A cell_relay policy-routes an assigned peer with `ip rule from <peer>
lookup <table>` plus a shared `default via <cell-ip>` route in that table
inside cell-wireguard. Two teardown bugs leaked both (confirmed on hardware,
pic0<->pic1):
- remove_peer_route_via deleted the rule with a hardcoded default table 100,
but the v2 cell_relay path adds it with the connection's own table (1000+),
so the rule never matched and survived peer detach/delete. It now deletes
by source IP (table-agnostic), covering both the v2 and the legacy
route-via (table 100) paths.
- nothing ever removed the table's shared default route: delete_connection
explicitly skipped cell_relay and reconcile_cell_relays deletes the record
directly. Added wireguard_manager.teardown_route_table(table) (removes any
leftover lookup-<table> rules + flushes the table) and call it from both
delete_connection and the reconcile removal path.
Also clear a peer's relay rule on peer deletion so a peer deleted while still
assigned doesn't leave a stale source rule that could misroute a future peer
reusing the IP.
Regression tests: detach removes the rule by source; delete_connection and
reconcile-removal each flush the relay table.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cell exits surface as cell_relay connections via reconcile, bridged onto
the existing cell route_via mechanism, health from handshake, loop
detection, assignable in the unified UI
- CELL_RELAY_TYPE constant; not manually creatable
- reconcile_cell_relays() derives connections from cell links offering an
exit (name "Cell: <cellname>", mark+table only, no iface/port/container)
- apply_routes bridges cell_relay to existing route_via path via
apply_peer_route_via + cell firewall rules + set_exit_relay_active;
keeps peer.route_via in sync
- _probe_cell_relay health from cell handshake + offer state
- _cell_relay_loops loop detection at assign and apply time
- FAILOPEN_DEFAULTS cell_relay=False
- set_peer_exit clears stale route_via on reassignment
- reconcile hooked into PUT /exit-offer and peer-sync/permissions handlers
- cell_link_manager + wireguard_manager wired into connectivity_manager
- UI: cell_relay in TYPE_META/GROUP_TYPES/GROUP_LABELS (Cells optgroup),
removed "coming soon" placeholder
- 18 new tests in tests/test_connectivity_cell_relay.py
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
roof