1720597 - Create a source port blocklist

Status: NEW

(Core :: Networking, task, P2)

Description

[Martin Thomson [:mt:]]

See https://mailarchive.ietf.org/arch/msg/quic/S-RFr4SssiQFGO9-ga9_uZsMeLo/ for more.

Some server deployments are looking at blocking certain source ports (mostly those that have a bad history of reflection attacks) for QUIC. We should know those port numbers and request a different port number if the OS gives us a listed port when we ask for an ephemeral port.

The suggested list includes privileged ports (53/DNS) and high-numbered ports (11211/memcached). We might not end up with the former at all, but the latter is a possibility in some configurations.

If we don't then attempts to use QUIC could time out, which has a bad user experience and could lead to unnecessarily disabling the protocol.

(Currently, this is UDP-specific and should remain that way.)