From d1e39243a622f7d3efa28123b157ca1d5f97929d Mon Sep 17 00:00:00 2001 From: kadinho Date: Wed, 7 Oct 2026 22:17:52 +0100 Subject: [PATCH] Allow Spectrum Library DNS endpoints --- README.md | 23 +++++++++++++++-------- compose.yaml | 2 +- docker/guide_gateway.py | 2 +- docs/HANDOFF.md | 29 ++++++++++++++++++++--------- docs/PS5_SETUP.md | 16 ++++++++++++---- 5 files changed, 49 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 85c9594..7f79edd 100644 --- a/README.md +++ b/README.md @@ -34,21 +34,28 @@ The maintained LAN deployment runs on `net-utils01` from Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. The DNS gateway resolves `manuals.playstation.net` locally and forwards only -`homebrew.page`, `itsplk.github.io`, `github.com`, and -`release-assets.githubusercontent.com` to its configured upstream resolver. These -names cover the homebrew store and the official PS5 Payload Manager catalog and -downloads; every other name receives NXDOMAIN. +`homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`, +`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its +configured upstream resolver. These names cover the homebrew store, the official +PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and +update endpoints; every other name receives NXDOMAIN. The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on -`192.168.20.30`. For the homebrew store and Payload Manager it also needs WAN egress -on TCP 443 to the four allowlisted domains; no WAN ingress rule is required. The -server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by -default). +`192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to +the six allowlisted domains; no WAN ingress rule is required. The server needs DNS +egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default). The Payload Manager supports arbitrary custom repository URLs. Those hosts are not allowed automatically: review the repository JSON, payload URLs, checksums, and redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`. +Spectrum Library is distributed without source code in its repository. Static +review of its 1.4.8 ELF identified `store.spectrumlibrary.online` for its API and +`api.github.com` for update checks. Catalog responses can supply additional cover, +manifest, and package URLs; these unknown hosts remain blocked until observed and +reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS +availability alone does not guarantee that its catalog will load. + To deploy a reviewed commit: ```sh diff --git a/compose.yaml b/compose.yaml index 2fefd69..98dea1f 100644 --- a/compose.yaml +++ b/compose.yaml @@ -20,7 +20,7 @@ services: environment: GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}" REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" - FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com}" + FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" ports: - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" diff --git a/docker/guide_gateway.py b/docker/guide_gateway.py index 9b74fbb..59c1525 100644 --- a/docker/guide_gateway.py +++ b/docker/guide_gateway.py @@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset( name.strip().lower() for name in os.environ.get( "FORWARDED_DOMAINS", - "homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com", + "homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com", ).split(",") if name.strip() ) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 5c055c3..e1e51b4 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -71,9 +71,9 @@ kadinho The same Compose project also runs `ps5-guide-gateway`, bound specifically to `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves `manuals.playstation.net` locally and forwards only `homebrew.page`, -`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the -configured upstream resolver (`1.1.1.1` by default). Every other name receives -NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to +`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` +and `release-assets.githubusercontent.com` to the configured upstream resolver +(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to `http://192.168.20.30:8000/`. Port `8080` on the host is already used by `unifi-network-application`; do not move @@ -179,12 +179,13 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol accept the self-signed certificate warning in the User Guide. The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`, -`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only -those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN. -This permits the homebrew store and the official PS5 Payload Manager catalog and -HTTPS release downloads while continuing to block PSN and update resolution. The -PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the -configured upstream resolver on UDP/TCP 53. +`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com` +and `release-assets.githubusercontent.com`. Only those names and +`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits +the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum +Library while continuing to block PSN and update resolution. The PS5 sends DNS only +to `net-utils01`; that host must be allowed to reach the configured upstream +resolver on UDP/TCP 53. The Payload Manager review used upstream commit `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on @@ -192,6 +193,16 @@ The Payload Manager review used upstream commit URLs used `github.com`, with observed redirects only to `release-assets.githubusercontent.com`. Custom repositories are intentionally not covered because their catalog and payload URLs are user-controlled. + +The Spectrum Library review used repository commit +`fe4935f5a21da1e080b941ddd1ec44483b7b60f7`. That repository contains only a README, +not source code. Static analysis of the published 1.4.8 ELF (SHA-256 +`5d1372d48f76167e3f9e24b335cf571ea6e4b3960e6b7202d2802b0f78c3a519`) +identified `store.spectrumlibrary.online` for API/catalog access and +`api.github.com` for update checks. Its API may return additional dynamic download +and cover hosts, which are not allowlisted without review. The Spectrum API returned +HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte +`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis. The PS5 was previously identified as `192.168.10.26`; requests from `192.168.10.6` seen at that time were from a different client. Those addresses are historical and must not be used as the current payload destination. diff --git a/docs/PS5_SETUP.md b/docs/PS5_SETUP.md index 74fb41d..2af0cba 100644 --- a/docs/PS5_SETUP.md +++ b/docs/PS5_SETUP.md @@ -137,10 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que: - bloqueie domínios PlayStation/PSN e servidores de atualização; - responda `manuals.playstation.net` com `192.168.20.30`; -- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e +- encaminhe apenas `homebrew.page`, `itsplk.github.io`, + `store.spectrumlibrary.online`, `api.github.com`, `github.com` e `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo - o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do - PS5 Payload Manager; + os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library; - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e telemetria bloqueados por DNS; - registe as consultas nos logs do container; @@ -170,7 +170,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para `192.168.20.30`; não deve consultar diretamente um DNS público. -O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios +O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será bloqueado até esse destino ser revisto e acrescentado explicitamente. @@ -182,6 +182,14 @@ O catálogo oficial do PS5 Payload Manager está em para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e redirects serem revistos e o hostname exato ser acrescentado conscientemente. +O repositório do Spectrum Library não publica código-fonte. A análise estática do +ELF 1.4.8 identificou `store.spectrumlibrary.online` para catálogo/API e +`api.github.com` para atualizações; os downloads de releases GitHub usam os dois +hosts GitHub já permitidos. A API pode devolver URLs dinâmicos de capas, manifests e +pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de +2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS +local não consegue corrigir. + ## Abrir pelo Guia do Utilizador Com um DNS que redirecione o manual: