Serve DHCP on LANs plugged in after boot; accept browser logins

Kea skips interfaces without carrier when it opens its sockets and only
looks again on a reload, so a LAN cable plugged in after Kea started got
no DHCP until a restart. networkd-dispatcher now restarts Kea when a DHCP
LAN gets carrier (a restart: a SIGHUP while Kea is starting ends it). The
rule script is the same for every configuration and reads the interfaces
from /etc/router/dhcp-interfaces, so the device never has to rebuild it
(writeShellApplication's shellcheck could not be built offline).

The web UI refused every login from a browser with "forbidden": under
Referrer-Policy no-referrer browsers send "Origin: null" with form posts.
Use http.CrossOriginProtection (Sec-Fetch-Site, then Origin) and a
same-origin referrer policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/main.go

@@ -189,7 +189,8 @@ func securityHeaders(next http.Handler) http.Handler {
 		h := w.Header()
 		h.Set("Content-Security-Policy", "default-src 'none'; style-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
 		h.Set("X-Content-Type-Options", "nosniff")
-		h.Set("Referrer-Policy", "no-referrer")
+		// Not no-referrer: under it browsers send "Origin: null" with form posts.
+		h.Set("Referrer-Policy", "same-origin")
 		h.Set("Cache-Control", "no-store")
 		next.ServeHTTP(w, r)
 	})
@@ -237,13 +238,12 @@ func (a *app) auth(h func(http.ResponseWriter, *http.Request, session)) http.Han
 	}
 }
 
+// Sec-Fetch-Site first (browsers may send "Origin: null" for same-origin
+// form posts), then Origin; requests with neither (curl) pass.
+var crossOrigin = http.NewCrossOriginProtection()
+
 func sameOrigin(r *http.Request) bool {
-	origin := r.Header.Get("Origin")
-	if origin == "" {
-		return true
-	}
-	u, err := url.Parse(origin)
-	return err == nil && u.Host == r.Host
+	return crossOrigin.Check(r) == nil
 }
 
 func (a *app) loginPage(w http.ResponseWriter, r *http.Request) {

pkgs/router-webui/main_test.go

@@ -48,7 +48,26 @@ func TestLoginAndSave(t *testing.T) {
 	if rec := do(h, "POST", "/login", url.Values{"password": {"nope"}}, nil); rec.Code != http.StatusUnauthorized {
 		t.Fatalf("wrong password: %d", rec.Code)
 	}
-	rec := do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
+	// What Firefox and Chrome send for a same-origin form post (seen as 403).
+	req := httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Origin", "null")
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
+		t.Fatalf("browser login: %d", rec.Code)
+	}
+	req = httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Sec-Fetch-Site", "cross-site")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("cross-site login: %d", rec.Code)
+	}
+
+	rec = do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
 	if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
 		t.Fatalf("login failed: %d", rec.Code)
 	}
@@ -80,7 +99,7 @@ func TestLoginAndSave(t *testing.T) {
 		t.Fatal("the form dropped the reservation")
 	}
 
-	req := httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
+	req = httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	req.Header.Set("Origin", "https://evil.example")
 	req.AddCookie(cookie)