From dae1836dff5e5ec5b76f9b5fe0ab1becb599cb11 Mon Sep 17 00:00:00 2001
From: Travis Groth <travisgroth@users.noreply.github.com>
Date: Fri, 30 Apr 2021 15:30:40 -0400
Subject: [PATCH] internal/envoy: always extract envoy (#2160)

---
 internal/envoy/embed.go | 37 ++++++++++++++++++-------------------
 internal/envoy/envoy.go |  2 +-
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/internal/envoy/embed.go b/internal/envoy/embed.go
index 36a357246..07e05eef4 100644
--- a/internal/envoy/embed.go
+++ b/internal/envoy/embed.go
@@ -1,6 +1,7 @@
 package envoy
 
 import (
+	"context"
 	"fmt"
 	"io/fs"
 	"os"
@@ -8,13 +9,16 @@ import (
 
 	"github.com/natefinch/atomic"
 	resources "gopkg.in/cookieo9/resources-go.v2"
+
+	"github.com/pomerium/pomerium/internal/log"
 )
 
 const embeddedEnvoyPermissions fs.FileMode = 0o700
+const embeddedDirectoryPermissions fs.FileMode = 0o755
 
-var embeddedFilesDirectory = filepath.Join(os.TempDir(), "pomerium-embedded-files")
+var embeddedFilesBaseDirectory = filepath.Join(os.TempDir(), "pomerium-embedded-files")
 
-func extractEmbeddedEnvoy() (outPath string, err error) {
+func extractEmbeddedEnvoy(ctx context.Context) (outPath string, err error) {
 	exePath, err := resources.ExecutablePath()
 	if err != nil {
 		return "", fmt.Errorf("error finding executable path: %w", err)
@@ -31,24 +35,23 @@ func extractEmbeddedEnvoy() (outPath string, err error) {
 	}
 	defer rc.Close()
 
-	err = os.MkdirAll(embeddedFilesDirectory, 0o755)
+	// clean up our base directory before starting
+	err = os.RemoveAll(embeddedFilesBaseDirectory)
 	if err != nil {
-		return "", fmt.Errorf("error creating embedded file directory: (directory=%s): %w", embeddedFilesDirectory, err)
+		return "", fmt.Errorf("error cleaning embedded file directory: (directory=%s): %w", embeddedFilesBaseDirectory, err)
 	}
 
-	outPath = filepath.Join(embeddedFilesDirectory, "envoy")
-
-	// skip extraction if we already have it
-	var zfi os.FileInfo
-	if zf, ok := rc.(interface{ FileInfo() os.FileInfo }); ok {
-		zfi = zf.FileInfo()
-		if fi, e := os.Stat(outPath); e == nil {
-			if fi.Size() == zfi.Size() && fi.ModTime() == zfi.ModTime() && zfi.Mode().Perm() == embeddedEnvoyPermissions {
-				return outPath, nil
-			}
-		}
+	// create known directory base to clean at startup
+	err = os.MkdirAll(embeddedFilesBaseDirectory, embeddedDirectoryPermissions)
+	if err != nil {
+		return "", fmt.Errorf("error creating embedded file directory: (directory=%s): %w", embeddedFilesBaseDirectory, err)
 	}
 
+	// build a random temp directory inside our base directory to guarantee permissions
+	tmpDir, err := os.MkdirTemp(embeddedFilesBaseDirectory, "envoy-")
+	outPath = filepath.Join(tmpDir, "envoy")
+
+	log.Info(ctx).Str("path", outPath).Msg("extracting envoy binary")
 	err = atomic.WriteFile(outPath, rc)
 	if err != nil {
 		return "", fmt.Errorf("error extracting embedded envoy binary to temporary directory (path=%s): %w", outPath, err)
@@ -59,9 +62,5 @@ func extractEmbeddedEnvoy() (outPath string, err error) {
 		return "", fmt.Errorf("error chmoding embedded envoy binary: %w", err)
 	}
 
-	if zfi != nil {
-		_ = os.Chtimes(outPath, zfi.ModTime(), zfi.ModTime())
-	}
-
 	return outPath, nil
 }
diff --git a/internal/envoy/envoy.go b/internal/envoy/envoy.go
index af3f2a6b1..2471f3fe2 100644
--- a/internal/envoy/envoy.go
+++ b/internal/envoy/envoy.go
@@ -74,7 +74,7 @@ func NewServer(ctx context.Context, src config.Source, grpcPort, httpPort string
 		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
 	}
 
-	envoyPath, err := extractEmbeddedEnvoy()
+	envoyPath, err := extractEmbeddedEnvoy(ctx)
 	if err != nil {
 		log.Warn(ctx).Err(err).Send()
 		envoyPath = "envoy"