WAMPCRA does not support salting

[Mahad-10]

As mentioned in the wamp proto specification: https://wamp-proto.org/wamp_ap_latest_ietf.html#section-5.2-31, wampcra should support salting but crossbar doesn't support it.

Steps to reproduce:

My config.json file looks like this:

{
  "version": 2,
  "controller": {},
  "workers": [
    {
      "type": "router",
      "realms": [
        {
          "name": "realm1",
          "roles": [
            {
              "name": "anonymous",
              "permissions": [
                {
                  "uri": "*",
                  "allow": {
                    "publish": true,
                    "subscribe": true,
                    "call": true,
                    "register": true
                  }
                }
              ]
            }
          ]
        }
      ],
      "transports": [
        {
          "type": "websocket",
          "endpoint": {
            "type": "tcp",
            "port": 8080
          },
          "auth": {
            "wampcra": {
              "type": "static",
              "users": {
                "bob": {
                  "secret": "bob-secret",
                  "role": "anonymous",
                  "salt": "salt123",
                  "iterations": 1000,
                  "keylen": 32
                }
              }
            }
          }
        }
      ]
    }
  ]
}

The client code to test it:

from twisted.internet.defer import inlineCallbacks

import txaio

txaio.use_twisted()

from autobahn.wamp.serializer import JsonSerializer
from autobahn.twisted.wamp import ApplicationSession
from autobahn.twisted.util import sleep
from autobahn.wamp import auth
from autobahn.twisted.wamp import ApplicationRunner

USER = "bob"
USER_SECRET = "bob-secret"


class ClientSession(ApplicationSession):

    def onConnect(self):
        self.join(self.config.realm, ["wampcra"], USER)

    def onChallenge(self, challenge):
        if challenge.method == "wampcra":
            signature = auth.compute_wcs(USER_SECRET, challenge.extra['challenge'])

            return signature

        else:
            raise Exception("Invalid authmethod {}".format(challenge.method))

    @inlineCallbacks
    def onJoin(self, details):
        print("Client session joined: {}".format(details))
        yield sleep(1)

        res = yield self.publish('com.example.add2', 2, 3)

        self.leave()

    def onLeave(self, details):
        self.disconnect()

if __name__ == '__main__':
    serializers = [JsonSerializer(batched=False)]

    runner = ApplicationRunner(url='ws://localhost:8080/ws', realm='realm1', serializers=serializers)
    runner.run(ClientSession)

This should result in error as i have not derived key from salt and passed it directly. But it works fine.

[om26er]

Yeah, I think would be a good first contribution to this project