TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow Spectrum Library DNS endpoints

Browse Source
This commit is contained in:
kadinho
2026-10-07 22:17:52 +01:00
parent 7df4a40c78
commit d1e39243a6
5 changed files with 49 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -8
View File
@@ -34,21 +34,28 @@ The maintained LAN deployment runs on `net-utils01` from
Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`. Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
The DNS gateway resolves `manuals.playstation.net` locally and forwards only The DNS gateway resolves `manuals.playstation.net` locally and forwards only
`homebrew.page`, `itsplk.github.io`, `github.com`, and `homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`,
`release-assets.githubusercontent.com` to its configured upstream resolver. These `api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its
names cover the homebrew store and the official PS5 Payload Manager catalog and configured upstream resolver. These names cover the homebrew store, the official
downloads; every other name receives NXDOMAIN. PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and
update endpoints; every other name receives NXDOMAIN.
The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
`192.168.20.30`. For the homebrew store and Payload Manager it also needs WAN egress `192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to
on TCP 443 to the four allowlisted domains; no WAN ingress rule is required. The the six allowlisted domains; no WAN ingress rule is required. The server needs DNS
server needs DNS egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).
default).
The Payload Manager supports arbitrary custom repository URLs. Those hosts are not The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
allowed automatically: review the repository JSON, payload URLs, checksums, and allowed automatically: review the repository JSON, payload URLs, checksums, and
redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`. redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`.
Spectrum Library is distributed without source code in its repository. Static
review of its 1.4.8 ELF identified `store.spectrumlibrary.online` for its API and
`api.github.com` for update checks. Catalog responses can supply additional cover,
manifest, and package URLs; these unknown hosts remain blocked until observed and
reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS
availability alone does not guarantee that its catalog will load.
To deploy a reviewed commit: To deploy a reviewed commit:
```sh ```sh
compose.yaml
+1 -1
View File
@@ -20,7 +20,7 @@ services:
environment: environment:
GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}" GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}"
REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com}" FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com}"
UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
ports: ports:
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
docker/guide_gateway.py
+1 -1
View File
@@ -20,7 +20,7 @@ FORWARDED_DOMAINS = frozenset(
name.strip().lower() name.strip().lower()
for name in os.environ.get( for name in os.environ.get(
"FORWARDED_DOMAINS", "FORWARDED_DOMAINS",
"homebrew.page,itsplk.github.io,github.com,release-assets.githubusercontent.com", "homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,release-assets.githubusercontent.com",
).split(",") ).split(",")
if name.strip() if name.strip()
) )
docs/HANDOFF.md
+20 -9
View File
@@ -71,9 +71,9 @@ kadinho <[email protected]>
The same Compose project also runs `ps5-guide-gateway`, bound specifically to The same Compose project also runs `ps5-guide-gateway`, bound specifically to
`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
`manuals.playstation.net` locally and forwards only `homebrew.page`, `manuals.playstation.net` locally and forwards only `homebrew.page`,
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
configured upstream resolver (`1.1.1.1` by default). Every other name receives and `release-assets.githubusercontent.com` to the configured upstream resolver
NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to (`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
`http://192.168.20.30:8000/`. `http://192.168.20.30:8000/`.
Port `8080` on the host is already used by `unifi-network-application`; do not move Port `8080` on the host is already used by `unifi-network-application`; do not move
@@ -179,12 +179,13 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol
accept the self-signed certificate warning in the User Guide. accept the self-signed certificate warning in the User Guide.
The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`, The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN. and `release-assets.githubusercontent.com`. Only those names and
This permits the homebrew store and the official PS5 Payload Manager catalog and `manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
HTTPS release downloads while continuing to block PSN and update resolution. The the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum
PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the Library while continuing to block PSN and update resolution. The PS5 sends DNS only
configured upstream resolver on UDP/TCP 53. to `net-utils01`; that host must be allowed to reach the configured upstream
resolver on UDP/TCP 53.
The Payload Manager review used upstream commit The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -192,6 +193,16 @@ The Payload Manager review used upstream commit
URLs used `github.com`, with observed redirects only to URLs used `github.com`, with observed redirects only to
`release-assets.githubusercontent.com`. Custom repositories are intentionally not `release-assets.githubusercontent.com`. Custom repositories are intentionally not
covered because their catalog and payload URLs are user-controlled. covered because their catalog and payload URLs are user-controlled.
The Spectrum Library review used repository commit
`fe4935f5a21da1e080b941ddd1ec44483b7b60f7`. That repository contains only a README,
not source code. Static analysis of the published 1.4.8 ELF (SHA-256
`5d1372d48f76167e3f9e24b335cf571ea6e4b3960e6b7202d2802b0f78c3a519`)
identified `store.spectrumlibrary.online` for API/catalog access and
`api.github.com` for update checks. Its API may return additional dynamic download
and cover hosts, which are not allowlisted without review. The Spectrum API returned
HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
The PS5 was previously identified as `192.168.10.26`; requests from The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from a different client. Those addresses `192.168.10.6` seen at that time were from a different client. Those addresses
are historical and must not be used as the current payload destination. are historical and must not be used as the current payload destination.
docs/PS5_SETUP.md
+12 -4
View File
@@ -137,10 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que:
- bloqueie domínios PlayStation/PSN e servidores de atualização; - bloqueie domínios PlayStation/PSN e servidores de atualização;
- responda `manuals.playstation.net` com `192.168.20.30`; - responda `manuals.playstation.net` com `192.168.20.30`;
- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e - encaminhe apenas `homebrew.page`, `itsplk.github.io`,
`store.spectrumlibrary.online`, `api.github.com`, `github.com` e
`release-assets.githubusercontent.com` para o resolvedor configurado, permitindo `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library;
PS5 Payload Manager;
- devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
telemetria bloqueados por DNS; telemetria bloqueados por DNS;
- registe as consultas nos logs do container; - registe as consultas nos logs do container;
@@ -170,7 +170,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
`192.168.20.30`; não deve consultar diretamente um DNS público. `192.168.20.30`; não deve consultar diretamente um DNS público.
O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios
permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
bloqueado até esse destino ser revisto e acrescentado explicitamente. bloqueado até esse destino ser revisto e acrescentado explicitamente.
@@ -182,6 +182,14 @@ O catálogo oficial do PS5 Payload Manager está em
para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e
redirects serem revistos e o hostname exato ser acrescentado conscientemente. redirects serem revistos e o hostname exato ser acrescentado conscientemente.
O repositório do Spectrum Library não publica código-fonte. A análise estática do
ELF 1.4.8 identificou `store.spectrumlibrary.online` para catálogo/API e
`api.github.com` para atualizações; os downloads de releases GitHub usam os dois
hosts GitHub já permitidos. A API pode devolver URLs dinâmicos de capas, manifests e
pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de
2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS
local não consegue corrigir.
## Abrir pelo Guia do Utilizador ## Abrir pelo Guia do Utilizador
Com um DNS que redirecione o manual: Com um DNS que redirecione o manual: