netwatch-dns: check with a HTTP/2 request

We need RouterOS 7.24 for this to catch runtime errors for bad
command parameters.

Actually this would work with RouterOS 7.23 on architectures that
support http-version=http2 ...

CERTIFICATES.md

@@ -48,7 +48,9 @@ can be closed now.)
 ![screenshot: window](CERTIFICATES.d/03-window.avif)
 
 A new tab opens, showing information on the server certificate and its
-chain of trust. The leftmost certificate is what we are interested in.
+chain of trust. The leftmost certificate is the current server certificate,
+the rightmost one is the *certification authority* certificate and what we
+are interested in.
 
 ![screenshot: certificate](CERTIFICATES.d/04-certificate.avif)
 

doc/netwatch-dns.md

@@ -4,7 +4,7 @@ Manage DNS and DoH servers from netwatch
 [![GitHub stars](https://img.shields.io/github/stars/eworm-de/routeros-scripts?logo=GitHub&style=flat&color=red)](https://github.com/eworm-de/routeros-scripts/stargazers)
 [![GitHub forks](https://img.shields.io/github/forks/eworm-de/routeros-scripts?logo=GitHub&style=flat&color=green)](https://github.com/eworm-de/routeros-scripts/network)
 [![GitHub watchers](https://img.shields.io/github/watchers/eworm-de/routeros-scripts?logo=GitHub&style=flat&color=blue)](https://github.com/eworm-de/routeros-scripts/watchers)
-[![required RouterOS version](https://img.shields.io/badge/RouterOS-7.22-yellow?style=flat)](https://mikrotik.com/download/changelogs/)
+[![required RouterOS version](https://img.shields.io/badge/RouterOS-7.24rc1-yellow?style=flat)](https://mikrotik.com/download/changelogs/)
 [![Telegram group @routeros_scripts](https://img.shields.io/badge/Telegram-%40routeros__scripts-%2326A5E4?logo=telegram&style=flat)](https://t.me/routeros_scripts)
 [![donate with PayPal](https://img.shields.io/badge/Like_it%3F-Donate!-orange?logo=githubsponsors&logoColor=orange&style=flat)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=A4ZXBD6YS2W8J)
 

global-functions.rsc

@@ -112,7 +112,7 @@
   :global ParseKeyValueStore;
 
   :if ([ :len $UseFor ] = 0) do={
-    $LogPrint warning $0 ("The intended use is undefined!");
+    $LogPrint info $0 ("The intended use is undefined!");
     :set UseFor "undefined";
   }
 

netwatch-dns.rsc

@@ -3,7 +3,7 @@
 # Copyright (c) 2022-2026 Christian Hesse <mail@eworm.de>
 # https://rsc.eworm.de/COPYING.md
 #
-# requires RouterOS, version=7.22
+# requires RouterOS, version=7.24rc1
 # requires device-mode, fetch
 #
 # monitor and manage dns/doh with netwatch
@@ -113,11 +113,16 @@
       :local I 1;
       :retry {
         :set I ($I ^ 1);
-        :set Data ([ /tool/fetch check-certificate=yes-without-crl output=user \
-          http-header-field=({ "accept: application/dns-message" }) \
-          url=(($DohServer->"doh-url") . "?dns=" . [ :convert to=base64 ([ :rndstr length=2 ] . \
+        :local Url (($DohServer->"doh-url") . "?dns=" . [ :convert to=base64 ([ :rndstr length=2 ] . \
           "\01\00" . "\00\01" . "\00\00" . "\00\00" . "\00\00" . "\09doh-check\05eworm" . \
-          ({ "\02de"; "\03net" }->$I) . "\00" . "\00\10" . "\00\01") ]) as-value ]->"data");
+          ({ "\02de"; "\03net" }->$I) . "\00" . "\00\10" . "\00\01") ]);
+        :do {
+          :set Data ([ /tool/fetch check-certificate=yes-without-crl output=user http-version=http2 \
+            http-header-field=({ "accept: application/dns-message" }) url=$Url as-value ]->"data");
+        } on-error={
+          :set Data ([ /tool/fetch check-certificate=yes-without-crl output=user \
+            http-header-field=({ "accept: application/dns-message" }) url=$Url as-value ]->"data");
+        }
       } delay=500ms max=6;
     } do={
       $LogPrint warning $ScriptName ("Request to DoH server " . ($DohServer->"doh-url") . \