<?php

// Получить значение из ассоциированного массива
function _get($array, $key)
{
	if (!isset($array, $key)) return;
	if (empty($array)) return;
	if (is_array($array))
	{
		if (array_key_exists($key, $array)) return $array[$key];
	}
}

// Аналог функции NVL
function _nvl($expr, $null=null, $value=null)
{
	if (isset($expr))
	{
		return isset($value) ? $value : $expr;
	}
	else
	{
		return $null;
	}
}

// Модуль для работы с RADIUS-сервером
class Radius
{

	// Типы RADIUS-пакетов
	const RAD_ACCESS_REQUEST      = 1;
	const RAD_ACCESS_ACCEPT       = 2;
	const RAD_ACCESS_REJECT       = 3;
	const RAD_ACCOUNTING_REQUEST  = 4;
	const RAD_ACCOUNTING_RESPONSE = 5;
	const RAD_ACCOUNTING_STATUS   = 6;
	const RAD_ACCESS_CHALLENGE    = 11;
	const RAD_DISCONNECT_REQUEST  = 40;
	const RAD_DISCONNECT_ACCEPT   = 41;
	const RAD_DISCONNECT_REJECT   = 42;
	const RAD_COA_REQUEST         = 43;
	const RAD_COA_ACCEPT          = 44;
	const RAD_COA_ACK             = 44;
	const RAD_COA_REJECT          = 45;
	const RAD_COA_NAK             = 45;

	private $rad;

	// Режим отладки класса
	static public function debug($mode=null)
	{
		static $debug;
		if (isset($mode)) $debug = (boolean)$mode;
		return $debug;
	}

	// Получить или вернуть код пакета по имени
	static public function type($find, $reverse=false)
	{
		$ref = new ReflectionClass('Radius');
		$cl = $ref->getConstants();
		foreach ($cl as $name=>$value)
		{
			if ($reverse)
			{
				if ($find == $value) return $name;
			}
			else
			{
				if ($find == $name) return $value;
			}
		}
		$cl = get_defined_constants(true);
		if (array_key_exists('radius', $cl))
		{
			foreach ($cl['radius'] as $name=>$value)
			{
				if ($reverse)
				{
					if ($find == $value) return $name;
				}
				else
				{
					if ($find == $name) return $value;
				}
			}
		}
	}

	// Конструктор
	function __construct($template=null)
	{
		$rad = radius_auth_open();
		$cfg = _cfg('radius', true);
		$cfg = $cfg[$template];
		if (!radius_add_server($rad, $cfg['host'], $cfg['port'], $cfg['secret'], 3, 3))
		{
			trigger_error('RADIUS connect error:' . radius_strerror($rad), E_USER_NOTICE);
			return;
		}
		$this->dict();
		$this->rad = $rad;
	}

	// Деструктор
	function __destruct()
	{
		if (isset($this->rad))
		{
			radius_close($this->rad);
		}
	}

	// Загрузить RADIUS-словарь из файла
	static private function load($file)
	{
		$debug = static::debug();
		$fh = fopen($file, "r");
		if (!$fh) return;
		$files = array();
		$data = array('vendor'=>array(), 'attr'=>array());
		$vendor = null;
		if ($debug) echo "*debug: load dictionary $file\n";
		while (($line = fgets($fh)) !== false)
		{
			$line = trim($line);
			if (substr($line,0,1) == "#") $line = null;
			$items = preg_split("/[\s]+/", $line);
			if (count($items) > 1)
			{
				$cmd = strtolower($items[0]);
				$name = (_get($items, 1));
				$id = (_get($items, 2));
				$type = strtolower(_get($items, 3));
				$vid = (_get($items, 4));
				if ($cmd == '$include')
				{
					if ($debug) echo "*debug: add file $items[1]\n";
					$files[] = $items[1];
				}
				else
				{
					if     ($cmd == 'vendor')
					{
						if ($debug) echo "*debug: add vendor #$id $name\n";
						$data['vendor'][$name] = $id;
					}
					elseif ($cmd == 'begin-vendor')
					{
						if ($debug) echo "*debug: add vendor $name\n";
						$vendor = $name;
					}
					elseif ($cmd == 'end-vendor')
					{
						$vendor = null;
					}
					elseif ($cmd == 'attribute')
					{
						if (!isset($vid)) $vid = $vendor;
						if ($debug) echo "*debug: add attribute #$id $name (vendor $vid)\n";
						$data['attr'][$name] = array('name'=>$name, 'id'=>$id, 'type'=>$type, 'vendor'=>$vid);
					}
					elseif ($cmd == 'value')
					{
						if (array_key_exists($name, $data['attr']))
						{
							if ($debug) echo "*debug: add value #$type $id (attribute $name)\n";
							if (!array_key_exists('values', $data['attr'][$name])) $data['attr'][$name]['values'] = array();
							$data['attr'][$name]['values'][$id] = $type;
						}
					}
					elseif ($cmd == 'vendorattr')
					{
						$vid = (_get($items, 1));
						$name = (_get($items, 2));
						$id = (_get($items, 3));
						$type = strtolower(_get($items, 4));
						foreach ($data['vendor'] as $key=>$item)
						{
							if ((int)$vid == (int)$item)
							{
								if ($debug) echo "*debug: add attribute #$id $name (vendor $key)\n";
								$data['attr'][$name] = array('name'=>$name, 'id'=>$id, 'type'=>$type, 'vendor'=>$key);
								break;
							}
						}
					}
					elseif ($cmd == 'vendorvalue')
					{
						$vid = (_get($items, 1));
						$name = (_get($items, 2));
						$id = (_get($items, 3));
						$type = strtolower(_get($items, 4));
						if (array_key_exists($name, $data['attr']))
						{
							if ($debug) echo "*debug: add value #$type $id (attribute $name)\n";
							if (!array_key_exists('values', $data['attr'][$name])) $data['attr'][$name]['values'] = array();
							$data['attr'][$name]['values'][$id] = $type;
						}
					}
				}
			}
		}
		fclose($fh);
		if ($debug) echo "*debug: load done\n";
		return array('data'=>$data, 'file'=>$files);
	}

	// Обратится к RADIUS-словарю
	static public function dict($attr=null, $reverse=false)
	{
		static $dict;
		if (!isset($dict))
		{
			$base = "/etc/raddb";
			$files = array('dictionary'=>false);
			$dict = array();
			$n = count($files);
			while ($n > 0)
			{
				foreach ($files as $file=>$state)
				{
					if ($state)
					{
						$n--;
					}
					else
					{
						$ret = static::load("$base/$file");
						$files[$file] = true;
						$n--;
						if (isset($ret))
						{
							foreach ($ret['data']['vendor'] as $key=>$item) $dict['vendor'][$key] = $item;
							foreach ($ret['data']['attr'] as $key=>$item) $dict['attr'][$key] = $item;
							foreach ($ret['file'] as $file)
							{
								if (!array_key_exists($file, $files))
								{
									$files[$file] = false;
									$n++;
								}
							}
						}
					}
				}
			}
		}
		if (isset($attr))
		{
			if ($reverse)
			{
				$a = null;
				$v = null;
				if (is_array($attr))
				{
					$a = _get($attr,'id');
					$v = _get($attr,'vid');
				}
				else
				{
					$a = $attr;
					if (is_string($a) && array_key_exists($a, $dict['attr'])) $a = $dict['attr'][$a]['id'];
				}
				$ret = null;
				foreach ($dict['attr'] as $item)
				{
					$ia = _get($item,'id');
					$iv = _get($item,'vendor');
					if (isset($iv)) $iv = _get($dict['vendor'],$iv);
					if (($ia == $a) && (_nvl($iv,0) == _nvl($v,0)))
					{
						$ret = $item;
						$ret['vid'] = $iv;
						break;
					}
				}
				return $ret;
			}
			else
			{
				if (!isset($vendor)) $vendor = '';
				if (array_key_exists($attr, $dict['attr']))
				{
					$ret = $dict['attr'][$attr];
					$ret['vid'] = null;
					if (isset($ret['vendor']) && array_key_exists($ret['vendor'], $dict['vendor']))
					{
						$ret['vid'] = $dict['vendor'][$ret['vendor']];
					}
					return $ret;
				}
			}
		}
	}

	// Выполнить RADIUS-запрос и получить ответ
	function request($avpair=null, $type=RADIUS_ACCESS_REQUEST)
	{
		if (!isset($avpair)) return;
		if (!is_array($avpair)) return;
		if (empty($avpair)) return;

		$debug = static::debug();
		$rad = $this->rad;
		$t = static::type($type,true);
		if ($debug) echo "*debug: create request #$type" . (isset($t) ? " ($t)" : "") . "\n";
		if (!radius_create_request($rad, $type))
		{
			if ($debug) echo "*debug: create request fail: " . radius_strerror($rad) . "\n";
			trigger_error('RADIUS create request error:' . radius_strerror($rad), E_USER_NOTICE);
			return;
		}
		foreach ($avpair as $a=>$v)
		{
			$ret = null;
			$a = static::dict($a);
			if ($debug) echo "*debug: attribute $a[name] (#$a[id], $a[type]" . (isset($a['vid']) ? ", vendor $a[vendor]" : "") . ") := $v" . ((isset($a['values']) && array_key_exists($v, $a['values'])) ? " (#$a[values])" : "") . "\n";
			if (isset($a['values']) && array_key_exists($v, $a['values'])) $v = $a['values'];
			if (isset($a['vid']))
			{
				if ($a['type'] == "integer")
				{
					$ret = radius_put_vendor_int($rad, $a['vid'], $a['id'], $v);
				}
				elseif ($a['type'] == "string")
				{
					$ret = radius_put_vendor_string($rad, $a['vid'], $a['id'], $v);
				}
				elseif ($a['type'] == "ipaddr")
				{
					$ret = radius_put_vendor_addr($rad, $a['vid'], $a['id'], $v);
				}
				else
				{
					$ret = radius_put_vendor_attr($rad, $a['vid'], $a['id'], $v);
				}
			}
			else
			{
				if ($a['type'] == "integer")
				{
					$ret = radius_put_int($rad, $a['id'], $v);
				}
				elseif ($a['type'] == "string")
				{
					$ret = radius_put_string($rad, $a['id'], $v);
				}
				elseif ($a['type'] == "ipaddr")
				{
					$ret = radius_put_addr($rad, $a['id'], $v);
				}
				else
				{
					$ret = radius_put_attr($rad, $a['id'], $v);
				}
			}
			if (!$ret)
			{
				trigger_error('RADIUS set request error:' . radius_strerror($rad), E_USER_NOTICE);
				return;
			}
		}

		$ret = radius_send_request($rad);
		if ($ret === false)
		{
			if ($debug) echo "*debug: send request fail: " . radius_strerror($rad) . "\n";
			trigger_error('RADIUS send request error:' . radius_strerror($rad), E_USER_NOTICE);
			return;
		}
		$t = static::type($ret,true);
		if ($debug) echo "*debug: response #$type" . (isset($t) ? " ($t)" : "") . "\n";

		$reply = array();
		while ($res = radius_get_attr($rad))
		{
			if ($res['attr'] == RADIUS_VENDOR_SPECIFIC)
			{
				$vsa = radius_get_vendor_attr($res['data']);
				$a = static::dict(array('id'=>$vsa['attr'], 'vid'=>$vsa['vendor']));
				$v = $vsa['data'];
			}
			else
			{
				$a = static::dict($res['attr']);
				$v = $res['data'];
			}
			if (isset($a['values']))
			{
				foreach ($a['values'] as $key=>$item)
				{
					if ($item == $v)
					{
						$v = $key;
						break;
					}
				}
			}
			if ($debug) echo "*debug: reply $a[name] (#$a[id], $a[type]" . (isset($a['vid']) ? ", vendor $a[vendor]" : "") . ") := $v" . ((isset($a['values']) && array_key_exists($v, $a['values'])) ? " (#$a[values])" : "") . "\n";
			$reply[$a['name']] = $v;
		}

		return array($ret=>$reply);
	}

	// Сбросить подключение
	function reconnect($session=null, $username=null, $ip=null)
	{
		$req = array();
		$req['RBN-Context_Name'] = 'local';
		if (isset($session)) $req['Acct-Session-Id'] = $session;
		if (isset($username)) $req['User-Name'] = $username;
		if (isset($ip)) $req['Framed-IP-Address'] = $ip;
		return $this->request($req, static::RAD_DISCONNECT_REQUEST);
	}

}