Frr: Flowspec entry is not installed in PBR

[464d41]

Description

FRR receives flowspec entry but it is reported as "not installed in PBR" and rule isn't applied to traffic.

Steps to Reproduce

1. Configure BGP to accept flowspec

router bgp 12345
 bgp router-id 10.0.0.1
 neighbor 10.15.10.253 remote-as 12345
 !
 address-family ipv4 flowspec
  neighbor 10.15.10.253 activate
 exit-address-family
 rfp full-table-download off
!

1. Check received flowspec entry

94613e4eaa8c# show bgp ipv4 flowspec
BGP table version is 1103, local router ID is 10.0.0.1, vrf id 0
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*>i to 10.17.10.20/32 from 0.0.0.0/0 proto = 6  dstp = 443                  10.15.10.253                  100      0 i
Displayed  1 routes and 1 total paths

94613e4eaa8c# show bgp ipv4 flowspec 10.17.10.20/32
BGP flowspec entry: (flags 0x418)
        Destination Address 10.17.10.20/32
        Source Address 0.0.0.0/0
        IP Protocol = 6
        Destination Port = 443
        FS:redirect IP 0x0
        NH 10.15.10.253
        received for 00:03:39
        not installed in PBR

bash-4.4# iptables -t mangle --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Expected behavior:

Flowspec entry translated to underlying linux instructions and applied to traffic flow

Actual behavior:
Looks flowspect entry is not translated to underlying linux instructions since iptables output shows nothing.

Components

bash-4.4# cat /etc/frr/daemons | grep yes
zebra=yes
bgpd=yes
pbrd=yes

sudo docker logs -f frr
Starting Frr daemons (prio:10):.
Exiting from the script
watchfrr[79]: watchfrr 6.1-dev starting: vty@0
watchfrr[79]: zebra state -> up : connect succeeded
watchfrr[79]: pbrd state -> up : connect succeeded
watchfrr[79]: bgpd state -> up : connect succeeded
watchfrr[79]: all daemons up, doing startup-complete notify

Versions

I'm running FRR in container. Image: ajones17/frr:latest

Likely info listed above is not enough to debug. Please let me know what else is needed.

[pguibert6WIND]

the PBR install requires FRR to contain a plugin that is not yet in FRR main stream
( look at https://github.com/FRRouting/frr/pull/2025 for more information).

[donaldsharp]

@pguibert6WIND I thought you indicated that you were going to be providing a patch that did the install correctly into the kernel. Is this not the case?

[pguibert6WIND]

yes. a patch will be provided. but the ETA has been delayed.

[464d41]

That is great. Thank you guys for fast reply. Hope on same fast resolution. Let me know if any other debug data is needed.

[bhicks69]

It looks as though this will be resolved in 7.0. Is that correct? If so, is there a way to test this in a dev or test release?

[pguibert6WIND]

Hi @bhicks69 , sorry but as ETA has been postponed, this will not be available for 7.0
as mentioned, I think the original pull request used for driving netfilter is available, you should be able to build your own frr.
but sorry, 7.0 will not have the flowspec driver.

[reza-ghazvini]

Hi Guys,
I have the same problem when I send rules from ExaBGP to FRR (ver 6.0.2), Debian. "not installed in PBR". Could you please leave me any helpful comments.

[pguibert6WIND]

Hi @reza-ghazvini , there has not been any rework of #2025 yet so that you can use PBR directly in frr. if you feel motivated for moving to ABI interface, you re welcome.