patchpal 0.24.1__tar.gz → 0.24.3__tar.gz

{patchpal-0.24.1/patchpal.egg-info → patchpal-0.24.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.1
+Version: 0.24.3
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.1 → patchpal-0.24.3}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.1"
+__version__ = "0.24.3"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.1 → patchpal-0.24.3}/patchpal/agent/bedrock_profile_utils.py

@@ -29,8 +29,33 @@ def _extract_model_from_arn(arn: str) -> str | None:
         else:
             region = os.getenv("AWS_REGION_NAME") or os.getenv("AWS_REGION") or "us-east-1"
 
+        # Check for custom Bedrock endpoint (VPC endpoint, custom domain, etc.)
+        # The control plane and runtime may use the same VPC endpoint base
+        custom_endpoint = (
+            os.getenv("AWS_BEDROCK_ENDPOINT")
+            or os.getenv("AWS_ENDPOINT_URL_BEDROCK")
+            or os.getenv("AWS_ENDPOINT_URL")
+        )
+
+        # CRITICAL FIX: Derive control plane endpoint from runtime VPC endpoint
+        # Scenario: User has VPC endpoint for runtime but not explicit control plane endpoint
+        # Problem: boto3.client("bedrock") defaults to public endpoint, not VPC endpoint
+        # Solution: Automatically derive control plane VPC endpoint from runtime endpoint
+        # VPC endpoint pattern:
+        #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+        #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+        # This matches the automatic derivation in sandbox.py endpoint detection
+        if custom_endpoint and "bedrock-runtime" in custom_endpoint:
+            # Try to construct control plane VPC endpoint by removing -runtime
+            control_endpoint = custom_endpoint.replace("bedrock-runtime", "bedrock")
+        else:
+            control_endpoint = custom_endpoint
+
         # Create bedrock client
-        bedrock = boto3.client("bedrock", region_name=region)
+        if control_endpoint:
+            bedrock = boto3.client("bedrock", region_name=region, endpoint_url=control_endpoint)
+        else:
+            bedrock = boto3.client("bedrock", region_name=region)
 
         # Get inference profile details
         response = bedrock.get_inference_profile(inferenceProfileIdentifier=arn)

{patchpal-0.24.1 → patchpal-0.24.3}/patchpal/cli/sandbox.py

@@ -144,6 +144,7 @@ def detect_llm_endpoints_from_env():
         "ANTHROPIC_API_BASE",
         "AWS_BEDROCK_ENDPOINT",
         "AWS_ENDPOINT_URL_BEDROCK_RUNTIME",
+        "AWS_ENDPOINT_URL_BEDROCK",  # Control plane endpoint
         "AWS_ENDPOINT_URL",
         "AWS_BEDROCK_RUNTIME_ENDPOINT",
         "AZURE_OPENAI_ENDPOINT",
@@ -162,6 +163,18 @@ def detect_llm_endpoints_from_env():
             # Ensure it's a valid URL
             if value.startswith("http://") or value.startswith("https://"):
                 detected_urls.append(value)
+
+                # CRITICAL FIX: For Bedrock VPC endpoints, derive control plane endpoint
+                # Scenario: User has VPC endpoint for runtime API (e.g., AWS GovCloud private network)
+                # Problem: Model capability detection needs control plane API (get_inference_profile)
+                #          but boto3 doesn't automatically derive control plane from runtime endpoint
+                # VPC endpoint pattern:
+                #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+                #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+                # Without this, capability detection hangs trying to reach public control plane endpoint
+                if "bedrock-runtime" in value and ".vpce.amazonaws.com" in value:
+                    control_plane_url = value.replace("bedrock-runtime", "bedrock")
+                    detected_urls.append(control_plane_url)
             else:
                 # Assume https if no protocol specified
                 detected_urls.append(f"https://{value}")
@@ -177,18 +190,37 @@ def detect_llm_endpoints_from_env():
     if aws_region and (
         os.environ.get("AWS_ACCESS_KEY_ID") or os.environ.get("AWS_SECRET_ACCESS_KEY")
     ):
-        # Add Bedrock endpoint for the region
+        # Add Bedrock endpoints for the region
         # Support both GovCloud and standard regions
         # Also support AWS China regions
+
+        # IMPORTANT: boto3 uses standard endpoint names by default, even in GovCloud
+        # Only use -fips suffix if AWS_USE_FIPS_ENDPOINT=true is explicitly set
+        # Scenario 1: Standard GovCloud → bedrock.us-gov-east-1.amazonaws.com (boto3 default)
+        # Scenario 2: FIPS required → bedrock-fips.us-gov-east-1.amazonaws.com (explicit opt-in)
+        use_fips = os.environ.get("AWS_USE_FIPS_ENDPOINT", "").lower() == "true"
+
         if "gov" in aws_region:
-            # GovCloud regions use FIPS endpoints
-            detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+            # GovCloud regions
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
+            if use_fips:
+                # FIPS endpoints (only when explicitly requested via AWS_USE_FIPS_ENDPOINT=true)
+                detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock-fips.{aws_region}.amazonaws.com")
+            else:
+                # Standard GovCloud endpoints (boto3 default behavior)
+                # This is what boto3 uses unless FIPS is explicitly configured
+                detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
         elif "cn-" in aws_region:
-            # AWS China regions use .amazonaws.com.cn
+            # AWS China regions use .amazonaws.com.cn domain
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com.cn")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com.cn")
         else:
-            # Standard commercial regions
+            # Standard commercial regions (us-east-1, eu-west-1, etc.)
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
 
     # Azure OpenAI: Extract from resource name if AZURE_OPENAI_KEY is set
     azure_key = os.environ.get("AZURE_OPENAI_KEY") or os.environ.get("AZURE_API_KEY")
@@ -207,8 +239,15 @@ def detect_llm_endpoints_from_env():
     return list(set(detected_urls))
 
 
-def build_network_restriction_script(allowed_urls, test_mode=False):
-    """Build bash script to configure iptables firewall for network restrictions."""
+def build_network_restriction_script(allowed_urls, test_mode=False, block_dns_exfil=True):
+    """Build bash script to configure iptables firewall for network restrictions.
+
+    Args:
+        allowed_urls: List of allowed URL endpoints
+        test_mode: Whether to test restrictions and exit
+        block_dns_exfil: Whether to block DNS record types used for exfiltration (default: True)
+                        Blocks TXT, NULL, SRV records and large DNS queries
+    """
     script = """
 echo "=== Pre-downloading required data (before network restrictions) ==="
 
@@ -276,9 +315,70 @@ fi
 # Configure iptables
 echo "Configuring firewall rules..."
 
-# Allow DNS (required for hostname resolution)
-iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
-iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+# Extract DNS resolver IP(s) from /etc/resolv.conf
+# This locks DNS queries to only the container's configured resolver,
+# preventing agents from directly querying attacker-controlled DNS servers
+RESOLVER_IPS=$(grep '^nameserver' /etc/resolv.conf | awk '{print $2}')
+
+if [ -z "$RESOLVER_IPS" ]; then
+    echo "❌ ERROR: Could not detect DNS resolver from /etc/resolv.conf"
+    echo "Cannot configure secure DNS filtering without a resolver"
+    exit 1
+fi
+"""
+
+    # Add DNS exfiltration blocking if enabled
+    if block_dns_exfil:
+        script += """
+# Block DNS record types used for data exfiltration (SECURITY ENHANCEMENT)
+# This prevents DNS tunneling attacks that use TXT, NULL, or SRV records
+# to encode and exfiltrate sensitive data through DNS queries
+echo "Blocking DNS record types used for data exfiltration..."
+
+# Block TXT records (type 16 = 0x0010)
+# TXT records can carry up to 255 bytes of arbitrary text per record
+# Commonly used for DNS tunneling due to large payload capacity
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 10|" --algo bm -j LOG --log-prefix "BLOCKED-DNS-TXT: " --log-level 4
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 10|" --algo bm -j DROP
+iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "|00 10|" --algo bm -j LOG --log-prefix "BLOCKED-DNS-TXT: " --log-level 4
+iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "|00 10|" --algo bm -j DROP
+
+# Block NULL records (type 10 = 0x000a)
+# NULL records are explicitly designed to carry arbitrary binary data
+# No legitimate use in normal DNS resolution
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 0a|" --algo bm -j LOG --log-prefix "BLOCKED-DNS-NULL: " --log-level 4
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 0a|" --algo bm -j DROP
+iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "|00 0a|" --algo bm -j DROP
+
+# Block SRV records (type 33 = 0x0021)
+# Service records can be abused for tunneling
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 21|" --algo bm -j LOG --log-prefix "BLOCKED-DNS-SRV: " --log-level 4
+iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "|00 21|" --algo bm -j DROP
+iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "|00 21|" --algo bm -j DROP
+
+# Block large DNS queries (likely subdomain encoding for data exfiltration)
+# Normal DNS queries: 50-100 bytes
+# Queries with encoded data in subdomains: 200+ bytes
+# This catches attempts to encode data in long subdomain names
+iptables -A OUTPUT -p udp --dport 53 -m length --length 150:65535 -j LOG --log-prefix "BLOCKED-DNS-LARGE: " --log-level 4
+iptables -A OUTPUT -p udp --dport 53 -m length --length 150:65535 -j DROP
+iptables -A OUTPUT -p tcp --dport 53 -m length --length 150:65535 -j DROP
+
+echo "✓ DNS exfiltration protections active (TXT/NULL/SRV/LARGE queries blocked)"
+"""
+
+    script += """
+# Allow DNS ONLY to detected resolver IPs (SECURITY FIX)
+# This prevents the OpenAI-style DNS tunneling attack where agents
+# send DNS packets directly to attacker-controlled DNS servers
+echo "Locking DNS queries to container's resolver(s):"
+while IFS= read -r RESOLVER_IP; do
+    if [ -n "$RESOLVER_IP" ]; then
+        echo "  $RESOLVER_IP (DNS - A/AAAA records only)"
+        iptables -A OUTPUT -d $RESOLVER_IP -p udp --dport 53 -j ACCEPT
+        iptables -A OUTPUT -d $RESOLVER_IP -p tcp --dport 53 -j ACCEPT
+    fi
+done <<< "$RESOLVER_IPS"
 
 # Allow localhost
 iptables -A OUTPUT -d 127.0.0.1/8 -j ACCEPT
@@ -830,12 +930,23 @@ SECURITY:
 
       FIREWALL RULES:
       - Only allowed URLs are accessible (auto-detected + --allow-url)
-      - DNS resolution permitted (required for hostname lookup)
+      - DNS resolution permitted (A/AAAA records only for hostname lookup)
+      - DNS exfiltration prevention: TXT, NULL, SRV records BLOCKED
+      - Large DNS queries (>150 bytes) BLOCKED (prevents subdomain encoding)
       - Localhost accessible (127.0.0.1/8)
       - All other network traffic BLOCKED and LOGGED
       - Web tools and MCP automatically disabled
       - Ideal for sensitive/regulated environments
 
+      DNS SECURITY:
+      * Blocks DNS tunneling attacks that exfiltrate data via:
+        - TXT records (up to 255 bytes per query)
+        - NULL records (arbitrary binary data)
+        - SRV records (service discovery abuse)
+        - Long subdomains (base64-encoded data in domain names)
+      * Only allows A and AAAA records (standard hostname resolution)
+      * Logs all blocked DNS queries for security auditing
+
       Use cases:
       * Compliance: Meet data governance requirements
       * Security: Prevent data exfiltration

{patchpal-0.24.1 → patchpal-0.24.3/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.1
+Version: 0.24.3
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0