🌴 Sync 2026-03-05 23:51:42

luci-app-school/root/etc/config/school

@@ -0,0 +1,6 @@
+config school 'config'
+	option IPID '0'
+    option IUA '0'
+	option INTP '0'
+	option ITTL '0'
+	option IACFlash '0'

luci-app-school/root/etc/init.d/school

@@ -0,0 +1,102 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+STOP=10
+
+restart_utils="true"
+
+start_ipid() {
+    /usr/share/school/ipid.rules
+}
+
+start_ua() {
+    /usr/share/school/iac.rules
+}
+
+start_ntp() {
+    /usr/share/school/intp.rules
+}
+
+start_ttl() {
+    /usr/share/school/ittl.rules
+}
+
+start_ac() {
+    /usr/share/school/iac.rules
+}
+
+stop_ipid() {
+    nft flush table ipid
+}
+
+stop_ua() {
+    nft flush table iua2f
+}
+
+stop_ntp() {
+    nft flush table intp
+}
+
+stop_ttl() {
+    nft flush table ittl
+}
+
+stop_ac() {
+    nft flush table iac
+}
+
+init_conf() {
+    config_load "school"
+    config_get "IPID" "config" "IPID" "0"
+    config_get "IUA" "config" "IUA" "0"
+    config_get "INTP" "config" "INTP" "0"
+    config_get "ITTL" "config" "ITTL" "0"
+    config_get "IACFlash" "config" "IACFlash" "0"
+}
+
+
+start() {
+    init_conf
+
+    if [ "${IPID}" -eq "1" ];  then
+		start_ipid
+	fi
+    if [ "${IUA}" -eq "1" ];  then
+		start_ua
+	fi
+    if [ "${INTP}" -eq "1" ];  then
+		start_ntp
+	fi
+    if [ "${ITTL}" -eq "1" ];  then
+		start_ttl
+	fi
+    if [ "${IACFlash}" -eq "1" ];  then
+		start_ac
+	fi
+
+}
+
+stop() {
+    init_conf
+
+    if [ "${IPID}" -eq "0" ];  then
+		stop_ipid
+	fi
+    if [ "${IUA}" -eq "0" ];  then
+		stop_ua
+	fi
+    if [ "${INTP}" -eq "0" ];  then
+		stop_ntp
+	fi
+    if [ "${ITTL}" -eq "0" ];  then
+		stop_ttl
+	fi
+    if [ "${IACFlash}" -eq "0" ];  then
+		stop_ac
+	fi
+}
+
+restart(){
+	stop
+	start
+}

luci-app-school/root/usr/share/rpcd/acl.d/luci-app-school.json

@@ -0,0 +1,11 @@
+{
+	"luci-app-school": {
+		"description": "Grant UCI access for luci-app-school",
+		"read": {
+			"uci": [ "school" ]
+		},
+		"write": {
+			"uci": [ "school" ]
+		}
+	}
+}

luci-app-school/root/usr/share/school/iac.rules

@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table ip iac {
+    chain FORWARD {
+		type filter hook forward priority filter; policy accept;
+		meta l4proto tcp tcp sport 80 tcp flags & (ack) == ack # STRING match  " src=\"http://1.1.1." ALGO name bm TO 65535 counter packets 0 bytes 0 drop
+	}
+}

luci-app-school/root/usr/share/school/idns.rules

@@ -0,0 +1,9 @@
+#!/usr/sbin/nft -f
+
+table ip idns {
+    chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		meta l4proto udp udp dport 53 counter packets 0 bytes 0 redirect to :53
+		meta l4proto tcp tcp dport 53 counter packets 0 bytes 0 redirect to :53
+	}
+}

luci-app-school/root/usr/share/school/intp.rules

@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+
+table ip intp {
+    chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		meta l4proto udp udp dport 123 counter packets 0 bytes 0 jump ntp_force_local
+	}
+
+    chain ntp_force_local {
+		ip daddr 0.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 127.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 192.168.0.0/16 counter packets 0 bytes 0 return
+		ip saddr 192.168.0.0/16 counter packets 0 bytes 0 dnat to 192.168.10.1
+	}
+}

luci-app-school/root/usr/share/school/ipid.rules

@@ -0,0 +1,23 @@
+#!/usr/sbin/nft -f
+
+table ip ipid {
+    chain FORWARD {
+		type filter hook forward priority mangle; policy accept;
+		counter packets 0 bytes 0 jump IPID_MOD
+	}
+
+	chain OUTPUT {
+		type route hook output priority mangle; policy accept;
+		counter packets 0 bytes 0 jump IPID_MOD
+	}
+    
+    chain IPID_MOD {
+		ip daddr 0.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 127.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 10.0.0.0/8 counter packets 0 bytes 0 return
+		ip daddr 172.16.0.0/12 counter packets 0 bytes 0 return
+		ip daddr 192.168.0.0/16 counter packets 0 bytes 0 return
+		ip daddr 255.0.0.0/8 counter packets 0 bytes 0 return
+		counter packets 0 bytes 0 meta mark set mark or 0x10 
+	}
+}

luci-app-school/root/usr/share/school/ittl.rules

@@ -0,0 +1,8 @@
+#!/usr/sbin/nft -f
+
+table ip ittl {
+    chain POSTROUTING {
+		type filter hook postrouting priority mangle; policy accept;
+		counter packets 0 bytes 0 # TTL set to 64
+	}
+}

luci-app-school/root/usr/share/school/iua2f.rules

@@ -0,0 +1,17 @@
+#!/usr/sbin/nft -f
+
+table ip iua2f {
+    chain wan_patch {
+		type filter hook postrouting priority mangle; policy accept;
+		oif "wan" meta nfproto ipv4 counter mark set mark or 0x10 ip ttl set 64 jump ua2f
+		oif "wan6" meta nfproto ipv6 counter ip6 hoplimit set 64 jump ua2f
+	}
+
+	chain ua2f {
+		tcp flags syn tcp option timestamp exists counter queue num 10010-10013 fanout
+		ct mark 43 counter return
+		meta l4proto != tcp counter return
+		tcp dport { ssh, https } counter return
+		counter queue num 10010-10013 fanout
+	}
+}

luci-app-school/root/usr/share/ucitrack/luci-app-school.json

@@ -0,0 +1,4 @@
+{
+	"config": "school",
+	"init": "school"
+}