restricted access to certain domains

With WASI there's the chance to introduce security guarantees not possible with POSIX. One I'd be really looking forward to, would be to allow only access to certain domain names.

For being able to do so, it would be required to combine name resolution and connect calls. If we would be able to directly call connect with a domain name and (optionally?) the desired address family, we would be able to design a capability that only allows connecting to certain domain names.

Without that, sockets can only be limited to (potentially large) IP ranges, and code calling connect would always have the possibility to connect to any IP address in this range.

As an example: I'd like to use a client library for accessing AWS S3 buckets and I'd like to ensure that this library isn't doing requests to anything else. I'd like to be able to pass a capability to that library that only allows access to the specific domain of the bucket (my_bucket.s3.amazonaws.com) and nothing else.

In a two-step approach with name resolution and address-based connect, there could be a capability that limits the name resolution to only resolve that domain but for the socket I'd need to allow access to all of AWS's IP-ranges for the desired region. There would be nothing that prevents the library from doing any other requests to any of the IPs in those ranges.

If we would be able to directly specify domain names as remote addresses in the socket's connect, we could limit it to only that single domain, and wouldn't need to allow access to the whole set of IP-ranges.

This would be a huge step forward in reducing software supply chain risks.

The issue names no files, tests, or entry points. Start by reviewing the proposed relationship between name resolution and socket connect calls in WASI, then determine the required capability design and scope. Done would require an agreed design before implementation and tests can be identified.