From ab61a3dd6d968c62b407c170079a236194357931 Mon Sep 17 00:00:00 2001
From: Danny Chiu <Danny.Chiu@infineon.com>
Date: Thu, 4 Nov 2021 02:44:17 -0500
Subject: [PATCH 15/49] Add CONFIG_WPA3_SAE_AUTH_EARLY_SET flags and codes

Enable this flags allow the AP to set authorization to firmware earier as the SAE confirm from is ok.
---
 hostapd/Android.mk            |  4 ++++
 hostapd/Makefile              |  4 ++++
 hostapd/android.config        |  3 +++
 hostapd/defconfig_base        |  3 +++
 src/ap/ieee802_11.c           | 11 +++++++++++
 wpa_supplicant/defconfig_base |  3 +++
 6 files changed, 28 insertions(+)

diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index bf26e41c6..997e9a447 100644
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -264,6 +264,10 @@ NEED_HMAC_SHA256_KDF=y
 NEED_DRAGONFLY=y
 endif
 
+ifdef CONFIG_WPA3_SAE_AUTH_EARLY_SET
+L_CFLAGS += -DCONFIG_WPA3_SAE_AUTH_EARLY_SET
+endif
+
 ifdef CONFIG_OWE
 L_CFLAGS += -DCONFIG_OWE
 NEED_ECC=y
diff --git a/hostapd/Makefile b/hostapd/Makefile
index e37c13b27..c65a51227 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -290,6 +290,10 @@ CFLAGS += -DCONFIG_ETH_P_OUI
 OBJS += ../src/ap/eth_p_oui.o
 endif
 
+ifdef CONFIG_WPA3_SAE_AUTH_EARLY_SET
+CFLAGS += -DCONFIG_WPA3_SAE_AUTH_EARLY_SET
+endif
+
 ifdef CONFIG_SAE
 CFLAGS += -DCONFIG_SAE
 OBJS += ../src/common/sae.o
diff --git a/hostapd/android.config b/hostapd/android.config
index c8b3afabe..3664f1773 100644
--- a/hostapd/android.config
+++ b/hostapd/android.config
@@ -212,3 +212,6 @@ CONFIG_NO_RANDOM_POOL=y
 # release under this optional build parameter. This functionality is subject to
 # be completely removed in a future release.
 CONFIG_WEP=y
+
+# Set SAE Auth status early
+CONFIG_WPA3_SAE_AUTH_EARLY_SET=y
diff --git a/hostapd/defconfig_base b/hostapd/defconfig_base
index 9dcf7848d..dafcf0f6c 100644
--- a/hostapd/defconfig_base
+++ b/hostapd/defconfig_base
@@ -399,5 +399,8 @@ CONFIG_TESTING_OPTIONS=y
 # Simultaneous Authentication of Equals (SAE), WPA3-Personal
 CONFIG_SAE=y
 
+# Set SAE Auth status early
+CONFIG_WPA3_SAE_AUTH_EARLY_SET=y
+
 # Device Provisioning Protocol (DPP)
 CONFIG_DPP=y
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index db4104928..3b735c09f 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -87,6 +87,10 @@ static void handle_auth(struct hostapd_data *hapd,
 			const struct ieee80211_mgmt *mgmt, size_t len,
 			int rssi, int from_queue);
 
+#ifdef CONFIG_WPA3_SAE_AUTH_EARLY_SET
+static void sae_sme_send_external_auth_status(struct hostapd_data *hapd,
+                                              struct sta_info *sta, u16 status);
+#endif /* CONFIG_WPA3_SAE_AUTH_EARLY_SET */
 
 u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid)
 {
@@ -677,6 +681,11 @@ static int auth_sae_send_confirm(struct hostapd_data *hapd,
 	if (data == NULL)
 		return WLAN_STATUS_UNSPECIFIED_FAILURE;
 
+#ifdef CONFIG_WPA3_SAE_AUTH_EARLY_SET
+	wpa_printf(MSG_DEBUG, "\nCalling sae_sme_send_external_auth_status\n");
+	sae_sme_send_external_auth_status(hapd, sta, WLAN_STATUS_SUCCESS);
+#endif /* CONFIG_WPA3_SAE_AUTH_EARLY_SET */
+
 	reply_res = send_auth_reply(hapd, sta, sta->addr, bssid,
 				    WLAN_AUTH_SAE, 2,
 				    WLAN_STATUS_SUCCESS, wpabuf_head(data),
@@ -973,7 +982,9 @@ void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
 	sta->sae->peer_commit_scalar = NULL;
 	wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
 			       sta->sae->pmk, sta->sae->pmkid);
+#ifndef CONFIG_WPA3_SAE_AUTH_EARLY_SET
 	sae_sme_send_external_auth_status(hapd, sta, WLAN_STATUS_SUCCESS);
+#endif /* CONFIG_WPA3_SAE_AUTH_EARLY_SET */
 }
 
 
diff --git a/wpa_supplicant/defconfig_base b/wpa_supplicant/defconfig_base
index 15daf0ad2..99c74853d 100644
--- a/wpa_supplicant/defconfig_base
+++ b/wpa_supplicant/defconfig_base
@@ -248,6 +248,9 @@ CONFIG_CTRL_IFACE=y
 # Simultaneous Authentication of Equals (SAE), WPA3-Personal
 CONFIG_SAE=y
 
+# Set SAE Auth status early
+CONFIG_WPA3_SAE_AUTH_EARLY_SET=y
+
 # Disable scan result processing (ap_scan=1) to save code size by about 1 kB.
 # This can be used if ap_scan=1 mode is never enabled.
 #CONFIG_NO_SCAN_PROCESSING=y
-- 
2.17.1

