nils/nixos-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Serve DHCP on LANs plugged in after boot; accept browser logins

Browse Source 
Kea skips interfaces without carrier when it opens its sockets and only
looks again on a reload, so a LAN cable plugged in after Kea started got
no DHCP until a restart. networkd-dispatcher now restarts Kea when a DHCP
LAN gets carrier (a restart: a SIGHUP while Kea is starting ends it). The
rule script is the same for every configuration and reads the interfaces
from /etc/router/dhcp-interfaces, so the device never has to rebuild it
(writeShellApplication's shellcheck could not be built offline).

The web UI refused every login from a browser with "forbidden": under
Referrer-Policy no-referrer browsers send "Origin: null" with form posts.
Use http.CrossOriginProtection (Sec-Fetch-Site, then Origin) and a
same-origin referrer policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F
This commit is contained in:
nils
2026-10-29 09:19:14 +01:00
co-authored by Claude Opus 5.5
parent 753459f5d7
commit 5ddff44a35
4 changed files with 70 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/router-webui/main_test.go
+21 -2
View File
@@ -48,7 +48,26 @@ func TestLoginAndSave(t *testing.T) {
if rec := do(h, "POST", "/login", url.Values{"password": {"nope"}}, nil); rec.Code != http.StatusUnauthorized {
t.Fatalf("wrong password: %d", rec.Code)
}
rec := do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
// What Firefox and Chrome send for a same-origin form post (seen as 403).
req := httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("Origin", "null")
req.Header.Set("Sec-Fetch-Site", "same-origin")
rec := httptest.NewRecorder()
h.ServeHTTP(rec, req)
if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
t.Fatalf("browser login: %d", rec.Code)
}
req = httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("Sec-Fetch-Site", "cross-site")
rec = httptest.NewRecorder()
h.ServeHTTP(rec, req)
if rec.Code != http.StatusForbidden {
t.Fatalf("cross-site login: %d", rec.Code)
}
rec = do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
t.Fatalf("login failed: %d", rec.Code)
}
@@ -80,7 +99,7 @@ func TestLoginAndSave(t *testing.T) {
t.Fatal("the form dropped the reservation")
}
req := httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
req = httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
req.Header.Set("Origin", "https://evil.example")
req.AddCookie(cookie)