Add SSL_get0_verified_chain to cffi lib (#4965)

* Add SSL_get0_verified_chain to cffi lib

OpenSSL 1.1.0 supports SSL_get0_verified_chain. This gives the full chain from the peer cert including your trusted CA cert.

* Work around no support for #if in cdef in old cffi

1 files changed, 7 insertions, 0 deletions

diff --git a/src/cryptography/hazmat/bindings/openssl/_conditional.py b/src/cryptography/hazmat/bindings/openssl/_conditional.py
index a1f78193..a2eee181 100644
--- a/src/cryptography/hazmat/bindings/openssl/_conditional.py
+++ b/src/cryptography/hazmat/bindings/openssl/_conditional.py
@@ -358,6 +358,12 @@ def cryptography_has_engine():
     ]
 
 
+def cryptography_has_verified_chain():
+    return [
+        "SSL_get0_verified_chain",
+    ]
+
+
 # This is a mapping of
 # {condition: function-returning-names-dependent-on-that-condition} so we can
 # loop over them and delete unsupported names at runtime. It will be removed
@@ -431,4 +437,5 @@ CONDITIONAL_NAMES = {
         cryptography_has_evp_r_memory_limit_exceeded
     ),
     "Cryptography_HAS_ENGINE": cryptography_has_engine,
+    "Cryptography_HAS_VERIFIED_CHAIN": cryptography_has_verified_chain,
 }