Condition, rules, state and action refactor / rewrite

Add nested rules
Add backend action, allow wildcard in backends
Remove poison from tree, update README with action table

Allow defining pass/fail actions on challenge,

Remove redirect/referer parameters on backend pass

Set challenge cookie tied to host

Rewrite DNSBL condition into a challenge

Allow passing an arbitrary path for assets to js challenges

Optimize programs exhaustively on compilation

Activation instead of map for CEL context, faster map access, new network override

Return valid host on cookie setting in case Host is an IP address.
bug: does not work with IPv6, see https://github.com/golang/go/issues/65521

Apply TLS fingerprinter on GetConfigForClient instead of GetCertificate

Cleanup go-away cookies before passing to backend

Code action for specifically replying with an HTTP code

lib/policy/challenge.go

@@ -1,15 +1,15 @@
 package policy
 
+import (
+	"github.com/goccy/go-yaml/ast"
+	"time"
+)
+
 type Challenge struct {
 	Conditions []string `yaml:"conditions"`
-	Mode       string   `yaml:"mode"`
-	Asset      *string  `yaml:"asset,omitempty"`
-	Url        *string  `yaml:"url,omitempty"`
+	Runtime    string   `yaml:"runtime"`
 
-	Parameters map[string]string `json:"parameters,omitempty"`
-	Runtime    struct {
-		Mode        string  `yaml:"mode,omitempty"`
-		Asset       string  `yaml:"asset,omitempty"`
-		Probability float64 `yaml:"probability,omitempty"`
-	} `yaml:"runtime"`
+	Duration time.Duration `yaml:"duration"`
+
+	Parameters ast.Node `yaml:"parameters,omitempty"`
 }

lib/policy/options.go

@@ -0,0 +1,18 @@
+package policy
+
+import (
+	"net/http"
+)
+
+type Settings struct {
+	Backends               map[string]http.Handler
+	PrivateKeySeed         []byte
+	Debug                  bool
+	PackageName            string
+	ChallengeTemplate      string
+	ChallengeTemplateTheme string
+	ClientIpHeader         string
+	BackendIpHeader        string
+
+	ChallengeResponseCode int
+}

lib/policy/rule.go

@@ -1,22 +1,40 @@
 package policy
 
+import "github.com/goccy/go-yaml/ast"
+
 type RuleAction string
 
 const (
-	RuleActionPASS      RuleAction = "PASS"
-	RuleActionDENY      RuleAction = "DENY"
-	RuleActionBLOCK     RuleAction = "BLOCK"
+	// RuleActionNONE Does nothing. Useful for parent rules when children want to be specified
+	RuleActionNONE RuleAction = "NONE"
+	// RuleActionPASS Passes the connection immediately
+	RuleActionPASS RuleAction = "PASS"
+	// RuleActionDENY Denies the connection with a fancy page
+	RuleActionDENY RuleAction = "DENY"
+	// RuleActionBLOCK Denies the connection with a response code
+	RuleActionBLOCK RuleAction = "BLOCK"
+	// RuleActionCODE Returns a specified HTTP code
+	RuleActionCODE RuleAction = "CODE"
+
+	// RuleActionDROP Drops the connection without sending a reply
+	RuleActionDROP RuleAction = "DROP"
+
+	// RuleActionCHALLENGE Issues a challenge that when passed, passes the connection
 	RuleActionCHALLENGE RuleAction = "CHALLENGE"
-	RuleActionCHECK     RuleAction = "CHECK"
-	RuleActionPOISON    RuleAction = "POISON"
+	// RuleActionCHECK Issues a challenge that when passed, continues checking rules
+	RuleActionCHECK RuleAction = "CHECK"
+
+	// RuleActionPROXY Proxies request to a backend, with optional path replacements
+	RuleActionPROXY RuleAction = "PROXY"
 )
 
 type Rule struct {
 	Name       string   `yaml:"name"`
-	Host       *string  `yaml:"host"`
 	Conditions []string `yaml:"conditions"`
 
 	Action string `yaml:"action"`
 
-	Challenges []string `yaml:"challenges"`
+	Settings ast.Node `yaml:"settings"`
+
+	Children []Rule `yaml:"children"`
 }