I recently updated a couple of my routers from FreeBSD 10.3 to 11.2, both running BIRD 1.6 (1.6.3 -> 1.6.4). After the upgrade, I noticed that my BGP protocol instances without a password fail to connect, while those with a password work as expected. For reference, my topology is as follows. I have a pair of routers (matching OS/BIRD versions), each with a BGP session to an upstream router. These eBGP protocol instances use a BGP password, which was previously handled by manually configuring the ipsec.conf file (changed to let BIRD manage while troubleshooting this issue). Additionally, there is an iBGP session between the two BIRD routers, which does not utilize a password. +-------+ +-------+ | ISP1 | | ISP2 | +--+----+ +--+----+ | | |(MD5) |(MD5) | | +--+----+ +--+----+ | BIRD1 +------+ BIRD2 | +-------+ +-------+ IIRC, the IPSec/TCP-MD5 changes in FreeBSD 11 have been discussed here previously. If I understand their effect on BIRD correctly, setting TCP_MD5SIG on the BGP listen socket in FreeBSD 11 mandates that all packets in/out on the socket MUST be MD5-signed (per tcp(4)). By comparison, the behavior in earlier FreeBSD releases was more of an opportunistic model. If my limited understanding of the BIRD code is correct, when the configuration of a BGP protocol instance specifies a password, the TCP_MD5SIG option is set on the listen socket (and appropriate connect sockets). Because of the change in behavior for the TCP_MD5SIG option, this effectively bars any non-MD5 connections to the listen socket. If I change the (non-password) iBGP session configuration to use a password and reconfigure BIRD, the session comes up (as expected). Interestingly, if I then remove the password from the iBGP instance and reconfigure (both BIRD hosts), the session is restarted and works without MD5 (as shown by tcpdump). My guess is that BIRD is removing the relevant option from the listen socket when the configuration is re-read? This is not a particularly good solution (or kludge), as new/restarted sessions that require MD5 would probably fail? Can anyone confirm if I am on the right track, that FreeBSD 11 changes effectively force all BGP sessions on a given BIRD [1.6] instance to either use a password, or no password? Reading the BIRD 2.0 documentation, it appears that there is a partial solution to be had. The 'strict bind' option appears to allow binding the listen socket to a specific IP. Would this allow IP address "1" to listen for sessions with passwords, and address "2" to listen for sessions without? This still would not address another situation I have, where multiple BGP sessions connect to the same local IP, some with passwords, some without (IXP connection). This would seem to be more of a FreeBSD issue than a BIRD issue. However, I'm curious if anyone else has run into it, and has some clever idea that I have overlooked? Configuration snippet for IPv4 follows, although I see the same behavior on IPv6 as well (omitted for brevity). # START BIRD CONFIG template bgp ebgp { local as 12345; } template bgp ibgp { multihop 2; } protocol bgp bgp_uplink from ebgp { neighbor 10.20.207.131 as 54321; import filter bgp_in_uplink; password "a_password"; #setkey off; source address 10.20.207.133; } protocol bgp ibgp_border from ibgp { local 192.168.166.247 as 12345; neighbor 192.168.166.246 as 12345; # Password added to allow session to connect. password "wtf"; } # END BIRD CONFIG % setkey -D 192.168.166.246 192.168.166.247 tcp mode=any spi=96441423(0x05bf944f) reqid=0(0x00000000) A: tcp-md5 777466 seq=0x00000000 replay=0 flags=0x00000040 state=mature created: Jul 17 13:49:03 2018 current: Jul 17 13:49:30 2018 diff: 27(s) hard: 0(s) soft: 0(s) last: Jul 17 13:49:06 2018 hard: 0(s) soft: 0(s) current: 1626176(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 2226 hard: 0 soft: 0 sadb_seq=9 pid=12858 refcnt=1 192.168.166.247 192.168.166.246 tcp mode=any spi=152346577(0x09149fd1) reqid=0(0x00000000) A: tcp-md5 777466 seq=0x00000000 replay=0 flags=0x00000040 state=mature created: Jul 17 13:49:03 2018 current: Jul 17 13:49:30 2018 diff: 27(s) hard: 0(s) soft: 0(s) last: Jul 17 13:49:06 2018 hard: 0(s) soft: 0(s) current: 3066573(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 2530 hard: 0 soft: 0 sadb_seq=8 pid=12858 refcnt=1 10.20.207.131 10.20.207.133 tcp mode=any spi=146229653(0x08b74995) reqid=0(0x00000000) A: tcp-md5 6321794e 783039 seq=0x00000000 replay=0 flags=0x00000040 state=mature created: Jul 17 10:49:14 2018 current: Jul 17 13:49:30 2018 diff: 10816(s) hard: 0(s) soft: 0(s) last: Jul 17 10:49:19 2018 hard: 0(s) soft: 0(s) current: 17378925(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 13433 hard: 0 soft: 0 sadb_seq=7 pid=12858 refcnt=1 10.20.207.133 10.20.207.131 tcp mode=any spi=128063495(0x07a21807) reqid=0(0x00000000) A: tcp-md5 6321794e 783039 seq=0x00000000 replay=0 flags=0x00000040 state=mature created: Jul 17 10:49:14 2018 current: Jul 17 13:49:30 2018 diff: 10816(s) hard: 0(s) soft: 0(s) last: Jul 17 10:49:19 2018 hard: 0(s) soft: 0(s) current: 453718(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 7494 hard: 0 soft: 0 sadb_seq=6 pid=12858 refcnt=1