fix(pkg/kernelrelease): fixed kernelrelease regex for weird COS kernels.

pkg/kernelrelease/kernelrelease.go

@@ -25,7 +25,7 @@ import (
 )
 
 var (
-	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>\d+|\d*[a-zA-Z-][0-9a-zA-Z-]*)([\.+~](\d+|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
+	kernelVersionPattern = regexp.MustCompile(`(?P<fullversion>^(?P<version>0|[1-9]\d*)\.(?P<patchlevel>0|[1-9]\d*)[.+]?(?P<sublevel>0|[1-9]\d*)?)(?P<fullextraversion>[-.+](?P<extraversion>\d+|\d*[a-zA-Z-][0-9a-zA-Z-]*)?([\.+~](\d+|\d*[a-zA-Z-][0-9a-zA-Z-_]*))*)?(\+[0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*)?$`)
 )
 
 const (

pkg/kernelrelease/kernelrelease_test.go

@@ -248,11 +248,26 @@ func TestFromString(t *testing.T) {
 				FullExtraversion: "-19.0009.28",
 			},
 		},
+		// See https://github.com/falcosecurity/falco/issues/3278
+		"strange cos version": {
+			kernelVersionStr: "5.15.146+",
+			want: KernelRelease{
+				Fullversion: "5.15.146",
+				Version: semver.Version{
+					Major: 5,
+					Minor: 15,
+					Patch: 146,
+				},
+				Extraversion:     "",
+				FullExtraversion: "+",
+			},
+		},
 	}
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
 			got := FromString(tt.kernelVersionStr)
 			assert.DeepEqual(t, tt.want, got)
+			assert.Equal(t, got.String(), tt.kernelVersionStr)
 		})
 	}
 }