[meta-security,06/19] ossec-hids: upgrade 3.7.0 -> 4.3.0

diff --git a/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch b/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch
index 08e018f..7b1600c 100644
--- a/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch
+++ b/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch
@@ -1,7 +1,7 @@ 
-From b948d36a8ca8e04794381f0f6eba29daf7e3fd01 Mon Sep 17 00:00:00 2001
+From 1035c4363148a831d2659bd88ac9d299cd6bd38e Mon Sep 17 00:00:00 2001
 From: Armin Kuster <akuster808@gmail.com>
 Date: Wed, 21 Apr 2021 00:56:53 +0000
-Subject: [PATCH 1/2] Makefile: drop running scrips @ install
+Subject: [PATCH] Makefile: drop running scrips @ install
 
 Upstream-Status: Inappropriate [embedded specific]
 
@@ -32,6 +32,3 @@  index 06a7094c..dfb8cb58 100644
  
  install-server-generic: install-common
  	$(call INSTALL_CMD,0660,${OSSEC_USER},${OSSEC_GROUP}) /dev/null ${PREFIX}/logs/active-responses.log
--- 
-2.25.1
-
diff --git a/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch b/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch
index d5e3403..fdbe49f 100644
--- a/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch
+++ b/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch
@@ -1,7 +1,7 @@ 
-From d9ec907881b72d42b4918f7cfb46516ce8e77772 Mon Sep 17 00:00:00 2001
+From 9572062689514907fb613e0bad2cab2489141f92 Mon Sep 17 00:00:00 2001
 From: Armin Kuster <akuster808@gmail.com>
 Date: Sat, 24 Apr 2021 23:07:29 +0000
-Subject: [PATCH 2/2] Makefile: don't set uid/gid
+Subject: [PATCH] Makefile: don't set uid/gid
 
 Upstream-Status: Inappropriate [embedded specific]
 
@@ -246,6 +246,3 @@  index dfb8cb58..a4d69ef6 100644
  
  	rm -f ${PREFIX}/etc/shared/merged.mg
  
--- 
-2.25.1
-
diff --git a/recipes-ids/ossec/files/0003-Add-OpenSSL-4.0-support.patch b/recipes-ids/ossec/files/0003-Add-OpenSSL-4.0-support.patch
new file mode 100644
index 0000000..e1f0d98
--- /dev/null
+++ b/recipes-ids/ossec/files/0003-Add-OpenSSL-4.0-support.patch
@@ -0,0 +1,167 @@ 
+From 7e1e68047ef990fbf85d769088479439e2538073 Mon Sep 17 00:00:00 2001
+From: Scott Murray <scott.murray@konsulko.com>
+Date: Sun, 13 Sep 2026 22:14:10 +0300
+Subject: [PATCH] Add OpenSSL 4.0 support
+
+Rework TLS setup and X509 certificate checking code to handle OpenSSL
+4.0 API changes.
+
+Upstream-Status: Pending
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+---
+ src/os_auth/check_cert.c | 42 +++++++++++++++-------------------------
+ src/os_auth/check_cert.h |  4 ++--
+ src/os_auth/ssl.c        |  9 +++++++++
+ 3 files changed, 27 insertions(+), 28 deletions(-)
+
+diff --git a/src/os_auth/check_cert.c b/src/os_auth/check_cert.c
+index 365eecee..94fc7660 100644
+--- a/src/os_auth/check_cert.c
++++ b/src/os_auth/check_cert.c
+@@ -106,13 +106,13 @@ int check_subject_alt_names(X509 *cert, const char *manager)
+  */
+ int check_subject_cn(X509 *cert, const char *manager)
+ {
+-    X509_NAME *name = NULL;
++    const X509_NAME *name = NULL;
+     int result = VERIFY_FALSE;
+     int i = 0;
+ 
+     if ((name = X509_get_subject_name(cert))) {
+         while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0 && result == VERIFY_FALSE) {
+-            X509_NAME_ENTRY *ne = X509_NAME_get_entry(name, i);
++            const X509_NAME_ENTRY *ne = X509_NAME_get_entry(name, i);
+             result = check_hostname(X509_NAME_ENTRY_get_data(ne), manager);
+         }
+     }
+@@ -127,7 +127,7 @@ int check_subject_cn(X509 *cert, const char *manager)
+  * and compared. Matching is case insensitive and basic wildcard matching
+  * is supported.
+  */
+-int check_hostname(ASN1_STRING *cert_astr, const char *manager)
++int check_hostname(const ASN1_STRING *cert_astr, const char *manager)
+ {
+     label c_labels[DNS_MAX_LABELS];
+     label m_labels[DNS_MAX_LABELS];
+@@ -135,7 +135,7 @@ int check_hostname(ASN1_STRING *cert_astr, const char *manager)
+     int m_label_num = 0;
+     int wildcard_cert = 0;
+     int i = 0;
+-    char *cert_cstr = NULL;
++    unsigned char *cert_cstr = NULL;
+ 
+     if (!(cert_cstr = asn1_to_cstr(cert_astr))) {
+         return VERIFY_FALSE;
+@@ -143,9 +143,9 @@ int check_hostname(ASN1_STRING *cert_astr, const char *manager)
+ 
+     /* Convert domain names to arrays of labels separated by '.'
+      */
+-    c_label_num = label_array(cert_cstr, c_labels);
++    c_label_num = label_array((char*) cert_cstr, c_labels);
+     m_label_num = label_array(manager, m_labels);
+-    free(cert_cstr);
++    OPENSSL_free(cert_cstr);
+ 
+     /* Check that we have an appropriate number of labels and that the name
+      * from the certificate and the name given on the command line have
+@@ -193,11 +193,11 @@ int check_ipaddr(const ASN1_STRING *cert_astr, const char *manager)
+     memset(&iptest6, 0, sizeof(iptest6));
+ 
+     if (inet_pton(AF_INET, manager, &iptest.sin_addr) == 1) {
+-        if (cert_astr->length == 4 && !memcmp(cert_astr->data, (const void *)&iptest.sin_addr, 4)) {
++        if (ASN1_STRING_length(cert_astr) == 4 && !memcmp(ASN1_STRING_get0_data(cert_astr), (const void *)&iptest.sin_addr, 4)) {
+             return VERIFY_TRUE;
+         }
+     } else if (inet_pton(AF_INET6, manager, &iptest6.sin6_addr) == 1) {
+-        if (cert_astr->length == 16 && !memcmp(cert_astr->data, (const void *)&iptest6.sin6_addr, 16)) {
++        if (ASN1_STRING_length(cert_astr) == 16 && !memcmp(ASN1_STRING_get0_data(cert_astr), (const void *)&iptest6.sin6_addr, 16)) {
+             return VERIFY_TRUE;
+         }
+     }
+@@ -291,35 +291,25 @@ int label_match(const label *label1, const label *label2)
+ 
+ /* Convert an ASN1 string which may not be null terminated into a
+  * standard null terminated string. Also check for embedded null
+- * characters.
++ * characters.  The returned string should be freed with
++ * OPENSSL_free.
+  */
+-char *asn1_to_cstr(ASN1_STRING *astr)
++unsigned char *asn1_to_cstr(const ASN1_STRING *astr)
+ {
+-    unsigned int astr_len = 0;
+-    char *tmp = NULL;
+-    char *cstr = NULL;
++    size_t astr_len = 0;
++    unsigned char *cstr = NULL;
+ 
+-    if (!(astr_len = (unsigned int) ASN1_STRING_length(astr))) {
+-        return NULL;
+-    }
+-
+-    if (!(tmp = (char *)ASN1_STRING_data(astr))) {
++    if ((astr_len = ASN1_STRING_to_UTF8(&cstr, astr)) <= 0) {
+         return NULL;
+     }
+ 
+     /* Verify that the string does not contain embedded null characters.
+      */
+-    if (memchr(tmp, '\0', astr_len)) {
++    if (memchr(cstr, '\0', astr_len)) {
++        OPENSSL_free(cstr);
+         return NULL;
+     }
+ 
+-    if ((cstr = (char *) malloc(astr_len + 1)) == NULL) {
+-        return NULL;
+-    }
+-
+-    memcpy(cstr, tmp, astr_len);
+-    cstr[astr_len] = '\0';
+-
+     return cstr;
+ }
+ 
+diff --git a/src/os_auth/check_cert.h b/src/os_auth/check_cert.h
+index ff244dd9..fc804653 100644
+--- a/src/os_auth/check_cert.h
++++ b/src/os_auth/check_cert.h
+@@ -46,12 +46,12 @@ label;
+ int check_x509_cert(const SSL *ssl, const char *manager);
+ int check_subject_alt_names(X509 *cert, const char *manager);
+ int check_subject_cn(X509 *cert, const char *manager);
+-int check_hostname(ASN1_STRING *cert_astr, const char *manager);
++int check_hostname(const ASN1_STRING *cert_astr, const char *manager);
+ int check_ipaddr(const ASN1_STRING *cert_astr, const char *manager);
+ int label_array(const char *domain_name, label result[DNS_MAX_LABELS]);
+ int label_valid(const label *label);
+ int label_match(const label *label1, const label *label2);
+-char *asn1_to_cstr(ASN1_STRING *astr);
++unsigned char *asn1_to_cstr(const ASN1_STRING *astr);
+ 
+ #endif /* LIBOPENSSL_ENABLED */
+ #endif /* _CHECK_CERT_H */
+diff --git a/src/os_auth/ssl.c b/src/os_auth/ssl.c
+index c9b017cc..ec579ef1 100644
+--- a/src/os_auth/ssl.c
++++ b/src/os_auth/ssl.c
+@@ -104,10 +104,19 @@ SSL_CTX *get_ssl_context(const char *ciphers)
+     OpenSSL_add_all_algorithms();
+ 
+     /* Create our context */
++#if(OPENSSL_VERSION_NUMBER < 0x40000000L)
+     sslmeth = TLSv1_2_method();
++#else
++    sslmeth = TLS_method();
++#endif
+     if (!(ctx = SSL_CTX_new(sslmeth))) {
+         goto CONTEXT_ERR;
+     }
++#if(OPENSSL_VERSION_NUMBER >= 0x40000000L)
++    if (!(SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION))) {
++        goto CONTEXT_ERR;
++    }
++#endif
+ 
+     /* Explicitly set options and cipher list */
+     SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
diff --git a/recipes-ids/ossec/ossec-hids_3.7.0.bb b/recipes-ids/ossec/ossec-hids_4.3.0.bb
similarity index 98%
rename from recipes-ids/ossec/ossec-hids_3.7.0.bb
rename to recipes-ids/ossec/ossec-hids_4.3.0.bb
index f8ee993..2ec7174 100644
--- a/recipes-ids/ossec/ossec-hids_3.7.0.bb
+++ b/recipes-ids/ossec/ossec-hids_4.3.0.bb
@@ -5,9 +5,10 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=d625d1520b5e38faefb81cf9772badc9"
 
 DEPENDS = "openssl libpcre2 zlib libevent"
 SRC_URI = "git://github.com/ossec/ossec-hids;branch=master;protocol=https \
-           file://0001-Makefile-drop-running-scrips-install.patch  \
+           file://0001-Makefile-drop-running-scrips-install.patch \
            file://0002-Makefile-don-t-set-uid-gid.patch \
-           "
+           file://0003-Add-OpenSSL-4.0-support.patch \
+"
 
 SRCREV = "bf797c759994015274f3bc31fe2bed278cce67ee"