problem with flow spec redistribution

[sunscreen]

Hi..
I am trying to perform a simple ddos mitigation experiement using FFR 8.2.2.
My Network is a 192.168.4.0/24
I have Vyos Virtual Machine and a custom test client to act as a peer AS

The problems I am facing

A) Is that first when i try and use the redistribute command inside the Address-Family of "Ipv4 flowpec" this causes the vtysh -b command to fail to validate.

root@vyos:~# vtysh -b
line 22: % Unknown command[24]:  exit-address-family
Configuration file[/etc/frr/frr.conf] processing failure: 2

B) the routes issued static or other wise by the defined tag are not passed to the output of the flowspec neighbor in any scenario.

ffr.conf of vyos VM.

root@vyos:~# cat /etc/frr/frr.conf
frr version 8.2.2
frr defaults datacenter
hostname vyos
log syslog
log facility local7
service integrated-vtysh-config
!
router bgp 50000
 no bgp default ipv4-unicast
 no bgp network import-check
 neighbor 192.168.4.59 remote-as 31595
 !
 address-family ipv4 unicast
  neighbor 192.168.4.59 activate
 #redistribute ospf
 exit-address-family
 !
 address-family ipv4 flowspec
  neighbor 192.168.4.59 activate
  neighbor 192.168.4.59 route-map flowspec out
  redistribute static
 exit-address-family
exit
!
ip prefix-list PLIST seq 5 permit any
!
route-map flowspec permit 255
 match ip address prefix-list PLIST
 match ip next-hop prefix-list PLIST
 match ip next-hop type blackhole
 #match ip route-source prefix-list PLIST
 set community 50000:777
 set ip next-hop 192.168.4.1
 set tag 777
exit
!
route-map blockhole-rm permit 256
 set community 666:666
 set ip next-hop 192.0.2.101
 set tag 666
exit
!

am i doing something wrong?

the test client recieves static route updates just fine when i enable redistribute for unicast.

if any one could shed some light on this i would be most thankful.

forgot to add neighbors output

vyos# show bgp neighbors 192.168.4.59
BGP neighbor is 192.168.4.59, remote AS 31595, local AS 50000, external link
  BGP version 4, remote router ID 192.168.4.59, local router ID 192.168.4.89
  BGP state = Established, up for 00:30:23
  Last read 00:00:02, Last write 00:00:02
  Hold time is 9, keepalive interval is 3 seconds
  Neighbor capabilities:
    4 Byte AS: advertised and received
    Extended Message: advertised
    AddPath:
      IPv4 Unicast: RX advertised
      IPv4 Flowspec: RX advertised
    Long-lived Graceful Restart: advertised
    Route refresh: advertised
    Enhanced Route Refresh: advertised
    Address Family IPv4 Unicast: advertised and received
    Address Family IPv4 Flowspec: advertised and received
    Hostname Capability: advertised (name: vyos,domain name: n/a) not received
    Graceful Restart Capability: advertised
  Graceful restart information:
    Local GR Mode: Helper*
    Remote GR Mode: Disable
    R bit: False
    Timers:
      Configured Restart Time(sec): 120
      Received Restart Time(sec): 0
  Message statistics:
    Inq depth is 0
    Outq depth is 0
                         Sent       Rcvd
    Opens:                  1          1
    Notifications:          0          0
    Updates:                0          0
    Keepalives:           608        608
    Route Refresh:          0          0
    Capability:             0          0
    Total:                609        609
  Minimum time between advertisement runs is 0 seconds

 For address family: IPv4 Unicast
  Update group 1, subgroup 1
  Packet Queue length 0
  Community attribute sent to this neighbor(all)
  0 accepted prefixes

 For address family: IPv4 Flowspec
  Update group 2, subgroup 2
  Packet Queue length 0
  Community attribute sent to this neighbor(all)
  Outbound path policy configured
  Route map for outgoing advertisements is *flowspec
  0 accepted prefixes

  Connections established 1; dropped 0
  Last reset 00:30:26,  No AFI/SAFI activated for peer
Local host: 192.168.4.89, Local port: 179
Foreign host: 192.168.4.59, Foreign port: 48740
Nexthop: 192.168.4.89
Nexthop global: fe80::a00:27ff:fef7:bddd
Nexthop local: fe80::a00:27ff:fef7:bddd
BGP connection: shared network
BGP Connect Retry Timer in Seconds: 10
Read thread: on  Write thread: on  FD used: 27

[ton31337]

redistribute command is not valid for address-family ipv4 flowspec, only for ipv4/ipv6 unicast. You can check the exact commands supported using find, like find redistribute.

[sunscreen]

hey and thanks i ended up using bird to test and my own bgp implementation to issue flowspec rules to neighbors :) .. do you know which version of ffr I should be using that is currently supporting flowspec and whats the best way to build it as i had problems trying to build 8.4dev ? as i would still like to try and do something with frr