TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adopt nanoDNS-style INI config for the guide gateway

Browse Source 
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on
https://github.com/drakmor/nanoDNS#config: [general] (redirect_url,
allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides]
(mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use
shell-style wildcards and match case-insensitively; resolution order is
exceptions -> overrides -> NXDOMAIN.

The unmatched-name behaviour is deliberately inverted from upstream nanoDNS:
names matching no rule return NXDOMAIN (default-deny) instead of being forwarded,
so PSN, updates and telemetry stay blocked. The source-client allowlist now lives
in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can
point at a mounted file for per-host overrides.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 13:38:29 +01:00
co-authored by Claude Opus 4.8
parent 9f28b8e2a1
commit 50dd2d8266
7 changed files with 237 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+35 -19
View File
@@ -182,26 +182,42 @@ the local container. The local gateway was therefore added. Configure the PS5 wi
primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the console and
accept the self-signed certificate warning in the User Guide.
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
`gmedia.playstation.com`. Only those names and
`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager, Spectrum
Library and BlackBox while continuing to block PSN and update resolution. The PS5
sends DNS only to `net-utils01`; that host must be allowed to reach the configured
upstream resolver on UDP/TCP 53.
The gateway's DNS policy follows the nanoDNS config model
(<https://github.com/drakmor/nanoDNS#config>), with the unmatched-name behaviour
deliberately inverted to default-deny. The policy lives in `docker/nanodns.ini`,
baked into the image, with these sections:
The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`,
and the trusted management VLAN `192.168.10.0/27`; queries from any other source
address are dropped and logged as `denied`, on both UDP and TCP. The server and
trusted VLANs are included so operators can test and administer the resolver; the
consoles themselves only need the `/28`. The value accepts a comma-separated mix of
individual addresses and CIDR ranges, and an empty value disables the filter. This
keeps the service off the rest of the LAN and prevents arbitrary hosts from using it
as an open resolver for the allowlisted names.
- `[general]` — `redirect_url` and `allowed_clients`.
- `[upstream]` — one or more resolver IPs (`server`, comma/space/newline
separated, tried in order) and a `timeout_ms` budget.
- `[overrides]` — `mask = IPv4`; matched names are answered with that A record.
`manuals.playstation.net` maps to `192.168.20.30`.
- `[exceptions]` — one mask per line; matched names are forwarded upstream. These
are the reviewed homebrew-store, PS5 Payload Manager, Spectrum Library and
BlackBox endpoints (`homebrew.page`, `itsplk.github.io`,
`store.spectrumlibrary.online`, `api.github.com`, `github.com`,
`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com`,
`gmedia.playstation.com`).
Masks use shell-style wildcards (`*`, `?`, `[abc]`, `[a-z]`, `[!0-9]`) and match
case-insensitively. Resolution order per query is: exceptions (forward) →
overrides (spoof) → NXDOMAIN. Unlike upstream nanoDNS, a name matching no rule is
**not** forwarded; it returns NXDOMAIN, which keeps PSN, updates and telemetry
blocked by default. The PS5 sends DNS only to `net-utils01`; that host must be
allowed to reach the configured upstream resolver on UDP/TCP 53.
The gateway additionally restricts which source clients it answers, via
`[general] allowed_clients`. It defaults to the console VLAN `192.168.40.0/28`,
the server VLAN `192.168.20.0/24`, and the trusted management VLAN
`192.168.10.0/27`; queries from any other source address are dropped and logged
as `denied`, on both UDP and TCP. The server and trusted VLANs are included so
operators can test and administer the resolver; the consoles themselves only need
the `/28`. The value accepts a comma/space/newline mix of individual addresses and
CIDR ranges, and an empty value disables the filter. This keeps the service off the
rest of the LAN and prevents arbitrary hosts from using it as an open resolver for
the allowlisted names. Editing the policy requires an image rebuild, or pointing
`CONFIG_FILE` at a mounted file.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
docs/PS5_SETUP.md
+26 -13
View File
@@ -154,6 +154,17 @@ O Compose inclui um DNS controlado no `net-utils01` que:
- apresente um gateway HTTPS local e redirecione o browser para o exploit em
`http://192.168.20.30:8000/`.
A política de DNS segue o modelo de configuração do nanoDNS
(<https://github.com/drakmor/nanoDNS#config>), mas com o comportamento para nomes
não correspondidos invertido para **default-deny** (NXDOMAIN em vez de reencaminhar).
Vive no ficheiro `docker/nanodns.ini`, incluído na imagem, com as secções
`[general]` (`redirect_url`, `allowed_clients`), `[upstream]` (`server`,
`timeout_ms`), `[overrides]` (`máscara = IPv4`, faz spoof) e `[exceptions]` (uma
máscara por linha, reencaminha para o upstream). As máscaras aceitam wildcards
shell (`*`, `?`, `[abc]`, `[a-z]`, `[!0-9]`) e a ordem de resolução é
exceptions → overrides → NXDOMAIN. Para alterar a política, editar o INI e
reconstruir a imagem (ou apontar `CONFIG_FILE` para um ficheiro montado).
Nesse cenário, a PS5 usaria:
```text
@@ -171,20 +182,22 @@ definir `GATEWAY_BIND_IP`, `GATEWAY_IP` e `GUIDE_REDIRECT_URL` antes de executar
Compose. Também é possível bloquear o acesso WAN da PS5 no router, mantendo apenas
a comunicação LAN; esta continua a ser uma camada adicional mais forte do que DNS.
O resolvedor upstream predefinido é `1.1.1.1`. Pode ser substituído por um endereço
DNS controlado na rede através de `UPSTREAM_DNS`; o valor deve ser um endereço IP,
não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para esse
resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
`192.168.20.30`; não deve consultar diretamente um DNS público.
O resolvedor upstream predefinido é `1.1.1.1`, definido em `[upstream] server` no
`docker/nanodns.ini`. Podem listar-se vários (separados por vírgulas/espaços/linhas),
tentados por ordem; os valores devem ser endereços IP, não hostnames. A firewall deve
permitir UDP e TCP `53` de `net-utils01` para esse resolvedor. A consola continua a
precisar apenas de UDP/TCP `53` para `192.168.20.30`; não deve consultar diretamente
um DNS público.
O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`.
Por defeito inclui a VLAN das consolas `192.168.40.0/28`, a VLAN de servers
`192.168.20.0/24` e a VLAN de gestão/confiança `192.168.10.0/27` (estas duas últimas
para o operador poder testar e administrar). O valor aceita uma lista separada por
vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo,
`192.168.40.13,192.168.40.14` para trancar apenas às duas PS5 autorizadas (PS5FAT e
PS5PRO). Um valor vazio desativa o filtro e serve todos os clientes. Consultas de
origens não permitidas são descartadas e registadas como `denied`.
O gateway só responde a consultas DNS vindas das redes listadas em
`[general] allowed_clients`. Por defeito inclui a VLAN das consolas
`192.168.40.0/28`, a VLAN de servers `192.168.20.0/24` e a VLAN de gestão/confiança
`192.168.10.0/27` (estas duas últimas para o operador poder testar e administrar). O
valor aceita uma lista separada por vírgulas/espaços de endereços individuais e/ou
intervalos CIDR — por exemplo, `192.168.40.13 192.168.40.14` para trancar apenas às
duas PS5 autorizadas (PS5FAT e PS5PRO). Um valor vazio desativa o filtro e serve todos
os clientes. Consultas de origens não permitidas são descartadas e registadas como
`denied`.
O acesso WAN da consola pode ficar limitado a TCP `443` para os domínios
permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar