Add set_verify method on Connection

[mithrandi]

When changing the context with set_context, the verify mode/callback is not updated from the new context, you need to call SSL_set_verify on the connection to update it.

This function is not currently exposed by Cryptography, so it will need to be added there too.

[mithrandi]

set_verify_depth should probably be added at the same time.

[ihamburglar]

Sorry, what exactly does this do?

[mithrandi]

That method is on Context, not Connection; as previously mentioned, the context settings are used to initialize the connection, but if the context is changed with set_context later, the verification settings from the new context are not transferred to the connection.

[mithrandi]

To elaborate on this a bit further: set_context is commonly used in a callback set with set_tlsext_servername_callback in order to change the context based on which hostname the client requests using SNI; if you want to do client verification on some hostnames but not on others, you need to be able to call SSL_set_verify to change the verification settings on that connection.

[ihamburglar]

Ah gotcha.

[mhils]

We have some renewed interest in this from some folks in mitmproxy/mitmproxy#5019, it also looks like we wouldn't be the only ones for whom this would be useful. I'd be happy to re-add the bindings to cryptography and then update #844.

@alex, @reaperhulk et al: Is this something you would be willing to merge, or too much extra complexity for too little value? I don't have strong feelings, we can easily continue to work around this on our end if necessary.

[reaperhulk]

Adding this to Connection + a single additional binding in cryptography seems reasonable to me given that you have people interested in actually using it.