TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adopt nanoDNS-style INI config for the guide gateway

Browse Source 
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on
https://github.com/drakmor/nanoDNS#config: [general] (redirect_url,
allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides]
(mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use
shell-style wildcards and match case-insensitively; resolution order is
exceptions -> overrides -> NXDOMAIN.

The unmatched-name behaviour is deliberately inverted from upstream nanoDNS:
names matching no rule return NXDOMAIN (default-deny) instead of being forwarded,
so PSN, updates and telemetry stay blocked. The source-client allowlist now lives
in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can
point at a mounted file for per-host overrides.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 13:38:29 +01:00
co-authored by Claude Opus 4.8
parent 9f28b8e2a1
commit 50dd2d8266
7 changed files with 237 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+35 -19
View File
@@ -182,26 +182,42 @@ the local container. The local gateway was therefore added. Configure the PS5 wi
primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the console and
accept the self-signed certificate warning in the User Guide.
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
`gmedia.playstation.com`. Only those names and
`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager, Spectrum
Library and BlackBox while continuing to block PSN and update resolution. The PS5
sends DNS only to `net-utils01`; that host must be allowed to reach the configured
upstream resolver on UDP/TCP 53.
The gateway's DNS policy follows the nanoDNS config model
(<https://github.com/drakmor/nanoDNS#config>), with the unmatched-name behaviour
deliberately inverted to default-deny. The policy lives in `docker/nanodns.ini`,
baked into the image, with these sections:
The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`,
and the trusted management VLAN `192.168.10.0/27`; queries from any other source
address are dropped and logged as `denied`, on both UDP and TCP. The server and
trusted VLANs are included so operators can test and administer the resolver; the
consoles themselves only need the `/28`. The value accepts a comma-separated mix of
individual addresses and CIDR ranges, and an empty value disables the filter. This
keeps the service off the rest of the LAN and prevents arbitrary hosts from using it
as an open resolver for the allowlisted names.
- `[general]` — `redirect_url` and `allowed_clients`.
- `[upstream]` — one or more resolver IPs (`server`, comma/space/newline
separated, tried in order) and a `timeout_ms` budget.
- `[overrides]` — `mask = IPv4`; matched names are answered with that A record.
`manuals.playstation.net` maps to `192.168.20.30`.
- `[exceptions]` — one mask per line; matched names are forwarded upstream. These
are the reviewed homebrew-store, PS5 Payload Manager, Spectrum Library and
BlackBox endpoints (`homebrew.page`, `itsplk.github.io`,
`store.spectrumlibrary.online`, `api.github.com`, `github.com`,
`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com`,
`gmedia.playstation.com`).
Masks use shell-style wildcards (`*`, `?`, `[abc]`, `[a-z]`, `[!0-9]`) and match
case-insensitively. Resolution order per query is: exceptions (forward) →
overrides (spoof) → NXDOMAIN. Unlike upstream nanoDNS, a name matching no rule is
**not** forwarded; it returns NXDOMAIN, which keeps PSN, updates and telemetry
blocked by default. The PS5 sends DNS only to `net-utils01`; that host must be
allowed to reach the configured upstream resolver on UDP/TCP 53.
The gateway additionally restricts which source clients it answers, via
`[general] allowed_clients`. It defaults to the console VLAN `192.168.40.0/28`,
the server VLAN `192.168.20.0/24`, and the trusted management VLAN
`192.168.10.0/27`; queries from any other source address are dropped and logged
as `denied`, on both UDP and TCP. The server and trusted VLANs are included so
operators can test and administer the resolver; the consoles themselves only need
the `/28`. The value accepts a comma/space/newline mix of individual addresses and
CIDR ranges, and an empty value disables the filter. This keeps the service off the
rest of the LAN and prevents arbitrary hosts from using it as an open resolver for
the allowlisted names. Editing the policy requires an image rebuild, or pointing
`CONFIG_FILE` at a mounted file.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on