Add NetworkIsolationKey to QuicSessionKey.

And don't pool QUIC requests with different NetworkIsolationKeys when
kPartitionConnectionsByNetworkIsolationKey is enabled.

BUG=963480

Change-Id: I41a3bf3f4f0a24a5bfc264de46fc28e1f880d46d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1629227
Commit-Queue: Matt Menke <[email protected]>
Reviewed-by: Zhongyi Shi <[email protected]>
Cr-Commit-Position: refs/heads/master@{#666102}
diff --git a/net/base/network_isolation_key.h b/net/base/network_isolation_key.h
index ced5858..68f3784 100644
--- a/net/base/network_isolation_key.h
+++ b/net/base/network_isolation_key.h
@@ -35,6 +35,10 @@
     return top_frame_origin_ == other.top_frame_origin_;
   }
 
+  bool operator!=(const NetworkIsolationKey& other) const {
+    return !(top_frame_origin_ == other.top_frame_origin_);
+  }
+
   bool operator<(const NetworkIsolationKey& other) const {
     return top_frame_origin_ < other.top_frame_origin_;
   }
diff --git a/net/http/http_proxy_connect_job.cc b/net/http/http_proxy_connect_job.cc
index d488656..e436396c 100644
--- a/net/http/http_proxy_connect_job.cc
+++ b/net/http/http_proxy_connect_job.cc
@@ -663,7 +663,7 @@
       common_connect_job_params()->quic_supported_versions->front();
   return quic_stream_request_->Request(
       proxy_server, quic_version.transport_version, ssl_params->privacy_mode(),
-      kH2QuicTunnelPriority, socket_tag(),
+      kH2QuicTunnelPriority, socket_tag(), params_->network_isolation_key(),
       ssl_params->ssl_config().GetCertVerifyFlags(),
       GURL("https://" + proxy_server.ToString()), net_log(),
       &quic_net_error_details_,
diff --git a/net/http/http_stream_factory_job.cc b/net/http/http_stream_factory_job.cc
index e176dfd..0994bf1 100644
--- a/net/http/http_stream_factory_job.cc
+++ b/net/http/http_stream_factory_job.cc
@@ -775,7 +775,8 @@
     int rv = quic_request_.Request(
         destination, quic_version_.transport_version,
         request_info_.privacy_mode, priority_, request_info_.socket_tag,
-        ssl_config->GetCertVerifyFlags(), url, net_log_, &net_error_details_,
+        request_info_.network_isolation_key, ssl_config->GetCertVerifyFlags(),
+        url, net_log_, &net_error_details_,
         base::BindOnce(&Job::OnFailedOnDefaultNetwork,
                        ptr_factory_.GetWeakPtr()),
         io_callback_);
diff --git a/net/http/http_stream_factory_job_controller.cc b/net/http/http_stream_factory_job_controller.cc
index d208cd01..ad0ad9d 100644
--- a/net/http/http_stream_factory_job_controller.cc
+++ b/net/http/http_stream_factory_job_controller.cc
@@ -1067,7 +1067,8 @@
     HostPortPair mapped_origin(origin.host(), origin.port());
     ignore_result(ApplyHostMappingRules(original_url, &mapped_origin));
     QuicSessionKey session_key(mapped_origin, request_info.privacy_mode,
-                               request_info.socket_tag);
+                               request_info.socket_tag,
+                               request_info.network_isolation_key);
 
     HostPortPair destination(alternative_service_info.host_port_pair());
     if (session_key.host() != destination.host() &&
diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
index 1d7b2bf..c216b1f8 100644
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/feature_list.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_functions.h"
@@ -20,9 +21,11 @@
 #include "base/time/tick_clock.h"
 #include "base/trace_event/memory_usage_estimator.h"
 #include "base/values.h"
+#include "net/base/features.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/network_activity_monitor.h"
+#include "net/base/network_isolation_key.h"
 #include "net/base/url_util.h"
 #include "net/http/transport_security_state.h"
 #include "net/log/net_log_event_type.h"
@@ -1285,12 +1288,17 @@
   return crypto_stream_->num_sent_client_hellos();
 }
 
-bool QuicChromiumClientSession::CanPool(const std::string& hostname,
-                                        PrivacyMode privacy_mode,
-                                        const SocketTag& socket_tag) const {
+bool QuicChromiumClientSession::CanPool(
+    const std::string& hostname,
+    PrivacyMode privacy_mode,
+    const SocketTag& socket_tag,
+    const NetworkIsolationKey& network_isolation_key) const {
   DCHECK(connection()->connected());
   if (privacy_mode != session_key_.privacy_mode() ||
-      socket_tag != session_key_.socket_tag()) {
+      socket_tag != session_key_.socket_tag() ||
+      (network_isolation_key != session_key_.network_isolation_key() &&
+       base::FeatureList::IsEnabled(
+           features::kPartitionConnectionsByNetworkIsolationKey))) {
     // Privacy mode and socket tag must always match.
     return false;
   }
@@ -3010,7 +3018,8 @@
 
 bool QuicChromiumClientSession::IsAuthorized(const std::string& hostname) {
   bool result =
-      CanPool(hostname, session_key_.privacy_mode(), session_key_.socket_tag());
+      CanPool(hostname, session_key_.privacy_mode(), session_key_.socket_tag(),
+              session_key_.network_isolation_key());
   if (result)
     streams_pushed_count_++;
   return result;
diff --git a/net/quic/quic_chromium_client_session.h b/net/quic/quic_chromium_client_session.h
index e1c9398..05610e4 100644
--- a/net/quic/quic_chromium_client_session.h
+++ b/net/quic/quic_chromium_client_session.h
@@ -52,6 +52,7 @@
 class CertVerifyResult;
 class DatagramClientSocket;
 class NetLog;
+class NetworkIsolationKey;
 class QuicCryptoClientStreamFactory;
 class QuicServerInfo;
 class QuicStreamFactory;
@@ -555,7 +556,8 @@
   // presented during the handshake.
   bool CanPool(const std::string& hostname,
                PrivacyMode privacy_mode,
-               const SocketTag& socket_tag) const;
+               const SocketTag& socket_tag,
+               const NetworkIsolationKey& network_isolation_key) const;
 
   const quic::QuicServerId& server_id() const {
     return session_key_.server_id();
diff --git a/net/quic/quic_chromium_client_session_test.cc b/net/quic/quic_chromium_client_session_test.cc
index cb20853..17ae6e8 100644
--- a/net/quic/quic_chromium_client_session_test.cc
+++ b/net/quic/quic_chromium_client_session_test.cc
@@ -11,9 +11,12 @@
 #include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/default_tick_clock.h"
 #include "build/build_config.h"
+#include "net/base/features.h"
+#include "net/base/network_isolation_key.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/http/transport_security_state.h"
@@ -1309,24 +1312,102 @@
   CompleteCryptoHandshake();
   session_->OnProofVerifyDetailsAvailable(details);
 
-  EXPECT_TRUE(
-      session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, SocketTag()));
-  EXPECT_FALSE(
-      session_->CanPool("www.example.org", PRIVACY_MODE_ENABLED, SocketTag()));
+  EXPECT_TRUE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED,
+                                SocketTag(), NetworkIsolationKey()));
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_ENABLED,
+                                 SocketTag(), NetworkIsolationKey()));
 #if defined(OS_ANDROID)
   SocketTag tag1(SocketTag::UNSET_UID, 0x12345678);
   SocketTag tag2(getuid(), 0x87654321);
-  EXPECT_FALSE(
-      session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag1));
-  EXPECT_FALSE(
-      session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag2));
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag1,
+                                 NetworkIsolationKey()));
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag2,
+                                 NetworkIsolationKey()));
 #endif
   EXPECT_TRUE(session_->CanPool("mail.example.org", PRIVACY_MODE_DISABLED,
-                                SocketTag()));
+                                SocketTag(), NetworkIsolationKey()));
   EXPECT_TRUE(session_->CanPool("mail.example.com", PRIVACY_MODE_DISABLED,
-                                SocketTag()));
-  EXPECT_FALSE(
-      session_->CanPool("mail.google.com", PRIVACY_MODE_DISABLED, SocketTag()));
+                                SocketTag(), NetworkIsolationKey()));
+  EXPECT_FALSE(session_->CanPool("mail.google.com", PRIVACY_MODE_DISABLED,
+                                 SocketTag(), NetworkIsolationKey()));
+
+  // Check that NetworkIsolationKey is respected when feature is enabled.
+  {
+    base::test::ScopedFeatureList feature_list;
+    feature_list.InitAndDisableFeature(
+        features::kPartitionConnectionsByNetworkIsolationKey);
+    EXPECT_TRUE(session_->CanPool(
+        "mail.example.com", PRIVACY_MODE_DISABLED, SocketTag(),
+        NetworkIsolationKey(url::Origin::Create(GURL("http://foo.test/")))));
+  }
+  {
+    base::test::ScopedFeatureList feature_list;
+    feature_list.InitAndEnableFeature(
+        features::kPartitionConnectionsByNetworkIsolationKey);
+    EXPECT_FALSE(session_->CanPool(
+        "mail.example.com", PRIVACY_MODE_DISABLED, SocketTag(),
+        NetworkIsolationKey(url::Origin::Create(GURL("http://foo.test/")))));
+  }
+}
+
+// Much as above, but uses a non-empty NetworkIsolationKey.
+TEST_P(QuicChromiumClientSessionTest, CanPoolWithNetworkIsolationKey) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(
+      features::kPartitionConnectionsByNetworkIsolationKey);
+
+  const NetworkIsolationKey kNetworkIsolationKey1(
+      url::Origin::Create(GURL("http://foo.test/")));
+  const NetworkIsolationKey kNetworkIsolationKey2(
+      url::Origin::Create(GURL("http://bar.test/")));
+
+  session_key_ =
+      QuicSessionKey(kServerHostname, kServerPort, PRIVACY_MODE_DISABLED,
+                     SocketTag(), kNetworkIsolationKey1);
+
+  MockRead reads[] = {MockRead(SYNCHRONOUS, ERR_IO_PENDING, 0)};
+  std::unique_ptr<quic::QuicEncryptedPacket> settings_packet(
+      client_maker_.MakeInitialSettingsPacket(1, nullptr));
+  MockWrite writes[] = {
+      MockWrite(ASYNC, settings_packet->data(), settings_packet->length(), 1)};
+  socket_data_.reset(new SequencedSocketData(reads, writes));
+  Initialize();
+  // Load a cert that is valid for:
+  //   www.example.org
+  //   mail.example.org
+  //   www.example.com
+
+  ProofVerifyDetailsChromium details;
+  details.cert_verify_result.verified_cert =
+      ImportCertFromFile(GetTestCertsDirectory(), "spdy_pooling.pem");
+  ASSERT_TRUE(details.cert_verify_result.verified_cert.get());
+
+  CompleteCryptoHandshake();
+  session_->OnProofVerifyDetailsAvailable(details);
+
+  EXPECT_TRUE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED,
+                                SocketTag(), kNetworkIsolationKey1));
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_ENABLED,
+                                 SocketTag(), kNetworkIsolationKey1));
+#if defined(OS_ANDROID)
+  SocketTag tag1(SocketTag::UNSET_UID, 0x12345678);
+  SocketTag tag2(getuid(), 0x87654321);
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag1,
+                                 kNetworkIsolationKey1));
+  EXPECT_FALSE(session_->CanPool("www.example.org", PRIVACY_MODE_DISABLED, tag2,
+                                 kNetworkIsolationKey1));
+#endif
+  EXPECT_TRUE(session_->CanPool("mail.example.org", PRIVACY_MODE_DISABLED,
+                                SocketTag(), kNetworkIsolationKey1));
+  EXPECT_TRUE(session_->CanPool("mail.example.com", PRIVACY_MODE_DISABLED,
+                                SocketTag(), kNetworkIsolationKey1));
+  EXPECT_FALSE(session_->CanPool("mail.google.com", PRIVACY_MODE_DISABLED,
+                                 SocketTag(), kNetworkIsolationKey1));
+
+  EXPECT_FALSE(session_->CanPool("mail.example.com", PRIVACY_MODE_DISABLED,
+                                 SocketTag(), kNetworkIsolationKey2));
+  EXPECT_FALSE(session_->CanPool("mail.example.com", PRIVACY_MODE_DISABLED,
+                                 SocketTag(), NetworkIsolationKey()));
 }
 
 TEST_P(QuicChromiumClientSessionTest, ConnectionNotPooledWithDifferentPin) {
@@ -1366,8 +1447,8 @@
   session_->OnProofVerifyDetailsAvailable(details);
   QuicChromiumClientSessionPeer::SetHostname(session_.get(), kNoPinsHost);
 
-  EXPECT_FALSE(
-      session_->CanPool(kPreloadedPKPHost, PRIVACY_MODE_DISABLED, SocketTag()));
+  EXPECT_FALSE(session_->CanPool(kPreloadedPKPHost, PRIVACY_MODE_DISABLED,
+                                 SocketTag(), NetworkIsolationKey()));
 }
 
 TEST_P(QuicChromiumClientSessionTest, ConnectionPooledWithMatchingPin) {
@@ -1399,7 +1480,7 @@
   QuicChromiumClientSessionPeer::SetHostname(session_.get(), "www.example.org");
 
   EXPECT_TRUE(session_->CanPool("mail.example.org", PRIVACY_MODE_DISABLED,
-                                SocketTag()));
+                                SocketTag(), NetworkIsolationKey()));
 }
 
 TEST_P(QuicChromiumClientSessionTest, MigrateToSocket) {
diff --git a/net/quic/quic_network_transaction_unittest.cc b/net/quic/quic_network_transaction_unittest.cc
index 40c5d9d8..712f11a 100644
--- a/net/quic/quic_network_transaction_unittest.cc
+++ b/net/quic/quic_network_transaction_unittest.cc
@@ -17,8 +17,10 @@
 #include "base/strings/string_piece.h"
 #include "base/strings/stringprintf.h"
 #include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
 #include "net/base/chunked_upload_data_stream.h"
 #include "net/base/completion_once_callback.h"
+#include "net/base/features.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/mock_network_change_notifier.h"
 #include "net/base/test_completion_callback.h"
@@ -8718,5 +8720,405 @@
   EXPECT_TRUE(mock_quic_data.AllWriteDataConsumed());
 }
 
+// Test that NetworkIsolationKey is respected by QUIC connections, when
+// kPartitionConnectionsByNetworkIsolationKey is enabled.
+TEST_P(QuicNetworkTransactionTest, NetworkIsolation) {
+  NetworkIsolationKey network_isolation_key1(
+      url::Origin::Create(GURL("http://origin1/")));
+  NetworkIsolationKey network_isolation_key2(
+      url::Origin::Create(GURL("http://origin2/")));
+
+  session_params_.origins_to_force_quic_on.insert(
+      HostPortPair::FromString("mail.example.org:443"));
+
+  // Whether to use an H2 proxy. When false, uses HTTPS H2 requests without a
+  // proxy, when true, uses HTTP requests over an H2 proxy. It's unnecessary to
+  // test tunneled HTTPS over an H2 proxy, since that path sets up H2 sessions
+  // the same way as the HTTP over H2 proxy case.
+  for (bool use_proxy : {false, true}) {
+    SCOPED_TRACE(use_proxy);
+
+    if (use_proxy) {
+      proxy_resolution_service_ =
+          ProxyResolutionService::CreateFixedFromPacResult(
+              "QUIC mail.example.org:443", TRAFFIC_ANNOTATION_FOR_TESTS);
+    } else {
+      proxy_resolution_service_ = ProxyResolutionService::CreateDirect();
+    }
+
+    GURL url1;
+    GURL url2;
+    GURL url3;
+    if (use_proxy) {
+      url1 = GURL("http://mail.example.org/1");
+      url2 = GURL("http://mail.example.org/2");
+      url3 = GURL("http://mail.example.org/3");
+    } else {
+      url1 = GURL("https://mail.example.org/1");
+      url2 = GURL("https://mail.example.org/2");
+      url3 = GURL("https://mail.example.org/3");
+    }
+
+    for (bool partition_connections : {false, true}) {
+      SCOPED_TRACE(partition_connections);
+
+      base::test::ScopedFeatureList feature_list;
+      if (partition_connections) {
+        feature_list.InitAndEnableFeature(
+            features::kPartitionConnectionsByNetworkIsolationKey);
+      } else {
+        feature_list.InitAndDisableFeature(
+            features::kPartitionConnectionsByNetworkIsolationKey);
+      }
+
+      // Reads and writes for the unpartitioned case, where only one socket is
+      // used.
+
+      session_params_.origins_to_force_quic_on.insert(
+          HostPortPair::FromString("mail.example.org:443"));
+
+      MockQuicData unpartitioned_mock_quic_data;
+      quic::QuicStreamOffset request_header_offset = 0;
+      quic::QuicStreamOffset response_header_offset = 0;
+      QuicTestPacketMaker client_maker1(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_CLIENT,
+          client_headers_include_h2_stream_dependency_);
+      QuicTestPacketMaker server_maker1(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_SERVER, false);
+
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS,
+          client_maker1.MakeInitialSettingsPacket(1, &request_header_offset));
+
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS,
+          client_maker1.MakeRequestHeadersPacketWithOffsetTracking(
+              2, GetNthClientInitiatedBidirectionalStreamId(0), true, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url1.scheme(), "/1"), 0,
+              &request_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC,
+          server_maker1.MakeResponseHeadersPacketWithOffsetTracking(
+              1, GetNthClientInitiatedBidirectionalStreamId(0), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC, server_maker1.MakeDataPacket(
+                     2, GetNthClientInitiatedBidirectionalStreamId(0), false,
+                     true, 0, ConstructDataHeader(1) + "1"));
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS, ConstructClientAckPacket(3, 2, 1, 1));
+
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS,
+          client_maker1.MakeRequestHeadersPacketWithOffsetTracking(
+              4, GetNthClientInitiatedBidirectionalStreamId(1), false, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url2.scheme(), "/2"), 0,
+              &request_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC,
+          server_maker1.MakeResponseHeadersPacketWithOffsetTracking(
+              3, GetNthClientInitiatedBidirectionalStreamId(1), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC, server_maker1.MakeDataPacket(
+                     4, GetNthClientInitiatedBidirectionalStreamId(1), false,
+                     true, 0, ConstructDataHeader(1) + "2"));
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS, ConstructClientAckAndConnectionClosePacket(5, 4, 3, 1));
+
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS,
+          client_maker1.MakeRequestHeadersPacketWithOffsetTracking(
+              6, GetNthClientInitiatedBidirectionalStreamId(2), false, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url3.scheme(), "/3"), 0,
+              &request_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC,
+          server_maker1.MakeResponseHeadersPacketWithOffsetTracking(
+              5, GetNthClientInitiatedBidirectionalStreamId(2), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      unpartitioned_mock_quic_data.AddRead(
+          ASYNC, server_maker1.MakeDataPacket(
+                     6, GetNthClientInitiatedBidirectionalStreamId(2), false,
+                     true, 0, ConstructDataHeader(1) + "3"));
+      unpartitioned_mock_quic_data.AddWrite(
+          SYNCHRONOUS, ConstructClientAckAndConnectionClosePacket(7, 6, 5, 1));
+
+      unpartitioned_mock_quic_data.AddRead(SYNCHRONOUS, ERR_IO_PENDING);
+
+      // Reads and writes for the partitioned case, where two sockets are used.
+
+      MockQuicData partitioned_mock_quic_data1;
+      request_header_offset = 0;
+      response_header_offset = 0;
+      QuicTestPacketMaker client_maker2(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_CLIENT,
+          client_headers_include_h2_stream_dependency_);
+      QuicTestPacketMaker server_maker2(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_SERVER, false);
+
+      partitioned_mock_quic_data1.AddWrite(
+          SYNCHRONOUS,
+          client_maker2.MakeInitialSettingsPacket(1, &request_header_offset));
+
+      partitioned_mock_quic_data1.AddWrite(
+          SYNCHRONOUS,
+          client_maker2.MakeRequestHeadersPacketWithOffsetTracking(
+              2, GetNthClientInitiatedBidirectionalStreamId(0), true, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url1.scheme(), "/1"), 0,
+              &request_header_offset));
+      partitioned_mock_quic_data1.AddRead(
+          ASYNC,
+          server_maker2.MakeResponseHeadersPacketWithOffsetTracking(
+              1, GetNthClientInitiatedBidirectionalStreamId(0), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      partitioned_mock_quic_data1.AddRead(
+          ASYNC, server_maker2.MakeDataPacket(
+                     2, GetNthClientInitiatedBidirectionalStreamId(0), false,
+                     true, 0, ConstructDataHeader(1) + "1"));
+      partitioned_mock_quic_data1.AddWrite(
+          SYNCHRONOUS, client_maker2.MakeAckPacket(3, 2, 1, 1, true));
+
+      partitioned_mock_quic_data1.AddWrite(
+          SYNCHRONOUS,
+          client_maker2.MakeRequestHeadersPacketWithOffsetTracking(
+              4, GetNthClientInitiatedBidirectionalStreamId(1), false, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url3.scheme(), "/3"), 0,
+              &request_header_offset));
+      partitioned_mock_quic_data1.AddRead(
+          ASYNC,
+          server_maker2.MakeResponseHeadersPacketWithOffsetTracking(
+              3, GetNthClientInitiatedBidirectionalStreamId(1), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      partitioned_mock_quic_data1.AddRead(
+          ASYNC, server_maker2.MakeDataPacket(
+                     4, GetNthClientInitiatedBidirectionalStreamId(1), false,
+                     true, 0, ConstructDataHeader(1) + "3"));
+      partitioned_mock_quic_data1.AddWrite(
+          SYNCHRONOUS, client_maker2.MakeAckPacket(5, 4, 3, 1, true));
+
+      partitioned_mock_quic_data1.AddRead(SYNCHRONOUS, ERR_IO_PENDING);
+
+      MockQuicData partitioned_mock_quic_data2;
+      request_header_offset = 0;
+      response_header_offset = 0;
+      QuicTestPacketMaker client_maker3(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_CLIENT,
+          client_headers_include_h2_stream_dependency_);
+      QuicTestPacketMaker server_maker3(
+          version_,
+          quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+          &clock_, kDefaultServerHostName, quic::Perspective::IS_SERVER, false);
+
+      partitioned_mock_quic_data2.AddWrite(
+          SYNCHRONOUS,
+          client_maker3.MakeInitialSettingsPacket(1, &request_header_offset));
+
+      partitioned_mock_quic_data2.AddWrite(
+          SYNCHRONOUS,
+          client_maker3.MakeRequestHeadersPacketWithOffsetTracking(
+              2, GetNthClientInitiatedBidirectionalStreamId(0), true, true,
+              ConvertRequestPriorityToQuicPriority(DEFAULT_PRIORITY),
+              GetRequestHeaders("GET", url2.scheme(), "/2"), 0,
+              &request_header_offset));
+      partitioned_mock_quic_data2.AddRead(
+          ASYNC,
+          server_maker3.MakeResponseHeadersPacketWithOffsetTracking(
+              1, GetNthClientInitiatedBidirectionalStreamId(0), false, false,
+              GetResponseHeaders("200 OK"), &response_header_offset));
+      partitioned_mock_quic_data2.AddRead(
+          ASYNC, server_maker3.MakeDataPacket(
+                     2, GetNthClientInitiatedBidirectionalStreamId(0), false,
+                     true, 0, ConstructDataHeader(1) + "2"));
+      partitioned_mock_quic_data2.AddWrite(
+          SYNCHRONOUS, client_maker3.MakeAckPacket(3, 2, 1, 1, true));
+
+      partitioned_mock_quic_data2.AddRead(SYNCHRONOUS, ERR_IO_PENDING);
+
+      if (partition_connections) {
+        partitioned_mock_quic_data1.AddSocketDataToFactory(&socket_factory_);
+        partitioned_mock_quic_data2.AddSocketDataToFactory(&socket_factory_);
+      } else {
+        unpartitioned_mock_quic_data.AddSocketDataToFactory(&socket_factory_);
+      }
+
+      CreateSession();
+
+      TestCompletionCallback callback;
+      HttpRequestInfo request1;
+      request1.method = "GET";
+      request1.url = GURL(url1);
+      request1.traffic_annotation =
+          net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS);
+      request1.network_isolation_key = network_isolation_key1;
+      HttpNetworkTransaction trans1(LOWEST, session_.get());
+      int rv = trans1.Start(&request1, callback.callback(), NetLogWithSource());
+      EXPECT_THAT(callback.GetResult(rv), IsOk());
+      std::string response_data1;
+      EXPECT_THAT(ReadTransaction(&trans1, &response_data1), IsOk());
+      EXPECT_EQ("1", response_data1);
+
+      HttpRequestInfo request2;
+      request2.method = "GET";
+      request2.url = GURL(url2);
+      request2.traffic_annotation =
+          net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS);
+      request2.network_isolation_key = network_isolation_key2;
+      HttpNetworkTransaction trans2(LOWEST, session_.get());
+      rv = trans2.Start(&request2, callback.callback(), NetLogWithSource());
+      EXPECT_THAT(callback.GetResult(rv), IsOk());
+      std::string response_data2;
+      EXPECT_THAT(ReadTransaction(&trans2, &response_data2), IsOk());
+      EXPECT_EQ("2", response_data2);
+
+      HttpRequestInfo request3;
+      request3.method = "GET";
+      request3.url = GURL(url3);
+      request3.traffic_annotation =
+          net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS);
+      request3.network_isolation_key = network_isolation_key1;
+      HttpNetworkTransaction trans3(LOWEST, session_.get());
+      rv = trans3.Start(&request3, callback.callback(), NetLogWithSource());
+      EXPECT_THAT(callback.GetResult(rv), IsOk());
+      std::string response_data3;
+      EXPECT_THAT(ReadTransaction(&trans3, &response_data3), IsOk());
+      EXPECT_EQ("3", response_data3);
+
+      if (partition_connections) {
+        EXPECT_TRUE(partitioned_mock_quic_data1.AllReadDataConsumed());
+        EXPECT_TRUE(partitioned_mock_quic_data1.AllWriteDataConsumed());
+        EXPECT_TRUE(partitioned_mock_quic_data2.AllReadDataConsumed());
+        EXPECT_TRUE(partitioned_mock_quic_data2.AllWriteDataConsumed());
+      } else {
+        EXPECT_TRUE(unpartitioned_mock_quic_data.AllReadDataConsumed());
+        EXPECT_TRUE(unpartitioned_mock_quic_data.AllWriteDataConsumed());
+      }
+    }
+  }
+}
+
+// Test that two requests to the same origin over QUIC tunnels use different
+// QUIC sessions if their NetworkIsolationKeys don't match, and
+// kPartitionConnectionsByNetworkIsolationKey is enabled.
+TEST_P(QuicNetworkTransactionTest, NetworkIsolationTunnel) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(
+      features::kPartitionConnectionsByNetworkIsolationKey);
+
+  session_params_.enable_quic = true;
+  session_params_.enable_quic_proxies_for_https_urls = true;
+  proxy_resolution_service_ = ProxyResolutionService::CreateFixedFromPacResult(
+      "QUIC proxy.example.org:70", TRAFFIC_ANNOTATION_FOR_TESTS);
+
+  const char kGetRequest[] =
+      "GET / HTTP/1.1\r\n"
+      "Host: mail.example.org\r\n"
+      "Connection: keep-alive\r\n\r\n";
+  const char kGetResponse[] =
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Length: 10\r\n\r\n";
+
+  MockQuicData mock_quic_data[2];
+
+  for (int index : {0, 1}) {
+    QuicTestPacketMaker client_maker(
+        version_, quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+        &clock_, kDefaultServerHostName, quic::Perspective::IS_CLIENT,
+        client_headers_include_h2_stream_dependency_);
+    QuicTestPacketMaker server_maker(
+        version_, quic::QuicUtils::CreateRandomConnectionId(&random_generator_),
+        &clock_, kDefaultServerHostName, quic::Perspective::IS_SERVER, false);
+
+    quic::QuicStreamOffset header_stream_offset = 0;
+    mock_quic_data[index].AddWrite(
+        SYNCHRONOUS,
+        client_maker.MakeInitialSettingsPacket(1, &header_stream_offset));
+
+    mock_quic_data[index].AddWrite(
+        SYNCHRONOUS,
+        client_maker.MakeRequestHeadersPacketWithOffsetTracking(
+            2, GetNthClientInitiatedBidirectionalStreamId(0), true, false,
+            ConvertRequestPriorityToQuicPriority(
+                HttpProxyConnectJob::kH2QuicTunnelPriority),
+            ConnectRequestHeaders("mail.example.org:443"), 0,
+            &header_stream_offset));
+    mock_quic_data[index].AddRead(
+        ASYNC, server_maker.MakeResponseHeadersPacketWithOffsetTracking(
+                   1, GetNthClientInitiatedBidirectionalStreamId(0), false,
+                   false, GetResponseHeaders("200 OK"), nullptr));
+
+    std::string header = ConstructDataHeader(strlen(kGetRequest));
+    if (version_.transport_version != quic::QUIC_VERSION_99) {
+      mock_quic_data[index].AddWrite(
+          SYNCHRONOUS,
+          client_maker.MakeAckAndDataPacket(
+              3, false, GetNthClientInitiatedBidirectionalStreamId(0), 1, 1, 1,
+              false, 0, quic::QuicStringPiece(kGetRequest)));
+    } else {
+      mock_quic_data[index].AddWrite(
+          SYNCHRONOUS,
+          client_maker.MakeAckAndMultipleDataFramesPacket(
+              3, false, GetNthClientInitiatedBidirectionalStreamId(0), 1, 1, 1,
+              false, 0, {header, std::string(kGetRequest)}));
+    }
+
+    std::string header2 = ConstructDataHeader(strlen(kGetResponse));
+    mock_quic_data[index].AddRead(
+        ASYNC, server_maker.MakeDataPacket(
+                   2, GetNthClientInitiatedBidirectionalStreamId(0), false,
+                   false, 0, header2 + std::string(kGetResponse)));
+    mock_quic_data[index].AddRead(
+        SYNCHRONOUS, server_maker.MakeDataPacket(
+                         3, GetNthClientInitiatedBidirectionalStreamId(0),
+                         false, false, strlen(kGetResponse) + header2.length(),
+                         ConstructDataHeader(10) + std::string("0123456789")));
+    mock_quic_data[index].AddWrite(
+        SYNCHRONOUS, client_maker.MakeAckPacket(4, 3, 2, 1, true));
+    mock_quic_data[index].AddRead(SYNCHRONOUS,
+                                  ERR_IO_PENDING);  // No more data to read
+
+    mock_quic_data[index].AddSocketDataToFactory(&socket_factory_);
+  }
+
+  socket_factory_.AddSSLSocketDataProvider(&ssl_data_);
+  SSLSocketDataProvider ssl_data2(ASYNC, OK);
+  socket_factory_.AddSSLSocketDataProvider(&ssl_data2);
+
+  CreateSession();
+
+  request_.url = GURL("https://mail.example.org/");
+  AddQuicAlternateProtocolMapping(MockCryptoClientStream::CONFIRM_HANDSHAKE);
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session_.get());
+  RunTransaction(&trans);
+  CheckResponseData(&trans, "0123456789");
+
+  HttpRequestInfo request2;
+  request_.network_isolation_key =
+      NetworkIsolationKey(url::Origin::Create(GURL("http://origin1/")));
+  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, session_.get());
+  RunTransaction(&trans2);
+  CheckResponseData(&trans2, "0123456789");
+
+  EXPECT_TRUE(mock_quic_data[0].AllReadDataConsumed());
+  EXPECT_TRUE(mock_quic_data[0].AllWriteDataConsumed());
+  EXPECT_TRUE(mock_quic_data[1].AllReadDataConsumed());
+  EXPECT_TRUE(mock_quic_data[1].AllWriteDataConsumed());
+}
+
 }  // namespace test
 }  // namespace net
diff --git a/net/quic/quic_session_key.cc b/net/quic/quic_session_key.cc
index da9a601..d7907d6b 100644
--- a/net/quic/quic_session_key.cc
+++ b/net/quic/quic_session_key.cc
@@ -4,34 +4,50 @@
 
 #include "net/quic/quic_session_key.h"
 
+#include "base/feature_list.h"
+#include "net/base/features.h"
+
 namespace net {
 
 QuicSessionKey::QuicSessionKey(const HostPortPair& host_port_pair,
                                PrivacyMode privacy_mode,
-                               const SocketTag& socket_tag)
+                               const SocketTag& socket_tag,
+                               const NetworkIsolationKey& network_isolation_key)
     : QuicSessionKey(host_port_pair.host(),
                      host_port_pair.port(),
                      privacy_mode,
-                     socket_tag) {}
+                     socket_tag,
+                     network_isolation_key) {}
 
 QuicSessionKey::QuicSessionKey(const std::string& host,
                                uint16_t port,
                                PrivacyMode privacy_mode,
-                               const SocketTag& socket_tag)
+                               const SocketTag& socket_tag,
+                               const NetworkIsolationKey& network_isolation_key)
     : QuicSessionKey(
           quic::QuicServerId(host, port, privacy_mode == PRIVACY_MODE_ENABLED),
-          socket_tag) {}
+          socket_tag,
+          network_isolation_key) {}
 
 QuicSessionKey::QuicSessionKey(const quic::QuicServerId& server_id,
-                               const SocketTag& socket_tag)
-    : server_id_(server_id), socket_tag_(socket_tag) {}
+                               const SocketTag& socket_tag,
+                               const NetworkIsolationKey& network_isolation_key)
+    : server_id_(server_id),
+      socket_tag_(socket_tag),
+      network_isolation_key_(
+          base::FeatureList::IsEnabled(
+              features::kPartitionConnectionsByNetworkIsolationKey)
+              ? network_isolation_key
+              : NetworkIsolationKey()) {}
 
 bool QuicSessionKey::operator<(const QuicSessionKey& other) const {
-  return std::tie(server_id_, socket_tag_) <
-         std::tie(other.server_id_, other.socket_tag_);
+  return std::tie(server_id_, socket_tag_, network_isolation_key_) <
+         std::tie(other.server_id_, other.socket_tag_,
+                  other.network_isolation_key_);
 }
 bool QuicSessionKey::operator==(const QuicSessionKey& other) const {
-  return server_id_ == other.server_id_ && socket_tag_ == other.socket_tag_;
+  return server_id_ == other.server_id_ && socket_tag_ == other.socket_tag_ &&
+         network_isolation_key_ == other.network_isolation_key_;
 }
 
 size_t QuicSessionKey::EstimateMemoryUsage() const {
diff --git a/net/quic/quic_session_key.h b/net/quic/quic_session_key.h
index 127726ca..5065564 100644
--- a/net/quic/quic_session_key.h
+++ b/net/quic/quic_session_key.h
@@ -6,6 +6,7 @@
 #define NET_QUIC_QUIC_SESSION_KEY_H_
 
 #include "net/base/host_port_pair.h"
+#include "net/base/network_isolation_key.h"
 #include "net/base/privacy_mode.h"
 #include "net/socket/socket_tag.h"
 #include "net/third_party/quiche/src/quic/core/quic_server_id.h"
@@ -16,16 +17,24 @@
 // tag.
 class QUIC_EXPORT_PRIVATE QuicSessionKey {
  public:
+  // TODO(mmenke): Remove default NetworkIsolationKey() values, which are only
+  // used in tests.
   QuicSessionKey() = default;
-  QuicSessionKey(const HostPortPair& host_port_pair,
-                 PrivacyMode privacy_mode,
-                 const SocketTag& socket_tag);
-  QuicSessionKey(const std::string& host,
-                 uint16_t port,
-                 PrivacyMode privacy_mode,
-                 const SocketTag& socket_tag);
-  QuicSessionKey(const quic::QuicServerId& server_id,
-                 const SocketTag& socket_tag);
+  QuicSessionKey(
+      const HostPortPair& host_port_pair,
+      PrivacyMode privacy_mode,
+      const SocketTag& socket_tag,
+      const NetworkIsolationKey& network_isolation_key = NetworkIsolationKey());
+  QuicSessionKey(
+      const std::string& host,
+      uint16_t port,
+      PrivacyMode privacy_mode,
+      const SocketTag& socket_tag,
+      const NetworkIsolationKey& network_isolation_key = NetworkIsolationKey());
+  QuicSessionKey(
+      const quic::QuicServerId& server_id,
+      const SocketTag& socket_tag,
+      const NetworkIsolationKey& network_isolation_key = NetworkIsolationKey());
   ~QuicSessionKey() = default;
 
   // Needed to be an element of std::set.
@@ -43,11 +52,17 @@
 
   SocketTag socket_tag() const { return socket_tag_; }
 
+  const NetworkIsolationKey& network_isolation_key() const {
+    return network_isolation_key_;
+  }
+
   size_t EstimateMemoryUsage() const;
 
  private:
   quic::QuicServerId server_id_;
   SocketTag socket_tag_;
+  // Used to separate requests made in different contexts.
+  NetworkIsolationKey network_isolation_key_;
 };
 
 }  // namespace net
diff --git a/net/quic/quic_stream_factory.cc b/net/quic/quic_stream_factory.cc
index 0688be7..55c5305 100644
--- a/net/quic/quic_stream_factory.cc
+++ b/net/quic/quic_stream_factory.cc
@@ -921,6 +921,7 @@
     PrivacyMode privacy_mode,
     RequestPriority priority,
     const SocketTag& socket_tag,
+    const NetworkIsolationKey& network_isolation_key,
     int cert_verify_flags,
     const GURL& url,
     const NetLogWithSource& net_log,
@@ -936,8 +937,8 @@
   net_error_details_ = net_error_details;
   failed_on_default_network_callback_ =
       std::move(failed_on_default_network_callback);
-  session_key_ =
-      QuicSessionKey(HostPortPair::FromURL(url), privacy_mode, socket_tag);
+  session_key_ = QuicSessionKey(HostPortPair::FromURL(url), privacy_mode,
+                                socket_tag, network_isolation_key);
 
   int rv = factory_->Create(session_key_, destination, quic_version, priority,
                             cert_verify_flags, url, net_log, this);
@@ -1251,7 +1252,8 @@
     QuicChromiumClientSession* session = key_value.second;
     if (destination.Equals(all_sessions_[session].destination()) &&
         session->CanPool(session_key.host(), session_key.privacy_mode(),
-                         session_key.socket_tag())) {
+                         session_key.socket_tag(),
+                         session_key.network_isolation_key())) {
       return true;
     }
   }
@@ -1334,7 +1336,8 @@
                            session_key.server_id().privacy_mode_enabled()
                                ? PRIVACY_MODE_ENABLED
                                : PRIVACY_MODE_DISABLED,
-                           session_key.socket_tag())) {
+                           session_key.socket_tag(),
+                           session_key.network_isolation_key())) {
         request->SetSession(session->CreateHandle(destination));
         return OK;
       }
@@ -1413,12 +1416,11 @@
 
     const SessionSet& sessions = ip_aliases_[address];
     for (QuicChromiumClientSession* session : sessions) {
-      if (!session->CanPool(server_id.host(),
-                            server_id.privacy_mode_enabled()
-                                ? PRIVACY_MODE_ENABLED
-                                : PRIVACY_MODE_DISABLED,
-                            key.session_key().socket_tag()))
+      if (!session->CanPool(server_id.host(), key.session_key().privacy_mode(),
+                            key.session_key().socket_tag(),
+                            key.session_key().network_isolation_key())) {
         continue;
+      }
       active_sessions_[key.session_key()] = session;
       session_aliases_[session].insert(key);
       return true;
diff --git a/net/quic/quic_stream_factory.h b/net/quic/quic_stream_factory.h
index bae47ec..207d20b 100644
--- a/net/quic/quic_stream_factory.h
+++ b/net/quic/quic_stream_factory.h
@@ -65,6 +65,7 @@
 class HostResolver;
 class HttpServerProperties;
 class NetLog;
+class NetworkIsolationKey;
 class QuicChromiumConnectionHelper;
 class QuicCryptoClientStreamFactory;
 class QuicServerInfo;
@@ -128,6 +129,7 @@
               PrivacyMode privacy_mode,
               RequestPriority priority,
               const SocketTag& socket_tag,
+              const NetworkIsolationKey& network_isolation_key,
               int cert_verify_flags,
               const GURL& url,
               const NetLogWithSource& net_log,
diff --git a/net/quic/quic_stream_factory_fuzzer.cc b/net/quic/quic_stream_factory_fuzzer.cc
index 60d828b..b91b834 100644
--- a/net/quic/quic_stream_factory_fuzzer.cc
+++ b/net/quic/quic_stream_factory_fuzzer.cc
@@ -7,6 +7,7 @@
 #include "base/test/fuzzed_data_provider.h"
 
 #include "base/stl_util.h"
+#include "net/base/network_isolation_key.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/do_nothing_ct_verifier.h"
@@ -162,8 +163,9 @@
   request.Request(
       env->host_port_pair,
       data_provider.PickValueInArray(quic::kSupportedTransportVersions),
-      PRIVACY_MODE_DISABLED, DEFAULT_PRIORITY, SocketTag(), kCertVerifyFlags,
-      GURL(kUrl), env->net_log, &net_error_details,
+      PRIVACY_MODE_DISABLED, DEFAULT_PRIORITY, SocketTag(),
+      NetworkIsolationKey(), kCertVerifyFlags, GURL(kUrl), env->net_log,
+      &net_error_details,
       /*failed_on_default_network_callback=*/CompletionOnceCallback(),
       callback.callback());
 
diff --git a/net/quic/quic_stream_factory_test.cc b/net/quic/quic_stream_factory_test.cc
index 2850d4d0..e6b6afe 100644
--- a/net/quic/quic_stream_factory_test.cc
+++ b/net/quic/quic_stream_factory_test.cc
@@ -17,6 +17,7 @@
 #include "base/test/test_mock_time_task_runner.h"
 #include "build/build_config.h"
 #include "net/base/mock_network_change_notifier.h"
+#include "net/base/network_isolation_key.h"
 #include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/do_nothing_ct_verifier.h"
 #include "net/cert/mock_cert_verifier.h"
@@ -390,7 +391,7 @@
     EXPECT_EQ(ERR_IO_PENDING,
               request.Request(
                   destination, version_.transport_version, privacy_mode_,
-                  DEFAULT_PRIORITY, SocketTag(),
+                  DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()));
 
@@ -549,7 +550,7 @@
     EXPECT_EQ(ERR_IO_PENDING,
               request.Request(
                   host_port_pair_, version_.transport_version, privacy_mode_,
-                  DEFAULT_PRIORITY, SocketTag(),
+                  DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()));
     EXPECT_EQ(OK, callback_.WaitForResult());
@@ -737,7 +738,7 @@
               request.Request(
                   HostPortPair(quic_server_id.host(), quic_server_id.port()),
                   version_.transport_version, privacy_mode_, DEFAULT_PRIORITY,
-                  SocketTag(),
+                  SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()));
     EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -773,7 +774,7 @@
               request2.Request(
                   HostPortPair(quic_server_id2.host(), quic_server_id2.port()),
                   version_.transport_version, privacy_mode_, DEFAULT_PRIORITY,
-                  SocketTag(),
+                  SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, GURL("https://mail.example.org/"),
                   net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()));
@@ -931,7 +932,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -942,12 +943,12 @@
   EXPECT_EQ(DEFAULT_PRIORITY, host_resolver_->last_request_priority());
 
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   // Will reset stream 3.
   stream = CreateStream(&request2);
 
@@ -956,12 +957,12 @@
   // TODO(rtenneti): We should probably have a tests that HTTP and HTTPS result
   // in streams on different sessions.
   QuicStreamRequest request3(factory_.get());
-  EXPECT_EQ(OK, request3.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request3.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   stream = CreateStream(&request3);  // Will reset stream 5.
   stream.reset();                    // Will reset stream 7.
 
@@ -986,12 +987,12 @@
                                             "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
@@ -1013,7 +1014,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1041,7 +1042,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request->Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   request.reset();
@@ -1071,7 +1072,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1112,7 +1113,7 @@
   QuicStreamRequest request(factory_.get());
   EXPECT_THAT(request.Request(
                   host_port_pair_, version_.transport_version, privacy_mode_,
-                  DEFAULT_PRIORITY, SocketTag(),
+                  DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()),
               IsOk());
@@ -1152,7 +1153,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1185,7 +1186,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1218,7 +1219,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1246,7 +1247,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1278,7 +1279,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1322,23 +1323,23 @@
   host_resolver_->rules()->AddIPLiteralRule(server2.host(), "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
 
   TestCompletionCallback callback;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -1387,7 +1388,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 server2, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback.callback()));
   EXPECT_EQ(OK, callback.WaitForResult());
@@ -1421,23 +1422,23 @@
   host_resolver_->rules()->AddIPLiteralRule(server2.host(), "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
 
   TestCompletionCallback callback;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -1447,12 +1448,12 @@
 
   TestCompletionCallback callback3;
   QuicStreamRequest request3(factory_.get());
-  EXPECT_EQ(OK, request3.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback3.callback()));
+  EXPECT_EQ(OK,
+            request3.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback3.callback()));
   std::unique_ptr<HttpStream> stream3 = CreateStream(&request3);
   EXPECT_TRUE(stream3.get());
 
@@ -1483,23 +1484,23 @@
   host_resolver_->rules()->AddIPLiteralRule(server2.host(), "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(server1, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                server1, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
 
   TestCompletionCallback callback;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -1533,23 +1534,23 @@
   host_resolver_->rules()->AddIPLiteralRule(server2.host(), "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(server1, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                server1, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
 
   TestCompletionCallback callback;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -1594,23 +1595,23 @@
   host_resolver_->rules()->AddIPLiteralRule(server2.host(), "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(server1, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                server1, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream.get());
 
   TestCompletionCallback callback;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -1641,7 +1642,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1663,7 +1664,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -1727,7 +1728,7 @@
     QuicStreamRequest request(factory_.get());
     int rv = request.Request(
         host_port_pair_, version_.transport_version, privacy_mode_,
-        DEFAULT_PRIORITY, SocketTag(),
+        DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
         /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
         failed_on_default_network_callback_, callback_.callback());
     if (i == 0) {
@@ -1745,12 +1746,12 @@
   }
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                CompletionOnceCallback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, CompletionOnceCallback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request);
   EXPECT_TRUE(stream);
   EXPECT_EQ(ERR_IO_PENDING,
@@ -1787,7 +1788,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1808,7 +1809,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1829,7 +1830,7 @@
     EXPECT_EQ(ERR_IO_PENDING,
               request.Request(
                   host_port_pair_, version_.transport_version, privacy_mode_,
-                  DEFAULT_PRIORITY, SocketTag(),
+                  DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()));
   }
@@ -1837,12 +1838,12 @@
   base::RunLoop().RunUntilIdle();
 
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream = CreateStream(&request2);
 
   EXPECT_TRUE(stream.get());
@@ -1877,7 +1878,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1902,7 +1903,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -1938,7 +1939,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(ERR_QUIC_HANDSHAKE_FAILED, callback_.WaitForResult());
@@ -1959,7 +1960,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_FALSE(HasActiveSession(host_port_pair_));
@@ -2004,7 +2005,7 @@
   EXPECT_EQ(ERR_QUIC_HANDSHAKE_FAILED,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   // Check no active session, or active jobs left for this server.
@@ -2025,7 +2026,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_FALSE(HasActiveSession(host_port_pair_));
@@ -2074,7 +2075,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -2109,7 +2110,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -2167,7 +2168,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2213,7 +2214,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2252,7 +2253,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -2274,12 +2275,12 @@
 
   // Attempting a new request to the same origin uses the same connection.
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   stream = CreateStream(&request2);
 
   stream.reset();
@@ -2353,7 +2354,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2532,7 +2533,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2676,7 +2677,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2793,7 +2794,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2858,7 +2859,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -2950,7 +2951,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3014,7 +3015,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3103,7 +3104,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3171,7 +3172,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3244,7 +3245,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3363,7 +3364,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3526,7 +3527,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3700,7 +3701,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3838,7 +3839,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cerf_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3879,7 +3880,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -3955,7 +3956,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4097,7 +4098,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4254,7 +4255,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4392,23 +4393,23 @@
 
   // Create request and QuicHttpStream to create session1.
   QuicStreamRequest request1(factory_.get());
-  EXPECT_EQ(OK, request1.Request(server1, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request1.Request(
+                server1, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream1 = CreateStream(&request1);
   EXPECT_TRUE(stream1.get());
 
   // Create request and QuicHttpStream to create session2.
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -4520,7 +4521,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4634,7 +4635,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4700,7 +4701,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4802,7 +4803,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -4821,12 +4822,12 @@
   // Request #2 returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -4939,7 +4940,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -5061,7 +5062,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -5122,7 +5123,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -5244,7 +5245,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -5361,7 +5362,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(ERR_QUIC_HANDSHAKE_FAILED, callback_.WaitForResult());
@@ -5382,7 +5383,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_FALSE(HasActiveSession(host_port_pair_));
@@ -5456,7 +5457,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   // Ensure that the session is alive but not active.
@@ -5526,7 +5527,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -5623,7 +5624,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -5760,7 +5761,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -5779,12 +5780,12 @@
   // Second request returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
   HttpRequestInfo request_info2;
@@ -5896,7 +5897,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -5915,12 +5916,12 @@
   // Second request returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -6043,7 +6044,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -6062,12 +6063,12 @@
   // Second request returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -6176,7 +6177,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -6263,7 +6264,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -6389,7 +6390,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -6484,7 +6485,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   // Deliver the network notification, which should cause the connection to be
@@ -6523,7 +6524,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -6657,7 +6658,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -6797,7 +6798,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -6928,7 +6929,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7032,7 +7033,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7146,7 +7147,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7314,7 +7315,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7474,7 +7475,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7623,7 +7624,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7758,7 +7759,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -7899,7 +7900,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8036,7 +8037,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8129,7 +8130,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8274,7 +8275,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8366,12 +8367,12 @@
       ->NotifyNetworkMadeDefault(kNewNetworkForTests);
 
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -8453,7 +8454,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -8567,7 +8568,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -8645,7 +8646,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8793,7 +8794,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -8851,7 +8852,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -8874,7 +8875,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -8991,12 +8992,12 @@
                                             "192.168.0.1", "");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   // If we are waiting for disk cache, we would have posted a task. Verify that
   // the CancelWaitForDataReady task hasn't been posted.
@@ -9042,12 +9043,12 @@
   EXPECT_EQ(quic::QuicTime::Delta::FromSeconds(quic::kPingTimeoutSecs),
             QuicStreamFactoryPeer::GetPingTimeout(factory_.get()));
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   QuicChromiumClientSession* session = GetActiveSession(host_port_pair_);
   EXPECT_EQ(quic::QuicTime::Delta::FromSeconds(quic::kPingTimeoutSecs),
@@ -9080,12 +9081,12 @@
   DVLOG(1) << "Create 2nd session and timeout with open stream";
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(server2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                server2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   QuicChromiumClientSession* session2 = GetActiveSession(server2);
   EXPECT_EQ(quic::QuicTime::Delta::FromSeconds(10),
             session2->connection()->ping_timeout());
@@ -9155,7 +9156,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9201,12 +9202,12 @@
                                        "StartReading");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   // Call run_loop so that QuicChromiumPacketReader::OnReadComplete() gets
   // called.
@@ -9250,12 +9251,12 @@
                                        "StartReading");
 
   QuicStreamRequest request(factory_.get());
-  EXPECT_EQ(OK, request.Request(host_port_pair_, version_.transport_version,
-                                privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                /*cert_verify_flags=*/0, url_, net_log_,
-                                &net_error_details_,
-                                failed_on_default_network_callback_,
-                                callback_.callback()));
+  EXPECT_EQ(OK,
+            request.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   // Call run_loop so that QuicChromiumPacketReader::OnReadComplete() gets
   // called.
@@ -9287,7 +9288,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9307,12 +9308,12 @@
         ->promised_by_url())[kDefaultUrl] = &promised;
 
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(host_port_pair_, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback_.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                host_port_pair_, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback_.callback()));
 
   EXPECT_EQ(1, QuicStreamFactoryPeer::GetNumPushStreamsCreated(factory_.get()));
 }
@@ -9341,7 +9342,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9366,12 +9367,13 @@
   // Doing the request should not use the push stream, but rather
   // cancel it because the privacy modes do not match.
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(ERR_IO_PENDING,
-            request2.Request(
-                host_port_pair_, version_.transport_version,
-                PRIVACY_MODE_ENABLED, DEFAULT_PRIORITY, SocketTag(),
-                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
-                failed_on_default_network_callback_, callback_.callback()));
+  EXPECT_EQ(
+      ERR_IO_PENDING,
+      request2.Request(
+          host_port_pair_, version_.transport_version, PRIVACY_MODE_ENABLED,
+          DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+          /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+          failed_on_default_network_callback_, callback_.callback()));
 
   EXPECT_EQ(0, QuicStreamFactoryPeer::GetNumPushStreamsCreated(factory_.get()));
   EXPECT_EQ(index->GetPromised(kDefaultUrl), nullptr);
@@ -9406,7 +9408,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 destination1, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -9417,12 +9419,12 @@
   // Second request returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(destination2, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url_, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                destination2, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -9527,7 +9529,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 destination, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9572,7 +9574,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 destination, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url1, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -9584,12 +9586,12 @@
   // Second request returns synchronously because it pools to existing session.
   TestCompletionCallback callback2;
   QuicStreamRequest request2(factory_.get());
-  EXPECT_EQ(OK, request2.Request(destination, version_.transport_version,
-                                 privacy_mode_, DEFAULT_PRIORITY, SocketTag(),
-                                 /*cert_verify_flags=*/0, url2, net_log_,
-                                 &net_error_details_,
-                                 failed_on_default_network_callback_,
-                                 callback2.callback()));
+  EXPECT_EQ(OK,
+            request2.Request(
+                destination, version_.transport_version, privacy_mode_,
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
+                /*cert_verify_flags=*/0, url2, net_log_, &net_error_details_,
+                failed_on_default_network_callback_, callback2.callback()));
   std::unique_ptr<HttpStream> stream2 = CreateStream(&request2);
   EXPECT_TRUE(stream2.get());
 
@@ -9651,7 +9653,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 destination, version_.transport_version, PRIVACY_MODE_DISABLED,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url1, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(OK, callback_.WaitForResult());
@@ -9664,7 +9666,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 destination, version_.transport_version, PRIVACY_MODE_ENABLED,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url2, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback2.callback()));
   EXPECT_EQ(OK, callback2.WaitForResult());
@@ -9738,7 +9740,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request1.Request(
                 destination, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url1, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_THAT(callback_.WaitForResult(), IsOk());
@@ -9751,7 +9753,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 destination, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url2, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback2.callback()));
   EXPECT_THAT(callback2.WaitForResult(), IsOk());
@@ -9862,7 +9864,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                MAXIMUM_PRIORITY, SocketTag(),
+                MAXIMUM_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9890,7 +9892,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                MAXIMUM_PRIORITY, SocketTag(),
+                MAXIMUM_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -9901,7 +9903,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request2.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url2_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_EQ(DEFAULT_PRIORITY, host_resolver_->last_request_priority());
@@ -9946,7 +9948,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10000,7 +10002,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10051,7 +10053,7 @@
   EXPECT_EQ(ERR_QUIC_PROTOCOL_ERROR,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10089,7 +10091,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10123,7 +10125,7 @@
   EXPECT_EQ(ERR_NAME_NOT_RESOLVED,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10149,7 +10151,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10202,7 +10204,7 @@
   QuicStreamRequest request(factory_.get());
   EXPECT_THAT(request.Request(
                   host_port_pair_, version_.transport_version, privacy_mode_,
-                  DEFAULT_PRIORITY, SocketTag(),
+                  DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                   /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                   failed_on_default_network_callback_, callback_.callback()),
               IsOk());
@@ -10238,7 +10240,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   TestCompletionCallback host_resolution_callback;
@@ -10296,7 +10298,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10357,7 +10359,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10424,7 +10426,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10495,7 +10497,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10565,7 +10567,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10639,7 +10641,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   // Finish dns resolution, but need to wait for stale connection.
@@ -10681,7 +10683,7 @@
   EXPECT_EQ(ERR_NAME_NOT_RESOLVED,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 }
@@ -10706,7 +10708,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10753,7 +10755,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10808,7 +10810,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   EXPECT_FALSE(HasLiveSession(host_port_pair_));
@@ -10857,7 +10859,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10919,7 +10921,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -10973,7 +10975,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -11026,7 +11028,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -11061,7 +11063,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
 
@@ -11113,7 +11115,7 @@
   EXPECT_EQ(ERR_IO_PENDING,
             request.Request(
                 host_port_pair_, version_.transport_version, privacy_mode_,
-                DEFAULT_PRIORITY, SocketTag(),
+                DEFAULT_PRIORITY, SocketTag(), NetworkIsolationKey(),
                 /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
                 failed_on_default_network_callback_, callback_.callback()));
   base::RunLoop().RunUntilIdle();
@@ -11179,7 +11181,7 @@
   QuicStreamRequest request1(factory_.get());
   int rv = request1.Request(
       host_port_pair_, version_.transport_version, privacy_mode_,
-      DEFAULT_PRIORITY, tag1,
+      DEFAULT_PRIORITY, tag1, NetworkIsolationKey(),
       /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
       failed_on_default_network_callback_, callback_.callback());
   EXPECT_THAT(callback_.GetResult(rv), IsOk());
@@ -11195,7 +11197,7 @@
   QuicStreamRequest request2(factory_.get());
   rv = request2.Request(
       host_port_pair_, version_.transport_version, privacy_mode_,
-      DEFAULT_PRIORITY, tag1,
+      DEFAULT_PRIORITY, tag1, NetworkIsolationKey(),
       /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
       failed_on_default_network_callback_, callback_.callback());
   EXPECT_THAT(callback_.GetResult(rv), IsOk());
@@ -11209,7 +11211,7 @@
   QuicStreamRequest request3(factory_.get());
   rv = request3.Request(
       host_port_pair_, version_.transport_version, privacy_mode_,
-      DEFAULT_PRIORITY, tag2,
+      DEFAULT_PRIORITY, tag2, NetworkIsolationKey(),
       /*cert_verify_flags=*/0, url_, net_log_, &net_error_details_,
       failed_on_default_network_callback_, callback_.callback());
   EXPECT_THAT(callback_.GetResult(rv), IsOk());