anchor.diff:  -include_lib("diameter/include/diameter.hrl").
   -include_lib("diameter/include/diameter_gen_base_rfc6733.hrl").
   -include("../include/diameter_gen_eap_application_rfc4072.hrl").
  +-include("../include/diameter_gen_nas_application_rfc7155.hrl").
   
   -record(statedata,
   		{sup :: pid(),
  
positive.code: 		StateData) ->
  	{stop, {shutdown, SessionID}, StateData};
  server_passthrough({accept, #subscriber{name = Identity,
  		attributes = Attributes}, SslSocket}, #statedata{eap_id = EapID,
  		start = #radius{}, session_id = SessionID, secret = Secret,
  		req_auth = RequestAuthenticator, radius_fsm = RadiusFsm,
  		radius_id = RadiusID, %ssl_socket = SslSocket,
  		client_rand = ClientRandom, server_rand = ServerRandom}
  		= StateData) ->
  	Seed = [<<ClientRandom/binary, ServerRandom/binary>>],
  	{MSK, _} = prf(SslSocket, master_secret ,
  			<<"ttls keying material">>, Seed, 128),
  	UserName = binary_to_list(Identity),
  	Salt = crypto:rand_uniform(16#8000, 16#ffff),
  	MsMppeKey = encrypt_key(Secret, RequestAuthenticator, Salt, MSK),
  	Attr1 = radius_attributes:store(?UserName, UserName, Attributes),
  	VendorSpecific1 = {?Microsoft, {?MsMppeSendKey, {Salt, MsMppeKey}}},
  	Attr2 = radius_attributes:add(?VendorSpecific, VendorSpecific1, Attr1),
  	VendorSpecific2 = {?Microsoft, {?MsMppeRecvKey, {Salt, MsMppeKey}}},
  	Attr3 = radius_attributes:add(?VendorSpecific, VendorSpecific2, Attr2),
  	EapPacket = #eap_packet{code = success, identifier = EapID},
  	send_response(EapPacket, ?AccessAccept,
  		RadiusID, Attr3, RequestAuthenticator, [], Secret, RadiusFsm, StateData),
  	{stop, {shutdown, SessionID}, StateData};
  server_passthrough(reject, #statedata{eap_id = EapID, 
  		session_id = SessionID, secret = Secret, start = #radius{},
  		req_auth = RequestAuthenticator, radius_fsm = RadiusFsm,
  
negative.code: %% @private
  %%
  init([Sup, radius, ServerAddress, ServerPort, ClientAddress, ClientPort,
  		RadiusFsm, Secret, PasswordReq, SessionID, #radius{attributes =
  		Attributes} = AccessRequest] = _Args) ->
  	{ok, TLSkey} = application:get_env(ocs, tls_key),
  	{ok, TLScert} = application:get_env(ocs, tls_cert),
  	{ok, TLScacert} = application:get_env(ocs, tls_cacert),
  	{ok, Hostname} = inet:gethostname(),
  	ServiceType = case radius_attributes:find(?ServiceType, Attributes) of
  		{error, not_found} ->
  			undefined;
  		{_, ST} ->
  			ST
  	end,
  	StateData = #statedata{sup = Sup, server_address = ServerAddress,
  			server_port = ServerPort, client_address = ClientAddress,
  			client_port = ClientPort, radius_fsm = RadiusFsm, secret = Secret,
  			session_id = SessionID, server_id = list_to_binary(Hostname),
  			start = AccessRequest, tls_key = TLSkey, tls_cert = TLScert,
  			tls_cacert = TLScacert, password_required = PasswordReq,
  			service_type = ServiceType},
  	process_flag(trap_exit, true),
  	{ok, ssl_start, StateData, 0};
  init([Sup, diameter, ServerAddress, ServerPort, ClientAddress, ClientPort,
  