Do not use HTTP/2 without adequate security.

net/socket/ssl_client_socket.cc

Index: net/socket/ssl_client_socket.cc
diff --git a/net/socket/ssl_client_socket.cc b/net/socket/ssl_client_socket.cc
index f6b9b895fa853410be2c8ed7d6fb9a3ff39ab726..51772360772087d9d675a0d78e9d1398d2aa9907 100644
--- a/net/socket/ssl_client_socket.cc
+++ b/net/socket/ssl_client_socket.cc
@@ -11,6 +11,7 @@
 #include "net/base/connection_type_histograms.h"
 #include "net/base/host_port_pair.h"
 #include "net/ssl/channel_id_service.h"
+#include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 
@@ -234,12 +235,31 @@ bool SSLClientSocket::IsChannelIDEnabled(
 }
 
 // static
+bool SSLClientSocket::IsSecurityAdequateForHTTP2(
+    const SSLConfig& ssl_config,
+    const std::vector<uint16>& cipher_suites) {
+  if (ssl_config.version_max < SSL_PROTOCOL_VERSION_TLS1_2)
+    return false;
+  for (uint16 cipher : cipher_suites) {
+    if (IsSecureTLSCipherSuite(cipher))
+      return true;
+  }
+  return false;
+}
+
+// static
 std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
-    const NextProtoVector& next_protos) {
-  // Do a first pass to determine the total length.
+    const NextProtoVector& next_protos,
+    bool can_advertise_http2) {
   size_t wire_length = 0;
   std::vector<std::string> next_proto_strings;
   for (const NextProto next_proto : next_protos) {
+    if (!can_advertise_http2) {
+      if (kProtoSPDY4MinimumVersion <= next_proto &&
+          next_proto <= kProtoSPDY4MaximumVersion) {
+        continue;
+      }
+    }
     const std::string proto = NextProtoToString(next_proto);
     if (proto.size() > 255) {
       LOG(WARNING) << "Ignoring overlong NPN/ALPN protocol: " << proto;
@@ -254,7 +274,6 @@ std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
     wire_length++;
   }
 
-  // Allocate memory for the result and fill it in.
   std::vector<uint8_t> wire_protos;
   wire_protos.reserve(wire_length);
   for (const std::string& proto : next_proto_strings) {