This change introduces a way to tie source address token keys to specific QUIC server configs

net/quic/crypto/crypto_server_config_protobuf.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_
 #define NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 71 matching lines @@
   }
 
   void set_primary_time(int64 primary_time) {
     primary_time_ = primary_time;
   }
 
   bool has_priority() const {
     return priority_ > 0;
   }
 
-  int64 priority() const {
+  uint64 priority() const {
     return priority_;
   }
 
   void set_priority(int64 priority) {
     priority_ = priority;
   }
 
+  bool has_source_address_token_secret_override() const {
+    return !source_address_token_secret_override_.empty();
+  }
+
+  std::string source_address_token_secret_override() const {
+    return source_address_token_secret_override_;
+  }
+
+  void set_source_address_token_secret_override(
+      base::StringPiece source_address_token_secret_override) {
+    source_address_token_secret_override_ =
+        source_address_token_secret_override.as_string();

[wtc, 2014/04/07 18:38:24]

Nit:
source_address_token_secret_override.CopyToString(&source_address_token_secret_override_)
is slightly cheaper. You can make the same change to set_config().

[ramant (doing other things), 2014/04/21 22:39:29]

Done.

+    LOG(ERROR) << "override: " << source_address_token_secret_override_;

[wtc, 2014/04/07 18:38:24]

IMPORTANT: remove this error message?

[ramant (doing other things), 2014/04/21 22:39:29]

Done.

+  }
+
  private:
   std::vector<PrivateKey*> keys_;
 
   // config_ is a serialised config in QUIC wire format.
   std::string config_;
 
   // primary_time_ contains a UNIX epoch seconds value that indicates when this
   // config should become primary.
   int64 primary_time_;
 
   // Relative priority of this config vs other configs with the same
   // primary time.  For use as a secondary sort key when selecting the
   // primary config.
   uint64 priority_;
+
+  // Optional override to the secret used to box/unbox source address
+  // tokens when talking to clients that select this server config.
+  // It can be of any length as it is fed into a KDF before use.
+  std::string source_address_token_secret_override_;
 };
 
 }  // namespace net
 
 #endif  // NET_QUIC_CRYPTO_CRYPTO_SERVER_CONFIG_PROTOBUF_H_