#!/bin/bash
# Author: Iain Douglas <centos@1n6.org.uk>
#

function ExitFail {
    t_Log "FAIL"
    exit $FAIL
}

t_Log "Runing $0 - normal user password tests"
# Check that the passtest user cannot use the root only options 

t_Log "Checking a normal user cannot use root options"

su passtest -c "passwd -l passtest" &>/dev/null && ExitFail
su passtest -c "passwd -u passtest" &>/dev/null && ExitFail
su passtest -c "passwd -e passtest" &>/dev/null && ExitFail
su passtest -c "passwd -n 10 passtest" &>/dev/null && ExitFail
su passtest -d "passwd -d passtest" &>/dev/null && ExitFail
su passtest -d "passwd -S passtest" &>/dev/null && ExitFail
t_Log "Pass"

# Check the user can change their own password. Reset it to passtest and
# turn off min change days before trying. Password becomes ano24ther

t_Log "Test user can change own password"

echo "passtest" | passwd --stdin passtest &>/dev/null
passwd -n 0 passtest &>/dev/null
./tests/p_passwd/_user_password.expect &>/dev/null
t_CheckExitStatus $?

# Check that sending the wrong current password fails we send passtest

t_Log "Check sending incorrect current password fails"
./tests/p_passwd/_user_password.expect &>/dev/null

if [ $? -eq "3" ]
then
    t_Log "PASS"
else
    ExitFail
fi

# Check that user cannot immediately change password if minimum password
# lifeftime is enabled.

t_Log "Testing Minimum password lifetine is enforced"
echo "passtest" | passwd --stdin passtest &>/dev/null
passwd -n 1 passtest &>/dev/null
./tests/p_passwd/_user_password.expect  &>/dev/null

if [ $? -eq "2" ]
then
    t_Log "PASS"
else
    ExitFail
fi

# Password complexity tests
echo "passtest" | passwd --stdin passtest &>/dev/null
passwd -n 0 passtest &>/dev/null

# Check very short password is rejected (single letter)
t_Log "Test very short password is rejected (1 character)"
./tests/p_passwd/_password_complexity.expect a &>/dev/null
t_CheckExitStatus $?

# Check a short password is rejected (4 chars)
t_Log "Test short password is rejected (4 charaters)"
./tests/p_passwd/_password_complexity.expect athe &>/dev/null
t_CheckExitStatus $?

# Check password is rejected with insufficient complexity
t_Log "Test insufficiently complex password is rejected"
./tests/p_passwd/_password_complexity.expect betabeta &>/dev/null
t_CheckExitStatus $?

# Check palindromic password is rejected
t_Log "Check palindromic password is rejected"
./tests/p_passwd/_password_complexity.expect qwe123321ewq &>/dev/null
t_CheckExitStatus $?