-Wall -Werror sweep on i386.

8 files changed, 197 insertions, 74 deletions

diff --git a/kerberosV/src/kdc/kaserver.c b/kerberosV/src/kdc/kaserver.c
index c57ba4dfee9..be739c2b7b0 100644
--- a/kerberosV/src/kdc/kaserver.c
+++ b/kerberosV/src/kdc/kaserver.c
@@ -33,11 +33,9 @@
 
 #include "kdc_locl.h"
 
-RCSID("$KTH: kaserver.c,v 1.15 2001/01/28 21:51:05 assar Exp $");
+RCSID("$KTH: kaserver.c,v 1.18 2001/08/17 07:49:01 joda Exp $");
 
-#ifdef KASERVER
 
-#include "kerberos4.h"
 #include <rx.h>
 
 #define KA_AUTHENTICATION_SERVICE 731
@@ -261,11 +259,12 @@ create_reply_ticket (struct rx_header *hdr,
     struct rx_header reply_hdr;
     des_cblock zero;
     size_t pad;
-    unsigned fyrtiosjuelva;
+    unsigned fyrtiosjuelva; /* XXX better variable name 
+			       (this means 4711 in swedish. not kidding */
 
     /* create the ticket */
 
-    des_new_random_key(&session);
+    des_new_random_key((unsigned char *)&session);
 
     krb_create_ticket (&ticket, 0, name, instance, realm,
 		       addr->sin_addr.s_addr,
@@ -312,8 +311,8 @@ create_reply_ticket (struct rx_header *hdr,
 
     /* encrypt it */
     des_set_key (key, schedule);
-    des_pcbc_encrypt ((des_cblock *)enc_data.data,
-		      (des_cblock *)enc_data.data,
+    des_pcbc_encrypt (enc_data.data,
+		      enc_data.data,
 		      enc_data.length,
 		      schedule,
 		      key,
@@ -406,10 +405,10 @@ do_authenticate (struct rx_header *hdr,
     snprintf (client_name, sizeof(client_name), "%s.%s@%s",
 	      name, instance, v4_realm);
 
-    client_entry = db_fetch4 (name, instance, v4_realm);
-    if (client_entry == NULL) {
-	kdc_log(0, "Client not found in database: %s",
-		client_name);
+    ret = db_fetch4 (name, instance, v4_realm, &client_entry);
+    if (ret) {
+	kdc_log(0, "Client not found in database: %s: %s",
+		client_name, krb5_get_err_text(context, ret));
 	make_error_reply (hdr, KANOENT, reply);
 	goto out;
     }
@@ -417,9 +416,10 @@ do_authenticate (struct rx_header *hdr,
     snprintf (server_name, sizeof(server_name), "%s.%s@%s",
 	      "krbtgt", v4_realm, v4_realm);
 
-    server_entry = db_fetch4 ("krbtgt", v4_realm, v4_realm);
-    if (server_entry == NULL) {
-	kdc_log(0, "Server not found in database: %s", server_name);
+    ret = db_fetch4 ("krbtgt", v4_realm, v4_realm, &server_entry);
+    if (ret) {
+	kdc_log(0, "Server not found in database: %s: %s",
+		server_name, krb5_get_err_text(context, ret));
 	make_error_reply (hdr, KANOENT, reply);
 	goto out;
     }
@@ -433,17 +433,17 @@ do_authenticate (struct rx_header *hdr,
     }
 
     /* find a DES key */
-    ret = get_des_key(client_entry, TRUE, &ckey);
+    ret = get_des_key(client_entry, FALSE, TRUE, &ckey);
     if(ret){
-	kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	kdc_log(0, "no suitable DES key for client");
 	make_error_reply (hdr, KANOKEYS, reply);
 	goto out;
     }
 
     /* find a DES key */
-    ret = get_des_key(server_entry, TRUE, &skey);
+    ret = get_des_key(server_entry, TRUE, TRUE, &skey);
     if(ret){
-	kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	kdc_log(0, "no suitable DES key for server");
 	make_error_reply (hdr, KANOKEYS, reply);
 	goto out;
     }
@@ -451,8 +451,8 @@ do_authenticate (struct rx_header *hdr,
     /* try to decode the `request' */
     memcpy (&key, ckey->key.keyvalue.data, sizeof(key));
     des_set_key (&key, schedule);
-    des_pcbc_encrypt ((des_cblock *)request.data,
-		      (des_cblock *)request.data,
+    des_pcbc_encrypt (request.data,
+		      request.data,
 		      request.length,
 		      schedule,
 		      &key,
@@ -599,9 +599,10 @@ do_getticket (struct rx_header *hdr,
     snprintf (server_name, sizeof(server_name),
 	      "%s.%s@%s", name, instance, v4_realm);
 
-    server_entry = db_fetch4 (name, instance, v4_realm);
-    if (server_entry == NULL) {
-	kdc_log(0, "Server not found in database: %s", server_name);
+    ret = db_fetch4 (name, instance, v4_realm, &server_entry);
+    if (ret) {
+	kdc_log(0, "Server not found in database: %s: %s",
+		server_name, krb5_get_err_text(context, ret));
 	make_error_reply (hdr, KANOENT, reply);
 	goto out;
     }
@@ -614,26 +615,26 @@ do_getticket (struct rx_header *hdr,
 	goto out;
     }
 
-    krbtgt_entry = db_fetch4 ("krbtgt", v4_realm, v4_realm);
-    if (krbtgt_entry == NULL) {
-	kdc_log(0, "Server not found in database: %s.%s@%s",
-		"krbtgt", v4_realm, v4_realm);
+    ret = db_fetch4 ("krbtgt", v4_realm, v4_realm, &krbtgt_entry);
+    if (ret) {
+	kdc_log(0, "Server not found in database: %s.%s@%s: %s",
+		"krbtgt", v4_realm, v4_realm, krb5_get_err_text(context, ret));
 	make_error_reply (hdr, KANOENT, reply);
 	goto out;
     }
 
     /* find a DES key */
-    ret = get_des_key(krbtgt_entry, TRUE, &kkey);
+    ret = get_des_key(krbtgt_entry, TRUE, TRUE, &kkey);
     if(ret){
-	kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	kdc_log(0, "no suitable DES key for krbtgt");
 	make_error_reply (hdr, KANOKEYS, reply);
 	goto out;
     }
 
     /* find a DES key */
-    ret = get_des_key(server_entry, TRUE, &skey);
+    ret = get_des_key(server_entry, TRUE, TRUE, &skey);
     if(ret){
-	kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	kdc_log(0, "no suitable DES key for server");
 	make_error_reply (hdr, KANOKEYS, reply);
 	goto out;
     }
@@ -818,5 +819,3 @@ out:
     krb5_storage_free (sp);
     return ret;
 }
-
-#endif /* KASERVER */
diff --git a/kerberosV/src/kdc/kerberos4.c b/kerberosV/src/kdc/kerberos4.c
index 834c730859f..2da37685ab7 100644
--- a/kerberosV/src/kdc/kerberos4.c
+++ b/kerberosV/src/kdc/kerberos4.c
@@ -33,7 +33,7 @@
 
 #include "kdc_locl.h"
 
-RCSID("$KTH: kerberos4.c,v 1.36 2001/01/30 01:44:08 assar Exp $");
+RCSID("$KTH: kerberos4.c,v 1.38 2001/08/21 23:00:16 assar Exp $");
 
 #ifdef KRB4
 
@@ -109,9 +109,10 @@ db_fetch4(const char *name, const char *instance, const char *realm,
 }
 
 krb5_error_code
-get_des_key(hdb_entry *principal, krb5_boolean prefer_afs_key, Key **ret_key)
+get_des_key(hdb_entry *principal, krb5_boolean is_server, 
+	    krb5_boolean prefer_afs_key, Key **ret_key)
 {
-    Key *v5_key = NULL, *v4_key = NULL, *afs_key = NULL;
+    Key *v5_key = NULL, *v4_key = NULL, *afs_key = NULL, *server_key = NULL;
     int i;
     krb5_enctype etypes[] = { ETYPE_DES_CBC_MD5, 
 			      ETYPE_DES_CBC_MD4, 
@@ -119,7 +120,8 @@ get_des_key(hdb_entry *principal, krb5_boolean prefer_afs_key, Key **ret_key)
 
     for(i = 0;
 	i < sizeof(etypes)/sizeof(etypes[0])
-	    && (v5_key == NULL || v4_key == NULL || afs_key == NULL);
+	    && (v5_key == NULL || v4_key == NULL || 
+		afs_key == NULL || server_key == NULL);
 	++i) {
 	Key *key = NULL;
 	while(hdb_next_enctype2key(context, principal, etypes[i], &key) == 0) {
@@ -133,7 +135,8 @@ get_des_key(hdb_entry *principal, krb5_boolean prefer_afs_key, Key **ret_key)
 	    } else if(key->salt->type == hdb_afs3_salt) {
 		if(afs_key == NULL)
 		    afs_key = key;
-	    }
+	    } else if(server_key == NULL)
+		server_key = key;
 	}
     }
 
@@ -144,6 +147,8 @@ get_des_key(hdb_entry *principal, krb5_boolean prefer_afs_key, Key **ret_key)
 	    *ret_key = v4_key;
 	else if(v5_key)
 	    *ret_key = v5_key;
+	else if(is_server && server_key)
+	    *ret_key = server_key;
 	else
 	    return KERB_ERR_NULL_KEY;
     } else {
@@ -153,6 +158,8 @@ get_des_key(hdb_entry *principal, krb5_boolean prefer_afs_key, Key **ret_key)
 	    *ret_key = afs_key;
 	else  if(v5_key)
 	    *ret_key = v5_key;
+	else if(is_server && server_key)
+	    *ret_key = server_key;
 	else
 	    return KERB_ERR_NULL_KEY;
     }
@@ -267,12 +274,11 @@ do_version4(unsigned char *buf,
 	    goto out1;
 	}
 
-	ret = get_des_key(client, FALSE, &ckey);
+	ret = get_des_key(client, FALSE, FALSE, &ckey);
 	if(ret){
-	    kdc_log(0, "%s", krb5_get_err_text(context, ret));
-	    /* XXX */
+	    kdc_log(0, "no suitable DES key for client");
 	    make_err_reply(reply, KDC_NULL_KEY, 
-			   "No DES key in database (client)");
+			   "no suitable DES key for client");
 	    goto out1;
 	}
 
@@ -290,12 +296,12 @@ do_version4(unsigned char *buf,
 	}
 #endif
 	
-	ret = get_des_key(server, FALSE, &skey);
+	ret = get_des_key(server, TRUE, FALSE, &skey);
 	if(ret){
-	    kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	    kdc_log(0, "no suitable DES key for server");
 	    /* XXX */
 	    make_err_reply(reply, KDC_NULL_KEY, 
-			   "No DES key in database (server)");
+			   "no suitable DES key for server");
 	    goto out1;
 	}
 
@@ -312,7 +318,7 @@ do_version4(unsigned char *buf,
 	    KTEXT r;
 	    des_cblock session;
 
-	    des_new_random_key(&session);
+	    des_new_random_key((unsigned char *)&session);
 
 	    krb_create_ticket(&ticket, 0, name, inst, v4_realm,
 			      addr->sin_addr.s_addr, session, life, kdc_time, 
@@ -375,12 +381,12 @@ do_version4(unsigned char *buf,
 	    goto out2;
 	}
 
-	ret = get_des_key(tgt, FALSE, &tkey);
+	ret = get_des_key(tgt, TRUE, FALSE, &tkey);
 	if(ret){
-	    kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	    kdc_log(0, "no suitable DES key for krbtgt");
 	    /* XXX */
 	    make_err_reply(reply, KDC_NULL_KEY, 
-			   "No DES key in database (krbtgt)");
+			   "no suitable DES key for krbtgt");
 	    goto out2;
 	}
 
@@ -463,12 +469,12 @@ do_version4(unsigned char *buf,
 	    goto out2;
 	}
 
-	ret = get_des_key(server, FALSE, &skey);
+	ret = get_des_key(server, TRUE, FALSE, &skey);
 	if(ret){
-	    kdc_log(0, "%s", krb5_get_err_text(context, ret));
+	    kdc_log(0, "no suitable DES key for server");
 	    /* XXX */
 	    make_err_reply(reply, KDC_NULL_KEY, 
-			   "No DES key in database (server)");
+			   "no suitable DES key for server");
 	    goto out2;
 	}
 
@@ -487,7 +493,7 @@ do_version4(unsigned char *buf,
 	    KTEXT_ST cipher, ticket;
 	    KTEXT r;
 	    des_cblock session;
-	    des_new_random_key(&session);
+	    des_new_random_key((unsigned char *)&session);
 	    krb_create_ticket(&ticket, 0, ad.pname, ad.pinst, ad.prealm,
 			      addr->sin_addr.s_addr, &session, life, kdc_time,
 			      sname, sinst, skey->key.keyvalue.data);
diff --git a/kerberosV/src/kuser/kinit.c b/kerberosV/src/kuser/kinit.c
index aefac52560e..e286c6cfd0e 100644
--- a/kerberosV/src/kuser/kinit.c
+++ b/kerberosV/src/kuser/kinit.c
@@ -618,7 +618,7 @@ main (int argc, char **argv)
 #ifdef KRB4
     if(get_v4_tgt == -1)
 	krb5_appdefault_boolean(context, "kinit", 
-				krb5_principal_get_realm(context, principal), 
+				(krb5_realm)krb5_principal_get_realm(context, principal), 
 				"krb4_get_tickets", TRUE, &get_v4_tgt);
 #endif
 
diff --git a/kerberosV/src/lib/kadm5/ipropd_master.c b/kerberosV/src/lib/kadm5/ipropd_master.c
index 22c93d0ab70..97a6f71e3dd 100644
--- a/kerberosV/src/lib/kadm5/ipropd_master.c
+++ b/kerberosV/src/lib/kadm5/ipropd_master.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -32,8 +32,9 @@
  */
 
 #include "iprop.h"
+#include <util.h>
 
-RCSID("$KTH: ipropd_master.c,v 1.21 2000/11/15 23:12:45 assar Exp $");
+RCSID("$KTH: ipropd_master.c,v 1.23 2001/08/30 15:15:50 nectar Exp $");
 
 static krb5_log_facility *log_facility;
 
@@ -380,6 +381,7 @@ main(int argc, char **argv)
 	exit(0);
     }
 
+    pidfile (NULL);
     krb5_openlog (context, "ipropd-master", &log_facility);
     krb5_set_warn_dest(context, log_facility);
 
@@ -472,8 +474,9 @@ main(int argc, char **argv)
 		send_diffs (context, p, log_fd, database, current_version);
 	}
 
-	for(p = slaves; p != NULL && ret--; p = p->next)
+	for(p = slaves; p != NULL; p = p->next)
 	    if (FD_ISSET(p->fd, &readset)) {
+		--ret;
 		if(process_msg (context, p, log_fd, database, current_version))
 		    remove_slave (context, p, &slaves);
 	    }
diff --git a/kerberosV/src/lib/kadm5/ipropd_slave.c b/kerberosV/src/lib/kadm5/ipropd_slave.c
index 852d976f7f3..b4801669350 100644
--- a/kerberosV/src/lib/kadm5/ipropd_slave.c
+++ b/kerberosV/src/lib/kadm5/ipropd_slave.c
@@ -32,6 +32,7 @@
  */
 
 #include "iprop.h"
+#include <util.h>
 
 RCSID("$KTH: ipropd_slave.c,v 1.24 2001/08/31 03:12:17 assar Exp $");
 
diff --git a/kerberosV/src/lib/krb5/crypto.c b/kerberosV/src/lib/krb5/crypto.c
index 65b5757eddf..017142551cf 100644
--- a/kerberosV/src/lib/krb5/crypto.c
+++ b/kerberosV/src/lib/krb5/crypto.c
@@ -248,12 +248,12 @@ DES_AFS3_Transarc_string_to_key (krb5_data pw,
     memcpy(&temp_key, "kerberos", 8);
     des_set_odd_parity (&temp_key);
     des_set_key (&temp_key, schedule);
-    des_cbc_cksum (password, &ivec, passlen, schedule, &ivec);
+    des_cbc_cksum ((des_cblock *)password, &ivec, passlen, schedule, &ivec);
 
     memcpy(&temp_key, &ivec, 8);
     des_set_odd_parity (&temp_key);
     des_set_key (&temp_key, schedule);
-    des_cbc_cksum (password, key, passlen, schedule, &ivec);
+    des_cbc_cksum ((des_cblock *)password, key, passlen, schedule, &ivec);
     memset(&schedule, 0, sizeof(schedule));
     memset(&temp_key, 0, sizeof(temp_key));
     memset(&ivec, 0, sizeof(ivec));
@@ -359,8 +359,9 @@ DES3_string_to_key(krb5_context context,
 	    des_set_key(keys + i, s[i]);
 	}
 	memset(&ivec, 0, sizeof(ivec));
-	des_ede3_cbc_encrypt(tmp, tmp, sizeof(tmp), 
-			     s[0], s[1], s[2], &ivec, DES_ENCRYPT);
+	des_ede3_cbc_encrypt((des_cblock *)tmp, (des_cblock *)tmp,
+			     sizeof(tmp), s[0], s[1], s[2], &ivec,
+			     DES_ENCRYPT);
 	memset(s, 0, sizeof(s));
 	memset(&ivec, 0, sizeof(ivec));
 	for(i = 0; i < 3; i++){
@@ -894,8 +895,8 @@ RSA_MD4_DES_checksum(krb5_context context,
     MD4_Update (&md4, data, len);
     MD4_Final (p + 8, &md4);
     memset (&ivec, 0, sizeof(ivec));
-    des_cbc_encrypt(p, 
-		    p, 
+    des_cbc_encrypt((des_cblock *)p, 
+		    (des_cblock *)p, 
 		    24, 
 		    key->schedule->data, 
 		    &ivec, 
@@ -969,8 +970,8 @@ RSA_MD5_DES_checksum(krb5_context context,
     MD5_Update (&md5, data, len);
     MD5_Final (p + 8, &md5);
     memset (&ivec, 0, sizeof(ivec));
-    des_cbc_encrypt(p, 
-		    p, 
+    des_cbc_encrypt((des_cblock *)p, 
+		    (des_cblock *)p, 
 		    24, 
 		    key->schedule->data, 
 		    &ivec, 
@@ -1031,8 +1032,8 @@ RSA_MD5_DES3_checksum(krb5_context context,
     MD5_Update (&md5, data, len);
     MD5_Final (p + 8, &md5);
     memset (&ivec, 0, sizeof(ivec));
-    des_ede3_cbc_encrypt(p, 
-			 p, 
+    des_ede3_cbc_encrypt((des_cblock *)p, 
+			 (des_cblock *)p, 
 			 24, 
 			 sched[0], sched[1], sched[2],
 			 &ivec, 
diff --git a/kerberosV/src/lib/krb5/init_creds.c b/kerberosV/src/lib/krb5/init_creds.c
index f66e694f6e8..7478dd149cf 100644
--- a/kerberosV/src/lib/krb5/init_creds.c
+++ b/kerberosV/src/lib/krb5/init_creds.c
@@ -103,26 +103,26 @@ krb5_get_init_creds_opt_set_default_flags(krb5_context context,
     time_t t;
 
     b = get_config_bool (context, realm, "forwardable");
-    krb5_appdefault_boolean(context, appname, realm, "forwardable", b, &b);
+    krb5_appdefault_boolean(context, appname, (krb5_realm)realm, "forwardable", b, &b);
     krb5_get_init_creds_opt_set_forwardable(opt, b);
 
     b = get_config_bool (context, realm, "proxiable");
-    krb5_appdefault_boolean(context, appname, realm, "proxiable", b, &b);
+    krb5_appdefault_boolean(context, appname, (krb5_realm)realm, "proxiable", b, &b);
     krb5_get_init_creds_opt_set_proxiable (opt, b);
 
-    krb5_appdefault_time(context, appname, realm, "ticket_lifetime", 0, &t);
+    krb5_appdefault_time(context, appname, (krb5_realm)realm, "ticket_lifetime", 0, &t);
     if (t == 0)
 	t = get_config_time (context, realm, "ticket_lifetime", 0);
     if(t != 0)
 	krb5_get_init_creds_opt_set_tkt_life(opt, t);
     
-    krb5_appdefault_time(context, appname, realm, "renew_lifetime", 0, &t);
+    krb5_appdefault_time(context, appname, (krb5_realm)realm, "renew_lifetime", 0, &t);
     if (t == 0)
 	t = get_config_time (context, realm, "renew_lifetime", 0);
     if(t != 0)
 	krb5_get_init_creds_opt_set_renew_life(opt, t);
 
-    krb5_appdefault_boolean(context, appname, realm, "no-addresses", FALSE, &b);
+    krb5_appdefault_boolean(context, appname, (krb5_realm)realm, "no-addresses", FALSE, &b);
     if (b)
 	krb5_get_init_creds_opt_set_address_list (opt, &no_addrs);
 
diff --git a/kerberosV/src/lib/roken/resolve.c b/kerberosV/src/lib/roken/resolve.c
index cfcb769225c..7d93caff61b 100644
--- a/kerberosV/src/lib/roken/resolve.c
+++ b/kerberosV/src/lib/roken/resolve.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -43,7 +43,9 @@
 #endif
 #include "resolve.h"
 
-RCSID("$KTH: resolve.c,v 1.26 2000/06/27 01:15:53 assar Exp $");
+#include <assert.h>
+
+RCSID("$KTH: resolve.c,v 1.28 2001/08/07 21:57:01 assar Exp $");
 
 #if defined(HAVE_RES_SEARCH) && defined(HAVE_DN_EXPAND)
 
@@ -360,6 +362,109 @@ dns_lookup(const char *domain, const char *type_name)
     return dns_lookup_int(domain, C_IN, type);
 }
 
+static int
+compare_srv(const void *a, const void *b)
+{
+    const struct resource_record *const* aa = a, *const* bb = b;
+
+    if((*aa)->u.srv->priority == (*bb)->u.srv->priority)
+	return ((*aa)->u.srv->weight - (*bb)->u.srv->weight);
+    return ((*aa)->u.srv->priority - (*bb)->u.srv->priority);
+}
+
+#ifndef HAVE_RANDOM
+#define random() rand()
+#endif
+
+/* try to rearrange the srv-records by the algorithm in RFC2782 */
+void
+dns_srv_order(struct dns_reply *r)
+{
+    struct resource_record **srvs, **ss, **headp;
+    struct resource_record *rr;
+    int num_srv = 0;
+
+#if defined(HAVE_INITSTATE) && defined(HAVE_SETSTATE)
+    char state[256], *oldstate;
+#endif
+
+    for(rr = r->head; rr; rr = rr->next) 
+	if(rr->type == T_SRV)
+	    num_srv++;
+
+    if(num_srv == 0)
+	return;
+
+    srvs = malloc(num_srv * sizeof(*srvs));
+    if(srvs == NULL)
+	return; /* XXX not much to do here */
+    
+    /* unlink all srv-records from the linked list and put them in
+       a vector */
+    for(ss = srvs, headp = &r->head; *headp; )
+	if((*headp)->type == T_SRV) {
+	    *ss = *headp;
+	    *headp = (*headp)->next;
+	    (*ss)->next = NULL;
+	    ss++;
+	} else
+	    headp = &(*headp)->next;
+    
+    /* sort them by priority and weight */
+    qsort(srvs, num_srv, sizeof(*srvs), compare_srv);
+
+#if defined(HAVE_INITSTATE) && defined(HAVE_SETSTATE)
+    oldstate = initstate(time(NULL), state, sizeof(state));
+#endif
+
+    headp = &r->head;
+    
+    for(ss = srvs; ss < srvs + num_srv; ) {
+	int sum, rnd, count;
+	struct resource_record **ee, **tt;
+	/* find the last record with the same priority and count the
+           sum of all weights */
+	for(sum = 0, tt = ss; tt < srvs + num_srv; tt++) {
+	    if(*tt == NULL)
+		continue;
+	    if((*tt)->u.srv->priority != (*ss)->u.srv->priority)
+		break;
+	    sum += (*tt)->u.srv->weight;
+	}
+	ee = tt;
+	/* ss is now the first record of this priority and ee is the
+           first of the next */
+	while(ss < ee) {
+	    rnd = random() % (sum + 1);
+	    for(count = 0, tt = ss; ; tt++) {
+		if(*tt == NULL)
+		    continue;
+		count += (*tt)->u.srv->weight;
+		if(count >= rnd)
+		    break;
+	    }
+
+	    assert(tt < ee);
+
+	    /* insert the selected record at the tail (of the head) of
+               the list */
+	    (*tt)->next = *headp;
+	    *headp = *tt;
+	    headp = &(*tt)->next;
+	    sum -= (*tt)->u.srv->weight;
+	    *tt = NULL;
+	    while(*ss == NULL)
+		ss++;
+	}
+    }
+    
+#if defined(HAVE_INITSTATE) && defined(HAVE_SETSTATE)
+    setstate(oldstate);
+#endif
+    free(srvs);
+    return;
+}
+
 #else /* NOT defined(HAVE_RES_SEARCH) && defined(HAVE_DN_EXPAND) */
 
 struct dns_reply *
@@ -373,6 +478,11 @@ dns_free_data(struct dns_reply *r)
 {
 }
 
+void
+dns_srv_order(struct dns_reply *r)
+{
+}
+
 #endif
 
 #ifdef TEST
@@ -386,6 +496,9 @@ main(int argc, char **argv)
 	printf("No reply.\n");
 	return 1;
     }
+    if(r->q.type == T_SRV)
+	dns_srv_order(r);
+
     for(rr = r->head; rr;rr=rr->next){
 	printf("%s %s %d ", rr->domain, dns_type_to_string(rr->type), rr->ttl);
 	switch(rr->type){