feat(spoe): Migrate implementation to dropmorepackets/haproxy-go

[LaurenceJJones]

• Replace github.com/negasus/haproxy-spoe-go with github.com/dropmorepackets/haproxy-go
• Implement zero-allocation message parsing with single-pass KV extraction
• Add struct pooling for HTTPMessageData and IPMessageData with embedded buffers
• Use bytes.Equal for key matching to avoid string allocations
• Update all action setting to use encoding.ActionWriter
• Optimize buffer reuse by embedding buffers in pooled structs
• Remove unused code and simplify pooling strategy
  Running the stress test and capturing pprof profiles for comparison:

Test: 50,000 requests, 100 concurrent connections

Metric	OLD Package	NEW Package	Improvement
Heap Allocated	85.63 MB	87.82 MB	+2.19 MB
GC Sys Bytes	5.93 MB	5.54 MB	6.6% less
Heap Objects	1,472,913	1,260,000	14.4% less

[Copilot]

Pull request overview

This PR migrates the SPOE (Stream Processing Offload Engine) implementation from github.com/negasus/haproxy-spoe-go to github.com/dropmorepackets/haproxy-go, introducing significant performance optimizations through zero-allocation message parsing, struct pooling with embedded buffers, and efficient key matching using byte comparisons.

Key Changes:

• Replace SPOE library dependency and update all integration points to use the new API (encoding.ActionWriter, encoding.Message)
• Implement struct pooling for HTTPMessageData and IPMessageData with embedded buffer reuse to reduce GC pressure
• Optimize message parsing with single-pass KV extraction using bytes.Equal for key matching instead of string conversions

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
pkg/spoa/root.go	Core migration: replaces handler wrapper with HandleSPOE interface, implements struct pooling, adds zero-allocation message parsing with extractHTTPMessageData and extractIPMessageData functions
internal/remediation/captcha/root.go	Updates InjectKeyValues to use encoding.ActionWriter instead of action.Actions
internal/remediation/ban/root.go	Updates InjectKeyValues to use encoding.ActionWriter instead of action.Actions
go.mod	Replaces negasus/haproxy-spoe-go v1.0.7 with dropmorepackets/haproxy-go v0.0.7
go.sum	Updates dependency checksums for library migration

Comments suppressed due to low confidence (2)

pkg/spoa/root.go:723

• Missing panic check on type assertion. If storedURLVal is not a string, this will panic. Add a check: storedURL, ok := storedURLVal.(string); if !ok { return remediation.Allow, httpData } or use a two-value type assertion to handle unexpected types gracefully.

				"session": uuid,

pkg/spoa/root.go:905

• The readKeyFromMessage function (lines 869-905) and its associated error variables (lines 865-867) appear to be unused. The new implementation uses extractHTTPMessageData and extractIPMessageData for extracting message data. Per the PR description "Remove unused code and simplify pooling strategy", this function should be removed.

	ipTypeLabel := "ipv4"
	if ipAddr.Is6() {
		ipTypeLabel = "ipv6"
	}

	// Count processed requests - use WithLabelValues to avoid map allocation on hot path
	metrics.TotalProcessedRequests.WithLabelValues(ipTypeLabel).Inc()

	// Check IP directly against dataset
	r, origin := s.getIPRemediation(ctx, writer, ipAddr)

	// Count blocked requests
	if r > remediation.Unknown {
		// Label order: origin, ip_type, remediation (as defined in metrics.go)
		metrics.TotalBlockedRequests.WithLabelValues(origin, ipTypeLabel, r.String()).Inc()
	}

	_ = writer.SetString(encoding.VarScopeTransaction, "remediation", r.String())
}

var (
	ErrMessageKeyNotFound     = errors.New("message key not found")
	ErrMessageKeyTypeMismatch = errors.New("message key type mismatch")
)

func readHeaders(headers []byte) (http.Header, error) {
	h := http.Header{}
	if len(headers) == 0 {
		return nil, fmt.Errorf("no headers found")
	}

	// Split by \r\n
	hs := strings.Split(string(headers), "\r\n")

	for _, header := range hs {
		if header == "" {
			continue
		}

		kv := strings.SplitN(header, ":", 2)
		if len(kv) != 2 {
			return nil, fmt.Errorf("invalid header: %q", header)
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.