netfilter: ipset: Check CIDR value only when attribute is given