From f0777208d85fdd95d0d859a374c5e45464464fd1 Mon Sep 17 00:00:00 2001
From: Federico Di Pierro <nierro92@gmail.com>
Date: Tue, 23 Apr 2024 10:55:52 +0200
Subject: [PATCH] update(pkg/kernelrelease): update kernelrelease regex to
 match more kernels.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
---
 pkg/kernelrelease/kernelrelease.go      |  2 +-
 pkg/kernelrelease/kernelrelease_test.go | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/pkg/kernelrelease/kernelrelease.go b/pkg/kernelrelease/kernelrelease.go
index 2482af84..1b3a3ed1 100644
--- a/pkg/kernelrelease/kernelrelease.go
+++ b/pkg/kernelrelease/kernelrelease.go
@@ -25,7 +25,7 @@ import (
 )
 
 var (
-	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)([\.+~](0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
+	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>\d+|\d*[a-zA-Z-][0-9a-zA-Z-]*)([\.+~](\d+|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
 )
 
 const (
diff --git a/pkg/kernelrelease/kernelrelease_test.go b/pkg/kernelrelease/kernelrelease_test.go
index 851a27f5..75973940 100644
--- a/pkg/kernelrelease/kernelrelease_test.go
+++ b/pkg/kernelrelease/kernelrelease_test.go
@@ -234,6 +234,20 @@ func TestFromString(t *testing.T) {
 				FullExtraversion: "+deb10u4~bpo9+1",
 			},
 		},
+		// See https://github.com/falcosecurity/falco/issues/3172
+		"strange tencentos version": {
+			kernelVersionStr: "5.4.119-19.0009.28",
+			want: KernelRelease{
+				Fullversion: "5.4.119",
+				Version: semver.Version{
+					Major: 5,
+					Minor: 4,
+					Patch: 119,
+				},
+				Extraversion:     "19",
+				FullExtraversion: "-19.0009.28",
+			},
+		},
 	}
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {