add ipset support

This is a rebased version of #348 and a fix for MODULES-1173.
Yeah, I think that's a good idea.