Per-host firewall rules

Per-host firewall rules
* The implementation is ugly (terribleness with tuples, filtering at
  generation time, etc.), but my SML-fu is too weak to do this
  properly in a time efficient manner
* Needs to check if user has some domtool permission to that node, ideally