1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
From 237b8e86e7575a9841047b6a99f4fd59196d898a Mon Sep 17 00:00:00 2001
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Mon, 3 Feb 2025 23:39:08 -0500
Subject: [PATCH GnuPG 14/19] gpg: Sync compliance mode cleanup with master
* g10/gpg.c (set_compliance_option): Clean up option settings for
compliance modes.
* doc/gpg.texi: note that --allow-old-cipher-algos must come after any
compliance setting.
--
This makes it possible to reset all options affected by any non-gnupg
compliance mode to their default values by using --compliance=gnupg.
This synchronizes the compliance mode behaviors with the master
branch, including commits:
- 54a8770aeb20eb9e18b5e95e51c376ec7820f8f6
- 0bdf5859935e3db15baaf5d0d96b723ddbd2acd5
- 04d58ff8475575f22a5ee1fb8c4f2c2dca0b5522
- aa46ba28ba75fc479b407c572c723b51b22d4a73
- 4b2729b983bf3c6c1186ebdf1962f64d8cb1b3a1
GnuPG-Bug-id: 7501
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
---
doc/gpg.texi | 7 ++++--
g10/gpg.c | 61 ++++++++++++++++++++++++++--------------------------
2 files changed, 35 insertions(+), 33 deletions(-)
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 652003c27..f99afd7e5 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3084,7 +3084,8 @@ to the default of 3.
@subsection Compliance options
These options control what GnuPG is compliant to. Only one of these
-options may be active at a time. Note that the default setting of
+options may be active at a time. If multiple options are given, the
+last one supersedes all the others. Note that the default setting of
this is nearly always the correct one. See the INTEROPERABILITY WITH
OTHER OPENPGP PROGRAMS section below before using one of these
options.
@@ -3691,7 +3692,9 @@ blocks of 64 bits; modern algorithms use blocks of 128 bit instead.
To avoid certain attack on these old algorithms it is suggested not to
encrypt more than 150 MiByte using the same key. For this reason gpg
does not allow the use of 64 bit block size algorithms for encryption
-unless this option is specified.
+unless this option is specified. Some compliance modes already set or
+clear this flag and thus this flag should be used after a compliance
+mode setting.
@item --allow-weak-digest-algos
@opindex allow-weak-digest-algos
diff --git a/g10/gpg.c b/g10/gpg.c
index 43488d60b..b1fb24b6b 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -2265,17 +2265,14 @@ set_compliance_option (enum cmd_and_opt_values option)
{
switch (option)
{
- case oOpenPGP:
- case oRFC4880:
- /* This is effectively the same as RFC2440, but with
- "--enable-dsa2 --no-rfc2440-text --escape-from-lines
- --require-cross-certification". */
- opt.compliance = CO_RFC4880;
- opt.flags.dsa2 = 1;
+ case oGnuPG:
+ /* set up default options affected by policy compliance: */
+ opt.compliance = CO_GNUPG;
+ opt.flags.dsa2 = 0;
opt.flags.require_cross_cert = 1;
opt.rfc2440_text = 0;
- opt.allow_non_selfsigned_uid = 1;
- opt.allow_freeform_uid = 1;
+ opt.allow_non_selfsigned_uid = 0;
+ opt.allow_freeform_uid = 0;
opt.escape_from = 1;
opt.not_dash_escaped = 0;
opt.def_cipher_algo = 0;
@@ -2283,33 +2280,44 @@ set_compliance_option (enum cmd_and_opt_values option)
opt.cert_digest_algo = 0;
opt.compress_algo = -1;
opt.s2k_mode = 3; /* iterated+salted */
+ opt.s2k_digest_algo = 0;
+ opt.s2k_cipher_algo = DEFAULT_CIPHER_ALGO;
+ opt.flags.allow_old_cipher_algos = 0;
+ break;
+ case oOpenPGP:
+ case oRFC4880:
+ set_compliance_option (oGnuPG);
+ /* This is effectively the same as RFC2440, but with
+ "--enable-dsa2 --no-rfc2440-text --escape-from-lines
+ --require-cross-certification". */
+ opt.compliance = CO_RFC4880;
+ opt.flags.dsa2 = 1;
+ opt.allow_non_selfsigned_uid = 1;
+ opt.allow_freeform_uid = 1;
opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
opt.flags.allow_old_cipher_algos = 1;
break;
case oRFC2440:
+ set_compliance_option (oGnuPG);
opt.compliance = CO_RFC2440;
- opt.flags.dsa2 = 0;
+ opt.flags.require_cross_cert = 0;
opt.rfc2440_text = 1;
opt.allow_non_selfsigned_uid = 1;
opt.allow_freeform_uid = 1;
opt.escape_from = 0;
- opt.not_dash_escaped = 0;
- opt.def_cipher_algo = 0;
- opt.def_digest_algo = 0;
- opt.cert_digest_algo = 0;
- opt.compress_algo = -1;
- opt.s2k_mode = 3; /* iterated+salted */
opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
opt.flags.allow_old_cipher_algos = 1;
break;
- case oPGP7: opt.compliance = CO_PGP7; break;
- case oPGP8: opt.compliance = CO_PGP8; break;
- case oGnuPG:
- opt.compliance = CO_GNUPG;
+ case oPGP7:
+ set_compliance_option (oGnuPG);
+ opt.compliance = CO_PGP7;
+ break;
+ case oPGP8:
+ set_compliance_option (oGnuPG);
+ opt.compliance = CO_PGP8;
break;
-
case oDE_VS:
set_compliance_option (oOpenPGP);
opt.compliance = CO_DE_VS;
@@ -2463,19 +2471,10 @@ main (int argc, char **argv)
opt.command_fd = -1; /* no command fd */
opt.compress_level = -1; /* defaults to standard compress level */
opt.bz2_compress_level = -1; /* defaults to standard compress level */
- /* note: if you change these lines, look at oOpenPGP */
- opt.def_cipher_algo = 0;
- opt.def_digest_algo = 0;
- opt.cert_digest_algo = 0;
- opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
- opt.s2k_mode = 3; /* iterated+salted */
opt.s2k_count = 0; /* Auto-calibrate when needed. */
- opt.s2k_cipher_algo = DEFAULT_CIPHER_ALGO;
opt.completes_needed = 1;
opt.marginals_needed = 3;
opt.max_cert_depth = 5;
- opt.escape_from = 1;
- opt.flags.require_cross_cert = 1;
opt.import_options = (IMPORT_REPAIR_KEYS
| IMPORT_COLLAPSE_UIDS
| IMPORT_COLLAPSE_SUBKEYS);
@@ -2509,7 +2508,7 @@ main (int argc, char **argv)
opt.passphrase_repeat = 1;
opt.emit_version = 0;
opt.weak_digests = NULL;
- opt.compliance = CO_GNUPG;
+ set_compliance_option (oGnuPG);
/* Check special options given on the command line. */
orig_argc = argc;
--
2.47.2
|
