[PATCH] android: randomize pre-association MAC addresses

[Daniel Micay]

> This would need to have a Signed-off-by: line in the commit message as
> described in the top level CONTRIBUTIONS file.

Ah, I missed that sign-offs are used here in the same way as the Linux
kernel. Here it is again:

>From 4a75a244ef4d3c8a3fc503819c2ccce9027717e5 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay at gmail.com>
Date: Sun, 17 Apr 2016 04:17:00 -0400
Subject: [PATCH] android: randomize pre-association MAC addresses

This enables pre-associating (scanning) MAC address randomization for
Android. It uses the default 60 second expiry time.

Change-Id: Id23947f46a0014e2b42913cd0a2cc3f908c3bc62
Signed-off-by: Daniel Micay <danielmicay at gmail.com>
---
 wpa_supplicant/wpa_supplicant_template.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wpa_supplicant/wpa_supplicant_template.conf b/wpa_supplicant/wpa_supplicant_template.conf
index f3f2a64..494d10a 100644
--- a/wpa_supplicant/wpa_supplicant_template.conf
+++ b/wpa_supplicant/wpa_supplicant_template.conf
@@ -4,3 +4,4 @@ eapol_version=1
 ap_scan=1
 fast_reauth=1
 pmf=1
+preassoc_mac_addr=1
-- 
2.8.0

> > diff --git a/wpa_supplicant/wpa_supplicant_template.conf
> > b/wpa_supplicant/wpa_supplicant_template.conf
> 
> > +preassoc_mac_addr=1
> 
> How has this been tested? I'm mainly interested in which Android
> versions and Wi-Fi drivers were used.

It works well on the Nexus 5 (brcmfmac), Nexus 5X (qcacld-2.0) and Nexus
9 (brcmfmac). I think they all use Broadcom chips, but not sure about
which drivers are used. Tested on AOSP 6.0.1 and master.

> I don't think I'd recommend using this preassoc_mac_addr=1 design
> since
> it changes the MAC address of the netdev. Instead, I'd use the pre-
> scan
> request mechanism to request driver to use random MAC addresses. This
> can be configured with the MAC_RAND_SCAN control interface command.

I could try that. Is changing device address harmful?

I saw the MAC_RAND_SCAN feature but I was worried about it not being
supported everywhere and possibly not randomizing the vendor prefix.

I was also planning on wiring up the mac_addr toggle to a setting in
Android, but that wouldn't involve any changes here since it would be
dynamic. So doing the scan randomization this way seemed to make sense
in the context of using the other portion of the feature too.