feat: native netlink route flush, agent-accelerated teardown, CI suite

Add --flush-routes <iface>[:family] to rxnm-agent. Performs RTM_GETROUTE
dump filtered by interface index (RTA_OIF), then fires RTM_DELROUTE for
each match. Completes the zero-loss teardown sequence alongside
--flush-addrs — static routes and default gateways that survive address
removal are now scrubbed via raw netlink.

Shell-side:
- _task_set_link(): flush-routes called after flush-addrs on disable
- action_route_flush(): agent path with --iface for interface-scoped flush
- Global IPv6 disable: flush addrs+routes per-interface during teardown

All flush paths follow agent-preferred/ip-fallback pattern consistently
across interfaces, routes, and system modules.

CI:
- Add v1.1.1 branch to workflow triggers
- Add v1.1.1 regression suite step (28-point structural validation)
- tests/test_v111_regressions.sh covers: flock compat, confirm_action,
  reload ordering, flush-addrs/flush-routes integration, profile .default
  tracker, route agent acceleration, 80-wired.network Type= removal

Author: aenertia

.github/workflows/integration.yml

@@ -2,9 +2,9 @@ name: RXNM CI (Native Nspawn)
 
 on:
   push:
-    branches: [ "main", "master", "v1.1.0", "1.1.x-CI", "agentic-review" ]
+    branches: [ "main", "master", "v1.1.0", "v1.1.1", "1.1.x-CI", "agentic-review" ]
   pull_request:
-    branches: [ "main", "master", "v1.1.0" ]
+    branches: [ "main", "master", "v1.1.0", "v1.1.1" ]
 
 jobs:
   unit-and-posix:
@@ -28,6 +28,12 @@ jobs:
         export GITHUB_ACTIONS=true
         make test-all
 
+    - name: "v1.1.1 Regression Suite"
+      run: |
+        echo "=== v1.1.1 Structural Regression Tests ==="
+        chmod +x tests/test_v111_regressions.sh
+        bash tests/test_v111_regressions.sh
+
     - name: "Path B: POSIX/dash compatibility"
       run: |
         echo "=== Step 1: dash -n syntax check on lib/*.sh ==="

lib/rxnm-interfaces.sh

@@ -154,20 +154,25 @@ _task_set_link() {
     reload_networkd
     reconfigure_iface "$iface"
 
-    # Flush addresses for disabled protocols using agent to bypass busybox limitations
+    # Flush addresses and routes for disabled protocols using agent's native
+    # netlink to completely bypass busybox ip deficiencies.
     if [ "$ipv6" = "off" ]; then
         if [ -x "$RXNM_AGENT_BIN" ]; then
             "$RXNM_AGENT_BIN" --flush-addrs "$iface:6" >/dev/null 2>&1 || true
+            "$RXNM_AGENT_BIN" --flush-routes "$iface:6" >/dev/null 2>&1 || true
         else
             ip -6 addr flush dev "$iface" scope global 2>/dev/null || true
             ip -6 addr flush dev "$iface" scope link 2>/dev/null || true
+            ip -6 route flush dev "$iface" 2>/dev/null || true
         fi
     fi
     if [ "$ipv4" = "off" ]; then
         if [ -x "$RXNM_AGENT_BIN" ]; then
             "$RXNM_AGENT_BIN" --flush-addrs "$iface:4" >/dev/null 2>&1 || true
+            "$RXNM_AGENT_BIN" --flush-routes "$iface:4" >/dev/null 2>&1 || true
         else
             ip -4 addr flush dev "$iface" 2>/dev/null || true
+            ip -4 route flush dev "$iface" 2>/dev/null || true
         fi
     fi
 }

lib/rxnm-routes.sh

@@ -184,31 +184,43 @@ action_route_get() {
 }
 
 action_route_flush() {
-    local target="$1" # e.g., table ID, or cache
+    local target="$1" # e.g., table ID, cache, or interface name
     shift
-    local table=""
-    
-    # Parse args to be safe
+    local table="" iface=""
+
+    # Parse args
     if [ "$target" = "cache" ]; then
-        ip route flush cache
+        ip route flush cache 2>/dev/null || true
         json_success '{"action": "route_flush", "target": "cache"}'
         return 0
     fi
-    
+
     while [ "$#" -gt 0 ]; do
         case "$1" in
             --table) table="$2"; shift 2 ;;
+            --iface) iface="$2"; shift 2 ;;
             *) shift ;;
         esac
     done
-    
+
+    # Interface-scoped flush: prefer agent netlink, fallback to ip
+    if [ -n "$iface" ]; then
+        if [ -x "$RXNM_AGENT_BIN" ]; then
+            "$RXNM_AGENT_BIN" --flush-routes "$iface" >/dev/null 2>&1
+        else
+            ip route flush dev "$iface" 2>/dev/null || true
+        fi
+        json_success '{"action": "route_flush", "iface": "'"$iface"'"}'
+        return 0
+    fi
+
     if [ -n "$table" ]; then
-        if ip route flush table "$table"; then
+        if ip route flush table "$table" 2>/dev/null; then
             json_success '{"action": "route_flush", "table": "'"$table"'"}'
         else
             json_error "Failed to flush table $table"
         fi
     else
-        json_error "Specify target to flush (e.g. 'rxnm route flush cache' or 'rxnm route flush --table 100')"
+        json_error "Specify target to flush (e.g. 'rxnm route flush cache' or 'rxnm route flush --iface wlan0')"
     fi
 }

lib/rxnm-system.sh

@@ -272,6 +272,14 @@ action_system_ipv6() {
             iname=$(basename "$iface")
             [ "$iname" = "lo" ] && continue
             sysctl -w "net.ipv6.conf.${iname}.disable_ipv6=1" >/dev/null 2>&1 || true
+            # Flush IPv6 addresses and routes for clean teardown
+            if [ -x "$RXNM_AGENT_BIN" ]; then
+                "$RXNM_AGENT_BIN" --flush-addrs "$iname:6" >/dev/null 2>&1 || true
+                "$RXNM_AGENT_BIN" --flush-routes "$iname:6" >/dev/null 2>&1 || true
+            else
+                ip -6 addr flush dev "$iname" scope global 2>/dev/null || true
+                ip -6 route flush dev "$iname" 2>/dev/null || true
+            fi
         done
 
         printf "net.ipv6.conf.all.disable_ipv6=1\nnet.ipv6.conf.default.disable_ipv6=1\n" > "$conf_file" 2>/dev/null || true

src/rxnm-agent.c

@@ -1484,6 +1484,123 @@ void cmd_check_internet() {
     printf("{\n  \"%s\": true,\n  \"connected\": %s,\n  \"ipv4\": %s,\n  \"ipv6\": %s\n}\n", KEY_SUCCESS, (v4 || v6) ? "true" : "false", v4 ? "true" : "false", v6 ? "true" : "false");
 }
 
+int cmd_flush_routes(const char *arg) {
+    char arg_copy[256];
+    strncpy(arg_copy, arg, sizeof(arg_copy) - 1);
+    arg_copy[sizeof(arg_copy)-1] = '\0';
+
+    char *iface = strtok(arg_copy, ":");
+    char *fam_str = strtok(NULL, ":");
+    int target_family = AF_UNSPEC;
+    if (fam_str) {
+        if (strcmp(fam_str, "4") == 0) target_family = AF_INET;
+        else if (strcmp(fam_str, "6") == 0) target_family = AF_INET6;
+    }
+
+    if (!iface) return 1;
+    int ifindex = if_nametoindex(iface);
+    if (ifindex == 0) {
+        fprintf(stderr, "Interface %s not found\n", iface);
+        return 1;
+    }
+
+    int sock = open_netlink_rt();
+    if (sock < 0) return 1;
+
+    struct { struct nlmsghdr nlh; struct rtgenmsg rtg; } req;
+    memset(&req, 0, sizeof(req));
+    req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtgenmsg));
+    req.nlh.nlmsg_type = RTM_GETROUTE;
+    req.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
+    req.nlh.nlmsg_seq = time(NULL);
+    req.rtg.rtgen_family = (target_family == AF_UNSPEC) ? AF_UNSPEC : target_family;
+    send(sock, &req, req.nlh.nlmsg_len, 0);
+
+    #define MAX_FLUSH_ROUTES 128
+    struct rtmsg to_delete[MAX_FLUSH_ROUTES];
+    struct rtattr *rta_dst[MAX_FLUSH_ROUTES];
+    struct rtattr *rta_gw[MAX_FLUSH_ROUTES];
+    struct rtattr *rta_oif[MAX_FLUSH_ROUTES];
+    struct rtattr *rta_priority[MAX_FLUSH_ROUTES];
+    int del_count = 0;
+
+    char buf[BUF_SIZE];
+    int len;
+    while ((len = recv(sock, buf, sizeof(buf), 0)) > 0) {
+        struct nlmsghdr *nh = (struct nlmsghdr *)buf;
+        for (; NLMSG_OK(nh, len); nh = NLMSG_NEXT(nh, len)) {
+            if (nh->nlmsg_type == NLMSG_DONE || nh->nlmsg_type == NLMSG_ERROR) goto rt_dump_done;
+            if (nh->nlmsg_type == RTM_NEWROUTE) {
+                struct rtmsg *rt = NLMSG_DATA(nh);
+                struct rtattr *tb[RTA_MAX + 1];
+                parse_rtattr(tb, RTA_MAX, RTM_RTA(rt), nh->nlmsg_len - NLMSG_LENGTH(sizeof(*rt)));
+
+                if (tb[RTA_OIF] && *(int *)RTA_DATA(tb[RTA_OIF]) == ifindex) {
+                    if (target_family == AF_UNSPEC || rt->rtm_family == target_family) {
+                        if (del_count < MAX_FLUSH_ROUTES) {
+                            to_delete[del_count] = *rt;
+                            rta_dst[del_count] = NULL;
+                            rta_gw[del_count] = NULL;
+                            rta_oif[del_count] = NULL;
+                            rta_priority[del_count] = NULL;
+
+                            if (tb[RTA_DST]) {
+                                int rta_len = tb[RTA_DST]->rta_len;
+                                rta_dst[del_count] = malloc(rta_len);
+                                if (rta_dst[del_count]) memcpy(rta_dst[del_count], tb[RTA_DST], rta_len);
+                            }
+                            if (tb[RTA_GATEWAY]) {
+                                int rta_len = tb[RTA_GATEWAY]->rta_len;
+                                rta_gw[del_count] = malloc(rta_len);
+                                if (rta_gw[del_count]) memcpy(rta_gw[del_count], tb[RTA_GATEWAY], rta_len);
+                            }
+                            if (tb[RTA_OIF]) {
+                                int rta_len = tb[RTA_OIF]->rta_len;
+                                rta_oif[del_count] = malloc(rta_len);
+                                if (rta_oif[del_count]) memcpy(rta_oif[del_count], tb[RTA_OIF], rta_len);
+                            }
+                            if (tb[RTA_PRIORITY]) {
+                                int rta_len = tb[RTA_PRIORITY]->rta_len;
+                                rta_priority[del_count] = malloc(rta_len);
+                                if (rta_priority[del_count]) memcpy(rta_priority[del_count], tb[RTA_PRIORITY], rta_len);
+                            }
+                            del_count++;
+                        }
+                    }
+                }
+            }
+        }
+    }
+rt_dump_done:
+
+    for (int i = 0; i < del_count; i++) {
+        struct {
+            struct nlmsghdr n;
+            struct rtmsg rtm;
+            char attrbuf[512];
+        } del_req;
+        memset(&del_req, 0, sizeof(del_req));
+        del_req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
+        del_req.n.nlmsg_type = RTM_DELROUTE;
+        del_req.n.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
+        del_req.n.nlmsg_seq = time(NULL) + i;
+        del_req.rtm = to_delete[i];
+
+        if (rta_dst[i]) { add_nl_attr(&del_req.n, sizeof(del_req), RTA_DST, RTA_DATA(rta_dst[i]), RTA_PAYLOAD(rta_dst[i])); free(rta_dst[i]); }
+        if (rta_gw[i]) { add_nl_attr(&del_req.n, sizeof(del_req), RTA_GATEWAY, RTA_DATA(rta_gw[i]), RTA_PAYLOAD(rta_gw[i])); free(rta_gw[i]); }
+        if (rta_oif[i]) { add_nl_attr(&del_req.n, sizeof(del_req), RTA_OIF, RTA_DATA(rta_oif[i]), RTA_PAYLOAD(rta_oif[i])); free(rta_oif[i]); }
+        if (rta_priority[i]) { add_nl_attr(&del_req.n, sizeof(del_req), RTA_PRIORITY, RTA_DATA(rta_priority[i]), RTA_PAYLOAD(rta_priority[i])); free(rta_priority[i]); }
+
+        send(sock, &del_req, del_req.n.nlmsg_len, 0);
+        char ackbuf[1024];
+        recv(sock, ackbuf, sizeof(ackbuf), 0);
+    }
+    close(sock);
+
+    printf("{\"success\": true, \"action\": \"flush_routes\", \"iface\": \"%s\", \"count\": %d}\n", iface, del_count);
+    return 0;
+}
+
 /* --- JSON Formatting --- */
 
 void get_proxy_config(char* http, char* https, char* no_proxy) {
@@ -2513,6 +2630,7 @@ char *g_ns_delete = NULL;
 char *g_ns_exec_name = NULL;
 char *g_route_table = NULL;
 char *g_flush_addrs = NULL;
+char *g_flush_routes = NULL;
 
 int main(int argc, char *argv[]) {
     atexit(cleanup_ifaces);
@@ -2541,6 +2659,7 @@ int main(int argc, char *argv[]) {
         {"nullify-xdp", required_argument, 0, 'X'},
         {"encode-ssid", required_argument, 0, 'E'},
         {"flush-addrs", required_argument, 0, 'F'},
+        {"flush-routes", required_argument, 0, 'R'},
         {"ns-create", required_argument, 0, 1001},
         {"ns-delete", required_argument, 0, 1002},
         {"ns-list", no_argument, 0, 1003},
@@ -2551,10 +2670,10 @@ int main(int argc, char *argv[]) {
     };
 
     int opt, option_index = 0;
-    while ((opt = getopt_long(argc, argv, "vhHtdLcrC:i:g:W:P:T:A:l:M:S:N:X:E:F:", long_options, &option_index)) != -1) {
+    while ((opt = getopt_long(argc, argv, "vhHtdLcrC:i:g:W:P:T:A:l:M:S:N:X:E:F:R:", long_options, &option_index)) != -1) {
         switch (opt) {
             case 'v': cmd_version(); return 0;
-            case 'h': printf("Usage: rxnm-agent [options]\n--dump  Full JSON status\n--ns-create <name> Create namespace\n--route-dump <table_id> Dump routing table\n--nullify-xdp <iface>\n--flush-addrs <iface>[:family]\n"); return 0;
+            case 'h': printf("Usage: rxnm-agent [options]\n--dump  Full JSON status\n--ns-create <name> Create namespace\n--route-dump <table_id> Dump routing table\n--nullify-xdp <iface>\n--flush-addrs <iface>[:family]\n--flush-routes <iface>[:family]\n"); return 0;
             case 'H': cmd_health(); return 0;
             case 't': cmd_time(); return 0;
             case 'L': cmd_is_low_power(); return 0;
@@ -2575,6 +2694,7 @@ int main(int argc, char *argv[]) {
             case 'X': g_nullify_xdp_iface = optarg; break;
             case 'E': cmd_encode_ssid(optarg); return 0;
             case 'F': g_flush_addrs = optarg; break;
+            case 'R': g_flush_routes = optarg; break;
             case 1001: g_ns_create = optarg; break;
             case 1002: g_ns_delete = optarg; break;
             case 1003: cmd_ns_list(); return 0;
@@ -2614,6 +2734,7 @@ int main(int argc, char *argv[]) {
     }
 
     if (g_flush_addrs) { return cmd_flush_addrs(g_flush_addrs); }
+    if (g_flush_routes) { return cmd_flush_routes(g_flush_routes); }
     if (g_atomic_path) { return cmd_atomic_write(g_atomic_path, g_perm_str); }
     if (g_append_path && g_append_line) { return cmd_append_config(g_append_path, g_append_line); }
     if (g_monitor_iface) { cmd_monitor_roam(g_monitor_iface, g_monitor_thresh); return 0; }