diff --git a/elasticsearch/connection/http_requests.py b/elasticsearch/connection/http_requests.py index 4959e1b5..4eb4fe7d 100644 --- a/elasticsearch/connection/http_requests.py +++ b/elasticsearch/connection/http_requests.py @@ -1,4 +1,5 @@ import time +import warnings try: import requests REQUESTS_AVAILABLE = True @@ -46,6 +47,10 @@ class RequestsHttpConnection(Connection): raise ImproperlyConfigured("You cannot pass CA certificates when verify SSL is off.") self.session.verify = ca_certs + if use_ssl and not verify_certs: + warnings.warn( + 'Connecting to %s using SSL with verify_certs=False is insecure.' % self.base_url) + def perform_request(self, method, url, params=None, body=None, timeout=None, ignore=()): url = self.base_url + url if params: diff --git a/elasticsearch/connection/http_urllib3.py b/elasticsearch/connection/http_urllib3.py index 47e6bbaa..57bf8ea9 100644 --- a/elasticsearch/connection/http_urllib3.py +++ b/elasticsearch/connection/http_urllib3.py @@ -1,6 +1,7 @@ import time import urllib3 from urllib3.exceptions import ReadTimeoutError, SSLError as UrllibSSLError +import warnings from .base import Connection from ..exceptions import ConnectionError, ImproperlyConfigured, ConnectionTimeout, SSLError @@ -44,6 +45,9 @@ class Urllib3HttpConnection(Connection): kw['cert_file'] = client_cert elif ca_certs: raise ImproperlyConfigured("You cannot pass CA certificates when verify SSL is off.") + else: + warnings.warn( + 'Connecting to %s using SSL with verify_certs=False is insecure.' % host) self.pool = pool_class(host, port=port, timeout=self.timeout, maxsize=maxsize, **kw) diff --git a/test_elasticsearch/test_connection.py b/test_elasticsearch/test_connection.py index e1448a2a..3019be34 100644 --- a/test_elasticsearch/test_connection.py +++ b/test_elasticsearch/test_connection.py @@ -1,6 +1,7 @@ import re from mock import Mock, patch import urllib3 +import warnings from elasticsearch.exceptions import TransportError, ConflictError, RequestError, NotFoundError from elasticsearch.connection import RequestsHttpConnection, \ @@ -46,7 +47,11 @@ class TestUrllib3Connection(TestCase): self.assertEquals({'authorization': 'Basic dXNlcm5hbWU6c2VjcmV0'}, con.headers) def test_uses_https_if_specified(self): - con = Urllib3HttpConnection(use_ssl=True) + with warnings.catch_warnings(record=True) as w: + con = Urllib3HttpConnection(use_ssl=True) + self.assertEquals(1, len(w)) + self.assertEquals('Connecting to localhost using SSL with verify_certs=False is insecure.', str(w[0].message)) + self.assertIsInstance(con.pool, urllib3.HTTPSConnectionPool) def test_doesnt_use_https_if_not_specified(self): @@ -87,7 +92,11 @@ class TestRequestsConnection(TestCase): self.assertEquals(42, con.timeout) def test_use_https_if_specified(self): - con = self._get_mock_connection({'use_ssl': True, 'url_prefix': 'url'}) + with warnings.catch_warnings(record=True) as w: + con = self._get_mock_connection({'use_ssl': True, 'url_prefix': 'url'}) + self.assertEquals(1, len(w)) + self.assertEquals('Connecting to https://localhost:9200/url using SSL with verify_certs=False is insecure.', str(w[0].message)) + request = self._get_request(con, 'GET', '/') self.assertEquals('https://localhost:9200/url/', request.url)