bird: add source address + next hop self (v6 anycast fix)

Cisco IOS rejects IPv6 BGP advertisements whose next-hop is link-local-
only. BIRD2 was synthesising a link-local next-hop for kernel-learned
routes whose dev had no via gateway (our anycast /128s). Symptom: v4
anycast worked (Cisco doesn't have the same constraint for /32s), v6
anycast didn't make it past crt001.

- pkg/routing/bird/config.go: NodeBGP.LocalV6/LocalV4. Template now
  emits `local <addr> as <asn>` and `next hop self;` in the BGP
  channel for both families, mirroring Calico's `source address` +
  `next hop self` pattern.
- pkg/agent/bird.go: localAddrSameSubnet picks an interface address
  on the peer's /64 or /24 to use as source.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/bird.go

@@ -44,12 +44,24 @@ func (b *BirdManager) Render(nc *flockv1alpha1.NodeConfig, anycast6, anycast4 []
 		Anycast6: anycast6,
 		Anycast4: anycast4,
 	}
+	// Pick a local source address per family that's on the same subnet as
+	// the BGP peer. crt001 rejects IPv6 advertisements whose next-hop is
+	// link-local-only; an explicit `source address` makes BIRD use a
+	// global next-hop self, which Cisco accepts.
 	for _, p := range nc.Spec.BGP.Peers {
 		fam := bird.FamilyOf(p.Address)
 		if fam == "" {
 			continue
 		}
 		in.Peers = append(in.Peers, bird.Peer{Family: fam, Address: p.Address, ASN: p.ASN})
+		if local := localAddrSameSubnet(p.Address); local != "" {
+			if fam == "v6" && in.LocalV6 == "" {
+				in.LocalV6 = local
+			}
+			if fam == "v4" && in.LocalV4 == "" {
+				in.LocalV4 = local
+			}
+		}
 	}
 
 	cfg, err := bird.Render(in)
@@ -126,6 +138,49 @@ func (b *BirdManager) SummaryRoutes(nc *flockv1alpha1.NodeConfig) error {
 	return nil
 }
 
+// localAddrSameSubnet finds an IP on a local interface that's in the same
+// /64 (v6) or /24 (v4) as `peer`. Returns "" if none. Used to derive the
+// `source address` for a BGP session.
+func localAddrSameSubnet(peer string) string {
+	pip := net.ParseIP(peer)
+	if pip == nil {
+		return ""
+	}
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return ""
+	}
+	v4 := pip.To4() != nil
+	for _, a := range addrs {
+		ipn, ok := a.(*net.IPNet)
+		if !ok {
+			continue
+		}
+		ip := ipn.IP
+		if ip.IsLoopback() || ip.IsLinkLocalUnicast() {
+			continue
+		}
+		if (ip.To4() != nil) != v4 {
+			continue
+		}
+		// Use the peer's mask (assume same subnet) for membership test.
+		var mask net.IPMask
+		if v4 {
+			mask = net.CIDRMask(24, 32)
+		} else {
+			mask = net.CIDRMask(64, 128)
+		}
+		peerSubnet := &net.IPNet{IP: pip, Mask: mask}
+		if peerSubnet.Contains(ip) {
+			if v4 {
+				return ip.To4().String()
+			}
+			return ip.To16().String()
+		}
+	}
+	return ""
+}
+
 func installBlackhole(cidr string) error {
 	// Use `ip` rather than netlink so this file stays portable for non-Linux
 	// builds (the agent on macOS just no-ops). The agent only runs in