commit - f92a2ceba411689890e6f8aab81a03f30b802b10
commit + 4c06b8eec1a1d71f67561d4fa9860850795c56aa
blob - f20208a2fc86c7e816b47db065283690f131e30a
blob + 9efe6d92a92ed57bb49546dfb175f080fc49d00d
--- src/libsunrpc/client.c
+++ src/libsunrpc/client.c
@@ -156,6 +156,7 @@ rpcMuxThread(void *v)
 	Out *o, **out;
 	SunRpc rpc;
 	SunClient *cli;
+	SunStatus ok;
 
 	cli = v;
 	mout = 16;
@@ -262,7 +263,7 @@ if(cli->chatty) fprint(2, "resend %lux %lud %lud\n", o
 			n = (p[0]<<24)|(p[1]<<16)|(p[2]<<8)|p[3];
 			p += 4;
 			ep = p+n;
-			if(sunrpcunpack(p, ep, &p, &rpc) < 0){
+			if((ok = sunrpcunpack(p, ep, &p, &rpc)) != SunSuccess){
 				fprint(2, "%s: in: %.*H unpack failed\n", argv0, n, buf+4);
 				free(buf);
 				break;
@@ -288,9 +289,9 @@ if(cli->chatty) fprint(2, "resend %lux %lud %lud\n", o
 			out[i] = out[--nout];
 			free(o->p);
 			o->p = nil;
+			o->rpc = rpc;
 			if(rpc.status == SunSuccess){
 				o->p = buf;
-				o->rpc = rpc;
 			}else{
 				o->p = nil;
 				free(buf);
@@ -353,9 +354,9 @@ sunclientclose(SunClient *cli)
 	if(!cli->timertid)
 		n++;
 	while(n < 2){
-		threadint(cli->nettid);
-		if(cli->timertid)
-			threadint(cli->timertid);
+	//	threadint(cli->nettid);
+	//	if(cli->timertid)
+	//		threadint(cli->timertid);
 		yield();
 		while(nbrecv(cli->dying, nil) == 1)
 			n++;
@@ -469,6 +470,13 @@ sunclientrpc(SunClient *cli, ulong tag, SunCall *tx, S
 	rx->rpc.prog = tx->rpc.prog;
 	rx->rpc.vers = tx->rpc.vers;
 	rx->type = (rx->rpc.proc<<1)|1;
+	if(rx->rpc.status != SunSuccess){
+		sunerrstr(rx->rpc.status);
+		werrstr("unpack: %r");
+		free(o.p);
+		return -1;
+	}
+
 	if((ok = suncallunpack(prog, p, ep, &p, rx)) != SunSuccess){
 		sunerrstr(ok);
 		werrstr("unpack: %r");
blob - 28890d6c2e69f9e473cbcfa24fab66cc1763c950
blob + a8b917e02360ebd27ffaf989e37394bf0355987e
--- src/libsunrpc/net.c
+++ src/libsunrpc/net.c
@@ -1,5 +1,6 @@
 #include <u.h>
 #include <libc.h>
+#include <ip.h>
 #include <thread.h>
 #include <sunrpc.h>
 
@@ -16,7 +17,10 @@ sunnetlisten(void *v)
 {
 	int fd, lcfd;
 	char ldir[40];
+	uchar ip[IPaddrlen];
+	int port;
 	Arg *a = v;
+	NetConnInfo *nci;
 
 	for(;;){
 		lcfd = listen(a->adir, ldir);
@@ -26,6 +30,19 @@ sunnetlisten(void *v)
 		close(lcfd);
 		if(fd < 0)
 			continue;
+		if(a->srv->ipokay){
+			if((nci = getnetconninfo(nil, fd)) == nil){
+				close(fd);
+				continue;
+			}
+			port = atoi(nci->rserv);
+			parseip(ip, nci->raddr);
+			freenetconninfo(nci);
+			if(!a->srv->ipokay(ip, port)){
+				close(fd);
+				continue;
+			}
+		}
 		if(!sunsrvfd(a->srv, fd))
 			close(fd);
 	}
blob - 4a3069dd45fb2783f8ecf4541c40985b9a690a53
blob + 2bb401534ce8285340b245b763c2226971b93174
--- src/libsunrpc/portmap.c
+++ src/libsunrpc/portmap.c
@@ -489,7 +489,7 @@ static SunProc proc[] = {
 	(P)portRCallitPack, (P)portRCallitUnpack, (S)portRCallitSize, (F)portRCallitPrint, sizeof(PortRCallit),
 };
 
-SunProg portProg = 
+SunProg portprog = 
 {
 	PortProgram,
 	PortVersion,
blob - 628fc21e41a4cc410b95695a3dafc1ddd81ff82f
blob + 914d61fc2f0fdc5e30ba2d811ca5b68acbae1f22
--- src/libsunrpc/prog.c
+++ src/libsunrpc/prog.c
@@ -29,7 +29,7 @@ suncallunpack(SunProg *prog, uchar *a, uchar *ea, ucha
 	if(c->type < 0 || c->type >= prog->nproc || (unpack=prog->proc[c->type].unpack) == nil)
 		return SunProcUnavail;
 	if((*unpack)(a, ea, pa, c) < 0){
-		fprint(2, "%lud %d: %.*H unpack failed\n", prog->prog, c->type, (int)(ea-a), a);
+		fprint(2, "%lud %d: '%.*H' unpack failed\n", prog->prog, c->type, (int)(ea-a), a);
 		return SunGarbageArgs;
 	}
 	return SunSuccess;
blob - 4383593405066eac46a55efcebff48dbb7d2cab8
blob + 837ead212b5a52930bdb15ff6c868a3f49d5df41
--- src/libsunrpc/rpc.c
+++ src/libsunrpc/rpc.c
@@ -68,12 +68,17 @@ sunrpcpack(uchar *a, uchar *ea, uchar **pa, SunRpc *rp
 			|| sunauthinfopack(a, ea, &a, &rpc->verf) < 0)
 				goto Err;
 			break;
+		case SunAuthError:
+			if(sunuint32pack(a, ea, &a, (x=MsgDenied, &x)) < 0
+			|| sunuint32pack(a, ea, &a, (x=MsgAuthError, &x)) < 0)
+				goto Err;
+			break;
 		default:
 			if(sunuint32pack(a, ea, &a, (x=MsgDenied, &x)) < 0)
 				goto Err;
 			break;
 		}
-
+	
 		switch(rpc->status){
 		case SunSuccess:
 			if(sunuint32pack(a, ea, &a, (x=MsgSuccess, &x)) < 0
@@ -90,6 +95,7 @@ sunrpcpack(uchar *a, uchar *ea, uchar **pa, SunRpc *rp
 		default:
 			if(sunuint32pack(a, ea, &a, (x=rpc->status&0xFFFF, &x)) < 0)
 				goto Err;
+
 			break;
 		}
 	}
@@ -118,6 +124,9 @@ sunrpcsize(SunRpc *rpc)
 		case 0:
 		case SunAcceptError:
 			a += 4+sunauthinfosize(&rpc->verf);
+			break;
+		case SunAuthError:
+			a += 4+4;
 			break;
 		default:
 			a += 4;
@@ -169,6 +178,7 @@ sunrpcunpack(uchar *a, uchar *ea, uchar **pa, SunRpc *
 		rpc->iscall = 0;
 		if(sunuint32unpack(a, ea, &a, &x) < 0)
 			goto Err;
+fprint(2, "x %x\n", x);
 		switch(x){
 		default:
 			goto Err;
@@ -200,6 +210,7 @@ sunrpcunpack(uchar *a, uchar *ea, uchar **pa, SunRpc *
 		case MsgDenied:
 			if(sunuint32unpack(a, ea, &a, &x) < 0)
 				goto Err;
+fprint(2, "xx %ux\n", x);
 			switch(x){
 			default:
 				goto Err;
blob - 8b45b44c9d5d60924f34cde2ed0d7c235f6d5d68
blob + 813585876b7f134d75d2e353f80c60c8ae4584f4
--- src/libsunrpc/server.c
+++ src/libsunrpc/server.c
@@ -1,5 +1,6 @@
 #include <u.h>
 #include <libc.h>
+#include <ip.h>
 #include <thread.h>
 #include <sunrpc.h>
 
@@ -79,6 +80,7 @@ sunsrvthreadcreate(SunSrv *srv, void (*fn)(void*), voi
 static void
 sunrpcrequestthread(void *v)
 {
+	int status;
 	uchar *p, *ep;
 	Channel *c;
 	SunSrv *srv = v;
@@ -93,6 +95,7 @@ if(srv->chatty) fprint(2, "sun msg %p count %d\n", m, 
 		m->srv = srv;
 		p = m->data;
 		ep = p+m->count;
+		status = m->rpc.status;
 		if(sunrpcunpack(p, ep, &p, &m->rpc) != SunSuccess){
 			fprint(2, "in: %.*H unpack failed\n", m->count, m->data);
 			sunmsgdrop(m);
@@ -100,7 +103,10 @@ if(srv->chatty) fprint(2, "sun msg %p count %d\n", m, 
 		}
 		if(srv->chatty)
 			fprint(2, "in: %B\n", &m->rpc);
-
+		if(status){
+			sunmsgreplyerror(m, status);
+			continue;
+		}
 		if(srv->alwaysreject){
 			if(srv->chatty)
 				fprint(2, "\trejecting\n");
blob - ff668f83af96909a86debd06a034f3cd9a6199d1
blob + 2e107e658bc29bab1d890f9e496d52749bdb5e76
--- src/libsunrpc/udp.c
+++ src/libsunrpc/udp.c
@@ -48,8 +48,18 @@ sunudpread(void *v)
 	while((n = udpread(arg.fd, &udp, buf, UdpMaxRead)) > 0){
 		if(arg.srv->chatty)
 			fprint(2, "udpread got %d (%d) from %I\n", n, Udphdrsize, udp.raddr);
+		msg = emalloc(sizeof(SunMsgUdp));
+		msg->udp = udp;
+		msg->msg.data = emalloc(n);
+		msg->msg.count = n;
+		memmove(msg->msg.data, buf, n);
+		msg->msg.creply = arg.creply;
+		msg->msg.srv = arg.srv;
+		if(arg.srv->chatty)
+			fprint(2, "message %p count %d\n", msg, msg->msg.count);
 		if((srv->localonly || srv->localparanoia) && ipcmp(udp.raddr, localip) != 0){
 			fprint(2, "dropping message from %I: not local\n", udp.raddr);
+			sunmsgreplyerror(&msg->msg, SunAuthTooWeak);
 			continue;
 		}
 		if(srv->localparanoia){
@@ -59,17 +69,12 @@ sunudpread(void *v)
 				paraport = port;
 			}else if(paraport != port){
 				fprint(2, "dropping message from %I: not port %d\n", udp.raddr, port);
+				sunmsgreplyerror(&msg->msg, SunAuthTooWeak);
 				continue;
 			}
 		}
-		msg = emalloc(sizeof(SunMsgUdp));
-		msg->udp = udp;
-		msg->msg.data = emalloc(n);
-		msg->msg.count = n;
-		memmove(msg->msg.data, buf, n);
-		msg->msg.creply = arg.creply;
-		if(arg.srv->chatty)
-			fprint(2, "message %p count %d\n", msg, msg->msg.count);
+		if(srv->ipokay && !srv->ipokay(udp.raddr, nhgets(udp.rport)))
+			msg->msg.rpc.status = SunProgUnavail;
 		sendp(arg.srv->crequest, msg);
 	}
 }