TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make the guide gateway IPv4-only to stop IPv6 stalls

Browse Source 
Serve only A/ANY queries; answer AAAA and all other record types with NOERROR and
no data, for overrides and forwarded names alike. The console LAN has no IPv6
route, so returning a real AAAA made clients stall on an unreachable address.

This fixes the PS5 Payload Manager looping on "synchronizing repositories": its
dual-stack catalog host itsplk.github.io handed back an IPv6 address and the
manager's libcurl download (no timeout) hung on it indefinitely.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 15:02:22 +01:00
co-authored by Claude Opus 4.8
parent 58d9b0adaf
commit 4c22f8addf
2 changed files with 34 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+11
View File
@@ -207,6 +207,17 @@ overrides (spoof) → NXDOMAIN. Unlike upstream nanoDNS, a name matching no rule
blocked by default. The PS5 sends DNS only to `net-utils01`; that host must be
allowed to reach the configured upstream resolver on UDP/TCP 53.
The gateway is **IPv4-only**: it serves only `A` (and `ANY`) queries. `AAAA` and
any other record type return NOERROR with no data, for both overrides and
forwarded names. The console LAN has no IPv6 route, so returning a real `AAAA`
would make clients stall on an unreachable IPv6 address. This specifically fixed
the PS5 Payload Manager looping forever on "synchronizing repositories": its
catalog host `itsplk.github.io` is dual-stack, the console tried the IPv6 address,
and the manager's libcurl download has no timeout, so the hung connection never
returned. The official Payload Manager repository needs only `itsplk.github.io`
(catalog), `github.com` (payload `url`s) and `release-assets.githubusercontent.com`
(release-download redirect target), all already in `[exceptions]`.
The gateway additionally restricts which source clients it answers, via
`[general] allowed_clients`. It defaults to the console VLAN `192.168.40.0/28`,
the server VLAN `192.168.20.0/24`, and the trusted management VLAN