ICM-49892 cgnat ranges and hostname denylist gaps

[ruslanti]

This PR is a push from of fastedge-lib subtree changes from FastEdge repo.

[Copilot]

Pull request overview

This PR pulls subtree updates that tighten outbound-request safety checks (CGNAT + additional non-public IPv4 ranges, plus hostname denylisting) and adjusts header propagation so “propagated” request headers behave as fallbacks rather than overriding app-supplied headers.

Changes:

• Harden is_public_host / private IP detection (CGNAT + additional reserved ranges) and add a small hostname denylist (e.g., localhost, GCP metadata names) to reduce SSRF risk.
• Change propagated-header behavior to avoid duplicating/overriding app-provided headers; add filtering for cdn-loop.
• Remove runtime log feature flags (kafka_log, victoria_log) and update related docs/tests.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/main.rs	Fix geo header fixture value for pop-country-code.
crates/runtime/src/lib.rs	Allow non-camel-case enum variant naming for AppResult.
crates/runtime/src/app.rs	Remove Kafka log variant/tests; make Victoria log variant unconditional.
crates/runtime/Cargo.toml	Drop default log features; dependency formatting cleanup.
crates/http-service/src/state.rs	Add cdn-loop to filtered headers; make propagated headers fallback-only; add tests.
crates/http-service/src/executor/wasi_http.rs	Remove propagate_header_names field from HttpState initialization.
crates/http-service/src/executor/http.rs	Remove propagate_header_names field from HttpState initialization.
crates/http-backend/src/lib.rs	Add cdn-loop filtering, improve propagated-header fallback behavior, harden host “public” checks, expand private IP ranges, add tests.
CLAUDE.md	Update feature documentation to reflect removed log features.
Cargo.lock	Update dependency lock entries (but currently inconsistent with pinned git deps in manifests).

Comments suppressed due to low confidence (1)

crates/http-backend/src/lib.rs:382

• Same issue as in the Direct branch above: because the presence check is against the mutated headers vector, multiple propagated values for the same header name will be collapsed to a single value. This changes HeaderMap semantics for multi-valued headers and can drop data.

                for (k, v) in self.propagate_headers_vec() {
                    if !headers
                        .iter()
                        .any(|(existing, _)| existing.eq_ignore_ascii_case(&k))
                    {
                        headers.push((k, v));
                    }
                }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.