Log the certificate subjects from the server certificate sent via QUIC.

net/quic/quic_connection_logger.cc

Index: net/quic/quic_connection_logger.cc
diff --git a/net/quic/quic_connection_logger.cc b/net/quic/quic_connection_logger.cc
index 4fbe6a4e28d2fc0cc87bd97c15718cff5e94aca3..84d6b37c578b806664d97977e399c32e7e7adf8d 100644
--- a/net/quic/quic_connection_logger.cc
+++ b/net/quic/quic_connection_logger.cc
@@ -15,6 +15,8 @@
 #include "base/values.h"
 #include "net/base/net_log.h"
 #include "net/base/net_util.h"
+#include "net/cert/cert_verify_result.h"
+#include "net/cert/x509_certificate.h"
 #include "net/quic/crypto/crypto_handshake_message.h"
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/quic_address_mismatch.h"
@@ -239,6 +241,21 @@ base::Value* NetLogQuicOnConnectionClosedCallback(
   return dict;
 }
 
+base::Value* NetLogQuicCertificateVerifiedCallback(
+    scoped_refptr<X509Certificate> cert,
+    NetLog::LogLevel /* log_level */) {
+  std::vector<std::string> dns_names;
+  cert->GetDNSNames(&dns_names);
+  base::DictionaryValue* dict = new base::DictionaryValue();
+  base::ListValue* subjects = new base::ListValue();
+  for (std::vector<std::string>::const_iterator it = dns_names.begin();
+       it != dns_names.end(); it++) {
+    subjects->Append(new base::StringValue(*it));
+  }
+  dict->Set("subjects", subjects);
+  return dict;
+}
+
 void UpdatePacketGapSentHistogram(size_t num_consecutive_missing_packets) {
   UMA_HISTOGRAM_COUNTS("Net.QuicSession.PacketGapSent",
                        num_consecutive_missing_packets);
@@ -672,6 +689,13 @@ void QuicConnectionLogger::UpdateReceivedFrameCounts(
   }
 }
 
+void QuicConnectionLogger::OnCertificateVerified(
+    const CertVerifyResult& result) {
+  net_log_.AddEvent(
+      NetLog::TYPE_QUIC_SESSION_CERTIFICATE_VERIFIED,
+      base::Bind(&NetLogQuicCertificateVerifiedCallback, result.verified_cert));

[wtc, 2014/07/24 17:34:36]

Nit: if we pass a const const CertVerifyResult& to base::Bind(), will
base::Bind() copy the entire CertVerifyResult object? If so, then passing a
reference to result.verified_cert is cheaper.

[Ryan Hamilton, 2014/07/24 17:45:09]

Yes, I believe that's exactly what will happen.

+}
+
 base::HistogramBase* QuicConnectionLogger::GetPacketSequenceNumberHistogram(
     const char* statistic_name) const {
   string prefix("Net.QuicSession.PacketReceived_");