We are seeing an issue with Http::reader()->getUntrusted() when fetching PayPal webhook certificate URLs.
In our production environment, DNS resolution for PayPal can return an IPv6 NAT64 address, for example:
64:ff9b::ad00:5c17
When getUntrusted() is used, XenForo appears to reject this address during its local/private IP validation because isLocalIpv6() rejects IPv6 addresses that are not within 2000::/3. This causes the request to fail even though the resolved address is a valid NAT64 address for PayPal.
Changing:
$reader->getUntrusted($certUrl)
to:
$reader->get($certUrl)
allows the request to succeed.
Is this expected behavior for getUntrusted()? Should XenForo's IPv6 validation account for the NAT64 64:ff9b::/96 prefix, or is there another recommended way to use getUntrusted() in an environment where external IPv4 hosts may resolve through NAT64?
