Commit 8dfe3b6533 for frr

commit 8dfe3b6533a07d2bfd1e866e32a3b3f5c52674ed
Author: Amr Shadid <amr.shadid.2016@gmail.com>
Date:   Tue Sep 15 15:04:07 2026 +0300

    bgpd: fail closed when TCP MD5 setup fails on an active connect

    bgp_connect() installs the configured TCP MD5 key on the outbound socket
    with bgp_md5_set_connect() but ignored the return value, so if the key
    could not be installed - the platform lacks TCP MD5 support, or setsockopt
    failed - the session was brought up unauthenticated even though the peer
    was configured with a password.

    Treat a failed key install as fatal for the connect attempt: reset the peer
    and return connect_error, the same way the other socket-setup failures in
    bgp_connect() are handled.  bgp_md5_set_socket() already logs the specific
    reason.

    Fixes: #22907
    Signed-off-by: Amr Shadid <amr.shadid.2016@gmail.com>

diff --git a/bgpd/bgp_network.c b/bgpd/bgp_network.c
index 76dcc7ac0f..6a143d96ed 100644
--- a/bgpd/bgp_network.c
+++ b/bgpd/bgp_network.c
@@ -938,8 +938,14 @@ enum connect_result bgp_connect(struct peer_connection *connection)
 		if (!BGP_CONNECTION_SU_UNSPEC(connection))
 			bgp_md5_set(connection);

-		bgp_md5_set_connect(connection->fd, &connection->su, prefixlen,
-				    peer->password);
+		/* Don't connect unauthenticated if the configured TCP MD5 key
+		 * could not be installed on the socket.
+		 */
+		if (bgp_md5_set_connect(connection->fd, &connection->su, prefixlen,
+					peer->password) < 0) {
+			peer_set_last_reset(peer, PEER_DOWN_SOCKET_ERROR);
+			return connect_error;
+		}
 	}

 	/* Update source bind. */