Basic syntax
	FILE ::= EMPTY | FILE STMT [`;']
	STMT ::= OPTION-STMT | FW-STMT
	FW-STMT ::= `fw' SOURCE OPTIONS [`to'|`->'] TARGET OPTIONS
	OPTIONS ::= `{' OPTION-SEQ `}'
	OPTION-SEQ ::= EMPTY | OPTION-STMT [`;'] OPTION-SEQ

Option syntax
	OPTION-STMT ::= Q-OPTION
	Q-OPTION ::= OPTION
	     | PREFIX `.' Q-OPTION
	     | PREFIX `{' OPTION-SEQ `}'
	PREFIX ::= WORD

File source and target
	SOURCE ::= FILE
	TARGET ::= FILE
	FILE ::= `file' [`.'] FSPEC [`,' FSPEC]
	FSPEC ::= FD-SPEC | NAME-SPEC | NULL-SPEC
	FD-SPEC ::= [[`:']`fd'[`:']] NUMBER|`stdin'|`stdout'
	NAME-SPEC ::= [[`:']`file'[`:']] FILE-NAME
	FILE-NAME ::= PATH-SEQ | [ PATH-SEQ ]
	PATH-SEQ ::= PATH-ELT | PATH-SEQ PATH-ELT
	PATH-ELT ::= `/' | WORD
	NULL-SPEC ::= [`:']`null'[`:']

Exec source and target
	SOURCE ::= EXEC
	TARGET ::= EXEC
	EXEC ::= `exec' [`.'] CMD-SPEC
	CMD-SPEC ::= SHELL-CMD | [PROG-NAME] `[' ARGV0 ARG-SEQ `]'
	ARG-SEQ ::= WORD | ARG-SEQ WORD
	SHELL-CMD ::= WORD
	ARGV0 ::= WORD

Socket source and target
	SOURCE ::= SOCKET-SOURCE
	TARGET ::= SOCKET-TARGET
	SOCKET-SOURCE ::= [`socket'[`.']] [[`:']ADDR-TYPE[`:']] SOURCE-ADDR
	SOCKET-TARGET ::= [`socket'[`.']] [[`:']ADDR-TYPE[`:']] TARGET-ADDR

	INET-SOURCE-ADDR ::= [`port'] PORT
	INET-TARGET-ADDR ::= ADDRESS [`:'] PORT
	ADDRESS ::= ADDR-ELT | ADDRESS ADDR-ELT
	ADDR-ELT ::= `.' | WORD

	UNIX-SOURCE-ADDR ::= FILE-NAME
	UNIX-TARGET-ADDR ::= FILE-NAME

File attributes (`fattr')
	PREFIX.fattr.mode [=] MODE
	PREFIX.fattr.owner [=] USER
	PREFIX.fattr.group [=] GROUP

File options
	file.create [=] yes|no
	file.open [=] no|truncate|append
	file.fattr.*

Exec options
	exec.logging [=] yes|no
	exec.dir [=] FILE-NAME
	exec.root [=] FILE-NAME
	exec.user [=] USER
	exec.group [=] GROUP
	exec.rlimit.LIMIT[.hard|.soft] [=] VALUE
	exec.env.clear
	exec.env.unset VAR
	exec.env.[set] VAR [=] VALUE

Socket options
	socket.conn [=] NUMBER|unlimited|one-shot
	socket.logging [=] yes|no

	socket.inet.source.[allow|deny] priv-port
	socket.inet.source.[allow|deny] [host] ADDR [/ ADDR]
	socket.inet.source.addr [=] any|ADDR
	socket.inet.dest.addr [=] any|ADDR
	oscket.inet.dest.priv-port [=] yes|no

	socket.unix.source.fattr.*