add ipset support

This is a rebased version of #348 and a fix for MODULES-1173.
I think desc should include a note about required kernel support.