/*
 *   Copyright (c) 1996 David Parsons. All rights reserved.
 *   
 *   Redistribution and use in source and binary forms, with or without
 *   modification, are permitted provided that the following conditions
 *   are met:
 *  1. Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *  2. Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in
 *     the documentation and/or other materials provided with the
 *     distribution.
 *  3. All advertising materials mentioning features or use of this
 *     software must display the following acknowledgement:
 *     
 *   This product includes software developed by David Parsons
 *   (orc@pell.chi.il.us)
 *
 *  4. My name may not be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *     
 *  THIS SOFTWARE IS PROVIDED BY DAVID PARSONS ``AS IS'' AND ANY
 *  EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 *  THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 *  PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
 *  PARSONS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 *  EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
 *  TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 *  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 *  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 *  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 *  IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 *  THE POSSIBILITY OF SUCH DAMAGE.
 */

static const char rcsid[] = "$Id: s.passwordcheck.c 1.5 99/02/26 19:20:01-00:00 orc $";

/*
 * PasswordCheck() looks to see if a password is relatively easy to crack.
 * (I would use cracklib here, except that it seems to be prone to dumping
 * core)
 */
#include <pwd.h>
#include <sys/types.h>
#include <ctype.h>

char *
PasswordCheck(char* user, char* passwd)
{
    char *p, *q;
    int r;
    int ucase = 0,
	lcase = 0,
	digit = 0,
	punct = 0;

    if ((strlen(passwd) < 6))
	return "The password must be at least 6 characters long.";

    for (p = passwd; *p; p++) {
	if (isupper(*p)) ucase++;
	if (islower(*p)) lcase++;
	if (isdigit(*p)) digit++;
	if (isdigit(*p)) punct++;
    }

    if (digit == 0 && punct == 0)
	return "The password must contain digits or punctuation";

    if (ucase+lcase < 3)
	return "You need at least 3 letters in the password";

    r = 0;
    for (p = passwd, q = user; *q && *p; q++, p++) {
	if (tolower(*p) != tolower(*q)) {
	    r = 1;
	    break;
	}
    }

    for (p = passwd + strlen(passwd) - 1, q = user;
	 *q && p >= passwd; q++, p--) {
	if (tolower(*p) != tolower(*q)) {
	    r += 2;
	    break;
	}
    }

    if (r != 3)
	return "This password is too easy to guess";

    return 0;
} /* PasswordCheck */
