Which rule wins when several Tattle rules match a connection?

What a rule can say

A rule allows or blocks connections for an app (or any app), to a destination (anywhere, a domain, a domain and its subdomains, an address or a range of addresses), optionally on certain ports, over TCP or UDP, in one direction, and only on the local network or only on the internet. It can last for good, for an hour, or until the app quits. Each rule is shown as a sentence, such as “Block Photo Editor connecting to telemetry.example.net”.

Apps are recognised by their code signature (their signing identifier and developer team), so a rule keeps applying after the app updates. Apps without a signature are recognised by where they are on disk. If an app’s signature changes, Tattle lists it under Alerts.

How Tattle chooses

1. Block All, if it is on, blocks everything.

2. Otherwise Tattle looks at every rule that matches and takes the most specific. A rule that names the app is more specific than one for any app. Then the destination: an exact domain beats a domain with its subdomains (a longer name beats a shorter one), which beats an address range (a narrower range beats a wider one), which beats “the local network” or “the internet”, which beats anywhere. Then a port, then the protocol, direction and network.

3. When two matching rules are just as specific, your own rules beat blocklist entries, and a block beats an allow.

4. If no rule matches, the mode decides: Allow and watch allows, Ask asks, Lockdown blocks.

An example

Say you have “Block any app connecting to ads.example.net and its subdomains” and “Allow PDF Reader connecting to ads.example.net”. PDF Reader can reach that host, because a rule naming the app is more specific; every other app is still blocked there.

The main window explains every verdict: select a connection under Connections and the “Why” pane names the rule (or the mode) that decided it.