process_query: weaken the ACL action for catalog queries to 'query'

diff --git a/doc/configuration.rst b/doc/configuration.rst
index b9c2aac74be2bd4a0e3abed704d39f58c4c67ba7..81c7ed168bd06728005bd98a5f210f2dff0cd58d 100644 (file)
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -633,8 +633,7 @@ It can be configured using all the standard options (but for example
 DNSSEC signing is useless as the zone won't be queried by clients), including primary/secondary configuration
 and ACLs. A catalog zone is indicated by setting the option
 :ref:`zone_catalog-role`. Standard DNS queries to a catalog zone are answered
-with REFUSED as though the zone doesn't exist unless there is a matching ACL
-rule for action transfer configured.
+with NOTAUTH unless there is a matching ACL rule for action at least ``query`` configured.
 The name of the catalog zone is arbitrary. It's possible to configure
 multiple catalog zones.
 

diff --git a/src/knot/nameserver/process_query.c b/src/knot/nameserver/process_query.c
index b8dd17757fffa21f75ea8744435ea3678772dbfe..d82af139331735ce61c106f84a95f90506318fe5 100644 (file)
--- a/src/knot/nameserver/process_query.c
+++ b/src/knot/nameserver/process_query.c
@@ -500,7 +500,7 @@ static int prepare_answer(knot_pkt_t *query, knot_pkt_t *resp, knot_layer_t *ctx
        /* Allow normal queries to catalog only if allowed by ACL. */
        if (qdata->extra->zone != NULL && qdata->extra->zone->is_catalog_flag &&
            query_type(query) == KNOTD_QUERY_TYPE_NORMAL) {
-               if (!process_query_acl_check(conf(), ACL_ACTION_TRANSFER, qdata)) {
+               if (!process_query_acl_check(conf(), ACL_ACTION_QUERY, qdata)) {
                        qdata->extra->zone = NULL;
                        qdata->extra->contents = NULL;
                }

diff --git a/tests-extra/tests/catalog/basic/test.py b/tests-extra/tests/catalog/basic/test.py
index 5169239c007fa4552f4954307630662dd7ff30f7..7a422f056dfc6ff7e60eb6e7da5b81e9a37d0c51 100644 (file)
--- a/tests-extra/tests/catalog/basic/test.py
+++ b/tests-extra/tests/catalog/basic/test.py
@@ -229,7 +229,7 @@ slave.ctl("conf-commit", custom_parm=confsock)
 t.sleep(3)
 try:
     resp = slave.dig("version.catalog1.", "TXT", tsig=True)
-    resp.check(rcode="REFUSED")
+    resp.check(rcode="NOTAUTH")
 except:
     pass