[1512] use NOTIMP instead of REFUSED for denying update forwarding.

this is actually closer to the current implementation status, and is
compatible BIND 9's behavior when the forwarding ACL is completely NULLified.

src/lib/python/isc/ddns/session.py

@@ -118,9 +118,10 @@ class UpdateSession:
         if zone_type == isc.ddns.zone_config.ZONE_PRIMARY:
             return datasrc_client, zname, zclass
         elif zone_type == isc.ddns.zone_config.ZONE_SECONDARY:
-            # unconditionally refused forwarding (we don't support it yet)
+            # We are a secondary server; since we don't yet support update
+            # forwarding, we return 'not implemented'.
             raise UpdateError('Update forwarding not supported',
-                              zname, zclass, Rcode.REFUSED())
+                              zname, zclass, Rcode.NOTIMP())
         # zone wasn't found
         raise UpdateError('not authoritative for update zone',
                           zname, zclass, Rcode.NOTAUTH())

src/lib/python/isc/ddns/tests/session_tests.py

@@ -115,7 +115,7 @@ class SessionTest(unittest.TestCase):
     def test_update_secondary(self):
         # specified zone is configured as a secondary.  Since this
         # implementation doesn't support update forwarding, the result
-        # should be REFUSED.
+        # should be NOTIMP.
         msg_data, msg = create_update_msg(zones=[Question(TEST_ZONE_NAME,
                                                           TEST_RRCLASS,
                                                           RRType.SOA())])
@@ -124,7 +124,7 @@ class SessionTest(unittest.TestCase):
                                            TEST_RRCLASS,
                                            self.__datasrc_client))
         self.assertEqual(UPDATE_ERROR, session.handle()[0])
-        self.check_response(session.get_message(), Rcode.REFUSED())
+        self.check_response(session.get_message(), Rcode.NOTIMP())
 
     def check_notauth(self, zname, zclass=TEST_RRCLASS):
         '''Common test sequence for the 'notauth' test'''