[RFC 2385 / major] TCP-MD5 BGP session authentication missing

[ruhex]

Context

BGP sessions run over plain TCP with no per-peer authentication. Some peers/ISPs require TCP-MD5 (RFC 2385) on the BGP TCP connection; without it those peers cannot establish a session, and there is no protection against spoofed TCP RST/injection.

What's wrong

• BGPLite.Server/BgpServer.cs:65-68 — listener socket used raw, no TCP_MD5SIG socket option.
• BGPLite.Configuration/PeerConfig.cs — no key/password field.

What the RFC says

RFC 2385 §2 — each TCP segment of a BGP session MUST carry an MD5 digest computed over the segment + a per-connection key; the listening side MUST require MD5 on accepted connections (reject segments without a valid digest). Keys up to 80 bytes, configurable per peer (§4).

Fix

• Add a per-peer key field to PeerConfig (YAML).
• Set TCP_MD5SIG socket option on the listener (keyed by peer address) and on accepted sockets (setsockopt IPPROTO_TCP, TCP_MD5SIG).
• On .NET, this requires platform interop (RuntimeInformation/P-Invoke) for the tcp_md5sig struct; gate behind config (only when a key is set).

Acceptance

• A peer configured with an MD5 key authenticates; a peer without/mismatched key is rejected.
• No regression for peers without a configured key (plain TCP path unchanged).

Refs: FIXPLAN 7.8; RFC 2385 §2, §4. Note: TCP-AO (RFC 5925) is the modern successor; MD5 remains widely required by peers.