Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: trailofbits/algo
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: trailofbits/algo
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: conditional-security-group-ports
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 10 files changed
  • 2 contributors

Commits on Nov 28, 2025

  1. Only open VPN ports in cloud security groups when enabled 

    When ipsec_enabled or wireguard_enabled is false, don't open those
ports in cloud provider security groups/firewalls. Previously, ports
500, 4500, and the WireGuard port were always opened regardless of
which VPN protocols were actually enabled.

This follows the principle of least privilege - only open ports for
services that are actually running.

Changes by provider:
- EC2: Add CloudFormation conditions for conditional SecurityGroupIngress
- Lightsail: Convert to Jinja2 template with conditional port blocks
- Azure: Convert to Jinja2 template with conditional security rules
- Vultr: Build firewall rules list conditionally
- GCE: Build allowed list conditionally
- OpenStack: Build security rules list conditionally
- CloudStack: Build security rules list conditionally

Note: The instance-level iptables firewall already blocked unused ports,
so this change improves security posture at the cloud provider level.

Fixes #14293

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
    @dguido @claude
    dguido and claude committed Nov 28, 2025
    Configuration menu
    Copy the full SHA
    69d145f View commit details
    Browse the repository at this point in the history
Loading