diff --git a/src/libsunrpc/client.c b/src/libsunrpc/client.c
index f20208a..9efe6d9 100644
--- a/src/libsunrpc/client.c
+++ b/src/libsunrpc/client.c
@@ -156,6 +156,7 @@
 	Out *o, **out;
 	SunRpc rpc;
 	SunClient *cli;
+	SunStatus ok;
 
 	cli = v;
 	mout = 16;
@@ -262,7 +263,7 @@
 			n = (p[0]<<24)|(p[1]<<16)|(p[2]<<8)|p[3];
 			p += 4;
 			ep = p+n;
-			if(sunrpcunpack(p, ep, &p, &rpc) < 0){
+			if((ok = sunrpcunpack(p, ep, &p, &rpc)) != SunSuccess){
 				fprint(2, "%s: in: %.*H unpack failed\n", argv0, n, buf+4);
 				free(buf);
 				break;
@@ -288,9 +289,9 @@
 			out[i] = out[--nout];
 			free(o->p);
 			o->p = nil;
+			o->rpc = rpc;
 			if(rpc.status == SunSuccess){
 				o->p = buf;
-				o->rpc = rpc;
 			}else{
 				o->p = nil;
 				free(buf);
@@ -353,9 +354,9 @@
 	if(!cli->timertid)
 		n++;
 	while(n < 2){
-		threadint(cli->nettid);
-		if(cli->timertid)
-			threadint(cli->timertid);
+	//	threadint(cli->nettid);
+	//	if(cli->timertid)
+	//		threadint(cli->timertid);
 		yield();
 		while(nbrecv(cli->dying, nil) == 1)
 			n++;
@@ -469,6 +470,13 @@
 	rx->rpc.prog = tx->rpc.prog;
 	rx->rpc.vers = tx->rpc.vers;
 	rx->type = (rx->rpc.proc<<1)|1;
+	if(rx->rpc.status != SunSuccess){
+		sunerrstr(rx->rpc.status);
+		werrstr("unpack: %r");
+		free(o.p);
+		return -1;
+	}
+
 	if((ok = suncallunpack(prog, p, ep, &p, rx)) != SunSuccess){
 		sunerrstr(ok);
 		werrstr("unpack: %r");
diff --git a/src/libsunrpc/net.c b/src/libsunrpc/net.c
index 28890d6..a8b917e 100644
--- a/src/libsunrpc/net.c
+++ b/src/libsunrpc/net.c
@@ -1,5 +1,6 @@
 #include <u.h>
 #include <libc.h>
+#include <ip.h>
 #include <thread.h>
 #include <sunrpc.h>
 
@@ -16,7 +17,10 @@
 {
 	int fd, lcfd;
 	char ldir[40];
+	uchar ip[IPaddrlen];
+	int port;
 	Arg *a = v;
+	NetConnInfo *nci;
 
 	for(;;){
 		lcfd = listen(a->adir, ldir);
@@ -26,6 +30,19 @@
 		close(lcfd);
 		if(fd < 0)
 			continue;
+		if(a->srv->ipokay){
+			if((nci = getnetconninfo(nil, fd)) == nil){
+				close(fd);
+				continue;
+			}
+			port = atoi(nci->rserv);
+			parseip(ip, nci->raddr);
+			freenetconninfo(nci);
+			if(!a->srv->ipokay(ip, port)){
+				close(fd);
+				continue;
+			}
+		}
 		if(!sunsrvfd(a->srv, fd))
 			close(fd);
 	}
diff --git a/src/libsunrpc/portmap.c b/src/libsunrpc/portmap.c
index 4a3069d..2bb4015 100644
--- a/src/libsunrpc/portmap.c
+++ b/src/libsunrpc/portmap.c
@@ -489,7 +489,7 @@
 	(P)portRCallitPack, (P)portRCallitUnpack, (S)portRCallitSize, (F)portRCallitPrint, sizeof(PortRCallit),
 };
 
-SunProg portProg = 
+SunProg portprog = 
 {
 	PortProgram,
 	PortVersion,
diff --git a/src/libsunrpc/prog.c b/src/libsunrpc/prog.c
index 628fc21..914d61f 100644
--- a/src/libsunrpc/prog.c
+++ b/src/libsunrpc/prog.c
@@ -29,7 +29,7 @@
 	if(c->type < 0 || c->type >= prog->nproc || (unpack=prog->proc[c->type].unpack) == nil)
 		return SunProcUnavail;
 	if((*unpack)(a, ea, pa, c) < 0){
-		fprint(2, "%lud %d: %.*H unpack failed\n", prog->prog, c->type, (int)(ea-a), a);
+		fprint(2, "%lud %d: '%.*H' unpack failed\n", prog->prog, c->type, (int)(ea-a), a);
 		return SunGarbageArgs;
 	}
 	return SunSuccess;
diff --git a/src/libsunrpc/rpc.c b/src/libsunrpc/rpc.c
index 4383593..837ead2 100644
--- a/src/libsunrpc/rpc.c
+++ b/src/libsunrpc/rpc.c
@@ -68,12 +68,17 @@
 			|| sunauthinfopack(a, ea, &a, &rpc->verf) < 0)
 				goto Err;
 			break;
+		case SunAuthError:
+			if(sunuint32pack(a, ea, &a, (x=MsgDenied, &x)) < 0
+			|| sunuint32pack(a, ea, &a, (x=MsgAuthError, &x)) < 0)
+				goto Err;
+			break;
 		default:
 			if(sunuint32pack(a, ea, &a, (x=MsgDenied, &x)) < 0)
 				goto Err;
 			break;
 		}
-
+	
 		switch(rpc->status){
 		case SunSuccess:
 			if(sunuint32pack(a, ea, &a, (x=MsgSuccess, &x)) < 0
@@ -90,6 +95,7 @@
 		default:
 			if(sunuint32pack(a, ea, &a, (x=rpc->status&0xFFFF, &x)) < 0)
 				goto Err;
+
 			break;
 		}
 	}
@@ -119,6 +125,9 @@
 		case SunAcceptError:
 			a += 4+sunauthinfosize(&rpc->verf);
 			break;
+		case SunAuthError:
+			a += 4+4;
+			break;
 		default:
 			a += 4;
 			break;
@@ -169,6 +178,7 @@
 		rpc->iscall = 0;
 		if(sunuint32unpack(a, ea, &a, &x) < 0)
 			goto Err;
+fprint(2, "x %x\n", x);
 		switch(x){
 		default:
 			goto Err;
@@ -200,6 +210,7 @@
 		case MsgDenied:
 			if(sunuint32unpack(a, ea, &a, &x) < 0)
 				goto Err;
+fprint(2, "xx %ux\n", x);
 			switch(x){
 			default:
 				goto Err;
diff --git a/src/libsunrpc/server.c b/src/libsunrpc/server.c
index 8b45b44..8135858 100644
--- a/src/libsunrpc/server.c
+++ b/src/libsunrpc/server.c
@@ -1,5 +1,6 @@
 #include <u.h>
 #include <libc.h>
+#include <ip.h>
 #include <thread.h>
 #include <sunrpc.h>
 
@@ -79,6 +80,7 @@
 static void
 sunrpcrequestthread(void *v)
 {
+	int status;
 	uchar *p, *ep;
 	Channel *c;
 	SunSrv *srv = v;
@@ -93,6 +95,7 @@
 		m->srv = srv;
 		p = m->data;
 		ep = p+m->count;
+		status = m->rpc.status;
 		if(sunrpcunpack(p, ep, &p, &m->rpc) != SunSuccess){
 			fprint(2, "in: %.*H unpack failed\n", m->count, m->data);
 			sunmsgdrop(m);
@@ -100,7 +103,10 @@
 		}
 		if(srv->chatty)
 			fprint(2, "in: %B\n", &m->rpc);
-
+		if(status){
+			sunmsgreplyerror(m, status);
+			continue;
+		}
 		if(srv->alwaysreject){
 			if(srv->chatty)
 				fprint(2, "\trejecting\n");
diff --git a/src/libsunrpc/udp.c b/src/libsunrpc/udp.c
index ff668f8..2e107e6 100644
--- a/src/libsunrpc/udp.c
+++ b/src/libsunrpc/udp.c
@@ -48,8 +48,18 @@
 	while((n = udpread(arg.fd, &udp, buf, UdpMaxRead)) > 0){
 		if(arg.srv->chatty)
 			fprint(2, "udpread got %d (%d) from %I\n", n, Udphdrsize, udp.raddr);
+		msg = emalloc(sizeof(SunMsgUdp));
+		msg->udp = udp;
+		msg->msg.data = emalloc(n);
+		msg->msg.count = n;
+		memmove(msg->msg.data, buf, n);
+		msg->msg.creply = arg.creply;
+		msg->msg.srv = arg.srv;
+		if(arg.srv->chatty)
+			fprint(2, "message %p count %d\n", msg, msg->msg.count);
 		if((srv->localonly || srv->localparanoia) && ipcmp(udp.raddr, localip) != 0){
 			fprint(2, "dropping message from %I: not local\n", udp.raddr);
+			sunmsgreplyerror(&msg->msg, SunAuthTooWeak);
 			continue;
 		}
 		if(srv->localparanoia){
@@ -59,17 +69,12 @@
 				paraport = port;
 			}else if(paraport != port){
 				fprint(2, "dropping message from %I: not port %d\n", udp.raddr, port);
+				sunmsgreplyerror(&msg->msg, SunAuthTooWeak);
 				continue;
 			}
 		}
-		msg = emalloc(sizeof(SunMsgUdp));
-		msg->udp = udp;
-		msg->msg.data = emalloc(n);
-		msg->msg.count = n;
-		memmove(msg->msg.data, buf, n);
-		msg->msg.creply = arg.creply;
-		if(arg.srv->chatty)
-			fprint(2, "message %p count %d\n", msg, msg->msg.count);
+		if(srv->ipokay && !srv->ipokay(udp.raddr, nhgets(udp.rport)))
+			msg->msg.rpc.status = SunProgUnavail;
 		sendp(arg.srv->crequest, msg);
 	}
 }