exit command received", NULL);
+			return true;
+		} else {
+			return false;
+		}
 	}
 };
 
-struct ClientDisconnectedException { };
-
 /**
  * A representation of a Client from the Server's point of view. This class
  * contains the methods used to communicate from a server to a connected
@@ -138,37 +110,46 @@ struct ClientDisconnectedException { };
  */
 class Client {
 private:
+	/** Maximum allowed size of SCGI headers. */
+	static const unsigned int MAX_HEADER_SIZE = 1024 * 128;
 	/** The client thread stack size in bytes. */
 	static const int CLIENT_THREAD_STACK_SIZE =
+		// Give a small amount of normal stack space
 		#ifdef __FreeBSD__
 			// localtime() on FreeBSD needs some more stack space.
-			1024 * 96;
+			1024 * 96
 		#else
-			1024 * 64;
+			1024 * 64
 		#endif
+		// and some more stack space for storing the session header.
+		+ MAX_HEADER_SIZE + 1024;
 	
 	/** The client number for this Client object, assigned by Server. */
 	unsigned int number;
 	
 	/** The application pool to which this Client object belongs to. */
-	StandardApplicationPoolPtr pool;
+	ApplicationPool::Ptr pool;
 	
 	/** This client's password. */
 	string password;
 	
-	/** Whether privilege lowering should be used. */
-	bool lowerPrivilege;
-	
-	/** The user that spawned processes should run as, if initial attempt
-	 * at privilege lowering failed. */
-	string lowestUser;
+	string defaultUser;
+	string defaultGroup;
 	
 	/** The server socket file descriptor. */
 	int serverSocket;
 	
+	/** The analytics logger to use. */
+	AnalyticsLoggerPtr analyticsLogger;
+	
 	/** This client's thread. */
 	oxt::thread *thr;
 	
+	/** A timer for measuring how long this worker thread has been doing
+	 * nothing (i.e. waiting for a connection).
+	 */
+	Timer inactivityTimer;
+	
 	/**
 	 * Attempts to accept a connection made by the client.
 	 *
@@ -191,7 +172,7 @@ private:
 	
 	/**
 	 * Reads and checks the password of a client message channel identified by the given file descriptor.
-	 * The HelperServer makes extensive use of Unix Sockets that would normally allow other processes to
+	 * The HelperAgent makes extensive use of Unix Sockets that would normally allow other processes to
 	 * connect to it as well. In our case, we just want to limit this to Nginx and it is for this reason
 	 * that we've secured communication channels between this server and its clients with passwords.
 	 * This method indicates whether or not the password of this client channel matches the one known to
@@ -205,7 +186,7 @@ private:
 	bool readAndCheckPassword(FileDescriptor &fd) {
 		TRACE_POINT();
 		MessageChannel channel(fd);
-		char buf[HELPER_SERVER_PASSWORD_SIZE];
+		char buf[REQUEST_SOCKET_PASSWORD_SIZE];
 		
 		if (channel.readRaw(buf, sizeof(buf))) {
 			const char *password_data;
@@ -247,7 +228,13 @@ private:
 		} while (parser.acceptingInput());
 
 		if (parser.getState() != ScgiRequestParser::DONE) {
-			P_ERROR("Invalid SCGI header received.");
+			if (parser.getState() == ScgiRequestParser::ERROR
+			 && parser.getErrorReason() == ScgiRequestParser::LIMIT_REACHED) {
+				P_ERROR("SCGI header too large.");
+			} else {
+				P_ERROR("Invalid SCGI header received: " <<
+					cEscapeString(parser.getHeaderData()));
+			}
 			return false;
 		} else if (!parser.hasHeader("DOCUMENT_ROOT")) {
 			P_ERROR("DOCUMENT_ROOT header is missing.");
@@ -273,7 +260,7 @@ private:
 	 * @throws SystemException Request body could not be read from the specified
 	 *   <tt>clientFd</tt>.
 	 */
-	void sendRequestBody(Application::SessionPtr &session,
+	void sendRequestBody(SessionPtr &session,
 	                     FileDescriptor &clientFd,
 	                     const string &partialRequestBody,
 	                     unsigned long contentLength) {
@@ -326,7 +313,7 @@ private:
 	 *                                     before we were able to send back the
 	 *                                     full response.
 	 */
-	void forwardResponse(Application::SessionPtr &session, FileDescriptor &clientFd) {
+	void forwardResponse(SessionPtr &session, FileDescriptor &clientFd) {
 		TRACE_POINT();
 		HttpStatusExtractor ex;
 		int stream = session->getStream();
@@ -402,25 +389,34 @@ private:
 	 *   spawn exception <tt>e</tt> to.
 	 * @param e The spawn exception to be written to the given <tt>fd</tt>'s message
 	 *   channel.
+	 * @param friendly Whether to show a friendly error page.
 	 */
-	void handleSpawnException(FileDescriptor &fd, const SpawnException &e) {
+	void handleSpawnException(FileDescriptor &fd, const SpawnException &e, bool friendly) {
 		MessageChannel channel(fd);
 		channel.writeRaw("HTTP/1.1 500 Internal Server Error\x0D\x0A");
 		channel.writeRaw("Status: 500 Internal Server Error\x0D\x0A");
 		channel.writeRaw("Connection: close\x0D\x0A");
 		channel.writeRaw("Content-Type: text/html; charset=utf-8\x0D\x0A");
 		
-		if (e.hasErrorPage()) {
-			channel.writeRaw("Content-Length: " +
-				toString(e.getErrorPage().size()) +
-				"\x0D\x0A");
-			channel.writeRaw("\x0D\x0A");
-			channel.writeRaw(e.getErrorPage());
+		if (friendly) {
+			if (e.hasErrorPage()) {
+				channel.writeRaw("Content-Length: " +
+					toString(e.getErrorPage().size()) +
+					"\x0D\x0A");
+				channel.writeRaw("\x0D\x0A");
+				channel.writeRaw(e.getErrorPage());
+			} else {
+				channel.writeRaw("Content-Length: " +
+					toString(strlen(e.what())) + "\x0D\x0A");
+				channel.writeRaw("\x0D\x0A");
+				channel.writeRaw(e.what());
+			}
 		} else {
+			const char body[] = "<h1>Internal Server Error (500)</h1>";
 			channel.writeRaw("Content-Length: " +
-				toString(strlen(e.what())) + "\x0D\x0A");
+				toString(strlen(body)) + "\x0D\x0A");
 			channel.writeRaw("\x0D\x0A");
-			channel.writeRaw(e.what());
+			channel.writeRaw(body);
 		}
 	}
 	
@@ -431,9 +427,8 @@ private:
 	 */
 	void handleRequest(FileDescriptor &clientFd) {
 		TRACE_POINT();
-		ScgiRequestParser parser;
+		ScgiRequestParser parser(MAX_HEADER_SIZE);
 		string partialRequestBody;
-		unsigned long contentLength;
 		
 		if (!readAndCheckPassword(clientFd)) {
 			P_ERROR("Client did not send a correct password.");
@@ -444,57 +439,147 @@ private:
 		}
 		
 		try {
+			bool enableAnalytics = parser.getHeader("PASSENGER_ANALYTICS") == "true";
+			StaticString appGroupName = parser.getHeader("PASSENGER_APP_GROUP_NAME");
 			PoolOptions options;
+			
 			if (parser.getHeader("SCRIPT_NAME").empty()) {
 				options.appRoot = extractDirName(parser.getHeader("DOCUMENT_ROOT"));
 			} else {
 				options.appRoot = extractDirName(resolveSymlink(parser.getHeader("DOCUMENT_ROOT")));
 				options.baseURI = parser.getHeader("SCRIPT_NAME");
 			}
+			if (appGroupName.empty()) {
+				options.appGroupName = options.appRoot;
+			} else {
+				options.appGroupName = appGroupName;
+			}
 			options.useGlobalQueue = parser.getHeader("PASSENGER_USE_GLOBAL_QUEUE") == "true";
 			options.environment    = parser.getHeader("PASSENGER_ENVIRONMENT");
 			options.spawnMethod    = parser.getHeader("PASSENGER_SPAWN_METHOD");
-			options.lowerPrivilege = lowerPrivilege;
-			options.lowestUser     = lowestUser;
+			options.user           = parser.getHeader("PASSENGER_USER");
+			options.group          = parser.getHeader("PASSENGER_GROUP");
+			options.defaultUser    = defaultUser;
+			options.defaultGroup   = defaultGroup;
 			options.appType        = parser.getHeader("PASSENGER_APP_TYPE");
+			options.rights         = Account::parseRightsString(
+				parser.getHeader("PASSENGER_APP_RIGHTS"),
+				DEFAULT_BACKEND_ACCOUNT_RIGHTS);
+			options.minProcesses   = atol(parser.getHeader("PASSENGER_MIN_INSTANCES"));
 			options.frameworkSpawnerTimeout = atol(parser.getHeader("PASSENGER_FRAMEWORK_SPAWNER_IDLE_TIME"));
 			options.appSpawnerTimeout       = atol(parser.getHeader("PASSENGER_APP_SPAWNER_IDLE_TIME"));
+			options.debugger       = parser.getHeader("PASSENGER_DEBUGGER") == "true";
+			options.showVersionInHeader = parser.getHeader("PASSENGER_SHOW_VERSION_IN_HEADER") == "true";
 			
-			try {
-				Application::SessionPtr session(pool->get(options));
+			UPDATE_TRACE_POINT();
+			AnalyticsLogPtr log;
+			if (enableAnalytics) {
+				log = analyticsLogger->newTransaction(
+					options.getAppGroupName(),
+					"requests",
+					parser.getHeader("PASSENGER_UNION_STATION_KEY"));
+				options.analytics = true;
+				options.log = log;
+			} else {
+				log.reset(new AnalyticsLog());
+			}
 			
-				UPDATE_TRACE_POINT();
-				session->sendHeaders(parser.getHeaderData().c_str(),
-					parser.getHeaderData().size());
+			AnalyticsScopeLog requestProcessingScope(log, "request processing");
+			log->message("URI: " + parser.getHeader("REQUEST_URI"));
 			
-				contentLength = atol(
-					parser.getHeader("CONTENT_LENGTH").c_str());
-				sendRequestBody(session,
-					clientFd,
-					partialRequestBody,
-					contentLength);
+			/***********************/
+			/***********************/
 			
-				session->shutdownWriter();
+			try {
+				SessionPtr session;
+				
+				{
+					AnalyticsScopeLog scope(log, "get from pool");
+					session = pool->get(options);
+					scope.success();
+					log->message("Application PID: " + toString(session->getPid()) +
+						" (GUPID: " + session->getGupid() + ")");
+				}
+				
+				UPDATE_TRACE_POINT();
+				AnalyticsScopeLog requestProxyingScope(log, "request proxying");
+				
+				char headers[parser.getHeaderData().size() +
+					sizeof("PASSENGER_CONNECT_PASSWORD") +
+					session->getConnectPassword().size() + 1 +
+					sizeof("PASSENGER_GROUP_NAME") +
+					options.getAppGroupName().size() + 1 +
+					sizeof("PASSENGER_TXN_ID") +
+					log->getTxnId().size() + 1];
+				char *end = headers;
+				
+				memcpy(end, parser.getHeaderData().c_str(), parser.getHeaderData().size());
+				end += parser.getHeaderData().size();
+				
+				memcpy(end, "PASSENGER_CONNECT_PASSWORD", sizeof("PASSENGER_CONNECT_PASSWORD"));
+				end += sizeof("PASSENGER_CONNECT_PASSWORD");
+				
+				memcpy(end, session->getConnectPassword().c_str(),
+					session->getConnectPassword().size() + 1);
+				end += session->getConnectPassword().size() + 1;
+				
+				if (enableAnalytics) {
+					memcpy(end, "PASSENGER_GROUP_NAME", sizeof("PASSENGER_GROUP_NAME"));
+					end += sizeof("PASSENGER_GROUP_NAME");
+					
+					memcpy(end, options.getAppGroupName().c_str(),
+						options.getAppGroupName().size() + 1);
+					end += options.getAppGroupName().size() + 1;
+					
+					memcpy(end, "PASSENGER_TXN_ID", sizeof("PASSENGER_TXN_ID"));
+					end += sizeof("PASSENGER_TXN_ID");
+					
+					memcpy(end, log->getTxnId().c_str(),
+						log->getTxnId().size() + 1);
+					end += log->getTxnId().size() + 1;
+				}
+				
+				{
+					AnalyticsScopeLog scope(log, "send request headers");
+					session->sendHeaders(headers, end - headers);
+					scope.success();
+				}
+				{
+					AnalyticsScopeLog scope(log, "send request body");
+					unsigned long contentLength = atol(
+						parser.getHeader("CONTENT_LENGTH").c_str());
+					sendRequestBody(session,
+						clientFd,
+						partialRequestBody,
+						contentLength);
+					session->shutdownWriter();
+					scope.success();
+				}
+				
 				forwardResponse(session, clientFd);
+				
+				requestProxyingScope.success();
 			} catch (const SpawnException &e) {
-				handleSpawnException(clientFd, e);
+				handleSpawnException(clientFd, e,
+					parser.getHeader("PASSENGER_FRIENDLY_ERROR_PAGES") == "true");
 			} catch (const ClientDisconnectedException &) {
 				P_WARN("Couldn't forward the HTTP response back to the HTTP client: "
 					"It seems the user clicked on the 'Stop' button in his "
 					"browser.");
 			}
+			
+			requestProcessingScope.success();
+			clientFd.close();
 		} catch (const boost::thread_interrupted &) {
 			throw;
 		} catch (const tracable_exception &e) {
 			P_ERROR("Uncaught exception in PassengerServer client thread:\n"
 				<< "   exception: " << e.what() << "\n"
 				<< "   backtrace:\n" << e.backtrace());
-		} catch (const exception &e) {
+		} catch (const std::exception &e) {
 			P_ERROR("Uncaught exception in PassengerServer client thread:\n"
 				<< "   exception: " << e.what() << "\n"
 				<< "   backtrace: not available");
-		} catch (...) {
-			P_ERROR("Uncaught unknown exception in PassengerServer client thread.");
 		}
 	}
 	
@@ -510,7 +595,9 @@ private:
 		try {
 			while (true) {
 				UPDATE_TRACE_POINT();
+				inactivityTimer.start();
 				FileDescriptor fd(acceptConnection());
+				inactivityTimer.stop();
 				handleRequest(fd);
 			}
 		} catch (const boost::thread_interrupted &) {
@@ -520,14 +607,10 @@ private:
 				<< "   exception: " << e.what() << "\n"
 				<< "   backtrace:\n" << e.backtrace());
 			abort();
-		} catch (const exception &e) {
+		} catch (const std::exception &e) {
 			P_ERROR("Uncaught exception in PassengerServer client thread:\n"
 				<< "   exception: " << e.what() << "\n"
 				<< "   backtrace: not available");
-			abort();
-		} catch (...) {
-			P_ERROR("Uncaught unknown exception in PassengerServer client thread.");
-			throw;
 		}
 	}
 	
@@ -540,20 +623,21 @@ public:
 	 * @param pool The application pool where this client belongs to.
 	 * @param password The password that is required to connect to this client handler.
 	 *   This value is determined and assigned by the server.
-	 * @param lowerPrivilege Whether privilege lowering should be used.
-	 * @param lowestUser The user that spawned processes should run as, if
-	 *   initial attempt at privilege lowering failed.
 	 * @param serverSocket The server socket to accept this clients connection from.
 	 */
-	Client(unsigned int number, StandardApplicationPoolPtr &pool,
-	       const string &password, bool lowerPrivilege,
-	       const string &lowestUser, int serverSocket) {
+	Client(unsigned int number, ApplicationPool::Ptr pool,
+	       const string &password, const string &defaultUser,
+	       const string &defaultGroup, int serverSocket,
+	       const AnalyticsLoggerPtr &logger)
+		: inactivityTimer(false)
+	{
 		this->number = number;
 		this->pool = pool;
 		this->password = password;
-		this->lowerPrivilege = lowerPrivilege;
-		this->lowestUser = lowestUser;
+		this->defaultUser = defaultUser;
+		this->defaultGroup = defaultGroup;
 		this->serverSocket = serverSocket;
+		this->analyticsLogger = logger;
 		thr = new oxt::thread(
 			bind(&Client::threadMain, this),
 			"Client thread " + toString(number),
@@ -569,9 +653,23 @@ public:
 		this_thread::disable_syscall_interruption dsi;
 		this_thread::disable_interruption di;
 		
-		thr->interrupt_and_join();
+		if (thr->joinable()) {
+			thr->interrupt_and_join();
+		}
 		delete thr;
 	}
+	
+	oxt::thread *getThread() const {
+		return thr;
+	}
+	
+	unsigned long long inactivityTime() const {
+		return inactivityTimer.elapsed();
+	}
+	
+	void resetInactivityTimer() {
+		inactivityTimer.start();
+	}
 };
 
 typedef shared_ptr<Client> ClientPtr;
@@ -583,33 +681,45 @@ typedef shared_ptr<Client> ClientPtr;
  */
 class Server {
 private:
-	string password;
-	int adminPipe;
-	int serverSocket;
+	static const int MESSAGE_SERVER_THREAD_STACK_SIZE = 64 * 128;
+	
+	FileDescriptor feedbackFd;
 	bool userSwitching;
 	string defaultUser;
+	string defaultGroup;
 	unsigned int numberOfThreads;
+	FileDescriptor requestSocket;
+	string requestSocketPassword;
+	MessageChannel feedbackChannel;
+	ServerInstanceDir serverInstanceDir;
+	ServerInstanceDir::GenerationPtr generation;
 	set<ClientPtr> clients;
-	StandardApplicationPoolPtr pool;
-	shared_ptr<ApplicationPoolStatusReporter> reporter;
+	AnalyticsLoggerPtr analyticsLogger;
+	ApplicationPool::Ptr pool;
+	AccountsDatabasePtr accountsDatabase;
+	MessageServerPtr messageServer;
+	ResourceLocator resourceLocator;
+	shared_ptr<oxt::thread> prestarterThread;
+	shared_ptr<oxt::thread> messageServerThread;
+	EventFd exitEvent;
+	
+	string getRequestSocketFilename() const {
+		return generation->getPath() + "/request.socket";
+	}
 	
 	/**
-	 * Starts listening for client connections from this server's <tt>serverSocket</tt>.
-	 * This server will first attempt to create an unconnected Unix socket on which it will
-	 * attempt to bind on. Once it is bound, it will start listening for incoming client
-	 * activity.
+	 * Starts listening for client connections on this server's request socket.
 	 *
 	 * @throws SystemException Something went wrong while trying to create and bind to the Unix socket.
 	 * @throws RuntimeException Something went wrong.
 	 */
 	void startListening() {
 		this_thread::disable_syscall_interruption dsi;
-		string socketName = getPassengerTempDir() + "/master/helper_server.sock";
-		serverSocket = createUnixServer(socketName.c_str());
+		requestSocket = createUnixServer(getRequestSocketFilename().c_str());
 		
 		int ret;
 		do {
-			ret = chmod(socketName.c_str(), S_ISVTX |
+			ret = chmod(getRequestSocketFilename().c_str(), S_ISVTX |
 				S_IRUSR | S_IWUSR | S_IXUSR |
 				S_IRGRP | S_IWGRP | S_IXGRP |
 				S_IROTH | S_IWOTH | S_IXOTH);
@@ -624,183 +734,217 @@ private:
 	 */
 	void startClientHandlerThreads() {
 		for (unsigned int i = 0; i < numberOfThreads; i++) {
-			ClientPtr client(new Client(i + 1, pool, password,
-				userSwitching, defaultUser, serverSocket));
+			ClientPtr client(new Client(i + 1, pool, requestSocketPassword,
+				defaultUser, defaultGroup, requestSocket,
+				analyticsLogger));
 			clients.insert(client);
 		}
 	}
 	
 	/**
-	 * Lowers this process's privilege to that of <em>username</em>.
+	 * Lowers this process's privilege to that of <em>username</em> and <em>groupname</em>.
 	 */
-	void lowerPrivilege(const string &username) {
-		struct passwd *entry;
+	void lowerPrivilege(const string &username, const string &groupname) {
+		struct passwd *userEntry;
+		struct group  *groupEntry;
+		int            e;
 		
-		entry = getpwnam(username.c_str());
-		if (entry != NULL) {
-			if (initgroups(username.c_str(), entry->pw_gid) != 0) {
-				int e = errno;
-				P_WARN("WARNING: Unable to lower Passenger HelperServer's "
-					"privilege to that of user '" << username <<
-					"': cannot set supplementary groups for this "
-					"user: " << strerror(e) << " (" << e << ")");
-			}
-			if (setgid(entry->pw_gid) != 0) {
-				int e = errno;
-				P_WARN("WARNING: Unable to lower Passenger HelperServer's "
-					"privilege to that of user '" << username <<
-					"': cannot set group ID: " << strerror(e) <<
-					" (" << e << ")");
-			}
-			if (setuid(entry->pw_uid) != 0) {
-				int e = errno;
-				P_WARN("WARNING: Unable to lower Passenger HelperServer's "
-					"privilege to that of user '" << username <<
-					"': cannot set user ID: " << strerror(e) <<
-					" (" << e << ")");
-			}
-		} else {
-			P_WARN("WARNING: Unable to lower Passenger HelperServer's "
-				"privilege to that of user '" << username <<
+		userEntry = getpwnam(username.c_str());
+		if (userEntry == NULL) {
+			throw NonExistentUserException(string("Unable to lower Passenger "
+				"HelperAgent's privilege to that of user '") + username +
+				"': user does not exist.");
+		}
+		groupEntry = getgrnam(groupname.c_str());
+		if (groupEntry == NULL) {
+			throw NonExistentGroupException(string("Unable to lower Passenger "
+				"HelperAgent's privilege to that of user '") + username +
 				"': user does not exist.");
 		}
+		
+		if (initgroups(username.c_str(), userEntry->pw_gid) != 0) {
+			e = errno;
+			throw SystemException(string("Unable to lower Passenger HelperAgent's "
+				"privilege to that of user '") + username +
+				"': cannot set supplementary groups for this user", e);
+		}
+		if (setgid(groupEntry->gr_gid) != 0) {
+			e = errno;
+			throw SystemException(string("Unable to lower Passenger HelperAgent's "
+				"privilege to that of user '") + username +
+				"': cannot set group ID", e);
+		}
+		if (setuid(userEntry->pw_uid) != 0) {
+			e = errno;
+			throw SystemException(string("Unable to lower Passenger HelperAgent's "
+				"privilege to that of user '") + username +
+				"': cannot set user ID", e);
+		}
 	}
-
+	
+	void resetWorkerThreadInactivityTimers() {
+		set<ClientPtr>::iterator it;
+		
+		for (it = clients.begin(); it != clients.end(); it++) {
+			ClientPtr client = *it;
+			client->resetInactivityTimer();
+		}
+	}
+	
+	unsigned long long minWorkerThreadInactivityTime() const {
+		set<ClientPtr>::const_iterator it;
+		unsigned long long result = 0;
+		
+		for (it = clients.begin(); it != clients.end(); it++) {
+			ClientPtr client = *it;
+			unsigned long long inactivityTime = client->inactivityTime();
+			if (inactivityTime < result || it == clients.begin()) {
+				result = inactivityTime;
+			}
+		}
+		return result;
+	}
+	
 public:
-	/**
-	 * Creates a server instance based on the given parameters, which starts to listen
-	 * for clients.
-	 *
-	 * @param password The password this server uses for its clients.
-	 * @param rootDir The Passenger root folder.
-	 * @param ruby The filename of the Ruby interpreter to use.
-	 * @param adminPipe The pipe that is used to receive this Server's password and to see if Nginx
-	 *   has exited.
-	 * @param feedbackPipe The feedback pipe, used for telling the web server that we're done
-	 *   initializing.
-	 * @param maxPoolSize The maximum number of simultaneously alive application instances.
-	 * @param maxInstancesPerApp The maximum number of simultaneously alive Rails instances that
-	 *   a single Rails application may occupy.
-	 * @param poolIdleTime The maximum number of seconds that an application may be idle before
-	 *   it gets terminated.
-	 * @param userSwitching Whether user switching should be used.
-	 * @param defaultUser If user switching is turned on, then this is the
-	 *   username that a process should lower its privilege to if the
-	 *   initial attempt at user switching fails. If user switching is off,
-	 *   then this is the username that HelperServer and all spawned
-	 *   processes should run as.
-	 * @param workerUid The UID of the web server's worker processes. Used for determining
-	 *   the optimal permissions for some temp files.
-	* @param workerGid The GID of the web server's worker processes. Used for determining
-	 *   the optimal permissions for some temp files.
-	 */
-	Server(const string &password, const string &rootDir, const string &ruby,
-	       int adminPipe, int feedbackPipe, unsigned int maxPoolSize,
-	       unsigned int maxInstancesPerApp, unsigned int poolIdleTime,
-	       bool userSwitching, const string &defaultUser, uid_t workerUid,
-	       gid_t workerGid) {
-		this->password      = password;
-		this->adminPipe     = adminPipe;
+	Server(FileDescriptor feedbackFd, pid_t webServerPid, const string &tempDir,
+		bool userSwitching, const string &defaultUser, const string &defaultGroup,
+		const string &passengerRoot, const string &rubyCommand, unsigned int generationNumber,
+		unsigned int maxPoolSize, unsigned int maxInstancesPerApp, unsigned int poolIdleTime,
+		const VariantMap &options)
+		: serverInstanceDir(webServerPid, tempDir, false),
+		  resourceLocator(passengerRoot)
+	{
+		string messageSocketPassword;
+		string loggingAgentPassword;
+		
+		TRACE_POINT();
+		this->feedbackFd    = feedbackFd;
 		this->userSwitching = userSwitching;
 		this->defaultUser   = defaultUser;
+		this->defaultGroup  = defaultGroup;
+		feedbackChannel     = MessageChannel(feedbackFd);
 		numberOfThreads     = maxPoolSize * 4;
 		
-		removeDirTree(getPassengerTempDir());
-		createPassengerTempDir(getSystemTempDir(), userSwitching, defaultUser,
-			workerUid, workerGid);
+		UPDATE_TRACE_POINT();
+		requestSocketPassword = Base64::decode(options.get("request_socket_password"));
+		messageSocketPassword = Base64::decode(options.get("message_socket_password"));
+		loggingAgentPassword  = options.get("logging_agent_password");
+		generation = serverInstanceDir.getGeneration(generationNumber);
 		startListening();
+		accountsDatabase = AccountsDatabase::createDefault(generation,
+			userSwitching, defaultUser, defaultGroup);
+		accountsDatabase->add("_web_server", messageSocketPassword, false, Account::EXIT);
+		messageServer = ptr(new MessageServer(generation->getPath() + "/socket", accountsDatabase));
 		
-		if (!userSwitching && geteuid() == 0) {
-			lowerPrivilege(defaultUser);
+		if (geteuid() == 0 && !userSwitching) {
+			lowerPrivilege(defaultUser, defaultGroup);
 		}
 		
-		pool = ptr(new StandardApplicationPool(
-			rootDir + "/bin/passenger-spawn-server",
-			"", ruby
+		UPDATE_TRACE_POINT();
+		analyticsLogger = ptr(new AnalyticsLogger(options.get("logging_agent_address"),
+			"logging", loggingAgentPassword));
+		
+		pool = ptr(new ApplicationPool::Pool(
+			resourceLocator.getSpawnServerFilename(), generation,
+			accountsDatabase, rubyCommand,
+			analyticsLogger,
+			options.getInt("log_level"),
+			options.get("debug_log_file", false)
 		));
 		pool->setMax(maxPoolSize);
 		pool->setMaxPerApp(maxInstancesPerApp);
 		pool->setMaxIdleTime(poolIdleTime);
 		
-		reporter = ptr(new ApplicationPoolStatusReporter(pool, userSwitching,
-				S_IRUSR | S_IWUSR));
+		messageServer->addHandler(ptr(new ApplicationPool::Server(pool)));
+		messageServer->addHandler(ptr(new BacktracesServer()));
+		messageServer->addHandler(ptr(new ExitHandler(exitEvent)));
+		
+		UPDATE_TRACE_POINT();
+		feedbackChannel.write("initialized",
+			getRequestSocketFilename().c_str(),
+			messageServer->getSocketFilename().c_str(),
+			NULL);
 		
-		// Tell the web server that we're done initializing.
-		syscalls::close(feedbackPipe);
+		prestarterThread = ptr(new oxt::thread(
+			boost::bind(prestartWebApps, resourceLocator, options.get("prestart_urls"))
+		));
 	}
 	
 	~Server() {
 		TRACE_POINT();
 		this_thread::disable_syscall_interruption dsi;
 		this_thread::disable_interruption di;
+		oxt::thread *threads[clients.size()];
+		set<ClientPtr>::iterator it;
+		unsigned int i = 0;
 		
-		P_DEBUG("Shutting down helper server...");
+		P_DEBUG("Shutting down helper agent...");
+		prestarterThread->interrupt_and_join();
+		if (messageServerThread != NULL) {
+			messageServerThread->interrupt_and_join();
+		}
+		
+		for (it = clients.begin(); it != clients.end(); it++, i++) {
+			ClientPtr client = *it;
+			threads[i] = client->getThread();
+		}
+		oxt::thread::interrupt_and_join_multiple(threads, clients.size());
 		clients.clear();
+		
 		P_TRACE(2, "All threads have been shut down.");
-		syscalls::close(serverSocket);
-		syscalls::close(adminPipe);
 	}
 	
-	/**
-	 * Starts this server by starting the client handlers threads.
-	 *
-	 * @see startCientHandlerThreads
-	 */
-	void start() {
+	void mainLoop() {
 		TRACE_POINT();
-		char buf;
 		
 		startClientHandlerThreads();
+		messageServerThread = ptr(new oxt::thread(
+			boost::bind(&MessageServer::mainLoop, messageServer.get()),
+			"MessageServer thread", MESSAGE_SERVER_THREAD_STACK_SIZE
+		));
 		
-		try {
-			// Wait until the web server has exited.
-			syscalls::read(adminPipe, &buf, 1);
-		} catch (const boost::thread_interrupted &) {
-			// Do nothing.
+		/* Wait until the watchdog closes the feedback fd (meaning it
+		 * was killed) or until we receive an exit message.
+		 */
+		this_thread::disable_syscall_interruption dsi;
+		fd_set fds;
+		int largestFd;
+		
+		FD_ZERO(&fds);
+		FD_SET(feedbackFd, &fds);
+		FD_SET(exitEvent.fd(), &fds);
+		largestFd = (feedbackFd > exitEvent.fd()) ? (int) feedbackFd : exitEvent.fd();
+		UPDATE_TRACE_POINT();
+		if (syscalls::select(largestFd + 1, &fds, NULL, NULL, NULL) == -1) {
+			int e = errno;
+			throw SystemException("select() failed", e);
+		}
+		
+		if (FD_ISSET(feedbackFd, &fds)) {
+			/* If the watchdog has been killed then we'll kill all descendant
+			 * processes and exit. There's no point in keeping this helper
+			 * server running because we can't detect when the web server exits,
+			 * and because this helper agent doesn't own the server instance
+			 * directory. As soon as passenger-status is run, the server
+			 * instance directory will be cleaned up, making this helper agent
+			 * inaccessible.
+			 */
+			syscalls::killpg(getpgrp(), SIGKILL);
+			_exit(2); // In case killpg() fails.
+		} else {
+			/* We received an exit command. We want to exit 5 seconds after
+			 * all worker threads have become inactive.
+			 */
+			resetWorkerThreadInactivityTimers();
+			while (minWorkerThreadInactivityTime() < 5000) {
+				syscalls::usleep(250000);
+			}
 		}
 	}
 };
 
 /**
- * Ignores the SIGPIPE signal that in general is raised when a computer program attempts
- * to write to a pipe without a processes connected to the other end. This is used to
- * prevent Nginx from getting killed by the default signal handler when it attempts to
- * write the server password to the HelperServer in the situation that the HelperServer
- * failed to start.
- */
-static void
-ignoreSigpipe() {
-	struct sigaction action;
-	action.sa_handler = SIG_IGN;
-	action.sa_flags   = 0;
-	sigemptyset(&action.sa_mask);
-	sigaction(SIGPIPE, &action, NULL);
-}
-
-/**
- * Extracts and returns the password from the given <tt>adminPipe</tt>. This password is
- * used to determine which processes may connect with this server's Unix socket, as unix
- * sockets would normally allow any process to connect to it. In this case, we strictly
- * want Nginx to be able to connect to it, and it is for this reason that we maintain a
- * password system.
- *
- * @param adminPipe The pipe used to read the password for this server from.
- * @return The password for this server.
- */
-static string
-receivePassword(int adminPipe) {
-	TRACE_POINT();
-	MessageChannel channel(adminPipe);
-	char buf[HELPER_SERVER_PASSWORD_SIZE];
-	
-	if (!channel.readRaw(buf, HELPER_SERVER_PASSWORD_SIZE)) {
-		throw IOException("Could not read password from the admin pipe.");
-	}
-	return string(buf, HELPER_SERVER_PASSWORD_SIZE);
-}
-
-/**
- * Initializes and starts the helper server that is responsible for handling communication
+ * Initializes and starts the helper agent that is responsible for handling communication
  * between Nginx and the backend Rails processes.
  *
  * @see Server
@@ -809,48 +953,38 @@ receivePassword(int adminPipe) {
 int
 main(int argc, char *argv[]) {
 	TRACE_POINT();
+	VariantMap options = initializeAgent(argc, argv, "PassengerHelperAgent");
+	pid_t   webServerPid  = options.getPid("web_server_pid");
+	string  tempDir       = options.get("temp_dir");
+	bool    userSwitching = options.getBool("user_switching");
+	string  defaultUser   = options.get("default_user");
+	string  defaultGroup  = options.get("default_group");
+	string  passengerRoot = options.get("passenger_root");
+	string  rubyCommand   = options.get("ruby");
+	unsigned int generationNumber   = options.getInt("generation_number");
+	unsigned int maxPoolSize        = options.getInt("max_pool_size");
+	unsigned int maxInstancesPerApp = options.getInt("max_instances_per_app");
+	unsigned int poolIdleTime       = options.getInt("pool_idle_time");
+	
 	try {
-		setup_syscall_interruption_support();
-		ignoreSigpipe();
-		
-		string password;
-		string rootDir  = argv[1];
-		string ruby      = argv[2];
-		int adminPipe    = atoi(argv[3]);
-		int feedbackPipe = atoi(argv[4]);
-		int logLevel     = atoi(argv[5]);
-		int maxPoolSize  = atoi(argv[6]);
-		int maxInstancesPerApp = atoi(argv[7]);
-		int poolIdleTime       = atoi(argv[8]);
-		bool userSwitching = strcmp(argv[9], "1") == 0;
-		string defaultUser = argv[10];
-		uid_t workerUid    = (uid_t) atoll(argv[11]);
-		gid_t workerGid    = (gid_t) atoll(argv[12]);
-		string passengerTempDir = argv[13];
-		
-		setLogLevel(logLevel);
-		P_DEBUG("Passenger helper server started on PID " << getpid());
-		
-		setPassengerTempDir(passengerTempDir);
-		
-		password = receivePassword(adminPipe);
-		P_TRACE(2, "Password received.");
+		UPDATE_TRACE_POINT();
+		Server server(FEEDBACK_FD, webServerPid, tempDir,
+			userSwitching, defaultUser, defaultGroup,
+			passengerRoot, rubyCommand, generationNumber,
+			maxPoolSize, maxInstancesPerApp, poolIdleTime,
+			options);
+		P_DEBUG("Passenger helper agent started on PID " << getpid());
 		
-		Server(password, rootDir, ruby, adminPipe, feedbackPipe, maxPoolSize,
-			maxInstancesPerApp, poolIdleTime, userSwitching,
-			defaultUser, workerUid, workerGid).start();
+		UPDATE_TRACE_POINT();
+		server.mainLoop();
 	} catch (const tracable_exception &e) {
 		P_ERROR(e.what() << "\n" << e.backtrace());
 		return 1;
-	} catch (const exception &e) {
+	} catch (const std::exception &e) {
 		P_ERROR(e.what());
 		return 1;
-	} catch (...) {
-		P_ERROR("Unknown exception thrown in main thread.");
-		throw;
 	}
 	
-	P_TRACE(2, "Helper server exited.");
+	P_TRACE(2, "Helper agent exited.");
 	return 0;
 }
-