{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/938","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/938/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/938/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/938/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/938","id":60266651,"number":938,"title":"MAC Randomization for iwlwifi","user":{"login":"marmarek","id":726704,"avatar_url":"https://avatars.githubusercontent.com/u/726704?v=3","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20other","name":"C: other","color":"cccccc"},{"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/P:%20major","name":"P: major","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-08T17:24:01Z","updated_at":"2015-10-05T11:37:24Z","closed_at":null,"body":"**Reported by andrewb on 6 Dec 2014 03:15 UTC**\nSee https://groups.google.com/d/msg/qubes-users/Yo73MZC4038/a5ONmKpLB5YJ -- qubes-users subject \"MAC randomization experiments\":\r\nOn 07/17/14 13:51, Joanna Rutkowska wrote:\r\n> On 07/09/14 14:36, cprise wrote:\r\n>> As a follow-up to the 'random MAC addresses (wifi)' thread, I was\r\n>> wondering if anyone has tried automating it on Qubes and if so, what\r\n>> some of your experiences are.\r\n>>\r\n>> I have started trying out different approaches, but it appears that the\r\n>> hooks/interfaces needed at this level are undergoing a great deal of\r\n>> flux, and the fact of having wifi live in a vm throws a wrinkle or two\r\n>> in there as well.\r\n>>\r\n>> My underlying rule is: Since bootup /and/ resume both reset the address\r\n>> to the hardware ID, randomization must be handled during those events to\r\n>> prevent the wifi interface from becoming active with and broadcasting\r\n>> the hardware ID. Handling the bootup part is easy; Suspend is a whole\r\n>> other story.\r\n>>\r\n> \r\n> The NICs I played with some years ago, specifically Intel AGN WiFi, used\r\n> to relay on the driver code to set the MAC address on device\r\n> initialization. The code looked more or less like this (quoting from\r\n> memory):\r\n> \r\n> my_nc_mac = read_eeprom (eeprom_address_mac);\r\n> set_hw_mac_address (my_nic_mac);\r\n> \r\n> This means the h/w itself doesn't know the MAC apriori (i.e it's not\r\n> burned into the chip), but expects the driver to tell it what the mac\r\n> should be.\r\n> \r\n> Patching the driver code above should be the most sure way to change the\r\n> mac address and ensure the NIC never ever use the original mac.\r\n> \r\n> joanna.\r\n\r\nSince iwlwifi devices are so popular with the business-class systems that seem to work well with Qubes, it makes sense to adopt this \"surefire\" MAC randomization strategy.  Most people who want Qubes probably also want MAC randomization.  Unless there's a more general solution, let's adopt this idea.\r\n\r\nHow much effort would it take to maintain this patch for iwlwifi?  Has someone else done it already?\n\nMigrated-From: https://wiki.qubes-os.org/ticket/938"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/145501913","html_url":"https://github.com/QubesOS/qubes-issues/issues/938#issuecomment-145501913","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/938","id":145501913,"user":{"login":"marmarek","id":726704,"avatar_url":"https://avatars.githubusercontent.com/u/726704?v=3","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T11:37:24Z","updated_at":"2015-10-05T11:37:24Z","body":"On Mon, Oct 05, 2015 at 12:25:47AM -0700, Patrick Schleizer wrote:\n> * 1) if this feature could be implemented in [whonix-setup-wizard](https://github.com/Whonix/whonix-setup-wizard). + A qrexec service so Whonix-Gateway can signal to netvm what to do about MAC spoofing.\n> * 2) Or if rather Whonix-Gateway should be capable to work as netvm. Might be easier to make Whonix-Gateway work as netvm than having Whonix-Gateway and netvm cooperate. (I am not specifically eager to receive all the hardware support questions.)\n\nI think it should be possible to use this feature even without Whonix,\nso none of above.\n\n> There is no network manager plugin. Only the Tails custom implementation which is non-trivial.\n> \n> * don't actively scan the network before the user decided what to do about MAC spoofing\n> * change MAC before touching the network\n> * detect if new wifi hardware is attached, make sure MAC is changed before it tries to connect\n\nCan you point the code/implementation details? Can we reuse some of\nthis?\nIf not, I think it worth evaluate NetworkManager plugin API - this way\nwe may be able to do all the about without fearing some race condition,\nbecause it's NetworkManager who enables and configures the network interface.\n\n> When the user should be given the possibility to enable/disable MAC changing?\n> \n> * a) wizard question, at every boot of netvm [or Whonix-Gateway (netvm)]? [This is what Tails does.] [With wizard I mean something like [Tails Greeter](https://tails.boum.org/doc/first_steps/startup_options/index.en.html#tails_greeter) or whonix-setup-wizard.]\n> * b) wizard question, on first boot of netvm [or Whonix-Gateway (netvm)] only?\n> * c) manually only?\n\nI think this may be configured by pre-configuration stack in response on\nsome firstboot option. Then changeable either in Qubes Manager (which\nwill again use pre-configuration stack), or netvm itself (simple\nconfiguration dialog, separate shortcut in the menu).\n\n-- \nBest Regards,\nMarek Marczykowski-Górecki\nInvisible Things Lab\nA: Because it messes up the order in which people normally read text.\nQ: Why is top-posting such a bad thing?\n"}}