This change introduces a way to tie source address token keys to specific QUIC server configs

net/quic/crypto/crypto_server_config_protobuf.h

Index: net/quic/crypto/crypto_server_config_protobuf.h
diff --git a/net/quic/crypto/crypto_server_config_protobuf.h b/net/quic/crypto/crypto_server_config_protobuf.h
index e76ff1452b445c7d7b899dc59979caa744896891..18f419e088f652d99a918bf9e9bcb4de46a759d0 100644
--- a/net/quic/crypto/crypto_server_config_protobuf.h
+++ b/net/quic/crypto/crypto_server_config_protobuf.h
@@ -89,7 +89,7 @@ class NET_EXPORT_PRIVATE QuicServerConfigProtobuf {
     return priority_ > 0;
   }
 
-  int64 priority() const {
+  uint64 priority() const {
     return priority_;
   }
 
@@ -97,6 +97,21 @@ class NET_EXPORT_PRIVATE QuicServerConfigProtobuf {
     priority_ = priority;
   }
 
+  bool has_source_address_token_secret_override() const {
+    return !source_address_token_secret_override_.empty();
+  }
+
+  std::string source_address_token_secret_override() const {
+    return source_address_token_secret_override_;
+  }
+
+  void set_source_address_token_secret_override(
+      base::StringPiece source_address_token_secret_override) {
+    source_address_token_secret_override_ =
+        source_address_token_secret_override.as_string();

[wtc, 2014/04/07 18:38:24]

Nit:
source_address_token_secret_override.CopyToString(&source_address_token_secret_override_)
is slightly cheaper. You can make the same change to set_config().

[ramant (doing other things), 2014/04/21 22:39:29]

Done.

+    LOG(ERROR) << "override: " << source_address_token_secret_override_;

[wtc, 2014/04/07 18:38:24]

IMPORTANT: remove this error message?

[ramant (doing other things), 2014/04/21 22:39:29]

Done.

+  }
+
  private:
   std::vector<PrivateKey*> keys_;
 
@@ -111,6 +126,11 @@ class NET_EXPORT_PRIVATE QuicServerConfigProtobuf {
   // primary time.  For use as a secondary sort key when selecting the
   // primary config.
   uint64 priority_;
+
+  // Optional override to the secret used to box/unbox source address
+  // tokens when talking to clients that select this server config.
+  // It can be of any length as it is fed into a KDF before use.
+  std::string source_address_token_secret_override_;
 };
 
 }  // namespace net