Description of problem:

It is possible to add invalid hostnames to netgroups with ipa netgroup-mod
--addattr and --setaddr.  This is being split out of bug 797256 into a separate
bug here.

# ipa netgroup-add test1 --desc=asdf
----------------------
Added netgroup "test1"
----------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  IPA unique ID: 9a65ec84-7ccf-11e1-9e50-525400a8d770


# ipa netgroup-mod test1 --setattr=externalhost=anotherbadhost?
-------------------------
Modified netgroup "test1"
-------------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  External host: anotherbadhost?


# ipa netgroup-mod test1
--addattr=externalhost=anotherbadhost\!\@\#$\%\^\&\*\(\)
-------------------------
Modified netgroup "test1"
-------------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  External host: anotherbadhost?, anotherbadhost!@#$%^&*()

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.  <setup IPA server>
2.  ipa netgroup-add test1 --desc=asdf
3.  ipa netgroup-mod test1 --setattr=externalhost=anotherbadhost?
4.  ipa netgroup-mod test1
--addattr=externalhost=anotherbadhost\!\@\#$\%\^\&\*\(\)


Actual results:

External hosts with invalid characters in hostname are added to netgroup.  See
output in Description for examples.

Expected results:

Should there be some validation of valid characters for externalhost (and other
attrs) from the addattr/setaddr options for the netgroup-mod command (and
others)?


Additional info: