bgp: parse NOTIFICATIONs, enforce hold-timer, support TCP-MD5 auth

[thewillyhuman]

Summary

PR 2 of the production-readiness remediation plan. Closes the three Tier-3 BGP findings from the audit: H1 (hold-timer expiry), H2 (NOTIFICATION parsing), H3 (MD5 auth). Three atomic commits. Workspace tests 203 → 211; cargo clippy --workspace --all-targets -- -D warnings clean; fmt clean.

Commits

1. Parse inbound BGP NOTIFICATION messages (H2)

The drive loop used to read into a 64-byte buffer and silently discard whatever arrived — the comment at the discard site admitted "A strict parser is out of scope". Operators had no visibility into why peers closed sessions.

Now: inbound bytes accumulate, take_message extracts whole BGP messages (self-healing on marker desync, bounded by RFC 4271 §4.1 max length), and any NOTIFICATION yields a new BgpEvent::PeerNotification + a warn! log + a lb_bgp_peer_notifications_total{peer_ip, code, subcode} counter increment. Other peer-initiated messages (KEEPALIVE, UPDATE) are still ignored — a strict UPDATE parser isn't on the roadmap.

New helpers in lb-bgp::messages:

• encode_notification(code, subcode)
• parse_notification(data) -> Option<(u8, u8)>
• notification_error_name(code) -> &'static str
• mod error_code { HOLD_TIMER_EXPIRED, CEASE } for the codes we emit ourselves

New integration test peer_notification_tears_down_session_and_emits_event uses the newly-added MockRouter::inject_bytes to push a Cease NOTIFICATION mid-session and asserts the event fires with the right code/subcode.

2. Enforce BGP hold-timer expiry (H1)

BgpSpeaker::connect now parses the peer's OPEN hold-time and returns the RFC-4271-negotiated value (min(our_hold, peer_hold)) alongside the stream. The drive loop tracks last_inbound: Instant (bumped on every successful read) and races a sleep_until(last_inbound + negotiated_hold) against the other select arms; if the sleep wins, we send a HOLD_TIMER_EXPIRED NOTIFICATION and return a transient disconnect.

negotiated_hold == 0 (peer disabled keepalives per RFC §4.2) disables both the keepalive ticker and the hold timer.

Integration test hold_timer_expires_and_fires_notification configures the peer with hold_time_secs = 2, asserts the mock router observes a HOLD_TIMER_EXPIRED NOTIFICATION on the wire within 5s of handshake completion.

3. Support RFC 2385 TCP-MD5 authentication per peer (H3)

New optional md5_password: Option<String> per peer config. When set, the speaker installs TCP_MD5SIG on the socket before connect() (via tokio::net::TcpSocket so the sockopt lands before the SYN). The helper:

• Lives in speaker.rs as a per-session concern
• Is #[cfg(target_os = "linux")] — TCP_MD5SIG is Linux-specific
• On non-Linux: stub logs a warn! and returns Ok so peering attempts plain TCP and fails cleanly at handshake rather than mysteriously
• Enforces the 80-byte Linux TCP_MD5SIG_MAXKEYLEN cap, returning InvalidInput on oversize keys
• Defines struct tcp_md5sig locally (the libc crate doesn't expose it uniformly)
• Only handles IPv4 peers, consistent with H5 being out of scope

Not tested end-to-end: runtime MD5 verification needs a real peer configured with the same key, or a full libc mock — out of scope for this PR. The code path is exercised by cargo build on Linux CI.

Test plan

• cargo test --workspace → 211 passing
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --all --check clean
• Check CI on Linux: lb-bgp builds with the cfg(target_os = "linux") libc dependency resolved
• Manual local run with a mock peer that goes silent after handshake → speaker sends HOLD_TIMER_EXPIRED within hold_time_secs and reconnects

What's next

Per the plan:

• PR 3: feat/fragment-reassembly (H4) — wire the existing FragmentTable into the hot path.
• PR 4: feat/io-backend-selection (S1/S2/S3) — delete DPDK stub, config-driven backend, complete AF_XDP via xdpilone or similar.
• PR 5: feat/lb-trace (H6).
• PR 6: chore/hardening (M2–M5, M7).

🤖 Generated with Claude Code