Delay a QUIC server's use of the FORWARD_SECURE encrypter until the

net/quic/quic_connection.h

Index: net/quic/quic_connection.h
diff --git a/net/quic/quic_connection.h b/net/quic/quic_connection.h
index cd3d3d4a7de4108f671deba14549028a331d3e1e..7d83d37baf95b187eea386e405fc49f080280271 100644
--- a/net/quic/quic_connection.h
+++ b/net/quic/quic_connection.h
@@ -460,7 +460,7 @@ class NET_EXPORT_PRIVATE QuicConnection
   void RetransmitUnackedPackets(TransmissionType retransmission_type);
 
   // Calls |sent_packet_manager_|'s NeuterUnencryptedPackets. Used when the
-  // connection becomes forward secure and hasn't received acks for all packets.
+  // connection becomes forward-secure and hasn't received acks for all packets.
   void NeuterUnencryptedPackets();
 
   // Changes the encrypter used for level |level| to |encrypter|. The function
@@ -678,7 +678,14 @@ class NET_EXPORT_PRIVATE QuicConnection
   QuicConnectionHelperInterface* helper_;  // Not owned.
   QuicPacketWriter* writer_;  // Owned or not depending on |owns_writer_|.
   bool owns_writer_;
+  // Encryption level for new packets. Should only be changed via
+  // SetDefaultEncryptionLevel().
   EncryptionLevel encryption_level_;
+  bool has_forward_secure_encrypter_;
+  // The sequence number of the first packet which will be encrypted with the
+  // foward-secure encrypter, even if the peer has not started sending
+  // forward-secure packets.
+  QuicPacketSequenceNumber first_required_forward_secure_packet_;
   const QuicClock* clock_;
   QuicRandom* random_generator_;