So I have to write a filtering system, which may apply preprocessed ruleset to data - and trigger some actions defined in the ruleset while continuing its evaluation.
<ruleset name="1">
<rule>
<conditions>
<and>
<or>
<match image="aceofspades" level="70" />
<match image="aceofdiamonds" level="66" />
</or>
<not>
<match image="aceofclubs" level="60" />
</not>
</and>
<action name="apply_ruleset" ruleset="2">
</rule>
<rule>
...
</rule>
</ruleset>
<ruleset name="2">
</ruleset>
(Good example of what it feels to be alike: sendmail configs; some Apache configs; IPTables ruleset, with multiple tables, JOIN/ACCEPT/DROP, etc).
What bothers me with every current design I can think of:
- keeping state of and-or nodes
- being able to jump between main and sub- rulesets easily
- tracking circular references
- keeping a vast set of possible conditions
- runtime speed: parsing/hashing may take time, but each data packet must be passed through dataset as fast as possible.
What should I read/think of to be sure that my parser will be nice enough to work with large sets and don't mess the speed/flexibility too much? (Not to mention iptables code).
Target language is C++ (however would like to implement a similar system in Perl later..), was reading through this - but still not see a good solution for switching rulesets / keeping with boolean logics within rules.