Permanently change MAC address on Libra 2

[ajkessel]

I've never been able to access WiFi in Marriott hotels from my Libra 2. There is something broken with the portal -- I believe either broken SSL or something with DNS -- that makes it impossible to get through the authentication process. But I've found a workaround -- authenticate with another device, then change the Libra's MAC address to match the other device. I have the following script runnable from Nicklemenu:

#!/bin/sh
ip link set dev wlan0 down
ip link set dev wlan0 address (MAC here)
ip link set dev wlan0 up

which works fine, but the MAC address seems to reset whenever the WiFi goes to sleep and comes back.

I tried adding a similar line to /etc/udhcpc.d/default.script but it's still not "sticking".

Does anyone know how to make this change permanent, or at least have it take effect whenever WiFi comes up?

[Aleron Ives]

Maybe you could add a Wi-Fi toggle to NickelMenu that also runs your script?

[Quoth]

Yes, the local library WiFi doesn't work with any ereader (Kindle and Kobo tried). Probably every library in Ireland is using the same stupid web page where you login in with your browser using your library user ID. It ought to be an anonymous local password for the WiFi point. The browser based Wifi authentications are horrible.

[ajkessel]

Originally Posted by Aleron Ives

Maybe you could add a Wi-Fi toggle to NickelMenu that also runs your script?

That's what I've done, but over time the MAC address reverts and I need to keep re-running the script.

On a standard Linux box, you could permanently set the interface MAC address, for example, in /etc/network/interfaces, but I don't see how to do that on Kobo. I was hoping there was some hook that was run automatically by the device whenever the network interface is brought online or a configuration file like interfaces where the MAC address could be hard-coded.

[PeterT]

Is it possible to change the device that you've used to do the validation to have the Kobo's MAC address; do the validation with that device and just leave the Kobo's MAC address as is?

Sent from my Pixel 7a using Tapatalk

[ajkessel]

Originally Posted by PeterT

Is it possible to change the device that you've used to do the validation to have the Kobo's MAC address; do the validation with that device and just leave the Kobo's MAC address as is?

That was my first thought, but Apple devices (iPhone/iPad) don't allow you to manually set a MAC address without jailbreaking. You can use "private MAC address" which will generate a unique MAC address for each access point, but the device choses the MAC address randomly--you can't specify.

My other device is a Lenovo Carbon X1. You can manually set the MAC address on that, but the NIC forces the first two characters to a certain setting (I think it's 00), I assume to deter improper spoofing, so I can't set it to match the Kobo's default which starts with 58 for me.

[DNSB]

For what it may be worth, a compliant randomized MAC address will have the first bit set to 0 (group/local) and the second bit set to 1 (locally administered) in the first octet. Looking at this in hex, the permitted values for the 2nd character in first octet of the MAC address will be 2 (0010), 6 (0110), A (1010) and E (1110) using most significant to least significant for the bits.

So a randomized MAC address will start with x2:, x6:, xA: or xE;.

Microsoft for some reason insists the first character can't be a 0 but iOS and Android both allow that.

[ajkessel]

Originally Posted by DNSB

For what it may be worth, a compliant randomized MAC address will have the first bit set to 0 (group/local) and the second bit set to 1 (locally administered) in the first octet. Looking at this in hex, the permitted values for the 2nd character in first octet of the MAC address will be 2 (0010), 6 (0110), A (1010) and E (1110) using most significant to least significant for the bits.

So a randomized MAC address will start with x2:, x6:, xA: or xE;.

Microsoft for some reason insists the first character can't be a 0 but iOS and Android both allow that.

Thanks for that detail. That explains why I can't set my Windows box to match the preexisting MAC address of my Kobo, and as mentioned the unjailbroken Apple devices can only use random MAC address, not manually specified MAC addresses.

So I'm back to Plan A which is trying to have a persistent manually set MAC address on my Kobo. Does anyone understand the network interface workflow well enough to have an idea about where to insert a script that would set the MAC address every time the interface is turned on?

[Quoth]

Or install a browser that works with the stupid authentication scheme?

Maybe even just a curl script?

[DNSB]

Have you tried adding 'IgnoreCaptivePortal=true' under the [FeatureSettings] header in the Kobo eReader.conf file in .kobo/Kobo directory? I've had my Sage not show the do you want to continue popup when it couldn't connect to the test site at a couple of conventions.

See Kobo GLO HD and Android Hotspot problem.

[ajkessel]

Originally Posted by Quoth

Or install a browser that works with the stupid authentication scheme?

Maybe even just a curl script?

Yeah, this is a good idea, there is probably some way to get through. Is there a third-party web browser that works reliably?

I'm not sure cURL is possible if the portal requires parsing JavaScript but I'll do some experimentation...

[ajkessel]

Originally Posted by DNSB

Have you tried adding 'IgnoreCaptivePortal=true' under the [FeatureSettings] header in the Kobo eReader.conf file in .kobo/Kobo directory? I've had my Sage not show the do you want to continue popup when it couldn't connect to the test site at a couple of conventions.

See Kobo GLO HD and Android Hotspot problem.

Interesting, I wasn't aware of this. I will give it a try!

[ajkessel]

Unfortunately, no luck with 'IgnoreCaptivePortal=true'. The only difference is I now see a certificate error ("certificate is not trusted / the host www.marriott.com:443 uses an invalid security certificate") but I still can't get through the login screen--it just gets stuck, perhaps due to JavaScript.

I did play around with the terminal in KOReader and ran some wget requests against the Marriott domain but don't see a clear way to actual log in through the command-line.

[Aleron Ives]

Is it possible that the hotel is using TLS 1.3 or some other protocol that is too new for the Libra's browser? Unless you can either ignore certificate errors or alter the certificate store on the Libra, you probably can't bypass that error.

[ajkessel]

Originally Posted by Aleron Ives

Is it possible that the hotel is using TLS 1.3 or some other protocol that is too new for the Libra's browser? Unless you can either ignore certificate errors or alter the certificate store on the Libra, you probably can't bypass that error.

I don't think that's it -- my strong suspicion is certificate authentication is actually broken until you have actually authenticated through the portal. I've seen this on other devices as well. It's true at every Marriott location (or at least the 40+ I've tried).

It still seems to me the simplest solution here is to find a "sticky" solution for the Kobo MAC address. Isn't there something in /etc that is always run when the NIC comes up? I tried some experiments with libexec/dhcpcd-hooks but only succeeded in bricking my network connectivity so had to revert.