Allow Spectrum Library DNS endpoints
This commit is contained in:
@@ -34,21 +34,28 @@ The maintained LAN deployment runs on `net-utils01` from
|
||||
|
||||
Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
|
||||
The DNS gateway resolves `manuals.playstation.net` locally and forwards only
|
||||
`homebrew.page`, `itsplk.github.io`, `github.com`, and
|
||||
`release-assets.githubusercontent.com` to its configured upstream resolver. These
|
||||
names cover the homebrew store and the official PS5 Payload Manager catalog and
|
||||
downloads; every other name receives NXDOMAIN.
|
||||
`homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`,
|
||||
`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its
|
||||
configured upstream resolver. These names cover the homebrew store, the official
|
||||
PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and
|
||||
update endpoints; every other name receives NXDOMAIN.
|
||||
|
||||
The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
|
||||
`192.168.20.30`. For the homebrew store and Payload Manager it also needs WAN egress
|
||||
on TCP 443 to the four allowlisted domains; no WAN ingress rule is required. The
|
||||
server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by
|
||||
default).
|
||||
`192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to
|
||||
the six allowlisted domains; no WAN ingress rule is required. The server needs DNS
|
||||
egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).
|
||||
|
||||
The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
|
||||
allowed automatically: review the repository JSON, payload URLs, checksums, and
|
||||
redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`.
|
||||
|
||||
Spectrum Library is distributed without source code in its repository. Static
|
||||
review of its 1.4.8 ELF identified `store.spectrumlibrary.online` for its API and
|
||||
`api.github.com` for update checks. Catalog responses can supply additional cover,
|
||||
manifest, and package URLs; these unknown hosts remain blocked until observed and
|
||||
reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS
|
||||
availability alone does not guarantee that its catalog will load.
|
||||
|
||||
To deploy a reviewed commit:
|
||||
|
||||
```sh
|
||||
|
||||
+1
-1
@@ -20,7 +20,7 @@ services:
|
||||
environment:
|
||||
GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}"
|
||||
REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
|
||||
FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com}"
|
||||
FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com}"
|
||||
UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
|
||||
ports:
|
||||
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
|
||||
|
||||
@@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset(
|
||||
name.strip().lower()
|
||||
for name in os.environ.get(
|
||||
"FORWARDED_DOMAINS",
|
||||
"homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com",
|
||||
"homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com",
|
||||
).split(",")
|
||||
if name.strip()
|
||||
)
|
||||
|
||||
+20
-9
@@ -71,9 +71,9 @@ kadinho <[email protected]>
|
||||
The same Compose project also runs `ps5-guide-gateway`, bound specifically to
|
||||
`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
|
||||
`manuals.playstation.net` locally and forwards only `homebrew.page`,
|
||||
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the
|
||||
configured upstream resolver (`1.1.1.1` by default). Every other name receives
|
||||
NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
|
||||
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
|
||||
and `release-assets.githubusercontent.com` to the configured upstream resolver
|
||||
(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
|
||||
`http://192.168.20.30:8000/`.
|
||||
|
||||
Port `8080` on the host is already used by `unifi-network-application`; do not move
|
||||
@@ -179,12 +179,13 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol
|
||||
accept the self-signed certificate warning in the User Guide.
|
||||
|
||||
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
|
||||
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only
|
||||
those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN.
|
||||
This permits the homebrew store and the official PS5 Payload Manager catalog and
|
||||
HTTPS release downloads while continuing to block PSN and update resolution. The
|
||||
PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the
|
||||
configured upstream resolver on UDP/TCP 53.
|
||||
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
|
||||
and `release-assets.githubusercontent.com`. Only those names and
|
||||
`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
|
||||
the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum
|
||||
Library while continuing to block PSN and update resolution. The PS5 sends DNS only
|
||||
to `net-utils01`; that host must be allowed to reach the configured upstream
|
||||
resolver on UDP/TCP 53.
|
||||
|
||||
The Payload Manager review used upstream commit
|
||||
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
|
||||
@@ -192,6 +193,16 @@ The Payload Manager review used upstream commit
|
||||
URLs used `github.com`, with observed redirects only to
|
||||
`release-assets.githubusercontent.com`. Custom repositories are intentionally not
|
||||
covered because their catalog and payload URLs are user-controlled.
|
||||
|
||||
The Spectrum Library review used repository commit
|
||||
`fe4935f5a21da1e080b941ddd1ec44483b7b60f7`. That repository contains only a README,
|
||||
not source code. Static analysis of the published 1.4.8 ELF (SHA-256
|
||||
`5d1372d48f76167e3f9e24b335cf571ea6e4b3960e6b7202d2802b0f78c3a519`)
|
||||
identified `store.spectrumlibrary.online` for API/catalog access and
|
||||
`api.github.com` for update checks. Its API may return additional dynamic download
|
||||
and cover hosts, which are not allowlisted without review. The Spectrum API returned
|
||||
HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
|
||||
`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
|
||||
The PS5 was previously identified as `192.168.10.26`; requests from
|
||||
`192.168.10.6` seen at that time were from a different client. Those addresses
|
||||
are historical and must not be used as the current payload destination.
|
||||
|
||||
+12
-4
@@ -137,10 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que:
|
||||
|
||||
- bloqueie domínios PlayStation/PSN e servidores de atualização;
|
||||
- responda `manuals.playstation.net` com `192.168.20.30`;
|
||||
- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e
|
||||
- encaminhe apenas `homebrew.page`, `itsplk.github.io`,
|
||||
`store.spectrumlibrary.online`, `api.github.com`, `github.com` e
|
||||
`release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
|
||||
o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do
|
||||
PS5 Payload Manager;
|
||||
os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library;
|
||||
- devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
|
||||
telemetria bloqueados por DNS;
|
||||
- registe as consultas nos logs do container;
|
||||
@@ -170,7 +170,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
|
||||
resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
|
||||
`192.168.20.30`; não deve consultar diretamente um DNS público.
|
||||
|
||||
O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios
|
||||
O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios
|
||||
permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
|
||||
os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
|
||||
bloqueado até esse destino ser revisto e acrescentado explicitamente.
|
||||
@@ -182,6 +182,14 @@ O catálogo oficial do PS5 Payload Manager está em
|
||||
para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e
|
||||
redirects serem revistos e o hostname exato ser acrescentado conscientemente.
|
||||
|
||||
O repositório do Spectrum Library não publica código-fonte. A análise estática do
|
||||
ELF 1.4.8 identificou `store.spectrumlibrary.online` para catálogo/API e
|
||||
`api.github.com` para atualizações; os downloads de releases GitHub usam os dois
|
||||
hosts GitHub já permitidos. A API pode devolver URLs dinâmicos de capas, manifests e
|
||||
pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de
|
||||
2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS
|
||||
local não consegue corrigir.
|
||||
|
||||
## Abrir pelo Guia do Utilizador
|
||||
|
||||
Com um DNS que redirecione o manual:
|
||||
|
||||
Reference in New Issue
Block a user