BIRD on FreeBSD: BGP MD5 needs a source address

I am toying with BGP on FreeBSD, and I started using BIRD.

It took me a while to understand why I had this error:

Socket error: connect: No such file or directory

But I could ping the peers, and setkey -D showed the TCP-MD5 security associations present and mature, with the correct password.

The tcpdump was the real clue. The peer's SYN arrived with a valid MD5 signature, and our box answered with a RST or ignored the packet:

18:24:14.625549 00:00:5e:00:53:02 > 00:00:5e:00:53:01, ethertype IPv4 (0x0800), length 82: 1.2.3.4.43565 > 1.2.3.5.179: Flags [S], seq 544230727, win 32768, options [mss 1436,wscale 0,nop,md5 valid,eol], length 0
18:24:14.625573 00:00:5e:00:53:01 > 00:00:5e:00:53:02, ethertype IPv4 (0x0800), length 60: 1.2.3.5.179 > 1.2.3.4.43565: Flags [R.], seq 0, ack 544230728, win 0, length 0

So the MD5 was fine; the kernel couldn't find the security association to verify (or sign) with.

It took me a bit of digging to find that FreeBSD's IPsec implementation matches on the exact source and destination addresses, with no wildcard.

BIRD's setkey on option installs a wildcard src when no source address is set.

Anyway, adding a source address to the BGP protocol block fixed it.

protocol bgp isp_v4 {
    local as 1234;
    neighbor 1.2.3.4 as 123;
    source address 1.2.3.5; # REQUIRED
    authentication md5;
    password "...";
    setkey on;
    ...
}

On FreeBSD, BGP MD5 requires a stable source address, which you want anyway for a transit box.