WPT details: There is no SSM WPT yet (follow-up tracked in crbug.com/461262401): the spec rejects loopback sources, so the test has to send from a non-loopback address of the test host, which I haven't validated on the WPT bots yet. The ASM multicast WPT (direct-sockets/udp_socket_multicast.https.html) runs in Chromium's virtual/direct-sockets suite (Timeout on Mac, crbug.com/443716695; flaky on Linux, crbug.com/570251397). No Chromium test sends SSM datagrams yet either; adding one is tracked in crbug.com/461262401. SSM is covered by: - blink_unittests: MulticastControllerSsmTest.* (validation, membership rules, IP-version mismatch, ASM/SSM mixing) and the IDL feature-flag tests - content_browsertests: DirectSocketsBoundUdpBrowserTest.*SSM* - browser_tests (installed IWA): ChromeDirectSocketsUdpIsolatedWebAppMulticastTest.*SSM* - net_unittests: UDPSocketTest.JoinSourceGroup*, LeaveSourceGroup*, SSMSourceFilteringMultiNIC* (join and leave with two sources) - services_unittests: the bad-message and invalid-address tests in crrev.com/c/8583003 and crrev.com/c/8583123
Adds Source-Specific Multicast (SSM) support to the Direct Sockets API, allowing Isolated Web Apps to optionally specify a source address when joining multicast groups to receive UDP packets only from that source. Without a source address, joinGroup() uses Any-Source Multicast (ASM), which receives packets from any source sending to the group. SSM is essential to using multicast outside of private networks, simplifying packet routing, and filtering traffic at the network level by source address, which mitigates spoofing and denial-of-service attacks.
RFC 8815 deprecates ASM for inter-domain use due to security vulnerabilities and operational complexity. Without SSM support, developers building multicast applications in Isolated Web Apps face several problems: Limited deployment scenarios: Applications are restricted to controlled private networks where all sources are trusted, preventing use cases like internet-wide content distribution or cross-organization IoT systems. Application-layer filtering overhead: Applications must receive and process all packets sent to a multicast group before validating the source, wasting CPU cycles and bandwidth on potentially malicious traffic. SSM is the IETF-recommended model for multicast across domains (RFC 4607, RFC 8815) and is supported by many enterprise and ISP networks. Adding SSM support enables more secure multicast communication beyond private network boundaries.
Samples: https://blockcast.network/live https://chromewebstore.google.com/detail/multicast-gateway-beacon/djikmiecejmojgcglkfmihhkfgekjlaj
Explainers: https://github.com/WICG/direct-sockets/blob/main/docs/multicast-explainer.md