Reduce set of ACL categories to which '-fake' applies
[hcoop/domtool2.git] / src / domain.sml
index 6a70c72..488d7a8 100644 (file)
@@ -1,5 +1,5 @@
 (* HCoop Domtool (http://hcoop.sourceforge.net/)
- * Copyright (c) 2006, Adam Chlipala
+ * Copyright (c) 2006-2007, Adam Chlipala
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
 
 structure Domain :> DOMAIN = struct
 
+open MsgTypes
+
 structure SM = DataStructures.StringMap
+structure SS = DataStructures.StringSet
+
+val ssl_context = ref (NONE : OpenSSL.context option)
+fun set_context ctx = ssl_context := SOME ctx
 
-val nodes = map #2 Config.nodeIps
+val nodes = map #1 Config.nodeIps
 val nodeMap = foldl (fn ((node, ip), mp) => SM.insert (mp, node, ip))
                    SM.empty Config.nodeIps
+fun nodeIp node = valOf (SM.find (nodeMap, node))
+
+val usr = ref ""
+fun getUser () = !usr
+val fakePrivs = ref false
+val isClient = ref false
+
+val your_doms = ref SS.empty
+fun your_domains () = !your_doms
+
+val your_usrs = ref SS.empty
+fun your_users () = !your_usrs
+
+val your_grps = ref SS.empty
+fun your_groups () = !your_grps
+
+val your_pths = ref SS.empty
+fun your_paths () = !your_pths
+
+val your_ipss = ref SS.empty
+fun your_ips () = !your_ipss
+
+val world_readable = SS.addList (SS.empty, Config.worldReadable)
+val readable_pths = ref world_readable
+fun readable_paths () = !readable_pths
+
+fun setUser user =
+    let
+       val () = usr := user
+
+       val your_paths = Acl.class {user = getUser (),
+                                   class = "path"}
+    in
+       fakePrivs := false;
+       your_doms := Acl.class {user = getUser (),
+                               class = "domain"};
+       your_usrs := Acl.class {user = getUser (),
+                               class = "user"};
+       your_grps := Acl.class {user = getUser (),
+                               class = "group"};
+       your_pths := your_paths;
+       readable_pths := SS.union (your_paths, world_readable);
+       your_ipss := Acl.class {user = getUser (),
+                               class = "ip"}
+    end
+
+fun declareClient () = isClient := true
+fun fakePrivileges () = if !isClient then
+                           fakePrivs := true
+                       else
+                           raise Fail "Tried to fake privileges as non-client"
 
 fun validIp s =
     case map Int.fromString (String.fields (fn ch => ch = #".") s) of
@@ -32,22 +89,104 @@ fun validIp s =
        n1 >= 0 andalso n1 < 256 andalso n2 >= 0 andalso n2 < 256 andalso n3 >= 0 andalso n3 < 256 andalso n4 >= 0 andalso n4 < 256
       | _ => false
 
+fun isHexDigit ch = Char.isDigit ch orelse (ord ch >= ord #"a" andalso ord ch <= ord #"f")
+
+fun validIpv6 s =
+    let
+       val fields = String.fields (fn ch => ch = #":") s
+
+       val empties = foldl (fn ("", n) => n + 1
+                             | (_, n) => n) 0 fields
+
+       fun noIpv4 maxLen =
+           length fields >= 2
+           andalso length fields <= maxLen
+           andalso empties <= 1
+           andalso List.all (fn "" => true
+                              | s => size s <= 4
+                                     andalso CharVector.all isHexDigit s) fields
+
+       fun hasIpv4 () =
+           length fields > 0
+           andalso
+           let
+               val maybeIpv4 = List.last fields
+               val theRest = List.take (fields, length fields - 1)
+           in
+               validIp maybeIpv4 andalso noIpv4 6
+           end
+    in
+       noIpv4 8 orelse hasIpv4 ()
+    end
+
 fun isIdent ch = Char.isLower ch orelse Char.isDigit ch
 
 fun validHost s =
-    size s > 0 andalso size s < 20
+    size s > 0 andalso size s < 50
     andalso CharVector.all (fn ch => isIdent ch orelse ch = #"-") s
 
 fun validDomain s =
-    size s > 0 andalso size s < 100
+    size s > 0 andalso size s < 200
     andalso List.all validHost (String.fields (fn ch => ch = #".") s)
 
 fun validNode s = List.exists (fn s' => s = s') nodes
 
+fun yourDomain s = !fakePrivs orelse SS.member (your_domains (), s)
+fun yourUser s = SS.member (your_users (), s)
+fun yourGroup s = SS.member (your_groups (), s)
+fun checkPath paths path =
+    (List.all (fn s => s <> "..") (String.fields (fn ch => ch = #"/") path)
+     andalso CharVector.all (fn ch => Char.isAlphaNum ch orelse ch = #"." orelse ch = #"/"
+                                     orelse ch = #"-" orelse ch = #"_") path
+     andalso SS.exists (fn s' => path = s' orelse String.isPrefix (s' ^ "/") path) (paths ()))
+val yourPath = checkPath your_paths
+val readablePath = checkPath readable_paths
+fun yourIp s = !fakePrivs orelse SS.member (your_ips (), s)
+
+fun yourDomainHost s =
+    !fakePrivs
+    orelse yourDomain s
+    orelse let
+       val (pref, suf) = Substring.splitl (fn ch => ch <> #".") (Substring.full s)
+    in
+       Substring.size suf > 0
+       andalso validHost (Substring.string pref)
+       andalso yourDomain (Substring.string
+                               (Substring.slice (suf, 1, NONE)))
+    end
+
+val yourDomain = yourDomainHost
+
+fun validUser s = size s > 0 andalso size s < 20
+                 andalso CharVector.all Char.isAlphaNum s
+
+fun validEmailUser s =
+    size s > 0 andalso size s < 50
+    andalso CharVector.all (fn ch => Char.isAlphaNum ch
+                                    orelse ch = #"."
+                                    orelse ch = #"_"
+                                    orelse ch = #"-"
+                                    orelse ch = #"+") s
+
+val validGroup = validUser
+
+val _ = Env.type_one "no_spaces"
+                    Env.string
+                    (CharVector.all (fn ch => Char.isPrint ch andalso not (Char.isSpace ch)
+                                              andalso ch <> #"\"" andalso ch <> #"'"))
+val _ = Env.type_one "no_newlines"
+                    Env.string
+                    (CharVector.all (fn ch => Char.isPrint ch andalso ch <> #"\n" andalso ch <> #"\r"
+                                              andalso ch <> #"\""))
+
 val _ = Env.type_one "ip"
        Env.string
        validIp
 
+val _ = Env.type_one "ipv6"
+       Env.string
+       validIpv6
+
 val _ = Env.type_one "host"
        Env.string
        validHost
@@ -56,14 +195,73 @@ val _ = Env.type_one "domain"
        Env.string
        validDomain
 
+val _ = Env.type_one "your_domain"
+       Env.string
+       yourDomain
+
+val _ = Env.type_one "your_domain_host"
+       Env.string
+       yourDomainHost
+
+val _ = Env.type_one "user"
+       Env.string
+       validUser
+
+val _ = Env.type_one "group"
+       Env.string
+       validGroup
+
+val _ = Env.type_one "your_user"
+       Env.string
+       yourUser
+
+val _ = Env.type_one "your_group"
+       Env.string
+       yourGroup
+
+val _ = Env.type_one "your_path"
+       Env.string
+       yourPath
+
+val _ = Env.type_one "readable_path"
+       Env.string
+       readablePath
+
+val _ = Env.type_one "your_ip"
+       Env.string
+       yourIp
+
 val _ = Env.type_one "node"
        Env.string
        validNode
 
+val _ = Env.registerFunction ("your_ip_to_ip",
+                             fn [e] => SOME e
+                              | _ => NONE)
+
+val _ = Env.registerFunction ("dns_node_to_node",
+                             fn [e] => SOME e
+                              | _ => NONE)
+
+val _ = Env.registerFunction ("mail_node_to_node",
+                             fn [e] => SOME e
+                              | _ => NONE)
+
+
 open Ast
 
 val dl = ErrorMsg.dummyLoc
 
+val _ = Env.registerFunction ("end_in_slash",
+                             fn [(EString "", _)] => SOME (EString "/", dl)
+                              | [(EString s, _)] =>
+                                SOME (EString (if String.sub (s, size s - 1) = #"/" then
+                                                   s
+                                               else
+                                                   s ^ "/"), dl)
+                              | _ => NONE)
+
+
 val nsD = (EString Config.defaultNs, dl)
 val serialD = (EVar "serialAuto", dl)
 val refD = (EInt Config.defaultRefresh, dl)
@@ -76,18 +274,28 @@ val soaD = multiApp ((EVar "soa", dl),
                     [nsD, serialD, refD, retD, expD, minD])
 
 val masterD = (EApp ((EVar "internalMaster", dl),
-                    (EString Config.defaultNode, dl)),
+                    (EString Config.masterNode, dl)),
               dl)
 
-val _ = Main.registerDefault ("DNS",
-                             (TBase "dnsKind", dl),
-                             (multiApp ((EVar "useDns", dl),
-                                        dl,
-                                        [soaD, masterD, (EList [], dl)])))
+val slavesD = (EList (map (fn s => (EString s, dl)) Config.slaveNodes), dl)
+
+val _ = Defaults.registerDefault ("Aliases",
+                                 (TList (TBase "your_domain", dl), dl),
+                                 (fn () => (EList [], dl)))
+
+val _ = Defaults.registerDefault ("Mailbox",
+                                 (TBase "email", dl),
+                                 (fn () => (EString (getUser ()), dl)))
+
+val _ = Defaults.registerDefault ("DNS",
+                                 (TBase "dnsKind", dl),
+                                 (fn () => multiApp ((EVar "useDns", dl),
+                                                     dl,
+                                                     [soaD, masterD, slavesD])))
 
-val _ = Main.registerDefault ("TTL",
-                             (TBase "int", dl),
-                             (EInt Config.Bind.defaultTTL, dl))
+val _ = Defaults.registerDefault ("TTL",
+                                 (TBase "int", dl),
+                                 (fn () => (EInt Config.Bind.defaultTTL, dl)))
 
 type soa = {ns : string,
            serial : int option,
@@ -124,7 +332,13 @@ datatype master =
         ExternalMaster of string
        | InternalMaster of string
 
-val master = fn (EApp ((EVar "externalMaster", _), e), _) => Option.map ExternalMaster (Env.string e)
+val ip = Env.string
+
+val _ = Env.registerFunction ("ip_of_node",
+                             fn [(EString node, _)] => SOME (EString (nodeIp node), dl)
+                              | _ => NONE)
+
+val master = fn (EApp ((EVar "externalMaster", _), e), _) => Option.map ExternalMaster (ip e)
              | (EApp ((EVar "internalMaster", _), e), _) => Option.map InternalMaster (Env.string e)
              | _ => NONE
 
@@ -144,6 +358,7 @@ val dnsKind = fn (EApp ((EApp ((EApp
                                    master = mstr,
                                    slaves = slaves})
                    | _ => NONE)
+              | (EVar "noDns", _) => SOME NoDns
               | _ => NONE
 
 val befores = ref (fn (_ : string) => ())
@@ -163,16 +378,57 @@ fun registerAfter f =
        afters := (fn x => (old x; f x))
     end
 
+val globals = ref (fn () => ())
+val locals = ref (fn () => ())
+
+fun registerResetGlobal f =
+    let
+       val old = !globals
+    in
+       globals := (fn x => (old x; f x))
+    end
+
+fun registerResetLocal f =
+    let
+       val old = !locals
+    in
+       locals := (fn x => (old x; f x))
+    end
+
+fun resetGlobal () = (!globals ();
+                     ignore (OS.Process.system (Config.rm ^ " -rf " ^ Config.resultRoot ^ "/*")))
+fun resetLocal () = !locals ()
+
 val current = ref ""
 val currentPath = ref (fn (_ : string) => "")
+val currentPathAli = ref (fn (_ : string, _ : string) => "")
 
 val scratch = ref ""
 
 fun currentDomain () = !current
 
+val currentsAli = ref ([] : string list)
+
+fun currentAliasDomains () = !currentsAli
+fun currentDomains () = currentDomain () :: currentAliasDomains ()
+
 fun domainFile {node, name} = ((*print ("Opening " ^ !currentPath node ^ name ^ "\n");*)
                               TextIO.openOut (!currentPath node ^ name))
 
+type files = {write : string -> unit,
+             writeDom : unit -> unit,
+             close : unit -> unit}
+
+fun domainsFile {node, name} =
+    let
+       val doms = currentDomains ()
+       val files = map (fn dom => (dom, TextIO.openOut (!currentPathAli (dom, node) ^ name))) doms
+    in
+       {write = fn s => app (fn (_, outf) => TextIO.output (outf, s)) files,
+        writeDom = fn () => app (fn (dom, outf) => TextIO.output (outf, dom)) files,
+        close = fn () => app (fn (_, outf) => TextIO.closeOut outf) files}
+    end
+
 fun getPath domain =
     let
        val toks = String.fields (fn ch => ch = #".") domain
@@ -217,7 +473,7 @@ datatype file_action' =
        | Delete' of string
        | Modify' of {src : string, dst : string}
 
-fun findDiffs (site, dom, acts) =
+fun findDiffs (prefixes, site, dom, acts) =
     let
        val gp = getPath dom
        val realPath = gp (Config.resultRoot, site)
@@ -245,8 +501,10 @@ fun findDiffs (site, dom, acts) =
                            loopReal acts
                        else
                            loopReal ((site, dom, realPath, Modify' {src = tmp, dst = real}) :: acts)
-                   else
+                   else if List.exists (fn prefix => String.isPrefix prefix real) prefixes then
                        loopReal ((site, dom, realPath, Delete' real) :: acts)
+                   else
+                       loopReal acts
                end
 
        val acts = loopReal acts
@@ -277,7 +535,7 @@ fun findDiffs (site, dom, acts) =
        acts
     end
 
-fun findAllDiffs () =
+fun findAllDiffs prefixes =
     let
        val dir = Posix.FileSys.opendir Config.tmpDir
        val len = length (String.fields (fn ch => ch = #"/") Config.tmpDir) + 1
@@ -309,7 +567,7 @@ fun findAllDiffs () =
                                                                                        file = name}
                                                  in
                                                      explore (dname',
-                                                              findDiffs (site, dom, diffs))
+                                                              findDiffs (prefixes, site, dom, diffs))
                                                  end
                                              else
                                                  diffs)
@@ -319,8 +577,8 @@ fun findAllDiffs () =
                            before Posix.FileSys.closedir dir
                        end
                in
-                   explore (OS.Path.joinDirFile {dir = Config.tmpDir,
-                                                 file = site}, diffs)
+                   exploreSites (explore (OS.Path.joinDirFile {dir = Config.tmpDir,
+                                                               file = site}, diffs))
                end
     in
        exploreSites []
@@ -330,64 +588,80 @@ fun findAllDiffs () =
 val masterNode : string option ref = ref NONE
 fun dnsMaster () = !masterNode
 
+val seenDomains : string list ref = ref []
+
 val _ = Env.containerV_one "domain"
                           ("domain", Env.string)
                           (fn (evs, dom) =>
                               let
+                                  val () = seenDomains := dom :: !seenDomains
+
                                   val kind = Env.env dnsKind (evs, "DNS")
                                   val ttl = Env.env Env.int (evs, "TTL")
+                                  val aliases = Env.env (Env.list Env.string) (evs, "Aliases")
 
                                   val path = getPath dom
 
                                   val () = (current := dom;
-                                            currentPath := (fn site => path (Config.tmpDir, site)))
+                                            currentsAli := Slave.remove (Slave.removeDups aliases, dom);
+                                            currentPath := (fn site => path (Config.tmpDir, site));
+                                            currentPathAli := (fn (dom, site) => getPath dom (Config.tmpDir, site)))
 
                                   fun saveSoa (kind, soa : soa) node =
                                       let
-                                          val outf = domainFile {node = node, name = "soa"}
+                                          val {write, writeDom, close} = domainsFile {node = node, name = "soa"}
                                       in
-                                          TextIO.output (outf, kind);
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, Int.toString ttl);
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, #ns soa);
-                                          TextIO.output (outf, "\n");
+                                          write kind;
+                                          write "\n";
+                                          write (Int.toString ttl);
+                                          write "\n";
+                                          write (#ns soa);
+                                          write "\n";
                                           case #serial soa of
                                               NONE => ()
-                                            | SOME n => TextIO.output (outf, Int.toString n);
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, Int.toString (#ref soa));
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, Int.toString (#ret soa));
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, Int.toString (#exp soa));
-                                          TextIO.output (outf, "\n");
-                                          TextIO.output (outf, Int.toString (#min soa));
-                                          TextIO.output (outf, "\n");
-                                          TextIO.closeOut outf
+                                            | SOME n => write (Int.toString n);
+                                          write "\n";
+                                          write (Int.toString (#ref soa));
+                                          write "\n";
+                                          write (Int.toString (#ret soa));
+                                          write "\n";
+                                          write (Int.toString (#exp soa));
+                                          write "\n";
+                                          write (Int.toString (#min soa));
+                                          write "\n";
+                                          close ()
                                       end
 
-                                  fun saveNamed (kind, soa : soa, masterIp) node =
-                                      let
-                                          val outf = domainFile {node = node, name = "named.conf"}
-                                      in
-                                          TextIO.output (outf, "\nzone \"");
-                                          TextIO.output (outf, dom);
-                                          TextIO.output (outf, "\" IN {\n\ttype ");
-                                          TextIO.output (outf, kind);
-                                          TextIO.output (outf, ";\n\tfile \"");
-                                          TextIO.output (outf, Config.Bind.zonePath);
-                                          TextIO.output (outf, "/");
-                                          TextIO.output (outf, dom);
-                                          TextIO.output (outf, ".zone\";\n");
-                                          case kind of
-                                              "master" => TextIO.output (outf, "\tallow-update { none; };\n")
-                                            | _ => (TextIO.output (outf, "\tmasters { ");
-                                                    TextIO.output (outf, masterIp);
-                                                    TextIO.output (outf, " };\n"));
-                                          TextIO.output (outf, "};\n");
-                                          TextIO.closeOut outf
-                                      end
+                                  fun saveNamed (kind, soa : soa, masterIp, slaveIps) node =
+                                      if dom = "localhost" then
+                                          ()
+                                      else let
+                                              val {write, writeDom, close} = domainsFile {node = node, name = "named.conf"}
+                                          in
+                                              write "\nzone \"";
+                                              writeDom ();
+                                              write "\" {\n\ttype ";
+                                              write kind;
+                                              write ";\n\tfile \"";
+                                              write Config.Bind.zonePath_real;
+                                              write "/";
+                                              writeDom ();
+                                              write ".zone\";\n";
+                                              case kind of
+                                                  "master" => (write "\tallow-transfer {\n";
+                                                               app (fn ip => (write "\t\t";
+                                                                              write ip;
+                                                                              write ";\n")) slaveIps;
+                                                               write "\t};\n")
+                                                | _ => (write "\tmasters { ";
+                                                        write masterIp;
+                                                        write "; };\n";
+                                                        write "// Updated: ";
+                                                        write (Time.toString (Time.now ()));
+                                                        write "\n");
+                                              write "};\n";
+                                              close ()
+                                          end
                               in
                                   case kind of
                                       NoDns => masterNode := NONE
@@ -395,23 +669,26 @@ val _ = Env.containerV_one "domain"
                                       let
                                           val masterIp =
                                               case #master dns of
-                                                  InternalMaster node => valOf (SM.find (nodeMap, node))
+                                                  InternalMaster node => nodeIp node
                                                 | ExternalMaster ip => ip
+
+                                          val slaveIps = map nodeIp (#slaves dns)
                                       in
                                           app (saveSoa ("slave", #soa dns)) (#slaves dns);
-                                          app (saveNamed ("slave", #soa dns, masterIp)) (#slaves dns);
+                                          app (saveNamed ("slave", #soa dns, masterIp, slaveIps)) (#slaves dns);
                                           case #master dns of
                                               InternalMaster node =>
                                               (masterNode := SOME node;
                                                saveSoa ("master", #soa dns) node;
-                                               saveNamed ("master", #soa dns, masterIp) node)
-                                            | _ => masterNode := NONE;
-                                          !befores dom
-                                      end
+                                               saveNamed ("master", #soa dns, masterIp, slaveIps) node)
+                                            | _ => masterNode := NONE
+                                      end;
+                                  !befores dom
                               end,
                            fn () => !afters (!current))
 
-val () = Env.registerPre (fn () => (ignore (Slave.shellF ([Config.rm, " -rf ", Config.tmpDir, ""],
+val () = Env.registerPre (fn () => (seenDomains := [];
+                                   ignore (Slave.shellF ([Config.rm, " -rf ", Config.tmpDir, ""],
                                                       fn cl => "Temp file cleanup failed: " ^ cl));
                                    OS.FileSys.mkDir Config.tmpDir;
                                    app (fn node => OS.FileSys.mkDir
@@ -424,9 +701,49 @@ val () = Env.registerPre (fn () => (ignore (Slave.shellF ([Config.rm, " -rf ", C
                                            handle OS.SysErr _ => ())
                                        nodes))
 
+fun handleSite (site, files) =
+    let
+       
+    in
+       print ("New configuration for node " ^ site ^ "\n");
+       if site = Config.defaultNode then
+           Slave.handleChanges files
+       else let
+               val bio = OpenSSL.connect true (valOf (!ssl_context),
+                                               nodeIp site
+                                               ^ ":"
+                                               ^ Int.toString Config.slavePort)
+           in
+               app (fn file => Msg.send (bio, MsgFile file)) files;
+               Msg.send (bio, MsgDoFiles);
+               case Msg.recv bio of
+                   NONE => print "Slave closed connection unexpectedly\n"
+                 | SOME m =>
+                   case m of
+                       MsgOk => print ("Slave " ^ site ^ " finished\n")
+                     | MsgError s => print ("Slave " ^ site
+                                            ^ " returned error: " ^
+                                            s ^ "\n")
+                     | _ => print ("Slave " ^ site
+                                   ^ " returned unexpected command\n");
+               OpenSSL.close bio
+           end
+    end
+
 val () = Env.registerPost (fn () =>
                              let
-                                 val diffs = findAllDiffs ()
+                                 val prefixes = List.concat
+                                                    (List.map (fn dom =>
+                                                                  let
+                                                                      val pieces = String.tokens (fn ch => ch = #".") dom
+                                                                      val path = String.concatWith "/" (rev pieces)
+                                                                  in
+                                                                      List.map (fn node =>
+                                                                                   Config.resultRoot ^ "/" ^ node ^ "/" ^ path ^ "/")
+                                                                               nodes
+                                                                  end) (!seenDomains))
+                                                                 
+                                 val diffs = findAllDiffs prefixes
 
                                  val diffs = map (fn (site, dom, dir, Add' {src, dst}) =>
                                                      (Slave.shellF ([Config.cp, " ", src, " ", dst],
@@ -441,7 +758,7 @@ val () = Env.registerPost (fn () =>
                                                       handle OS.SysErr _ =>
                                                              ErrorMsg.error NONE ("Delete failed for " ^ dst);
                                                       (site,
-                                                       {action = Slave.Delete,
+                                                       {action = Slave.Delete true,
                                                         domain = dom,
                                                         dir = dir,
                                                         file = dst}))
@@ -456,12 +773,220 @@ val () = Env.registerPost (fn () =>
                              in
                                  if !ErrorMsg.anyErrors then
                                      ()
-                                 else
-                                     Slave.handleChanges (map #2 diffs);
+                                 else let
+                                         val changed = foldl (fn ((site, file), changed) =>
+                                                                 let
+                                                                     val ls = case SM.find (changed, site) of
+                                                                                  NONE => []
+                                                                                | SOME ls => ls
+                                                                 in
+                                                                     SM.insert (changed, site, file :: ls)
+                                                                 end) SM.empty diffs
+                                     in
+                                         SM.appi handleSite changed
+                                     end;
                                  ignore (Slave.shellF ([Config.rm, " -rf ", Config.tmpDir, ""],
                                                     fn cl => "Temp file cleanup failed: " ^ cl))
                              end)
 
+fun hasPriv priv = Acl.query {user = getUser (), class = "priv", value = "all"}
+                  orelse Acl.query {user = getUser (), class = "priv", value = priv}
+
+val _ = Env.type_one "dns_node"
+       Env.string
+       (fn node =>
+           List.exists (fn x => x = node) Config.dnsNodes_all
+           orelse (hasPriv "dns"
+                   andalso List.exists (fn x => x = node) Config.dnsNodes_admin))
+
+val _ = Env.type_one "mail_node"
+       Env.string
+       (fn node =>
+           List.exists (fn x => x = node) Config.mailNodes_all
+           orelse (hasPriv "mail"
+                   andalso List.exists (fn x => x = node) Config.mailNodes_admin))
+
+fun rmdom' delete resultRoot doms =
+    let
+       fun doNode (node, _) =
+           let
+               val dname = OS.Path.joinDirFile {dir = resultRoot,
+                                                file = node}
+
+               fun doDom (dom, actions) =
+                   let
+                       val domPath = String.concatWith "/" (rev (String.fields (fn ch => ch = #".") dom))
+                       val dname = OS.Path.concat (dname, domPath)
+
+                       fun visitDom (dom, dname, actions) =
+                           let
+                               val dir = Posix.FileSys.opendir dname
+
+                               fun loop actions =
+                                   case Posix.FileSys.readdir dir of
+                                       NONE => actions
+                                     | SOME fname =>
+                                       let
+                                           val fnameFull = OS.Path.joinDirFile {dir = dname,
+                                                                                file = fname}
+                                       in
+                                           if Posix.FileSys.ST.isDir (Posix.FileSys.stat fnameFull) then
+                                               loop (visitDom (fname ^ "." ^ dom,
+                                                               fnameFull,
+                                                               actions))
+                                           else                        
+                                                loop ({action = Slave.Delete delete,
+                                                       domain = dom,
+                                                       dir = dname,
+                                                       file = fnameFull} :: actions)
+                                       end
+                           in
+                               loop actions
+                               before Posix.FileSys.closedir dir
+                           end
+                               handle OS.SysErr (s, _) =>
+                                      (print ("Warning: System error deleting domain " ^ dom ^ " on " ^ node ^ ": " ^ s ^ "\n");
+                                       actions)
+                   in
+                       visitDom (dom, dname, actions)
+                   end
+
+               val actions = foldl doDom [] doms
+           in
+               handleSite (node, actions)
+           end
+               handle IO.Io _ => print ("Warning: IO error deleting domains on " ^ node ^ ".\n")
+
+       fun cleanupNode (node, _) =
+           let
+               fun doDom dom =
+                   let
+                       val domPath = String.concatWith "/" (rev (String.fields (fn ch => ch = #".") dom))
+                       val dname = OS.Path.joinDirFile {dir = resultRoot,
+                                                        file = node}
+                       val dname = OS.Path.concat (dname, domPath)
+                   in
+                       if delete then
+                           ignore (OS.Process.system (Config.rm ^ " -rf " ^ dname))
+                       else
+                           ()
+                   end
+           in
+               app doDom doms
+           end
+    in
+       app doNode Config.nodeIps;
+       app cleanupNode Config.nodeIps
+    end
+
+val rmdom = rmdom' true Config.resultRoot
+val rmdom' = rmdom' false
+
+fun homedirOf uname =
+    Posix.SysDB.Passwd.home (Posix.SysDB.getpwnam uname)
+
+fun homedir () = homedirOf (getUser ())
+
+type subject = {node : string, domain : string}
+
+val describers : (subject -> string) list ref = ref []
+
+fun registerDescriber f = describers := f :: !describers
+
+fun describeOne arg = String.concat (map (fn f => f arg) (rev (!describers)))
+
+val line = "--------------------------------------------------------------\n"
+val dline = "==============================================================\n"
+
+fun describe dom =
+    String.concat (List.mapPartial
+                      (fn node =>
+                          case describeOne {node = node, domain = dom} of
+                              "" => NONE
+                            | s =>
+                              SOME (String.concat [dline, "Node ", node, "\n", dline, "\n", s]))
+                      nodes)
+
+datatype description =
+        Filename of { filename : string, heading : string, showEmpty : bool }
+       | Extension of { extension : string, heading : string -> string }
+                       
+fun considerAll ds {node, domain} =
+    let
+       val ds = map (fn d => (d, ref [])) ds
+
+       val path = Config.resultRoot
+       val jdf = OS.Path.joinDirFile
+       val path = jdf {dir = path, file = node}
+       val path = foldr (fn (more, path) => jdf {dir = path, file = more})
+                        path (String.tokens (fn ch => ch = #".") domain)
+    in
+       if Posix.FileSys.access (path, []) then
+           let
+               val dir = Posix.FileSys.opendir path
+
+               fun loop () =
+                   case Posix.FileSys.readdir dir of
+                       NONE => ()
+                     | SOME fname =>
+                       (app (fn (d, entries) =>
+                                let
+                                    fun readFile showEmpty entries' =
+                                        let
+                                            val fname = OS.Path.joinDirFile {dir = path,
+                                                                             file = fname}
+
+                                            val inf = TextIO.openIn fname
+
+                                            fun loop (seenOne, entries') =
+                                                case TextIO.inputLine inf of
+                                                    NONE => if seenOne orelse showEmpty then
+                                                                "\n" :: entries'
+                                                            else
+                                                                !entries
+                                                  | SOME line => loop (true, line :: entries')
+                                        in
+                                            loop (false, entries')
+                                            before TextIO.closeIn inf
+                                        end
+                                in
+                                    case d of
+                                        Filename {filename, heading, showEmpty} =>
+                                        if fname = filename then
+                                            entries := readFile showEmpty ("\n" :: line :: "\n" :: heading :: line :: !entries)
+                                        else
+                                            ()
+                                      | Extension {extension, heading} =>
+                                        let
+                                            val {base, ext} = OS.Path.splitBaseExt fname
+                                        in
+                                            case ext of
+                                                NONE => ()
+                                              | SOME extension' =>
+                                                if extension' = extension then
+                                                    entries := readFile true ("\n" :: line :: "\n" :: heading base :: line :: !entries)
+                                                else
+                                                    ()
+                                        end
+                                end) ds;
+                        loop ())
+           in
+               loop ();
+               Posix.FileSys.closedir dir;
+               String.concat (List.concat (map (fn (_, entries) => rev (!entries)) ds))
+           end
+       else
+           ""
+    end
+
+val () = registerDescriber (considerAll [Filename {filename = "soa",
+                                                  heading = "DNS SOA:",
+                                                  showEmpty = false}])
 
+val () = Env.registerAction ("domainHost",
+                            fn (env, [(EString host, _)]) =>
+                               SM.insert (env, "Hostname",
+                                          (EString (host ^ "." ^ currentDomain ()), dl))
+                             | (_, args) => Env.badArgs ("domainHost", args))
 
 end