how to findclass with client IP matching string

As you found, I don't think it will work with a single class. You could create two classes and then use matchclass and findclass. Or you could create an array with three elements (network, mask, gateway) and use IP::addr with the client IP and the first two elements to find a match.

Here's a quick example for using two classes:

when RULE_INIT {
   log local0. "\$::address_class: $::address_class"
   log local0. "\$::gw_class: $::gw_class"
   log local0. "\[matchclass 10.100.0.1 equals \$::address_class\]: [matchclass 10.100.0.1 equals $::address_class]"
   log local0. "[findclass [matchclass 10.100.0.1 equals $::address_class] $gw_class " "]"
   log local0. "\[matchclass 192.168.2.2 equals \$::address_class\]: [matchclass 192.168.2.2 equals $::address_class]"
   log local0. "[findclass [matchclass 192.168.2.2 equals $::address_class] $gw_class " "]"
}

With two classes:

class address_class  {
   network 10.0.0.0 mask 255.0.0.0
   network 172.16.0.0 mask 255.240.0.0
   network 192.168.0.0 mask 255.255.0.0
}

class gw_class  {
   "1 10.1.1.1"
   "2 172.16.0.1"
   "3 192.168.0.1"
}

The log output is:

 $::address_class: {10.0.0.0/8} {172.16.0.0/12} {192.168.0.0/16}
 $::gw_class: {2 172.16.0.1} {1 10.1.1.1} {3 192.168.0.1}
 [matchclass 10.100.0.1 equals $::address_class]: 1
 10.1.1.1
 [matchclass 192.168.2.2 equals $::address_class]: 3
 192.168.0.1

With that said, an array might be a cleaner solution.

Aaron