what are the intended semantics of paircompare()?

[Alan DeKok]

John Dennis wrote:
> I'm in the process of debugging a problem and it seems to me
> paircompare() (in src/main/valuepair.c) is returning the wrong result.
> But I might be ascribing the wrong semantics to the function. Here is
> what I think it's supposed to do, is this correct?

  The semantics are... what's grown over time, to be compatible with the
historical implementation of the "users" file.

> If any check attribute matches (according to it's operator) any
> attribute of the same attribute type in the request then return 0 else
> return ~0.
> 
> Phrased another way it's a short circuit "logical or", e.g. as long as
> something matches it succeeds.

  Pretty much.

> If that is the intended semantics then I think there are couple of bugs
> in it and I'll provide a patch along with an explanation, otherwise
> could you set me straight on what it's behaviour is supposed to be?

  I think the main issues are that (foo != bar) SHOULD be !(foo == bar),
and it's not.  They're different.

  I'll look at the patches, but I'm very wary of changing the
functionality.  There are 100,000 sites using this code, and I want to
be sure any change will have limited effect.

  Alan DeKok.