IPA-style netgroups from bug #498432, revised