Fail the SPDY transaction if it does not meet TLS base requirements.

net/ssl/ssl_cipher_suite_names.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_cipher_suite_names.h"
 
 #include <stdlib.h>
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 327 matching lines @@
   int value = 0;
   if (cipher_string.size() == 6 &&
       StartsWithASCII(cipher_string, "0x", false /* case insensitive */) &&
       base::HexStringToInt(cipher_string, &value)) {
     *cipher_suite = static_cast<uint16>(value);
     return true;
   }
   return false;
 }
 
+bool IsSecureTLSCipherSuite(uint16 cipher_suite) {
+  CipherSuite desired = {0};
+  desired.cipher_suite = cipher_suite;
+
+  void* r = bsearch(&desired,
+                    kCipherSuites,
+                    arraysize(kCipherSuites),
+                    sizeof(kCipherSuites[0]),
+                    CipherSuiteCmp);
+
+  if (!r)
+    return false;
+
+  const CipherSuite* cs = static_cast<const CipherSuite*>(r);
+
+  const int key_exchange = cs->encoded >> 8;
+  const int cipher = (cs->encoded >> 3) & 0x1f;
+  const int mac = cs->encoded & 0x7;
+
+  // Only allow forward secure key exchanges.
+  switch (key_exchange) {
+    case 10:  // DHE_RSA
+    case 14:  // ECDHE_ECDSA
+    case 16:  // ECDHE_RSA
+      break;
+    default:
+      return false;
+  }
+
+  switch (cipher) {
+    case 13:  // AES_128_GCM
+    case 14:  // AES_256_GCM
+    case 17:  // CHACHA20_POLY1305
+      break;
+    default:
+      return false;
+  }
+
+  // Only AEADs allowed.
+  if (mac != kAEADMACValue)
+    return false;
+
+  return true;
+}
+
 }  // namespace net