I object to the entire whitelist and blacklist thing, because it's not implemented the way they're supposed to be... each should be explicit "accept" and "reject" rules, with the ability to explicitly "*" them with wildcard rules or "reject all". 

This, what we've got, is good enough to accomplish what we need to do. 
I'll add some comments to the code to document how it works. 

If you're willing to let this one go, so am I.