TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow BlackBox catalog DNS endpoints

Browse Source
This commit is contained in:
kadinho
2026-10-07 22:20:42 +01:00
parent d1e39243a6
commit 74a412ded8
5 changed files with 50 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -5
View File
@@ -35,14 +35,16 @@ The maintained LAN deployment runs on `net-utils01` from
Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
The DNS gateway resolves `manuals.playstation.net` locally and forwards only The DNS gateway resolves `manuals.playstation.net` locally and forwards only
`homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`,
`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its `api.github.com`, `github.com`, `raw.githubusercontent.com`,
configured upstream resolver. These names cover the homebrew store, the official `release-assets.githubusercontent.com`, `prosperopatches.com`,
PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and `cdn.prosperopatches.com`, `image.api.playstation.com`, and
update endpoints; every other name receives NXDOMAIN. `gmedia.playstation.com` to its configured upstream resolver. These names cover the
homebrew store, PS5 Payload Manager, Spectrum Library, and BlackBox's catalog,
updates, and artwork; every other name receives NXDOMAIN.
The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
`192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to `192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to
the six allowlisted domains; no WAN ingress rule is required. The server needs DNS the allowlisted domains; no WAN ingress rule is required. The server needs DNS
egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default). egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).
The Payload Manager supports arbitrary custom repository URLs. Those hosts are not The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
@@ -56,6 +58,13 @@ manifest, and package URLs; these unknown hosts remain blocked until observed an
reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS
availability alone does not guarantee that its catalog will load. availability alone does not guarantee that its catalog will load.
BlackBox v1.0.5 uses `raw.githubusercontent.com` for its catalog and update JSON,
the existing GitHub hosts for its own release files, and the Prosperopatches and
PlayStation media hosts for artwork. Its catalog also advertises third-party game
files from Archive.org and Vikingfile. Those download providers are deliberately
not allowlisted: browsing, artwork, and application updates work without granting
the console access to unreviewed game files that frequently lack SHA-256 hashes.
To deploy a reviewed commit: To deploy a reviewed commit:
```sh ```sh
compose.yaml
+1 -1
View File
@@ -20,7 +20,7 @@ services:
environment: environment:
GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}" GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}"
REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com}" FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com}"
UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
ports: ports:
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
docker/guide_gateway.py
+1 -1
View File
@@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset(
name.strip().lower() name.strip().lower()
for name in os.environ.get( for name in os.environ.get(
"FORWARDED_DOMAINS", "FORWARDED_DOMAINS",
"homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com", "homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com",
).split(",") ).split(",")
if name.strip() if name.strip()
) )
docs/HANDOFF.md
+21 -7
View File
@@ -72,8 +72,10 @@ The same Compose project also runs `ps5-guide-gateway`, bound specifically to
`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
`manuals.playstation.net` locally and forwards only `homebrew.page`, `manuals.playstation.net` locally and forwards only `homebrew.page`,
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
and `release-assets.githubusercontent.com` to the configured upstream resolver `raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to `prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
`gmedia.playstation.com` to the configured upstream resolver (`1.1.1.1` by
default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
`http://192.168.20.30:8000/`. `http://192.168.20.30:8000/`.
Port `8080` on the host is already used by `unifi-network-application`; do not move Port `8080` on the host is already used by `unifi-network-application`; do not move
@@ -180,12 +182,14 @@ accept the self-signed certificate warning in the User Guide.
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`, The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
and `release-assets.githubusercontent.com`. Only those names and `raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
`gmedia.playstation.com`. Only those names and
`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits `manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager, Spectrum
Library while continuing to block PSN and update resolution. The PS5 sends DNS only Library and BlackBox while continuing to block PSN and update resolution. The PS5
to `net-utils01`; that host must be allowed to reach the configured upstream sends DNS only to `net-utils01`; that host must be allowed to reach the configured
resolver on UDP/TCP 53. upstream resolver on UDP/TCP 53.
The Payload Manager review used upstream commit The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -203,6 +207,16 @@ identified `store.spectrumlibrary.online` for API/catalog access and
and cover hosts, which are not allowlisted without review. The Spectrum API returned and cover hosts, which are not allowlisted without review. The Spectrum API returned
HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis. `Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
The BlackBox review used repository commit
`80fa07c9cb5319b3ca4b906b9381e1cca2a91295` and the published v1.0.5 ELF. Its
SHA-256, `152dda87ec64899270db61c61676b62e5d29a46a67523299b2719a81d4486235`,
matched the release sidecar. Static analysis identified `raw.githubusercontent.com`
for catalog/update manifests, the existing GitHub hosts for application releases,
and Prosperopatches plus PlayStation media hosts for artwork. Archive.org,
Vikingfile and their download infrastructure are intentionally excluded: they serve
third-party game files, many catalog entries have no SHA-256, and those hosts are
not required for catalog browsing or BlackBox updates.
The PS5 was previously identified as `192.168.10.26`; requests from The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from a different client. Those addresses `192.168.10.6` seen at that time were from a different client. Those addresses
are historical and must not be used as the current payload destination. are historical and must not be used as the current payload destination.
docs/PS5_SETUP.md
+13 -3
View File
@@ -139,8 +139,11 @@ O Compose inclui um DNS controlado no `net-utils01` que:
- responda `manuals.playstation.net` com `192.168.20.30`; - responda `manuals.playstation.net` com `192.168.20.30`;
- encaminhe apenas `homebrew.page`, `itsplk.github.io`, - encaminhe apenas `homebrew.page`, `itsplk.github.io`,
`store.spectrumlibrary.online`, `api.github.com`, `github.com` e `store.spectrumlibrary.online`, `api.github.com`, `github.com` e
`release-assets.githubusercontent.com` para o resolvedor configurado, permitindo `raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library; `prosperopatches.com`, `cdn.prosperopatches.com`,
`image.api.playstation.com` e `gmedia.playstation.com` para o resolvedor
configurado, permitindo os destinos revistos do homebrew store, PS5 Payload
Manager, Spectrum Library e BlackBox;
- devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
telemetria bloqueados por DNS; telemetria bloqueados por DNS;
- registe as consultas nos logs do container; - registe as consultas nos logs do container;
@@ -170,7 +173,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
`192.168.20.30`; não deve consultar diretamente um DNS público. `192.168.20.30`; não deve consultar diretamente um DNS público.
O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios O acesso WAN da consola pode ficar limitado a TCP `443` para os domínios
permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
bloqueado até esse destino ser revisto e acrescentado explicitamente. bloqueado até esse destino ser revisto e acrescentado explicitamente.
@@ -190,6 +193,13 @@ pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de
2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS 2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS
local não consegue corrigir. local não consegue corrigir.
O BlackBox v1.0.5 obtém o catálogo e manifests de atualização em
`raw.githubusercontent.com`, descarrega as suas próprias releases através dos hosts
GitHub já permitidos e usa Prosperopatches e os dois hosts de media PlayStation para
capas. Embora o catálogo contenha links para Archive.org e Vikingfile, esses hosts
não são permitidos: não são necessários para navegar no catálogo ou atualizar o
BlackBox e dão acesso a ficheiros de jogos terceiros, frequentemente sem SHA-256.
## Abrir pelo Guia do Utilizador ## Abrir pelo Guia do Utilizador
Com um DNS que redirecione o manual: Com um DNS que redirecione o manual: