IPS actions allow you to execute custom responses to events. Unlike loggers,
these are invoked before thresholding and can be used to control external agents
(including loggers).

IPS rules have an associated type that determines what kind of action they
trigger. The rule types defined in this module are:

* log pass alert drop block

It also defines 3 active responses:
* react reject rewrite

Reject performs active response to shutdown hostile network session by injecting
TCP resets (TCP connections) or ICMP unreachable packets.

React sends an HTML page to the client, a RST to the server and blocks the flow.
It is using payload_injector utility. payload_injector should be configured when
react is used. In some cases, block page injection is not possible. For example,
if the client is expecting a response body rather than a status line, injecting
a block page would be invalid. For more details look at implementation of
payload_injector. In either case, even when injection of the block page is
not supported, react blocks the flow.

An IPS policy can define multiple named react action variables, each with its
own page:

    ips =
    {
        variables =
        {
            actions =
            {
                BLOCK_PAGE_1 = { react = { page = "block_page_1.html" } },
                BLOCK_PAGE_2 = { react = { page = "block_page_2.html" } },
            }
        }
    }

Rules use those variables as actions:

    $BLOCK_PAGE_1 http ( sid:1; )
    $BLOCK_PAGE_2 http ( sid:2; )

A common use is to keep the base rule action generic and select the configured
react page from ips.states:

    ips.states =
    [[
        $BLOCK_PAGE_1 ( gid:119; sid:19; enable:yes; )
        $BLOCK_PAGE_2 ( gid:119; sid:20; enable:yes; )
    ]]

The parser resolves the variable to the underlying react action type and stores
an action selector in the RTN. The selector is used at event time to retrieve
the configured react action instance for that variable. A selector of 0 uses the
normal policy action instance, preserving the standard action path for rules
that do not use action variables.

The selector is policy-local. When a rule state action is stored as an action
variable, keep the original "$NAME" token and resolve it against the target IPS
policy when the state is applied. This matters for detection.global_rule_state:
different IPS policies can declare the same action variable name in different
orders, or point it at different react pages. Carrying a selector parsed under
one policy into another policy would select the wrong configured action.

Every target policy that receives a global rule state using an action variable
must define that variable name. Missing variables are configuration errors.

ips.action_override is applied before action variable resolution, so an override
value such as "$BLOCK_PAGE_1" selects that configured react page for rules in
the policy.

Action variables are currently scoped to configured react pages. They are not
general aliases for built-in actions or unconfigured action instances. These
forms are not supported:

    actions =
    {
        MISCONFIGURED_ALERT = "alert",
        MISCONFIGURED_REACT = "react",
    }

Rewrite enables overwrite packet contents based on "replace" option in the
rules. Note that using "rewrite" action without "replace" option will raise
the appropriate rule alert but will not overwrite the packet payload.
Rewrite/replace works for raw packets only.

Ips actions are all pluggable and implemented as subclasses of IpsAction action.
Each ips action instance has an instance of the active action that is used to
perform the active response.

IpsAction::exec represents the action taken by the ips actions after rule
evaluation during packet processing. This may include logging, alerting  marking
the packet as passed, etc. IpsActions::exec when called without the otn will do
the active action such as drop/block/reset without alerting/logging or marking
the packet as passed.

ActiveAction::delayed_exec is called during the post processing of a packet to
send active responses.
