Rulesets: Match first or match last?

[Julian Field]

The Filename Rules option concatenates all the matching rule results
together, then uses that as the set of allow/deny rules for the attachment
filenames.

It only uses the "default" setting if none of the other rules match.


At 00:04 04/07/2003, you wrote:
>I thought rulesets were supposed to use the first entry that matches, but
>I'm doing some testing now and that doesn't seem to be the case.  If I use
>this ruleset:
>
>    # filename.rules
>    # This file lists which e-mails are scanned for nasty filenames
>    From:        jeremye at bsa.ca.gov
>/opt/MailScanner/etc/filename.rules.conf
>    From:        *@bsa.ca.gov
>/opt/MailScanner/etc/filename.allowall.conf
>    FromTo:      default
>/opt/MailScanner/etc/filename.rules.conf
>
>and send an e-mail from jeremye at bsa.ca.gov with an attached file blocked in
>filename.rules.conf, it comes through without any problems.  If I use this
>ruleset:
>
>    # filename.rules
>    # This file lists which e-mails are scanned for nasty filenames
>    From:        *@bsa.ca.gov
>/opt/MailScanner/etc/filename.allowall.conf
>    From:        jeremye at bsa.ca.gov
>/opt/MailScanner/etc/filename.rules.conf
>    FromTo:      default
>/opt/MailScanner/etc/filename.rules.conf
>
>the attachment is stripped from the file.  Are the rulesets supposed to use
>the first entry that matches, or the last one?
>
>Jeremy Evans
>Information Systems Analyst
>California State Auditor
>916-445-0255 phone
>916-322-7801 fax

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support