Skip to content

fix: restore IPv6 dual-stack support for nginx and uWSGI probes#15328

Open
alirezakolahdouzan wants to merge 1 commit into
DefectDojo:masterfrom
alirezakolahdouzan:fix/ipv6-dual-stack-support
Open

fix: restore IPv6 dual-stack support for nginx and uWSGI probes#15328
alirezakolahdouzan wants to merge 1 commit into
DefectDojo:masterfrom
alirezakolahdouzan:fix/ipv6-dual-stack-support

Conversation

@alirezakolahdouzan

@alirezakolahdouzan alirezakolahdouzan commented Jul 22, 2026

Copy link
Copy Markdown

Summary

Related: #12695, #12710, #12916, #12938.

Helm usage (IPv6-only)

django:
  uwsgi:
    appSettings:
      http: "[::]:8081"

Test plan

  • helm template renders DD_UWSGI_HTTP: '0.0.0.0:8081' by default
  • helm template --set django.uwsgi.appSettings.http=[::]:8081 renders DD_UWSGI_HTTP: '[::]:8081'
  • nginx -t succeeds for dual-stack nginx.conf / nginx_TLS.conf
  • nginx -t still succeeds after entrypoint IPv4-only strip of listen [::]:
  • Live nginx listens on both IPv4 and IPv6 :8080; /nginx_health returns 200 on 127.0.0.1 and [::1]
  • uWSGI --http 0.0.0.0:8081 and --http [::]:8081 both answer probes
  • Reviewers: deploy Helm chart on an IPv6-only cluster with django.uwsgi.appSettings.http: "[::]:8081" and confirm uwsgi/nginx probes pass.

Nginx IPv6 listens were reverted and never restored; uWSGI probe bind stayed IPv4-only. Restore dual-stack nginx listens and make DD_UWSGI_HTTP configurable via Helm for IPv6-only clusters.

Co-authored-by: Cursor <cursoragent@cursor.com>
@dryrunsecurity

Copy link
Copy Markdown

DryRun Security

This pull request contains a critical finding where the sensitive file 'docker/entrypoint-uwsgi.sh' was modified by an author not on the allowed list. Although this issue is flagged as failing, it is not currently set to block the merge.

🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in docker/entrypoint-uwsgi.sh (drs_cfbc7c18)
Vulnerability Configured Sensitive Codepath Modified by Non-Allowed Author
Description File 'docker/entrypoint-uwsgi.sh' matches configured sensitive codepath pattern 'docker/entrypoint-uwsgi.sh' and was modified by 'alirezakolahdouzan' (commit 480ae1a) who is not in the allowed authors list.

We've notified @mtesauro.


Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant