Fail the SPDY transaction if it does not meet TLS base requirements.

net/ssl/ssl_cipher_suite_names.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CIPHER_SUITE_NAMES_H_
 #define NET_SSL_SSL_CIPHER_SUITE_NAMES_H_
 
 #include <string>
 
 #include "base/basictypes.h"
@@ skipping 28 matching lines @@
 //     suites in this form will not return an error.
 //
 // Returns true if the cipher suite was successfully parsed, storing the
 // result in |cipher_suite|.
 //
 // TODO(rsleevi): Support the full strings defined in the IANA TLS parameters
 // list.
 NET_EXPORT bool ParseSSLCipherString(const std::string& cipher_string,
                                      uint16* cipher_suite);
 
+// |cipher_suite| is the IANA id for the cipher suite. What a "secure"
+// cipher suite is arbitrarily determined here. The intent is to indicate what
+// cipher suites meet modern security standards when backwards compatibility can
+// be ignored. Notably, HTTP/2 requires/encourages this sort of validation of
+// cipher suites: https://http2.github.io/http2-spec/#TLSUsage.
+//
+// Currently, this function follows these criteria:
+// 1) Only uses forward secure key exchanges
+// 2) Only uses AEADs
+NET_EXPORT_PRIVATE bool IsSecureTLSCipherSuite(uint16 cipher_suite);
+
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CIPHER_SUITE_NAMES_H_