Using a dictionary object might be prettier but this did the trick for me.
I also increased the block duration to an hour and added "ftp" as username to block immediately.
Added simple whitelisting feature.
I'm probably not going to merge this commit but I certainly appreciate the contribution. I've got about 12 hours now into code to use registry parameters for whitelisting individual IP addresses or entire subnets. I'm in a busy time of year right now and haven't had time to do any significant testing of the code but it's written and waiting to be integrated.
Would you be interested in testing the code out? It's probably still 4 - 6 hours of work away from being integrated into ts_block (I wrote the code as a generic module for handling IP subnets, storing them in a binary tree, and querying the tree to determine if addresses are included / excluded from the tree.) If you are, I'll try to accelerate the effort to get you some code in the next couple weeks. (Work is really, really crazy right now...)