A cell_relay policy-routes an assigned peer with `ip rule from <peer>
lookup <table>` plus a shared `default via <cell-ip>` route in that table
inside cell-wireguard. Two teardown bugs leaked both (confirmed on hardware,
pic0<->pic1):
- remove_peer_route_via deleted the rule with a hardcoded default table 100,
but the v2 cell_relay path adds it with the connection's own table (1000+),
so the rule never matched and survived peer detach/delete. It now deletes
by source IP (table-agnostic), covering both the v2 and the legacy
route-via (table 100) paths.
- nothing ever removed the table's shared default route: delete_connection
explicitly skipped cell_relay and reconcile_cell_relays deletes the record
directly. Added wireguard_manager.teardown_route_table(table) (removes any
leftover lookup-<table> rules + flushes the table) and call it from both
delete_connection and the reconcile removal path.
Also clear a peer's relay rule on peer deletion so a peer deleted while still
assigned doesn't leave a stale source rule that could misroute a future peer
reusing the IP.
Regression tests: detach removes the rule by source; delete_connection and
reconcile-removal each flush the relay table.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
roof
2ab6e715d8