Thanks! That is a pretty easy approach indeed. But the source & destination network are still a problem though.

If I find a "any" or "host X.X.X.X" entry in the line, how to help the interpreter to determine if it is source or destination.

Actually the same limitation exists for the regex $re_protocols as well. It wouldn't know the difference between object-group entry for protocol, source network or a destination network.