pingpp 2.0.8 → 2.0.11

data/lib/pingpp/version.rb

@@ -1,3 +1,3 @@
 module Pingpp
-  VERSION = '2.0.8'
+  VERSION = '2.0.11'
 end

data/lib/pingpp.rb

@@ -3,8 +3,9 @@
 require 'cgi'
 require 'set'
 require 'openssl'
-require 'rest_client'
+require 'rest-client'
 require 'json'
+require 'base64'
 
 # Version
 require 'pingpp/version'
@@ -21,7 +22,6 @@ require 'pingpp/pingpp_object'
 require 'pingpp/api_resource'
 require 'pingpp/singleton_api_resource'
 require 'pingpp/list_object'
-require 'pingpp/certificate_blacklist'
 require 'pingpp/charge'
 require 'pingpp/refund'
 require 'pingpp/red_envelope'
@@ -43,16 +43,15 @@ module Pingpp
   DEFAULT_CA_BUNDLE_PATH = File.dirname(__FILE__) + '/data/ca-certificates.crt'
   @api_base = 'https://api.pingxx.com'
 
-  @api_version = '2015-06-03'
+  @api_version = '2015-10-10'
 
   @ssl_bundle_path  = DEFAULT_CA_BUNDLE_PATH
   @verify_ssl_certs = true
-  @CERTIFICATE_VERIFIED = false
 
   HEADERS_TO_PARSE = [:pingpp_one_version, :pingpp_sdk_version]
 
   class << self
-    attr_accessor :api_key, :api_base, :verify_ssl_certs, :api_version, :parsed_headers
+    attr_accessor :api_key, :api_base, :verify_ssl_certs, :api_version, :parsed_headers, :private_key_path
   end
 
   def self.api_url(url='')
@@ -92,15 +91,19 @@ module Pingpp
         'email support@pingxx.com if you have any questions.)')
     end
 
-    request_opts = { :verify_ssl => false, :ssl_version => 'TLSv1' }
-
-    if ssl_preflight_passed?
-      request_opts.update(:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
-                          :ssl_ca_file => @ssl_bundle_path)
-    end
-
-    if @verify_ssl_certs and !@CERTIFICATE_VERIFIED
-      @CERTIFICATE_VERIFIED = CertificateBlacklist.check_ssl_cert(@api_base, @ssl_bundle_path)
+    if verify_ssl_certs
+      request_opts = {:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
+                      :ssl_ca_file => @ssl_bundle_path,
+                      :ssl_version => 'TLSv1'}
+    else
+      request_opts = {:verify_ssl => false,
+                      :ssl_version => 'TLSv1'}
+      unless @verify_ssl_warned
+        @verify_ssl_warned = true
+        $stderr.puts("WARNING: Running without SSL cert verification. " \
+          "You should never do this in production. " \
+          "Execute 'Pingpp.verify_ssl_certs = true' to enable verification.")
+      end
     end
 
     params = Util.objects_to_ids(params)
@@ -115,7 +118,7 @@ module Pingpp
       payload = JSON.generate(params)
     end
 
-    request_opts.update(:headers => request_headers(api_key, method.to_s.downcase.to_sym == :post).update(headers),
+    request_opts.update(:headers => request_headers(api_key, method.to_s.downcase.to_sym == :post, payload).update(headers),
                         :method => method, :open_timeout => 30,
                         :payload => payload, :url => url, :timeout => 80)
 
@@ -146,23 +149,6 @@ module Pingpp
 
   private
 
-  def self.ssl_preflight_passed?
-    if !verify_ssl_certs && !@no_verify
-      $stderr.puts "WARNING: Running without SSL cert verification. " +
-        "Execute 'Pingpp.verify_ssl_certs = true' to enable verification."
-
-      @no_verify = true
-
-    elsif !Util.file_readable(@ssl_bundle_path) && !@no_bundle
-      $stderr.puts "WARNING: Running without SSL cert verification " +
-        "because #{@ssl_bundle_path} isn't readable"
-
-      @no_bundle = true
-    end
-
-    !(@no_verify || @no_bundle)
-  end
-
   def self.user_agent
     @uname ||= get_uname
     lang_version = "#{RUBY_VERSION} p#{RUBY_PATCHLEVEL} (#{RUBY_RELEASE_DATE})"
@@ -189,7 +175,7 @@ module Pingpp
       map { |k,v| "#{k}=#{Util.url_encode(v)}" }.join('&')
   end
 
-  def self.request_headers(api_key, is_post=false)
+  def self.request_headers(api_key, is_post=false, data=nil)
     headers = {
       :user_agent => "Pingpp/v1 RubyBindings/#{Pingpp::VERSION}",
       :authorization => "Bearer #{api_key}",
@@ -205,6 +191,13 @@ module Pingpp
       headers.update(:x_pingpp_client_raw_user_agent => user_agent.inspect,
                      :error => "#{e} (#{e.class})")
     end
+
+    if is_post && private_key_path && data
+      signature = sign_request(data, private_key_path)
+      headers.update(:pingplusplus_signature => signature)
+    end
+
+    headers
   end
 
   def self.execute_request(opts)
@@ -223,6 +216,11 @@ module Pingpp
     Util.symbolize_names(response)
   end
 
+  def self.sign_request(data, key_path)
+    pkey = OpenSSL::PKey.read(File.read(key_path))
+    return Base64.strict_encode64(pkey.sign(OpenSSL::Digest::SHA256.new, data))
+  end
+
   def self.general_api_error(rcode, rbody)
     APIError.new("Invalid response object from API: #{rbody.inspect} " +
                  "(HTTP response code was #{rcode})", rcode, rbody)
@@ -271,7 +269,7 @@ module Pingpp
   def self.handle_restclient_error(e)
     connection_message = "Please check your internet connection and try again. " \
         "If this problem persists, you should check Pingpp's service status at " \
-        "https://pingxx.com, or let us know at support@pingxx.com."
+        "https://www.pingxx.com/status"
 
     case e
     when RestClient::RequestTimeout
@@ -284,8 +282,7 @@ module Pingpp
     when RestClient::SSLCertificateNotVerified
       message = "Could not verify Pingpp's SSL certificate. " \
         "Please make sure that your network is not intercepting certificates. " \
-        "(Try going to (#{@api_base}) in your browser.) " \
-        "If this problem persists, let us know at support@pingxx.com."
+        "(Try going to (#{@api_base}) in your browser.)"
 
     when SocketError
       message = "Unexpected error communicating when trying to connect to Pingpp. " \
@@ -293,8 +290,7 @@ module Pingpp
         "To check, try running 'host pingxx.com' from the command line."
 
     else
-      message = "Unexpected error communicating with Pingpp. " \
-        "If this problem persists, let us know at support@pingxx.com."
+      message = "Unexpected error communicating with Pingpp."
 
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pingpp
 version: !ruby/object:Gem::Version
-  version: 2.0.8
+  version: 2.0.11
 platform: ruby
 authors:
 - Xufeng Weng
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-13 00:00:00.000000000 Z
+date: 2016-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -141,7 +141,6 @@ files:
 - lib/pingpp/api_operations/list.rb
 - lib/pingpp/api_operations/update.rb
 - lib/pingpp/api_resource.rb
-- lib/pingpp/certificate_blacklist.rb
 - lib/pingpp/charge.rb
 - lib/pingpp/errors/api_connection_error.rb
 - lib/pingpp/errors/api_error.rb

data/lib/pingpp/certificate_blacklist.rb

@@ -1,51 +0,0 @@
-require 'uri'
-require 'digest/sha1'
-
-module Pingpp
-  module CertificateBlacklist
-
-    BLACKLIST = {
-      "api.pingxx.com" => [
-      ]
-    }
-
-    # Preflight the SSL certificate presented by the backend. This isn't 100%
-    # bulletproof, in that we're not actually validating the transport used to
-    # communicate with Pingpp, merely that the first attempt to does not use a
-    # revoked certificate.
-
-    # Unfortunately the interface to OpenSSL doesn't make it easy to check the
-    # certificate before sending potentially sensitive data on the wire. This
-    # approach raises the bar for an attacker significantly.
-
-    def self.check_ssl_cert(uri, ca_file)
-      uri = URI.parse(uri)
-
-      sock = TCPSocket.new(uri.host, uri.port)
-      ctx = OpenSSL::SSL::SSLContext.new
-      ctx.set_params(:verify_mode => OpenSSL::SSL::VERIFY_PEER,
-                     :ca_file => ca_file)
-
-      socket = OpenSSL::SSL::SSLSocket.new(sock, ctx)
-      socket.connect
-
-      certificate = socket.peer_cert.to_der
-      fingerprint = Digest::SHA1.hexdigest(certificate)
-
-      if blacklisted_certs = BLACKLIST[uri.host]
-        if blacklisted_certs.include?(fingerprint)
-          raise APIConnectionError.new(
-            "Invalid server certificate. You tried to connect to a server that" +
-            "has a revoked SSL certificate, which means we cannot securely send" +
-            "data to that server. Please email support@pingxx.com if you need" +
-            "help connecting to the correct API server."
-          )
-        end
-      end
-
-      socket.close
-
-      return true
-    end
-  end
-end