avoid multiple calls to ipset_get_chains()