1 files changed, 41 insertions, 19 deletions

diff --git a/netwatch-dns.rsc b/netwatch-dns.rsc
index 09365ba..9e2f9bc 100644
--- a/netwatch-dns.rsc
+++ b/netwatch-dns.rsc
@@ -1,32 +1,39 @@
 #!rsc by RouterOS
 # RouterOS script: netwatch-dns
-# Copyright (c) 2022-2024 Christian Hesse <mail@eworm.de>
-# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
+# Copyright (c) 2022-2025 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
 #
-# requires RouterOS, version=7.13
+# requires RouterOS, version=7.16
+# requires device-mode, fetch
 #
 # monitor and manage dns/doh with netwatch
-# https://git.eworm.de/cgit/routeros-scripts/about/doc/netwatch-dns.md
+# https://rsc.eworm.de/doc/netwatch-dns.md
 
-:global GlobalFunctionsReady;
-:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
-
-:do {
+:local ExitOK false;
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
   :local ScriptName [ :jobname ];
 
   :global CertificateAvailable;
   :global EitherOr;
+  :global IsDNSResolving;
+  :global IsTimeSync;
   :global LogPrint;
+  :global LogPrintOnce;
   :global ParseKeyValueStore;
   :global ScriptLock;
 
   :if ([ $ScriptLock $ScriptName ] = false) do={
+    :set ExitOK true;
     :error false;
   }
 
   :local SettleTime (5m30s - [ /system/resource/get uptime ]);
   :if ($SettleTime > 0s) do={
     $LogPrint info $ScriptName ("System just booted, giving netwatch " . $SettleTime . " to settle.");
+    :set ExitOK true;
     :error true;
   }
 
@@ -67,11 +74,17 @@
   :local DohCurrent [ /ip/dns/get use-doh-server ];
   :local DohServers ({});
 
+  :if ([ :len $DohCurrent ] > 0 && [ $IsDNSResolving ] = false && [ $IsTimeSync ] = false) do={
+    $LogPrint info $ScriptName ("Time is not sync, disabling DoH: " . $DohCurrent);
+    /ip/dns/set use-doh-server="";
+    :set DohCurrent "";
+  }
+
   :foreach Host in=[ /tool/netwatch/find where comment~"\\bdoh\\b" status="up" ] do={
     :local HostVal [ /tool/netwatch/get $Host ];
     :local HostInfo [ $ParseKeyValueStore ($HostVal->"comment") ];
     :local HostName [ /ip/dns/static/find where name address=($HostVal->"host") \
-        (!type or type="A" or type="AAAA") !disabled !dynamic ];
+        (type="A" or type="AAAA") !disabled !dynamic ];
     :if ([ :len $HostName ] > 0) do={
       :set HostName [ /ip/dns/static/get ($HostName->0) name ];
     }
@@ -83,6 +96,7 @@
 
       :if ($DohCurrent = $HostInfo->"doh-url") do={
         $LogPrint debug $ScriptName ("Current DoH server is still up: " . $DohCurrent);
+        :set ExitOK true;
         :error true;
       }
 
@@ -104,22 +118,28 @@
     }
 
     :local Data false;
-    :do {
-      :set Data ([ /tool/fetch check-certificate=yes-without-crl output=user \
-        http-header-field=({ "accept: application/dns-message" }) \
-        url=(($DohServer->"doh-url") . "?dns=" . [ :convert to=base64 ([ :rndstr length=2 ] . \
-        "\01\00" . "\00\01" . "\00\00" . "\00\00" . "\00\00" . "\09doh-check\05eworm\02de\00" . \
-        "\00\10" . "\00\01") ]) as-value ]->"data");
-    } on-error={
-      $LogPrint warning $ScriptName ("Request to DoH server failed (network or certificate issue): " . \
-        ($DohServer->"doh-url"));
+    :onerror Err {
+      :retry {
+        :set Data ([ /tool/fetch check-certificate=yes-without-crl output=user \
+          http-header-field=({ "accept: application/dns-message" }) \
+          url=(($DohServer->"doh-url") . "?dns=" . [ :convert to=base64 ([ :rndstr length=2 ] . \
+          "\01\00" . "\00\01" . "\00\00" . "\00\00" . "\00\00" . "\09doh-check\05eworm\02de\00" . \
+          "\00\10" . "\00\01") ]) as-value ]->"data");
+      } delay=1s max=3;
+    } do={
+      $LogPrint warning $ScriptName ("Request to DoH server " . ($DohServer->"doh-url") . \
+          " failed: " . $Err);
     }
 
     :if ($Data != false) do={
       :if ([ :typeof [ :find $Data "doh-check-OK" ] ] = "num") do={
         /ip/dns/set use-doh-server=($DohServer->"doh-url") verify-doh-cert=yes;
+        :if ([ /certificate/settings/get crl-use ] = true) do={
+          $LogPrintOnce warning $ScriptName ("Configured to use CRL, that can cause severe issue!");
+        }
         /ip/dns/cache/flush;
         $LogPrint info $ScriptName ("Setting DoH server: " . ($DohServer->"doh-url"));
+        :set ExitOK true;
         :error true;
       } else={
         $LogPrint warning $ScriptName ("Received unexpected response from DoH server: " . \
@@ -127,4 +147,6 @@
       }
     }
   }
-} on-error={ }
+} do={
+  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+}