From 74a412ded8cc281b254a50090e6c5053f21675b3 Mon Sep 17 00:00:00 2001 From: kadinho Date: Wed, 7 Oct 2026 22:20:42 +0100 Subject: [PATCH] Allow BlackBox catalog DNS endpoints --- README.md | 19 ++++++++++++++----- compose.yaml | 2 +- docker/guide_gateway.py | 2 +- docs/HANDOFF.md | 28 +++++++++++++++++++++------- docs/PS5_SETUP.md | 16 +++++++++++++--- 5 files changed, 50 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 7f79edd..7224ba2 100644 --- a/README.md +++ b/README.md @@ -35,14 +35,16 @@ The maintained LAN deployment runs on `net-utils01` from Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. The DNS gateway resolves `manuals.playstation.net` locally and forwards only `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, -`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its -configured upstream resolver. These names cover the homebrew store, the official -PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and -update endpoints; every other name receives NXDOMAIN. +`api.github.com`, `github.com`, `raw.githubusercontent.com`, +`release-assets.githubusercontent.com`, `prosperopatches.com`, +`cdn.prosperopatches.com`, `image.api.playstation.com`, and +`gmedia.playstation.com` to its configured upstream resolver. These names cover the +homebrew store, PS5 Payload Manager, Spectrum Library, and BlackBox's catalog, +updates, and artwork; every other name receives NXDOMAIN. The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on `192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to -the six allowlisted domains; no WAN ingress rule is required. The server needs DNS +the allowlisted domains; no WAN ingress rule is required. The server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default). The Payload Manager supports arbitrary custom repository URLs. Those hosts are not @@ -56,6 +58,13 @@ manifest, and package URLs; these unknown hosts remain blocked until observed an reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS availability alone does not guarantee that its catalog will load. +BlackBox v1.0.5 uses `raw.githubusercontent.com` for its catalog and update JSON, +the existing GitHub hosts for its own release files, and the Prosperopatches and +PlayStation media hosts for artwork. Its catalog also advertises third-party game +files from Archive.org and Vikingfile. Those download providers are deliberately +not allowlisted: browsing, artwork, and application updates work without granting +the console access to unreviewed game files that frequently lack SHA-256 hashes. + To deploy a reviewed commit: ```sh diff --git a/compose.yaml b/compose.yaml index 98dea1f..bdab249 100644 --- a/compose.yaml +++ b/compose.yaml @@ -20,7 +20,7 @@ services: environment: GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}" REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" - FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com}" + FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" ports: - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" diff --git a/docker/guide_gateway.py b/docker/guide_gateway.py index 59c1525..29e56bd 100644 --- a/docker/guide_gateway.py +++ b/docker/guide_gateway.py @@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset( name.strip().lower() for name in os.environ.get( "FORWARDED_DOMAINS", - "homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com", + "homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com", ).split(",") if name.strip() ) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index e1e51b4..bb9ac72 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -72,8 +72,10 @@ The same Compose project also runs `ps5-guide-gateway`, bound specifically to `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves `manuals.playstation.net` locally and forwards only `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` -and `release-assets.githubusercontent.com` to the configured upstream resolver -(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to +`raw.githubusercontent.com`, `release-assets.githubusercontent.com`, +`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and +`gmedia.playstation.com` to the configured upstream resolver (`1.1.1.1` by +default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to `http://192.168.20.30:8000/`. Port `8080` on the host is already used by `unifi-network-application`; do not move @@ -180,12 +182,14 @@ accept the self-signed certificate warning in the User Guide. The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` -and `release-assets.githubusercontent.com`. Only those names and +`raw.githubusercontent.com`, `release-assets.githubusercontent.com`, +`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and +`gmedia.playstation.com`. Only those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits -the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum -Library while continuing to block PSN and update resolution. The PS5 sends DNS only -to `net-utils01`; that host must be allowed to reach the configured upstream -resolver on UDP/TCP 53. +the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager, Spectrum +Library and BlackBox while continuing to block PSN and update resolution. The PS5 +sends DNS only to `net-utils01`; that host must be allowed to reach the configured +upstream resolver on UDP/TCP 53. The Payload Manager review used upstream commit `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on @@ -203,6 +207,16 @@ identified `store.spectrumlibrary.online` for API/catalog access and and cover hosts, which are not allowlisted without review. The Spectrum API returned HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte `Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis. + +The BlackBox review used repository commit +`80fa07c9cb5319b3ca4b906b9381e1cca2a91295` and the published v1.0.5 ELF. Its +SHA-256, `152dda87ec64899270db61c61676b62e5d29a46a67523299b2719a81d4486235`, +matched the release sidecar. Static analysis identified `raw.githubusercontent.com` +for catalog/update manifests, the existing GitHub hosts for application releases, +and Prosperopatches plus PlayStation media hosts for artwork. Archive.org, +Vikingfile and their download infrastructure are intentionally excluded: they serve +third-party game files, many catalog entries have no SHA-256, and those hosts are +not required for catalog browsing or BlackBox updates. The PS5 was previously identified as `192.168.10.26`; requests from `192.168.10.6` seen at that time were from a different client. Those addresses are historical and must not be used as the current payload destination. diff --git a/docs/PS5_SETUP.md b/docs/PS5_SETUP.md index 2af0cba..94057d6 100644 --- a/docs/PS5_SETUP.md +++ b/docs/PS5_SETUP.md @@ -139,8 +139,11 @@ O Compose inclui um DNS controlado no `net-utils01` que: - responda `manuals.playstation.net` com `192.168.20.30`; - encaminhe apenas `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` e - `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo - os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library; + `raw.githubusercontent.com`, `release-assets.githubusercontent.com`, + `prosperopatches.com`, `cdn.prosperopatches.com`, + `image.api.playstation.com` e `gmedia.playstation.com` para o resolvedor + configurado, permitindo os destinos revistos do homebrew store, PS5 Payload + Manager, Spectrum Library e BlackBox; - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e telemetria bloqueados por DNS; - registe as consultas nos logs do container; @@ -170,7 +173,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para `192.168.20.30`; não deve consultar diretamente um DNS público. -O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios +O acesso WAN da consola pode ficar limitado a TCP `443` para os domínios permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será bloqueado até esse destino ser revisto e acrescentado explicitamente. @@ -190,6 +193,13 @@ pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de 2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS local não consegue corrigir. +O BlackBox v1.0.5 obtém o catálogo e manifests de atualização em +`raw.githubusercontent.com`, descarrega as suas próprias releases através dos hosts +GitHub já permitidos e usa Prosperopatches e os dois hosts de media PlayStation para +capas. Embora o catálogo contenha links para Archive.org e Vikingfile, esses hosts +não são permitidos: não são necessários para navegar no catálogo ou atualizar o +BlackBox e dão acesso a ficheiros de jogos terceiros, frequentemente sem SHA-256. + ## Abrir pelo Guia do Utilizador Com um DNS que redirecione o manual: