Do not use HTTP/2 without adequate security.

net/socket/ssl_client_socket.cc

Index: net/socket/ssl_client_socket.cc
diff --git a/net/socket/ssl_client_socket.cc b/net/socket/ssl_client_socket.cc
index a52e6a3c052c70eba239aa57594c8a390816fc56..17643552e5186e48898ffb45804c176219310c3e 100644
--- a/net/socket/ssl_client_socket.cc
+++ b/net/socket/ssl_client_socket.cc
@@ -11,6 +11,7 @@
 #include "net/base/connection_type_histograms.h"
 #include "net/base/host_port_pair.h"
 #include "net/ssl/channel_id_service.h"
+#include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 
@@ -234,8 +235,23 @@ bool SSLClientSocket::IsChannelIDEnabled(
 }
 
 // static
+bool SSLClientSocket::IsSecurityAdequateForHTTP2(
+    const SSLConfig& ssl_config,
+    const std::vector<uint16>& cipher_suites) {
+  if (ssl_config.version_max < SSL_PROTOCOL_VERSION_TLS1_2)
+    return false;
+  for (std::vector<uint16>::const_iterator it = cipher_suites.begin();
+       it != cipher_suites.end(); ++it) {
+    if (IsSecureTLSCipherSuite(*it))
+      return true;
+  }
+  return false;
+}
+
+// static
 std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
-    const std::vector<std::string>& next_protos) {
+    const std::vector<std::string>& next_protos,
+    bool advertise_http2) {
   // Do a first pass to determine the total length.
   size_t wire_length = 0;
   for (std::vector<std::string>::const_iterator i = next_protos.begin();
@@ -248,6 +264,13 @@ std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
       LOG(WARNING) << "Ignoring empty NPN/ALPN protocol";
       continue;
     }
+    if (!advertise_http2) {
+      const NextProto proto = NextProtoFromString(*i);
+      if (kProtoSPDY4MinimumVersion <= proto &&
+          proto <= kProtoSPDY4MaximumVersion) {
+        continue;
+      }
+    }
     wire_length += i->size();
     wire_length++;
   }
@@ -259,6 +282,13 @@ std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
        i != next_protos.end(); i++) {
     if (i->size() == 0 || i->size() > 255)
       continue;
+    if (!advertise_http2) {
+      const NextProto proto = NextProtoFromString(*i);
+      if (kProtoSPDY4MinimumVersion <= proto &&
+          proto <= kProtoSPDY4MaximumVersion) {
+        continue;
+      }
+    }
     wire_protos.push_back(i->size());
     wire_protos.resize(wire_protos.size() + i->size());
     memcpy(&wire_protos[wire_protos.size() - i->size()],