Massive constification.

124 files changed, 496 insertions, 448 deletions

diff --git a/CHANGES b/CHANGES
index de8b1cdd2e..748f9b0411 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,10 @@
 
  Changes between 0.9.2b and 0.9.3
 
+  *) A lot of constification, and fix a bug in X509_NAME_oneline() that could
+     return a const string when you are expecting an allocated buffer.
+     [Ben Laurie]
+
   *) Add support for ASN1 types UTF8String and VISIBLESTRING.
      [Steve Henson]
 
diff --git a/Configure b/Configure
index 72753f943a..98ff3eceaa 100755
--- a/Configure
+++ b/Configure
@@ -83,7 +83,7 @@ my %table=(
 "purify",	"purify gcc:-g -DPURIFY -Wall:-lsocket -lnsl::::",
 "debug",	"gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:-lefence::::",
 "debug-ben",	"gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -O2 -Wall -Wshadow -Werror -pipe:::::",
-"debug-ben-strict",	"gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe:::::",
+"debug-ben-strict",	"gcc:-DBN_DEBUG -DREF_CHECK -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe:::::",
 "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::BN_LLONG $x86_gcc_des $x86_gcc_opts:$x86_elf_asm",
 "dist",		"cc:-O -DNOPROTO::::",
 
diff --git a/apps/ca.c b/apps/ca.c
index 7a8dcbfdb3..4225158dfa 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -168,17 +168,20 @@ static int index_name_cmp(char **a,char **b);
 static BIGNUM *load_serial(char *serialfile);
 static int save_serial(char *serialfile, BIGNUM *serial);
 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
-	EVP_MD *dgst,STACK *policy,TXT_DB *db,BIGNUM *serial,char *startdate,
-	int days, int batch, char *ext_sect, LHASH *conf,int verbose);
+		   const EVP_MD *dgst,STACK *policy,TXT_DB *db,BIGNUM *serial,
+		   char *startdate,int days,int batch,char *ext_sect,
+		   LHASH *conf,int verbose);
 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
-	EVP_MD *dgst,STACK *policy,TXT_DB *db,BIGNUM *serial,char *startdate,
-	int days,int batch,char *ext_sect, LHASH *conf,int verbose);
+			const EVP_MD *dgst,STACK *policy,TXT_DB *db,
+			BIGNUM *serial,char *startdate,int days,int batch,
+			char *ext_sect, LHASH *conf,int verbose);
 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
-	EVP_MD *dgst,STACK *policy,TXT_DB *db,BIGNUM *serial,char *startdate,
-	int days,char *ext_sect,LHASH *conf,int verbose);
+			 const EVP_MD *dgst,STACK *policy,TXT_DB *db,
+			 BIGNUM *serial,char *startdate,int days,
+			 char *ext_sect,LHASH *conf,int verbose);
 static int fix_data(int nid, int *type);
 static void write_new_certificate(BIO *bp, X509 *x, int output_der);
-static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, EVP_MD *dgst,
+static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 	STACK *policy, TXT_DB *db, BIGNUM *serial, char *startdate,
 	int days, int batch, int verbose, X509_REQ *req, char *ext_sect,
 	LHASH *conf);
@@ -257,7 +260,7 @@ char **argv;
 	char **pp,*p,*f;
 	int i,j;
 	long l;
-	EVP_MD *dgst=NULL;
+	const EVP_MD *dgst=NULL;
 	STACK *attribs=NULL;
 	STACK *cert_sk=NULL;
 	BIO *hex=NULL;
@@ -1303,7 +1306,7 @@ X509 **xret;
 char *infile;
 EVP_PKEY *pkey;
 X509 *x509;
-EVP_MD *dgst;
+const EVP_MD *dgst;
 STACK *policy;
 TXT_DB *db;
 BIGNUM *serial;
@@ -1374,7 +1377,7 @@ X509 **xret;
 char *infile;
 EVP_PKEY *pkey;
 X509 *x509;
-EVP_MD *dgst;
+const EVP_MD *dgst;
 STACK *policy;
 TXT_DB *db;
 BIGNUM *serial;
@@ -1448,7 +1451,7 @@ static int do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,days,
 X509 **xret;
 EVP_PKEY *pkey;
 X509 *x509;
-EVP_MD *dgst;
+const EVP_MD *dgst;
 STACK *policy;
 TXT_DB *db;
 BIGNUM *serial;
@@ -1921,7 +1924,7 @@ X509 **xret;
 char *infile;
 EVP_PKEY *pkey;
 X509 *x509;
-EVP_MD *dgst;
+const EVP_MD *dgst;
 STACK *policy;
 TXT_DB *db;
 BIGNUM *serial;
diff --git a/apps/ciphers.c b/apps/ciphers.c
index a62c5b0e8a..146527790e 100644
--- a/apps/ciphers.c
+++ b/apps/ciphers.c
@@ -83,7 +83,8 @@ char **argv;
 	{
 	int ret=1,i;
 	int verbose=0;
-	char **pp,*p;
+	char **pp;
+	const char *p;
 	int badops=0;
 	SSL_CTX *ctx=NULL;
 	SSL *ssl=NULL;
diff --git a/apps/dgst.c b/apps/dgst.c
index 86d60c53da..eb7462d0b1 100644
--- a/apps/dgst.c
+++ b/apps/dgst.c
@@ -85,10 +85,10 @@ char **argv;
 	{
 	unsigned char *buf=NULL;
 	int i,err=0;
-	EVP_MD *md=NULL,*m;
+	const EVP_MD *md=NULL,*m;
 	BIO *in=NULL,*inp;
 	BIO *bmd=NULL;
-	char *name;
+	const char *name;
 #define PROG_NAME_SIZE  16
         char pname[PROG_NAME_SIZE];
 	int separator=0;
diff --git a/apps/dsa.c b/apps/dsa.c
index f58ff35c7f..1f57c46005 100644
--- a/apps/dsa.c
+++ b/apps/dsa.c
@@ -89,7 +89,7 @@ char **argv;
 	int ret=1;
 	DSA *dsa=NULL;
 	int i,badops=0;
-	EVP_CIPHER *enc=NULL;
+	const EVP_CIPHER *enc=NULL;
 	BIO *in=NULL,*out=NULL;
 	int informat,outformat,text=0,noout=0;
 	char *infile,*outfile,*prog;
diff --git a/apps/enc.c b/apps/enc.c
index c00d520b44..00cc336177 100644
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -97,7 +97,7 @@ char **argv;
 	char *hkey=NULL,*hiv=NULL;
 	int enc=1,printkey=0,i,base64=0;
 	int debug=0,olb64=0;
-	EVP_CIPHER *cipher=NULL,*c;
+	const EVP_CIPHER *cipher=NULL,*c;
 	char *inf=NULL,*outf=NULL;
 	BIO *in=NULL,*out=NULL,*b64=NULL,*benc=NULL,*rbio=NULL,*wbio=NULL;
 #define PROG_NAME_SIZE  16
diff --git a/apps/req.c b/apps/req.c
index 136cdc7d01..0cfed93878 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -157,7 +157,7 @@ char **argv;
 	EVP_CIPHER *cipher=NULL;
 	int modulus=0;
 	char *p;
-	EVP_MD *md_alg=NULL,*digest=EVP_md5();
+	const EVP_MD *md_alg=NULL,*digest=EVP_md5();
 #ifndef MONOLITH
 	MS_STATIC char config_name[256];
 #endif
diff --git a/apps/rsa.c b/apps/rsa.c
index 056936da73..c8473d9558 100644
--- a/apps/rsa.c
+++ b/apps/rsa.c
@@ -89,7 +89,7 @@ char **argv;
 	int ret=1;
 	RSA *rsa=NULL;
 	int i,badops=0;
-	EVP_CIPHER *enc=NULL;
+	const EVP_CIPHER *enc=NULL;
 	BIO *in=NULL,*out=NULL;
 	int informat,outformat,text=0,noout=0;
 	char *infile,*outfile,*prog;
diff --git a/apps/s_apps.h b/apps/s_apps.h
index 145207f5fe..4ce6725d2b 100644
--- a/apps/s_apps.h
+++ b/apps/s_apps.h
@@ -86,7 +86,7 @@ int extract_port(char *str, short *port_ptr);
 int extract_host_port(char *str,char **host_ptr,unsigned char *ip,short *p);
 int host_ip(char *str, unsigned char ip[4]);
 
-long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, char *argp,
+long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp,
 	int argi, long argl, long ret);
 
 #ifdef HEADER_SSL_H
diff --git a/apps/s_cb.c b/apps/s_cb.c
index ba0b548ea1..c18ecc3a18 100644
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -184,7 +184,7 @@ char *key_file;
 long MS_CALLBACK bio_dump_cb(bio,cmd,argp,argi,argl,ret)
 BIO *bio;
 int cmd;
-char *argp;
+const char *argp;
 int argi;
 long argl;
 long ret;
diff --git a/apps/s_server.c b/apps/s_server.c
index de0c712109..8edd8e79bf 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -792,7 +792,7 @@ static int init_ssl_connection(con)
 SSL *con;
 	{
 	int i;
-	char *str;
+	const char *str;
 	X509 *peer;
 	long verify_error;
 	MS_STATIC char buf[BUFSIZ];
diff --git a/apps/x509.c b/apps/x509.c
index c20d213b3d..2a7188f121 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -121,9 +121,10 @@ NULL
 static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx);
 static EVP_PKEY *load_key(char *file, int format);
 static X509 *load_cert(char *file, int format);
-static int sign (X509 *x, EVP_PKEY *pkey,int days,EVP_MD *digest);
-static int x509_certify (X509_STORE *ctx,char *CAfile, EVP_MD *digest,X509 *x,
-	X509 *xca, EVP_PKEY *pkey,char *serial, int create, int days);
+static int sign (X509 *x, EVP_PKEY *pkey,int days,const EVP_MD *digest);
+static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
+			 X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,
+			 int create,int days);
 #else
 static int MS_CALLBACK callb();
 static EVP_PKEY *load_key();
@@ -157,7 +158,7 @@ char **argv;
 	X509_REQ *rq=NULL;
 	int fingerprint=0;
 	char buf[256];
-	EVP_MD *md_alg,*digest=EVP_md5();
+	const EVP_MD *md_alg,*digest=EVP_md5();
 
 	reqfile=0;
 
@@ -706,7 +707,7 @@ end:
 static int x509_certify(ctx,CAfile,digest,x,xca,pkey,serialfile,create,days)
 X509_STORE *ctx;
 char *CAfile;
-EVP_MD *digest;
+const EVP_MD *digest;
 X509 *x;
 X509 *xca;
 EVP_PKEY *pkey;
@@ -1041,7 +1042,7 @@ static int sign(x, pkey, days, digest)
 X509 *x;
 EVP_PKEY *pkey;
 int days;
-EVP_MD *digest;
+const EVP_MD *digest;
 	{
 
 	EVP_PKEY *pktmp;
diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
index a476960d9a..9eff09509c 100644
--- a/crypto/asn1/a_object.c
+++ b/crypto/asn1/a_object.c
@@ -90,11 +90,12 @@ unsigned char **pp;
 int a2d_ASN1_OBJECT(out,olen,buf,num)
 unsigned char *out;
 int olen;
-char *buf;
+const char *buf;
 int num;
 	{
 	int i,first,len=0,c;
-	char tmp[24],*p;
+	char tmp[24];
+	const char *p;
 	unsigned long l;
 
 	if (num == 0)
@@ -188,7 +189,7 @@ ASN1_OBJECT *a;
 	int i,idx=0,n=0,len,nid;
 	unsigned long l;
 	unsigned char *p;
-	char *s;
+	const char *s;
 	char tbuf[32];
 
 	if (buf_len <= 0) return(0);
@@ -246,9 +247,9 @@ ASN1_OBJECT *a;
 		}
 	else
 		{
-		s=(char *)OBJ_nid2ln(nid);
+		s=OBJ_nid2ln(nid);
 		if (s == NULL)
-			s=(char *)OBJ_nid2sn(nid);
+			s=OBJ_nid2sn(nid);
 		strncpy(buf,s,buf_len);
 		n=strlen(s);
 		}
@@ -355,8 +356,10 @@ ASN1_OBJECT *a;
 	if (a == NULL) return;
 	if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS)
 		{
-		if (a->sn != NULL) Free(a->sn);
-		if (a->ln != NULL) Free(a->ln);
+#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause mempory leaks */
+		if (a->sn != NULL) Free((void *)a->sn);
+		if (a->ln != NULL) Free((void *)a->ln);
+#endif
 		a->sn=a->ln=NULL;
 		}
 	if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA)
@@ -366,7 +369,7 @@ ASN1_OBJECT *a;
 		a->length=0;
 		}
 	if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
-		Free((char *)a);
+		Free(a);
 	}
 
 ASN1_OBJECT *ASN1_OBJECT_create(nid,data,len,sn,ln)
diff --git a/crypto/asn1/a_set.c b/crypto/asn1/a_set.c
index a140cc14ad..34000ecf7d 100644
--- a/crypto/asn1/a_set.c
+++ b/crypto/asn1/a_set.c
@@ -73,8 +73,8 @@ typedef struct
  */
 static int SetBlobCmp(const void *elem1, const void *elem2 )
     {
-    MYBLOB *b1 = (MYBLOB *)elem1;
-    MYBLOB *b2 = (MYBLOB *)elem2;
+    const MYBLOB *b1 = (const MYBLOB *)elem1;
+    const MYBLOB *b2 = (const MYBLOB *)elem2;
     int r;
 
     r = memcmp(b1->pbData, b2->pbData,
diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c
index 9ae9370c04..d3ae78b7b4 100644
--- a/crypto/asn1/a_sign.c
+++ b/crypto/asn1/a_sign.c
@@ -75,7 +75,7 @@ X509_ALGOR *algor2;
 ASN1_BIT_STRING *signature;
 char *data;
 EVP_PKEY *pkey;
-EVP_MD *type;
+const EVP_MD *type;
 	{
 	EVP_MD_CTX ctx;
 	unsigned char *p,*buf_in=NULL,*buf_out=NULL;
diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c
index 09e7fc05bb..dc5db9288b 100644
--- a/crypto/asn1/a_verify.c
+++ b/crypto/asn1/a_verify.c
@@ -76,7 +76,7 @@ char *data;
 EVP_PKEY *pkey;
 	{
 	EVP_MD_CTX ctx;
-	EVP_MD *type;
+	const EVP_MD *type;
 	unsigned char *p,*buf_in=NULL;
 	int ret= -1,i,inl;
 
@@ -89,7 +89,7 @@ EVP_PKEY *pkey;
 		}
 	
 	inl=i2d(data,NULL);
-	buf_in=(unsigned char *)Malloc((unsigned int)inl);
+	buf_in=Malloc((unsigned int)inl);
 	if (buf_in == NULL)
 		{
 		ASN1err(ASN1_F_ASN1_VERIFY,ERR_R_MALLOC_FAILURE);
diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h
index 2ea7bc4bcf..5a2cee1b9a 100644
--- a/crypto/asn1/asn1.h
+++ b/crypto/asn1/asn1.h
@@ -150,7 +150,7 @@ typedef struct asn1_ctx_st
 #define ASN1_OBJECT_FLAG_DYNAMIC_DATA 	 0x08	/* internal use */
 typedef struct asn1_object_st
 	{
-	char *sn,*ln;
+	const char *sn,*ln;
 	int nid;
 	int length;
 	unsigned char *data;
@@ -561,7 +561,7 @@ int i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type);
 #endif
 int i2t_ASN1_OBJECT(char *buf,int buf_len,ASN1_OBJECT *a);
 
-int a2d_ASN1_OBJECT(unsigned char *out,int olen, char *buf, int num);
+int a2d_ASN1_OBJECT(unsigned char *out,int olen, const char *buf, int num);
 ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data,int len,
 	char *sn, char *ln);
 
diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c
index 5c6fdb78ff..a18c7e7075 100644
--- a/crypto/asn1/asn1_lib.c
+++ b/crypto/asn1/asn1_lib.c
@@ -69,7 +69,7 @@ static int asn1_get_length();
 static void asn1_put_length();
 #endif
 
-char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
+const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
 
 int ASN1_check_infinite_end(p,len)
 unsigned char **p;
diff --git a/crypto/asn1/asn1_par.c b/crypto/asn1/asn1_par.c
index bde3a3b2c3..9cddfb497b 100644
--- a/crypto/asn1/asn1_par.c
+++ b/crypto/asn1/asn1_par.c
@@ -79,9 +79,10 @@ int xclass;
 int constructed;
 int indent;
 	{
-	static char *fmt="%-18s";
-	static char *fmt2="%2d %-15s";
-	char *p,str[128],*p2=NULL;
+	static const char fmt[]="%-18s";
+	static const char fmt2[]="%2d %-15s";
+	char str[128];
+	const char *p,*p2=NULL;
 
 	if (constructed & V_ASN1_CONSTRUCTED)
 		p="cons: ";
diff --git a/crypto/asn1/f_enum.c b/crypto/asn1/f_enum.c
index 13b06f5037..515f1dc42d 100644
--- a/crypto/asn1/f_enum.c
+++ b/crypto/asn1/f_enum.c
@@ -68,7 +68,7 @@ BIO *bp;
 ASN1_ENUMERATED *a;
 	{
 	int i,n=0;
-	static char *h="0123456789ABCDEF";
+	static const char *h="0123456789ABCDEF";
 	char buf[2];
 
 	if (a == NULL) return(0);
diff --git a/crypto/asn1/f_int.c b/crypto/asn1/f_int.c
index 4817c45cb7..a877e0cd52 100644
--- a/crypto/asn1/f_int.c
+++ b/crypto/asn1/f_int.c
@@ -66,7 +66,7 @@ BIO *bp;
 ASN1_INTEGER *a;
 	{
 	int i,n=0;
-	static char *h="0123456789ABCDEF";
+	static const char *h="0123456789ABCDEF";
 	char buf[2];
 
 	if (a == NULL) return(0);
diff --git a/crypto/asn1/f_string.c b/crypto/asn1/f_string.c
index ab2837824e..e7ca97f9eb 100644
--- a/crypto/asn1/f_string.c
+++ b/crypto/asn1/f_string.c
@@ -67,7 +67,7 @@ ASN1_STRING *a;
 int type;
 	{
 	int i,n=0;
-	static char *h="0123456789ABCDEF";
+	static const char *h="0123456789ABCDEF";
 	char buf[2];
 
 	if (a == NULL) return(0);
diff --git a/crypto/asn1/n_pkey.c b/crypto/asn1/n_pkey.c
index 9649847866..d9bf417738 100644
--- a/crypto/asn1/n_pkey.c
+++ b/crypto/asn1/n_pkey.c
@@ -138,7 +138,9 @@ int (*cb)();
 	l[2]=i2d_X509_ALGOR(alg,NULL);
 	l[3]=ASN1_object_size(1,l[2]+l[1],V_ASN1_SEQUENCE);
 
+#ifndef CONST_STRICT
 	os.data=(unsigned char *)"private-key";
+#endif
 	os.length=11;
 	l[4]=i2d_ASN1_OCTET_STRING(&os,NULL);
 
@@ -195,7 +197,7 @@ int (*cb)();
 	i2d_ASN1_OCTET_STRING(&os2,&p);
 	ret=l[5];
 err:
-	if (os2.data != NULL) Free((char *)os2.data);
+	if (os2.data != NULL) Free(os2.data);
 	if (alg != NULL) X509_ALGOR_free(alg);
 	if (pkey != NULL) NETSCAPE_PKEY_free(pkey);
 	r=r;
diff --git a/crypto/asn1/t_pkey.c b/crypto/asn1/t_pkey.c
index bc518d59a2..8a960f9cb2 100644
--- a/crypto/asn1/t_pkey.c
+++ b/crypto/asn1/t_pkey.c
@@ -75,7 +75,7 @@
  */
 
 #ifndef NOPROTO
-static int print(BIO *fp,char *str,BIGNUM *num,
+static int print(BIO *fp,const char *str,BIGNUM *num,
 		unsigned char *buf,int off);
 #else
 static int print();
@@ -108,7 +108,8 @@ BIO *bp;
 RSA *x;
 int off;
 	{
-	char str[128],*s;
+	char str[128];
+	const char *s;
 	unsigned char *m=NULL;
 	int i,ret=0;
 
@@ -231,13 +232,14 @@ err:
 
 static int print(bp,number,num,buf,off)
 BIO *bp;
-char *number;
+const char *number;
 BIGNUM *num;
 unsigned char *buf;
 int off;
 	{
 	int n,i;
-	char str[128],*neg;
+	char str[128];
+	const char *neg;
 
 	if (num == NULL) return(1);
 	neg=(num->neg)?"-":"";
diff --git a/crypto/asn1/t_req.c b/crypto/asn1/t_req.c
index a44b8266d3..bc05ff6c0e 100644
--- a/crypto/asn1/t_req.c
+++ b/crypto/asn1/t_req.c
@@ -89,7 +89,8 @@ X509_REQ *x;
 	{
 	unsigned long l;
 	int i,n;
-	char *s,*neg;
+	char *s;
+	const char *neg;
 	X509_REQ_INFO *ri;
 	EVP_PKEY *pkey;
 	STACK *sk;
diff --git a/crypto/asn1/t_x509.c b/crypto/asn1/t_x509.c
index 12e170488f..1ab2caef19 100644
--- a/crypto/asn1/t_x509.c
+++ b/crypto/asn1/t_x509.c
@@ -100,7 +100,7 @@ X509 *x;
 	X509_CINF *ci;
 	ASN1_INTEGER *bs;
 	EVP_PKEY *pkey=NULL;
-	char *neg;
+	const char *neg;
 	X509_EXTENSION *ex;
 	ASN1_STRING *str=NULL;
 
@@ -275,6 +275,11 @@ ASN1_TIME *tm;
 	return(0);
 }
 
+static const char *mon[12]=
+    {
+    "Jan","Feb","Mar","Apr","May","Jun",
+    "Jul","Aug","Sep","Oct","Nov","Dec"
+    };
 
 int ASN1_GENERALIZEDTIME_print(bp,tm)
 BIO *bp;
@@ -282,9 +287,6 @@ ASN1_GENERALIZEDTIME *tm;
 	{
 	char *v;
 	int gmt=0;
-	static char *mon[12]={
-		"Jan","Feb","Mar","Apr","May","Jun",
-		"Jul","Aug","Sep","Oct","Nov","Dec"};
 	int i;
 	int y=0,M=0,d=0,h=0,m=0,s=0;
 
@@ -321,9 +323,6 @@ ASN1_UTCTIME *tm;
 	{
 	char *v;
 	int gmt=0;
-	static char *mon[12]={
-		"Jan","Feb","Mar","Apr","May","Jun",
-		"Jul","Aug","Sep","Oct","Nov","Dec"};
 	int i;
 	int y=0,M=0,d=0,h=0,m=0,s=0;
 
diff --git a/crypto/asn1/x_x509.c b/crypto/asn1/x_x509.c
index e235abb231..8e7d214d21 100644
--- a/crypto/asn1/x_x509.c
+++ b/crypto/asn1/x_x509.c
@@ -108,8 +108,8 @@ long length;
 	M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
 	M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
 	M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
-if (ret->name != NULL) Free(ret->name);
-ret->name=X509_NAME_oneline(ret->cert_info->subject,NULL,0);
+	if (ret->name != NULL) Free(ret->name);
+	ret->name=X509_NAME_oneline(ret->cert_info->subject,NULL,0);
 
 	M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
 	}
diff --git a/crypto/bf/bf_ecb.c b/crypto/bf/bf_ecb.c
index fd362b7cc9..efceae6e20 100644
--- a/crypto/bf/bf_ecb.c
+++ b/crypto/bf/bf_ecb.c
@@ -65,9 +65,9 @@
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
-char *BF_version="BlowFish" OPENSSL_VERSION_PTEXT;
+const char *BF_version="BlowFish" OPENSSL_VERSION_PTEXT;
 
-char *BF_options()
+const char *BF_options()
 	{
 #ifdef BF_PTR
 	return("blowfish(ptr)");
diff --git a/crypto/bf/blowfish.h b/crypto/bf/blowfish.h
index 23a2bd7d1e..61ffff608b 100644
--- a/crypto/bf/blowfish.h
+++ b/crypto/bf/blowfish.h
@@ -102,7 +102,7 @@ void BF_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
 	BF_KEY *schedule, unsigned char *ivec, int *num, int enc);
 void BF_ofb64_encrypt(unsigned char *in, unsigned char *out, long length,
 	BF_KEY *schedule, unsigned char *ivec, int *num);
-char *BF_options(void);
+const char *BF_options(void);
 
 #else
 
@@ -113,7 +113,7 @@ void BF_decrypt();
 void BF_cbc_encrypt();
 void BF_cfb64_encrypt();
 void BF_ofb64_encrypt();
-char *BF_options();
+const char *BF_options();
 
 #endif
 
diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c
index db84ad3d47..5e05af5b0c 100644
--- a/crypto/bio/b_dump.c
+++ b/crypto/bio/b_dump.c
@@ -69,7 +69,7 @@
 
 int BIO_dump(bio,s,len)
 BIO *bio;
-char *s;
+const char *s;
 int len;
 {
   int ret=0;
diff --git a/crypto/bio/b_sock.c b/crypto/bio/b_sock.c
index f96cb60019..a1a37605e3 100644
--- a/crypto/bio/b_sock.c
+++ b/crypto/bio/b_sock.c
@@ -97,7 +97,7 @@ static struct ghbn_cache_st
 	} ghbn_cache[GHBN_NUM];
 
 #ifndef NOPROTO
-static int get_ip(char *str,unsigned char *ip);
+static int get_ip(const char *str,unsigned char *ip);
 static void ghbn_free(struct hostent *a);
 static struct hostent *ghbn_dup(struct hostent *a);
 #else
@@ -107,7 +107,7 @@ static struct hostent *ghbn_dup();
 #endif
 
 int BIO_get_host_ip(str,ip)
-char *str;
+const char *str;
 unsigned char *ip;
 	{
 	int i;
@@ -147,7 +147,7 @@ unsigned char *ip;
 	}
 
 int BIO_get_port(str,port_ptr)
-char *str;
+const char *str;
 unsigned short *port_ptr;
 	{
 	int i;
@@ -330,7 +330,7 @@ struct hostent *a;
 	}
 
 struct hostent *BIO_gethostbyname(name)
-char *name;
+const char *name;
 	{
 	struct hostent *ret;
 	int i,lowi=0,j;
@@ -439,7 +439,7 @@ unsigned long *arg;
 /* The reason I have implemented this instead of using sscanf is because
  * Visual C 1.52c gives an unresolved external when linking a DLL :-( */
 static int get_ip(str,ip)
-char *str;
+const char *str;
 unsigned char ip[4];
 	{
 	unsigned int tmp[4];
@@ -484,7 +484,8 @@ int bind_mode;
 	int s= -1,cs;
 	unsigned char ip[4];
 	unsigned short port;
-	char *str,*h,*p,*e;
+	char *str,*e;
+	const char *h,*p;
 	unsigned long l;
 	int err_num;
 
diff --git a/crypto/bio/bio.h b/crypto/bio/bio.h
index ec75860220..0f54834f60 100644
--- a/crypto/bio/bio.h
+++ b/crypto/bio/bio.h
@@ -203,7 +203,7 @@ extern "C" {
 typedef struct bio_method_st
 	{
 	int type;
-	char *name;
+	const char *name;
 	int (*bwrite)();
 	int (*bread)();
 	int (*bputs)();
@@ -216,7 +216,7 @@ typedef struct bio_method_st
 typedef struct bio_method_st
 	{
 	int type;
-	char *name;
+	const char *name;
 	int (_far *bwrite)();
 	int (_far *bread)();
 	int (_far *bputs)();
@@ -232,7 +232,7 @@ typedef struct bio_st
 	BIO_METHOD *method;
 #ifndef NOPROTO
 	/* bio, mode, argp, argi, argl, ret */
-	long (*callback)(struct bio_st *,int,char *,int, long,long);
+	long (*callback)(struct bio_st *,int,const char *,int, long,long);
 #else
 	long (*callback)();
 #endif
@@ -378,8 +378,15 @@ typedef struct bio_f_buffer_ctx_struct
 
 /* name is cast to lose const, but might be better to route through a function
    so we can do it safely */
+#ifdef CONST_STRICT
+/* If you are wondering why this isn't defined, its because CONST_STRICT is
+ * purely a compile-time kludge to allow const to be checked.
+ */
+int BIO_read_filename(BIO *b,const char *name);
+#else
 #define BIO_read_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \
 		BIO_CLOSE|BIO_FP_READ,(char *)name)
+#endif
 #define BIO_write_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \
 		BIO_CLOSE|BIO_FP_WRITE,name)
 #define BIO_append_filename(b,name) BIO_ctrl(b,BIO_C_SET_FILENAME, \
@@ -493,8 +500,8 @@ int	BIO_set(BIO *a,BIO_METHOD *type);
 int	BIO_free(BIO *a);
 int	BIO_read(BIO *b, char *data, int len);
 int	BIO_gets(BIO *bp,char *buf, int size);
-int	BIO_write(BIO *b, char *data, int len);
-int	BIO_puts(BIO *bp,char *buf);
+int	BIO_write(BIO *b, const char *data, int len);
+int	BIO_puts(BIO *bp,const char *buf);
 long	BIO_ctrl(BIO *bp,int cmd,long larg,char *parg);
 char *	BIO_ptr_ctrl(BIO *bp,int cmd,long larg);
 long	BIO_int_ctrl(BIO *bp,int cmd,long larg,int iarg);
@@ -507,10 +514,10 @@ int	BIO_get_retry_reason(BIO *bio);
 BIO *	BIO_dup_chain(BIO *in);
 
 #ifndef WIN16
-long BIO_debug_callback(BIO *bio,int cmd,char *argp,int argi,
+long BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
 	long argl,long ret);
 #else
-long _far _loadds BIO_debug_callback(BIO *bio,int cmd,char *argp,int argi,
+long _far _loadds BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
 	long argl,long ret);
 #endif
 
@@ -530,14 +537,14 @@ int BIO_sock_should_retry(int i);
 int BIO_sock_non_fatal_error(int error);
 int BIO_fd_should_retry(int i);
 int BIO_fd_non_fatal_error(int error);
-int BIO_dump(BIO *b,char *bytes,int len);
+int BIO_dump(BIO *b,const char *bytes,int len);
 
-struct hostent *BIO_gethostbyname(char *name);
+struct hostent *BIO_gethostbyname(const char *name);
 int BIO_sock_error(int sock);
 int BIO_socket_ioctl(int fd, long type, unsigned long *arg);
 int BIO_socket_nbio(int fd,int mode);
-int BIO_get_port(char *str, unsigned short *port_ptr);
-int BIO_get_host_ip(char *str, unsigned char *ip);
+int BIO_get_port(const char *str, unsigned short *port_ptr);
+int BIO_get_host_ip(const char *str, unsigned char *ip);
 int BIO_get_accept_socket(char *host_port,int mode);
 int BIO_accept(int sock,char **ip_port);
 int BIO_sock_init(void );
diff --git a/crypto/bio/bio_cb.c b/crypto/bio/bio_cb.c
index bc6ed9eda1..32ae7be499 100644
--- a/crypto/bio/bio_cb.c
+++ b/crypto/bio/bio_cb.c
@@ -66,7 +66,7 @@
 long MS_CALLBACK BIO_debug_callback(bio,cmd,argp,argi,argl,ret)
 BIO *bio;
 int cmd;
-char *argp;
+const char *argp;
 int argi;
 long argl;
 long ret;
diff --git a/crypto/bio/bio_lib.c b/crypto/bio/bio_lib.c
index bee1f5d2e0..0b3b10d287 100644
--- a/crypto/bio/bio_lib.c
+++ b/crypto/bio/bio_lib.c
@@ -178,7 +178,7 @@ int outl;
 
 int BIO_write(b,in,inl)
 BIO *b;
-char *in;
+const char *in;
 int inl;
 	{
 	int i;
@@ -222,7 +222,7 @@ int inl;
 
 int BIO_puts(b,in)
 BIO *b;
-char *in;
+const char *in;
 	{
 	int i;
 	long (*cb)();
diff --git a/crypto/bio/bss_conn.c b/crypto/bio/bss_conn.c
index b90fea1a3a..95c4bbbc03 100644
--- a/crypto/bio/bss_conn.c
+++ b/crypto/bio/bss_conn.c
@@ -483,7 +483,7 @@ char *ptr;
 	{
 	BIO *dbio;
 	int *ip;
-	char **pptr;
+	const char **pptr;
 	long ret=1;
 	BIO_CONNECT *data;
 
@@ -507,7 +507,7 @@ char *ptr;
 	case BIO_C_GET_CONNECT:
 		if (ptr != NULL)
 			{
-			pptr=(char **)ptr;
+			pptr=(const char **)ptr;
 			if (num == 0)
 				{
 				*pptr=data->param_hostname;
diff --git a/crypto/bio/bss_log.c b/crypto/bio/bss_log.c
index ce6401efb3..89afb0e11c 100644
--- a/crypto/bio/bss_log.c
+++ b/crypto/bio/bss_log.c
@@ -90,7 +90,7 @@ static int MS_CALLBACK slg_new();
 static int MS_CALLBACK slg_free();
 #endif
 
-static int xopenlog(BIO* bp, char* name, int level);
+static int xopenlog(BIO* bp, const char* name, int level);
 static int xcloselog(BIO* bp);
 
 static BIO_METHOD methods_slg=
@@ -221,7 +221,7 @@ char *str;
 	return(ret);
 	}
 
-static int xopenlog(BIO* bp, char* name, int level)
+static int xopenlog(BIO* bp, const char* name, int level)
 {
 #if defined(WIN32)
 	if((bp->ptr= (char *)RegisterEventSource(NULL, name)) == NULL){
diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index 5e3f3ed210..ed5a76d027 100644
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -60,7 +60,7 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-char *BN_version="Big Number" OPENSSL_VERSION_PTEXT;
+const char *BN_version="Big Number" OPENSSL_VERSION_PTEXT;
 
 /* For a 32 bit machine
  * 2 -   4 ==  128
diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
index 2bcc11c852..c473d6f941 100644
--- a/crypto/bn/bn_print.c
+++ b/crypto/bn/bn_print.c
@@ -62,7 +62,7 @@
 #include "buffer.h"
 #include "bn_lcl.h"
 
-static char *Hex="0123456789ABCDEF";
+const static char *Hex="0123456789ABCDEF";
 
 /* Must 'Free' the returned data */
 char *BN_bn2hex(a)
diff --git a/crypto/buffer/buffer.c b/crypto/buffer/buffer.c
index b160a74a47..94535956f7 100644
--- a/crypto/buffer/buffer.c
+++ b/crypto/buffer/buffer.c
@@ -128,7 +128,7 @@ int len;
 	}
 
 char *BUF_strdup(str)
-char *str;
+const char *str;
 	{
 	char *ret;
 	int n;
diff --git a/crypto/buffer/buffer.h b/crypto/buffer/buffer.h
index 6d6da3d186..20184bed15 100644
--- a/crypto/buffer/buffer.h
+++ b/crypto/buffer/buffer.h
@@ -74,7 +74,7 @@ typedef struct buf_mem_st
 BUF_MEM *BUF_MEM_new(void);
 void	BUF_MEM_free(BUF_MEM *a);
 int	BUF_MEM_grow(BUF_MEM *str, int len);
-char *	BUF_strdup(char *str);
+char *	BUF_strdup(const char *str);
 
 void ERR_load_BUF_strings(void );
 
diff --git a/crypto/comp/comp.h b/crypto/comp/comp.h
index 00af0622b9..0b86084528 100644
--- a/crypto/comp/comp.h
+++ b/crypto/comp/comp.h
@@ -11,7 +11,7 @@ extern "C" {
 typedef struct comp_method_st
 	{
 	int type;		/* NID for compression library */
-	char *name;		/* A text string to identify the library */
+	const char *name;	/* A text string to identify the library */
 	int (*init)();
 	void (*finish)();
 	int (*compress)();
diff --git a/crypto/conf/conf.c b/crypto/conf/conf.c
index e8085348e2..2d7972512c 100644
--- a/crypto/conf/conf.c
+++ b/crypto/conf/conf.c
@@ -95,7 +95,7 @@ static CONF_VALUE *get_section();
 
 #define scan_esc(p)	((((p)[1] == '\0')?(p++):(p+=2)),p)
 
-char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
+const char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
 
 LHASH *CONF_load(h,file,line)
 LHASH *h;
@@ -375,7 +375,7 @@ char *name;
 				if (p != NULL) return(p);
 				}
 			}
-		vv.section="default";
+		vv.section=BUF_strdup("default");
 		vv.name=name;
 		v=(CONF_VALUE *)lh_retrieve(conf,(char *)&vv);
 		if (v != NULL)
diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
index 3614e3fc5d..920ff184e2 100644
--- a/crypto/cryptlib.c
+++ b/crypto/cryptlib.c
@@ -67,7 +67,7 @@ static double SSLeay_MSVC5_hack=0.0; /* and for VC1.5 */
 #endif
 
 /* real #defines in crypto.h, keep these upto date */
-static char* lock_names[CRYPTO_NUM_LOCKS] =
+static const char* lock_names[CRYPTO_NUM_LOCKS] =
 	{
 	"<<ERROR>>",
 	"err",
@@ -96,9 +96,9 @@ static STACK *app_locks=NULL;
 
 #ifndef NOPROTO
 static void (MS_FAR *locking_callback)(int mode,int type,
-	char *file,int line)=NULL;
+	const char *file,int line)=NULL;
 static int (MS_FAR *add_lock_callback)(int *pointer,int amount,
-	int type,char *file,int line)=NULL;
+	int type,const char *file,int line)=NULL;
 static unsigned long (MS_FAR *id_callback)(void)=NULL;
 #else
 static void (MS_FAR *locking_callback)()=NULL;
@@ -135,24 +135,26 @@ char *name;
 	return(i);
 	}
 
-void (*CRYPTO_get_locking_callback(P_V))(P_I_I_P_I)
+void (*CRYPTO_get_locking_callback(void))(int mode,int type,const char *file,
+		int line)
 	{
 	return(locking_callback);
 	}
 
-int (*CRYPTO_get_add_lock_callback(P_V))(P_IP_I_I_P_I)
+int (*CRYPTO_get_add_lock_callback(void))(int *num,int mount,int type,
+					  const char *file,int line)
 	{
 	return(add_lock_callback);
 	}
 
-void CRYPTO_set_locking_callback(func)
-void (*func)(P_I_I_P_I);
+void CRYPTO_set_locking_callback(void (*func)(int mode,int type,
+					      const char *file,int line))
 	{
 	locking_callback=func;
 	}
 
-void CRYPTO_set_add_lock_callback(func)
-int (*func)(P_IP_I_I_P_I);
+void CRYPTO_set_add_lock_callback(int (*func)(int *num,int mount,int type,
+					      const char *file,int line))
 	{
 	add_lock_callback=func;
 	}
@@ -192,7 +194,7 @@ unsigned long CRYPTO_thread_id()
 void CRYPTO_lock(mode,type,file,line)
 int mode;
 int type;
-char *file;
+const char *file;
 int line;
 	{
 #ifdef LOCK_DEBUG
@@ -226,7 +228,7 @@ int CRYPTO_add_lock(pointer,amount,type,file,line)
 int *pointer;
 int amount;
 int type;
-char *file;
+const char *file;
 int line;
 	{
 	int ret;
@@ -265,7 +267,7 @@ int line;
 	return(ret);
 	}
 
-char *CRYPTO_get_lock_name(type)
+const char *CRYPTO_get_lock_name(type)
 int type;
 	{
 	if (type < 0)
diff --git a/crypto/crypto.h b/crypto/crypto.h
index d573cbc279..44d65f5f1b 100644
--- a/crypto/crypto.h
+++ b/crypto/crypto.h
@@ -233,7 +233,7 @@ typedef struct crypto_ex_data_func_st
 
 #ifndef NOPROTO
 
-char *SSLeay_version(int type);
+const char *SSLeay_version(int type);
 unsigned long SSLeay(void);
 
 int CRYPTO_get_ex_new_index(int idx,STACK **sk,long argl,char *argp,
@@ -246,20 +246,21 @@ void CRYPTO_new_ex_data(STACK *meth, char *obj, CRYPTO_EX_DATA *ad);
 
 int CRYPTO_mem_ctrl(int mode);
 int CRYPTO_get_new_lockid(char *name);
-void CRYPTO_lock(int mode, int type,char *file,int line);
-void CRYPTO_set_locking_callback(void (*func)(int mode,int type,char *file,
-		int line));
-void (*CRYPTO_get_locking_callback(void))(int mode,int type,char *file,
+void CRYPTO_lock(int mode, int type,const char *file,int line);
+void CRYPTO_set_locking_callback(void (*func)(int mode,int type,
+					      const char *file,int line));
+void (*CRYPTO_get_locking_callback(void))(int mode,int type,const char *file,
 		int line);
-void CRYPTO_set_add_lock_callback(int (*func)(int *num,int mount,
-		int type,char *file, int line));
-int (*CRYPTO_get_add_lock_callback(void))(int *num,int mount,
-		int type,char *file,int line);
+void CRYPTO_set_add_lock_callback(int (*func)(int *num,int mount,int type,
+					      const char *file, int line));
+int (*CRYPTO_get_add_lock_callback(void))(int *num,int mount,int type,
+					  const char *file,int line);
 void CRYPTO_set_id_callback(unsigned long (*func)(void));
 unsigned long (*CRYPTO_get_id_callback(void))(void);
 unsigned long CRYPTO_thread_id(void);
-char *CRYPTO_get_lock_name(int type);
-int CRYPTO_add_lock(int *pointer,int amount,int type, char *file,int line);
+const char *CRYPTO_get_lock_name(int type);
+int CRYPTO_add_lock(int *pointer,int amount,int type, const char *file,
+		    int line);
 
 void CRYPTO_set_mem_functions(char *(*m)(),char *(*r)(), void (*free_func)());
 void CRYPTO_get_mem_functions(char *(**m)(),char *(**r)(), void (**f)());
@@ -273,10 +274,10 @@ void CRYPTO_free(void *);
 void *CRYPTO_realloc(void *addr,int num);
 void *CRYPTO_remalloc(void *addr,int num);
 
-void *CRYPTO_dbg_malloc(int num,char *file,int line);
-void *CRYPTO_dbg_realloc(void *addr,int num,char *file,int line);
+void *CRYPTO_dbg_malloc(int num,const char *file,int line);
+void *CRYPTO_dbg_realloc(void *addr,int num,const char *file,int line);
 void CRYPTO_dbg_free(void *);
-void *CRYPTO_dbg_remalloc(void *addr,int num,char *file,int line);
+void *CRYPTO_dbg_remalloc(void *addr,int num,const char *file,int line);
 #ifndef NO_FP_API
 void CRYPTO_mem_leaks_fp(FILE *);
 #endif
@@ -308,7 +309,7 @@ int (*CRYPTO_get_add_lock_callback())();
 void CRYPTO_set_id_callback();
 unsigned long (*CRYPTO_get_id_callback())();
 unsigned long CRYPTO_thread_id();
-char *CRYPTO_get_lock_name();
+const char *CRYPTO_get_lock_name();
 int CRYPTO_add_lock();
 
 void CRYPTO_set_mem_functions();
diff --git a/crypto/cversion.c b/crypto/cversion.c
index c3a372258e..3933a0c37a 100644
--- a/crypto/cversion.c
+++ b/crypto/cversion.c
@@ -62,7 +62,7 @@
 #include "crypto.h"
 #include "date.h"
 
-char *SSLeay_version(t)
+const char *SSLeay_version(t)
 int t;
 	{
 	if (t == SSLEAY_VERSION)
diff --git a/crypto/des/des.org b/crypto/des/des.org
index a66f2ce3dd..295fb75ad7 100644
--- a/crypto/des/des.org
+++ b/crypto/des/des.org
@@ -152,7 +152,7 @@ extern int des_set_weak_key_flag; /* set the weak key flag */
 #undef NOPROTO
 #endif
 #ifndef NOPROTO
-char *des_options(void);
+const char *des_options(void);
 void des_ecb3_encrypt(const unsigned char *input,unsigned char *output,
 		      des_key_schedule ks1,des_key_schedule ks2,
 		      des_key_schedule ks3, int enc);
diff --git a/crypto/des/des_enc.c b/crypto/des/des_enc.c
index 40df30261e..935e83ff8e 100644
--- a/crypto/des/des_enc.c
+++ b/crypto/des/des_enc.c
@@ -65,7 +65,7 @@ int enc;
 	{
 	register DES_LONG l,r,t,u;
 #ifdef DES_PTR
-	register unsigned char *des_SP=(unsigned char *)des_SPtrans;
+	register const unsigned char *des_SP=(const unsigned char *)des_SPtrans;
 #endif
 #ifndef DES_UNROLL
 	register int i;
@@ -166,7 +166,7 @@ int enc;
 	{
 	register DES_LONG l,r,t,u;
 #ifdef DES_PTR
-	register unsigned char *des_SP=(unsigned char *)des_SPtrans;
+	register const unsigned char *des_SP=(const unsigned char *)des_SPtrans;
 #endif
 #ifndef DES_UNROLL
 	register int i;
@@ -392,14 +392,15 @@ int enc;
 	{
 	register DES_LONG tin0,tin1;
 	register DES_LONG tout0,tout1,xor0,xor1;
-	register unsigned char *in,*out;
+	register const unsigned char *in;
+	unsigned char *out;
 	register long l=length;
 	DES_LONG tin[2];
 	unsigned char *iv;
 
-	in=(unsigned char *)input;
-	out=(unsigned char *)output;
-	iv=(unsigned char *)ivec;
+	in=input;
+	out=output;
+	iv=ivec;
 
 	if (enc)
 		{
@@ -436,7 +437,7 @@ int enc;
 			l2c(tout0,out);
 			l2c(tout1,out);
 			}
-		iv=(unsigned char *)ivec;
+		iv=ivec;
 		l2c(tout0,iv);
 		l2c(tout1,iv);
 		}
@@ -488,7 +489,7 @@ int enc;
 			xor1=t1;
 			}
 
-		iv=(unsigned char *)ivec;
+		iv=ivec;
 		l2c(xor0,iv);
 		l2c(xor1,iv);
 		}
diff --git a/crypto/des/des_locl.org b/crypto/des/des_locl.org
index 67ef3e7900..c9e8be3add 100644
--- a/crypto/des/des_locl.org
+++ b/crypto/des/des_locl.org
@@ -302,24 +302,24 @@ YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 	u2&=0xfc; \
 	t=ROTATE(t,4); \
 	u>>=16L; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP      +u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x200+u2); \
+	LL^= *(const DES_LONG *)(des_SP      +u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x200+u2); \
 	u3=(int)(u>>8L); \
 	u1=(int)u&0xfc; \
 	u3&=0xfc; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x400+u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x600+u3); \
+	LL^= *(const DES_LONG *)(des_SP+0x400+u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x600+u3); \
 	u2=(int)t>>8L; \
 	u1=(int)t&0xfc; \
 	u2&=0xfc; \
 	t>>=16L; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x100+u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x300+u2); \
+	LL^= *(const DES_LONG *)(des_SP+0x100+u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x300+u2); \
 	u3=(int)t>>8L; \
 	u1=(int)t&0xfc; \
 	u3&=0xfc; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x500+u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x700+u3); }
+	LL^= *(const DES_LONG *)(des_SP+0x500+u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x700+u3); }
 #endif
 #ifdef DES_RISC2
 #define D_ENCRYPT(LL,R,S) { \
@@ -329,39 +329,39 @@ YOU SHOULD NOT HAVE BOTH DES_RISC1 AND DES_RISC2 DEFINED!!!!!
 	u1=(int)u&0xfc; \
 	u2&=0xfc; \
 	t=ROTATE(t,4); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP      +u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x200+u2); \
+	LL^= *(const DES_LONG *)(des_SP      +u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x200+u2); \
 	s1=(int)(u>>16L); \
 	s2=(int)(u>>24L); \
 	s1&=0xfc; \
 	s2&=0xfc; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x400+s1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x600+s2); \
+	LL^= *(const DES_LONG *)(des_SP+0x400+s1); \
+	LL^= *(const DES_LONG *)(des_SP+0x600+s2); \
 	u2=(int)t>>8L; \
 	u1=(int)t&0xfc; \
 	u2&=0xfc; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x100+u1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x300+u2); \
+	LL^= *(const DES_LONG *)(des_SP+0x100+u1); \
+	LL^= *(const DES_LONG *)(des_SP+0x300+u2); \
 	s1=(int)(t>>16L); \
 	s2=(int)(t>>24L); \
 	s1&=0xfc; \
 	s2&=0xfc; \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x500+s1); \
-	LL^= *(DES_LONG *)((unsigned char *)des_SP+0x700+s2); }
+	LL^= *(const DES_LONG *)(des_SP+0x500+s1); \
+	LL^= *(const DES_LONG *)(des_SP+0x700+s2); }
 #endif
 #else
 #define D_ENCRYPT(LL,R,S) { \
 	LOAD_DATA_tmp(R,S,u,t,E0,E1); \
 	t=ROTATE(t,4); \
 	LL^= \
-	*(DES_LONG *)((unsigned char *)des_SP      +((u     )&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x200+((u>> 8L)&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x400+((u>>16L)&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x600+((u>>24L)&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x100+((t     )&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x300+((t>> 8L)&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x500+((t>>16L)&0xfc))^ \
-	*(DES_LONG *)((unsigned char *)des_SP+0x700+((t>>24L)&0xfc)); }
+	*(const DES_LONG *)(des_SP      +((u     )&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x200+((u>> 8L)&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x400+((u>>16L)&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x600+((u>>24L)&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x100+((t     )&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x300+((t>> 8L)&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x500+((t>>16L)&0xfc))^ \
+	*(const DES_LONG *)(des_SP+0x700+((t>>24L)&0xfc)); }
 #endif
 
 #else /* original version */
diff --git a/crypto/des/ecb_enc.c b/crypto/des/ecb_enc.c
index c6cbea3f56..573a9f6bc9 100644
--- a/crypto/des/ecb_enc.c
+++ b/crypto/des/ecb_enc.c
@@ -60,17 +60,17 @@
 #include "spr.h"
 #include "opensslv.h"
 
-char *libdes_version="libdes v 3.24 - 20-Apr-1996 - eay";
-char *DES_version="DES" OPENSSL_VERSION_PTEXT;
+const char *libdes_version="libdes v 3.24 - 20-Apr-1996 - eay";
+const char *DES_version="DES" OPENSSL_VERSION_PTEXT;
 
-char *des_options()
+const char *des_options(void)
 	{
 	static int init=1;
 	static char buf[32];
 
 	if (init)
 		{
-		char *ptr,*unroll,*risc,*size;
+		const char *ptr,*unroll,*risc,*size;
 
 		init=0;
 #ifdef DES_PTR
diff --git a/crypto/des/fcrypt_b.c b/crypto/des/fcrypt_b.c
index 1544634bc1..2197b98bf1 100644
--- a/crypto/des/fcrypt_b.c
+++ b/crypto/des/fcrypt_b.c
@@ -85,7 +85,7 @@ DES_LONG Eswap1;
 	{
 	register DES_LONG l,r,t,u;
 #ifdef DES_PTR
-	register unsigned char *des_SP=(unsigned char *)des_SPtrans;
+	register const unsigned char *des_SP=(const unsigned char *)des_SPtrans;
 #endif
 	register DES_LONG *s;
 	register int j;
diff --git a/crypto/des/pcbc_enc.c b/crypto/des/pcbc_enc.c
index 850717cc57..2d5bb40e5f 100644
--- a/crypto/des/pcbc_enc.c
+++ b/crypto/des/pcbc_enc.c
@@ -68,11 +68,12 @@ int enc;
 	{
 	register DES_LONG sin0,sin1,xor0,xor1,tout0,tout1;
 	DES_LONG tin[2];
-	unsigned char *in,*out,*iv;
+	const unsigned char *in;
+	unsigned char *out,*iv;
 
-	in=(unsigned char *)input;
-	out=(unsigned char *)output;
-	iv=(unsigned char *)ivec;
+	in=input;
+	out=output;
+	iv=ivec;
 
 	if (enc)
 		{
diff --git a/crypto/des/qud_cksm.c b/crypto/des/qud_cksm.c
index 93505354a6..d5e38c952f 100644
--- a/crypto/des/qud_cksm.c
+++ b/crypto/des/qud_cksm.c
@@ -83,7 +83,7 @@ des_cblock seed;
 	DES_LONG z0,z1,t0,t1;
 	int i;
 	long l;
-	unsigned char *cp;
+	const unsigned char *cp;
 	unsigned char *lp;
 
 	if (out_count < 1) out_count=1;
@@ -94,7 +94,7 @@ des_cblock seed;
 
 	for (i=0; ((i<4)&&(i<out_count)); i++)
 		{
-		cp=(unsigned char *)input;
+		cp=input;
 		l=length;
 		while (l > 0)
 			{
diff --git a/crypto/des/set_key.c b/crypto/des/set_key.c
index fef8d277fd..cdc3c19233 100644
--- a/crypto/des/set_key.c
+++ b/crypto/des/set_key.c
@@ -163,7 +163,7 @@ des_key_schedule schedule;
 	{
 	static int shifts2[16]={0,0,1,1,1,1,1,1,0,1,1,1,1,1,1,0};
 	register DES_LONG c,d,t,s,t2;
-	register unsigned char *in;
+	register const unsigned char *in;
 	register DES_LONG *k;
 	register int i;
 
@@ -177,7 +177,7 @@ des_key_schedule schedule;
 		}
 
 	k=(DES_LONG *)schedule;
-	in=(unsigned char *)key;
+	in=key;
 
 	c2l(in,c);
 	c2l(in,d);
diff --git a/crypto/des/supp.c b/crypto/des/supp.c
index ff13e073da..1d9effdd42 100644
--- a/crypto/des/supp.c
+++ b/crypto/des/supp.c
@@ -87,7 +87,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: supp.c,v 1.2 1999/02/13 18:52:21 ben Exp $
+ * $Id: supp.c,v 1.3 1999/04/17 21:25:00 ben Exp $
  */
 
 #include <stdio.h>
@@ -98,7 +98,7 @@ void des_cblock_print_file(cb, fp)
 	FILE *fp;
 {
 	int i;
-	unsigned int *p = (unsigned int *)cb;
+	const unsigned int *p = (const unsigned int *)cb;
 
 	fprintf(fp, " 0x { ");
 	for (i = 0; i < 8; i++) {
diff --git a/crypto/dh/dh_lib.c b/crypto/dh/dh_lib.c
index abee2c0e47..d18484cf41 100644
--- a/crypto/dh/dh_lib.c
+++ b/crypto/dh/dh_lib.c
@@ -61,7 +61,7 @@
 #include "bn.h"
 #include "dh.h"
 
-char *DH_version="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
+const char *DH_version="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
 
 DH *DH_new()
 	{
diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c
index c877a95951..9692670e80 100644
--- a/crypto/dsa/dsa_lib.c
+++ b/crypto/dsa/dsa_lib.c
@@ -64,7 +64,7 @@
 #include "dsa.h"
 #include "asn1.h"
 
-char *DSA_version="DSA" OPENSSL_VERSION_PTEXT;
+const char *DSA_version="DSA" OPENSSL_VERSION_PTEXT;
 
 DSA *DSA_new()
 	{
diff --git a/crypto/err/err.c b/crypto/err/err.c
index ef47252736..46f69e187a 100644
--- a/crypto/err/err.c
+++ b/crypto/err/err.c
@@ -73,8 +73,8 @@ static unsigned long err_hash(ERR_STRING_DATA *a);
 static int err_cmp(ERR_STRING_DATA *a, ERR_STRING_DATA *b);
 static unsigned long pid_hash(ERR_STATE *pid);
 static int pid_cmp(ERR_STATE *a,ERR_STATE *pid);
-static unsigned long get_error_values(int inc,char **file,int *line,
-	char **data,int *flags);
+static unsigned long get_error_values(int inc,const char **file,int *line,
+				      const char **data,int *flags);
 static void ERR_STATE_free(ERR_STATE *s);
 #else
 static unsigned long err_hash();
@@ -256,7 +256,7 @@ void ERR_free_strings()
 
 void ERR_put_error(lib,func,reason,file,line)
 int lib,func,reason;
-char *file;
+const char *file;
 int line;
 	{
 	ERR_STATE *es;
@@ -296,14 +296,14 @@ unsigned long ERR_get_error()
 	{ return(get_error_values(1,NULL,NULL,NULL,NULL)); }
 
 unsigned long ERR_get_error_line(file,line)
-char **file;
+const char **file;
 int *line;
 	{ return(get_error_values(1,file,line,NULL,NULL)); }
 
 unsigned long ERR_get_error_line_data(file,line,data,flags)
-char **file;
+const char **file;
 int *line;
-char **data;
+const char **data;
 int *flags;
 	{ return(get_error_values(1,file,line,data,flags)); }
 
@@ -311,22 +311,22 @@ unsigned long ERR_peek_error()
 	{ return(get_error_values(0,NULL,NULL,NULL,NULL)); }
 
 unsigned long ERR_peek_error_line(file,line)
-char **file;
+const char **file;
 int *line;
 	{ return(get_error_values(0,file,line,NULL,NULL)); }
 
 unsigned long ERR_peek_error_line_data(file,line,data,flags)
-char **file;
+const char **file;
 int *line;
-char **data;
+const char **data;
 int *flags;
 	{ return(get_error_values(0,file,line,data,flags)); }
 
 static unsigned long get_error_values(inc,file,line,data,flags)
 int inc;
-char **file;
+const char **file;
 int *line;
-char **data;
+const char **data;
 int *flags;
 	{	
 	int i=0;
@@ -381,7 +381,7 @@ unsigned long e;
 char *ret;
 	{
 	static char buf[256];
-	char *ls,*fs,*rs;
+	const char *ls,*fs,*rs;
 	unsigned long l,f,r;
 	int i;
 
@@ -422,7 +422,7 @@ LHASH *ERR_get_err_state_table()
 	return(thread_hash);
 	}
 
-char *ERR_lib_error_string(e)
+const char *ERR_lib_error_string(e)
 unsigned long e;
 	{
 	ERR_STRING_DATA d,*p=NULL;
@@ -443,7 +443,7 @@ unsigned long e;
 	return((p == NULL)?NULL:p->string);
 	}
 
-char *ERR_func_error_string(e)
+const char *ERR_func_error_string(e)
 unsigned long e;
 	{
 	ERR_STRING_DATA d,*p=NULL;
@@ -465,7 +465,7 @@ unsigned long e;
 	return((p == NULL)?NULL:p->string);
 	}
 
-char *ERR_reason_error_string(e)
+const char *ERR_reason_error_string(e)
 unsigned long e;
 	{
 	ERR_STRING_DATA d,*p=NULL;
diff --git a/crypto/err/err.h b/crypto/err/err.h
index f06ed383e8..52202942da 100644
--- a/crypto/err/err.h
+++ b/crypto/err/err.h
@@ -87,7 +87,7 @@ typedef struct err_state_st
 	unsigned long err_buffer[ERR_NUM_ERRORS];
 	char *err_data[ERR_NUM_ERRORS];
 	int err_data_flags[ERR_NUM_ERRORS];
-	char *err_file[ERR_NUM_ERRORS];
+	const char *err_file[ERR_NUM_ERRORS];
 	int err_line[ERR_NUM_ERRORS];
 	int top,bottom;
 	} ERR_STATE;
@@ -207,26 +207,26 @@ typedef struct err_state_st
 typedef struct ERR_string_data_st
 	{
 	unsigned long error;
-	char *string;
+	const char *string;
 	} ERR_STRING_DATA;
 
 #ifndef NOPROTO
-void ERR_put_error(int lib, int func,int reason,char *file,int line);
+void ERR_put_error(int lib, int func,int reason,const char *file,int line);
 void ERR_set_error_data(char *data,int flags);
 
 unsigned long ERR_get_error(void );
-unsigned long ERR_get_error_line(char **file,int *line);
-unsigned long ERR_get_error_line_data(char **file,int *line,
-		char **data, int *flags);
+unsigned long ERR_get_error_line(const char **file,int *line);
+unsigned long ERR_get_error_line_data(const char **file,int *line,
+				      const char **data, int *flags);
 unsigned long ERR_peek_error(void );
-unsigned long ERR_peek_error_line(char **file,int *line);
-unsigned long ERR_peek_error_line_data(char **file,int *line,
-		char **data,int *flags);
+unsigned long ERR_peek_error_line(const char **file,int *line);
+unsigned long ERR_peek_error_line_data(const char **file,int *line,
+				       const char **data,int *flags);
 void ERR_clear_error(void );
 char *ERR_error_string(unsigned long e,char *buf);
-char *ERR_lib_error_string(unsigned long e);
-char *ERR_func_error_string(unsigned long e);
-char *ERR_reason_error_string(unsigned long e);
+const char *ERR_lib_error_string(unsigned long e);
+const char *ERR_func_error_string(unsigned long e);
+const char *ERR_reason_error_string(unsigned long e);
 #ifndef NO_FP_API
 void ERR_print_errors_fp(FILE *fp);
 #endif
diff --git a/crypto/err/err_prn.c b/crypto/err/err_prn.c
index ecd0e7c4fa..e52a062eb6 100644
--- a/crypto/err/err_prn.c
+++ b/crypto/err/err_prn.c
@@ -70,7 +70,7 @@ FILE *fp;
 	{
 	unsigned long l;
 	char buf[200];
-	char *file,*data;
+	const char *file,*data;
 	int line,flags;
 	unsigned long es;
 
@@ -89,7 +89,7 @@ BIO *bp;
 	unsigned long l;
 	char buf[256];
 	char buf2[256];
-	char *file,*data;
+	const char *file,*data;
 	int line,flags;
 	unsigned long es;
 
diff --git a/crypto/evp/bio_enc.c b/crypto/evp/bio_enc.c
index ad09b94b1a..e1443d684d 100644
--- a/crypto/evp/bio_enc.c
+++ b/crypto/evp/bio_enc.c
@@ -405,7 +405,7 @@ EVP_CIPHER_ctx *c;
 
 void BIO_set_cipher(b,c,k,i,e)
 BIO *b;
-EVP_CIPHER *c;
+const EVP_CIPHER *c;
 unsigned char *k;
 unsigned char *i;
 int e;
@@ -415,7 +415,7 @@ int e;
 	if (b == NULL) return;
 
 	if ((b->callback != NULL) &&
-		(b->callback(b,BIO_CB_CTRL,(char *)c,BIO_CTRL_SET,e,0L) <= 0))
+		(b->callback(b,BIO_CB_CTRL,(const char *)c,BIO_CTRL_SET,e,0L) <= 0))
 		return;
 
 	b->init=1;
@@ -423,6 +423,6 @@ int e;
 	EVP_CipherInit(&(ctx->cipher),c,k,i,e);
 	
 	if (b->callback != NULL)
-		b->callback(b,BIO_CB_CTRL,(char *)c,BIO_CTRL_SET,e,1L);
+		b->callback(b,BIO_CB_CTRL,(const char *)c,BIO_CTRL_SET,e,1L);
 	}
 
diff --git a/crypto/evp/bio_md.c b/crypto/evp/bio_md.c
index fa5fdc055b..51dd1aa0c9 100644
--- a/crypto/evp/bio_md.c
+++ b/crypto/evp/bio_md.c
@@ -185,7 +185,7 @@ long num;
 char *ptr;
 	{
 	EVP_MD_CTX *ctx,*dctx,**pctx;
-	EVP_MD **ppmd;
+	const EVP_MD **ppmd;
 	EVP_MD *md;
 	long ret=1;
 	BIO *dbio;
@@ -204,7 +204,7 @@ char *ptr;
 	case BIO_C_GET_MD:
 		if (b->init)
 			{
-			ppmd=(EVP_MD **)ptr;
+			ppmd=(const EVP_MD **)ptr;
 			*ppmd=ctx->digest;
 			}
 		else
diff --git a/crypto/evp/bio_ok.c b/crypto/evp/bio_ok.c
index 174ecdeb39..09ce86f3ce 100644
--- a/crypto/evp/bio_ok.c
+++ b/crypto/evp/bio_ok.c
@@ -371,7 +371,7 @@ char *ptr;
 	{
 	BIO_OK_CTX *ctx;
 	EVP_MD *md;
-	EVP_MD **ppmd;
+	const EVP_MD **ppmd;
 	long ret=1;
 	int i;
 
@@ -440,7 +440,7 @@ char *ptr;
 	case BIO_C_GET_MD:
 		if (b->init)
 			{
-			ppmd=(EVP_MD **)ptr;
+			ppmd=(const EVP_MD **)ptr;
 			*ppmd=ctx->md.digest;
 			}
 		else
diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index 7ef0e73b5a..e2604ac8ca 100644
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -63,7 +63,7 @@
 
 void EVP_DigestInit(ctx,type)
 EVP_MD_CTX *ctx;
-EVP_MD *type;
+const EVP_MD *type;
 	{
 	ctx->digest=type;
 	type->init(&(ctx->md));
@@ -71,7 +71,7 @@ EVP_MD *type;
 
 void EVP_DigestUpdate(ctx,data,count)
 EVP_MD_CTX *ctx;
-unsigned char *data;
+const unsigned char *data;
 unsigned int count;
 	{
 	ctx->digest->update(&(ctx->md.base[0]),data,(unsigned long)count);
diff --git a/crypto/evp/e_cbc_r2.c b/crypto/evp/e_cbc_r2.c
index b15310ab48..57d46129b6 100644
--- a/crypto/evp/e_cbc_r2.c
+++ b/crypto/evp/e_cbc_r2.c
@@ -68,7 +68,7 @@ static void rc2_cbc_init_key(EVP_CIPHER_CTX *ctx, unsigned char *key,
 	unsigned char *iv,int enc);
 static void rc2_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
 	unsigned char *in, unsigned int inl);
-static int rc2_meth_to_magic(EVP_CIPHER *e);
+static int rc2_meth_to_magic(const EVP_CIPHER *e);
 static EVP_CIPHER *rc2_magic_to_meth(int i);
 static int rc2_set_asn1_type_and_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
 static int rc2_get_asn1_type_and_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
@@ -168,7 +168,7 @@ unsigned int inl;
 	}
 
 static int rc2_meth_to_magic(e)
-EVP_CIPHER *e;
+const EVP_CIPHER *e;
 	{
 	int i;
 
diff --git a/crypto/evp/evp.h b/crypto/evp/evp.h
index 1188c35787..bc6ea0c033 100644
--- a/crypto/evp/evp.h
+++ b/crypto/evp/evp.h
@@ -285,7 +285,7 @@ typedef struct env_md_st
 
 typedef struct env_md_ctx_st
 	{
-	EVP_MD *digest;
+	const EVP_MD *digest;
 	union	{
 		unsigned char base[4];
 #ifndef NO_MD2
@@ -324,13 +324,13 @@ typedef struct evp_cipher_st
 
 typedef struct evp_cipher_info_st
 	{
-	EVP_CIPHER *cipher;
+	const EVP_CIPHER *cipher;
 	unsigned char iv[EVP_MAX_IV_LENGTH];
 	} EVP_CIPHER_INFO;
 
 typedef struct evp_cipher_ctx_st
 	{
-	EVP_CIPHER *cipher;
+	const EVP_CIPHER *cipher;
 	int encrypt;		/* encrypt or decrypt */
 	int buf_len;		/* number we have left */
 
@@ -444,7 +444,11 @@ typedef int (EVP_PBE_KEYGEN)(unsigned char *pass, int passlen,
 #define EVP_OpenUpdate(a,b,c,d,e)	EVP_DecryptUpdate(a,b,c,d,e)
 #define EVP_SealUpdate(a,b,c,d,e)	EVP_EncryptUpdate(a,b,c,d,e)	
 
-#define BIO_set_md(b,md)		BIO_ctrl(b,BIO_C_SET_MD,0,(char *)md)
+#ifdef CONST_STRICT
+void BIO_set_md(BIO *,const EVP_MD *md);
+#else
+# define BIO_set_md(b,md)		BIO_ctrl(b,BIO_C_SET_MD,0,(char *)md)
+#endif
 #define BIO_get_md(b,mdp)		BIO_ctrl(b,BIO_C_GET_MD,0,(char *)mdp)
 #define BIO_get_md_ctx(b,mdcp)     BIO_ctrl(b,BIO_C_GET_MD_CTX,0,(char *)mdcp)
 #define BIO_get_cipher_status(b)	BIO_ctrl(b,BIO_C_GET_CIPHER_STATUS,0,NULL)
@@ -464,34 +468,33 @@ typedef int (EVP_PBE_KEYGEN)(unsigned char *pass, int passlen,
 #ifndef NOPROTO
 
 int     EVP_MD_CTX_copy(EVP_MD_CTX *out,EVP_MD_CTX *in);  
-void	EVP_DigestInit(EVP_MD_CTX *ctx, EVP_MD *type);
-void	EVP_DigestUpdate(EVP_MD_CTX *ctx,unsigned char *d,unsigned int cnt);
+void	EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type);
+void	EVP_DigestUpdate(EVP_MD_CTX *ctx,const unsigned char *d,
+			 unsigned int cnt);
 void	EVP_DigestFinal(EVP_MD_CTX *ctx,unsigned char *md,unsigned int *s);
 
-int	EVP_read_pw_string(char *buf,int length,char *prompt,int verify);
+int	EVP_read_pw_string(char *buf,int length,const char *prompt,int verify);
 void	EVP_set_pw_prompt(char *prompt);
 char *	EVP_get_pw_prompt(void);
 
-int	EVP_BytesToKey(EVP_CIPHER *type,EVP_MD *md,unsigned char *salt,
+int	EVP_BytesToKey(const EVP_CIPHER *type,EVP_MD *md,unsigned char *salt,
 		unsigned char *data, int datal, int count,
 		unsigned char *key,unsigned char *iv);
 
-EVP_CIPHER *EVP_get_cipherbyname(char *name);
-
-void	EVP_EncryptInit(EVP_CIPHER_CTX *ctx,EVP_CIPHER *type,
+void	EVP_EncryptInit(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *type,
 		unsigned char *key, unsigned char *iv);
 void	EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
 		int *outl, unsigned char *in, int inl);
 void	EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl);
 
-void	EVP_DecryptInit(EVP_CIPHER_CTX *ctx,EVP_CIPHER *type,
+void	EVP_DecryptInit(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *type,
 		unsigned char *key, unsigned char *iv);
 void	EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
 		int *outl, unsigned char *in, int inl);
 int	EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
 
-void	EVP_CipherInit(EVP_CIPHER_CTX *ctx,EVP_CIPHER *type, unsigned char *key,
-		unsigned char *iv,int enc);
+void	EVP_CipherInit(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *type,
+		       unsigned char *key,unsigned char *iv,int enc);
 void	EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
 		int *outl, unsigned char *in, int inl);
 int	EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
@@ -534,7 +537,7 @@ BIO_METHOD *BIO_f_md(void);
 BIO_METHOD *BIO_f_base64(void);
 BIO_METHOD *BIO_f_cipher(void);
 BIO_METHOD *BIO_f_reliable(void);
-void BIO_set_cipher(BIO *b,EVP_CIPHER *c,unsigned char *k,
+void BIO_set_cipher(BIO *b,const EVP_CIPHER *c,unsigned char *k,
 	unsigned char *i, int enc);
 #endif
 
@@ -594,8 +597,8 @@ void SSLeay_add_all_digests(void);
 int EVP_add_cipher(EVP_CIPHER *cipher);
 int EVP_add_digest(EVP_MD *digest);
 
-EVP_CIPHER *EVP_get_cipherbyname(char *name);
-EVP_MD *EVP_get_digestbyname(char *name);
+const EVP_CIPHER *EVP_get_cipherbyname(const char *name);
+const EVP_MD *EVP_get_digestbyname(const char *name);
 void EVP_cleanup(void);
 
 int		EVP_PKEY_decrypt(unsigned char *dec_key,unsigned char *enc_key,
diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index 46fb3c27db..2814e32455 100644
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -60,7 +60,7 @@
 #include "cryptlib.h"
 #include "evp.h"
 
-char *EVP_version="EVP" OPENSSL_VERSION_PTEXT;
+const char *EVP_version="EVP" OPENSSL_VERSION_PTEXT;
 
 void EVP_CIPHER_CTX_init(ctx)
 EVP_CIPHER_CTX *ctx;
@@ -71,7 +71,7 @@ EVP_CIPHER_CTX *ctx;
 
 void EVP_CipherInit(ctx,data,key,iv,enc)
 EVP_CIPHER_CTX *ctx;
-EVP_CIPHER *data;
+const EVP_CIPHER *data;
 unsigned char *key;
 unsigned char *iv;
 int enc;
@@ -109,7 +109,7 @@ int *outl;
 
 void EVP_EncryptInit(ctx,cipher,key,iv)
 EVP_CIPHER_CTX *ctx;
-EVP_CIPHER *cipher;
+const EVP_CIPHER *cipher;
 unsigned char *key;
 unsigned char *iv;
 	{
@@ -122,7 +122,7 @@ unsigned char *iv;
 
 void EVP_DecryptInit(ctx,cipher,key,iv)
 EVP_CIPHER_CTX *ctx;
-EVP_CIPHER *cipher;
+const EVP_CIPHER *cipher;
 unsigned char *key;
 unsigned char *iv;
 	{
diff --git a/crypto/evp/evp_key.c b/crypto/evp/evp_key.c
index dafa686f64..b766f73ec1 100644
--- a/crypto/evp/evp_key.c
+++ b/crypto/evp/evp_key.c
@@ -89,7 +89,7 @@ int des_read_pw_string(char *buf,int len,char *prompt,int verify);
 int EVP_read_pw_string(buf,len,prompt,verify)
 char *buf;
 int len;
-char *prompt;
+const char *prompt;
 int verify;
 	{
 	if ((prompt == NULL) && (prompt_string[0] != '\0'))
@@ -98,7 +98,7 @@ int verify;
 	}
 
 int EVP_BytesToKey(type,md,salt,data,datal,count,key,iv)
-EVP_CIPHER *type;
+const EVP_CIPHER *type;
 EVP_MD *md;
 unsigned char *salt;
 unsigned char *data;
diff --git a/crypto/evp/names.c b/crypto/evp/names.c
index 6bf37100de..124ff8fcd3 100644
--- a/crypto/evp/names.c
+++ b/crypto/evp/names.c
@@ -77,7 +77,7 @@ int EVP_add_digest(md)
 EVP_MD *md;
 	{
 	int r;
-	char *name;
+	const char *name;
 
 	name=OBJ_nid2sn(md->type);
 	r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(char *)md);
@@ -96,21 +96,21 @@ EVP_MD *md;
 	return(r);
 	}
 
-EVP_CIPHER *EVP_get_cipherbyname(name)
-char *name;
+const EVP_CIPHER *EVP_get_cipherbyname(name)
+const char *name;
 	{
-	EVP_CIPHER *cp;
+	const EVP_CIPHER *cp;
 
-	cp=(EVP_CIPHER *)OBJ_NAME_get(name,OBJ_NAME_TYPE_CIPHER_METH);
+	cp=(const EVP_CIPHER *)OBJ_NAME_get(name,OBJ_NAME_TYPE_CIPHER_METH);
 	return(cp);
 	}
 
-EVP_MD *EVP_get_digestbyname(name)
-char *name;
+const EVP_MD *EVP_get_digestbyname(name)
+const char *name;
 	{
-	EVP_MD *cp;
+	const EVP_MD *cp;
 
-	cp=(EVP_MD *)OBJ_NAME_get(name,OBJ_NAME_TYPE_MD_METH);
+	cp=(const EVP_MD *)OBJ_NAME_get(name,OBJ_NAME_TYPE_MD_METH);
 	return(cp);
 	}
 
diff --git a/crypto/hmac/hmac.c b/crypto/hmac/hmac.c
index fb09129963..ead5f649f8 100644
--- a/crypto/hmac/hmac.c
+++ b/crypto/hmac/hmac.c
@@ -64,7 +64,7 @@ void HMAC_Init(ctx,key,len,md)
 HMAC_CTX *ctx;
 unsigned char *key;
 int len;
-EVP_MD *md;
+const EVP_MD *md;
 	{
 	int i,j,reset=0;
 	unsigned char pad[HMAC_MAX_MD_CBLOCK];
diff --git a/crypto/hmac/hmac.h b/crypto/hmac/hmac.h
index e6b43f52c4..2a39d67bdf 100644
--- a/crypto/hmac/hmac.h
+++ b/crypto/hmac/hmac.h
@@ -68,7 +68,7 @@ extern "C" {
 
 typedef struct hmac_ctx_st
 	{
-	EVP_MD *md;
+	const EVP_MD *md;
 	EVP_MD_CTX md_ctx;
 	EVP_MD_CTX i_ctx;
 	EVP_MD_CTX o_ctx;
@@ -81,7 +81,7 @@ typedef struct hmac_ctx_st
 #ifndef NOPROTO
 
 void HMAC_Init(HMAC_CTX *ctx, unsigned char *key, int len,
-	EVP_MD *md);
+	       const EVP_MD *md);
 void HMAC_Update(HMAC_CTX *ctx,unsigned char *key, int len);
 void HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
 void HMAC_cleanup(HMAC_CTX *ctx);
diff --git a/crypto/idea/i_ecb.c b/crypto/idea/i_ecb.c
index 5682e5ad1d..17d014a3f3 100644
--- a/crypto/idea/i_ecb.c
+++ b/crypto/idea/i_ecb.c
@@ -60,9 +60,9 @@
 #include "idea_lcl.h"
 #include "opensslv.h"
 
-char *IDEA_version="IDEA" OPENSSL_VERSION_PTEXT;
+const char *IDEA_version="IDEA" OPENSSL_VERSION_PTEXT;
 
-char *idea_options()
+const char *idea_options()
 	{
 	if (sizeof(short) != sizeof(IDEA_INT))
 		return("idea(int)");
diff --git a/crypto/idea/idea.org b/crypto/idea/idea.org
index e0eb4e0d63..5b3084fada 100644
--- a/crypto/idea/idea.org
+++ b/crypto/idea/idea.org
@@ -85,7 +85,7 @@ typedef struct idea_key_st
 	} IDEA_KEY_SCHEDULE;
 
 #ifndef NOPROTO
-char *idea_options(void);
+const char *idea_options(void);
 void idea_ecb_encrypt(unsigned char *in, unsigned char *out,
 	IDEA_KEY_SCHEDULE *ks);
 void idea_set_encrypt_key(unsigned char *key, IDEA_KEY_SCHEDULE *ks);
@@ -99,7 +99,7 @@ void idea_ofb64_encrypt(unsigned char *in, unsigned char *out,
 	long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv, int *num);
 void idea_encrypt(unsigned long *in, IDEA_KEY_SCHEDULE *ks);
 #else
-char *idea_options();
+const char *idea_options();
 void idea_ecb_encrypt();
 void idea_set_encrypt_key();
 void idea_set_decrypt_key();
diff --git a/crypto/lhash/lhash.c b/crypto/lhash/lhash.c
index 133c543c44..cd56515df7 100644
--- a/crypto/lhash/lhash.c
+++ b/crypto/lhash/lhash.c
@@ -100,7 +100,7 @@
 #include "crypto.h"
 #include "lhash.h"
 
-char *lh_version="lhash" OPENSSL_VERSION_PTEXT;
+const char *lh_version="lhash" OPENSSL_VERSION_PTEXT;
 
 #undef MIN_NODES 
 #define MIN_NODES	16
@@ -476,7 +476,7 @@ char *str;
  * well, not as good as MD5, but still good.
  */
 unsigned long lh_strhash(c)
-char *c;
+const char *c;
 	{
 	unsigned long ret=0;
 	long n;
diff --git a/crypto/lhash/lhash.h b/crypto/lhash/lhash.h
index 06aad873b2..e97d39ffc5 100644
--- a/crypto/lhash/lhash.h
+++ b/crypto/lhash/lhash.h
@@ -120,7 +120,7 @@ char *lh_delete(LHASH *lh, char *data);
 char *lh_retrieve(LHASH *lh, char *data);
 void lh_doall(LHASH *lh, void (*func)(/* char *b */));
 void lh_doall_arg(LHASH *lh, void (*func)(/*char *a,char *b*/),char *arg);
-unsigned long lh_strhash(char *c);
+unsigned long lh_strhash(const char *c);
 
 #ifndef NO_FP_API
 void lh_stats(LHASH *lh, FILE *out);
diff --git a/crypto/md2/md2.org b/crypto/md2/md2.org
index 9f39933790..de0c7c3532 100644
--- a/crypto/md2/md2.org
+++ b/crypto/md2/md2.org
@@ -86,13 +86,13 @@ typedef struct MD2state_st
 	} MD2_CTX;
 
 #ifndef NOPROTO
-char *MD2_options(void);
+const char *MD2_options(void);
 void MD2_Init(MD2_CTX *c);
 void MD2_Update(MD2_CTX *c, register unsigned char *data, unsigned long len);
 void MD2_Final(unsigned char *md, MD2_CTX *c);
 unsigned char *MD2(unsigned char *d, unsigned long n,unsigned char *md);
 #else
-char *MD2_options();
+const char *MD2_options();
 void MD2_Init();
 void MD2_Update();
 void MD2_Final();
diff --git a/crypto/md2/md2_dgst.c b/crypto/md2/md2_dgst.c
index 1d5e261cdf..a1eb553b35 100644
--- a/crypto/md2/md2_dgst.c
+++ b/crypto/md2/md2_dgst.c
@@ -62,7 +62,7 @@
 #include "md2.h"
 #include "opensslv.h"
 
-char *MD2_version="MD2" OPENSSL_VERSION_PTEXT;
+const char *MD2_version="MD2" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1319 The MD2 Message-Digest Algorithm
  */
@@ -112,7 +112,7 @@ static MD2_INT S[256]={
 	0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14,
 	};
 
-char *MD2_options()
+const char *MD2_options()
 	{
 	if (sizeof(MD2_INT) == 1)
 		return("md2(char)");
diff --git a/crypto/mem.c b/crypto/mem.c
index ee115d78e6..f47ea6b4a2 100644
--- a/crypto/mem.c
+++ b/crypto/mem.c
@@ -76,7 +76,7 @@ typedef struct mem_st
 	{
 	char *addr;
 	int num;
-	char *file;
+	const char *file;
 	int line;
 	unsigned long order;
 	} MEM;
@@ -206,7 +206,7 @@ void *str;
 static unsigned long break_order_num=0;
 void *CRYPTO_dbg_malloc(num,file,line)
 int num;
-char *file;
+const char *file;
 int line;
 	{
 	char *ret;
@@ -280,7 +280,7 @@ void *addr;
 void *CRYPTO_dbg_realloc(addr,num,file,line)
 void *addr;
 int num;
-char *file;
+const char *file;
 int line;
 	{
 	char *ret;
@@ -319,7 +319,7 @@ int n;
 void *CRYPTO_dbg_remalloc(a,n,file,line)
 void *a;
 int n;
-char *file;
+const char *file;
 int line;
 	{
 	if (a != NULL) CRYPTO_dbg_free(a);
diff --git a/crypto/objects/o_names.c b/crypto/objects/o_names.c
index a3b05d2dee..c22530612b 100644
--- a/crypto/objects/o_names.c
+++ b/crypto/objects/o_names.c
@@ -106,8 +106,8 @@ OBJ_NAME *a;
 	return(ret);
 	}
 
-char *OBJ_NAME_get(name,type)
-char *name;
+const char *OBJ_NAME_get(name,type)
+const char *name;
 int type;
 	{
 	OBJ_NAME on,*ret;
@@ -139,9 +139,9 @@ int type;
 	}
 
 int OBJ_NAME_add(name,type,data)
-char *name;
+const char *name;
 int type;
-char *data;
+const char *data;
 	{
 	void (*f)();
 	OBJ_NAME *onp,*ret;
@@ -187,7 +187,7 @@ char *data;
 	}
 
 int OBJ_NAME_remove(name,type)
-char *name;
+const char *name;
 int type;
 	{
 	OBJ_NAME on,*ret;
diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index 563556e1f8..0b572a110d 100644
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -306,7 +306,7 @@ int n;
 		}
 	}
 
-char *OBJ_nid2sn(n)
+const char *OBJ_nid2sn(n)
 int n;
 	{
 	ADDED_OBJ ad,*adp;
@@ -339,7 +339,7 @@ int n;
 		}
 	}
 
-char *OBJ_nid2ln(n)
+const char *OBJ_nid2ln(n)
 int n;
 	{
 	ADDED_OBJ ad,*adp;
@@ -404,7 +404,7 @@ ASN1_OBJECT *a;
  */
 
 ASN1_OBJECT *OBJ_txt2obj(s, no_name)
-char *s;
+const char *s;
 int no_name;
 	{
 	int nid = NID_undef;
@@ -454,7 +454,7 @@ char *s;
 }
 
 int OBJ_ln2nid(s)
-char *s;
+const char *s;
 	{
 	ASN1_OBJECT o,*oo= &o,**op;
 	ADDED_OBJ ad,*adp;
@@ -474,7 +474,7 @@ char *s;
 	}
 
 int OBJ_sn2nid(s)
-char *s;
+const char *s;
 	{
 	ASN1_OBJECT o,*oo= &o,**op;
 	ADDED_OBJ ad,*adp;
diff --git a/crypto/objects/obj_lib.c b/crypto/objects/obj_lib.c
index 16ff852095..ba30736dc7 100644
--- a/crypto/objects/obj_lib.c
+++ b/crypto/objects/obj_lib.c
@@ -67,18 +67,19 @@ ASN1_OBJECT *o;
 	{
 	ASN1_OBJECT *r;
 	int i;
+	char *ln=NULL;
 
 	if (o == NULL) return(NULL);
 	if (!(o->flags & ASN1_OBJECT_FLAG_DYNAMIC))
 		return(o);
 
-	r=(ASN1_OBJECT *)ASN1_OBJECT_new();
+	r=ASN1_OBJECT_new();
 	if (r == NULL)
 		{
 		OBJerr(OBJ_F_OBJ_DUP,ERR_R_ASN1_LIB);
 		return(NULL);
 		}
-	r->data=(unsigned char *)Malloc(o->length);
+	r->data=Malloc(o->length);
 	if (r->data == NULL)
 		goto err;
 	memcpy(r->data,o->data,o->length);
@@ -88,17 +89,19 @@ ASN1_OBJECT *o;
 	if (o->ln != NULL)
 		{
 		i=strlen(o->ln)+1;
-		r->ln=(char *)Malloc(i);
+		r->ln=ln=Malloc(i);
 		if (r->ln == NULL) goto err;
-		memcpy(r->ln,o->ln,i);
+		memcpy(ln,o->ln,i);
 		}
 
 	if (o->sn != NULL)
 		{
+		char *s;
+
 		i=strlen(o->sn)+1;
-		r->sn=(char *)Malloc(i);
+		r->sn=s=Malloc(i);
 		if (r->sn == NULL) goto err;
-		memcpy(r->sn,o->sn,i);
+		memcpy(s,o->sn,i);
 		}
 	r->flags=o->flags|(ASN1_OBJECT_FLAG_DYNAMIC|
 		ASN1_OBJECT_FLAG_DYNAMIC_STRINGS|ASN1_OBJECT_FLAG_DYNAMIC_DATA);
@@ -107,7 +110,7 @@ err:
 	OBJerr(OBJ_F_OBJ_DUP,ERR_R_MALLOC_FAILURE);
 	if (r != NULL)
 		{
-		if (r->ln != NULL) Free(r->ln);
+		if (ln != NULL) Free(ln);
 		if (r->data != NULL) Free(r->data);
 		Free(r);
 		}
diff --git a/crypto/objects/objects.h b/crypto/objects/objects.h
index e9a8f47a83..5203514f18 100644
--- a/crypto/objects/objects.h
+++ b/crypto/objects/objects.h
@@ -871,8 +871,8 @@ typedef struct obj_name_st
 	{
 	int type;
 	int alias;
-	char *name;
-	char *data;
+	const char *name;
+	const char *data;
 	} OBJ_NAME;
 
 #define		OBJ_create_and_add_object(a,b,c) OBJ_create(a,b,c)
@@ -882,20 +882,20 @@ typedef struct obj_name_st
 int OBJ_NAME_init(void);
 int OBJ_NAME_new_index(unsigned long (*hash_func)(),int (*cmp_func)(),
 	void (*free_func)());
-char *OBJ_NAME_get(char *name,int type);
-int OBJ_NAME_add(char *name,int type,char *data);
-int OBJ_NAME_remove(char *name,int type);
+const char *OBJ_NAME_get(const char *name,int type);
+int OBJ_NAME_add(const char *name,int type,const char *data);
+int OBJ_NAME_remove(const char *name,int type);
 void OBJ_NAME_cleanup(int type); /* -1 for everything */
 
 ASN1_OBJECT *	OBJ_dup(ASN1_OBJECT *o);
 ASN1_OBJECT *	OBJ_nid2obj(int n);
-char *		OBJ_nid2ln(int n);
-char *		OBJ_nid2sn(int n);
+const char *	OBJ_nid2ln(int n);
+const char *	OBJ_nid2sn(int n);
 int		OBJ_obj2nid(ASN1_OBJECT *o);
-ASN1_OBJECT *	OBJ_txt2obj(char *s, int no_name);
+ASN1_OBJECT *	OBJ_txt2obj(const char *s, int no_name);
 int		OBJ_txt2nid(char *s);
-int		OBJ_ln2nid(char *s);
-int		OBJ_sn2nid(char *s);
+int		OBJ_ln2nid(const char *s);
+int		OBJ_sn2nid(const char *s);
 int		OBJ_cmp(ASN1_OBJECT *a,ASN1_OBJECT *b);
 char *		OBJ_bsearch(char *key,char *base,int num,int size,int (*cmp)());
 
diff --git a/crypto/pem/pem_all.c b/crypto/pem/pem_all.c
index 92d5a5db4f..cd33a9c801 100644
--- a/crypto/pem/pem_all.c
+++ b/crypto/pem/pem_all.c
@@ -248,7 +248,7 @@ RSA *x;
 int PEM_write_bio_RSAPrivateKey(bp,x,enc,kstr,klen,cb)
 BIO *bp;
 RSA *x;
-EVP_CIPHER *enc;
+const EVP_CIPHER *enc;
 unsigned char *kstr;
 int klen;
 int (*cb)();
@@ -293,7 +293,7 @@ int (*cb)();
 int PEM_write_DSAPrivateKey(fp,x,enc,kstr,klen,cb)
 FILE *fp;
 DSA *x;
-EVP_CIPHER *enc;
+const EVP_CIPHER *enc;
 unsigned char *kstr;
 int klen;
 int (*cb)();
@@ -306,7 +306,7 @@ int (*cb)();
 int PEM_write_bio_DSAPrivateKey(bp,x,enc,kstr,klen,cb)
 BIO *bp;
 DSA *x;
-EVP_CIPHER *enc;
+const EVP_CIPHER *enc;
 unsigned char *kstr;
 int klen;
 int (*cb)();
diff --git a/crypto/pem/pem_info.c b/crypto/pem/pem_info.c
index 4b69833b62..bb56aa4e4e 100644
--- a/crypto/pem/pem_info.c
+++ b/crypto/pem/pem_info.c
@@ -282,7 +282,7 @@ int (*cb)();
 	EVP_CIPHER_CTX ctx;
 	int i,ret=0;
 	unsigned char *data=NULL;
-	char *objstr=NULL;
+	const char *objstr=NULL;
 #define PEM_BUFSIZE	1024
 	char buf[PEM_BUFSIZE];
 	unsigned char *iv=NULL;
diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 6aa7bd554f..780e20e1e6 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -68,7 +68,7 @@
 #include "des.h"
 #endif
 
-char *PEM_version="PEM" OPENSSL_VERSION_PTEXT;
+const char *PEM_version="PEM" OPENSSL_VERSION_PTEXT;
 
 #define MIN_LENGTH	4
 
@@ -96,7 +96,7 @@ int w;
 	return(-1);
 #else
 	int i,j;
-	char *prompt;
+	const char *prompt;
 
 	prompt=EVP_get_pw_prompt();
 	if (prompt == NULL)
@@ -127,7 +127,7 @@ void PEM_proc_type(buf, type)
 char *buf;
 int type;
 	{
-	char *str;
+	const char *str;
 
 	if (type == PEM_TYPE_ENCRYPTED)
 		str="ENCRYPTED";
@@ -145,7 +145,7 @@ int type;
 
 void PEM_dek_info(buf, type, len, str)
 char *buf;
-char *type;
+const char *type;
 int len;
 char *str;
 	{
@@ -169,7 +169,7 @@ char *str;
 #ifndef NO_FP_API
 char *PEM_ASN1_read(d2i,name,fp, x, cb)
 char *(*d2i)();
-char *name;
+const char *name;
 FILE *fp;
 char **x;
 int (*cb)();
@@ -191,7 +191,7 @@ int (*cb)();
 
 char *PEM_ASN1_read_bio(d2i,name,bp, x, cb)
 char *(*d2i)();
-char *name;
+const char *name;
 BIO *bp;
 char **x;
 int (*cb)();
@@ -244,10 +244,10 @@ err:
 #ifndef NO_FP_API
 int PEM_ASN1_write(i2d,name,fp, x, enc, kstr, klen, callback)
 int (*i2d)();
-char *name;
+const char *name;
 FILE *fp;
 char *x;
-EVP_CIPHER *enc;
+const EVP_CIPHER *enc;
 unsigned char *kstr;
 int klen;
 int (*callback)();
@@ -269,10 +269,10 @@ int (*callback)();
 
 int PEM_ASN1_write_bio(i2d,name,bp, x, enc, kstr, klen, callback)
 int (*i2d)();
-char *name;
+const char *name;
 BIO *bp;
 char *x;
-EVP_CIPHER *enc;
+const EVP_CIPHER *enc;
 unsigned char *kstr;
 int klen;
 int (*callback)();
@@ -280,7 +280,7 @@ int (*callback)();
 	EVP_CIPHER_CTX ctx;
 	int dsize=0,i,j,ret=0;
 	unsigned char *p,*data=NULL;
-	char *objstr=NULL;
+	const char *objstr=NULL;
 #define PEM_BUFSIZE	1024
 	char buf[PEM_BUFSIZE];
 	unsigned char key[EVP_MAX_KEY_LENGTH];
@@ -412,7 +412,7 @@ char *header;
 EVP_CIPHER_INFO *cipher;
 	{
 	int o;
-	EVP_CIPHER *enc=NULL;
+	const EVP_CIPHER *enc=NULL;
 	char *p,c;
 
 	cipher->cipher=NULL;
@@ -515,7 +515,7 @@ long len;
 
 int PEM_write_bio(bp, name, header, data,len)
 BIO *bp;
-char *name;
+const char *name;
 char *header;
 unsigned char *data;
 long len;
diff --git a/crypto/pkcs12/p12_key.c b/crypto/pkcs12/p12_key.c
index ec357860d1..3bef1fa38a 100644
--- a/crypto/pkcs12/p12_key.c
+++ b/crypto/pkcs12/p12_key.c
@@ -77,7 +77,7 @@ void h__dump (unsigned char *p, int len);
 int PKCS12_key_gen_asc (pass, passlen, salt, saltlen, id, iter, n, out, md_type)
 unsigned char *pass, *salt, *out;
 int passlen, saltlen, id, iter, n;
-EVP_MD *md_type;
+const EVP_MD *md_type;
 {
 	int ret;
 	unsigned char *unipass;
@@ -96,7 +96,7 @@ EVP_MD *md_type;
 int PKCS12_key_gen_uni (pass, passlen, salt, saltlen, id, iter, n, out, md_type)
 unsigned char *pass, *salt, *out;
 int passlen, saltlen, id, iter, n;
-EVP_MD *md_type;
+const EVP_MD *md_type;
 {
 	unsigned char *B, *D, *I, *p, *Ai;
 	int Slen, Plen, Ilen;
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 9acd6ce316..d860c21b52 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -70,7 +70,7 @@ int passlen;
 unsigned char *mac;
 unsigned int *maclen;
 {
-	EVP_MD *md_type;
+	const EVP_MD *md_type;
 	HMAC_CTX hmac;
 	unsigned char key[PKCS12_MAC_KEY_LENGTH], *salt;
 	int saltlen, iter;
diff --git a/crypto/pkcs12/pkcs12.h b/crypto/pkcs12/pkcs12.h
index 6e9ee78bd3..98a5d1cb35 100644
--- a/crypto/pkcs12/pkcs12.h
+++ b/crypto/pkcs12/pkcs12.h
@@ -206,8 +206,8 @@ unsigned char *PKCS12_pbe_crypt(X509_ALGOR *algor, unsigned char *pass, int pass
 char *PKCS12_decrypt_d2i(X509_ALGOR *algor, char *(*d2i)(), void (*free_func)(), unsigned char *pass, int passlen, ASN1_STRING *oct, int seq);
 ASN1_STRING *PKCS12_i2d_encrypt(X509_ALGOR *algor, int (*i2d)(), unsigned char *pass, int passlen, char *obj, int seq);
 PKCS12 *PKCS12_init(int mode);
-int PKCS12_key_gen_asc(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, EVP_MD *md_type);
-int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, EVP_MD *md_type);
+int PKCS12_key_gen_asc(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, const EVP_MD *md_type);
+int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int id, int iter, int n, unsigned char *out, const EVP_MD *md_type);
 int PKCS12_PBE_keyivgen(unsigned char *pass, int passlen, unsigned char *salt, int saltlen, int iter, EVP_CIPHER *cipher, EVP_MD *md_type, unsigned char *key, unsigned char *iv);
 int PKCS12_gen_mac(PKCS12 *p12, unsigned char *pass, int passlen, unsigned char *mac, unsigned int *maclen);
 int PKCS12_gen_mac(PKCS12 *p12, unsigned char *pass, int passlen, unsigned char *mac, unsigned int *maclen);
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 1b8150874a..7cb8ba3f49 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -73,8 +73,8 @@ BIO *bio;
 	int i,j;
 	BIO *out=NULL,*btmp=NULL;
 	X509_ALGOR *xa;
-	EVP_MD *evp_md;
-	EVP_CIPHER *evp_cipher=NULL;
+	const EVP_MD *evp_md;
+	const EVP_CIPHER *evp_cipher=NULL;
 	STACK *md_sk=NULL,*rsk=NULL;
 	X509_ALGOR *xalg=NULL;
 	PKCS7_RECIP_INFO *ri=NULL;
@@ -268,8 +268,8 @@ X509_STORE *xs;
 	char *tmp=NULL;
 	X509_ALGOR *xa;
 	ASN1_OCTET_STRING *data_body=NULL;
-	EVP_MD *evp_md;
-	EVP_CIPHER *evp_cipher=NULL;
+	const EVP_MD *evp_md;
+	const EVP_CIPHER *evp_cipher=NULL;
 	EVP_CIPHER_CTX *evp_ctx=NULL;
 	X509_ALGOR *enc_alg=NULL;
 	STACK *md_sk=NULL,*rsk=NULL;
@@ -568,7 +568,7 @@ BIO *bio;
 				unsigned int md_len;
 				ASN1_OCTET_STRING *digest;
 				ASN1_UTCTIME *sign_time;
-				EVP_MD *md_tmp;
+				const EVP_MD *md_tmp;
 
 				/* Add signing time */
 				sign_time=X509_gmtime_adj(NULL,0);
diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c
index fcc87438dc..e96c103a68 100644
--- a/crypto/rand/md_rand.c
+++ b/crypto/rand/md_rand.c
@@ -128,7 +128,7 @@ static unsigned char state[STATE_SIZE+MD_DIGEST_LENGTH];
 static unsigned char md[MD_DIGEST_LENGTH];
 static long md_count[2]={0,0};
 
-char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
+const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
 
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
@@ -204,7 +204,7 @@ int num;
 		MD_Final(md,&m);
 		md_count[1]++;
 
-		buf=(char *)buf + j;
+		buf=(const char *)buf + j;
 
 		for (k=0; k<j; k++)
 			{
diff --git a/crypto/rc2/rc2_ecb.c b/crypto/rc2/rc2_ecb.c
index 7868a96415..d00070b309 100644
--- a/crypto/rc2/rc2_ecb.c
+++ b/crypto/rc2/rc2_ecb.c
@@ -60,7 +60,7 @@
 #include "rc2_locl.h"
 #include "opensslv.h"
 
-char *RC2_version="RC2" OPENSSL_VERSION_PTEXT;
+const char *RC2_version="RC2" OPENSSL_VERSION_PTEXT;
 
 /* RC2 as implemented frm a posting from
  * Newsgroups: sci.crypt
diff --git a/crypto/rc4/rc4.org b/crypto/rc4/rc4.org
index c558651af8..bf5fd3d404 100644
--- a/crypto/rc4/rc4.org
+++ b/crypto/rc4/rc4.org
@@ -83,14 +83,14 @@ typedef struct rc4_key_st
 
 #ifndef NOPROTO
  
-char *RC4_options(void);
+const char *RC4_options(void);
 void RC4_set_key(RC4_KEY *key, int len, unsigned char *data);
 void RC4(RC4_KEY *key, unsigned long len, unsigned char *indata,
 		unsigned char *outdata);
 
 #else
 
-char *RC4_options();
+const char *RC4_options();
 void RC4_set_key();
 void RC4();
 
diff --git a/crypto/rc4/rc4_skey.c b/crypto/rc4/rc4_skey.c
index b33a4cbfb2..e57810e143 100644
--- a/crypto/rc4/rc4_skey.c
+++ b/crypto/rc4/rc4_skey.c
@@ -60,9 +60,9 @@
 #include "rc4_locl.h"
 #include "opensslv.h"
 
-char *RC4_version="RC4" OPENSSL_VERSION_PTEXT;
+const char *RC4_version="RC4" OPENSSL_VERSION_PTEXT;
 
-char *RC4_options()
+const char *RC4_options()
 	{
 #ifdef RC4_INDEX
 	if (sizeof(RC4_INT) == 1)
diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h
index 9911579226..6083a6cb25 100644
--- a/crypto/rsa/rsa.h
+++ b/crypto/rsa/rsa.h
@@ -70,7 +70,7 @@ typedef struct rsa_st RSA;
 
 typedef struct rsa_meth_st
 	{
-	char *name;
+	const char *name;
 #ifndef NOPROTO
 	int (*rsa_pub_enc)(int flen,unsigned char *from,unsigned char *to,
 			   RSA *rsa,int padding);
diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c
index 6f9d182f9b..951d18185f 100644
--- a/crypto/rsa/rsa_lib.c
+++ b/crypto/rsa/rsa_lib.c
@@ -63,7 +63,7 @@
 #include "bn.h"
 #include "rsa.h"
 
-char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
+const char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
 
 static RSA_METHOD *default_RSA_meth=NULL;
 static int rsa_meth_num=0;
diff --git a/crypto/stack/stack.c b/crypto/stack/stack.c
index 9b552251f1..600ccfd2f3 100644
--- a/crypto/stack/stack.c
+++ b/crypto/stack/stack.c
@@ -72,7 +72,7 @@
 #undef MIN_NODES
 #define MIN_NODES	4
 
-char *STACK_version="Stack" OPENSSL_VERSION_PTEXT;
+const char *STACK_version="Stack" OPENSSL_VERSION_PTEXT;
 
 #ifndef NOPROTO
 #define	FP_ICC	(int (*)(const void *,const void *))
diff --git a/crypto/txt_db/txt_db.c b/crypto/txt_db/txt_db.c
index 34a87e332d..5f072cc04f 100644
--- a/crypto/txt_db/txt_db.c
+++ b/crypto/txt_db/txt_db.c
@@ -66,7 +66,7 @@
 #undef BUFSIZE
 #define BUFSIZE	512
 
-char *TXT_DB_version="TXT_DB" OPENSSL_VERSION_PTEXT;
+const char *TXT_DB_version="TXT_DB" OPENSSL_VERSION_PTEXT;
 
 TXT_DB *TXT_DB_read(in,num)
 BIO *in;
diff --git a/crypto/x509/by_dir.c b/crypto/x509/by_dir.c
index d16f5bf718..118d6e31bd 100644
--- a/crypto/x509/by_dir.c
+++ b/crypto/x509/by_dir.c
@@ -79,7 +79,7 @@ typedef struct lookup_dir_st
 static int dir_ctrl(X509_LOOKUP *ctx,int cmd,char *argp,long argl,char **ret);
 static int new_dir(X509_LOOKUP *lu);
 static void free_dir(X509_LOOKUP *lu);
-static int add_cert_dir(BY_DIR *ctx,char *dir,int type);
+static int add_cert_dir(BY_DIR *ctx,const char *dir,int type);
 static int get_cert_by_subject(X509_LOOKUP *xl,int type,X509_NAME *name,
 	X509_OBJECT *ret);
 #else
@@ -183,12 +183,12 @@ X509_LOOKUP *lu;
 
 static int add_cert_dir(ctx,dir, type)
 BY_DIR *ctx;
-char *dir;
+const char *dir;
 int type;
 	{
 	int j,len;
 	int *ip;
-	char *s,*ss,*p;
+	const char *s,*ss,*p;
 	char **pp;
 
 	if (dir == NULL || !*dir)
@@ -269,7 +269,7 @@ X509_OBJECT *ret;
 	BUF_MEM *b=NULL;
 	struct stat st;
 	X509_OBJECT stmp,*tmp;
-	char *postfix="";
+	const char *postfix="";
 
 	if (name == NULL) return(0);
 
diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c
index 09ebb9bf08..991f04aad9 100644
--- a/crypto/x509/by_file.c
+++ b/crypto/x509/by_file.c
@@ -140,7 +140,7 @@ char **ret;
 
 int X509_load_cert_file(ctx,file,type)
 X509_LOOKUP *ctx;
-char *file;
+const char *file;
 int type;
 	{
 	int ret=0;
@@ -210,7 +210,7 @@ err:
 
 int X509_load_crl_file(ctx,file,type)
 X509_LOOKUP *ctx;
-char *file;
+const char *file;
 int type;
 	{
 	int ret=0;
diff --git a/crypto/x509/x509.h b/crypto/x509/x509.h
index 4d7b996e51..9d4aeca371 100644
--- a/crypto/x509/x509.h
+++ b/crypto/x509/x509.h
@@ -528,16 +528,16 @@ typedef struct pkcs8_priv_key_info_st
 #ifndef SSLEAY_MACROS
 #ifdef HEADER_ENVELOPE_H
 int X509_verify(X509 *a, EVP_PKEY *r);
-char *X509_verify_cert_error_string(long n);
+const char *X509_verify_cert_error_string(long n);
 
 int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r);
 int X509_CRL_verify(X509_CRL *a, EVP_PKEY *r);
 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r);
 
-int X509_sign(X509 *x, EVP_PKEY *pkey, EVP_MD *md);
-int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, EVP_MD *md);
-int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, EVP_MD *md);
-int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, EVP_MD *md);
+int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
+int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md);
+int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md);
+int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md);
 
 int X509_digest(X509 *data,EVP_MD *type,unsigned char *md,unsigned int *len);
 int X509_NAME_digest(X509_NAME *data,EVP_MD *type,
@@ -590,12 +590,12 @@ RSA *RSAPrivateKey_dup(RSA *rsa);
 int		X509_cmp_current_time(ASN1_UTCTIME *s);
 ASN1_UTCTIME *	X509_gmtime_adj(ASN1_UTCTIME *s, long adj);
 
-char *		X509_get_default_cert_area(void );
-char *		X509_get_default_cert_dir(void );
-char *		X509_get_default_cert_file(void );
-char *		X509_get_default_cert_dir_env(void );
-char *		X509_get_default_cert_file_env(void );
-char *		X509_get_default_private_dir(void );
+const char *	X509_get_default_cert_area(void );
+const char *	X509_get_default_cert_dir(void );
+const char *	X509_get_default_cert_file(void );
+const char *	X509_get_default_cert_dir_env(void );
+const char *	X509_get_default_cert_file_env(void );
+const char *	X509_get_default_private_dir(void );
 
 X509_REQ *	X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, EVP_MD *md);
 X509 *		X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
@@ -728,7 +728,7 @@ int ASN1_digest(int (*i2d)(),EVP_MD *type,char *data,
 
 int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
 	ASN1_BIT_STRING *signature,
-	char *data,EVP_PKEY *pkey, EVP_MD *type);
+	char *data,EVP_PKEY *pkey, const EVP_MD *type);
 #endif
 
 int 		X509_set_version(X509 *x,long version);
diff --git a/crypto/x509/x509_def.c b/crypto/x509/x509_def.c
index d9ab39b15a..0646a6bc8f 100644
--- a/crypto/x509/x509_def.c
+++ b/crypto/x509/x509_def.c
@@ -63,21 +63,21 @@
 #include "crypto.h"
 #include "x509.h"
 
-char *X509_get_default_private_dir()
+const char *X509_get_default_private_dir()
 	{ return(X509_PRIVATE_DIR); }
 	
-char *X509_get_default_cert_area()
+const char *X509_get_default_cert_area()
 	{ return(X509_CERT_AREA); }
 
-char *X509_get_default_cert_dir()
+const char *X509_get_default_cert_dir()
 	{ return(X509_CERT_DIR); }
 
-char *X509_get_default_cert_file()
+const char *X509_get_default_cert_file()
 	{ return(X509_CERT_FILE); }
 
-char *X509_get_default_cert_dir_env()
+const char *X509_get_default_cert_dir_env()
 	{ return(X509_CERT_DIR_EVP); }
 
-char *X509_get_default_cert_file_env()
+const char *X509_get_default_cert_file_env()
 	{ return(X509_CERT_FILE_EVP); }
 
diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c
index c0576fd6f6..5a16fd500a 100644
--- a/crypto/x509/x509_obj.c
+++ b/crypto/x509/x509_obj.c
@@ -71,14 +71,14 @@ int len;
 	X509_NAME_ENTRY *ne;
 	unsigned int i;
 	int n,lold,l,l1,l2,num,j,type;
-	char *s,*p;
+	const char *s;
+	char *p;
 	unsigned char *q;
 	BUF_MEM *b=NULL;
 	static char hex[17]="0123456789ABCDEF";
 	int gs_doit[4];
 	char tmp_buf[80];
 
-	if (a == NULL) return("NO X509_NAME");
 	if (buf == NULL)
 		{
 		if ((b=BUF_MEM_new()) == NULL) goto err;
@@ -86,6 +86,16 @@ int len;
 		b->data[0]='\0';
 		len=200;
 		}
+	if (a == NULL)
+	    {
+	    if(b)
+		{
+		buf=b->data;
+		Free(b);
+		}
+	    strncpy(buf,"NO X509_NAME",len);
+	    return buf;
+	    }
 
 	len--; /* space for '\0' */
 	l=0;
@@ -166,7 +176,7 @@ int len;
 	if (b != NULL)
 		{
 		p=b->data;
-		Free((char *)b);
+		Free(b);
 		}
 	else
 		p=buf;
diff --git a/crypto/x509/x509_txt.c b/crypto/x509/x509_txt.c
index de7550d9cd..2c401c134a 100644
--- a/crypto/x509/x509_txt.c
+++ b/crypto/x509/x509_txt.c
@@ -69,7 +69,7 @@
 #include "x509.h"
 #include "objects.h"
 
-char *X509_verify_cert_error_string(n)
+const char *X509_verify_cert_error_string(n)
 long n;
 	{
 	static char buf[100];
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 10f1848481..1b3a491930 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -79,7 +79,7 @@ static int null_callback();
 static int internal_verify();
 #endif
 
-char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
+const char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
 
 static STACK *x509_store_ctx_method=NULL;
 static int x509_store_ctx_num=0;
diff --git a/crypto/x509/x509_vfy.h b/crypto/x509/x509_vfy.h
index 027160f05f..fd70b74961 100644
--- a/crypto/x509/x509_vfy.h
+++ b/crypto/x509/x509_vfy.h
@@ -124,7 +124,7 @@ typedef struct x509_lookup_st X509_LOOKUP;
 /* This is a static that defines the function interface */
 typedef struct x509_lookup_method_st
 	{
-	char *name;
+	const char *name;
 	int (*new_item)(X509_LOOKUP *ctx);
 	void (*free)(X509_LOOKUP *ctx);
 	int (*init)(X509_LOOKUP *ctx);
@@ -279,8 +279,8 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs,int type,X509_NAME *name,
 int X509_LOOKUP_ctrl(X509_LOOKUP *ctx,int cmd,char *argc,long argl,char **ret);
 
 #ifndef NO_STDIO
-int X509_load_cert_file(X509_LOOKUP *ctx, char *file, int type);
-int X509_load_crl_file(X509_LOOKUP *ctx, char *file, int type);
+int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type);
+int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type);
 #endif
 
 
diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index 682de167f7..582a7729e0 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c
@@ -100,7 +100,7 @@ EVP_PKEY *r;
 int X509_sign(x,pkey,md)
 X509 *x;
 EVP_PKEY *pkey;
-EVP_MD *md;
+const EVP_MD *md;
 	{
 	return(ASN1_sign((int (*)())i2d_X509_CINF, x->cert_info->signature,
 		x->sig_alg, x->signature, (char *)x->cert_info,pkey,md));
@@ -109,7 +109,7 @@ EVP_MD *md;
 int X509_REQ_sign(x,pkey,md)
 X509_REQ *x;
 EVP_PKEY *pkey;
-EVP_MD *md;
+const EVP_MD *md;
 	{
 	return(ASN1_sign((int (*)())i2d_X509_REQ_INFO,x->sig_alg, NULL,
 		x->signature, (char *)x->req_info,pkey,md));
@@ -118,7 +118,7 @@ EVP_MD *md;
 int X509_CRL_sign(x,pkey,md)
 X509_CRL *x;
 EVP_PKEY *pkey;
-EVP_MD *md;
+const EVP_MD *md;
 	{
 	return(ASN1_sign((int (*)())i2d_X509_CRL_INFO,x->crl->sig_alg,
 		x->sig_alg, x->signature, (char *)x->crl,pkey,md));
@@ -127,7 +127,7 @@ EVP_MD *md;
 int NETSCAPE_SPKI_sign(x,pkey,md)
 NETSCAPE_SPKI *x;
 EVP_PKEY *pkey;
-EVP_MD *md;
+const EVP_MD *md;
 	{
 	return(ASN1_sign((int (*)())i2d_NETSCAPE_SPKAC, x->sig_algor,NULL,
 		x->signature, (char *)x->spkac,pkey,md));
diff --git a/crypto/x509v3/v3_conf.c b/crypto/x509v3/v3_conf.c
index f81cd277d8..0427a3071e 100644
--- a/crypto/x509v3/v3_conf.c
+++ b/crypto/x509v3/v3_conf.c
@@ -70,7 +70,7 @@
 static int v3_check_critical(char **value);
 static int v3_check_generic(char **value);
 static X509_EXTENSION *do_ext_conf(LHASH *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value);
-static X509_EXTENSION *v3_generic_extension(char *ext, char *value, int crit, int type);
+static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type);
 #else
 static int v3_check_critical();
 static int v3_check_generic();
@@ -198,7 +198,7 @@ char **value;
 
 /* Create a generic extension: for now just handle RAW type */
 static X509_EXTENSION *v3_generic_extension(ext, value, crit, type)
-char *ext;
+const char *ext;
 char *value;
 int crit;
 int type;
diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index cd53f35b94..5f26e40af2 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c
@@ -69,8 +69,8 @@ static char *strip_spaces(char *name);
 /* Add a CONF_VALUE name value pair to stack */
 
 int X509V3_add_value(name, value, extlist)
-char *name;
-char *value;
+const char *name;
+const char *value;
 STACK **extlist;
 {
 	CONF_VALUE *vtmp = NULL;
@@ -105,7 +105,7 @@ CONF_VALUE *conf;
 }
 
 int X509V3_add_value_bool(name, asn1_bool, extlist)
-char *name;
+const char *name;
 int asn1_bool;
 STACK **extlist;
 {
@@ -176,7 +176,7 @@ char *value;
 }
 
 int X509V3_add_value_int(name, aint, extlist)
-char *name;
+const char *name;
 ASN1_INTEGER *aint;
 STACK **extlist;
 {
@@ -426,8 +426,8 @@ long *len;
  */
 
 int name_cmp(name, cmp)
-char *name;
-char *cmp;
+const char *name;
+const char *cmp;
 {
 	int len, ret;
 	char c;
diff --git a/crypto/x509v3/x509v3.h b/crypto/x509v3/x509v3.h
index 52037eccb3..63c8574220 100644
--- a/crypto/x509v3/x509v3.h
+++ b/crypto/x509v3/x509v3.h
@@ -137,8 +137,8 @@ typedef struct v3_ext_ctx X509V3_CTX;
 
 typedef struct BIT_STRING_BITNAME_st {
 int bitnum;
-char *lname;
-char *sname;
+const char *lname;
+const char *sname;
 } BIT_STRING_BITNAME;
 
 typedef BIT_STRING_BITNAME ENUMERATED_NAMES;
@@ -299,9 +299,9 @@ void X509V3_free_section( X509V3_CTX *ctx, STACK *section);
 void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
 				 X509_REQ *req, X509_CRL *crl, int flags);
 
-int X509V3_add_value(char *name, char *value, STACK **extlist);
-int X509V3_add_value_bool(char *name, int asn1_bool, STACK **extlist);
-int X509V3_add_value_int( char *name, ASN1_INTEGER *aint, STACK **extlist);
+int X509V3_add_value(const char *name, const char *value, STACK **extlist);
+int X509V3_add_value_bool(const char *name, int asn1_bool, STACK **extlist);
+int X509V3_add_value_int(const char *name, ASN1_INTEGER *aint, STACK **extlist);
 char * i2s_ASN1_INTEGER(X509V3_EXT_METHOD *meth, ASN1_INTEGER *aint);
 ASN1_INTEGER * s2i_ASN1_INTEGER(X509V3_EXT_METHOD *meth, char *value);
 char * i2s_ASN1_ENUMERATED(X509V3_EXT_METHOD *meth, ASN1_ENUMERATED *aint);
@@ -318,7 +318,7 @@ char *X509V3_EXT_d2i(X509_EXTENSION *ext);
 
 char *hex_to_string(unsigned char *buffer, long len);
 unsigned char *string_to_hex(char *str, long *len);
-int name_cmp(char *name, char *cmp);
+int name_cmp(const char *name, const char *cmp);
 
 int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, int flag, int indent);
 int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index 46e14d82cd..8c3cbde177 100644
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -536,8 +536,8 @@ SSL *s;
 	unsigned char *p,*d;
 	int clear,enc,karg,i;
 	SSL_SESSION *sess;
-	EVP_CIPHER *c;
-	EVP_MD *md;
+	const EVP_CIPHER *c;
+	const EVP_MD *md;
 
 	buf=(unsigned char *)s->init_buf->data;
 	if (s->state == SSL2_ST_SEND_CLIENT_MASTER_KEY_A)
diff --git a/ssl/s2_enc.c b/ssl/s2_enc.c
index 63ebf28748..af12dc472f 100644
--- a/ssl/s2_enc.c
+++ b/ssl/s2_enc.c
@@ -65,8 +65,8 @@ int client;
 	{
 	/* Max number of bytes needed */
 	EVP_CIPHER_CTX *rs,*ws;
-	EVP_CIPHER *c;
-	EVP_MD *md;
+	const EVP_CIPHER *c;
+	const EVP_MD *md;
 	int num;
 
 	if (!ssl_cipher_get_evp(s->session,&c,&md,NULL))
diff --git a/ssl/s2_lib.c b/ssl/s2_lib.c
index e7581313c9..7241ea2cf9 100644
--- a/ssl/s2_lib.c
+++ b/ssl/s2_lib.c
@@ -67,7 +67,7 @@ static long ssl2_default_timeout(void );
 static long ssl2_default_timeout();
 #endif
 
-char *ssl2_version_str="SSLv2" OPENSSL_VERSION_PTEXT;
+const char *ssl2_version_str="SSLv2" OPENSSL_VERSION_PTEXT;
 
 #define SSL2_NUM_CIPHERS (sizeof(ssl2_ciphers)/sizeof(SSL_CIPHER))
 
diff --git a/ssl/s2_pkt.c b/ssl/s2_pkt.c
index 96d9a1be55..e1b13ccf65 100644
--- a/ssl/s2_pkt.c
+++ b/ssl/s2_pkt.c
@@ -567,7 +567,7 @@ unsigned int len;
 
 	/* lets try to actually write the data */
 	s->s2->wpend_tot=olen;
-	s->s2->wpend_buf=(char *)buf;
+	s->s2->wpend_buf=buf;
 
 	s->s2->wpend_ret=len;
 
diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c
index 930a47d4d3..c058b522bc 100644
--- a/ssl/s2_srvr.c
+++ b/ssl/s2_srvr.c
@@ -340,8 +340,8 @@ SSL *s;
 	int export,i,n,keya,ek;
 	unsigned char *p;
 	SSL_CIPHER *cp;
-	EVP_CIPHER *c;
-	EVP_MD *md;
+	const EVP_CIPHER *c;
+	const EVP_MD *md;
 
 	p=(unsigned char *)s->init_buf->data;
 	if (s->state == SSL2_ST_GET_CLIENT_MASTER_KEY_A)
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index d79d9272d6..d1341af178 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -135,9 +135,9 @@ int which;
 	unsigned char exp_iv[EVP_MAX_KEY_LENGTH];
 	unsigned char *ms,*key,*iv,*er1,*er2;
 	EVP_CIPHER_CTX *dd;
-	EVP_CIPHER *c;
+	const EVP_CIPHER *c;
 	COMP_METHOD *comp;
-	EVP_MD *m;
+	const EVP_MD *m;
 	MD5_CTX md;
 	int exp,n,i,j,k,cl;
 
@@ -282,8 +282,8 @@ int ssl3_setup_key_block(s)
 SSL *s;
 	{
 	unsigned char *p;
-	EVP_CIPHER *c;
-	EVP_MD *hash;
+	const EVP_CIPHER *c;
+	const EVP_MD *hash;
 	int num;
 	SSL_COMP *comp;
 
@@ -340,7 +340,7 @@ int send;
 	EVP_CIPHER_CTX *ds;
 	unsigned long l;
 	int bs,i;
-	EVP_CIPHER *enc;
+	const EVP_CIPHER *enc;
 
 	if (send)
 		{
@@ -411,7 +411,7 @@ SSL *s;
 
 void ssl3_finish_mac(s,buf,len)
 SSL *s;
-unsigned char *buf;
+const unsigned char *buf;
 int len;
 	{
 	EVP_DigestUpdate(&(s->s3->finish_dgst1),buf,len);
@@ -486,7 +486,7 @@ int send;
 	SSL3_RECORD *rec;
 	unsigned char *mac_sec,*seq;
 	EVP_MD_CTX md_ctx;
-	EVP_MD *hash;
+	const EVP_MD *hash;
 	unsigned char *p,rec_char;
 	unsigned int md_size;
 	int npad,i;
@@ -541,10 +541,10 @@ unsigned char *out;
 unsigned char *p;
 int len;
 	{
-	static unsigned char *salt[3]={
-		(unsigned char *)"A",
-		(unsigned char *)"BB",
-		(unsigned char *)"CCC",
+	static const unsigned char *salt[3]={
+		(const unsigned char *)"A",
+		(const unsigned char *)"BB",
+		(const unsigned char *)"CCC",
 		};
 	unsigned char buf[EVP_MAX_MD_SIZE];
 	EVP_MD_CTX ctx;
@@ -554,7 +554,7 @@ int len;
 	for (i=0; i<3; i++)
 		{
 		EVP_DigestInit(&ctx,s->ctx->sha1);
-		EVP_DigestUpdate(&ctx,salt[i],strlen((char *)salt[i]));
+		EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i]));
 		EVP_DigestUpdate(&ctx,p,len);
 		EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]),
 			SSL3_RANDOM_SIZE);
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index ab0d012b38..444e554c27 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -60,7 +60,7 @@
 #include "objects.h"
 #include "ssl_locl.h"
 
-char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT;
+const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT;
 
 #define SSL3_NUM_CIPHERS	(sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 
@@ -1039,7 +1039,7 @@ int len;
 		if (s->s3->delay_buf_pop_ret == 0)
 			{
 			ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-				(char *)buf,len);
+					     buf,len);
 			if (ret <= 0) return(ret);
 
 			s->s3->delay_buf_pop_ret=ret;
@@ -1060,7 +1060,7 @@ int len;
 	else
 		{
 		ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-			(char *)buf,len);
+				     buf,len);
 		if (ret <= 0) return(ret);
 		}
 
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index f5350bf1b7..6b1addc6ac 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -94,8 +94,9 @@
  */
 
 #ifndef NOPROTO
-static int do_ssl3_write(SSL *s, int type, char *buf, unsigned int len);
-static int ssl3_write_pending(SSL *s, int type, char *buf, unsigned int len);
+static int do_ssl3_write(SSL *s, int type, const char *buf, unsigned int len);
+static int ssl3_write_pending(SSL *s, int type, const char *buf,
+			      unsigned int len);
 static int ssl3_get_record(SSL *s);
 static int do_compress(SSL *ssl);
 static int do_uncompress(SSL *ssl);
@@ -477,7 +478,7 @@ SSL *ssl;
 int ssl3_write_bytes(s,type,buf,len)
 SSL *s;
 int type;
-char *buf;
+const char *buf;
 int len;
 	{
 	unsigned int tot,n,nw;
@@ -514,7 +515,7 @@ int len;
 			}
 
 		if (type == SSL3_RT_HANDSHAKE)
-			ssl3_finish_mac(s,(unsigned char *)&(buf[tot]),i);
+			ssl3_finish_mac(s,&(buf[tot]),i);
 
 		if (i == (int)n) return(tot+i);
 
@@ -526,7 +527,7 @@ int len;
 static int do_ssl3_write(s,type,buf,len)
 SSL *s;
 int type;
-char *buf;
+const char *buf;
 unsigned int len;
 	{
 	unsigned char *p,*plen;
@@ -644,7 +645,7 @@ err:
 static int ssl3_write_pending(s,type,buf,len)
 SSL *s;
 int type;
-char *buf;
+const char *buf;
 unsigned int len;
 	{
 	int i;
@@ -975,7 +976,7 @@ start:
 		}
 
 	if (type == SSL3_RT_HANDSHAKE)
-		ssl3_finish_mac(s,(unsigned char *)buf,n);
+		ssl3_finish_mac(s,buf,n);
 	return(n);
 f_err:
 	ssl3_send_alert(s,SSL3_AL_FATAL,al);
diff --git a/ssl/ssl.h b/ssl/ssl.h
index bea99a7769..4329d29ef0 100644
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -162,7 +162,7 @@ typedef struct ssl_st *ssl_crock_st;
 typedef struct ssl_cipher_st
 	{
 	int valid;
-	char *name;			/* text name */
+	const char *name;		/* text name */
 	unsigned long id;		/* id, 4 bytes, first is version */
 	unsigned long algorithms;	/* what ciphers are used */
 	unsigned long algorithm2;	/* Extra flags */
@@ -416,9 +416,9 @@ struct ssl_ctx_st
 
 	CRYPTO_EX_DATA ex_data;
 
-	EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */
-	EVP_MD *md5;	/* For SSLv3/TLSv1 'ssl3-md5' */
-	EVP_MD *sha1;   /* For SSLv3/TLSv1 'ssl3->sha1' */
+	const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */
+	const EVP_MD *md5;	/* For SSLv3/TLSv1 'ssl3-md5' */
+	const EVP_MD *sha1;   /* For SSLv3/TLSv1 'ssl3->sha1' */
 
 	STACK_OF(X509) *extra_certs;
         STACK_OF(SSL_COMP) *comp_methods; /* stack of SSL_COMP, SSLv3/TLSv1 */
@@ -546,7 +546,7 @@ struct ssl_st
 	 * the ones to be 'copied' into these ones */
 
 	EVP_CIPHER_CTX *enc_read_ctx;		/* cryptographic state */
-	EVP_MD *read_hash;			/* used for mac generation */
+	const EVP_MD *read_hash;		/* used for mac generation */
 #ifdef HEADER_COMP_H
 	COMP_CTX *expand;			/* uncompress */
 #else
@@ -554,7 +554,7 @@ struct ssl_st
 #endif
 
 	EVP_CIPHER_CTX *enc_write_ctx;		/* cryptographic state */
-	EVP_MD *write_hash;			/* used for mac generation */
+	const EVP_MD *write_hash;		/* used for mac generation */
 #ifdef HEADER_COMP_H
 	COMP_CTX *compress;			/* compression */
 #else
@@ -837,10 +837,10 @@ void	SSL_CTX_flush_sessions(SSL_CTX *ctx,long tm);
 SSL_CIPHER *SSL_get_current_cipher(SSL *s);
 int	SSL_CIPHER_get_bits(SSL_CIPHER *c,int *alg_bits);
 char *	SSL_CIPHER_get_version(SSL_CIPHER *c);
-char *	SSL_CIPHER_get_name(SSL_CIPHER *c);
+const char *	SSL_CIPHER_get_name(SSL_CIPHER *c);
 
 int	SSL_get_fd(SSL *s);
-char  * SSL_get_cipher_list(SSL *s,int n);
+const char  * SSL_get_cipher_list(SSL *s,int n);
 char *	SSL_get_shared_ciphers(SSL *s, char *buf, int len);
 int	SSL_get_read_ahead(SSL * s);
 int	SSL_pending(SSL *s);
diff --git a/ssl/ssl2.h b/ssl/ssl2.h
index 95e8231dfc..4d75e93740 100644
--- a/ssl/ssl2.h
+++ b/ssl/ssl2.h
@@ -162,7 +162,7 @@ typedef struct ssl2_ctx_st
 	 * args were passwd */
 	unsigned int wnum;	/* number of bytes sent so far */
 	int wpend_tot;
-	char *wpend_buf;
+	const char *wpend_buf;
 
 	int wpend_off;	/* offset to data to write */
 	int wpend_len; 	/* number of bytes passwd to write */
diff --git a/ssl/ssl3.h b/ssl/ssl3.h
index d334c90c3d..cf34e978f1 100644
--- a/ssl/ssl3.h
+++ b/ssl/ssl3.h
@@ -286,7 +286,7 @@ typedef struct ssl3_ctx_st
 	int wpend_tot;		/* number bytes written */
 	int wpend_type;
 	int wpend_ret;		/* number of bytes submitted */
-	char *wpend_buf;
+	const char *wpend_buf;
 
 	/* used during startup, digest all incoming/outgoing packets */
 	EVP_MD_CTX finish_dgst1;
@@ -338,10 +338,10 @@ typedef struct ssl3_ctx_st
 		int key_block_length;
 		unsigned char *key_block;
 
-		EVP_CIPHER *new_sym_enc;
-		EVP_MD *new_hash;
+		const EVP_CIPHER *new_sym_enc;
+		const EVP_MD *new_hash;
 #ifdef HEADER_COMP_H
-		SSL_COMP *new_compression;
+		const SSL_COMP *new_compression;
 #else
 		char *new_compression;
 #endif
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index f53d688d89..2b95ee6aff 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -70,7 +70,7 @@
 #define SSL_ENC_NULL_IDX	6
 #define SSL_ENC_NUM_IDX		7
 
-static EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
+static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
 	NULL,NULL,NULL,NULL,NULL,NULL,
 	};
 
@@ -79,7 +79,7 @@ static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
 #define SSL_MD_MD5_IDX	0
 #define SSL_MD_SHA1_IDX	1
 #define SSL_MD_NUM_IDX	2
-static EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
+static const EVP_MD *ssl_digest_methods[SSL_MD_NUM_IDX]={
 	NULL,NULL,
 	};
 
@@ -187,8 +187,8 @@ static void load_ciphers()
 
 int ssl_cipher_get_evp(s,enc,md,comp)
 SSL_SESSION *s;
-EVP_CIPHER **enc;
-EVP_MD **md;
+const EVP_CIPHER **enc;
+const EVP_MD **md;
 SSL_COMP **comp;
 	{
 	int i;
@@ -750,7 +750,7 @@ SSL_CIPHER *c;
 	}
 
 /* return the actual cipher being used */
-char *SSL_CIPHER_get_name(c)
+const char *SSL_CIPHER_get_name(c)
 SSL_CIPHER *c;
 	{
 	if (c != NULL)
@@ -764,8 +764,8 @@ SSL_CIPHER *c;
 int *alg_bits;
 	{
 	int ret=0,a=0;
-	EVP_CIPHER *enc;
-	EVP_MD *md;
+	const EVP_CIPHER *enc;
+	const EVP_MD *md;
 	SSL_SESSION ss;
 
 	if (c != NULL)
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 566d112d07..2fad1c32c3 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -736,7 +736,7 @@ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
 	}
 
 /** The old interface to get the same thing as SSL_get_ciphers() */
-char *SSL_get_cipher_list(SSL *s,int n)
+const char *SSL_get_cipher_list(SSL *s,int n)
 	{
 	SSL_CIPHER *c;
 	STACK_OF(SSL_CIPHER) *sk;
@@ -775,7 +775,8 @@ int SSL_set_cipher_list(SSL *s,char *str)
 /* works well for SSLv2, not so good for SSLv3 */
 char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
 	{
-	char *p,*cp;
+	char *p;
+	const char *cp;
 	STACK_OF(SSL_CIPHER) *sk;
 	SSL_CIPHER *c;
 	int i;
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index a29994b1e1..870dcf27de 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -367,8 +367,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_METHOD *meth,
 					     STACK_OF(SSL_CIPHER) **sorted,
 					     char *str);
 void ssl_update_cache(SSL *s, int mode);
-int ssl_cipher_get_evp(SSL_SESSION *s, EVP_CIPHER **enc, EVP_MD **md,
-	SSL_COMP **comp);
+int ssl_cipher_get_evp(SSL_SESSION *s,const EVP_CIPHER **enc,const EVP_MD **md,
+		       SSL_COMP **comp);
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_undefined_function(SSL *s);
 X509 *ssl_get_server_send_cert(SSL *);
@@ -427,11 +427,11 @@ int ssl3_renegotiate_check(SSL *ssl);
 int ssl3_dispatch_alert(SSL *s);
 int ssl3_read_bytes(SSL *s, int type, char *buf, int len);
 int ssl3_part_read(SSL *s, int i);
-int ssl3_write_bytes(SSL *s, int type, char *buf, int len);
+int ssl3_write_bytes(SSL *s, int type, const char *buf, int len);
 int ssl3_final_finish_mac(SSL *s, EVP_MD_CTX *ctx1,EVP_MD_CTX *ctx2,
 	unsigned char *sender, int slen,unsigned char *p);
 int ssl3_cert_verify_mac(SSL *s, EVP_MD_CTX *in, unsigned char *p);
-void ssl3_finish_mac(SSL *s, unsigned char *buf, int len);
+void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len);
 int ssl3_enc(SSL *s, int send_data);
 int ssl3_mac(SSL *ssl, unsigned char *md, int send_data);
 unsigned long ssl3_output_cert_chain(SSL *s, X509 *x);
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 0f5cbd326a..4e783c23a4 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -175,9 +175,9 @@ int which;
 	unsigned char *ms,*key,*iv,*er1,*er2;
 	int client_write;
 	EVP_CIPHER_CTX *dd;
-	EVP_CIPHER *c;
-	SSL_COMP *comp;
-	EVP_MD *m;
+	const EVP_CIPHER *c;
+	const SSL_COMP *comp;
+	const EVP_MD *m;
 	int _exp,n,i,j,k,exp_label_len,cl;
 
 	_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
@@ -346,8 +346,8 @@ int tls1_setup_key_block(s)
 SSL *s;
 	{
 	unsigned char *p1,*p2;
-	EVP_CIPHER *c;
-	EVP_MD *hash;
+	const EVP_CIPHER *c;
+	const EVP_MD *hash;
 	int num;
 	SSL_COMP *comp;
 
@@ -407,7 +407,7 @@ int send;
 	EVP_CIPHER_CTX *ds;
 	unsigned long l;
 	int bs,i,ii,j,k,n=0;
-	EVP_CIPHER *enc;
+	const EVP_CIPHER *enc;
 
 	if (send)
 		{
@@ -549,7 +549,7 @@ int send;
 	{
 	SSL3_RECORD *rec;
 	unsigned char *mac_sec,*seq;
-	EVP_MD *hash;
+	const EVP_MD *hash;
 	unsigned int md_size;
 	int i;
 	HMAC_CTX hmac;