Rulesets: Match first or match last?

[Jeremy Evans]

I thought rulesets were supposed to use the first entry that matches, but
I'm doing some testing now and that doesn't seem to be the case.  If I use
this ruleset:

   # filename.rules
   # This file lists which e-mails are scanned for nasty filenames
   From:        jeremye at bsa.ca.gov
/opt/MailScanner/etc/filename.rules.conf
   From:        *@bsa.ca.gov
/opt/MailScanner/etc/filename.allowall.conf
   FromTo:      default
/opt/MailScanner/etc/filename.rules.conf

and send an e-mail from jeremye at bsa.ca.gov with an attached file blocked in
filename.rules.conf, it comes through without any problems.  If I use this
ruleset:

   # filename.rules
   # This file lists which e-mails are scanned for nasty filenames
   From:        *@bsa.ca.gov
/opt/MailScanner/etc/filename.allowall.conf
   From:        jeremye at bsa.ca.gov
/opt/MailScanner/etc/filename.rules.conf
   FromTo:      default
/opt/MailScanner/etc/filename.rules.conf

the attachment is stripped from the file.  Are the rulesets supposed to use
the first entry that matches, or the last one?

Jeremy Evans
Information Systems Analyst
California State Auditor
916-445-0255 phone
916-322-7801 fax