tetragon/windows: Support multiple programs from a single collection

This PR changes the way programs are loaded on Windows in order to
support loading multiple programs from a single collection. Earlier
implementation assumed one program per collection.
In Windows, a collection can be loaded only once per process. In that light,
if a sensor had two programs from the same sys file, the loading of the second
program would fail, as loading the collection second time around fails.

In the PR, we cache loaded collections by path and check the cache before
loading a new collection. The second run will use the cached collection
object and load the passed in program.

Signed-off-by: Anadi Anadi<[email protected]>

Author: ExceptionalHandler

pkg/bpf/coll_windows.go

@@ -9,31 +9,40 @@ import (
 	"github.com/cilium/ebpf"
 )
 
-type CollectionStore struct {
-	collMap map[string]*ebpf.Collection
-}
-
 var (
-	store          CollectionStore
-	collstoreMutex sync.RWMutex
+	collectionByName map[string]*ebpf.Collection
+	collectionByPath map[string]*ebpf.Collection
+	collstoreMutex   sync.RWMutex
 )
 
-func SetCollection(name string, coll *ebpf.Collection) {
+func SetCollection(name string, path string, coll *ebpf.Collection) {
 	collstoreMutex.Lock()
-	store.collMap[name] = coll
-	collstoreMutex.Unlock()
+	defer collstoreMutex.Unlock()
+	collectionByName[name] = coll
+	collectionByPath[path] = coll
+}
+
+func GetCollectionByPath(path string) (*ebpf.Collection, error) {
+	collstoreMutex.RLock()
+	defer collstoreMutex.RUnlock()
+	coll, ok := collectionByPath[path]
+	if ok {
+		return coll, nil
+	}
+	return nil, errors.New("collection object not found by path")
 }
 
 func GetCollection(name string) (*ebpf.Collection, error) {
 	collstoreMutex.RLock()
-	coll, ok := store.collMap[name]
-	collstoreMutex.RUnlock()
+	defer collstoreMutex.RUnlock()
+	coll, ok := collectionByName[name]
 	if ok {
 		return coll, nil
 	}
 	return nil, errors.New("collection object not found")
 }
 
 func init() {
-	store.collMap = make(map[string]*ebpf.Collection)
+	collectionByName = make(map[string]*ebpf.Collection)
+	collectionByPath = make(map[string]*ebpf.Collection)
 }

pkg/sensors/program/loader_windows.go

@@ -123,12 +123,15 @@ func doLoadProgram(
 	_ int,
 ) (*LoadedCollection, error) {
 
-	coll, err := ebpf.LoadCollection(load.Name)
+	coll, err := bpf.GetCollectionByPath(load.Name)
 	if err != nil {
-		logger.GetLogger().WithError(err).WithField("Error ", err.Error()).Warn(" Failed to load Native Windows Collection ")
-		return nil, err
+		coll, err = ebpf.LoadCollection(load.Name)
+		if err != nil {
+			logger.GetLogger().WithError(err).WithField("Error ", err.Error()).Warn(" Failed to load Native Windows Collection ")
+			return nil, err
+		}
+		bpf.SetCollection(load.Label, load.Name, coll)
 	}
-	bpf.SetCollection(load.Label, coll)
 
 	collMaps := map[ebpf.MapID]*ebpf.Map{}
 	// we need a mapping by ID
@@ -165,7 +168,6 @@ func doLoadProgram(
 
 	var prog *ebpf.Program
 	for _, p := range coll.Programs {
-
 		i, err := p.Info()
 		if i.Name == load.Label {
 			prog = p