Do not use HTTP/2 without adequate security.

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
@@ skipping 191 matching lines @@
       bool supports_ecc);
 
   // Records ConnectionType histograms for a successful SSL connection.
   static void RecordConnectionTypeMetrics(int ssl_version);
 
   // Returns whether TLS channel ID is enabled.
   static bool IsChannelIDEnabled(
       const SSLConfig& ssl_config,
       ChannelIDService* channel_id_service);
 
+  // Determine if there is at least one enabled cipher suite and TLS version
+  // that is satisfies Section 9.2 of the HTTP/2 specification.  Note that the
+  // server might still pick an inadequate cipher suite or TLS version.
+  static bool IsSecurityAdequateForHTTP2(
+      const SSLConfig& ssl_config,
+      const std::vector<uint16>& cipher_suites);
+
   // Serializes |next_protos| in the wire format for ALPN: protocols are listed
-  // in order, each prefixed by a one-byte length.
+  // in order, each prefixed by a one-byte length.  Any HTTP/2 protocols in
+  // |next_protos| are ignored if |can_advertise_http2| is false.
   static std::vector<uint8_t> SerializeNextProtos(
-      const NextProtoVector& next_protos);
+      const NextProtoVector& next_protos,
+      bool can_advertise_http2);
 
   // For unit testing only.
   // Returns the unverified certificate chain as presented by server.
   // Note that chain may be different than the verified chain returned by
   // StreamSocket::GetSSLInfo().
   virtual scoped_refptr<X509Certificate> GetUnverifiedServerCertificateChain()
       const = 0;
 
  private:
   // For signed_cert_timestamps_received_ and stapled_ocsp_response_received_.
@@ skipping 18 matching lines @@
   bool signed_cert_timestamps_received_;
   // True if a stapled OCSP response was received.
   bool stapled_ocsp_response_received_;
   // Protocol negotiation extension used.
   SSLNegotiationExtension negotiation_extension_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_