From 4b2729b983bf3c6c1186ebdf1962f64d8cb1b3a1 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Mon, 3 Feb 2025 11:46:57 +0100
Subject: [PATCH] gpg: Simplify the compliance settings.

* g10/gpg.c (set_compliance_option): Base most settings on oGnuPG.
For oGnuPG explictly clear the allow_old_cipher_algos flag.
--

Note that --allow-old-cipher-algos must now come after a compliance
settings.  This avoids a bug when first setting oRFC2440 and then
oGnuPG which would not clear the flag.

GnuPG-bug-id: T7501
---
 doc/gpg.texi |  4 ++-
 g10/gpg.c    | 86 +++++++++++++++++++++++-----------------------------
 2 files changed, 41 insertions(+), 49 deletions(-)

diff --git a/doc/gpg.texi b/doc/gpg.texi
index fe2e5ce8c..9a621c89b 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3687,7 +3687,9 @@ blocks of 64 bits; modern algorithms use blocks of 128 bit instead.
 To avoid certain attack on these old algorithms it is suggested not to
 encrypt more than 150 MiByte using the same key.  For this reason gpg
 does not allow the use of 64 bit block size algorithms for encryption
-unless this option is specified.
+unless this option is specified.  Some compliance modes already set or
+clear this flag and thus this flags should be used after a compliance
+mode setting.
 
 @item --allow-weak-digest-algos
 @opindex allow-weak-digest-algos
diff --git a/g10/gpg.c b/g10/gpg.c
index 70e1a7b3c..e16244777 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -2277,54 +2277,6 @@ set_compliance_option (enum cmd_and_opt_values option)
 {
   switch (option)
     {
-    case oOpenPGP:
-    case oRFC4880:
-      /* This is effectively the same as RFC2440, but with
-         "--enable-dsa2 --no-rfc2440-text --escape-from-lines
-         --require-cross-certification". */
-      opt.compliance = CO_RFC4880;
-      opt.flags.dsa2 = 1;
-      opt.flags.require_cross_cert = 1;
-      opt.rfc2440_text = 0;
-      opt.allow_non_selfsigned_uid = 1;
-      opt.allow_freeform_uid = 1;
-      opt.escape_from = 1;
-      opt.not_dash_escaped = 0;
-      opt.def_cipher_algo = 0;
-      opt.def_digest_algo = 0;
-      opt.cert_digest_algo = 0;
-      opt.compress_algo = -1;
-      opt.s2k_mode = 3; /* iterated+salted */
-      opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
-      opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
-      opt.flags.allow_old_cipher_algos = 1;
-      break;
-    case oRFC2440:
-      opt.compliance = CO_RFC2440;
-      opt.flags.dsa2 = 0;
-      opt.flags.require_cross_cert = 0;
-      opt.rfc2440_text = 1;
-      opt.allow_non_selfsigned_uid = 1;
-      opt.allow_freeform_uid = 1;
-      opt.escape_from = 0;
-      opt.not_dash_escaped = 0;
-      opt.def_cipher_algo = 0;
-      opt.def_digest_algo = 0;
-      opt.cert_digest_algo = 0;
-      opt.compress_algo = -1;
-      opt.s2k_mode = 3; /* iterated+salted */
-      opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
-      opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
-      opt.flags.allow_old_cipher_algos = 1;
-      break;
-    case oPGP7:
-      set_compliance_option (oGnuPG);
-      opt.compliance = CO_PGP7;
-      break;
-    case oPGP8:
-      set_compliance_option (oGnuPG);
-      opt.compliance = CO_PGP8;
-      break;
     case oGnuPG:
       /* set up default options affected by policy compliance: */
       opt.compliance = CO_GNUPG;
@@ -2342,6 +2294,44 @@ set_compliance_option (enum cmd_and_opt_values option)
       opt.s2k_mode = 3; /* iterated+salted */
       opt.s2k_digest_algo = 0;
       opt.s2k_cipher_algo = DEFAULT_CIPHER_ALGO;
+      opt.flags.allow_old_cipher_algos = 0;
+      break;
+
+    case oOpenPGP:
+    case oRFC4880:
+      /* This is effectively the same as RFC2440, but with
+         "--enable-dsa2 --no-rfc2440-text --escape-from-lines
+         --require-cross-certification". */
+      set_compliance_option (oGnuPG);
+      opt.compliance = CO_RFC4880;
+      opt.flags.dsa2 = 1;
+      opt.allow_non_selfsigned_uid = 1;
+      opt.allow_freeform_uid = 1;
+      opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
+      opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
+      opt.flags.allow_old_cipher_algos = 1;
+      break;
+
+    case oRFC2440:
+      set_compliance_option (oGnuPG);
+      opt.compliance = CO_RFC2440;
+      opt.flags.require_cross_cert = 0;
+      opt.rfc2440_text = 1;
+      opt.allow_non_selfsigned_uid = 1;
+      opt.allow_freeform_uid = 1;
+      opt.escape_from = 0;
+      opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
+      opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
+      opt.flags.allow_old_cipher_algos = 1;
+      break;
+
+    case oPGP7:
+      set_compliance_option (oGnuPG);
+      opt.compliance = CO_PGP7;
+      break;
+    case oPGP8:
+      set_compliance_option (oGnuPG);
+      opt.compliance = CO_PGP8;
       break;
 
     case oDE_VS: