# untested, but close.
$blocked = Cache::FileCache->new(
  cache_root => '/wherever/blocked_hosts',
  default_expires_in => '30 days',
) or die "no cache!\n";

sub block {   # block($ip,$howlong)
  $blocked->set($_[0], 1, $_[1]);  
}

sub is_blocked {  # is_blocked($ip) -> undef or 1
  $blocked->get($_[0]);
}

sub unblock {  # unblock($ip)
  block($_[0], 'now');  # expire 'now', $ip go poof!
}


block('192.168.254.1');   # 30 days
block('192.168.254.12','6 months');
deny_access if is_blocked('192.168.254.1');
unblock('192.168.254.1');
block('192.168.254.13', 'never');  # block forever!

##</code><code>##

$is_blocked = $dbh->prepare('
SELECT 1 FROM blocks WHERE
( ? & mask ) == ( ip & mask )
');

deny_access if ($is_blocked->execute(ip2int('192.168.254.1')));

# blocks
#  ip integer,
#  mask integer
1.0.0.0  == 16777216
1.1.0.0  == 16842752
1.1.1.1  == 16843009
255.255.0.0 == 4294901760

16777216 & 4294901760 == 16777216
16842752 & 4294901760 == 16842752
16843009 & 4294901760 == 16842752

so... blocks
ip          mask
16842752    4294901760   (1.1.0.0 255.255.0.0)

will block everything under 1.1.0.0/16

##</code><code>##

tie %blocks, 'Tie::Foo', 'the_block_file';
sub block { $blocks{shift} = 1 }
sub unblock { delete $blocks{shift} }
sub is_blocked { exists $blocks{shift} }