From where WPA_PTK state machine enters AUTHENTICATION2 state?

[Jeon]

I am investigating on procedure of WPA_PTK state machine.

So far, I've found a normal transition procedure based on a log file
[1] as following:

INITIALZE -> AUTHENTICATION -> AUTHENTICATION2 -> INITPSK -> PTKSTART
(sending 1/4 Eapol-Key) -> PTKCALCNEGOTIATING -> PTKCALCNEGOTIATING2
-> PTKINITNEGOTIATING -> PTKINITDONE

Also, I've found that the state machine enters INITIALIZE state by invoking:

wpa_auth_sta_associated() -> sm->Init = TRUE -> wpa_sm_step() ->
SM_STEP_RUN(WPA_PTK) -> SM_ENTER(WPA_PTK, INITIALIZE)

And the state machine enters AUTHENTICATIOIN state by invoking:

wpa_auth_sta_associated() -> sm->AuthenticationRequest = TRUE ->
wpa_sm_step() ->SM_STEP_RUN(WPA_PTK) -> SM_ENTER(WPA_PTK,
AUTHENTICATION)

However, I couldn't find a location that makes the state machine enter
AUTHENTICATION2 state after AUTHENTICATION state. The state machine
enters the state when:

1. if (sm->ReAuthenticationRequest)
or
2. swtich(sm->wpa_ptk_state) {case WPA_PTK_AUTHENTICATION}.

But for normal association procedure, ReAuth is not the case. Hence, I
need to find where the source code sets sm->wpa_ptk_state =
WPA_PTK_AUTHENTICATION. However, I couldn't find it.

Could anyone please give me a hint for this?

Regards,
Jeon.

[1] https://gist.github.com/gsongsong/d25d0856a289b98c143b7b8f192a969c#file-hostapd-wpa2-log-L6