git: 714433a6772b - main - bind_all_fibs: Disable bind_all_fibs by default

The branch main has been updated by pouria:

URL: https://cgit.FreeBSD.org/src/commit/?id=714433a6772b346723341735ef9547f672d9d2a3

commit 714433a6772b346723341735ef9547f672d9d2a3
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-10-24 18:01:06 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-10-29 14:07:17 +0000

    bind_all_fibs: Disable bind_all_fibs by default
    
    net.inet.{tcp,udp,raw}.bind_all_fibs was set to 1 for backward
    compatibility. Set to 0 by default to drop them all unless an inpcb
    bound to the same FIB exists.
    
    While here, Add an UPDATING entry for behaviour change.
    
    Relnotes:       yes
    Reviewed by:    markj
    Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/73
---
 UPDATING                 | 10 ++++++++++
 sys/netinet/raw_ip.c     |  2 +-
 sys/netinet/tcp_input.c  |  2 +-
 sys/netinet/udp_usrreq.c |  2 +-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/UPDATING b/UPDATING
index 44b77a813e48..abcbbfbf5ee5 100644
--- a/UPDATING
+++ b/UPDATING
@@ -27,6 +27,16 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 16.x IS SLOW:
 	world, or to merely disable the most expensive debugging functionality
 	at runtime, run "ln -s 'abort:false,junk:false' /etc/malloc.conf".)
 
+20261029:
+	The net.inet.{tcp,udp,raw}.bind_all_fibs sysctls now default to 0.
+	This allows applications to bind to the same port in different
+	FIBs.  As a result, a socket bound to a specific address only
+	receives traffic from the FIB it was created in (see setfib(1)).
+	Sockets bound to the wildcard address are not affected.  If you
+	use multiple FIBs and rely on such a service accepting traffic
+	from all of them, set these sysctls to 1 to restore the previous
+	behavior.
+
 20260919:
 	less(1) has been updated to version 710, which removes the obsolete
 	lesskey(1) utility.  It is no longer built or installed, and the
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 1360dedbb2ef..e2fea834ee79 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -128,7 +128,7 @@ void (*ip_rsvp_force_done)(struct socket *);
 #endif /* INET */
 
 #define	V_rip_bind_all_fibs	VNET(rip_bind_all_fibs)
-VNET_DEFINE(int, rip_bind_all_fibs) = 1;
+VNET_DEFINE(int, rip_bind_all_fibs) = 0;
 SYSCTL_INT(_net_inet_raw, OID_AUTO, bind_all_fibs, CTLFLAG_VNET | CTLFLAG_RDTUN,
     &VNET_NAME(rip_bind_all_fibs), 0,
     "Bound sockets receive traffic from all FIBs");
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 5ebcad5eae43..e7554b6c6e07 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -131,7 +131,7 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(tcp_log_in_vain), 0,
     "Log all incoming TCP segments to closed ports");
 
-VNET_DEFINE(int, tcp_bind_all_fibs) = 1;
+VNET_DEFINE(int, tcp_bind_all_fibs) = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, bind_all_fibs, CTLFLAG_VNET | CTLFLAG_RDTUN,
     &VNET_NAME(tcp_bind_all_fibs), 0,
     "Bound sockets receive traffic from all FIBs");
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 79d292983c24..2eac13d167d8 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -103,7 +103,7 @@
  * Per RFC 3828, July, 2004.
  */
 
-VNET_DEFINE(int, udp_bind_all_fibs) = 1;
+VNET_DEFINE(int, udp_bind_all_fibs) = 0;
 SYSCTL_INT(_net_inet_udp, OID_AUTO, bind_all_fibs, CTLFLAG_VNET | CTLFLAG_RDTUN,
     &VNET_NAME(udp_bind_all_fibs), 0,
     "Bound sockets receive traffic from all FIBs");