Port blocking

[ricea]

We need to ensure that port blocking is applied to avoid security issues like the NAT Slipstreaming attack. This will probably be delegated to the Fetch standard, so this issue is just here to track it and make sure it isn't forgotten.

[yutakahirano]

I'm sure that WebTransport people are happy with the current block list, but having an allow-list instead (whatwg/fetch#1189) can be concerning.

[annevk]

whatwg/fetch#889 has some thoughts on this. We probably need to distinguish between local and remote ports as well.

[jan-ivar]

@yutakahirano What's our "current block list"? I couldn't find any reference to "port" or "ports" in this spec.

[ricea]

https://fetch.spec.whatwg.org/#port-blocking is what we're blocking in practice.

[jan-ivar]

We probably should call that out in the spec explicitly.

[jan-ivar]

Meeting:

• Adam: Probably W3C's responsibility to track this, since IETF may have native implementations where port blocking is not an issue.
• Marking ready for PR to add link to fetch spec per Port blocking #229 (comment)
• As follow-up, push on Additions to "bad port list" for UDP due to HTTP/3 whatwg/fetch#1268 to possibly add a list to source ports as well to the block list that would be shared with WebTransport (more important for UDP/HTTP3 that we control the source port)
• Might be worth sending a mail to IETF (WebTrans & QUIC?) mailing lists requesting clarity on where this belongs?