add ipset support

This is a rebased version of #348 and a fix for MODULES-1173.