From 7d42b145399b312950ae7c4a63d4552959d7e83b Mon Sep 17 00:00:00 2001
From: Akhilarka Jayanthi <akhilarkaj@andromedasecurity.com>
Date: Thu, 9 May 2024 10:09:25 +0530
Subject: [PATCH] add user agent 'aws-sdk-go-v2' to regex file

---
 regexes.yaml       | 21 ++++++++++++++++++++-
 tests/test_os.yaml | 22 ++++++++++++++++++++++
 tests/test_ua.yaml |  6 ++++++
 3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/regexes.yaml b/regexes.yaml
index 14412307..b98b5a53 100644
--- a/regexes.yaml
+++ b/regexes.yaml
@@ -152,7 +152,7 @@ user_agent_parsers:
 
   # AWS S3 Clients
   # must come before "Bots General matcher" to catch "boto"/"boto3" before "bot"
-  - regex: '\b(Boto3?|JetS3t|aws-(?:cli|sdk-(?:cpp|go|java|nodejs|ruby2?|dotnet-(?:\d{1,2}|core)))|s3fs)/(\d+)\.(\d+)(?:\.(\d+)|)'
+  - regex: '\b(Boto3?|JetS3t|aws-(?:cli|sdk-(?:cpp|go|go-v\d|java|nodejs|ruby2?|dotnet-(?:\d{1,2}|core)))|s3fs)/(\d+)\.(\d+)(?:\.(\d+)|)'
 
   # SAFE FME
   - regex: '(FME)\/(\d+\.\d+)\.(\d+)\.(\d+)'
@@ -1360,6 +1360,13 @@ os_parsers:
   # Box Drive and Box Sync on Mac OS X use OSX version numbers, not Darwin
   - regex: '^Box.{0,200};(Darwin)/(10)\.(1\d)(?:\.(\d+)|)'
     os_replacement: 'Mac OS X'
+  
+  ##########
+  # Hashicorp API
+  # APN/1.0 HashiCorp/1.0 Terraform/1.8.0 (+https://www.terraform.io) terraform-provider-aws/4.67.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.261 (go1.19.8; darwin; arm64)
+  ##########
+  - regex: 'darwin; arm64'
+    os_replacement: 'Mac OS X'
 
   ##########
   # iOS
@@ -1868,6 +1875,18 @@ os_parsers:
   # Roku Digital-Video-Players https://www.roku.com/
   - regex: '^(Roku)/DVP-(\d+)\.(\d+)'
 
+  ##########
+  # Amazon S3 client boto3
+  # Hasicorp API
+  # Boto3/1.28.62 md/Botocore#1.31.62 ua/2.0 os/macos#22.4.0 md/arch#arm64 lang/python#3.11.6 md/pyimpl#CPython cfg/retry-mode#legacy Botocore/1.31.62
+  # APN/1.0 HashiCorp/1.0 Terraform/1.8.1 (+https://www.terraform.io) terraform-provider-aws/4.67.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.18.0 os/macos lang/go/1.19.8 md/GOOS/darwin md/GOARCH/arm64 api/identitystore/1.16.11
+  ##########
+  - regex: 'os\/macos[#]?(\d*)[.]?(\d*)[.]?(\d*)'
+    os_replacement: 'Mac OS X'
+    os_v1_replacement: '$1'
+    os_v2_replacement: '$2'
+    os_v3_replacement: '$3'
+
 device_parsers:
 
   #########
diff --git a/tests/test_os.yaml b/tests/test_os.yaml
index 5fbf17a7..c3b293ce 100644
--- a/tests/test_os.yaml
+++ b/tests/test_os.yaml
@@ -3237,3 +3237,25 @@ test_cases:
     minor: '1'
     patch: '1'
     patch_minor:
+  
+  - user_agent_string: 'Boto3/1.28.62 md/Botocore#1.31.62 ua/2.0 os/macos#22.4.0 md/arch#arm64 lang/python#3.11.6 md/pyimpl#CPython cfg/retry-mode#legacy Botocore/1.31.62'
+    family: 'Mac OS X'
+    major: '22'
+    minor: '4'
+    patch: '0'
+    patch_minor:
+  
+  - user_agent_string: 'APN/1.0 HashiCorp/1.0 Terraform/1.8.1 (+https://www.terraform.io) terraform-provider-aws/4.67.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go-v2/1.18.0 os/macos lang/go/1.19.8 md/GOOS/darwin md/GOARCH/arm64 api/identitystore/1.16.11'
+    family: 'Mac OS X'
+    major:
+    minor: 
+    patch: 
+    patch_minor:
+  
+  - user_agent_string: 'APN/1.0 HashiCorp/1.0 Terraform/1.8.0 (+https://www.terraform.io) terraform-provider-aws/4.67.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.261 (go1.19.8; darwin; arm64)'
+    family: 'Mac OS X'
+    major:
+    minor: 
+    patch: 
+    patch_minor:
+
diff --git a/tests/test_ua.yaml b/tests/test_ua.yaml
index d27a6f1f..3b6da6cf 100644
--- a/tests/test_ua.yaml
+++ b/tests/test_ua.yaml
@@ -8031,6 +8031,12 @@ test_cases:
     major: '1'
     minor: '4'
     patch: '12'
+  
+  - user_agent_string: 'aws-sdk-go-v2/1.24.1 os/linux lang/go#1.20.4 md/GOOS#linux md/GOARCH#arm64 api/sts#1.26.7'
+    family: 'aws-sdk-go-v2'
+    major: '1'
+    minor: '24'
+    patch: '1'
 
   - user_agent_string: 'aws-sdk-nodejs/2.141.0 win32/v8.4.0'
     family: 'aws-sdk-nodejs'