netXX-lsearch to net-iplsearch, request to clarify

hg user via Exim-users <[email protected]> Wed, 17 Jun 2026 15:11:51 +0200
Newsgroups gmane.mail.exim.user
Message-ID <CANRteqBYLrXjoMg66AKUjQb+nJJ6_MywY4THzFewPZn4+xdqrg@mail.gmail.com>
Hi,
my coworker (RIP) insisted on creating a rule with this syntax:
  drop    message = invalid IP
            hosts = !net-lsearch;ETC/allowed-by-ip : \
                    !net32-lsearch;ETC/allowed-by-ip : \
                    !net24-lsearch;ETC/allowed-by-ip : \
                    !net16-lsearch;ETC/allowed-by-ip : \
                    !net8-lsearch;ETC/allowed-by-ip : \
                    net-lsearch;ETC/rejected-by-ip : \
                    net32-lsearch;ETC/rejected-by-ip : \
                    net24-lsearch;ETC/rejected-by-ip : \
                    net16-lsearch;ETC/rejected-by-ip : \
                    net8-lsearch;ETC/rejected-by-ip

The idea is that the email is not accepted if the IP is not in
allowed-by-ip and is in rejected-by-ip.

In those files I have something like
10.0.0.0/8
or
1.1.1.1/32

Since I have these block in tens of acl rules, working on different files,
I was thinking about changing to something like

  drop    message = invalid IP
            hosts = !net-iplsearch;ETC/allowed-by-ip : \
                    net-iplsearch;ETC/rejected-by-ip

>From what I understand, net-iplsearch does a sequential scan since it has
to check for IP included in a range, like 10.1.1.1 is included in
10.0.0.0/32
The previous (really old) configuration was needed so that 10.1.1.1 was
converted by net8 to "10.0.0.0/8" and this valued used as a key...

Is this correct ?

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki