Question

So I have to write a filtering system, which may apply preprocessed ruleset to data - and trigger some actions defined in the ruleset while continuing its evaluation.

<ruleset name="1">
<rule>
<conditions>
   <and>
    <or>
     <match image="aceofspades" level="70" />
     <match image="aceofdiamonds" level="66" />
    </or>
    <not>
     <match image="aceofclubs" level="60" />
    </not>
   </and>
<action name="apply_ruleset" ruleset="2">
</rule>
<rule>
...
</rule>
</ruleset>
<ruleset name="2">
</ruleset>
(Good example of what it feels to be alike: sendmail configs; some Apache configs; IPTables ruleset, with multiple tables, JOIN/ACCEPT/DROP, etc).

What bothers me with every current design I can think of:

keeping state of and-or nodes
being able to jump between main and sub- rulesets easily
tracking circular references
keeping a vast set of possible conditions
runtime speed: parsing/hashing may take time, but each data packet must be passed through dataset as fast as possible.
What should I read/think of to be sure that my parser will be nice enough to work with large sets and don't mess the speed/flexibility too much? (Not to mention iptables code).

Target language is C++ (however would like to implement a similar system in Perl later..), was reading through this - but still not see a good solution for switching rulesets / keeping with boolean logics within rules.