UDP firewall rules for Windows.

chrome/browser/io_thread.cc

Index: chrome/browser/io_thread.cc
diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index f8ea00c9b531f50991762a9cff38f8512e80c944..fa8356aaf53af4303ca3aa8dcb20110b86707448 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -15,6 +15,7 @@
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/metrics/field_trial.h"
+#include "base/path_service.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/pref_service.h"
 #include "base/stl_util.h"
@@ -82,6 +83,8 @@
 #include "net/websockets/websocket_job.h"
 
 #if defined(OS_WIN)
+#include "chrome/installer/util/browser_distribution.h"
+#include "chrome/installer/util/firewall_manager.h"
 #include "win8/util/win8_util.h"
 #endif
 
@@ -1145,17 +1148,17 @@ bool IOThread::ShouldEnableQuicPortSelection(
 
 #if defined(OS_WIN)
   chrome::VersionInfo::Channel channel = chrome::VersionInfo::GetChannel();
-  // Avoid picking ports (which might induce a security dialog) when we have a
-  // beta or stable release.  Allow in all other cases, including when we do a
-  // developer build (CHANNEL_UNKNOWN).
+  // Only pick ports on beta and stable channels when it seems that the firewall
+  // will allow it without prompting the user.
   if (channel == chrome::VersionInfo::CHANNEL_STABLE ||
       channel == chrome::VersionInfo::CHANNEL_BETA) {
-    // TODO(grt) bug=329255: Detect presence of rule on Windows that allows us
-    // to do port selection without inducing a dialog.
-    // When we have an API to see if the administrative security manager will
-    // allow port selection without a security dialog, we may return true if
-    // we're sure there will be no security dialog.
-    return false;
+    base::FilePath chrome_exe;
+    if (!PathService::Get(base::FILE_EXE, &chrome_exe))
+      return false;
+    scoped_ptr<installer::FirewallManager> firewall_manager(
+        installer::FirewallManager::Create(
+            BrowserDistribution::GetDistribution(), chrome_exe));
+    return firewall_manager && firewall_manager->CanUseLocalUDPPort();
   }
   return true;
 #else