shadow1ng/fscan · error

reply rejected

Error message

reply rejected

What it means

replyStatus (bytes 8-12) of an RPC REPLY indicates MSG_ACCEPTED (0) or MSG_DENIED (nonzero). getExports rejects denied replies. MSG_DENIED typically means RPC mismatch (program version unavailable), auth failure, or the server rejecting the call itself rather than the exported data being unavailable.

Source

Thrown at plugins/services/nfs.go:139

	reply, err := readRPCFragment(conn, 4096)
	if err != nil {
		return nil, err
	}
	if len(reply) < 24 {
		return nil, fmt.Errorf("invalid reply")
	}

	replyXID := binary.BigEndian.Uint32(reply[0:4])
	if replyXID != xid {
		return nil, fmt.Errorf("xid mismatch")
	}
	msgType := binary.BigEndian.Uint32(reply[4:8])
	if msgType != 1 { // REPLY
		return nil, fmt.Errorf("not a reply")
	}
	replyStatus := binary.BigEndian.Uint32(reply[8:12])
	if replyStatus != 0 { // MSG_ACCEPTED
		return nil, fmt.Errorf("reply rejected")
	}

	// Skip auth verifier
	offset := 12
	if offset+8 > len(reply) {
		return nil, fmt.Errorf("truncated")
	}
	// verifier flavor + length
	verifierLen := binary.BigEndian.Uint32(reply[offset+4 : offset+8])
	if verifierLen > uint32(len(reply)-offset-8) {
		return nil, fmt.Errorf("truncated verifier")
	}
	offset += 8 + int(verifierLen)
	if pad := (4 - verifierLen%4) % 4; pad > 0 {
		if int(pad) > len(reply)-offset {
			return nil, fmt.Errorf("truncated verifier padding")
		}
		offset += int(pad)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Check the server's export/auth requirements (/etc/exports, krb5 flags) and supply matching AUTH_SYS credentials
2. Verify the mount protocol version the server supports (mountd v1/v3) and send a matching request
3. Test manually with `showmount -e <host>` to see if the server denies RPC broadly
4. Ensure no IPS/firewall is blocking RPC replies

Example fix

// before
// request with no auth flavor/credentials
// after
// use AUTH_SYS (flavor 1) with a valid uid/gid in the call's cred field
callCred := buildAuthSys(uid, gids, hostname)

null

null

exports, err := getExports(conn, xid)
if err != nil && strings.Contains(err.Error(), "reply rejected") {
    return fmt.Errorf("mountd denied RPC call (auth or version mismatch): %w", err)
}

When it happens

Trigger: Calling Scan or TestNFSGetExportsHandlesVerifierPadding against a server whose mountd replies MSG_DENIED — e.g. auth credentials rejected, RPC program/version mismatch, or GSS requirements.

Common situations: Server requires AUTH_SYS credentials the client did not supply; requesting the wrong mount protocol version (v1 vs v3); Kerberos-secured exports (sec=krb5) denying plain calls; firewalls/RPZ filters rejecting RPC.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• invalid reply
• truncated
• accept status: %d
• invalid fragment size: %d
• short fragment payload: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/50f451d60a55e862. Report an issue: GitHub.