TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow Spectrum Library DNS endpoints

Browse Source
This commit is contained in:
kadinho
2026-10-07 22:17:52 +01:00
parent 7df4a40c78
commit d1e39243a6
5 changed files with 49 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+20 -9
View File
@@ -71,9 +71,9 @@ kadinho <[email protected]>
The same Compose project also runs `ps5-guide-gateway`, bound specifically to
`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
`manuals.playstation.net` locally and forwards only `homebrew.page`,
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the
configured upstream resolver (`1.1.1.1` by default). Every other name receives
NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
and `release-assets.githubusercontent.com` to the configured upstream resolver
(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
`http://192.168.20.30:8000/`.
Port `8080` on the host is already used by `unifi-network-application`; do not move
@@ -179,12 +179,13 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol
accept the self-signed certificate warning in the User Guide.
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only
those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN.
This permits the homebrew store and the official PS5 Payload Manager catalog and
HTTPS release downloads while continuing to block PSN and update resolution. The
PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the
configured upstream resolver on UDP/TCP 53.
`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
and `release-assets.githubusercontent.com`. Only those names and
`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum
Library while continuing to block PSN and update resolution. The PS5 sends DNS only
to `net-utils01`; that host must be allowed to reach the configured upstream
resolver on UDP/TCP 53.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -192,6 +193,16 @@ The Payload Manager review used upstream commit
URLs used `github.com`, with observed redirects only to
`release-assets.githubusercontent.com`. Custom repositories are intentionally not
covered because their catalog and payload URLs are user-controlled.
The Spectrum Library review used repository commit
`fe4935f5a21da1e080b941ddd1ec44483b7b60f7`. That repository contains only a README,
not source code. Static analysis of the published 1.4.8 ELF (SHA-256
`5d1372d48f76167e3f9e24b335cf571ea6e4b3960e6b7202d2802b0f78c3a519`)
identified `store.spectrumlibrary.online` for API/catalog access and
`api.github.com` for update checks. Its API may return additional dynamic download
and cover hosts, which are not allowlisted without review. The Spectrum API returned
HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from a different client. Those addresses
are historical and must not be used as the current payload destination.