Secure Time Retrival/Synchronization from HTTPS Headers

[ghost]

Just like most routers, UDM uses user-selected NTP servers, like time.cloudflare.com and does not support Network Time Security protocol (https://datatracker.ietf.org/doc/html/draft-ietf-ntp-network-time-security-15), but there is way for Linux to obtain time from HTTPS links using several commands (like CURL) and set such extracted time as system time with specified interval. For example, GrapheneOS does that and has a server dedicated to it.

Another thing that bugs me is that system time is reset after a reboot until UDM re-connects to NTP server and re-acquires time again. Without a local NTP server or WAN connection, time is set to incorrect date of the last firmware update and has to be corrected manually via SSH commands. Is there no way to preserve time after reboot? Doesn't UDM have a battery inside that can keep accurate time information even the router if powered down?

[SamErde]

Woah, what?! What does the time get reset to, and how can that be observed? I'm curious now. There have been comments about bundling an NTP server here before, but I don't recall where those ideas landed.

[ghost]

The date and time are usually set to the date and time of last firmware update, like 8/7/2022. That's the date you get with UDM firmware 3.0.20 and it stays with that date and time until it can synchronize with an NTP server or until someone manually enters correct date and time. That opens up a door to replay attacks where having correct time is crucial.