Repository: secdev/scapy

Issue:
Remove references to crypto_valid_advanced?
Since support for cryptography < 2.0 tests were removed in #2260, should we remove references to `crypto_valid_advanced` at these locations?
```
$ git grep crypto_valid_advanced
scapy/config.py:    crypto_valid_advanced = isCryptographyAdvanced()
scapy/layers/tls/automaton_cli.py:            if conf.crypto_valid_advanced:
scapy/layers/tls/automaton_cli.py:                            if conf.crypto_valid_advanced:
scapy/layers/tls/automaton_cli.py:        if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:        # if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:            if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:                if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:                    if (conf.crypto_valid_advanced and
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:        # if conf.crypto_valid_advanced:
scapy/layers/tls/crypto/cipher_aead.py:if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:                if conf.crypto_valid_advanced:
scapy/layers/tls/keyexchange_tls13.py:                if conf.crypto_valid_advanced:
scapy/layers/tls/record.py:if conf.crypto_valid_advanced:
scapy/layers/tls/record.py:            if (conf.crypto_valid_advanced and
```


Discussion:
`crypto_valid_advanced` is about X25519 support. Doesn't it require a certain OpenSSL version or something ?
You are right. It is mostly used for X25519. In `cipher_aead.py`, and `tls_record.py` it is also used to import AESCCM and ChaCha20Poly1305. I will check if these algorithms need a specific suppor in OpenSSL or are implemented in Python.
I seems that `cryptography` supports OpenSSL >= 1.0.1 (from https://cryptography.io/en/latest/hazmat/backends/openssl/). 

I found that 1.1.0 supports AES CCM, ChaCha20Poly1305 and X25519 (https://www.openssl.org/docs/man1.1.0/man1/ciphers.html).
It might be better to change `crypto_valid_advanced` to something more explicit and related to the algorithms. Another alternative is to use `openssl_version_text()` (https://cryptography.io/en/latest/hazmat/backends/openssl/#openssl_version_text) to decide which algorithms can be used.

Resolving patch:
diff --git a/scapy/config.py b/scapy/config.py
--- a/scapy/config.py
+++ b/scapy/config.py
@@ -378,20 +378,24 @@ def _version_checker(module, minver):
 
 def isCryptographyValid():
     """
-    Check if the cryptography library is present, and if it is recent enough
-    for most usages in scapy (v1.7 or later).
+    Check if the cryptography module >= 2.0.0 is present. This is the minimum
+    version for most usages in Scapy.
     """
     try:
         import cryptography
     except ImportError:
         return False
-    return _version_checker(cryptography, (1, 7))
+    return _version_checker(cryptography, (2, 0, 0))
 
 
 def isCryptographyAdvanced():
     """
-    Check if the cryptography library is present, and if it supports X25519,
-    ChaCha20Poly1305 and such (v2.0 or later).
+    Check if the cryptography module is present, and if it supports X25519,
+    ChaCha20Poly1305 and such.
+
+    Notes:
+    - cryptography >= 2.0 is required
+    - OpenSSL >= 1.1.0 is required
     """
     try:
         from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey  # noqa: E501


Test patch: