tests/security-server-tests/security_server_tests_password.cpp

   1 /*
   2  * Copyright (c) 2013 Samsung Electronics Co., Ltd All Rights Reserved
   3  */
   4 /*
   5  * @file    security_server_tests_password.cpp
   6  * @author  Bumjin Im (bj.im@samsung.com)
   7  * @author  Pawel Polawski (p.polawski@partner.samsung.com)
   8  * @author  Radoslaw Bartosiak (r.bartosiak@samsung.com)
   9  * @author  Jan Olszak (j.olszak@samsung.com)
  10  * @version 2.0
  11  * @brief   Test cases for security server
  12  *
  13  * WARNING: In this file test order is very important. They have to always be run
  14  * in correct order. This is done by correct test case names ("tcXX_").
  15  */
  16
  17 #include <stdio.h>
  18 #include <errno.h>
  19 #include <stdlib.h>
  20 #include <string.h>
  21 #include <limits.h>
  22 #include <sys/types.h>
  23 #include <sys/param.h>
  24 #include <fcntl.h>
  25 #include <sys/un.h>
  26 #include <unistd.h>
  27 #include <sys/socket.h>
  28 #include <sys/time.h>
  29 #include <dirent.h>
  30 #include "security-server.h"
  31 #include <dpl/test/test_runner.h>
  32 #include <tests_common.h>
  33 #include <dlog.h>
  34 #include "security_server_clean_env.h"
  35 #include "security_server_tests_common.h"
  36 #include <summary_collector.h>
  37
  38
  39 // the maximum time (in seconds) passwords can expire in
  40 const unsigned int PASSWORD_INFINITE_EXPIRATION_TIME = 0xFFFFFFFF;
  41
  42 // test passwords
  43 const char* TEST_PASSWORD =         "IDLEPASS";
  44 const char* SECOND_TEST_PASSWORD =  "OTHERIDLEPASS";
  45 const char* THIRD_TEST_PASSWORD =   "THIRDPASS";
  46 const char* FOURTH_TEST_PASSWORD =  "FOURTHPASS";
  47
  48 RUNNER_TEST_GROUP_INIT(SECURITY_SERVER_TESTS_PASSWORD);
  49
  50 struct SystemClock {
  51     SystemClock(time_t sft)
  52       : m_original(time(0))
  53       , m_shift(0)
  54     {
  55         shift(sft);
  56     }
  57
  58     SystemClock()
  59       : m_original(time(0))
  60       , m_shift(0)
  61     {}
  62
  63     void shift(time_t sft) {
  64         m_shift += sft;
  65         time_t shifted = m_original + m_shift;
  66         RUNNER_ASSERT_BT(0 == stime(&shifted));
  67     }
  68
  69     ~SystemClock() {
  70         if (std::uncaught_exception()) {
  71             stime(&m_original);
  72             return;
  73         }
  74
  75         RUNNER_ASSERT_BT(0 == stime(&m_original));
  76     }
  77 private:
  78     time_t m_original;
  79     time_t m_shift;
  80 };
  81
  82
  83 /**
  84  * Confirm there is no password before tests are run.
  85  */
  86 RUNNER_TEST(tc01_clear_environment)
  87 {
  88     int ret;
  89     unsigned int attempt, max_attempt, expire_sec;
  90
  91     if (getuid() == 0)
  92     {
  93         reset_security_server();
  94
  95         ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
  96
  97         RUNNER_ASSERT_MSG_BT(expire_sec == 0, "expire_sec = " << expire_sec);
  98         RUNNER_ASSERT_MSG_BT(max_attempt == 0, "max_attempt = " << max_attempt);
  99         RUNNER_ASSERT_MSG_BT(attempt == 0, "attempt = " << attempt);
 100         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 101     }
 102     else
 103     {
 104         SLOGD("To run the test as non root user, please remove password files (/opt/data/security-server/*) in root shell\n");
 105         SLOGD("If not, you will see some failures\n");
 106
 107         RUNNER_IGNORED_MSG("I'm not root");
 108     }
 109 }
 110
 111 /**
 112  * Basic test of setting validity period.
 113  */
 114 RUNNER_TEST(tc02_security_server_set_pwd_validity)
 115 {
 116     int ret;
 117
 118     // Prepare environment
 119     reset_security_server();
 120
 121     // TESTS:
 122     // WITHOUT password
 123     ret = security_server_set_pwd_validity(10);
 124     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 125
 126     ret = security_server_set_pwd_validity(11);
 127     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 128
 129     // WITH password
 130     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 131     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 132
 133     ret = security_server_set_pwd_validity(10);
 134     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 135
 136     ret = security_server_set_pwd_validity(11);
 137     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 138 }
 139
 140 /**
 141  * Basic test of setting maximum number of password challenges.
 142  */
 143 RUNNER_TEST(tc03_security_server_set_pwd_max_challenge)
 144 {
 145     int ret;
 146
 147     // Prepare environment
 148     reset_security_server();
 149
 150     // TESTS:
 151     // WITHOUT password
 152     ret = security_server_set_pwd_max_challenge(5);
 153     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 154
 155     ret = security_server_set_pwd_max_challenge(6);
 156     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 157
 158     // WITH password
 159     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 160     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 161
 162     ret = security_server_set_pwd_max_challenge(5);
 163     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 164
 165     ret = security_server_set_pwd_max_challenge(6);
 166     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 167 }
 168
 169 /**
 170  * Test checking a too long password.
 171  */
 172 RUNNER_TEST(tc04_security_server_chk_pwd_too_long_password_case)
 173 {
 174     int ret;
 175     unsigned int attempt, max_attempt, expire_sec;
 176
 177     // 33 char password
 178     ret = security_server_chk_pwd("abcdefghijklmnopqrstuvwxyz0123456", &attempt, &max_attempt, &expire_sec);
 179     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 180 }
 181
 182 /**
 183  * Test various parameter values when checking a password.
 184  */
 185 RUNNER_TEST(tc05_security_server_chk_pwd_null_input_case)
 186 {
 187     int ret;
 188     unsigned int attempt, max_attempt, expire_sec;
 189
 190     ret = security_server_chk_pwd(NULL, &attempt, &max_attempt, &expire_sec);
 191     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 192
 193     ret = security_server_chk_pwd("password", NULL, &max_attempt, &expire_sec);
 194     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 195
 196     ret = security_server_chk_pwd("password", &attempt, NULL, &expire_sec);
 197     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 198
 199     ret = security_server_chk_pwd("password", &attempt, &max_attempt, NULL);
 200     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 201 }
 202
 203 /**
 204  * Check the given password when no password is set.
 205  */
 206 RUNNER_TEST(tc06_security_server_chk_pwd_no_password_case)
 207 {
 208     int ret;
 209     unsigned int attempt, max_attempt, expire_sec;
 210
 211     // Prepare environment - there is no password now!
 212     reset_security_server();
 213
 214     // TEST
 215     ret = security_server_chk_pwd("isthisempty", &attempt, &max_attempt, &expire_sec);
 216
 217     RUNNER_ASSERT_MSG_BT(expire_sec == 0, expire_sec);
 218     RUNNER_ASSERT_MSG_BT(max_attempt == 0, max_attempt);
 219     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_NO_PASSWORD, "ret = " << ret);
 220 }
 221
 222 /**
 223  * Checks various parameter values.
 224  */
 225 RUNNER_TEST(tc07_security_server_set_pwd_null_input_case)
 226 {
 227     int ret;
 228
 229     // Prepare environment
 230     reset_security_server();
 231
 232     // TEST
 233     ret = security_server_set_pwd(NULL, NULL, 0, 0);
 234     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 235 }
 236
 237 /**
 238  * Test setting too long password.
 239  */
 240 RUNNER_TEST(tc08_security_server_set_pwd_too_long_input_param)
 241 {
 242     int ret;
 243
 244     // Prepare environment
 245     reset_security_server();
 246
 247     // TEST
 248     // 33 char password
 249     ret = security_server_set_pwd("abcdefghijklmnopqrstuvwxyz0123456", "abcdefghijklmnopqrstuvwxyz0123456", 0, 0);
 250     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 251 }
 252
 253 /**
 254  * Basic password setting.
 255  */
 256 RUNNER_TEST(tc09_security_server_set_pwd_current_pwd_empty)
 257 {
 258     int ret;
 259
 260     // Prepare environment
 261     reset_security_server();
 262
 263     // TEST
 264     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
 265     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 266 }
 267
 268 /**
 269  * Set a maximum password period.
 270  */
 271 RUNNER_TEST(tc10_security_server_set_pwd_current_pwd_max_valid_period_in_days)
 272 {
 273     int ret;
 274     // Prepare environment
 275     reset_security_server();
 276     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 277     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 278
 279     // TEST
 280     usleep(PASSWORD_RETRY_TIMEOUT_US);
 281     // UINT_MAX will cause api error, it is to big value
 282     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, UINT_MAX);
 283     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 284     usleep(PASSWORD_RETRY_TIMEOUT_US);
 285     // calculate max applicable valid days that will not be rejected by ss
 286     // ensure, that after conversion from days to seconds in ss there will be no uint overflow
 287     unsigned int valid_days = ((UINT_MAX - time(NULL)) / 86400) - 1;
 288     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, valid_days);
 289     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 290 }
 291
 292 /**
 293  * Set a maximum password challenge number.
 294  */
 295 RUNNER_TEST(tc11_security_server_set_pwd_current_pwd_max_max_challenge)
 296 {
 297     int ret;
 298     // Prepare environment
 299     reset_security_server();
 300     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 301     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 302
 303     // TEST
 304     usleep(PASSWORD_RETRY_TIMEOUT_US);
 305     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, UINT_MAX, 0);
 306     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 307 }
 308
 309 /**
 310  * Set empty password.
 311  */
 312 RUNNER_TEST(tc12_security_server_set_pwd_current_pwd_nonempty2zero)
 313 {
 314     int ret;
 315     // Prepare environment
 316     reset_security_server();
 317     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 318     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 319
 320     // TEST
 321     usleep(PASSWORD_RETRY_TIMEOUT_US);
 322     ret = security_server_set_pwd(TEST_PASSWORD, "", 0, 0);
 323     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 324 }
 325
 326 /**
 327  * Change password to a too long password.
 328  */
 329 RUNNER_TEST(tc14_security_server_set_pwd_current_pwd_too_long_input_param)
 330 {
 331     int ret;
 332     // Prepare environment
 333     reset_security_server();
 334     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 335     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 336
 337     // TEST
 338     usleep(PASSWORD_RETRY_TIMEOUT_US);
 339     std::string lng_pwd(5000, 'A');
 340     ret = security_server_set_pwd(TEST_PASSWORD,lng_pwd.c_str(), 10, 10);
 341     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 342 }
 343
 344 /**
 345  * Check empty password.
 346  */
 347 RUNNER_TEST(tc15_security_server_chk_pwd_empty_password)
 348 {
 349     int ret;
 350     unsigned int attempt, max_attempt, expire_sec;
 351
 352     // Prepare environment
 353     reset_security_server();
 354     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 355     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 356
 357     // TEST
 358     usleep(PASSWORD_RETRY_TIMEOUT_US);
 359     ret = security_server_chk_pwd("", &attempt, &max_attempt, &expire_sec);
 360     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 361 }
 362
 363 /**
 364  * Various validity parameter values.
 365  */
 366 RUNNER_TEST(tc16_security_server_set_pwd_validity)
 367 {
 368     int ret;
 369     // Prepare environment
 370     reset_security_server();
 371     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 372     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 373
 374     // TEST
 375     ret = security_server_set_pwd_validity(0);
 376     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 377
 378     ret = security_server_set_pwd_validity(1);
 379     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 380
 381     //When trying to set UINT_MAX we should get error.
 382     ret = security_server_set_pwd_validity(UINT_MAX);
 383     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 384
 385     ret = security_server_set_pwd_validity(2);
 386     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 387 }
 388
 389 /**
 390  * Check passwords validity
 391  */
 392 RUNNER_TEST(tc17_security_server_is_pwd_valid)
 393 {
 394     int ret;
 395     unsigned int attempt, max_attempt, expire_sec;
 396
 397     // Prepare environment
 398     reset_security_server();
 399     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 2);
 400     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 401
 402     // TEST:
 403     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
 404     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST,  "ret = " << ret);
 405     RUNNER_ASSERT_MSG_BT((expire_sec > 172795) && (expire_sec < 172805),  "expire_sec = " << expire_sec);
 406 }
 407
 408 /**
 409  * Various numbers of challenges.
 410  */
 411 RUNNER_TEST(tc18_security_server_set_pwd_max_challenge)
 412 {
 413     int ret;
 414     // Prepare environment
 415     reset_security_server();
 416     // calculate max applicable valid days that will not be rejected by ss
 417     // ensure, that after conversion from days to seconds in ss there will be no uint overflow
 418     unsigned int valid_days = ((UINT_MAX - time(NULL)) / 86400) - 1;
 419     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, valid_days);
 420     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 421
 422     // TESTS
 423     ret = security_server_set_pwd_max_challenge(0);
 424     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 425
 426     ret = security_server_set_pwd_max_challenge(UINT_MAX);
 427     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 428
 429     ret = security_server_set_pwd_max_challenge(5);
 430     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 431
 432     ret = security_server_set_pwd_max_challenge(6);
 433     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 434 }
 435
 436
 437 /**
 438  * Check the max number of challenges.
 439  */
 440 RUNNER_TEST(tc19_security_server_is_pwd_valid)
 441 {
 442     int ret;
 443     unsigned int attempt, max_attempt, expire_sec;
 444     // Prepare environment
 445     reset_security_server();
 446     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 447     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 448
 449     ret = security_server_set_pwd_max_challenge(6);
 450     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 451
 452     // TEST
 453     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
 454     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
 455     RUNNER_ASSERT_MSG_BT(max_attempt == 6,  "max_attempt = " << max_attempt);
 456 }
 457
 458 /**
 459  * Basic password check.
 460  */
 461 RUNNER_TEST(tc20_security_server_chk_pwd)
 462 {
 463     int ret;
 464     unsigned int attempt, max_attempt, expire_sec;
 465
 466     // Prepare environment
 467     reset_security_server();
 468     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 469     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 470
 471     // TEST
 472     usleep(PASSWORD_RETRY_TIMEOUT_US);
 473     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 474     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, ret);
 475
 476     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
 477     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
 478 }
 479
 480 /**
 481  * Check an incorrect password.
 482  */
 483 RUNNER_TEST(tc21_security_server_chk_incorrect_pwd)
 484 {
 485     int ret;
 486     unsigned int attempt, max_attempt, expire_sec;
 487
 488     // Prepare environment
 489     reset_security_server();
 490     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 491     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 492
 493     //TEST
 494     usleep(PASSWORD_RETRY_TIMEOUT_US);
 495     ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 496     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH, "ret = " << ret);
 497 }
 498
 499 /**
 500  * Check an incorrect password
 501  */
 502 RUNNER_TEST(tc22_security_server_set_pwd_incorrect_current)
 503 {
 504     int ret;
 505
 506     // Prepare environment
 507     reset_security_server();
 508     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 509     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 510
 511     // TEST
 512     usleep(PASSWORD_RETRY_TIMEOUT_US);
 513     ret = security_server_set_pwd(SECOND_TEST_PASSWORD, THIRD_TEST_PASSWORD, 10, 10);
 514     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,  "ret = " << ret);
 515 }
 516
 517 /**
 518  * Change password
 519  */
 520 RUNNER_TEST(tc23_security_server_set_pwd_correct_current)
 521 {
 522     int ret;
 523
 524     // Prepare environment
 525     reset_security_server();
 526     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 527     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 528
 529     // TEST
 530     usleep(PASSWORD_RETRY_TIMEOUT_US);
 531     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 10, 10);
 532     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 533 }
 534
 535 /**
 536  * Check wrong password multiple times and then check a correct one.
 537  */
 538 RUNNER_TEST(tc24_security_server_attempt_exceeding)
 539 {
 540     int ret;
 541     unsigned int i, attempt, max_attempt, expire_sec;
 542
 543     // Prepare environment
 544     reset_security_server();
 545     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
 546     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 547
 548     // TEST
 549     printf("5 subtests started...");
 550     for (i = 1; i <= 5; i++) {
 551         usleep(PASSWORD_RETRY_TIMEOUT_US);
 552         ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 553         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH, "ret = " << ret);
 554         RUNNER_ASSERT_MSG_BT(attempt == i, "attempt = " << attempt << ", expected " << i);
 555     }
 556     printf("DONE\n");
 557
 558     usleep(PASSWORD_RETRY_TIMEOUT_US);
 559     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 560     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 561
 562     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
 563     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
 564     RUNNER_ASSERT_MSG_BT(attempt == 0, "ret = " << ret);
 565     RUNNER_ASSERT_MSG_BT(max_attempt == 10, "ret = " << ret);
 566 }
 567
 568 /**
 569  * Try to exceed maximum number of challenges.
 570  */
 571 RUNNER_TEST(tc25_security_server_attempt_exceeding)
 572 {
 573     int ret;
 574     unsigned int i, attempt, max_attempt, expire_sec;
 575
 576     // Prepare environment
 577     reset_security_server();
 578     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 1);
 579     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 580
 581     // TEST
 582     printf("10 subtests started...");
 583     for (i = 1; i <= 10; i++) {
 584         usleep(PASSWORD_RETRY_TIMEOUT_US);
 585         ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 586         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH, "ret = " << ret);
 587         RUNNER_ASSERT_MSG_BT(attempt == i, "attempt = " << attempt << ", expected " << i);
 588     }
 589
 590     // The check, that exceeds max number
 591     usleep(PASSWORD_RETRY_TIMEOUT_US);
 592     ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 593     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MAX_ATTEMPTS_EXCEEDED, "ret = " << ret);
 594     printf("DONE\n");
 595
 596     usleep(PASSWORD_RETRY_TIMEOUT_US);
 597     ret = security_server_chk_pwd(TEST_PASSWORD,  &attempt, &max_attempt, &expire_sec);
 598     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MAX_ATTEMPTS_EXCEEDED, "ret = " << ret);
 599 }
 600
 601 /**
 602  * Reset password
 603  */
 604 RUNNER_TEST(tc26_security_server_reset_pwd)
 605 {
 606     int ret;
 607
 608     // Prepare environment
 609     reset_security_server();
 610     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 5, 10);
 611     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 612
 613     // TEST
 614     ret = security_server_reset_pwd(TEST_PASSWORD, 10, 10);
 615     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 616 }
 617
 618 /**
 619  * Check too long password.
 620  */
 621 RUNNER_TEST(tc27_security_server_chk_pwd_too_long_password)
 622 {
 623     int ret;
 624     unsigned int attempt, max_attempt, expire_sec;
 625     // Prepare environment
 626     reset_security_server();
 627     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 5, 10);
 628     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 629
 630     // TEST
 631     std::string lng_pwd(5000, 'A');
 632     ret = security_server_chk_pwd(lng_pwd.c_str(),  &attempt, &max_attempt, &expire_sec);
 633     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 634 }
 635
 636 /**
 637  * Check passwords expiration (not expired)
 638  */
 639 RUNNER_TEST(tc28_security_server_check_expiration)
 640 {
 641     int ret;
 642     unsigned int attempt, max_attempt, expire_sec;
 643
 644     // Prepare environment
 645     reset_security_server();
 646     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 5, 1);
 647     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 648
 649     // TEST
 650     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
 651     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
 652     RUNNER_ASSERT_MSG_BT((expire_sec < 86402) && (expire_sec > 86396), "expire_sec = " << ret);
 653 }
 654
 655 /**
 656  * Use various parameter values of parameters.
 657  */
 658 RUNNER_TEST(tc29_security_server_set_pwd_history)
 659 {
 660     int ret;
 661
 662     // Prepare environment
 663     reset_security_server();
 664     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 5, 1);
 665     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 666
 667     // TESTS
 668     ret = security_server_set_pwd_history(100);
 669     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 670
 671     ret = security_server_set_pwd_history(51);
 672     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 673
 674     ret = security_server_set_pwd_history(-5);
 675     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 676
 677     ret = security_server_set_pwd_history(50);
 678     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 679
 680     ret = security_server_set_pwd_history(0);
 681     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 682
 683     ret = security_server_set_pwd_history(INT_MAX);
 684     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 685
 686     ret = security_server_set_pwd_history(INT_MIN);
 687     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 688
 689     ret = security_server_set_pwd_history(10);
 690     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 691 }
 692
 693
 694
 695 int dir_filter(const struct dirent *entry)
 696 {
 697     if ((strcmp(entry->d_name, ".") == 0) ||
 698         (strcmp(entry->d_name, "..") == 0) ||
 699         (strcmp(entry->d_name, "attempts") == 0) ||
 700         (strcmp(entry->d_name, "history") == 0))
 701         return (0);
 702     else
 703         return (1);
 704 }
 705
 706 void clean_password_dir(void)
 707 {
 708     int ret;
 709     int i;
 710     struct dirent **mydirent;
 711
 712     ret = scandir("/opt/data/security-server", &mydirent, &dir_filter, alphasort);
 713     i = ret;
 714     while (i--)
 715         free(mydirent[i]);
 716     free(mydirent);
 717 }
 718
 719
 720 /**
 721  * Check password history.
 722  */
 723 RUNNER_TEST(tc30_security_server_check_history)
 724 {
 725     int ret;
 726     int i;
 727     char buf1[33], buf2[33];
 728
 729     // Prepare environment
 730     reset_security_server();
 731
 732     clean_password_dir();
 733
 734     ret = security_server_set_pwd_history(9);
 735     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 736
 737     ret = security_server_reset_pwd("history0", 0, 0);
 738     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 739
 740     printf("11 subtests started...");
 741     for (i = 0; i < 11; i++) {
 742         sprintf(buf1, "history%d", i);
 743         sprintf(buf2, "history%d", i + 1);
 744
 745         usleep(PASSWORD_RETRY_TIMEOUT_US);
 746         ret = security_server_set_pwd(buf1, buf2, 0, 0);
 747         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 748     }
 749     printf("DONE\n");
 750
 751     usleep(PASSWORD_RETRY_TIMEOUT_US);
 752     ret = security_server_set_pwd("history11", "history1", 0, 0);
 753     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 754
 755     usleep(PASSWORD_RETRY_TIMEOUT_US);
 756     ret = security_server_set_pwd("history1", "history8", 0, 0);
 757     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
 758
 759     usleep(PASSWORD_RETRY_TIMEOUT_US);
 760     ret = security_server_set_pwd("history1", "history12", 0, 0);
 761     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 762
 763     printf("48 subtests started...");
 764     for (i = 12; i < 60; i++) {
 765         usleep(PASSWORD_RETRY_TIMEOUT_US);
 766
 767         sprintf(buf1, "history%d", i);
 768         sprintf(buf2, "history%d", i + 1);
 769
 770         ret = security_server_set_pwd(buf1, buf2, 0, 0);
 771         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 772     }
 773     printf("DONE\n");
 774
 775     clean_password_dir();
 776 }
 777
 778 /**
 779  * Replay attack
 780  */
 781 RUNNER_TEST(tc31_security_server_replay_attack)
 782 {
 783     int ret;
 784     int i = 0;
 785     unsigned int attempt, max_attempt, expire_sec;
 786
 787     usleep(PASSWORD_RETRY_TIMEOUT_US);
 788     ret = security_server_chk_pwd("quickquickquick", &attempt, &max_attempt, &expire_sec);
 789
 790     while (ret == SECURITY_SERVER_API_ERROR_PASSWORD_RETRY_TIMER) {
 791         i += 100000;
 792
 793         ret = security_server_chk_pwd("quickquickquick", &attempt, &max_attempt, &expire_sec);
 794         usleep(i);
 795     }
 796
 797     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH, "ret = " << ret);
 798 }
 799
 800 /**
 801  * Expired password
 802  */
 803 RUNNER_TEST(tc32_security_server_challenge_on_expired_password)
 804 {
 805     int ret;
 806     unsigned int attempt, max_attempt, expire_sec;
 807     struct timeval cur_time;
 808
 809     // Prepare environment
 810     reset_security_server();
 811     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 4, 1);
 812     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 813
 814     // TEST
 815     usleep(PASSWORD_RETRY_TIMEOUT_US);
 816     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 817     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 818
 819     ret = gettimeofday(&cur_time, NULL);
 820     RUNNER_ASSERT_MSG_BT(ret > -1, ret);
 821
 822     cur_time.tv_sec += (expire_sec + 1);
 823     ret = settimeofday(&cur_time, NULL);
 824     RUNNER_ASSERT_MSG_BT(ret > -1, ret);
 825
 826     usleep(PASSWORD_RETRY_TIMEOUT_US);
 827     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 828     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXPIRED, "ret = " << ret);
 829
 830     usleep(PASSWORD_RETRY_TIMEOUT_US);
 831     ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
 832     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH, "ret = " << ret);
 833 }
 834
 835 /**
 836  * Reset password
 837  */
 838 RUNNER_TEST(tc33_security_server_reset_by_null_pwd)
 839 {
 840     int ret;
 841
 842     // Prepare environment
 843     reset_security_server();
 844
 845     // TEST
 846     ret = security_server_reset_pwd(NULL, 10, 10);
 847     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_INPUT_PARAM, "ret = " << ret);
 848 }
 849
 850 /*
 851  * Use this instead of security_server_chk_pwd directly to verify the function output.
 852  * For example:
 853  * verify_chk_pwd("password", SECURITY_SERVER_API_SUCCESS, 2, 5, "debug string")
 854  */
 855 void verify_chk_pwd (
 856     const char* challenge,
 857     int expected_result,
 858     unsigned int expected_current_attempt,
 859     unsigned int expected_max_attempt,
 860     const std::string &info = std::string())
 861 {
 862     /* ensure that initial values differ from expected ones */
 863     unsigned int attempt = expected_current_attempt - 1;
 864     unsigned int max_attempt = expected_max_attempt - 1;
 865     unsigned int expire_sec = PASSWORD_INFINITE_EXPIRATION_TIME - 1;
 866
 867     usleep(PASSWORD_RETRY_TIMEOUT_US);
 868     int ret = security_server_chk_pwd(challenge, &attempt, &max_attempt, &expire_sec);
 869
 870     // validate returned value
 871     RUNNER_ASSERT_MSG_BT(ret == expected_result,
 872         info << "security_server_chk_pwd returned "
 873          << ret << " (expected: " << expected_result << ")");
 874
 875     // validate current attempts value
 876     RUNNER_ASSERT_MSG_BT(attempt == expected_current_attempt,
 877         info << "security_server_chk_pwd returned attempt = " << attempt <<
 878         " (expected: " << expected_current_attempt << ")");
 879
 880     // validate max attempt value
 881     RUNNER_ASSERT_MSG_BT(max_attempt == expected_max_attempt,
 882         info << "security_server_chk_pwd returned max_attempt = " << max_attempt <<
 883         " (expected: " << expected_max_attempt << ")");
 884
 885     RUNNER_ASSERT_MSG_BT(expire_sec == PASSWORD_INFINITE_EXPIRATION_TIME,
 886         info << "security_server_chk_pwd returned expire_sec = " << expire_sec <<
 887         " (expected: " << PASSWORD_INFINITE_EXPIRATION_TIME << ")");
 888 }
 889
 890 /**
 891  * Reach last attempt few times in a row (before exceeding max_attempt).
 892  */
 893 RUNNER_TEST(tc34_security_server_max_attempts)
 894 {
 895     // Prepare environment
 896     reset_security_server();
 897
 898     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
 899     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 900
 901     // change max attempts number few times
 902     std::vector<unsigned int> max_challenge_tab = {1, 4, 2};
 903
 904     for (size_t pass = 0; pass < max_challenge_tab.size(); ++pass) {
 905         unsigned int max_challenges = max_challenge_tab[pass];
 906
 907         ret = security_server_set_pwd_max_challenge(max_challenges);
 908         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 909
 910         // max_challenges-1 wrong password attempts
 911         for (unsigned int attempt_nr = 1; attempt_nr < max_challenges; ++attempt_nr)
 912             verify_chk_pwd(SECOND_TEST_PASSWORD,
 913                            SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
 914                            attempt_nr,
 915                            max_challenges,
 916                            std::string("pass = ") + std::to_string(pass) +
 917                                        ", attempt = " + std::to_string(attempt_nr));
 918
 919         // Check correct password finally
 920         verify_chk_pwd(TEST_PASSWORD, SECURITY_SERVER_API_SUCCESS,
 921                        max_challenges, max_challenges);
 922     }
 923 }
 924
 925 /**
 926  * Decrease 'max challenge' number after several missed attempts.
 927  */
 928 RUNNER_TEST(tc35_security_server_decrease_max_attempts)
 929 {
 930     const unsigned int max_challenge_more = 10;
 931     const unsigned int max_challenge_less = 5;
 932
 933     // Prepare environment
 934     reset_security_server();
 935
 936     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, max_challenge_more, 0);
 937     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 938
 939     // missed attempts
 940     for (unsigned int attempt = 1; attempt <= max_challenge_more; ++attempt)
 941         verify_chk_pwd(SECOND_TEST_PASSWORD,
 942                        SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
 943                        attempt,
 944                        max_challenge_more,
 945                        std::string("attempt = ") + std::to_string(attempt));
 946
 947     // lower max_challenge
 948     ret = security_server_set_pwd_max_challenge(max_challenge_less);
 949     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 950
 951     // try valid password - should pass (curr attempts is reset)
 952     verify_chk_pwd(TEST_PASSWORD, SECURITY_SERVER_API_SUCCESS, 1, max_challenge_less);
 953
 954     // remove max attempts limit
 955     ret = security_server_set_pwd_max_challenge(0);
 956     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 957
 958     // try valid password again - should pass
 959     verify_chk_pwd(TEST_PASSWORD, SECURITY_SERVER_API_SUCCESS, 1, 0);
 960
 961     // try to change the password - should pass
 962     usleep(PASSWORD_RETRY_TIMEOUT_US);
 963     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
 964     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 965
 966     // validate new password
 967     verify_chk_pwd(SECOND_TEST_PASSWORD, SECURITY_SERVER_API_SUCCESS, 1, 0);
 968 }
 969
 970 /**
 971  * Change password few times and challenge previous passwords - checks if security_server_set_pwd
 972  * works as it should.
 973  */
 974 RUNNER_TEST(tc36_security_server_challenge_previous_passwords)
 975 {
 976     const int history_depth = 5;
 977     const unsigned int max_challenge = 3;
 978     std::string prev_pass, new_pass = TEST_PASSWORD;
 979
 980     // Prepare environment
 981     reset_security_server();
 982
 983     int ret = security_server_set_pwd_history(history_depth);
 984     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 985
 986     ret = security_server_reset_pwd(TEST_PASSWORD, max_challenge, 0);
 987     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 988
 989     for (int depth = 0; depth < history_depth; ++depth) {
 990         prev_pass = new_pass;
 991
 992         //generate password name
 993         new_pass = "history" + std::to_string(depth+1);
 994
 995         usleep(PASSWORD_RETRY_TIMEOUT_US);
 996         ret = security_server_set_pwd(prev_pass.c_str(), new_pass.c_str(), max_challenge, 0);
 997         RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
 998
 999         // challenge initial password
1000         verify_chk_pwd(
1001             TEST_PASSWORD,
1002             SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1003             1,
1004             max_challenge,
1005             std::string("depth = ") + std::to_string(depth));
1006
1007         // challenge previous password
1008         verify_chk_pwd(
1009             prev_pass.c_str(),
1010             SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1011             2,
1012             max_challenge,
1013             std::string("depth = ") + std::to_string(depth));
1014     }
1015 }
1016
1017 /**
1018  * Challenge correct and incorrect passwords, check security_server_chk_pwd output.
1019  * This test simulates user's behaviour - challenges valid and invalid passwords
1020  * in various combinations.
1021  */
1022 RUNNER_TEST(tc37_security_server_challenge_mixed)
1023 {
1024     // Prepare environment
1025     reset_security_server();
1026
1027     const unsigned int max_challenge = 2;
1028     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, max_challenge, 0);
1029     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1030
1031     // 2x correct pwd - verify that 'cuurrent attempt' isn't increased
1032     for (unsigned int i = 0; i < max_challenge; ++i)
1033         verify_chk_pwd(
1034             TEST_PASSWORD,
1035             SECURITY_SERVER_API_SUCCESS,
1036             1,
1037             max_challenge,
1038             std::string("i = ") + std::to_string(i));
1039
1040     // Ensure that challenging valid password resets 'cuurrent attempt' value.
1041     // If it didn't, the test would fail in third loop pass.
1042     for (unsigned int i = 0; i < max_challenge + 1; ++i) {
1043         // incorrect pwd
1044         verify_chk_pwd(
1045             SECOND_TEST_PASSWORD,
1046             SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1047             1,
1048             max_challenge,
1049             std::string("i = ") + std::to_string(i));
1050
1051         // correct pwd
1052         verify_chk_pwd(
1053             TEST_PASSWORD,
1054             SECURITY_SERVER_API_SUCCESS,
1055             2,
1056             max_challenge,
1057             std::string("i = ") + std::to_string(i));
1058     }
1059
1060     // incorrect pwd 2x - 'cuurrent attempt' reaches max_challenge -
1061     // any further attempts (even correct) are blocked
1062     for (unsigned int i = 1; i <= max_challenge; ++i)
1063         verify_chk_pwd(
1064             SECOND_TEST_PASSWORD,
1065             SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1066             i,
1067             max_challenge,
1068             std::string("i = ") + std::to_string(i));
1069
1070     // correct - refused
1071     for (unsigned int i = 1; i <= max_challenge; ++i)
1072         verify_chk_pwd(
1073             TEST_PASSWORD,
1074             SECURITY_SERVER_API_ERROR_PASSWORD_MAX_ATTEMPTS_EXCEEDED,
1075             max_challenge + i,
1076             max_challenge,
1077             std::string("i = ") + std::to_string(i));
1078 }
1079
1080 /*
1081  * Pasword change mixed with history depth change.
1082  */
1083 RUNNER_TEST(tc38_security_server_history_depth_change)
1084 {
1085     int ret;
1086     const int initial_history_depth = 2;
1087     const int decreased_history_depth = 1;
1088     const int increased_history_depth = 3;
1089
1090     // Prepare environment
1091     reset_security_server();
1092
1093     ret = security_server_set_pwd_history(initial_history_depth);
1094     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1095
1096     ret = security_server_reset_pwd(TEST_PASSWORD, 0, 0);
1097     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1098
1099     usleep(PASSWORD_RETRY_TIMEOUT_US);
1100     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1101     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1102
1103     usleep(PASSWORD_RETRY_TIMEOUT_US);
1104     ret = security_server_set_pwd(SECOND_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1105     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1106
1107     // TEST_PASSWORD, 2nd and 3rd remembered => 1st should be refused
1108     usleep(PASSWORD_RETRY_TIMEOUT_US);
1109     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1110     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1111
1112     /*
1113      * Lower history depth. At this point SS should treat THIRD_TEST_PASSWORD as current pwd,
1114      * and SECOND_TEST_PASSWORD as a part of history.
1115      */
1116     ret = security_server_set_pwd_history(decreased_history_depth);
1117     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1118
1119     usleep(PASSWORD_RETRY_TIMEOUT_US);
1120     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1121     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1122
1123     usleep(PASSWORD_RETRY_TIMEOUT_US);
1124     ret = security_server_set_pwd(TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1125     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1126
1127     /*
1128      * Increase history depth to 3. At this point SS should remember TEST_PASSWORD
1129      * and THIRD_TEST_PASSWORD only.
1130      */
1131     ret = security_server_set_pwd_history(increased_history_depth);
1132     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1133
1134     // 3rd and TEST_PASSWORD remembered => 2nd should be accepted
1135     usleep(PASSWORD_RETRY_TIMEOUT_US);
1136     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1137     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1138
1139     // TEST_PASSWORD, 2nd and 3rd remembered => 3rd should be refused
1140     usleep(PASSWORD_RETRY_TIMEOUT_US);
1141     ret = security_server_set_pwd(SECOND_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1142     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1143 }
1144
1145 /**
1146  * Challenge invalid password, reset server and check if 'current attempts' is restored.
1147  */
1148 RUNNER_TEST(tc39_security_server_attempts_num_check_after_reset)
1149 {
1150     unsigned int attempt, max_attempt, expire_sec;
1151     const unsigned int max_challenge = 10;
1152     const unsigned int invalid_attempts_num = 3;
1153
1154     // Prepare environment
1155     reset_security_server();
1156
1157     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, max_challenge, 0);
1158     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1159
1160     // missed attempts
1161     for (unsigned int attempt = 1; attempt <= invalid_attempts_num; ++attempt)
1162         verify_chk_pwd(
1163             SECOND_TEST_PASSWORD,
1164             SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1165             attempt,
1166             max_challenge);
1167
1168     attempt = max_attempt = expire_sec = UINT_MAX;
1169     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
1170     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1171     RUNNER_ASSERT_MSG_BT(max_attempt == max_challenge, "max_attempt = " << max_attempt);
1172     RUNNER_ASSERT_MSG_BT(attempt == invalid_attempts_num, "attempt = " << attempt);
1173     RUNNER_ASSERT_MSG_BT(expire_sec == PASSWORD_INFINITE_EXPIRATION_TIME, "expire_sec = " <<
1174                       expire_sec);
1175
1176     // restart server - triggers loading password data from file
1177     restart_security_server();
1178
1179     // challenge invalid password
1180     verify_chk_pwd(
1181         SECOND_TEST_PASSWORD,
1182         SECURITY_SERVER_API_ERROR_PASSWORD_MISMATCH,
1183         invalid_attempts_num + 1,
1184         max_challenge);
1185
1186     // challenge valid password
1187     verify_chk_pwd(
1188         TEST_PASSWORD,
1189         SECURITY_SERVER_API_SUCCESS,
1190         invalid_attempts_num + 2,
1191         max_challenge);
1192 }
1193
1194 /**
1195  * Validate passwords history after security server reset.
1196  */
1197 RUNNER_TEST(tc40_security_server_history_check_after_reset)
1198 {
1199     const unsigned int history_depth = 2;
1200
1201     // Prepare environment
1202     reset_security_server();
1203
1204     int ret = security_server_set_pwd_history(history_depth);
1205     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1206
1207     ret = security_server_reset_pwd(TEST_PASSWORD, 0, 0);
1208     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1209
1210     usleep(PASSWORD_RETRY_TIMEOUT_US);
1211     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1212     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1213
1214     usleep(PASSWORD_RETRY_TIMEOUT_US);
1215     ret = security_server_set_pwd(SECOND_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1216     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1217
1218     usleep(PASSWORD_RETRY_TIMEOUT_US);
1219     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, FOURTH_TEST_PASSWORD, 0, 0);
1220     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1221
1222     // restart server - triggers loading password data from file
1223     restart_security_server();
1224
1225     // try to reuse history passwords
1226     usleep(PASSWORD_RETRY_TIMEOUT_US);
1227     ret = security_server_set_pwd(FOURTH_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1228     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1229
1230     usleep(PASSWORD_RETRY_TIMEOUT_US);
1231     ret = security_server_set_pwd(FOURTH_TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1232     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1233
1234     usleep(PASSWORD_RETRY_TIMEOUT_US);
1235     ret = security_server_set_pwd(FOURTH_TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1236     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1237 }
1238
1239 /**
1240  * Check if SS has correct behaviour when changing history depth to 0.
1241  */
1242 RUNNER_TEST(tc41_security_server_empty_history_check)
1243 {
1244     const unsigned int history_depth = 2;
1245     const unsigned int empty_history_depth = 0;
1246
1247     //prepare environment
1248     reset_security_server();
1249
1250     //set new history count
1251     int ret = security_server_set_pwd_history(history_depth);
1252     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1253
1254     //set new password and fill history
1255     ret = security_server_reset_pwd(TEST_PASSWORD, 0, 0);
1256     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1257
1258     usleep(PASSWORD_RETRY_TIMEOUT_US);
1259     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1260     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1261
1262     usleep(PASSWORD_RETRY_TIMEOUT_US);
1263     ret = security_server_set_pwd(SECOND_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1264     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1265
1266     //make sure, that everything went OK - try setting something that would cause reuse error
1267     usleep(PASSWORD_RETRY_TIMEOUT_US);
1268     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1269     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1270
1271     usleep(PASSWORD_RETRY_TIMEOUT_US);
1272     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1273     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_REUSED, "ret = " << ret);
1274
1275     //reset history limit to no history at all
1276     ret = security_server_set_pwd_history(empty_history_depth);
1277     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1278
1279     //make sure, that current password still exists in memory
1280     //expected attempt 3 because our previous tries increased attempt counter
1281     verify_chk_pwd(
1282         THIRD_TEST_PASSWORD,
1283         SECURITY_SERVER_API_SUCCESS,
1284         3,
1285         0);
1286
1287     //make sure that it's possible to reuse old password once history limit is set to 0
1288     usleep(PASSWORD_RETRY_TIMEOUT_US);
1289     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, THIRD_TEST_PASSWORD, 0, 0);
1290     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1291
1292     //once again try setting earlier used passwords - now API should return success
1293     usleep(PASSWORD_RETRY_TIMEOUT_US);
1294     ret = security_server_set_pwd(THIRD_TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1295     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1296
1297     usleep(PASSWORD_RETRY_TIMEOUT_US);
1298     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1299     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1300 }
1301
1302 RUNNER_TEST(tc42_security_server_set_new_pwd_with_current_empty)
1303 {
1304     //prepare environment
1305     reset_security_server();
1306
1307     //set a password
1308     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1309     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1310
1311     //try setting different password and giving NULL as current once again
1312     usleep(PASSWORD_RETRY_TIMEOUT_US);
1313     ret = security_server_set_pwd(NULL, SECOND_TEST_PASSWORD, 0, 0);
1314     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1315 }
1316
1317 RUNNER_TEST(tc43_security_server_no_retry_timeout_is_pwd_valid)
1318 {
1319     //prepare environment
1320     reset_security_server();
1321
1322     //set a password
1323     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1324     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1325
1326     //do test
1327     unsigned int attempt, max_attempt, expire_sec;
1328     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
1329     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1330     ret = security_server_is_pwd_valid(&attempt, &max_attempt, &expire_sec);
1331     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1332 }
1333
1334 RUNNER_TEST(tc44_security_server_retry_timeout_chk_pwd)
1335 {
1336     //prepare environment
1337     reset_security_server();
1338
1339     //set a password
1340     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1341     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1342
1343     //do test
1344     unsigned int attempt, max_attempt, expire_sec;
1345     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
1346     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_RETRY_TIMER, "ret = " << ret);
1347     ret = security_server_chk_pwd(TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
1348     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_RETRY_TIMER, "ret = " << ret);
1349 }
1350
1351 RUNNER_TEST(tc45_security_server_retry_timeout_set_pwd)
1352 {
1353     //prepare environment
1354     reset_security_server();
1355
1356     //set a password
1357     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1358     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1359
1360     //do test
1361     ret = security_server_set_pwd(TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1362     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_RETRY_TIMER, "ret = " << ret);
1363     ret = security_server_set_pwd(TEST_PASSWORD, TEST_PASSWORD, 0, 0);
1364     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_RETRY_TIMER, "ret = " << ret);
1365 }
1366
1367 RUNNER_TEST(tc46_security_server_no_retry_timeout_set_pwd_validity)
1368 {
1369     //prepare environment
1370     reset_security_server();
1371
1372     //set a password
1373     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1374     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1375
1376     //do test
1377     ret = security_server_set_pwd_validity(11);
1378     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1379     ret = security_server_set_pwd_validity(11);
1380     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1381 }
1382
1383 RUNNER_TEST(tc47_security_server_no_retry_timeout_reset_pwd)
1384 {
1385     //prepare environment
1386     reset_security_server();
1387
1388     //set a password
1389     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1390     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1391
1392     //do test
1393     ret = security_server_reset_pwd(TEST_PASSWORD, 0, 0);
1394     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1395     ret = security_server_reset_pwd(TEST_PASSWORD, 0, 0);
1396     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1397 }
1398
1399 RUNNER_TEST(tc48_security_server_no_retry_timeout_pwd_history)
1400 {
1401     //prepare environment
1402     reset_security_server();
1403
1404     //set a password
1405     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1406     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1407
1408     //do test
1409     ret = security_server_set_pwd_history(5);
1410     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1411     ret = security_server_set_pwd_history(5);
1412     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1413 }
1414
1415 RUNNER_TEST(tc49_security_server_no_retry_timeout_set_pwd_max_challenge)
1416 {
1417     //prepare environment
1418     reset_security_server();
1419
1420     //set a password
1421     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1422     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1423
1424     //do test
1425     ret = security_server_set_pwd_max_challenge(5);
1426     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1427     ret = security_server_set_pwd_max_challenge(5);
1428     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1429 }
1430
1431 RUNNER_TEST(tc50_security_server_set_pwd_current_pwd_with_infinite_expiration_time)
1432 {
1433     int ret;
1434     unsigned int attempt, max_attempt, expire_sec;
1435
1436     // Prepare environment
1437     reset_security_server();
1438     ret = security_server_set_pwd(NULL, TEST_PASSWORD, 10, 10);
1439     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1440     usleep(PASSWORD_RETRY_TIMEOUT_US);
1441
1442     // Assert security server sets infinite expiration time
1443     ret = security_server_set_pwd(TEST_PASSWORD, SECOND_TEST_PASSWORD, 0, 0);
1444     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1445     usleep(PASSWORD_RETRY_TIMEOUT_US);
1446
1447     ret = security_server_chk_pwd(SECOND_TEST_PASSWORD, &attempt, &max_attempt, &expire_sec);
1448     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1449     RUNNER_ASSERT_MSG_BT(expire_sec == PASSWORD_INFINITE_EXPIRATION_TIME,
1450             "invalid expiration time " << expire_sec);
1451
1452     clean_password_dir();
1453 }
1454
1455 RUNNER_TEST(tc51_security_server_is_pwd_valid)
1456 {
1457     reset_security_server();
1458
1459     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 1);
1460     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1461
1462     unsigned int attempt, maxAttempt, validSec;
1463     attempt = maxAttempt = validSec = 0;
1464
1465     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1466     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret <<
1467         " atempt=" << attempt << " maxAttempt=" << maxAttempt << " validSec=" << validSec);
1468
1469
1470     SystemClock clock(60*60*24*2);
1471
1472     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1473     RUNNER_ASSERT_MSG_BT((ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST) && (validSec == 0),
1474         "ret = " << ret << " atempt=" << attempt << " maxAttempt=" << maxAttempt
1475         << " validSec=" << validSec);
1476 }
1477
1478 RUNNER_TEST(tc52_security_server_is_pwd_valid)
1479 {
1480     reset_security_server();
1481
1482     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 0);
1483     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1484
1485     unsigned int attempt, maxAttempt, validSec;
1486     attempt = maxAttempt = validSec = 0;
1487
1488     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1489     RUNNER_ASSERT_MSG_BT((ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST) && (validSec == 0xffffffff), "ret = " << ret <<
1490         " atempt=" << attempt << " maxAttempt=" << maxAttempt << " validSec=" << validSec);
1491 }
1492
1493 RUNNER_TEST(tc53_security_server_is_pwd_valid)
1494 {
1495     reset_security_server();
1496
1497     int ret = security_server_set_pwd(NULL, TEST_PASSWORD, 0, 3);
1498     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_SUCCESS, "ret = " << ret);
1499
1500     unsigned int attempt, maxAttempt, validSec;
1501     attempt = maxAttempt = validSec = 0;
1502
1503     // password shoudl be valid for 3 days == (60*60*24*3) 259200 seconds
1504     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1505     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1506     RUNNER_ASSERT_MSG_BT((validSec > 259000) && (validSec < 260000), "validSec = " << validSec);
1507
1508     SystemClock clock;
1509     clock.shift(-60*60*24); // one day back
1510
1511     // password should be valid for 4 days == (60*60*24*4) 345600 seconds
1512     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1513     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1514     RUNNER_ASSERT_MSG_BT((validSec > 345000) && (validSec < 346000), "validSec = " << validSec);
1515
1516     clock.shift(-60*60*24*2); // 3 days back
1517
1518     // password shoudl be valid for 6 days == (60*60*24*6) 518400 seconds
1519     ret = security_server_is_pwd_valid(&attempt, &maxAttempt, &validSec);
1520     RUNNER_ASSERT_MSG_BT(ret == SECURITY_SERVER_API_ERROR_PASSWORD_EXIST, "ret = " << ret);
1521     RUNNER_ASSERT_MSG_BT((validSec > 518000) && (validSec < 519000), "validSec = " << validSec);
1522 }
1523
1524 int main(int argc, char *argv[])
1525 {
1526     SummaryCollector::Register();
1527     return DPL::Test::TestRunnerSingleton::Instance().ExecTestRunner(argc, argv);
1528 }