From 6a66360f60510f4256c3e327faa6cd91c340cb61 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Fri, 10 Jan 2025 16:21:30 -0500
Subject: [PATCH 1/3] network revocation for websocket and webtransport

---
 spec.bs | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 75 insertions(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index 65aa289..891fa2c 100644
--- a/spec.bs
+++ b/spec.bs
@@ -269,6 +269,18 @@ spec: attribution-reporting; urlPrefix: https://wicg.github.io/attribution-repor
 spec: turtledove; urlPrefix: https://wicg.github.io/turtledove/
   type: dfn
     text: construct a pending fenced frame config; url: construct-a-pending-fenced-frame-config
+spec: RFC6455; urlPrefix: https://datatracker.ietf.org/doc/html/rfc6455
+  type: dfn
+    text: fail the WebSocket connection; url: #section-7.1.7
+spec: WebSocket; urlPrefix: https://websockets.spec.whatwg.org/
+  type: dfn
+    text: establish a WebSocket connection; url: #concept-websocket-establish
+spec: WebTransport; urlPrefix: https://w3c.github.io/webtransport
+  type: dfn
+    for: WebTransport
+      text: cleanup; url: #webtransport-cleanup
+      text: queue a network task; url: #webtransport-queue-a-network-task
+    text: initialize WebTransport over HTTP; url: #initialize-webtransport-over-http
 </pre>
 
 <style>
@@ -2123,6 +2135,16 @@ Issue: This will require a RFC to add a test-only function to the WPT web driver
   1. [=set/Append=] |nonce| to the user agent's [=network revocation nonce set=].
 
   1. [=fetch group/terminated|Terminate=] |settings|'s [=fetch/fetch group=].
+
+  1. [=list/For each=] {{WebSocket}} object |webSocket| whose [=relevant settings object=] is
+     |settings|, run [=fail the WebSocket connection=] given |webSocket|.
+
+  1. [=list/For each=] {{WebTransport}} object |webTransport| whose [=relevant settings object=] is
+     |settings|, [=WebTransport/cleanup=] |webTransport| with a newly [=exception/create|created=]
+     {{WebTransportError}} whose {{WebTransportErrorOptions/source}} is `"session"`.
+
+     Note: Not passing in a {{WebTransportCloseInfo}} ensures that the {{WebTransport}} object is
+     set to the `"failed"` state rather than the `"closed"` state.
 </div>
 
 <div algorithm>
@@ -2161,7 +2183,41 @@ The network revocation mechanism requires the following monkeypatches to the [[F
   (<a href="https://github.com/WICG/fenced-frame/issues/191">WICG/fenced-frame#191</a>)
 </div>
 
-The network revocation mechanism requires the following monkeypatches to the [[HTML]] Standard.
+<h3 id=disable-websocket>WebSocket monkeypatches for network revocation</h3>
+
+The network revocation mechanism requires the following monkeypatch to the [[WebSockets]]
+Standard.
+
+<div algorithm=establish-websocket-patch>
+  Modify the [=establish a WebSocket connection=] algorithm. Add a new step after step 10 that
+  reads:
+
+  11. If the result of running [=determine if a navigable has revoked network for itself=] given
+      <var ignore>client</var>'s [=environment settings object/global object=]'s
+      [=Window/navigable=] is true, [=fail the WebSocket connection=].
+</div>
+
+<h3 id=disable-webtransport>WebTransport monkeypatches for network revocation</h3>
+
+The network revocation mechanism requires the following monkeypatch to the [[WebTransport]]
+Standard.
+
+<div algorithm=initialize-webtransport-patch>
+  Modify the [=initialize WebTransport over HTTP=] algorithm. Rewrite step 5 (keeping all substeps
+  unchanged) to read:
+
+  5. If any of the following conditions are true:
+     
+     - Running [=should request be blocked by Content Security Policy?=] with |request| returns
+       **"Blocked"**;
+     - Running [=should request be blocked due to a bad port=] with |request| returns **"blocked"**;
+     - Running [=determine if a navigable has revoked network for itself=] given <var
+       ignore>client</var>'s [=environment settings object/global object=]'s [=Window/navigable=]
+       returns true;
+     
+     then abort the remaining steps and [=WebTransport/queue a network task=] with
+     <var ignore>transport</var> to run these steps:
+</div>
 
 <h3 id=new-request-destination>New [=request=] [=request/destination=]</h3>
 
@@ -2196,6 +2252,24 @@ table](https://fetch.spec.whatwg.org/#destination-table) to illustrate that <{fe
  * CSP directive of <code>fenced-frame-src</code>
  * Features as HTML's <code>&lt;fencedframe&gt;</code>
 
+<h3 id=methods-gated-on-network-revocation>Methods gated on network revocation</h3>
+
+<div algorithm>
+  To <dfn>determine if a navigable has revoked network for itself</dfn> given a [=navigable=] 
+  |navigable|:
+
+  1. If |navigable|'s [=navigable/traversable navigable=] is not a [=fenced navigable
+     container/fenced navigable=], return false.
+
+  1. Let |config| be |navigable|'s [=navigable/active browsing context=]'s [=browsing
+     context/fenced frame config instance=].
+
+  1. If |config|'s [=fenced frame config instance/untrusted network status=] is not [=untrusted
+     network status/enabled=], return true.
+
+  1. Return false.
+</div>
+
 <h3 id=automatic-reporting>Automatic Reporting</h3>
 
 *This first introductory paragraph is non-normative.*

From 945d2b21010d2053a91a9d03d21282ac5447b385 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Mon, 13 Jan 2025 11:12:54 -0500
Subject: [PATCH 2/3] return false in all guard clauses

---
 spec.bs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/spec.bs b/spec.bs
index 891fa2c..5ae965b 100644
--- a/spec.bs
+++ b/spec.bs
@@ -2264,10 +2264,10 @@ table](https://fetch.spec.whatwg.org/#destination-table) to illustrate that <{fe
   1. Let |config| be |navigable|'s [=navigable/active browsing context=]'s [=browsing
      context/fenced frame config instance=].
 
-  1. If |config|'s [=fenced frame config instance/untrusted network status=] is not [=untrusted
-     network status/enabled=], return true.
+  1. If |config|'s [=fenced frame config instance/untrusted network status=] is [=untrusted network
+     status/enabled=], return false.
 
-  1. Return false.
+  1. Return true.
 </div>
 
 <h3 id=automatic-reporting>Automatic Reporting</h3>

From d027b959df21b0e0cc029d7db91f653619270edd Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 16 Jan 2025 16:52:42 -0500
Subject: [PATCH 3/3] update introductory section

---
 spec.bs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spec.bs b/spec.bs
index 3f8495b..9c8a57d 100644
--- a/spec.bs
+++ b/spec.bs
@@ -2269,6 +2269,10 @@ In the intermediate state where {{Fence/disableUntrustedNetwork()}} has been cal
 requests over the network. The second algorithm below is used to determine whether those features
 are allowed.
 
+We make the distinction between "fully revoked" and "revoked for self"
+because nested fenced frame trees might still have network access, and these restrictions will not
+apply to them until they have invoked {{Fence/disableUntrustedNetwork()}} as well. 
+
 <div algorithm>
   To <dfn export>determine if a navigable has fully revoked network</dfn> given a [=navigable=] 
   |navigable|: