This change introduces a way to tie source address token keys to specific QUIC server configs

net/quic/crypto/crypto_server_config_protobuf.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_
 #define NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 43 matching lines @@
   const PrivateKey& key(size_t i) const {
     DCHECK_GT(keys_.size(), i);
     return *keys_[i];
   }
 
   std::string config() const {
     return config_;
   }
 
   void set_config(base::StringPiece config) {
-    config_ = config.as_string();
+    config.CopyToString(&config_);
   }
 
   QuicServerConfigProtobuf::PrivateKey* add_key() {
     keys_.push_back(new PrivateKey);
     return keys_.back();
   }
 
   void clear_key() {
     STLDeleteElements(&keys_);
   }
 
   bool has_primary_time() const {
     return primary_time_ > 0;
   }
 
   int64 primary_time() const {
     return primary_time_;
   }
 
   void set_primary_time(int64 primary_time) {
     primary_time_ = primary_time;
   }
 
   bool has_priority() const {
     return priority_ > 0;
   }
 
-  int64 priority() const {
+  uint64 priority() const {
     return priority_;
   }
 
   void set_priority(int64 priority) {
     priority_ = priority;
   }
 
+  bool has_source_address_token_secret_override() const {
+    return !source_address_token_secret_override_.empty();
+  }
+
+  std::string source_address_token_secret_override() const {
+    return source_address_token_secret_override_;
+  }
+
+  void set_source_address_token_secret_override(
+      base::StringPiece source_address_token_secret_override) {
+    source_address_token_secret_override.CopyToString(
+        &source_address_token_secret_override_);
+  }
+
  private:
   std::vector<PrivateKey*> keys_;
 
   // config_ is a serialised config in QUIC wire format.
   std::string config_;
 
   // primary_time_ contains a UNIX epoch seconds value that indicates when this
   // config should become primary.
   int64 primary_time_;
 
   // Relative priority of this config vs other configs with the same
   // primary time.  For use as a secondary sort key when selecting the
   // primary config.
   uint64 priority_;
 
+  // Optional override to the secret used to box/unbox source address
+  // tokens when talking to clients that select this server config.
+  // It can be of any length as it is fed into a KDF before use.
+  std::string source_address_token_secret_override_;
+
   DISALLOW_COPY_AND_ASSIGN(QuicServerConfigProtobuf);
 };
 
 }  // namespace net
 
 #endif  // NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_