From 5c896b1c75afc9b349d344d35c728cbe75c9178a Mon Sep 17 00:00:00 2001
From: Federico Di Pierro <nierro92@gmail.com>
Date: Mon, 9 Sep 2024 09:02:58 +0200
Subject: [PATCH] fix(pkg/kernelrelease): fixed kernelrelease regex for weird
 COS kernels.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
---
 pkg/kernelrelease/kernelrelease.go      |  2 +-
 pkg/kernelrelease/kernelrelease_test.go | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/pkg/kernelrelease/kernelrelease.go b/pkg/kernelrelease/kernelrelease.go
index 1b3a3ed1..fd16b722 100644
--- a/pkg/kernelrelease/kernelrelease.go
+++ b/pkg/kernelrelease/kernelrelease.go
@@ -25,7 +25,7 @@ import (
 )
 
 var (
-	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>\d+|\d*[a-zA-Z-][0-9a-zA-Z-]*)([\.+~](\d+|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
+	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>\d+|\d*[a-zA-Z-][0-9a-zA-Z-]*)?([\.+~](\d+|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
 )
 
 const (
diff --git a/pkg/kernelrelease/kernelrelease_test.go b/pkg/kernelrelease/kernelrelease_test.go
index 75973940..bffe314a 100644
--- a/pkg/kernelrelease/kernelrelease_test.go
+++ b/pkg/kernelrelease/kernelrelease_test.go
@@ -248,11 +248,26 @@ func TestFromString(t *testing.T) {
 				FullExtraversion: "-19.0009.28",
 			},
 		},
+		// See https://github.com/falcosecurity/falco/issues/3278
+		"strange cos version": {
+			kernelVersionStr: "5.15.146+",
+			want: KernelRelease{
+				Fullversion: "5.15.146",
+				Version: semver.Version{
+					Major: 5,
+					Minor: 15,
+					Patch: 146,
+				},
+				Extraversion:     "",
+				FullExtraversion: "+",
+			},
+		},
 	}
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
 			got := FromString(tt.kernelVersionStr)
 			assert.DeepEqual(t, tt.want, got)
+			assert.Equal(t, got.String(), tt.kernelVersionStr)
 		})
 	}
 }