Warn when people using insecure options.

elasticsearch/connection/http_requests.py

@@ -1,4 +1,5 @@
 import time
+import warnings
 try:
     import requests
     REQUESTS_AVAILABLE = True
@@ -46,6 +47,10 @@ class RequestsHttpConnection(Connection):
                 raise ImproperlyConfigured("You cannot pass CA certificates when verify SSL is off.")
             self.session.verify = ca_certs
 
+        if use_ssl and not verify_certs:
+            warnings.warn(
+                'Connecting to %s using SSL with verify_certs=False is insecure.' % self.base_url)
+
     def perform_request(self, method, url, params=None, body=None, timeout=None, ignore=()):
         url = self.base_url + url
         if params:

elasticsearch/connection/http_urllib3.py

@@ -1,6 +1,7 @@
 import time
 import urllib3
 from urllib3.exceptions import ReadTimeoutError, SSLError as UrllibSSLError
+import warnings
 
 from .base import Connection
 from ..exceptions import ConnectionError, ImproperlyConfigured, ConnectionTimeout, SSLError
@@ -44,6 +45,9 @@ class Urllib3HttpConnection(Connection):
                 kw['cert_file'] = client_cert
             elif ca_certs:
                 raise ImproperlyConfigured("You cannot pass CA certificates when verify SSL is off.")
+            else:
+                warnings.warn(
+                    'Connecting to %s using SSL with verify_certs=False is insecure.' % host)
 
         self.pool = pool_class(host, port=port, timeout=self.timeout, maxsize=maxsize, **kw)
 

test_elasticsearch/test_connection.py

@@ -1,6 +1,7 @@
 import re
 from mock import Mock, patch
 import urllib3
+import warnings
 
 from elasticsearch.exceptions import TransportError, ConflictError, RequestError, NotFoundError
 from elasticsearch.connection import RequestsHttpConnection, \
@@ -46,7 +47,11 @@ class TestUrllib3Connection(TestCase):
         self.assertEquals({'authorization': 'Basic dXNlcm5hbWU6c2VjcmV0'}, con.headers)
 
     def test_uses_https_if_specified(self):
+        with warnings.catch_warnings(record=True) as w:
             con = Urllib3HttpConnection(use_ssl=True)
+            self.assertEquals(1, len(w))
+            self.assertEquals('Connecting to localhost using SSL with verify_certs=False is insecure.', str(w[0].message))
+
         self.assertIsInstance(con.pool, urllib3.HTTPSConnectionPool)
 
     def test_doesnt_use_https_if_not_specified(self):
@@ -87,7 +92,11 @@ class TestRequestsConnection(TestCase):
         self.assertEquals(42, con.timeout)
 
     def test_use_https_if_specified(self):
+        with warnings.catch_warnings(record=True) as w:
             con = self._get_mock_connection({'use_ssl': True, 'url_prefix': 'url'})
+            self.assertEquals(1, len(w))
+            self.assertEquals('Connecting to https://localhost:9200/url using SSL with verify_certs=False is insecure.', str(w[0].message))
+
         request = self._get_request(con, 'GET', '/')
 
         self.assertEquals('https://localhost:9200/url/', request.url)